Towards Adversarial Evaluations for Inexact Machine Unlearning

TL;DR

The paper addresses the privacy risk of memorization in deep networks by reframing machine unlearning as an inexact process and arguing that existing evaluation metrics are insufficient to ensure indistinguishability from retraining. It introduces the Interclass Confusion (IC) test, an adversarial, black-box evaluation that enforces a deletion-induced property (confusion between two classes) to expose memorization and generalized property leakage. To benchmark unlearning, the authors propose two simple baselines, EU-$k$ and CF-$k$, that scale to large deletion sets while enabling analysis of information flow across network layers. Empirical results show IC is more discriminative than prior tests, and that EU-$k$ and CF-$k$ outperform several baselines in forgetting effectiveness, utility, and efficiency, especially when original models are regularized. The work highlights practical avenues for stronger unlearning procedures and outlines open questions around passing scores for IC and broader applicability.

Abstract

Machine Learning models face increased concerns regarding the storage of personal user data and adverse impacts of corrupted data like backdoors or systematic bias. Machine Unlearning can address these by allowing post-hoc deletion of affected training data from a learned model. Achieving this task exactly is computationally expensive; consequently, recent works have proposed inexact unlearning algorithms to solve this approximately as well as evaluation methods to test the effectiveness of these algorithms. In this work, we first outline some necessary criteria for evaluation methods and show no existing evaluation satisfies them all. Then, we design a stronger black-box evaluation method called the Interclass Confusion (IC) test which adversarially manipulates data during training to detect the insufficiency of unlearning procedures. We also propose two analytically motivated baseline methods~(EU-k and CF-k) which outperform several popular inexact unlearning methods. Overall, we demonstrate how adversarial evaluation strategies can help in analyzing various unlearning phenomena which can guide the development of stronger unlearning algorithms.

Figures (11)

• Figure 1: IC Test Pipeline: We mislabel a subset of samples from two classes of the original dataset, forming $S_f$. Here, shape and colour represent the actual and labelled class respectively. Then, $M$ and $M_r$ are obtained by training from scratch on $S$ and $S \setminus S_f$ respectively. The unlearning procedure can leverage (some of) $M$, $S_f$ and $S \setminus S_f$ to produce the unlearnt model $M_u$.
• Figure 2: Error, MIA for various deletion strategies (Y) reported across the number of layers (X) affected by the unlearning procedure. The left-most points at 0 layers represent the original model $M$, whereas the right-most points at 110 layers represent the retrained model $M_r^T$. Only Interclass Confusion reliably distinguishes different degrees of unlearning (no. of layers unlearnt) across all graphs.
• Figure 3: Interclass Confusion Targeted Error (Y) on unlearning from original models with different regularization (bar colors) reported for the original model $M$, EU-$10$, EU-$50$, and retrained model $M_r^t$. The same unlearning procedure can remove more confusion when starting from better regularized original models.
• Figure 4: Hyperbolic deterioration of efficiency in isolation-based unlearning when scaling to a large number of removed samples. In this work, we analyze $|S_f|$ from 100-4000 where $\mathbb{E}[Y] \sim 1$.
• Figure 5: Logistic growth of the probability of needing to retrain all portions with increasing deletion set size. We represent isolation strategies with different portion sizes $P$.

Theorems & Definitions (2)

• Theorem 1
• proof