Towards Unbounded Machine Unlearning

TL;DR

This work tackles deep machine unlearning by proposing SCRUB, a scalable teacher-student framework that selectively forgets data while preserving retained knowledge. SCRUB optimizes to maximize forgetting on the forget set and minimize impact on retained data, with a practical rewinding variant (SCRUB+R) to balance privacy and utility. It unifies three applications—removing biases, resolving label confusion, and user privacy—by evaluating across diverse metrics and datasets, and it introduces a LiRA-adapted MIA to assess privacy defenses. Empirically, SCRUB consistently outperforms baselines in forgetting quality and utility, offering a practical, scalable solution with strong defense against membership inference attacks, while acknowledging the need for formal guarantees and broader scalability in future work.

Abstract

Deep machine unlearning is the problem of `removing' from a trained neural network a subset of its training set. This problem is very timely and has many applications, including the key tasks of removing biases (RB), resolving confusion (RC) (caused by mislabelled data in trained models), as well as allowing users to exercise their `right to be forgotten' to protect User Privacy (UP). This paper is the first, to our knowledge, to study unlearning for different applications (RB, RC, UP), with the view that each has its own desiderata, definitions for `forgetting' and associated metrics for forget quality. For UP, we propose a novel adaptation of a strong Membership Inference Attack for unlearning. We also propose SCRUB, a novel unlearning algorithm, which is the only method that is consistently a top performer for forget quality across the different application-dependent metrics for RB, RC, and UP. At the same time, SCRUB is also consistently a top performer on metrics that measure model utility (i.e. accuracy on retained data and generalization), and is more efficient than previous work. The above are substantiated through a comprehensive empirical evaluation against previous state-of-the-art.

Figures (13)

• Figure 1: RB results: SCRUB is the only consistent top-performer in terms of forgetting and preserving utility. It is also highly efficient: second only to Bad-T which, however, fails at forgetting and damages utility. In all subfigures, each point represents the average across ResNet and All-CNN variants. For large-scale results, we also compute the scale-up factor: the fraction of the runtime of retraining from scratch over the runtime of the given unlearning algorithm (multiplied by 5 here, for visualization purposes). We find that selective unlearning is harder for all methods, especially for EU-k and Fisher (see Figure \ref{['fig:cifar10-class-spider']} vs \ref{['fig:cifar10-selective-spider']}). CF-k and Finetuning perform similarly (they perform poorly) in all cases, so their lines occlude one another. Complete tables are in the Appendix.
• Figure 2: The number of times each method was a top performer in forgetting in RB-application. A model is a top-performer if its 95% confidence interval overlaps with that of the best mean. Small-scale counts are over {ResNet, All-CNN} x {CIFAR, Lacuna} (4 total), large-scale additionally x {class, selective} (8 total). SCRUB is the most consistent top-performer.
• Figure 3: MIA results for different sizes of forget set on CIFAR-10 with ResNet. Error bars show 95% confidence intervals. Rewinding is most useful for smaller forget sizes (see the discussion in Section \ref{['sec:mia_results']}). SCRUB+R successfully defends MIAs, comparably to the Retrain oracle.
• Figure 4: ROC curves for the strong LiRA-for-unlearning attack (Area Under the Curve (AUC) is also reported in the legend, for each unlearning method). Different subplots correspond to different target models (we trained the target unlearned model 5 times for each unlearning method, using different random seeds, and different forget sets). Positives are examples in the forget set, and negatives in the test set. A true positive means that the attacker correctly identified that an example was forgotten, whereas a false positive means that it incorrectly predicted that a test example was forgotten. We are primarily interested in the area of small False Positive Rate carlini2022membership and a good unlearning method is associated with a smaller True Positive Rate, i.e. fewer successes for the attacker, especially in the region of interest. We observe that SCRUB(+R) defends the strong LiRA-for-unlearning attack more successfully than the other baselines.
• Figure 5: Sensitivity of SCRUB to $\gamma$ and $\alpha$. To create this plot, we ran SCRUB many times for different values of $\gamma$ ([0.1, 0.5, 1, 2, 3]) and $\alpha$ ([0.1, 0.5, 1, 2, 3]). The x-axis is represents combinations of these values. t-error, f-error and r-error refer to test, forget and retain error, respectively. We find that SCRUB is not very sensitive to these hyperparameters: the retain error remains low across values, and there are several different settings to these hyperparameters for which we can obtain the desired results for test and forget errors too.