Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearning

TL;DR

The paper reframes MU evaluation by targeting worst-case forget sets via a bi-level optimization framework, aiming to maximize unlearning difficulty without sacrificing utility. By unrolling a lower-level unlearning process with signSGD and optimizing forget-set weights at the upper level, it provides a scalable approach to stress-test MU methods across vision and generation tasks. Empirical results show that worst-case forget sets reduce variance and reveal gaps in approximate MU methods, especially for relabeling-based strategies, while offering data-attribution and coreset insights. The work lays groundwork for robust MU evaluation and suggests curriculum-based strategies and broader applicability to class-wise and prompt-wise forgetting. ${}$

Abstract

The trustworthy machine learning (ML) community is increasingly recognizing the crucial need for models capable of selectively 'unlearning' data points after training. This leads to the problem of machine unlearning (MU), aiming to eliminate the influence of chosen data points on model performance, while still maintaining the model's utility post-unlearning. Despite various MU methods for data influence erasure, evaluations have largely focused on random data forgetting, ignoring the vital inquiry into which subset should be chosen to truly gauge the authenticity of unlearning performance. To tackle this issue, we introduce a new evaluative angle for MU from an adversarial viewpoint. We propose identifying the data subset that presents the most significant challenge for influence erasure, i.e., pinpointing the worst-case forget set. Utilizing a bi-level optimization principle, we amplify unlearning challenges at the upper optimization level to emulate worst-case scenarios, while simultaneously engaging in standard training and unlearning at the lower level, achieving a balance between data influence erasure and model utility. Our proposal offers a worst-case evaluation of MU's resilience and effectiveness. Through extensive experiments across different datasets (including CIFAR-10, 100, CelebA, Tiny ImageNet, and ImageNet) and models (including both image classifiers and generative models), we expose critical pros and cons in existing (approximate) unlearning strategies. Our results illuminate the complex challenges of MU in practice, guiding the future development of more accurate and robust unlearning algorithms. The code is available at https://github.com/OPTML-Group/Unlearn-WorstCase.

Figures (10)

• Figure 1: Overview of unlearning under our proposal (worst-case forget set) vs. random forget set. The data influence is difficult to remove under worst-case forget set vs. random forget set.
• Figure 2: Performance of Retrain and $\ell_1$-sparse unlearning under random and worst-case forgetting scenarios at different forgetting data ratios on (CIFAR-10, ResNet-18). Variance over 10 random selections is indicated by the shaded areas of the dashed lines.
• Figure 3: Performance of ResNet-18 trained on coresets of (a) CIFAR-10 and (b) CIFAR-100, determined by different approaches, including the complement of worst-case forget set (Worst), random select (Random), EL2N and GraNd, at varying coreset ratios. The dashed line represents the model's performance trained on the full dataset (Origin).
• Figure 4: Composition of the worst-case forget set under CelebA.
• Figure 5: Examples of image generation using the original SD model (w/o unlearning), the unlearned SD over the worst-case forgetting prompt set (Worst), and the unlearned SD over the random forget set (Random). For each diffusion model, images are generated based on two conditions, an unlearned prompt (${\text{$P_\text{u}^{(\text{w})}$}}$ or ${\text{$P_\text{u}^{(\text{r})}$}}$) and an unlearning-irrelevant normal prompt (${\text{$P_\text{n}$}}$). Here ${\text{$P_\text{u}^{(\text{w})}$}}$ and ${\text{$P_\text{u}^{(\text{r})}$}}$ indicate the prompt drawn from the worst-case forget set and the random forget set, respectively.