Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

EVE: Efficient Verification of Data Erasure through Customized Perturbation in Approximate Unlearning

Weiqi Wang, Zhiyi Tian, Chenhan Zhang, Luoyu Chen, Shui Yu

TL;DR

This work addresses the challenge of verifying machine unlearning without access to the model's initial training. It introduces EVE, a training-free method that perturbs unlearning data to embed a verification signal, then uses gradient-alignment and a statistical hypothesis test to certify that the unlearning operation occurred. Empirical results across multiple datasets and unlearning algorithms show that EVE achieves perfect verifiability with substantial efficiency gains over backdoor-based baselines, while preserving user-model utility. The approach has practical impact for MLaaS and other settings where data erasure requests must be verified quickly and reliably.

Abstract

Verifying whether the machine unlearning process has been properly executed is critical but remains underexplored. Some existing approaches propose unlearning verification methods based on backdooring techniques. However, these methods typically require participation in the model's initial training phase to backdoor the model for later verification, which is inefficient and impractical. In this paper, we propose an efficient verification of erasure method (EVE) for verifying machine unlearning without requiring involvement in the model's initial training process. The core idea is to perturb the unlearning data to ensure the model prediction of the specified samples will change before and after unlearning with perturbed data. The unlearning users can leverage the observation of the changes as a verification signal. Specifically, the perturbations are designed with two key objectives: ensuring the unlearning effect and altering the unlearned model's prediction of target samples. We formalize the perturbation generation as an adversarial optimization problem, solving it by aligning the unlearning gradient with the gradient of boundary change for target samples. We conducted extensive experiments, and the results show that EVE can verify machine unlearning without involving the model's initial training process, unlike backdoor-based methods. Moreover, EVE significantly outperforms state-of-the-art unlearning verification methods, offering significant speedup in efficiency while enhancing verification accuracy. The source code of EVE is released at \uline{https://anonymous.4open.science/r/EVE-C143}, providing a novel tool for verification of machine unlearning.

EVE: Efficient Verification of Data Erasure through Customized Perturbation in Approximate Unlearning

TL;DR

This work addresses the challenge of verifying machine unlearning without access to the model's initial training. It introduces EVE, a training-free method that perturbs unlearning data to embed a verification signal, then uses gradient-alignment and a statistical hypothesis test to certify that the unlearning operation occurred. Empirical results across multiple datasets and unlearning algorithms show that EVE achieves perfect verifiability with substantial efficiency gains over backdoor-based baselines, while preserving user-model utility. The approach has practical impact for MLaaS and other settings where data erasure requests must be verified quickly and reliably.

Abstract

Verifying whether the machine unlearning process has been properly executed is critical but remains underexplored. Some existing approaches propose unlearning verification methods based on backdooring techniques. However, these methods typically require participation in the model's initial training phase to backdoor the model for later verification, which is inefficient and impractical. In this paper, we propose an efficient verification of erasure method (EVE) for verifying machine unlearning without requiring involvement in the model's initial training process. The core idea is to perturb the unlearning data to ensure the model prediction of the specified samples will change before and after unlearning with perturbed data. The unlearning users can leverage the observation of the changes as a verification signal. Specifically, the perturbations are designed with two key objectives: ensuring the unlearning effect and altering the unlearned model's prediction of target samples. We formalize the perturbation generation as an adversarial optimization problem, solving it by aligning the unlearning gradient with the gradient of boundary change for target samples. We conducted extensive experiments, and the results show that EVE can verify machine unlearning without involving the model's initial training process, unlike backdoor-based methods. Moreover, EVE significantly outperforms state-of-the-art unlearning verification methods, offering significant speedup in efficiency while enhancing verification accuracy. The source code of EVE is released at \uline{https://anonymous.4open.science/r/EVE-C143}, providing a novel tool for verification of machine unlearning.
Paper Structure (21 sections, 2 theorems, 6 equations, 7 figures, 4 tables, 1 algorithm)

This paper contains 21 sections, 2 theorems, 6 equations, 7 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Threat Model and Problem Statement
  4. MLaaS Scenario and Threat Model
  5. Data Erasure Verification Problem in Machine Unlearning
  6. EVE: Efficient Verification of Data Erasure
  7. Overview of the EVE Method
  8. Customized Perturbation for Unlearning Data
  9. Unlearning Verification
  10. Performance Evaluation
  11. Experimental Settings
  12. Overview Evaluation of EVE
  13. Evaluations of Verification on Various Unlearning Methods
  14. Scalability of Verification Methods on Various $\text{\it ESR}$
  15. Ablation Study of Perturbation Distance
  16. ...and 6 more sections

Key Result

Theorem 1

Given a target model $f(\cdot)$ in a classification task with $K$ classes, and $m$ queries to $f(\cdot)$, if the model's misprediction probability $\alpha$ for the target sample $f(x_t) \neq y_{t}$ satisfies the following formula: the unlearning user can reject the null hypothesis $\mathcal{H}_{0}$ at significance level $1- \tau$, where $\beta = \frac{K-1}{K}$ is the expected misprediction proba

Figures (7)

  • Figure 1: (a) The backdoor-based verification and (b) the intuition of efficient verification of erasure (EVE) based on the perturbed unlearning data. The scheme only involves the unlearning process rather than the original model training process.
  • Figure 2: An example of the idea of our method. a) A trained robust model can correctly predict the genuine unlearned and target model-unseen samples with high probability. b) Our method customizes perturbation for the erased data for unlearning, aiming to make the unlearned model easily misclassify the unseen data after unlearning. c) The unlearning user queries for specified samples to verify if the unlearned model is influenced by the perturbation.
  • Figure 3: Data erasure verification for different unlearning methods.
  • Figure 4: Efficiency impacted by different $\text{\it ESR}$.
  • Figure 5: Evaluations of impact about different $\text{\it ESR}$.
  • ...and 2 more figures

Theorems & Definitions (2)

  • Theorem 1
  • Theorem 1