Mirror Mirror on the Wall, Have I Forgotten it All? A New Framework for Evaluating Machine Unlearning

TL;DR

This paper introduces a formal framework called computational unlearning to evaluate machine unlearning methods, demonstrating that many existing approaches can be distinguished from retrained models, thus questioning their effectiveness.

Contribution

It proposes a rigorous definition of computational unlearning, analyzes the limitations of current unlearning methods, and explores the relationship with differential privacy, providing a foundation for future research.

Findings

Adversaries can distinguish unlearned models from retrained models using existing metrics.

Computational unlearning cannot be achieved by deterministic methods for entropic learning algorithms.

Differential privacy-based unlearning approaches require extreme utility trade-offs.

Abstract

Machine unlearning methods take a model trained on a dataset and a forget set, then attempt to produce a model as if it had only been trained on the examples not in the forget set. We empirically show that an adversary is able to distinguish between a mirror model (a control model produced by retraining without the data to forget) and a model produced by an unlearning method across representative unlearning methods from the literature. We build distinguishing algorithms based on evaluation scores in the literature (i.e. membership inference scores) and Kullback-Leibler divergence. We propose a strong formal definition for machine unlearning called computational unlearning. Computational unlearning is defined as the inability for an adversary to distinguish between a mirror model and a model produced by an unlearning method. If the adversary cannot guess better than random (except with negligible probability), then we say that an unlearning method achieves computational unlearning. Our computational unlearning definition provides theoretical structure to prove unlearning feasibility results. For example, our computational unlearning definition immediately implies that there are no deterministic computational unlearning methods for entropic learning algorithms. We also explore the relationship between differential privacy (DP)-based unlearning methods and computational unlearning, showing that DP-based approaches can satisfy computational unlearning at the cost of an extreme utility collapse. These results demonstrate that current methodology in the literature fundamentally falls short of achieving computational unlearning. We conclude by identifying several open questions for future work.