System-Aware Unlearning Algorithms: Use Lesser, Forget Faster

TL;DR

This paper introduces a system-aware unlearning framework that allows for more efficient model updates by assuming a less powerful attacker, and presents algorithms for linear classification and general functions.

Contribution

It proposes a new, less stringent unlearning definition tailored for system-aware attackers and develops algorithms that leverage this for improved efficiency.

Findings

Efficient unlearning algorithms for linear classifiers.

Tradeoffs between deletion capacity, accuracy, memory, and computation.

Theoretical analysis of system-aware unlearning benefits.

Abstract

Machine unlearning addresses the problem of updating a machine learning model/system trained on a dataset $S$ so that the influence of a set of deletion requests $U \subseteq S$ on the unlearned model is minimized. The gold standard definition of unlearning demands that the updated model, after deletion, be nearly identical to the model obtained by retraining. This definition is designed for a worst-case attacker (one who can recover not only the unlearned model but also the remaining data samples, i.e., $S \setminus U$). Such a stringent definition has made developing efficient unlearning algorithms challenging. However, such strong attackers are also unrealistic. In this work, we propose a new definition, system-aware unlearning, which aims to provide unlearning guarantees against an attacker that can at best only gain access to the data stored in the system for learning/unlearning requests and not all of $S\setminus U$. With this new definition, we use the simple intuition that if a system can store less to make its learning/unlearning updates, it can be more secure and update more efficiently against a system-aware attacker. Towards that end, we present an exact system-aware unlearning algorithm for linear classification using a selective sampling-based approach, and we generalize the method for classification with general function classes. We theoretically analyze the tradeoffs between deletion capacity, accuracy, memory, and computation time.