ZK-APEX: Zero-Knowledge Approximate Personalized Unlearning with Executable Proofs

TL;DR

ZK APEX is a zero-knowledge, lightweight method for personalized model unlearning that verifies data removal without retraining, maintaining accuracy and privacy on edge devices.

Contribution

It introduces a novel zero-knowledge proof-based framework for efficient, verifiable personalized unlearning directly on models without retraining.

Findings

Nearly complete accuracy recovery on Vision Transformer tasks.

Achieves around 70% accuracy recovery on OPT125M model.

Proof generation is over ten million times faster than retraining.

Abstract

Machine unlearning aims to remove the influence of specific data points from a trained model to satisfy privacy, copyright, and safety requirements. In real deployments, providers distribute a global model to many edge devices, where each client personalizes the model using private data. When a deletion request is issued, clients may ignore it or falsely claim compliance, and providers cannot check their parameters or data. This makes verification difficult, especially because personalized models must forget the targeted samples while preserving local utility, and verification must remain lightweight on edge devices. We introduce ZK APEX, a zero-shot personalized unlearning method that operates directly on the personalized model without retraining. ZK APEX combines sparse masking on the provider side with a small Group OBS compensation step on the client side, using a blockwise empirical Fisher matrix to create a curvature-aware update designed for low overhead. Paired with Halo2 zero-knowledge proofs, it enables the provider to verify that the correct unlearning transformation was applied without revealing any private data or personalized parameters. On Vision Transformer classification tasks, ZK APEX recovers nearly all personalization accuracy while effectively removing the targeted information. Applied to the OPT125M generative model trained on code data, it recovers around seventy percent of the original accuracy. Proof generation for the ViT case completes in about two hours, more than ten million times faster than retraining-based checks, with less than one gigabyte of memory use and proof sizes around four hundred megabytes. These results show the first practical framework for verifiable personalized unlearning on edge devices.