Towards Scalable Exact Machine Unlearning Using Parameter-Efficient Fine-Tuning

Authors: Somnath Basu Roy Chowdhury, Krzysztof Marcin Choromanski, Arijit Sehanobish, Kumar Avinava Dubey, Snigdha Chaturvedi
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Machine Unlearning, Data Deletion, Exact Unlearning

Abstract:
Machine unlearning is the process of efficiently removing the influence of a training data instance from a trained machine learning model without retraining it from scratch. A popular subclass of unlearning approaches is exact machine unlearning, which focuses on techniques that explicitly guarantee the removal of the influence of a data instance from a model.  Exact unlearning approaches use a machine learning model in which individual components are trained on disjoint subsets of the data. During deletion, exact unlearning approaches only retrain the affected components rather than the entire model. While existing approaches reduce retraining costs, it can still be expensive for an organization to retrain a model component as it requires halting a system in production, which leads to service failure and adversely impacts customers.  To address these challenges, we introduce an exact unlearning framework -- Sequence-aware Sharded Sliced Training  (S3T), which is designed to enhance the deletion capabilities of an exact unlearning system while minimizing the impact on model's performance. At the core of S3T, we utilize a lightweight parameter-efficient fine-tuning approach that enables parameter isolation by sequentially training layers with disjoint data slices. This enables efficient unlearning by simply deactivating the layers affected by data deletion. Furthermore, to reduce the retraining cost and improve model performance, we train the model on multiple data sequences, which allows S3T to handle an increased number of deletion requests. Both theoretically and empirically, we demonstrate that S3T attains superior deletion capabilities and enhanced performance compared to baselines across a wide range of settings.

Decision: accept (poster)
Reviewer scores: 5, 6, 8, 8

Reviews and discussion:
<thread>
creation date:
1730591442062

thread_type:
official_review

<thread_object>
creator: reviewer_masp

<content>
summary:
This paper presents a new framework for exact machine unlearning, called S$^3$T, inspired from SISA. S$^3$T leverages PEFT on disjoint shards of data. Different from SISA, S$^3$T sequentially trains PEFT layers following a slice sequence. By using multiple slice sequences, S$^3$T provides granular isolation and superior deletion capabilities, enhancing the deletion rate while maintaining good performance. The authors propose two algorithms to choose slice sequences, for uniform and non-uniform deletion priors. Extensive experiments and ablations on several vision and language benchmarks demonstrate the effectiveness of S$^3$T in comparison to SOTA baselines.

strengths:
- This is a well written paper.
- The paper focuses on a very relevant setting involving PEFT for unlearning. 
- Rethinking slicing from SISA into a layerwise training while leveraging PEFT is a clever design. It was interesting to see that such a design does not introduce significant trade-offs. 
- The experimental evaluation is extensive, spanning several datasets and model sizes. The authors cover all the important questions relevant to S$^3$T in their evaluations, including its training performance, deletion performance and ablation studies. The diversity and scale of experiments strengthens the contributions of the paper.
- The appendix discusses several important aspects of the work including storage costs, training time, design choices, etc. In particular, it was interesting to note why the top-down approach was chosen over a bottom-up approach.

weaknesses:
- Depending upon the model and the dataset, S$^3$T can result in lower training performance compared to full training. 
- No code is provided, however the authors promise to release it with the final version.

The paper can be further improved by adding a limitations section that could summarize all potential trade-offs and discussing future directions to improve the same. It would also be nice to see some performance numbers in the abstract itself, such as S$^3$T improves the deletion rate by $1.6\times$ over SISA.

questions:
1) Are results in Table 1 with B = 1? When B > 1, will using an ensemble of models across different slice sequences enhance performance?
2) On similar lines as the previous question, will using an ensemble of available models improve performance over just using the model trained on the maximum number of slices pertaining to a deletion request?
3) How does the net storage cost of S$^3$T compare to SISA when B > L and B < L?
4) The performance of ProtoSISA seems to be almost overlapping with SISA? Why is this so?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730665121195

thread_type:
official_review

<thread_object>
creator: reviewer_u5bx

<content>
summary:
The paper tackles machine unlearning,  the process of efficiently removing the influence of a specific training data instance from a machine learning model without retraining it entirely. There are two main types of unlearning: approximate and exact. This paper focuses on exact machine unlearning, a category that guarantees the complete removal of a data instance's influence from the model. Exact unlearning methods rely on training individual components of the model on distinct, disjoint subsets of the data.

The authors introduce a new framework for exact unlearning called Sequence-aware Sharded Sliced Training ($S^3T$). $S^3T$ is designed to improve the ability to delete data instances from a model while minimizing any negative impact on the model's overall performance. Both theoretical and empirical results show that $S^3T$ outperforms existing methods in terms of deletion capability and performance across a variety of scenarios.

The key innovation of the $S^3T$ framework is the use of additional offline training before the model is deployed, which significantly reduces retraining costs. The authors compare their approach with Sharded, Isolated, Sliced, and Aggregated (SISA) training. A major drawback of SISA is that if deletion requests target Slice 1 across all shards, the entire system becomes compromised, necessitating complete retraining. The S3T framework addresses this issue by introducing more robust deletion strategies.

Additionally, the authors use LoRa for slicewise training and present methods for selecting diverse permutations under budget constraints.

strengths:
- Theoretically shown that S3T achieves provably better deletion guarantees than existing approaches.

- Empirical results show that S3T is an effective method for fine-tuning Transformer models, enabling parameter isolation for data slices without compromising the model's performance.

weaknesses:
- The paper exhibits minor weaknesses due to lack of clarity and ambiguity; for detailed points, please refer to the questions provided.

questions:
- What does "Total time" refer to in Figure 9, and in which units is it measured?
- Could you elaborate on the setting where budget B < L?
- Could you explicitly provide answers to RQ2 and RQ3 in the text, similar to how RQ1 is addressed?
- In Figure 1, it’s unclear that the shards are disjoint—can you clarify this?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730732383722

thread_type:
official_review

<thread_object>
creator: reviewer_tctf

<content>
summary:
This paper proposes S3T, a new solution for machine unlearning. Different from Shared, Isolated, Sliced, and Aggregated training (SISA) techniques, S3T allows isolation between parameters by sequentially training model layers using disjoint data slices. S3T trains the pre-trained model multiple times with different training orders to avoid re-training from scratch. The experimental results show that S3T can effectively reduce the re-training parameters after receiving the deletion request, compared with SISA methods.

strengths:
++ This paper points out a strong limitation of current SISA-based machine unlearning methods: the deletion request of the bottom slices will lead to retraining all the above slices. S3T’s solution effectively reduces the re-training time cost.

++ The LoRA-based training solution makes S3T practical in application as it is compatible with many Transformer-Based models, including small and large models. 

++ The theoretical analysis of S3T’s deletion rate and performance retention metrics is rigorous. 

++ The writings and figures of the paper are easy to follow.

weaknesses:
-- In Section 2, the paper claims that “approximate unlearning techniques… may have weak privacy guarantees in practice.” However, it does not explain whether S3T has a stronger privacy guarantee mechanism.

-- Although S3T outperforms other SISA-based methods, it significantly increases the training burden of the model providers (Even after applying the permutation-tree-based method, S3T still requires training the same model multiple times). I think the paper should further explain whether it is worth increasing the training cost several times or even dozens of times to reduce the cost of re-training, especially in the context of training LLMs. 

-- The sequence-order selecting algorithm in Section 3.3 depends on the deletion rate of each slice. In other words, its performance is related to the distribution of each slice’s deletion request’s arrival probability. Therefore, In Section 4.2’s evaluation, the uniform deletion prior over all slices may not be enough to fully evaluate the algorithm’s performance.  The paper could conduct another experiment in which the slice’s arrival probability is more unpredictable.

questions:
Please refer to the comments in Weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730930055794

thread_type:
official_review

<thread_object>
creator: reviewer_lnan

<content>
summary:
This paper presents a machine unlearning framework using parameter-efficient fine-tuning. The approach integrates LoRA-based adapters into the layers of pre-trained networks, which can be trained sequentially or using sequence selection algorithm like BMS. When a data deletion request is made, the associated LoRA parameters tied to the associated data shards are zeroed out, allowing deletions without full retraining. This technique hence enhances deletion efficiency while retaining overall model performance, even after handling multiple unlearning requests.

strengths:
The paper is well-written and easy to follow. The paper is well-written and easy to follow, with a clear explanation of the LoRA-based adapters’ role in isolating model layers for efficient data deletion Validation is performed on a diverse set of tasks and datasets, which strengthens the generalizability performance. The technique effectively handles deletion requests under high budgets, with minimal loss in generalizability.

weaknesses:
W1.	There are some concerns with the proposed top-to-bottom training strategy. First, since different layers are trained with varying data shards, this could cause performance degradation due to inconsistent data exposure across layers. The use of a pretrained base model might mask this potential degradation, as the presented performance relies on the ensemble of pretrained layers with LoRA adapters. It would be beneficial to see results when the model is trained from scratch to evaluate this strategy fully. Additionally, why does a bottom-to-top or other ordering not work well? Some theoretical justification for the chosen order would be helpful.

W2.	It is unclear whether PEFT is essential to this approach or primarily used for computational savings. Could similar outcomes be achieved with additional classification heads or adapters? A discussion on whether PEFT is integral to the technique would be great.

W3.	The novelty of the proposed technique is limited considering the use of off-the-shelf techniques like BMS and LORA to reduce the complexity. A comparison with several recent works like E2URec, Bad-T, NegGrad, NegKL, and RecEraser is missing. 

W4.	For a random deletion request unless it is for the slice associated with the final layer, the initial LORA parameters are using not participating for majority of the requests. This raises the question of whether the pretrained model’s representation power makes LoRA adapters in initial layers unnecessary. Any clarifications on this?

W5.	I am a bit confused for the implementation of the baseline SISA. Why the SISA models do not work in your implementation after 40 requests? (In the original paper, the performance does not even visibly drop for tens of deletion requests). It is also mentioned following Lemma 1 that considering real-world scenario, you do not allow retraining of model as originally proposed in SISA. It this is how it is implemented for comparison in the experimental section too? 

My score is based on the weaknesses mentioned above. Give clarifications, I am willing to raise my score.

questions:
1.	With higher deletion budgets, the deletion rate does not scale linearly. Would incorporating a retraining strategy improve this? Retraining is mentioned briefly, but further details on when it’s necessary and whether this decision is empirical or rule-based would be helpful.
2.	How does increasing the number of shards and slices impact model accuracy and storage requirements? An ablation study on this would add valuable insight.
3.	A comparison of S3T’s efficiency in terms of time or FLOPs against the baseline would clarify its computational advantages.
4.	In Figure 9, does the SISA baseline include retraining of models, or does it simply use the latest checkpoint? This clarification is necessary for a fair comparison.
5.	How does S3T’s storage requirement compare to SISA’s, particularly with frequent deletion requests?
</content>
</thread_object>

</thread>
<thread>
creation date:
1731905732307

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response

comment:
We thank the reviewers for taking the time to go through our paper and provide detailed feedback/suggestions. We have conducted additional experiments and revised the paper to address any concerns. Here is the summary of all the changes:


* We evaluate that our proposed layer-wise training approach is effective when performing full-finetuning of the layers.
* We conducted an experiment to evaluate the impact of the number of shards on the model performance.
* We added an explanation of why exact unlearning techniques provide stronger privacy guarantees in Section 2.
* We have added a new experiment to evaluate the deletion rate of $S^3$T when the deletion requests are sampled from a non-uniform prior (Appendix C.3). 
* We have updated Figure 1 and the corresponding caption in the draft.
* We have incorporated the conclusions of RQ2 and RQ3 in Section 4.2 and Section 4.3 respectively.
* We have provided several ablations of the baseline in Appendix C.3 (Baseline Ablations).
* We conducted experiments to evaluate the impact of using an ensemble of models trained on different slice sequences in Appendix C.3 (Ensemble of Slice Sequences).
* We have included a limitation and future directions section in Appendix D of the paper.
</content>
</thread_object>

</thread>


Metareview:
metareview:
This work proposes a method for exact unlearning that a relies on learning (and combining) multiple models on disjoint data shards. Learning of the models leverages parameter efficient fine-tuning to enable parameter isolation. The methodology is clearly described and positioned with respect to the state of the art. The authors produced compelling experimental evidence to validate the approach, suggesting strong performances. They also discussed the computational complexity of the method. Most reviewers voted for acceptance and all were satisfied with the clarifications provided by the authors during rebuttal.