Knowledge Unlearning for Mitigating Privacy Risks in Language Models
Year: 2023

Abstract:
Pretrained Language Models (LMs) memorize a vast amount of knowledge during initial pretraining, including information that may violate the privacy of personal lives and identities. Previous work addressing privacy issues for LMs has mostly focused on data preprocessing and differential privacy methods, both requiring re-training the underlying LM. We propose knowledge unlearning as an alternative method to reduce privacy risks for LMs post hoc. We show that simply performing gradient ascent on target token sequences is effective at forgetting them with little to no degradation of general language modeling performances for larger-sized LMs. We also find that sequential unlearning is better than trying to unlearn all the data at once and that unlearning is highly dependent on which kind of data (domain) is forgotten. By showing comparisons with previous methods known to mitigate privacy risks for LMs, we show that our approach can give a stronger empirical privacy guarantee in scenarios where the data vulnerable to extraction attacks are known a priori while being much more efficient and robust 1.

heading: Future Work
text: Since it is inherently impossible to prevent and predict all future privacy concerns prior to pretraining the LM, we suggest the community consider knowledge unlearning for ensuring privacy upon individuals’ requests post hoc pretraining. 6 Limitations
While we provide a privacy guarantee through unlearning, our Forgetting Threshold is dependent on which data samples are chosen as D′. Furthermore, varying the prefix length can be seen as a naïve way of varying the strength of the extraction attacks. In a real-world scenario, extraction attacks may be more complicated and may require other prevention methods. Also, we could not directly compare our approach with a Differential Privacy (DP) (Anil et al. , 2021) approach because there are no open-sourced LMs pretrained with a DP algorithm. We could not replicate the pretrainig phase because of the heavy computational resources needed to pretrain an LM with DP which is estimated to require thousands of GPU hours. We leave this comparison for future work. Finally, a recent work (Carlini et al. , 2022b) has suggested that machine unlearning (for the vision domain) can bring negative effects harming the privacy of other users. Future work should explore this phenomenon in the setting of performing unlearning on large LMs as well