An Online Algorithm for Data Deletion
Anonymous Author(s)
AffiliationAddress email
Abstract
We study the problem of deleting user data from machine learning models trainedusing empirical risk minimization (ERM).
Our focus is on learning algorithmswhich return the empirical risk minimizer and approximate unlearning algorithmsthat comply with deletion requests that come in an online manner.
Leveragingthe infintesimal jacknife, we develop an online unlearning algorithm that is bothcomputationally and memory efficient.
Unlike prior memory efficient unlearning algorithms, we target ERM trained models that minimize objectives with non-smoothregularizers, such as the commonly used ℓ 1 , elastic net, or nuclear norm penalties.
We also provide generalization, deletion capacity, and unlearning guarantees thatare consistent with state of the art methods.
Across a variety of benchmark datasets,our algorithm empirically improves upon the runtime of prior methods while maintaining the same memory requirements and test accuracy.
Finally, we open a newdirection of inquiry by proving that all approximate unlearning algorithms introduced so far fail to unlearn in problem settings where common hyperparametertuning methods, such as cross-validation, have been used to select models.
Introduction
The right to be forgotten (RtbF) is considered a fundamental human right in many legal systems [27,21 , 5].
The proliferation of techniques that employ user data to do things such as training andvalidating machine learning across a variety of organizations has led to reconsideration of how tointerpret RtbF. The European Union’s General Data Protection Regulation (GDPR), California’s
Consumer Privacy Act (CCPA), and Canada’s proposed Consumer Privacy Protection Act (CPPA) areall examples of new pieces of legislation which attempt to codify the RtbF by requiring companiesand organizations to delete a user’s data by request [34].
But what does it mean to delete a user’s data?
User data, for example, can be recovered from trainedmachine learning models [31] and hyperparameter tuning procedures [25].
This suggests that data as well.
This interpretation is consistent with the Federal Trade Commission’s recent actionordering companies to delete the data from users who deleted their account as well as the models and algorithms derived from the users’ data [7].
Forcing organizations to comply with each deletionrequest by retraining, however, comes with potentially significant monetary and time costs.
Thus, itis worth asking if these costs can be managed while still maintaining model performance.
The cost concerns associated with RtbF compliance have prompted several recent works whichformalize and study the problem of unlearning [6].
The aim of these works is to develop techniqueswhich delete user data from models that are inexpensive in both computation and memory whilemaintaining reasonable performance.
Most unlearning algorithms proposed so far focus on unlearning models obtained via empirical risk minimization [14, 28, 4, 23, 20].
However, several of these methods are memory intensive [4, 15], requiring organizations to store several states of the model while training.
We build on recent works [14, 28] which show that for models derived from minimizing convex and sufficiently smooth ERM objectives, a Newton update to the current model can be appliedin order to approximately unlearn in certain data directions.
We show a different Newton estimatebased on the classical infinitesimal jacknife developed in the robust statistics literature [17, 10] results in a more computationally efficient unlearning algorithm in the online setting.
While thecurrent legislation only requires companies to satisfy delete requests in 30 days there are scenarioswhere immediate (online) delete requests are necessary such as the UK Biobank [12].
We also show how to utilize the proximal infinitesimal jackknife [35] to unlearn in settings when the model wastrained using an ERM objective that is not smooth.
Finally, we present an important and concerning failure mode of all approximate unlearning algorithms.
Our principal contributions are three-fold.
• Computationally efficient online algorithm.
We develop an online unlearning algorithm tounlearn a sequence of m datapoints from a model ˆ θ n ( λ ) that approximately minimizes a smoothand convex ERM objective that requires O ( d 2 ) storage and has running time
O ( md 2 ) .
Tounlearn m datapoints in an online manner, the algorithms developed in prior works (e
g. [14,28]) requires a similar storage, but have a longer O ( md 3 ) running time.
By avoiding thecost of computing and inverting a different Hessian at each deletion request we improve onthe computational requirements of previous memory efficient unlearning algorithms, whilemaintaining the same generalization, unlearning and deletion capacity guarantees.
We empiricallydemonstrate significant computational savings without sacrificing test set accuracy on multipledatasets.• Accommodating non-smooth regularizers.
We provide a generalization of our unlearning algorithm based on the proximal Newton method that can be used to efficiently delete data frommodels that minimize objective functions with non-smooth penalties.
We provide state-of-the artunlearning, deletion capacity and generalization guarantees for our new unlearning method.
Weempirically demonstrate significant computational savings without sacrificing test set accuracy inpredicting Warfarin dosages.• Failure modes.
Most data processing pipelines are not as simple as writing down an objectivefunction and running an algorithm out-of-the-box which returns the approximate empirical risk
minimizer.
A more common practice is to tune hyperparameters using techniques such as crossvalidation.
We reveal a fundamental limitation of all (approximate) data removal processes
developed so far when hyperparameter tuning takes place.
Related Work
Given the increasing concerns around privacy of user data, recent research on machine unlearningstudies how we can efficiently delete datapoints used to train models without retraining from scratch.
This work was first initiated by Cao and Yang [6] whose definition requires the outputs of anunlearning algorithm to be identical to the outputs of the model produced by retraining.
Since then,several works have provided different definitions of machine unlearning which can be separated asexact unlearning ([4, 32, 15, 11]) or approximate unlearning ([14, 28, 12, 9, 23]).
Our work is focused on satisfying approximate unlearning definitions inspired by differential privacy [9] defined by [14] as ( ϵ, δ ) -certified removal or by [28] as ( ϵ, δ ) -unlearning.
This definitionrequires the output distribution of the unlearning algorithm to be similar to that obtained by retrainingfrom scratch using the original training set with the requested datapoints removed from it.
Wefocus on this definition because algorithms for exact unlearning such as statistical query learning [6],
SISA [4], and its adaptive variant [15] have high computational and memory cost.
Prior algorithms developed for approximate unlearning use a variety of techniques: perturbed gradientdescent [23, 33], Newton style updates [14, 28], and projected residual updates [16].
The perturbed gradient descent and projected residual update methods provide theoretical error guarantees for theempirical training loss but fail to provide any generalization guarantees.
In addition, while thesemethods reduce the computation burden associated with exact unlearning, their high memory costsare still similar to exact unlearning methods.
Given these issues, Newton update unlearning algorithms were proposed to efficiently satisfy approximate unlearning.
Our work is closest to [14, 28] who use Newton updates to efficiently delete datafor generalized linear models.
Sekhari et al.
[28] improve upon Guo et al.
[14] in multiple ways: (i)by not requiring full access to the training dataset, providing (ii) generalization guarantees, and (iii)removing the requirement for randomization in the learning algorithm itself (which often reducesutility).
Yet the algorithm developed by [28] targets the batch setting which is unrealistic in practiceand they provide no empirical results demonstrating the efficacy of their algorithm.
If implemented inan online way, their algorithm would suffer a much larger computational cost given the requirement tocompute and invert a new Hessian for each delete request.
Finally, neither of these algorithms providetheoretical guarantees for the commonly used models that are obtained from objective functions withnon-smooth penalties.
We address several of these issues using the (proximal) infinitesimal jacknife [13, 17, 10].
Ouralgorithm can handle online delete requests selected in an adaptively adversarial manner (a failuremode of many previous algorithms pointed out by Gupta et al.
[15]) making it more practical forreal world use.
Furthermore, we provide generalization and deletion capacity guarantees similarto Sekhari et al.
[28] for both smooth and non-smooth regularizers.
To do so, we leverage similarguarantees found in approximate cross-validation literature [35].
Finally, inspired by recent workingshowing that hyperparameter tuning can leak user data [25] we demonstrate that all approximateunlearning algorithms introduced so far fail to unlearn in settings where hyperparameter tuning hastaken place to choose a model.
Methods and Results
Learning Consider the objective function comprised of a loss function ℓ , a regularizer π andregularization parameter λ ∈ Λ ⊆
[0 , ∞ ] .
The goal of learning is to find a parameter θ ∗ ( λ ) whichminimizes the population risk
[Equation]
Given the distribution D is often inaccessible, practitioners often instead find a model ˆ θ n ( λ ) which(at least approximately) minimizes the empirical risk
[Equation]
corresponding to a given dataset S
=
( z 1 , . . .
z n ) .
Unlearning Having used a dataset S to train and publish a model ˆ θ n ( λ ) , a set of m users in thetraining set U
⊂ S might request that their datapoints be deleted and that any models producedusing their data be removed.
To comply with this request, an organization might find the minimizerθ n, − U ( λ ) of the leave-
U -out objective
[Equation]
While reoptiminzing the leave-one-out objective from scratch constitutes a baseline for the problemof unlearning , the computational cost makes complying with every data delete request in this wayundesirable.
Training from scratch satisfies the notion of unlearning [28] formalized in Definition 1.
Definition 1 ( ( ϵ, δ ) -unlearning [28]) .
Let S be a fixed training set and A : S → θ be an algorithmthat trains on S and outputs a model θ ∈ Θ .
For an ϵ > 0 and set of delete requests U ⊆ S , we saythat a removal mechanism M is ( ϵ, δ ) -unlearning for learning algorithm
A
if ∀ T ⊆ Θ and S ⊆ Z ,the following two conditions are satisfied:
[Equation]
and
[Equation]
Finally, we point out that like most previously proposed unlearning algorithms, we do not require
T ( S ) to contain the entire training set, but instead propose unlearning algorithms for which T ( S ) isindependent of n .
3.1 Unlearning models obtained via regularized empirical risk minimization
We recommend use of the following proximal operator to comply with delete requests
[Equation]
which allows us to handle objective functions that incorporate non-smooth regularizers, such as theℓ 1 , elastic net or nuclear norm penalty.
More specifically, having deleted the datapoints in the set U ,we propose Algorithm 1 to delete the data of an additional user j .
Algorithm
Input: | U | = m , Hessian of loss or objective, ˜ θ n, − U ( λ ) , ¯ θ Nn, − U ( λ ) ˆ θ n ( λ ) , and delete request j
Set: H ℓ = 1 n (cid:80) ni
=1 ∇ 2 θ ℓ ( z i , ˆ θ n ) , H f = 1 n (cid:80) ni
=1 ∇ 2 θ f
( z i , ˆ θ n , λ ) , ¯ θ Nn, −∅ ( λ ) =
˜ θ n, −∅ ( λ ) =
ˆ θ n ( λ )
If π is not smooth:
Compute:
[Equation]
Store: ¯ θ Nn, − ( U ∪{ j } ) ( λ ) =
¯ θ Nn, − U ( λ ) + 1 n H −
[Equation]
ℓ ∇ ℓ (
[Equation]
θ n ( λ ))
Else compute:
[Equation]
Sample: σ ∼ N (0 , cI )
Return: ˜ θ n, − ( U ∪{ j } ) ( λ ) :
= ¯ θ n, − ( U ∪{ j }
[Equation]
( λ
[Equation]
+ σ
Guarantees While we give guarantees for functions that are strongly convex, we rely on standardreductions from the convex setting to the strongly convex setting (i.e. based on defining a objectivefunction F ( θ ) =
˜ F ( θ ) + ( µ/ 2)
∥ θ ∥ 2 when ˜ F is convex).
Furthermore, similar to Guo et al.
[14, 3.3]our methods can be used for unlearning in the non-convex setting when the deep learning modelapplies a simple convex model to a differentially private feature extractor [1].
Assumption 1 (Smooth regularizer) .
For any z ∈ Z , the objective function F ( θ, z, λ ) is µ -stronglyconvex and L -Lipschitz with M -smooth Hessian.
The loss has C -Lipschitz Hessians.
Assumption 2 (Non-smooth regularizer) .
For any z ∈ Z , the loss function ℓ ( θ, z ) is µ -stronglyconvex and L -Lipschitz with M -smooth and C -Lipschitz Hessians.
The regularizer π ( θ ) is convex.
With either of these assumptions, it’s possible to show that the denoised output of Algorithm 1 is
O ( m 2 /n 2 ) close to the exact unlearned model.
We formalize this proximity result in the following Lemma 1.
Lemma 1 (Proximity to the baseline estimator) .
Suppose F satisfies Assumption 1 or Assumption 2.
Let S be the dataset of size n sampled from D and U
⊆ S denote the set of m delete requests.
Consider ¯ θ n, − U ( λ ) , i.e. the output of Algorithm 1 without noise term σ added and the modelˆ θ n, − U ( λ ) obtained by minimizing the leave-U-out objective F n, − U .
Then,
[Equation]
and
[Equation]
6b
[Equation]
Lemma 1 implies adding the noise term σ ∝ O ( m 2 /n 2 ) will result in the desired unlearningguarantee.
The following Theorem 1 outlines this guarantee as well as the proximity of the unlearntmodel to the test loss minimizer.
The proof is contained in Appendix A.1.
Theorem 1 (Unlearning and generalization guarantees) .
Suppose the loss function satisfies Assumption 1 or Assumption 2 and consider any learning algorithm that returns a model
O (1 /n 2 ) close tothe empirical risk minimizer ˆ θ n ( λ ) trained on any dataset S ∼ D of size n .
Then the output ˜ θ n, − U ( λ )of Algorithm 1, where | U | = m , satisfies the test error bound
[Equation]
Furthermore, the unlearning Algorithm 1 results in ( ϵ, δ ) -certifiable removal of ∀ z ∈ U ⊆ S .
3.1.1 Deletion Capacity
Sekhari et al.
[28] introduce the notion of deletion capacity which formalizes how many samplescan be deleted from a the model parameterized by the original empirical risk minimizer ˆ θ n ( λ ) whilemaintaining reasonable guarantees on the test loss.
We restate the definition here.
Definition 2 (Deletion capacity [28]) .
Let ϵ, δ, γ > 0 and S be a dataset of size n drawn i.i.d From
D , and let F ( θ, z, λ ) be an objective function.
For a learning algorithm and removal mechanism
M that satisfies ( ϵ, δ ) -unlearning of all z ∈ U , where U is the set of delete requests, the deletioncapacity m A,Mϵ,δ,γ ( d, n ) is defined as the maximum number of samples that can be unlearned while stillensuring the excess population risk is γ .
Specifically,
[Equation]
where the expectation is with respect to S ∼ D and output of the learning algorithm A and removalmechanism M .
Sekhari et al.
[28] provide both an upper bound and lower bound on the deletion capacity of unlearningalgorithms.
We recount both bounds and show our algorithm achieves the same bounds.
Theorem 2 (Deletion capacity upper bound [28]) .
Let δ ≤ 0 .
005 and ϵ = 1 .
There exists a 4-Lipschitzand 1-strongly convex loss function f, and a distribution D such that for any learning algorithm
Aand removal mechanism M that satisfies ( ϵ, δ ) -unlearning and has access to all undeleted samples
S \ U , then the deletion capacity is:
[Equation]
where the constant c depends on the Lipschitz constants L , M , strongly convex constant µ , andboundedness constant C from Assumptions 1 or 2 and c < 1 .
Theorem 3 (Deletion capacity lower bound [28]) .
Let ϵ, δ > 0 and γ = 0 .
01 , S be a dataset of size ndrawn i.i.d from D , and F ( θ, z, λ ) be an objective function satisfying Assumption 1 or Assumptions 2.
Consider a learning algorithm
A
that returns the empirical risk minimizer and unlearning algorithm
M .
Then the deletion capacity is:
[Equation]
where the constant c depends on the Lipschitz constants L , C , and M .
Theorem 4 (Deletion capacity from unlearning via DP [28]) .
There exists a polynomial time learningalgorithm A and removal mechanism M of the form M ( U, A ( S ) , T ( S ))
=
A ( S ) such that thedeletion capacity is:
[Equation]
where the constant in Ω -notation depends on the properties of the loss function f .
As an extensions of a result developed by Bassily et al.
[2, Section C], Sekhari et al.
[28] show thatany unlearning algorithm that ignores the samples U can’t improve upon the DP lower bound.
Thismotivates the study of algorithms specifically designed for unlearning which leverage samples from
U instead of algorithms based on DP.
In Appendix B, we provide details showing that our Algorithm 1achieves the lower bound (7), where the constant c depends on the Lipschitz constants L , M , stronglyconvex constant µ , and boundedness constant C .
Comparison to previous results We compare our method to Sekhari et al.
[28] and Guo et al.[14] who propose optimizing a second-order Taylor approximation ( TA ) to the leave- U -out objectivefunction (2) for batch removal of U .
This results in the Newton-like removal mechanism (8).
[Equation]
Comparison of Assumptions.
On the one hand, our Assumption 1 is slightly more restrictive thanthat of Sekhari et al.
[28] given we require boundedness of the Hessian loss to obtain our unlearning,generalization and deletion capacity guarantees.
Notably, this assumption does not rule out any of themost common convex objective functions (e.g. least squares, logistic, hinge, or cross entropy lossfunctions).
On the other hand, our technique allows for non-smooth regularizers which are commonin modern machine learning pipelines.
Comparison of Computation.
Algorithm 1 entails calculating and inverting the full Hessian H for H ℓ and storing it (memory cost O ( d 2 ) and computation cost O ( d 3 ) ).
It also entails storing thegradient of each point evaluated on the full data model ˆ θ n ( λ ) , as well as the current model ˜ θ n, − U ( λ ) .
In the setting where π is not smooth, ¯ θ n, − U ( λ ) must be stored.
During runtime, Algorithm 1requires matrix-vector multiplication and vector addition (as well as proximal step in the non-smoothsetting).
For unlearning in settings where deletion requests come in a online manner, our techniqueis computationally more efficient.
This is because removal mechanism (8) requires computing andinverting a different Hessian that depends on the user requesting the deletion.
Therefore, outsidesimple settings, complying with such requests involves a computational cost of O ( md 3 ) to removem datapoints.
Comparison of unlearning, generalization and deletion capacity.
As summarized above, the generalization, unlearning and deletion capacity results for our removal mechanism are essentially equivalentto the unlearning, generalization, and deletion capacity results of [28].
Remark 1 (Extending Sekhari et al.
[28] to non-smooth regularizers) .
Following from the equivalencewe show between the batch and online setting in Appendix A.2, we can extend our use of the proximaloperator to (8) which would extend the results of Sekhari et al.
[28] to non-smooth regularizers.
Similar unlearning, deletion capacity and generalization results are obtained.
We provide detailsin Appendix C.
Experiments
In this section we will refer to retraining from scratch as RT , the Algorithm (8) as TA and our
Algorithm 1 as IJ .
We empirically demonstrate the benefits of our algorithm over both RT and TA inthree different settings: (i) smooth regularizers where we train a logistic regression model with an ℓ 2penalty to predict between the digit 3 and 8 from the MNIST dataset [19], (ii) non-smooth regularizerswhere we train a logistic regression model with an ℓ 1 penalty to predict whether an individual was prescribed a Warfarin dosage of > 30 mg/week from a dataset released by the International Warfarin
Pharmacogenetics Consortium [8], and (iii) non-convex training where we apply a logistic regressionmodel with an ℓ 2 penalty to predict street digits signs 3 and 8 from SVHN [24] on representationsextracted from a differentially private feature extractor with ϵ = 0 .
1 (similar to the setup of Guo et al.[14] ).
For all algorithms, we tune λ over the set { 10 − 3 , 10 − 4 , 10 − 5 , 10 − 6 } .
In the Appendix D, weprovide further details about each dataset and the code to produce our models is attached separately.
We present results in the main paper for λ = 1 − 3 and provide other results in Appendix E. All modelsare trained on a single NVIDIA Tesla T4 GPU and 16 2.10GHz Xeon(R)
Silver 4110 CPU cores.
Wefocus our evaluation on total runtime in seconds and test set accuracy as the number of delete requestsincreases.
Given that the current window for complying with delete requests for GDPR is one month,the runtime savings on our plots occur at month X where X is provided by the y-axis.
We note that the"Right to Be Forgotten" is a much broader right and our experimental findings demonstrate that thiscan be satisfied much more efficiently for convex problems.
For all results, we provide the averageover three different runs and provide standard error bars.
Logistic Regression with Smooth Regularizers In this experiment we simulate an online datadeletion setup using the MNIST dataset.
For simplicity, we restrict the problem to binary classificationby predicting between 3s and 8s.
This is the same setup used by Guo et al.
[14] to evaluate theirapproximate unlearning algorithm.
We flatten the MNIST image into a 1-D vector and train anℓ 2 regularized logistic regression model for each algorithm.
We evaluate the impact of a deletinga sequence of 5000 datapoints (approximately 40% of the total dataset) both randomly and in anadaptively chosen manner.
In these experiments we consider noise at c = 0 .
On average, IJ was 2611x faster than RT and 2045x faster than TA (Figure 1).
We find that thisimprovement in runtime comes at very minimal cost to the test performance of the model returned byour algorithm compared to the test performance of TA (Figure 1).
Furthermore, we observe that theseresults also hold when the delete requests are chosen adaptively (Figure 1).
As discussed previously,the main savings in computation for our algorithm comes from only inverting the hessian once while
TA requires a hessian inversion for every delete request.
Logistic Regression with Non-Smooth Regularizers This experiment showcases the performanceof our proximal Newton algorithm on a problem with a non-smooth regularizer.
We focus onpredicting warfarin dosing from patient demographic and physiological data because it a practicalsetting where ℓ 1 regularization has been demonstrated to be preferred [30].
Given that TA doesnot naturally support non-smooth regularizers we only compare IJ to RT .
In these experiments weconsider a logistic regression objective, ℓ 1 regularizer, and noise level of c = 0 .
On average, IJwas 30x faster than RT (Figure 2).
This improvement in runtime only comes at small cost to the testaccuracy of the model returned by our algorithm compared to the test performance of TA (Figure 2).
Non-Convex: Logistic Regression with Differentially Private Feature Extractor
We demonstrate the ability to use our unlearning algorithm in non-convex settings.
Similar to Guo et al.
[14]we train a differentially private feature extractor with ϵ = 0 .
1 on street digit signs from SVHN toextract representations which a logistic regression model can be applied on top of.
Similar to previousexperiments, we pick digits 3 and 8 for simplicity and observe significant speedups using IJ .
Onaverage, IJ was 15036x faster than RT and 17x faster than TA and these speedups come at a marginalcost to the test accuracy of our algorithm even as the number of delete requests increase (Figure 3).
Unlearning hyperparameter-tuned models
One of the most common techniques for hyperparameter tuning is cross-validation .
Here datapointsare used to validate and select models using the following cross-validation error objective
[Equation]
Specifically, the model selection pipeline oftentimes entails selecting λ ∈ Λ that minimizes the CVerror (9).
Given each datapoint is used to select models, one might hope it is possible to unlearnmodels using Algorithm 1 when CV is used to select the model.
However, as the following propositionillustrates, the ( ϵ, δ ) -unlearning guarantees of Theorem 1 no longer apply when CV has taken place.
Proposition 1.
Suppose cross-validation is used to select λ ∈ Λ and the empirical risk minimizerˆ θ n ( λ ) is returned.
Consider a delete request by user i and the model returned by unlearningprocedure (8) or (1) , which we denote ˜ θ n, − i ( λ ) .
Then it is possible ∥
˜ θ n, − i ( λ ) − ˆ θ n, − i ( λ ′ )
∥
=
o (1 /n )where ˆ θ n, − i ( λ ′ ) is the model selected after deleting user i and performing cross-validation again toselect λ ′ ∈ Λ before returning the empricial risk minizer.
Proof of Proposition 1.
Suppose ℓ ( z, θ ) =
12 ( z − θ ) 2 , π ( θ )
= θ 2 and Λ = { 0 , ∞} .
Note thatˆ θ n ( λ ) =
11+ λ ¯ z where ¯ z = 1 n (cid:80) ni
=
z i is the sample average.
Consider a dataset consisting of n − 1 points (group A) with value − 1 n and a remaining point (group B) with value n with n ≥ 2 , andsuppose the user in group B requests to delete their data.
Performing cross-validation on this datasetwill entail computing two kinds of sample averages, one where we have deleted a point from group
A , ¯ z − i A
= 1 n − 1 ( − n − 2 n + n ) , and one where we have deleted the point from group B , ¯ z − i B = − 1 n .
Recall the CV error
[Equation]
When minimized over the set Λ = { 0 , ∞} , λ = ∞ is optimal for any n ≥ 2 .
This results in estimatorˆ θ n ( λ ) =
ˆ θ n ( ∞ ) = 0 .
The leave-one-out approximation is the same for estimators (1) and (8),given ∇ 2 θ F ( z, θ, λ ) − 1 = 11+ λ .
Subsequently, ˜ θ n, − i ( λ ) =
ˆ θ n ( λ ) + 1 n 11+ λ (ˆ θ n ( λ ) − z i ) results in theapproximation ˜ θ n, − i ( ∞ )
= 0 .
On the other hand, having deleted the datapoint from group B , wehave a new sample mean ¯ z = − 1 n and CV error, given by
[Equation]
is minimized by λ = 0 .
This results in leave-one-out minimizer ˆ θ n, − i (0) =
− 1 n .
An implication of Proposition 1 is that Algorithm 1 as well as the algorithms proposed by [28, 14]
donot unlearn models when cross-validation is used to selected hyperparameters.
This is because thenoise term σ ∝ O ( m 2 /n 2 ) is no longer sufficient to guarantee datapoint i is unlearned.
This meansthat organizations which train their models using cross-validation and use approximate unlearningalgorithms could still be leaking information about the data which they delete.
Discussion
A main contribution of our study is the development of an efficient online data deletion algorithm fornon-smooth problems.
The only previous work proposing a low-memory online algorithm is Guoet al.
However, Marchant et al.
[20] show that this algorithm is susceptible to poisoning attacksrendering it highly inefficient.
While exact unlearning algorithms such as SISA and retrainingnaturally work in an online setting, our work is the first to make this work for approximate unlearningalgorithms.
Further development of data deletion algorithms should focus more on the online settingto ensure practical use.
The infinitesimal jacknife has been previously been used to perform cross-validation.
We notedeep connections between the approximate cross-validation algorithms and approximate machineunlearning algorithms.
The algorithm developed by [28], for example, can be viewed as an analog ofthe approximate cross-validation algorithm proposed by [3, 26].
Additionally, the model selectionerror bounds provided in the approximate cross-validation literature for example in [35] are verysimilar to the generalization guarantees proved in our work and [28] where we are concerned withthe error introduced by our approximation to the unlearning baseline.
We believe further connectionscould be exploited to provide unlearning algorithms when hyperparameter tuning has taken place.
In this work and in several others we consider a definition of data deletion that is parameterized bytwo values ϵ and δ .
As is the case with differential privacy, it is currently unclear what the impact ofsatisfying different levels of ϵ means practically.
Developing auditing algorithms [32] similar to thoserecently seen in the DP community [18, 22] can help provide more transparency on the meaning ofthe ( ϵ, δ ) -unlearning guarantee.
Finally, we return to the broader question we posed at the beginning: what does it mean to deletedata from a machine learning pipeline?
Most existing work focuses on data deletion in the modeltraining process.
Yet, the machine learning and data analysis pipeline is much broader than just modeltraining.
As evidenced in Section 5, the lack of research on data deletion in model selection couldpotentially result in information being leaked from previously proposed unlearning algorithms.
Giventhis result, it is likely that all unlearning algorithms (both exact and inexact) still leak informationabout deleted data in other stages of the machine learning pipeline such as exploratory data analysisand feature selection.
We encourage the community to explore definitions of data deletion whichencompass the entire machine learning pipeline.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[Yes]
(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e
g., data splits, hyperparameters, how theywere chosen)?
[Yes]
(c) Did you report error bars (e
g., with respect to the random seed after running experiments multiple times)?
[Yes](d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[Yes]
(c) Did you include any new assets either in the supplemental material or as a URL?
[No]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]