Fast Yet Effective Graph Unlearning through Inﬂuence Analysis
Anonymous authors
Paper under double-blind review
A BSTRACT
Recent evolving data privacy policies and regulations have led to increasing interest in the problem of removing information from a machine learning model.
In this paper, we consider Graph Neural Networks (GNNs) as the target model, and study the problem of edge unlearning in GNNs , i.e., learning a new GNN model as if a speciﬁed set of edges never existed in the training graph.
Despite its practical importance, the problem remains elusive due to the non-convexity nature of
GNNs and the large scale of the input graph.
Our main technical contribution is three-fold: 1) we cast the problem of fast edge unlearning as estimating the inﬂuence of the edges to be removed and eliminating the estimated inﬂuence from the original model in one-shot; 2) we design a computationally and memory efﬁcient algorithm named EraEdge for edge inﬂuence estimation and unlearning; 3) under standard regularity conditions, we prove that EraEdge converges to the desired model.
A comprehensive set of experiments on four prominent GNN models and three benchmark graph datasets demonstrate that EraEdge achieves signiﬁcant speedup gains over retraining from scratch without sacriﬁcing the model accuracy too much.
The speedup is even more outstanding on large graphs.
Furthermore,
EraEdge witnesses signiﬁcantly higher model accuracy than the existing GNN unlearning approaches.
I NTRODUCTION
Recent legislation such as the General Data Protection Regulation (GDPR) (Regulation, 2018), the
California Consumer Privacy Act (CCPA) (Pardau, 2018), and the Personal Information Protection and Electronic Documents Act (PIPEDA) (Parliament, 2000) requires companies to remove private user data upon request.
This has prompted the discussion of “right to be forgotten” (Kwak et al., 2017), which entitles users to get more control over their data by deleting it from learned models.
In case a company has already used the data collected from users to train their machine learning (ML) models, these models need to be manipulated accordingly to reﬂect data deletion requests.
In this paper, we consider Graph Neural Networks (GNNs) that receive frequent edge removal requests as our target ML model.
For example, consider a social network graph collected from an online social network platform that witnesses frequent insertion/deletion of users (nodes) and/or change of social relations between users (edges).
Some of these structural changes can be accompanied with users’ withdrawal requests of their data.
In this paper, we only consider the requests of removing social relations (edges).
Then the owner of the platform is obligated by the laws to remove the effect of the requested edges, so that the GNN models trained on the graph do not “remember” their corresponding social interactions.
In general, a naive solution to deleting user data from a trained ML model is to retrain the model on the training data which excludes the samples to be removed.
However, retraining a model from scratch can be prohibitively expensive, especially for complex ML models and large training data.
To address this issue, numerous efforts (Mahadevan & Mathioudakis, 2021; Brophy & Lowd, 2021;
Cauwenberghs & Poggio, 2000; Cao & Yang, 2015) have been spent on designing efﬁcient unlearning methods that can remove the effect of some particular data samples without model retraining.
One of the main challenges is how to estimate the effects of a given training sample on model parameters (Golatkar et al., 2021), which has led to research focusing on simpler convex learning problem such a linear/logistic regression (Mahadevan & Mathioudakis, 2021), random forests (Brophy & Lowd, 2021), support vector machines (Cauwenberghs & Poggio, 2000) and k-means clustering (Ginart et al., 2019), for which a theoretical analysis was established.
Although there have been some works on unlearning in deep neural networks (Golatkar et al., 2020a;b; 2021; Guo et al., 2020), very few works (Chen et al., 2022; Chien et al., 2022) have investigated efﬁcient unlearning in GNNs. These works can be distinguished into two categories: exact and approximate GNN unlearning.
GraphEraser (Chen et al., 2022) is an exact unlearning method that retrains the GNN model on the graph that excludes the to-be-removed edges in an efﬁcient way.
It follows the basic idea of Sharded, Isolated, Sliced, and Aggregated (SISA) method
(Bourtoule et al., 2021) and splits the training graph into several disjoint shards and train each shard model separately.
Upon receiving an unlearning request, the model provider retrains only the affected shard model.
Despite its efﬁciency, partitioning training data into disjoint shards severely damages the graph structure and thus incurs signiﬁcant loss of target model accuracy (will be shown in our empirical evaluation).
On the other hand, approximate GNN unlearning returns a sanitized GNN model which is statistically indistinguishable from the retrained model.
Certiﬁed graph unlearning (Chien et al., 2022) can provide a theoretical privacy guarantee of the approximate GNN unlearning.
However, it only considers some simpliﬁed GNN architectures such as simple graph convolutions (SGC) and their generalized
PageRank (GPR) extensions. We aim to design the efﬁcient approximate unlearning solutions that are model-agnostic, i.e., without making any assumption of the nature and complexity of the model. In this paper, we design an efﬁcient edge unlearning algorithm named EraEdge which directly modiﬁes the parameters of the pre-trained model in one shot to remove the inﬂuence of the requested edges from the model.
By adapting the idea of treating removal of data points as upweighting these data points (Koh & Liang, 2017), we compute the inﬂuence of the requested edges on the model as the change in model parameters due to upweighting these edges.
However, due to the aggregation function of GNN models, it is non-trivial to estimate the change on GNN parameters as removing an edge e ( v i , v j ) could affect not only the neighbors of v i and v j but also on multi-hops.
Thus we design a new inﬂuence derivation method that takes the aggregation effect of GNN models into consideration when estimating the change in parameters.
We address several theoretical and practical challenges of inﬂuence derivation due to the non-convexity nature of GNNs.
To demonstrate the efﬁciency and effectiveness of EraEdge , we systematically represent the empirical trade-off space between unlearning efﬁciency (i.e., the time performance of unlearning, model accuracy (i.e., the quality of the unlearned model), and unlearning efﬁcacy (i.e., the extent to which the unlearned model has forgotten the removed edges).
Our results show that, ﬁrst, while achieving similar model accuracy and unlearning efﬁcacy as the retrained model, EraEdge is signiﬁcantly faster than retraining.
For example, it speeds up the training time by 5.03 × for GCN model on C ora dataset.
The speedup is even more outstanding on larger graphs; it can be two orders of magnitude on C S graph which contains around 160K edges.
Second, EraEdge outperforms GraphEraser (Chen et al., 2022) considerably in model accuracy.
For example, EraEdge witnesses an increase of 50% in model accuracy on C ora dataset compared to GraphEraser .
Furthermore, EraEdge is much faster than GraphEraser especially on large graphs.
For instance, EraEdge is 5.8 × faster than GraphEraser on C S dataset.
Additionally, EraEdge outperforms certiﬁed graph unlearning (CGU) (Chien et al., 2022) signiﬁcantly in terms of target model accuracy and unlearning efﬁcacy, while it demonstrates comparable edge forgetting ability as CGU. In summary, we made the following four main contributions: 1) We cast the problem of edge unlearning as estimating the inﬂuence of a set of edges on GNNs while taking the aggregation effects of GNN models into consideration; 2) We design EraEdge , a computationally and memory efﬁcient algorithm that applies a one-shot update to the original model by removing the estimated inﬂuence of the removed edges from the model; 3) We address several theoretical and practical challenges of deriving edge inﬂuence, and prove that EraEdge converges to the desired model under standard regularity conditions; 4) We perform an extensive set of experiments on four prominent GNN models and three benchmark graph datasets, and demonstrate the efﬁciency and effectiveness of EraEdge .
G RAPH N EURAL N ETWORK
Given a graph G ( V, E ) that consists of a set of nodes V and their edges E , the goal of a Graph
Neural Network (GNN) model is to learn a representation vector (cid:126)h (embedding) for each node v in
G that can be used in downstream tasks (e.g., node classiﬁcation, link prediction).
A GNN model updates the node embeddings through aggregating its neighbors’ representations.
The embedding corresponding to each node v i ∈ V at layer l is updated according to v i ’s graph [Table] neighborhood (typically 1-hop neighborhood).
This update operation can be expressed as follows:
[Equation]
where σ is an activation function, A is the ajacency matrix of the given graph G , and θ ( l ) denotes the trainable parameters as layer l .
The initial embeddings at (cid:96) = 0 are set to the input features for all the nodes, i.e., H (0) =
X .
Different GNN models use different AGGREGATE functions.
In this paper, we consider four representative GNN models, namely Graph Convolutional Networks (GCN) (Kipf & Welling, 2017),
GraphSAGE (Hamilton et al., 2018), graph attention networks (GAT) (Veli ˇ ckovi ´ c et al., 2018), and
Graph Isomorphism Network (GIN) (Xu et al., 2019).
These models differ on their AGGREGATE functions.
We ignore the details of their AGGREGATE functions as our unlearning methods are model agnostic, and thus are independent from these functions.
After K iterations of message passing, a Readout function pools the node embeddings at the last layer and produce the ﬁnal prediction results.
The R eadout function varies by the learning tasks.
In this paper, we consider node classiﬁcation as the learning task and the Readout function is a softmax function.
[Equation]
The ﬁnal output of the target model for node v is a vector of probabilities, each corresponding to the predicted probability (or posterior) that v is assigned to a class.
We consider cross entropy loss (Cox, 1958) which is the de-facto choice for classiﬁcation tasks.
In the following sections, we use
L ( θ ; v, E ) to denote the loss on node v for simplicity because only edges are directly manipulated.
F ORMULATION OF E DGE U NLEARNING P ROBLEM
Despite that GNNs are widely applicable to many ﬁelds, there are very few studies (Chen et al., 2022; Chien et al., 2022) on graph unlearning so far.
In this section, we will formulate the deﬁnition of the edge unlearning problem.
Table 1 lists the notations we use in the paper.
In this paper, we only consider edge unlearning.
We will discuss how to extend edge unlearning to handle node unlearning in Section 7.
Let G be the set of all graphs.
In this paper, we only consider undirected graphs.
Let Θ be the parameter space of the GNN models.
A learning algorithm
A L is a function that maps an instance
G ( V, E ) ∈ G to a parameter θ ∈ Θ .
Let θ OR be the parameters of A L trained on G .
Any user can submit an edge unlearning request to remove speciﬁc edges from G .
In practice, unlearning requests are often submitted sequentially.
For efﬁciency, we assume these requests are processed in a batch.
As the response to these requests, A L has to erase the impacts of these edges and produce an unlearned model.
A straightforward approach is to retrain the model on G ( V, E \ E UL ) from scratch and obtain the model parameters θ RE .
However, due to the high computational cost of retraining, an alternative solution is to apply a unlearning process
A UL that takes E UL and θ OR as the input, and outputs the unlearned model .
The retrained and unlearned models should be sufﬁciently close and ideally identical.
There are two types of notations in the literature that quantify the closeness of the retrained and unlearning models: (1) both retraining and unlearning models are indistinguishable in the parameter space , i.e., distributions of model parameters of both retraining and unlearning models are sufﬁciently close, where the distance in two distributions can be measured by (cid:96) 2 distance (Wu et al., 2020) and KL divergence (Golatkar et al., 2020b); (2) both models are indistinguishable in the output space , i.e., distributions of the learning outputs by both models are sufﬁciently close, where the distance between two output distributions can be measured by either test accuracy (Thudi et al., 2021) or the privacy leakage of membership inference attack launched on model outputs (Graves et al., 2021; Baumhauer et al., 2020).
We argue that indistinguishably of the parameter space is not suitable for GNNs, due to their non-convex loss functions (Tarun et al., 2021), as small changes of the training data can cause large changes in GNN parameters.
Therefore, in this paper, we consider the indistinguishability of the output space between retrained and unlearned models as our unlearning notion.
Formally, we deﬁne the edge unlearning problem as follows:
Deﬁnition 1 ( Edge Unlearning Problem).
Given a graph G ( V, E ) , a set of edges E UL ⊂ E that are requested to be removed from G , a graph learning algorithm
A L and its readout function f , then an edge unlearning algorithm
A UL should satisfy the following:
[Equation]
where G UL = G ( V, E \ E UL ) , and P ( f ( θ ) | G ) denotes the distribution of possible outputs of the model (with parameters θ ) on G .
The readout function f varies for different learning tasks.
In this paper, we consider the softmax function (Eqn.
as the readout function.
There are various choices to measure the similarity between the output softmax vectors.
We consider Jensen–Shannon divergence (JSD) in our experiments.
M AIN A LGORITHM : E FFICIENT E DGE U NLEARNING
Given a graph G ( V, E ) as input, one often ﬁnds a proper model represented by θ that ﬁts the data by minimizing an empirical loss.
In this paper, we consider cross-entropy loss (Cox, 1958) for node classiﬁcation as our loss function.
The or iginal model θ OR is optimized by the following:
[Equation]
Assuming a set of edges E UL is deleted from G and the new graph after this deletion is represented by G UL
= G ( V, E \ E UL ) ,
re training the model will give us a new model parameter θ RE on G UL :
[Equation]
[Figure]
Figure 1 gives an overview of our unlearning solution named EraEdge .
A major difﬁculty, as expected, is that obtaining θ RE is prohibitively slow for complex networks and large datasets.
To overcome this difﬁculty, the aim of EraEdge is to identify an update to θ OR through an analogous one-shot u n l earning update :
[Equation]
where I E UL is the inﬂuence of E UL on the target model, i.e., the change on the model parameters by E UL .
In general, I E UL is a K × d matrix, where K is the number of parameters in θ
OR (and both θ RE and θ UL ), and d is the dimension of each parameter (i.e. embedding).
This update can be interpreted from the optimization perspective that the model forgets E UL by “reversing” the inﬂuence of E UL from the model.
The challenge is how to quantify I E UL to achieve the unlearning objective (Eqn.
Next, we discuss the details of how to compute I E UL .
Existing inﬂuence functions and their inapplicability.
Inﬂuence functions (Koh & Liang, 2017) enable efﬁcient approximation of the effect of some particular training points on a model’s prediction.
The general idea of inﬂuence functions is the following: let θ
and ˆ θ be the model parameters before and after removing a data point z , the new parameters ˆ θ (cid:15),z after z is removed can be computed as following:
[Equation]
where m is the number of data points in the original dataset, and (cid:15) is a small constant.
Intuitively, the inﬂuence function computes the parameters after removal of z by upweighting z on the parameters with some small (cid:15) .
It seemly sounds that the inﬂuence function (Eqn.
(7)) can be applied to the edge unlearning setting directly by upweighting those nodes that are included in any edge in E UL .
However, this is incorrect as removing one edge e ( v i , v j ) from the graph can affect not only the prediction of v i and v j but also those of neighboring nodes of v i and v j , due to the aggregation function of GNN models.
4. T HEORETICAL C HARACTERIZATION OF E DGE I NFLUENCE ON GNN S
In general, an (cid:96) -layer GNN aggregates the information of the (cid:96) -hop neighborhood of each node.
Thus removing an edge e ( v i , v j ) will affect not only v i and v j but also all nodes in the (cid:96) -hop neighborhood of v i and v j .
To capture such aggregation effect in derivation of edge inﬂuence, ﬁrst, we deﬁne the set of nodes (denoted as V e ) that will be affected by removing an edge e ( v i , v j ) as:
[Equation]
where N ( v ) is the set of nodes connected to v in (cid:96) hops.
Then given a set of edges E UL ⊂ E to be removed, the set of nodes V E UL that will be affected by removing E UL is deﬁned as follows:
[Equation]
Next, we follow the data perturbation idea of inﬂuence functions (Koh & Liang, 2017), and compute the new parameters θ (cid:15),E UL after the removal of E UL as follows:
[Equation]
Intuitively, Eqn.
(9) approximates the effects that moving (cid:15) mass of perturbation on V E UL with
E \ E UL in place of E .
Then we obtain the following theorem.
Theorem 2.
Given the parameters θ OR obtained by A UL on a graph G , and the loss function L , assume that L is twice-differentiable and convex in θ , then the inﬂuence of a set of edges E UL is:
[Equation]
where H OR :
= ∇ 2 1 | V | (cid:80) v ∈ V L ( θ OR , v, E ) is the Hessian matrix of L with respect to θ OR .
The proof of Theorem 2 can be found in Appendix A.1.
According to Eqn (9), removing E UL is equivalent to upweighting (cid:15) =
1 | V | mass of perturbation.
Therefore, θ UL = θ (cid:15),V E UL when (cid:15) =
1 | V | .
Finally, we have a linear approximation of θ UL :
[Equation]
Dealing with non-convexity of GNNs.
Theorem 2 assumes the loss function is convex.
Given the non-convexity nature of GNN models, it is hard to reach the global minimum in practice.
As a result, the Hessian matrix H θ
OR may have negative eigenvalues.
To address this issue, we adapt the damping term based solution (Koh & Liang, 2017) to prevent H θ OR from having negative eigenvalues by adding a damping term to the Hessian matrix, i.e., ( H θ OR + λI ) .
4. T IME AND M EMORY E FFICIENT I NFLUENCE E STIMATOR
Although by Theorem 2 estimating the edge inﬂuence amounts to solving a linear system, there are several practical and theoretical challenges.
First, it can well be the case that the Hessian matrix
H θ OR is non-invertible.
This is because our loss function is non-convex with respect to θ .
As a consequence, the linear system may even not have a solution.
Second, even storing a Hessian matrix in memory (either CPU or GPU) is expensive: in our experiments, we will show that Hessian matrices are huge, e.g. the Hessian matrix on the Physics dataset has size around 10 6 × 10 6 which would cost 60 GB memory.
Lastly, even under the promise that the linear system is feasible, computing the inverse of such a huge size matrix is prohibitive.
Our second technical contribution thus is an algorithm that resolves all the challenges mentioned above.
Claim 3.
There is a computationally and memory efﬁcient algorithm to solve the linear system of
I E UL in Theorem 2.
The starting point of our algorithm is a novel perspective that solving the linear system (Eqn.
(10)) can be thought of as ﬁnding a stationary point of the following quadratic function:
[Equation]
(11) with A = H θ OR and b = ∇ θ (cid:80) v ∈ V E UL L ( θ OR ; v, E \ E UL ) −∇ θ (cid:80) v ∈ V E UL L ( θ OR ; v, E ) .
Note that even the function f ( x ) is non-convex, there is rich literature establishing convergence guarantee to stationary points using gradient-descent-type algorithms; see e.g. (Bertsekas, 1999).
In this paper, we will employ the conjugate gradient (CG) method which exhibits promising computational efﬁciency for minimizing quadratic functions (Pytlak, 2008).
In fact, it was well-known that as long as the step size satisﬁes the Wolfe conditions (Wolfe, 1969; 1971) and the objective function is Lipschitz and bounded from below, the sequence of iterates produced by CG asymptotically converges to a stationary point of f ( x ) , which corresponds to a solution I E UL that satisﬁes Eqn.
Note that these regularity conditions are satisﬁed as soon as the training data are bounded.
Hence, we have the following convergence guarantee.
Lemma 4 (Theorem 2.1 of (Pytlak, 2008)) .
The CG method generates a sequence of iterates { x t } t ≥ 1 such that lim t → + ∞ f ( x t ) = 0 .
In addition, the per-iteration time complexity is O ( | x | ) where | x | denotes the dimension of x .
We note, however, that an appealing feature of Eqn.
(10) is that we do not have to ﬁnd a solution with exact zero gradient.
This enables us to terminate CG early by monitoring the magnitude of the gradients.
Our empirical study also shows that CG can get good approximation in a small number of iterations.
In addition, we propose a memory-efﬁcient implementation of CG, which signiﬁcantly reduces the memory cost.
Lemma 5.
The CG method can be implemented using O ( | θ | ) memory.
Proof.
To see why the above lemma holds, recall that a key step of CG update is calculating the gradient of f ( x ) as
[Equation]
As H θ OR ∈ R | θ |×| θ | , we can not explicitly compute H θ OR .
Instead, we utilize Hessian-vector product (Pearlmutter, 1994) to approximately calculate H θ OR x by
[Equation]
(12) for some very small step size r > 0 , where g ( θ ) : = ∇ θ [Equation] E UL L ( θ OR ; v, E \ E UL ) − ∇ θ (cid:80) v ∈ V E UL L ( θ OR ; v, E ) .
Note that the memory cost of evaluating the function value of g ( · ) is O ( | θ | ) .
Hence, Lemma 5 follows.
Remark 6.
Observe that a trivial implementation involves storing the Hessian matrix which consumes O ( | θ | 2 ) memory.
Returning to our previous example on the Physics dataset, a trivial implementation consumes 64 GB memory, while ours only needs 8 GB memory.
Proof of Claim 3.
Claim 3 follows from Lemma 4 and Lemma 5.
E XPERIMENTS
In this section, we empirically verify the efﬁciency and effectiveness of our unlearning method.
5. E XPERIMENTAL S ETUP
All the experiments are executed on a GPU server with NVIDIA A100 (40G).
All the algorithms are implemented in Python with PyTorch.
We set the damping term λ = 0 .
01 for all experiments.
The link to the code and datasets will be available in the camera-ready version.
Datasets.
We use three well-known datasets, namely Cora (Sen et al., 2008), Citeseer (Yang et al., 2016), and CS (Shchur et al., 2018), that are popularly used for performance evaluation of GNNs (Shchur et al., 2018; Zhang et al., 2019).
The statistical information of these datasets can be found in Appendix A.2.
GNN models.
We consider four representative GNN models, namely GCN (Kipf & Welling, 2017),
GAT (Veli ˇ ckovi ´ c et al., 2018), GraphSAGE (Hamilton et al., 2017), and GIN (Xu et al., 2019).
We conﬁgure the GNNs with one hidden layer and a softmax output layer.
All GNN models are trained for 1,000 epochs with an early-stopping condition when the validation loss is not decreasing forepochs.
We randomly split each graph into a training set (60%), a validation set (20%), and a test set (20%).
As we mainly consider the impact of structure change on GNN models, we randomly initialize the values of node features such that they follow the Gaussian distribution to eliminate the possible dominant impact of node features on model performance. More details of the model setup can be found in Appendix A.2. We also measure the model performance with original node features. The results can be found in Appendix A.5.
Picking edges for removal. We randomly pick k = { 100, 200, 400, 600, 800, 1,000 } ) edges from Cora and CiteSeer datasets, and k = { 1,000, 2,000, 4,000, 6,000, 8,000, 10,000 } ) edges from CS dataset for removal. For each setting, we randomly sample ten batches of edges, with each batch containing k edges.
We report the average of model performance (model accuracy, unlearning efﬁcacy, etc.) of the ten batches. Metrics. We evaluate the performance of EraEdge in terms of efﬁciency , efﬁcacy , and model accuracy : (1) Unlearning efﬁciency : we measure the running time of EraEdge and retraining time for a given set of edges; (2) Target model accuracy : we measure accuracy of node classiﬁcation, i.e., the percentage of nodes that are correctly classiﬁed by the model, as the accuracy of the target model.
Higher accuracy indicates better accuracy retained by the unlearned model; (3) Unlearning efﬁcacy : we measure the distance between the output space of both retrained and unlearned models as the Jensen–Shannon divergence (JSD) between the posterior distributions output by these two models.
Smaller JSD indicates a higher similarity between the two models in terms of their outputs.
Baselines.
We consider both baselines of exact and approximate GNN unlearning for comparison with EraEdge . For exact GNN unlearning, we consider GraphEraser (Bourtoule et al., 2021) as the baseline.
GraphEraser has two partitioning strategies denoted as balanced LPA ( BLPA ) and balanced embedding k -means ( BEKM ), We consider both BLPA and BEKM as the baseline methods.
We use the same setting of number of shards as in (Chen et al., 2022) for both BLPA and BEKM. For approximate GNN unlearning, we consider (Chien et al., 2022) as the baseline.
5. P ERFORMANCE OF E RA E DGE
We evaluate the performance of EraEdge on four representative GNN models and three graph datasets, and compare the performance of the unlearned model with both the retrained model and two baselines in terms of model accuracy, unlearning efﬁciency, and unlearning efﬁcacy. [Table]
Model accuracy.
We report the results of GNN model accuracy in Table 2 ( Accuracy column) for
GCN+Cora and GraphSAGE+CS settings.
The results for other settings can be found in Appendix
A.3.
We have the following observations.
First, the model accuracy obtained by EraEdge stays very close to that of the retrained model, regardless of the number of the removed edges.
The difference in model accuracy between retrained and unlearned models remains negligible (in range of [0.48%, 0.52%] and [0.01%, 0.2%] for the two settings respectively).
Second, EraEdge witnesses signiﬁcantly higher model accuracy compared to the two baseline approaches, especially for the GCN+Cora setting.
For example, both BEKM and BLPA only can deliver the model accuracy as around 48% when removing 200 edges under the GCN+Cora setting.
This shows that unlearning through graph partitioning can bring signiﬁcant loss of target model accuracy.
Meanwhile EraEdge demonstrates that the model accuracy can be as high as ∼ 79% (65% improvement).
Unlearning efﬁciency.
We report the time performance results of EraEdge and retraining in Table( Running time.
column) for GCN+Cora and GraphSAGE+CS settings.
The results of other settings can be found in Appendix A.3.
We measure the running time of the two baselines as the average training time per shard, as all shards are trained in parallel.
The most important observation is that EraEdge is signiﬁcantly faster than retraining.
For example, it speeds up the training time by 5 × under GCN+Cora setting when removing 1,000 edges, and 77 × under GraphSAGE+CS setting when removing 2,000 edges.
Furthermore, EraEdge is much faster than the two baselines especially when training large graphs.
For example, EraEdge is 5.8 × faster than BLPA and 3.5 × faster than
BEKM under the GraphSAGE+CS setting when 2,000 edges were removed.
Unlearning efﬁcacy.
Figure 2 plots the results of unlearning efﬁcacy which is measured as the
JSD between the posterior probability output by both retraining and unlearning models.
We observe that JSD remains insigniﬁcant (at most 0.02) in all the settings.
Furthermore, JSD stays relatively stable when the number of removed edges increase.
This demonstrates the efﬁcacy of EraEdge - it remains close to the retraining model even when a large number of edges is removed.
Main takeaway.
While demonstrating similar accuracy as retraining, EraEdge is signiﬁcantly faster than retraining, where the speedup gain becomes more outstanding when more edges are [Figure] [Table] EraEdge 0.
[Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table] [Figure] [Figure] as AUC of the membership inference attack that infers the existence of E UL in training graph (Cora dataset) removed.
Furthermore, EraEdge outperforms the baseline approaches considerably in both model accuracy and time performance.
5. T ESTING OF EDGE FORGETTING THROUGH MEMBERSHIP INFERENCE ATTACKS
To empirically evaluate the extent to which the unlearned model has forgotten the removed edges, we launch a black-box edge membership inference attack (MIA) (Wu et al., 2022) 1 that predicts whether particular edges exist in the training graph.
We measure the attack performance as AUC of
MIA.
Intuitively, an AUC that is close to 50% indicates that MIA’s belief of edge existence is close to random guess.
Table 3 reports the attack performance of MIA’s inference of the removed edges E UL against both the original model and the retrained/unlearned models on Cora dataset.
First, MIA is effective to predict the existence of E UL in the original graph, as the AUC of MIA against the original model is much higher than 0.5.
Second, the ability of MIA inferring E UL from either the retrained or the unlearned model degrades, as the AUC of MIA on both retrained and unlearned models is noticeably reduced.
Indeed, the AUC of MIA for both retrained and unlearned models remain close to each other.
This demonstrates that the extent to which EraEdge forgets E UL is similar to that of the retrained model.
5. C OMPARISON WITH C ERTIFIED G RAPH U NLEARNING
In this part of the experiments, we compare the performance of EraEdge with certiﬁed graph unlearning (CGU) (Chien et al., 2022).
The key idea of the certiﬁed unlearning method is to add noise drawn from the Gaussian distribution to the loss function.
We use µ = 0 and σ = 1 as the mean and standard deviation of the Gaussian distribution.
We compare CGU and EraEdge in terms of: (1) target model accuracy, (2) unlearning efﬁcacy (measured as the JSD between the probability output
[Figure]
[Figure]
of retraining and unlearning models)
, and (3) privacy vulnerability of the removed edges against the membership inference attack.
Figure 3 (a) reports the target model accuracy by CGU and EraEdge .
As we can see, while EraEdge enjoys similar target model accuracy as the retrained model, CGU suffers from signiﬁcant loss of model accuracy due to added noise, where the model accuracy is 50% worse than that of both
EraEdge and retraining.
Figure 3 (b) reports unlearning efﬁcacy by CGU and EraEdge .
The results demonstrate that the model output by CGU is much farther away from that of the retrained model than EraEdge .
This is consistent with the low accuracy results in Figure 3 (b).
Table 4 shows the ability of forgetting the removed edges E UL by both CGU and EraEdge , where the edge forgetting ability is measured as the accuracy (AUC) of the membership inference attack that predicts E UL in the training graph.
We use the same membership inference attack (Wu et al., 2022) as in Section 5.3.
The reported results are calculated as the average AUC of ten MIA trials.
We observe that CGU and EraEdge has comparable edge forgetting ability, where MIA performance against both models is close.
This demonstrate empirically that EraEdge provides similar privacy risks as CGU.
As it has been shown above that the target model accuracy by EraEdge outperforms that of CGU signiﬁcantly, we believe that EraEdge better addresses the trade-off between unlearning efﬁcacy, privacy, and model accuracy.
R ELATED W ORK
Machine unlearning.
Machine unlearning aims to remove some speciﬁc information from a pretrained ML model.
Several attempts have been made to make unlearning more efﬁcient than retraining from scratch.
An earlier study converts ML algorithms to statistical query (SQ) learning, so that unlearning processes only need to retrain the summation of SQ learning (Cao & Yang, 2015).
The concept of SISA (sharded, isolated, sliced, and aggregated) approach is proposed recently (Bourtoule et al., 2021) where a set of constituent models, trained on disjoint data shards , are aggregated to form an ensemble model.
Given an unlearning request, only the affected constituent model is retrained.
Alternative machine unlearning solutions directly modify the model’s parameters to unlearn in a small number of updates (Guo et al., 2020; Neel et al., 2021; Sekhari et al., 2021).
Recent studies have focused on various convex ML models including random forest (Brophy & Lowd, 2021;
Schelter et al., 2021), k-means clustering (Ginart et al., 2019), and Bayesian inference models (Fu et al., 2021).
Machine unlearning in deep neural networks.
Early work on deep machine unlearning focuses on removing the information from the network weights by imposing a condition of SGD based optimization during training (Golatkar et al., 2020a).
The subsequent work (Golatkar et al., 2020b) estimates the network weights for the unlearned mode.
However, all these methods suffer from high computational costs and constraints on the training process (Tarun et al., 2021).
The amnesiac unlearning approach (Graves et al., 2021) focuses on Convolutional Neural Networks.
It cancels parameter updates from only the batches containing the removed data.
However, it assumes that the data to be removed is known before the training of the original model, which does not hold in our setting where edge removal requests are unknown and unpredictable.
There also has been recent empirical and theoretical work in developing deep network unlearning in the application domain of computer vision (Du et al., 2019; Nguyen et al., 2020).
GraphEraser (Chen et al., 2022) is one of the few works that consider unlearning in GNNs.
It follows the SISA approach (Bourtoule et al., 2021) and splits graph into disjoint partitions (shards).
Upon receiving an unlearning request, only the model on the affected shards is retrained.
However, as splitting the training graph into disjoint partitions will damage the original graph structure, GraphEraser could downgrade the accuracy of the unlearned model signiﬁcantly, especially when a large number of edges is to be removed.
This has been demonstrated in our experiments.
Certiﬁed machine unlearning.
Certiﬁed removal (Guo et al., 2020) deﬁnes approximate unlearning with a privacy guarantee (indistinguishability of unlearned models with retrained models), where indistinguishability is deﬁned in a similar manner as differential privacy (Dwork et al., 2006).
Certiﬁed removal can be realized by adding noise sampled from either Gaussian distribution or Laplace distribution on the weights (Golatkar et al., 2020a;
Wu et al., 2020; Neel et al., 2021; Golatkar et al., 2021; Sekhari et al., 2021), or adding perturbation on the loss function (Guo et al., 2020). (Chien et al., 2022) provides the ﬁrst certiﬁed GNN unlearning solution. It only considers simple graph convolutions (SGC) and their generalized PageRank (GPR) extensions.
To achieve a theoretical guarantee for certiﬁed removal, it adds noise to the loss function.
However, as shown in our empirical evaluation (Section 5), the certiﬁed unlearning leads to signiﬁcant loss of target model due to the added noise.
Explanations of deep ML models by inﬂuence functions. One of the challenges of deep ML models is its non-transparency that hinders understanding of the prediction results.
Recent works (Koh & Liang, 2017) adapt the concept of inﬂuence function - a classic technique from robust statistics — to formalize the impact of a training point on a prediction.
Broadly speaking, the inﬂuence function attempts to estimate the change in the model’s predictions if a particular training point is removed.
Very recently, the concept of inﬂuence function has been extended to GNNs.
For instance, inﬂuence functions are designed for GNNs to measure feature-label inﬂuence and label inﬂuence (Wang et al., 2019).
Node-pair inﬂuence, i.e., the change in the prediction for node u if the features of the other node v are reweighted, is also studied (Wu et al., 2022).
Unlike these works, we estimate the edge inﬂuence, i.e., the effect of removing particular edges on GNN models.
C ONCLUSION
In this work, we study the problem of edge unlearning that aims to remove a set of target edges from
GNNs.
We design an approximate unlearning algorithm named EraEdge which enables fast yet effective edge unlearning in GNNs.
An extensive set of experiments on four representative GNN models and three benchmark graph datasets demonstrates that EraEdge can achieve signiﬁcant speedup gains over retraining without sacriﬁcing the model accuracy too much.
There are several research directions for the future work.
First, while EraEdge only considers edge unlearning, it can be easily extended to handle node unlearning, as removing a node v from a graph is equivalent to removing all the edges that connect with v in the graph.
We will investigate the feasibility and performance of node unlearning through EraEdge , and compare the performance with the existing node unlearning methods (Chien et al., 2022).
Second, an important metric of unlearning performance is unlearning capacity , i.e., the maximum number of edges that can be deleted while still ensuring good model accuracy.
We will investigate how EraEdge can be tuned to meet the capacity requirement.
Third, we will extend the study to a relevant topic, continual learning (CL), which studies how to learn from an inﬁnite stream of data, so that the acquired knowledge can be used for future learning (Chen & Liu, 2018).
An interesting question is how to support both continual learning (Chen & Liu, 2018) and private unlearning (CLPU) (Liu et al., 2022), i.e., the model learns and remembers permanently the data samples at large, and forgets speciﬁc samples completely and privately.
We will explore how to extend EraEdge to support CLPU.
A A PPENDIX A. P ROOF OF T HEOREM
Proof.
For simplicity, we ﬁrst deﬁne
[Equation]
Then
[Equation]
we formulate a GNN learning process as
[Equation]
Since removing edges can be considered as perturbing the input
[Equation]
we introduce Eqn 9, θ
[Equation]
= arg
[Equation] [Equation]
We note a necessary condition is that the gradient of Eqn 15 at θ (cid:15) is zero.
Then, we have
[Equation] [Equation]
Next, we apply Taylor series at θ
OR and we get
[Equation]
OR
[Equation]
where we have dropped o ( θ OR − θ (cid:15) ) for approximation.
Then Eqn (17) is a linear system of E UL , the inﬂuence of E UL .
Since θ OR is the minimum of Eqn (14), we have 1 | V | ∇ R ( θ OR , V, E )
= 0 .
As (cid:15) is a small value, we drop the two o ( (cid:15) ) terms and have the following:
[Equation]
Suppose Eqn (14) is convex, then
[Equation]
Denote
[Equation]
where
H OR := ∇ 2 1 | V | (cid:80) v ∈ V L ( θ OR , v, E ) .
[Table]
A. A DDITIONAL D ETAILS OF E XPERIMENTAL S ETUP
Description of datasets. Table 5 summarizes the statistical information of the three graph datasets (Cora, Citeseer, and CS) we used in the experiments.
Cora and Citeseer datasets are citation graphs, while CS dataset is a co-author graph. Additional details of model setup.
To ensure fair comparison between the retrained and unlearned models, we use the same model size (i.e., same number of layers and number of neurons) for both retraining and unlearned models.
All GNN models are trained with a learning rate of 0.001.
We train the models by 1,000 epochs, with the early-stopping condition as that the validation loss does not decrease for 20 epochs.
A. A DDITIONAL P ERFORMANCE R ESULTS
Model efﬁciency.
Figure 4 presents the model efﬁciency results on the three datasets.
We observe that EraEdge is signiﬁcantly faster than retraining.
For example, EraEdge outperforms by 9.95 × , 5.41 × , 69.36 × , and 3.12 × on CS dataset respectively over retraining (Figure 4 (c), (f), (i), and (l)).
Model accuracy.
Figure 5 presents the results of model accuracy for all settings.
First, the accuracy of the target model by EraEdge is very close to that by the retrained model.
In particular, the average difference in model accuracy between retrained and unlearned models are in the range of [0.11%, 0.68%], [0.02%, 0.74%], [0.06%, 0.65%] and [0.07%, 1.00%] for GCN, GAT, GraphSAGE, and
GIN on Cora, [0.01%, 0.71%], [0.05%, 0.44%, [0.05%, 0.65%], and [0.02%, 1.25%] on CiteSeer, and [0.02%, 0.22%], [0.01%, 0.20%, [0.05%, 0.23%], and [0.01%, 0.22%] on CS, respectively.
Furthermore, the model accuracy of the unlearned model stays close to that of the retrained model, regardless of the number of removed edges.
This demonstrates that EraEdge can handle the removal of a large number of edges. A. S EQUENTIAL U NLEARNING (NEW)
So far we only considered deleting of one batch of edges.
In practice, there can be multiple batch deletion requests to forget the edges in a sequential fashion.
Next, we focus on the scenario where multiple edge batches are removed sequentially.
Speciﬁcally, we divide the to-be-removed E UL into k > 1 disjoint batches { B i } ki =1 , with each batch consisting of the same number of edges.
For each batch B i ( 1 ≤ i ≤ k − 1) , we consider the target model obtained from retraining/unlearning of the previous batch B i − 1 as the original model θ OR , and update θ OR by removing B i (either by retraining or unlearning).
We evaluate the target model accuracy under sequential unlearning and compare it with that under one-batch unlearning.
We consider k = 4 , and reports the target model accuracy for deleting E UL in one batch and deleting
E UL in k = 4 batches in Table 6.
We also report the target model accuracy of the retrained and unlearned models at each batch.
We observe that, ﬁrst, the accuracy of the unlearned model remains close to the retrained model at each batch during sequential removals.
Second, the performance of the unlearned model after removing k batches stays close to that of the model after single-batch unlearning.
These results demonstrate that EraEdge can handle sequential deletion of multiple batches of edges.
A. U NLEARNING WITH N ODE F EATURES (NEW)
In Section 5 we mainly considered the node features that are randomly initialized to eliminate the possible dominant impact of node features on model performance.
Next, we evaluate the perfor-
[Figure]
l
[Figure]
a r n i n g t
i
[Figure]
[Figure]
[Figure]
[Figure]
[Figure]
U n l e a r n i n g t i m e ( s e c o n d s )
[Figure]
[Figure]
GraphSAGE
[Figure]
o d e l a cc u r a c y
[Figure]
[Figure]
mance of EraEdge that uses the original node features.
Figure 6 reports the target model accuracy of the unlearned model that is trained with or without the node features.
We have the following main observations.
First, the target model accuracy improves signiﬁcantly by considering the original node features.
This shows that the node features have dominant importance on the target model performance in this setting.
However, the target model accuracy of the unlearned model still stays close to that of the retrained model.
In other words, EraEdge still can make GNNs forget the edges effectively even when node features have dominant importance over the graph structure on model performance.