Knowledge Unlearning for Mitigating Privacy Risks in Language Models (2023)

Abstract: Pretrained Language Models (LMs) memorize a vast amount of knowledge during initial pretraining, including information that may violate the privacy of personal lives and identities. Previous work addressing privacy issues for LMs has mostly focused on data preprocessing and differential privacy methods, both requiring re-training the underlying LM. We propose knowledge unlearning as an alternative method to reduce privacy risks for LMs post hoc. We show that simply performing gradient ascent on target token sequences is effective at forgetting them with little to no degradation of general language modeling performances for larger-sized LMs. We also find that sequential unlearning is better than trying to unlearn all the data at once and that unlearning is highly dependent on which kind of data (domain) is forgotten. By showing comparisons with previous methods known to mitigate privacy risks for LMs, we show that our approach can give a stronger empirical privacy guarantee in scenarios where the data vulnerable to extraction attacks are known a priori while being much more efficient and robust.

## introduction recent work has shown that an adversary can extract training data from pretrained language models (lms) including personally identifiable information (pii) such as names, phone numbers, and email addresses, and other information such as licensed code, private clinical notes, and 128-bit uuids @xcite @xcite . in 2021, an ai chatbot iruda became the first ai system to be sued for violating the personal information protection act after generating the exact home addresses and bank account numbers of actual individuals unintentionally @xcite . @xcite has also shown that gpt-3 @xcite , one of the most well-known lm currently in commercial use, offered detailed private information about the editor-in-chief of mit technology review including his family members, work address, and phone number. considering findings that show extracting training data gets easier as lms scale to larger sizes @xcite and that it is common practice for practitioners to release billion parameters pretrained lms for public use @xcite @xcite , it has become important to provide privacy guarantees for large lms. practitioners are required to delete personal information from the lms by individuals' request because each individual has the "right to be forgotten (rtbf)" @xcite and can limit the direct and indirect commercial use of their personal information @xcite . previous methods addressing privacy risks for language models attempt to remove all private information from the training data (data preprocessing) @xcite @xcite or attempt to design algorithms that ensure differential privacy (dp) @xcite @xcite @xcite . both approaches require retraining the underlying lm every time individuals want to practice their rtbf, which makes them inadequate for large lms that are extremely costly to retrain. furthermore, as pointed out by @xcite , data preprocessing methods assume private information to be easily identifiable, specified, and removed and dp algorithms can only guarantee protection for information that has clear privacy borders, which makes them inadequate in the real-world scenarios where the standard of privacy might differ by each individual. to this end, we propose knowledge unlearning (figure 1 ) as an efficient solution that can be applied with just a few parameter updates instead of pretraining the underlying lm again. we perform experiments on gpt-neo lms (125m, 1.3b, 2.7b) @xcite and show that simply changing the gradient descent to the opposite direction during language modeling (which can also be seen as maximizing instead of minimizing the loss function) is effective at protecting target sequences from extraction attacks with little to no performance degradation on the initial lm capabilities measured via 13 downstream nlp tasks: 9 common classification benchmarks and 4 dialogue tasks. for some cases, knowledge unlearning unexpectedly shows significant improvements in lm performance for some of the benchmarks. we compare our approach with data deduplication method @xcite and differential privacy decoding method @xcite which are both known to mitigate privacy risks and show the effectiveness of knowledge unlearning by providing strong privacy protection while being much more efficient and robust. we also provide a general guideline that can be used to quantify the memorization and extraction likelihood of target token sequences and suggest when we can empirically consider them to have been "forgotten". specifically, we introduce a novel metric that measures the extraction likelihood by varying the prefix length of the target token sequence and quantifying how much of the suffix is actually extracted from the lm. surprisingly, for knowledge unlearning, we find that it is easier to forget a chunk of instances sequentially rather than trying to forget them all at once. we provide further analysis and show that the difficulty of knowledge unlearning depends heavily on the target data being forgotten, especially the domain of the target data. we also provide empirical examples of performing extraction attacks and how exactly knowledge unlearning provides privacy protection for the lm. to summarize, our main contributions are fourfold: ## conclusion in this paper, we propose knowledge unlearning as a method for mitigating privacy risks in lms that provides a strong privacy protection with little to no degradation of general lm capabilities measured by evaluating on 9 common lm classification benchmarks and 4 dialogue benchmarks for the larger sized lms. as large lms expand their use cases, potentially affecting the daily lives of people, the research community should make sure that the privacy of individuals is not violated intentionally or unintentionally by the knowledge stored in the implicit parameters of these models. since it is inherently impossible to prevent and predict all future privacy concerns prior to pretraining the lm, we suggest the community consider knowledge unlearning for ensuring privacy upon individuals' requests post hoc pretraining.