Towards Adversarial Evaluations for Inexact Machine Unlearning (2022-01-17T00:00:00.000000Z)

TL;DR

A stronger black-box evaluation method called the Interclass Confusion (IC) test which adversarially manipulates data during training to detect the insufficiency of unlearning procedures is designed.

Abstract

Machine Learning models face increased concerns regarding the storage of personal user data and adverse impacts of corrupted data like backdoors or systematic bias. Machine Unlearning can address these by allowing post-hoc deletion of affected training data from a learned model. Achieving this task exactly is computationally expensive; consequently, recent works have proposed inexact unlearning algorithms to solve this approximately as well as evaluation methods to test the effectiveness of these algorithms. In this work, we first outline some necessary criteria for evaluation methods and show no existing evaluation satisfies them all. Then, we design a stronger black-box evaluation method called the Interclass Confusion (IC) test which adversarially manipulates data during training to detect the insufficiency of unlearning procedures. We also propose two analytically motivated baseline methods~(EU-k and CF-k) which outperform several popular inexact unlearning methods. Overall, we demonstrate how adversarial evaluation strategies can help in analyzing various unlearning phenomena which can guide the development of stronger unlearning algorithms.

Authors

Philip H. S. Torr

52 papers

Ameya Prabhu

4 papers

P. Kumaraguru

3 papers

TL;DR

Abstract

Authors

References85 items

Forget Unlearning: Towards True Data-Deletion in Machine Learning

A law of adversarial risk, interpolation, and label noise

ARCANE: An Efficient Architecture for Exact Machine Unlearning

How unfair is private learning ?

Deep Unlearning via Randomized Conditionally Independent Hessians

Zero-Shot Machine Unlearning

On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning

Unrolling SGD: Understanding Factors Influencing Machine Unlearning

Machine Unlearning of Features and Labels

Learning with Selective Forgetting

A Survey on Bias in Visual Datasets

SSSE: Efficiently Erasing Samples from Trained Machine Learning Models

Adversarial Examples Make Strong Poisons

HedgeCut: Maintaining Randomised Trees for Low-Latency Machine Unlearning

DeepObliviate: A Powerful Charm for Erasing Data Residual Memory in Deep Neural Networks

Moving beyond “algorithmic bias is a data problem”

Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarks

Membership Inference Attacks on Machine Learning: A Survey

Fairness-Aware PAC Learning from Corrupted Data

Pre-Training Without Natural Images

Coded Machine Unlearning

Mixed-Privacy Forgetting in Deep Networks

Amnesiac Machine Learning

InstaHide: Instance-hiding Schemes for Private Distributed Learning

Distributional Generalization: A New Kind of Generalization

Machine Unlearning for Random Forests

What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimation

Backdoor Learning: A Survey

Instance-hiding Schemes for Private Distributed Learning

DeltaGrad: Rapid retraining of machine learning models

Large image datasets: A pyrrhic win for computer vision?

When Machine Unlearning Jeopardizes Privacy

Learn to Forget: Machine Unlearning via Neuron Masking

Systematic Evaluation of Privacy Risks of Machine Learning Models

Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observations

Approximate Data Deletion from Machine Learning Models: Algorithms and Evaluations

Machine unlearning: linear filtration for logit-based classifiers

Machine Unlearning

Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks

Certified Data Removal from Machine Learning Models

Confident Learning: Estimating Uncertainty in Dataset Labels

A Discussion of 'Adversarial Examples Are Not Bugs, They Are Features': Adversarial Examples are Just Bugs, Too

Making AI Forget You: Data Deletion in Machine Learning

A survey on Image Data Augmentation for Deep Learning

CutMix: Regularization Strategy to Train Strong Classifiers With Localizable Features

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks

Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Humans forget, machines remember: Artificial intelligence and the Right to Be Forgotten

Towards Deep Learning Models Resistant to Adversarial Attacks

FreezeOut: Accelerate Training by Progressively Freezing Layers

Generative Poisoning Attack Method Against Neural Networks

Understanding deep learning requires rethinking generalization

Membership Inference Attacks Against Machine Learning Models

Equality of Opportunity in Supervised Learning

Deep Residual Learning for Image Recognition

Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures

Understanding Neural Networks Through Deep Visualization

Towards Making Systems Forget with Machine Unlearning

Personal Information Protection and Electronic Documents Act

Incremental and decremental training for linear classification

Classification in the Presence of Label Noise: A Survey

Can machine learning be secure?

Scaling to Very Very Large Corpora for Natural Language Disambiguation

Catastrophic forgetting in connectionist networks

2021) recently show that metric-MIA, measuring simple metrics and deciding membership

2020), deleting data that induces harmful biases Prabhu & Birhane (2021); Fabbrizzi et al. (2021), and organizations requiring deletion of user data older than some retention

"Amnesia" - Machine Learning Models That Can Forget User Data Very Fast

URL https://openreview.net/forum?id=rJzIBfZAb

California consumer privacy act

such metrics can be computed on methods other than their own proposed unlearning procedure. We also exclude purely-qualitative tests such as model inversion attacks

Council of European Union. Council regulation (EU) no 269/2014

Learning Multiple Layers of Features from Tiny Images

Is There a Cost to Privacy Breaches? An Event Study