Machine Unlearning

The Sharded, Isolated, Sliced, and Aggregated (SISA) framework pre-structures training to make unlearning trivial. Data is partitioned into independent shards, each training a separate sub-model. When a deletion request arrives, only the shard containing the target data is retrained from its last checkpoint before the data point was introduced. The final prediction is an aggregation of all shard outputs. This provides a mathematical guarantee of exact removal, but introduces storage overhead for checkpoints and a slight accuracy penalty due to sharding.

This approach frames unlearning as a parameter perturbation problem. After training, the influence of a data point is removed by applying a single Newton-style update to the model weights. The update is computed using the Hessian of the loss function, effectively scrubbing the gradient contribution of the forgotten data. This method provides a differential privacy-style guarantee (ε-certified removal) that the unlearned model is statistically indistinguishable from one trained without the data. It is computationally efficient but assumes the model is near a local minimum.

A direct counter-optimization technique: instead of minimizing loss on the forget set, the model performs gradient ascent to maximize error on the target data. This rapidly degrades performance on the forgotten samples. To prevent catastrophic damage to the rest of the model, a teacher-student framework is often employed where a separate model trained on retained data provides regularization. The method is simple to implement but can leave detectable traces in the weight space, making it less suitable for strict privacy guarantees.

For support vector machines, unlearning is deterministic. The model's decision boundary is defined solely by support vectors. To unlearn a data point, one simply removes it from the support vector set and recomputes the boundary using the remaining vectors. This is an exact, zero-cost operation if the point was not a support vector. If it was, only a local retraining on the affected region is required. This technique highlights how unlearning complexity is deeply tied to the inductive bias of the model class.

This method quantifies the information a data point imparts to each model parameter. The Fisher Information Matrix (FIM) measures how much the model's output distribution changes with respect to a parameter. By computing the FIM for the forget set, the algorithm identifies and selectively obfuscates the most affected weights by adding calibrated noise. This is a form of selective forgetting that leaves the majority of the model intact. It is particularly effective for generative models where output distributions matter more than point predictions.

DeltaGrad accelerates unlearning by caching intermediate training gradients. When a deletion request arrives, the algorithm retrieves the stored gradients for the forget set and subtracts their influence from the final model parameters using a Bregman divergence optimization. This avoids recomputing gradients for the entire retained dataset. The method is exact for models trained with stochastic gradient descent and provides a strong theoretical guarantee: the unlearned model is identical to one trained from scratch without the deleted data.

A legal right, often called the 'right to be forgotten' under GDPR Article 17, allowing individuals to request deletion of their personal data from a controller's systems. In the context of machine learning, this extends beyond simple database deletion to requiring the removal of the data's influence on model parameters. This legal obligation is the primary driver behind machine unlearning research, as full retraining is often computationally prohibitive. Key aspects include:

• Applies when data is no longer necessary for the original purpose
• Requires erasure without undue delay (typically 30 days)
• Extends to third-party processors and downstream systems
• Creates tension with model performance preservation

An adversarial attack where malicious data is injected into a training set to corrupt the model's learning process. Machine unlearning serves as a defensive countermeasure against poisoning by surgically removing the influence of identified poisoned samples without full retraining. The relationship is bidirectional:

• Backdoor attacks embed triggers that cause misclassification on specific inputs
• Targeted poisoning degrades performance on particular classes or demographics
• Unlearning algorithms can excise poisoned data points while preserving legitimate knowledge
• Effective unlearning requires accurate poisoned sample identification before removal

A mathematical framework that injects calibrated statistical noise into query results or training data to ensure that the presence or absence of any single individual's record is indistinguishable. Differential privacy and machine unlearning are complementary approaches to data protection:

• DP guarantees that model outputs don't reveal individual training examples
• Unlearning guarantees that specific data's influence is actively removed
• Combined approaches use DP noise during unlearning to mask residual influence
• The privacy budget (ε) quantifies the maximum information leakage permitted
• Certified unlearning often leverages differential privacy bounds for formal guarantees

The process of identifying which specific source or subset of training data is responsible for a model's particular output or behavior. Attribution is a prerequisite for targeted unlearning, as you cannot remove what you cannot trace. Key attribution methods include:

• Influence functions that estimate how removing a training point would change predictions
• TracIn which tracks gradient similarity between training examples and test predictions
• Shapley values adapted for data valuation in machine learning contexts
• Attribution enables copyright compliance by identifying infringing training sources
• Critical for debugging model failures and identifying poisoned or biased samples

The practice of tracking and managing changes to datasets over time, similar to code version control, enabling reproducibility and rollback of specific data states used in model training. Data versioning is essential infrastructure for machine unlearning because:

• Maintains an immutable lineage of which data was used in which training run
• Enables precise identification of the training set state before and after unlearning
• Supports audit trails proving that specific data was removed from the training pipeline
• Tools like DVC and LakeFS provide Git-like semantics for dataset management
• Facilitates compliance documentation for regulatory inspections

A privacy attack that determines whether a specific data record was part of a model's training dataset, potentially exposing sensitive information about individuals. Machine unlearning must address membership inference risks:

• Shadow model techniques train surrogate models to predict membership
• Successful unlearning should reduce membership inference accuracy to random chance
• Overfitting increases vulnerability to these attacks
• Unlearning verification often uses membership inference as a success metric
• Residual influence after incomplete unlearning can still be detected by sophisticated attacks