Data Unlearning in Diffusion Models

We appreciate the reviewer's comment stating our paper is “mostly well-written.”

Weaknesses:

1. The claim that sampling from the unlearning set $A$ is beneficial for our loss is empirically justified by our ablations over $\lambda$:

   • $\lambda=0$: Only sample from $X\setminus A$
   • $\lambda=1$: Only sample from $A$
   • $\lambda=0.5$: Sample from both $X\setminus A$ and $A$

   All our experiments in the paper (e.g., Tables 1 and 2) show that $\lambda=0.5$ has significantly better unlearning performance than $\lambda=0$ which shows why sampling from the unlearning set $A$ in the loss function is crucial for our method.

2. It is not true that sampling from a mixture of two normal distributions generates an interpolated version of two noisy images. You might have been thinking of the linear combination of samples from two normal distributions (which would indeed be an interpolation and would cause strange effects). Our objective can intuitively be thought of: With $\lambda=0.5$ probability, we sample from a normal centered at $x\in X\setminus A$, with $1-\lambda=0.5$ probability, we sample normal centered at $a\in A$.

3. The reason why we present both variants SISS (no IS) and SISS (with IS) of our loss function is because SISS (no IS) might be the preferred choice for many readers. Indeed, the computational overhead only occurs at training and is negligible in many cases, so SISS (no IS) might be preferred because of its simplicity. However, SISS (with IS) uses half as many forward passes per step and achieves similar results. In particular, it uses half as much GPU memory which is relevant for many practitioners. Moreover, we found the importance sampling variant interesting because of its theoretical guarantees in being unbiased.

   We also appreciate the suggested alternative loss function and would be glad to explore it in future work. The proposed loss function would be equal to SISS (with IS), wherever one of the importance weights is zero. However, wherever both of the importance weights are non-zero, SISS (with IS) has effectively 2x the batch size compared to the proposed loss due to incorporating both naive deletion and NegGrad terms. Empirically, for higher timesteps the importance weights are non-zero (see MNIST IS ratios at https://drive.google.com/file/d/1SyqVq1kLMMNdrtbcfH1M1lfqErvioOWm/view?usp=sharing) and for lower timesteps one weight is zero. Intuitively, the higher timesteps are important because they are where the diffusion process decides whether to collapse into the memorized image.

Questions:

1. See item 1 in weaknesses.
2. Recall that the IS ratios in the SISS loss (Eq. 8 of our paper) are given by: $\frac{q\left(m_t| x\right)}{(1-\lambda) q\left(m_t| x\right)+\lambda q\left(m_t| a\right)}= \frac{1}{(1 - \lambda) + \lambda \frac{q(m_t | a)}{q(m_t | x)}}$ and $\frac{q\left(m_t| a\right)}{(1-\lambda) q\left(m_t| x\right)+\lambda q\left(m_t| a\right)}= \frac{1}{(1 - \lambda) \frac{q(m_t | x)}{q(m_t | a)} + \lambda}.$

By definition of DDPM, the densities of the noise-injecting Gaussians are given by: $q(m_t | x) = \mathcal{N}(m_t; \gamma_t x, \sigma_t^2 I) = \frac{1}{(2\pi \sigma_t^2)^{d/2}} \exp\left(-\frac{1}{2\sigma_t^2} \|m_t - \gamma_t x\|_2^2\right),$ $q(m_t | a) = \mathcal{N}(m_t; \gamma_t a, \sigma_t^2 I) = \frac{1}{(2\pi \sigma_t^2)^{d/2}} \exp\left(-\frac{1}{2\sigma_t^2} \|m_t - \gamma_t a\|_2^2\right),$

Notice that in order to compute the importance ratios, we need to find the ratio of the density of the above Gaussians which is given by: $\frac{q(m_t | a)}{q(m_t | x)} = \exp\left(-\frac{1}{2\sigma_t^2} \|m_t - \gamma_t a\|_2^2 + \frac{1}{2\sigma_t^2} \|m_t - \gamma_t x\|_2^2\right),$

$\frac{q(m_t | x)}{q(m_t | a)} = \exp\left(-\frac{1}{2\sigma_t^2} \|m_t - \gamma_t x\|_2^2 + \frac{1}{2\sigma_t^2} \|m_t - \gamma_t a\|_2^2\right).$

3. For each CelebA experiment we selected one celebrity face datapoint to unlearn ($|A|=1$). To reduce variance, we ran the experiment $n=6$ times with randomly chosen data points and reported average metrics in Table 1 and Figure 4a. We chose the number $n=6$ because that was the maximum that fit in our computational budget.

4. See item 3 in weaknesses.

We appreciate the reviewer’s assessment that our paper is “well written” and “makes a valuable contribution to the field.”

Weaknesses:

1. One limitation of generating synthetic data for SD lies with how SISS was derived based on unlearning training samples. Our synthetic examples were not used to train SD but were empirically sufficient for unlearning purposes as seen in Figure 6 of the paper. However, the primary limitation was in the manual construction of the modified prompts detailed in Figure 5. This process required manual trial and error of inserting and deleting tokens to obtain greater sample diversity.

2. The interpretation of SISS being an improvement over retraining in Figure 4(b) means it is less likely to generate a T-Shirt due to the way our method specifically targets unlearning it. While retraining doesn’t produce any T-Shirts anyway, there is nevertheless some likelihood, however small it may be, of generating a T-Shirt. With SISS, this likelihood is even smaller.

We appreciate the reviewer’s assessment that our paper is “well-written” and “makes a valuable contribution to the field.”

Weaknesses:

1. For greater theoretical justification, we have proven a new result that shows for small learning rates, all SISS variants (with IS and no IS) must improve wrt. naive deletion loss. As a result, this provides a guarantee that model quality will not degrade. You can find a PDF with details of this lemma at https://drive.google.com/file/d/1B1rDuibatkhVp33ducUGKeSi9m69-lSp/view?usp=sharing. The intuition is that the gradient clipping we use makes it so that the naive deletion gradient dominates the NegGrad gradient, so the majority of gradient updates goes towards preserving model quality (i.e., naive deletion). The lemma does not provide guarantees around whether unlearning will occur, but our empirical results indicate that unlearning does occur.

2. Addressed below in questions.

Questions:

2. Here are additional results for $\lambda=0.25, 0.75$:

CelebA-HQ (Table 1 in Paper)

MNIST T-Shirt (Table 2 in Paper)

As long as $\lambda$ is not too far from $0.5$, results will be similar. Generally, the objective of IS is to reduce estimator variance. $\lambda$, in particular, controls the tradeoff in variance between naive deletion and NegGrad. If $\lambda$ is close to $1$, then we will have a good estimate for NegGrad but a poor one for naive deletion and vice versa for $\lambda\approx 0$.

The superfactor has a significant impact on quality degradation. With SISS, the superfactor is auto-tuned to keep the NegGrad gradient norm at a fixed fraction of the naive deletion gradient norm. If this clipping-based setting of the superfactor is not done, then model quality significantly degrades because of NegGrad’s exploding gradient, rendering unlearning results meaningless.

3. The reason why we present both variants SISS (no IS) and SISS ($\lambda=0.5$) of our loss function is because SISS (no IS) might be the preferred choice for many readers. The computational overhead of SISS (no IS) is negligible in many cases and might be preferred because of its simplicity. However, SISS ($\lambda=0.5$) uses half as many forward passes per step and achieves similar results. In particular, it uses half as much GPU memory which is relevant for many practitioners. Moreover, we found the importance sampling variant interesting because of its theoretical guarantees in being unbiased.

   Regarding $\lambda=1$ missing from Figure 3, it was not included because of the quality degradation quantitatively shown in Table 1. For $\lambda=0$ missing in Figure 6, we briefly mentioned why in lines 476-478 of the paper. Namely, SISS ($\lambda=0$) had numerical instability issues from very small NegGrad terms. Removing these NegGrad terms would result in identical behavior to naive deletion.

4. There is no need to train from scratch with any of our proposed loss objectives. We do assume access to the training data $X$ and unlearning set $A$ in order to sample from them in Eq. (4). However, all our experiments start from a pretrained model checkpoint and fine-tune on our proposed loss objectives to achieve unlearning.

We appreciate the reviewer’s assessment that our paper is “well written and structured” and our approach “has not been explored in the literature so far.”

Weaknesses: Fully addressed by questions.

Questions:

1. With regards to retraining, it is very expensive (e.g., in Table 2 retraining requires 117500 steps) since it does not start from a pre-trained checkpoint. All other unlearning methods we test start from a pre-trained checkpoint, and the computational cost among them can be measured through the number of forward passes in the loss function. As a concrete example, this is the SISS loss (Eq. 5 in the paper):

Notice there is only one forward pass through the denoising network due to the term $\epsilon_\theta(m_t, t)$.

However, in the SISS (No IS) loss function (Eq. 4 in the paper),

we observe there are two forward passes due to the terms $\epsilon_\theta(x_t, t)$ and $\epsilon_\theta(a_t, t)$ making it twice as computationally expensive.

2. We agree that it is inconsistent to have shared timesteps for CelebA-HQ (Table 1) but not for MNIST T-Shirt (Table 2). Here are the updated numbers of the red methods in Table 2 after 300 fine-tuning steps:

MNIST T-Shirt Results (Table 2 in Paper)

The main difference is that the quality metric (Inception Score) for those red methods is significantly worse. They have higher NLL but that is not very meaningful if the model quality is already very poor.

3. Here are additional results for $\lambda=0.25, 0.75$:

CelebA-HQ (Table 1 in Paper)

MNIST T-Shirt (Table 2 in Paper)

As long as $\lambda$ is not too far from $0.5$, the results will be similar. Generally, the objective of IS is to reduce estimator variance. $\lambda$, in particular, controls the tradeoff in variance between naive deletion and NegGrad. If $\lambda$ is close to $1$, then we will have a good estimate for NegGrad but a poor one for naive deletion and vice versa for $\lambda\approx 0$.

The extra whitespace on page 8 will be fixed in the camera-ready version of the paper.

Thanks for pointing out the lack of clarity! We have updated the codebase and uploaded the latest version to https://github.com/claserken/SISS. The updated ddpm_deletion_loss.py specifies the matching to unlearning methods in our paper.