Pseudo-Probability Unlearning: Towards Efficient and Privacy-Preserving Machine Unlearning

Thank you for recognizing the extensive experimentation in our work. We appreciate your suggestions, and our responses are as follows:

(1) Efficiency and Privacy Leakage: We evaluate both efficiency and privacy in Sections 5.5 and 5.6. Privacy is primarily assessed using the membership inference attack, while efficiency is measured by the* total computation time* required. The results of the membership inference attack are presented in Table 4. We will clearly define these in the revised version.

(2) Random Distribution vs. Membership Inference Attack: The random distributions are proposed to achieve a high forget error on the forget set without requiring optimization to maximize the forget error. This approach is cost-efficient and does not require access to the forget set's labels. Membership inference attack is not mitigated by the uniform distribution itself but by applying the optimization goal upon the uniform distribution to minimize the discrepancy between the retained and unlearned models, as shown in Equation 1. This step ensures that the unlearned model remains close to the retained model, improving performance on the retained set and reducing the risk of membership inference attacks on the forget set. Table 4 shows the effectiveness of our approach in mitigating membership inference compared with baselines.

(3) Typos: We appreciate the reviewer for pointing out typos in the original submission. The reference to "Figure ??" originally refers to Figure 1. We have addressed and corrected this, along with several other typos, in the rebuttal version.

Thank you for recognizing our work's contribution to privacy on machine unlearning. We appreciate your suggestions, and our responses are below:

(1) Membership Inference Attack: The evaluation of the membership inference attack is detailed in Section 5.5, titled "Protect Privacy." The results, which compare our method to others, are presented in Table 4. In this table, our proposed method, PPU, demonstrates superior performance compared to alternative approaches, particularly in the ResNet large-scale class and selective unlearning tasks, as well as the ALL-CNN selective unlearning task.

(2) Uniform/Random Distribution vs. Membership Inference Attack: The uniform and random distributions are proposed to achieve a high forget error on the forget set without requiring optimization to maximize the forget error. This approach is cost-efficient and does not require access to the forget set's labels. Membership inference attack is not mitigated by the uniform distribution itself but by applying the optimization goal upon the uniform distribution to minimize the discrepancy between the retained and unlearned models, as shown in Equation 1. This step ensures that the unlearned model remains close to the retained model, improving performance on the retained set and reducing the risk of membership inference attacks on the forget set.

Thank you for acknowledging our work as a novel approach to machine unlearning. We sincerely appreciate your valuable suggestions, and our responses are provided below:

(1) Contribution: We propose a novel machine unlearning framework that focuses on two key tasks: removing bias and protecting privacy. Our approach introduces a new perspective by optimizing the final layer probabilities, a technique not previously explored by existing unlearning methods to the best of our knowledge. Additionally, we provide proof showing that our method converges to a unique optimal solution and can be efficiently solved using coordinate descent. Our method achieves a higher forget error in bias removal tasks while maintaining performance comparable to a retrained model in privacy protection tasks.

(2) Typos: Thanks for pointing out that we incorrectly categorized SISA as an approximate unlearning method. It is, in fact, an exact unlearning method, and we will update this accordingly. Additionally, \lambda_k​ should be replaced with \alpha_k​, and the reference on line 485 should be corrected to "retain error" instead of "retrain error." We have addressed and corrected these, along with several other typos, in the rebuttal version.

(3) Differences between 5.4 and 5.5: Goals 5.4 and 5.5 have distinct objectives. Goal 5.4 evaluates unlearning performance on the forget set, measured by the forget set error, where higher values indicate better unlearning. Goal 5.5 evaluates privacy leakage risk, measured by membership inference attacks, where lower values are preferred. These goals are achieved simultaneously by assigning pseudo-probabilities to the forget set's logit layer to optimize the forget error. The unlearned model is then refined by minimizing the discrepancy between the retained and unlearned models, making it harder to differentiate the forget set from other data. We acknowledge that the current section titles may be confusing and will revise them to “5.4 Unlearning Performance” and “5.5 Membership Inference Attack” for clarity.

(4) Experiment on Imagenet We evaluated our method on ImageNet-1K with class unlearning for forgetting a single class. For this experiment, we utilized the ResNet-50 v1.5 architecture [4], which was pre-trained on ImageNet-1K and publicly available. Our results demonstrate that our method achieves a forget error of 82% and a retain error of 30%. Furthermore, under a membership inference attack, it achieves an approximate success rate of 60.2%.

Thank you for recognizing our work's contribution to privacy on machine unlearning. We appreciate your suggestions, and our responses are below:

(1) Why focus on Classification tasks?

Classification is an important and foundational task that has been the focus of many prior unlearning methods [1, 2]. We focus on the classification task to ensure comparability with existing approaches. However, we acknowledge the significance of extending unlearning techniques to other tasks, such as generative tasks, and plan to explore these directions in future work.

(2) Why maximize the forgotten error instead of minimizing the discrepancy between the retained and unlearned models?

Thank you for your question. We respectfully note a potential inconsistency in the review, as these two statements conflict. If we understand correctly, the reviewer is asking why our optimization goal is to "maximize the forget error" (listed as the first weakness) rather than "minimize the forget error" (listed as the first question). To clarify, we do not adopt an optimization-based approach to maximize the forgotten error. Instead, we modify the forget set's probabilities into pseudo-probabilities, which reduces computational costs while maintaining strong forgotten performance. Forgotten performance, as typically evaluated by the forgotten error in prior work [1, 2, 3], is preserved in our approach. Following the application of pseudo-probabilities, our method indeed includes minimizing the discrepancy between the retained and unlearned models, as shown in Equation 1. This step ensures that the unlearned model remains close to the retained model, resulting in better performance on the retained set and reduced risk of membership inference attacks on the forget set.

(3) Experiment on Imagenet

We evaluated our method on ImageNet-1K with class unlearning for forgetting a single class. For this experiment, we utilized the ResNet-50 v1.5 architecture [4], which was pre-trained on ImageNet-1K and publicly available. Our results demonstrate that our method achieves a forget error of 82% and a retain error of 30%. Furthermore, under a membership inference attack, it achieves an approximate success rate of 60.2%.

(4) Have you considered scenarios where the model's prediction confidence may not accurately reflect the sensitivity of the data?

The unlearned sensitive dataset is predefined instead of considering the model’s prediction, as outlined in Section 5.2. We adopt the settings described in Kurmanji et al. (2024). The objective of unlearning methods is to ensure that the model forgets the specified samples, making it behave as if it had never been trained on those samples.

(5) What are the key factors that influence the trade-off between privacy preservation and model performance in the context of machine unlearning?

To protect privacy, the model's performance on the forget set should be similar to that of a retrained model. If the forget error on the forget set is excessively high, it becomes easier for membership inference attacks to identify the unlearned examples.

(6) Forget error and retain error metrics.

The forget error metric quantifies how well the model has forgotten specified data by calculating the error rate (100% minus accuracy) on the forget set. Similarly, the retain error measures the error rate on the retain set, evaluating how much the model's performance on other datasets is preserved. While the forget error highlights the effectiveness of the unlearning process, the retain error ensures that unlearning does not negatively impact the model's performance on unrelated data.

Typo for figure 3 and figure 4.

Thanks for pointing out this. In line 408, “Figure 3” should be replaced with “Table 3”. This table demonstrates that the model's performance on the forgotten set is comparable to that of the retrained model. Additionally, the membership inference attack is presented Table 4 instead of Figure 4. We have addressed and corrected these, along with several other typos, in the rebuttal version.

[1] Kurmanji, M., Triantafillou, P., Hayes, J., & Triantafillou, E. (2024). Towards unbounded machine unlearning. Advances in neural information processing systems, 36.

[2] Kodge, S., Saha, G., & Roy, K. (2023). Deep Unlearning: Fast and Efficient Training-free Approach to Controlled Forgetting.

[3] Chundawat, V. S., Tarun, A. K., Mandal, M., & Kankanhalli, M. (2023, June). Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In Proceedings of the AAAI Conference on Artificial Intelligence (Vol. 37, No. 6, pp. 7210-7217).

[4] He, K., Zhang, X., Ren, S., & Sun, J. (2016). Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 770-778).