UGradSL: Machine Unlearning Using Gradient-based Smoothed Label

1. Thanks for your clarification of these two retraining definitions. First, as we state in Section 3, not all of the retrained models are exact MU because the convergence of the deep learning model is hard to determine. Given a fixed forgetting set and model, the prediction distribution on $D_f$ from the exact MU model should be determined. Here, we want to state that retrained-based MU is hard to balance between unlearning efficacy and computational complexity. In our next version, we will revise these sentences to make them more precise.

2. As mentioned above, one (not all) of the retrain models can be the exact MU model, which is what Definition 1 tells us. For example, we can train CIFAR-10 using ResNet for 1, 10, and 100 epochs. They are all from the distribution of the retraining model. We don’t think they are all exact MU, or maybe none of them are exact MU. As stated above, given a fixed forgetting set and model, the prediction distribution on $D_f$ from the exact MU model should be determined. The exact MU should treat the forgetting dataset as never seen before at the sample level. Please note that we have a sentence below Definition 1 showing that retrain is effectively an approximation of exact MU, meaning that most retrain is effectively an approximation of exact MU, which is not exact MU because exact MU is very hard to reach and determine in the deep learning scenario. Exact MU is a further case of the retrain model in general.

3. Thanks for pointing it out. First, UA is not for privacy efficacy. The MIA we use is from [1]. A higher MIA means less information on $D_f$ remains in the unlearned model. Then, we want to state that not all the retrained models can be regarded as exact MU, as we mentioned above. The real exact MU is hard to determine. In addition, how we can evaluate this in real cases should be considered if we don’t have retrained models like ChatGPT, DALLE-2, etc. If we always rely on the retrained model to evaluate the MU methods or select the hyper-parameters, the practical meaning of MU will be much less meaningful. If we cannot access a retrained model in real life, it is hard to compare with the retrained model even to claim privacy leakage. For the cases that cannot access a retrained model, [2, 3] also gives up the retrained model baseline to compare, especially in diffusion models.

We also consider the privacy issue for this “the higher, the better” metric. We compare the distribution difference between the forgetting and testing sets, which should be similar because both datasets are unseen datasets for the unlearned model. Our method shows a similar distribution in Section D.10 in the Appendix.

[1] Jia, Jinghan, et al. "Model Sparsity Can Simplify Machine Unlearning." Thirty-seventh Conference on Neural Information Processing Systems. 2023.

[2] SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation https://openreview.net/forum?id=gn0mIhQGNM&noteId=E7HA5uwCaw

[3] Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models https://openreview.net/forum?id=PuRhqpBTmj

We have read the competition instructions, and the organizer uses 512 retrained models to evaluate the $\mathcal{F}$. It is perfect for the ideal cases. As stated in Google's doc, their evaluation metrics may not be a perfect way. We also admit that our evaluation metrics may need improvement. However, we hope our insight and design of the evaluation metrics can help.

4. Thanks for pointing it out. I understand your perspective is from privacy protection, making forgetting datasets more distinguishable. The entropy metrics are from the information theory perspective. The extreme of forgetting is to randomly guess, which is our idea about exact machine unlearning. For exact MU, the model should behave as not seeing the sample completely, which should randomly guess. As for your concerns about privacy protection, we also have the experiment shown in Section D.10 in the Appendix. The prediction on the forgetting dataset and testing dataset are almost the same. They are both unseen datasets, which should be reasonable.

Weakness:

(a) Thanks for your question. First, we argue that not all the retrain models can be seen as exact MU models because retraining based on deep learning in an iterative style is very sensitive to hyperparameters. It is hard to determine whether the mode is converged or not. Given the forgetting dataset D_f and the model, the exact MU model should be determined, which should not be influenced by the hyper-parameters. From the theory of information, the unknown status of one data point should be random, whose entropy is highest.

We admit that your example is valid because of the model generalization. However, the current unlearn is still an approximate MU rather than the real exact MU. Again, from the theory of information, the exact MU predicts the unknown data point should be random.

(b) Thanks for your advice. We will revise it in our next version.

(c) Thanks for your advice. We will recheck the notation and terminologies in our next version. As for the Unlearning Diagram, it is a typo of the Unlearning Paradigm.

(d) Thanks for your advice. We will modify the contribution list.

(e) Thanks for your question. We have noticed that references [2-4] do use a retrained model as the baseline. However, it should be noted that we often cannot access the retrained model in real usage, especially for industry-level large language models. Some of the methods are sensitive to hyperparameters like the number of epochs, learning rate, etc. It is impossible to find a more suitable parameter that makes the performance of the unlearned model closer to the retrained model because we don’t have the retrained model in real usage. Thus, we believe that we cannot use the performance of the retrained model as a baseline. For the reason why the higher is the better, it is natural to have the unlearned model hurt the testing or remaining performance as little as possible. For the classification task, if the fewer data points the unlearned model can remember, the higher the unlearning errors and the better the unlearning is.

Questions:

(a) Because Eq. 8 is the subtraction of Eq. 6 and 7. Eq. 6 and 7 are the approximations of Taylor Series which are approximately equal. We will revise this statement in our next version.

(b) Thanks for your question. First, a, b, and c are vectors here with directions. Random outputs mean that the gradient of the target label and the non-target label are diverse or not in the same direction because every time, the largest gradient will point to different labels (directions), which is what <a-b, c-b> tells us.

(c) For different datasets, the alpha, E and p are different which shows the different difficulties to unlearn. For example, class-wise unlearning should be easier than random unlearning. Alpha should be smaller in random unlearning. But it should be noted that our method does not rely on the unseen data because our metrics are higher, the better. Thus, it is suitable for the method always to find a better parameter as given in Section D.9 in the Appendix.

No. Our method only relies on the pre-trained model and does not rely on the pre-trained parameters.

(d) We selected the baseline methods mainly based on [1] and boundary unlearn, which is accepted in CVPR 2023. The reason why we have some missing values is that some of the methods only work on one modality or the method is too slow for a very large dataset like ImageNet, CelebA. Our methods are general for both vision and language.

[1] Jia et al. Model sparsification can simplify machine unlearning[J]. arXiv preprint arXiv, 2023.

1. Thanks for your suggestion. It should be noted that our framework only considers the converged weight. What we did is to make the Taylor expansion on these converged weights as shown in Equations 6 and 7. The converged model weight can be seen as locally convex. We did not consider any model weight which is not converged.

2. Thanks for your advice. We will add these references and compare these methods in our next version.

3. Thanks for your advice. We will look at them very carefully and seriously consider integrating the framework into ours in our next version.

4. Thanks for your question. Our method is based on the existence of ideal retraining in close form. This expression is hard to get. The current widely accepted definition is given in Definition 1. It is hard for us to provide the error range based on the expression in Definition 1.

5. Thanks for your advice. UGradSL+ is a method based on the finetune. Actually, all our methods are based on the pre-trained model. Thus, it can be regarded as locally convex as what we mention in the first answer.

6. Thanks for your advice. We will seriously consider adding this plot in our next version.

7. Thanks for your advice. Our settings is not based on the adaptive unlearning framework. But your suggestion can be a direction of our future work.

8. First, evaluating the unlearning performance based on weight is unreasonable. According to [1], the same output can be from two models with totally different weights. Thus, a model which is not unlearned is also likely to predict similar results as the one unlearned. That's the reason why we use the output rather than the weight. As for the information removal, as we mentioned in Evaluation Metrics and [2], A higher MIA-Efficacy implies less information about $D_f$ in $\theta_u$ where $D_f$ is the forgetting set and $\theta_u$ is the unlearned model weight.

[1] Thudi, Anvith, et al. "On the necessity of auditable algorithmic definitions for machine unlearning." 31st USENIX Security Symposium (USENIX Security 22). 2022.

[2] Jia et al. Model sparsification can simplify machine unlearning[J]. arXiv preprint arXiv, 2023.