{"type":"ScholarlyArticle","title":"ARCANE: An Efficient Architecture for Exact Machine Unlearning","authors":[{"name":"Haonan Yan","slug":"haonan-yan","given":"Haonan","family":"Yan","affiliation":"State Key Laboratory of ISN , School of Cyber Engineering , Xidian University , China; School of Computer Science , University of Guelph , Canada"},{"name":"Xiaoguang Li","slug":"xiaoguang-li","given":"Xiaoguang","family":"Li","affiliation":"State Key Laboratory of ISN , School of Cyber Engineering , Xidian University , China"},{"name":"Ziyao Guo","slug":"ziyao-guo","given":"Ziyao","family":"Guo","affiliation":"State Key Laboratory of ISN , School of Cyber Engineering , Xidian University , China"},{"name":"Hui Li","slug":"hui-li","given":"Hui","family":"Li","affiliation":"State Key Laboratory of ISN , School of Cyber Engineering , Xidian University , China"},{"name":"Fenghua Li","slug":"fenghua-li","given":"Fenghua","family":"Li","affiliation":"State Key Laboratory of Information Security , Institute of Information Engineering , China; School of Cyber Security , University of Chinese Academy of Sciences , China"},{"name":"Xiaodong Lin","slug":"xiaodong-lin","given":"Xiaodong","family":"Lin","affiliation":"School of Computer Science , University of Guelph , Canada"}],"abstract":"Recently users’ right-to-be-forgotten is stipulated by many laws and regulations. However, only removing the data from the dataset is not enough, as machine learning models would memorize the training data once the data is involved in model training, increasing the risk of exposing users’ privacy. To solve this problem, currently, the straightforward method, naive retraining, is to discard these data and retrain the model from scratch, which is reliable but brings much computational and time overhead. In this paper, we propose an exact unlearning architecture called ARCANE. Based on ensemble learning, we transform the naive retraining into multiple one-class classification tasks to reduce retraining cost while ensuring model performance, especially in the case of a large number of unlearning requests not considered by previous works. Then we further introduce data preprocessing methods to reduce the retraining overhead and speed up the unlearning, which includes representative data selection for redundancy removal, training state saving to reuse previous calculation results, and sorting to cope with unlearning requests of different distributions. We extensively evaluate ARCANE on three typical datasets with three common model architectures. Experiment results show the effectiveness and superiority of ARCANE over both the naive retraining and the state-of-the-art method in terms of model performance and unlearning speed.","doi":"10.24963/ijcai.2022/556","url":"https://ijcai.org/proceedings/2022/556","pdf":"https://ijcai.org/proceedings/2022/0556.pdf","markdown":"https://ijcai.org/proceedings/2022/556.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/556","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":556,"pages":{"first":4006,"last":4013},"keywords":["Machine Learning: Ensemble Methods","Multidisciplinary Topics and Applications: Security and Privacy","Machine Learning: Experimental Methodology","AI Ethics, Trust, Fairness: AI and Law, Governance, Regulation","AI Ethics, Trust, Fairness: Trustworthy AI"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986690","length_sec":86,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38984833","length_sec":352,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Bertram et al., 2019] Theo Bertram, Elie Bursztein, Stephanie Caro, Hubert Chao, Rutledge Chin Feman, Peter Fleischer, Albin Gustafsson, Jess Hemerly, Chris Hibbert, Luca Invernizzi, et al. Five years of the right to be forgotten. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 959-972, 2019.","title":"Five years of the right to be forgotten","authors":"Bertram","year":"2019","venue":"Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bourtoule et al., 2021] Lucas Bourtoule, Varun Chan- drasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), pages 141-159. IEEE, 2021.","title":"Machine unlearning","authors":"Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, Nicolas Papernot","year":"2021","venue":"IEEE Symposium on Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Cao and Yang, 2015] Yinzhi Cao and Junfeng Yang. To- wards making systems forget with machine unlearning. In 2015 IEEE Symposium on Security and Privacy, pages 463-480. IEEE, 2015.","title":"Towards making systems forget with machine unlearning","authors":"Yang ; ] Yinzhi Cao, Junfeng Cao, Yang","year":"2015","venue":"IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Chen and Sun, 2021] Jihong Chen and Jiabin Sun. Under- standing the chinese data security law. International Cy- bersecurity Law Review, 2(2):209-221, 2021.","title":"Understanding the chinese data security law","authors":"Jihong Chen, Jiabin Sun","year":"2021","venue":"International Cybersecurity Law Review","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chouvatut et al., 2015] Varin Chouvatut, Wattana Jindalu- ang, and Ekkarat Boonchieng. Training set size reduction in large dataset problems. In 2015 International Computer Science and Engineering Conference (ICSEC), pages 1-5. IEEE, 2015.","title":"Training set size reduction in large dataset problems","authors":"Varin Chouvatut, Wattana Jindaluang, Ekkarat Boonchieng","year":"2015","venue":"2015 International Computer Science and Engineering Conference (ICSEC)","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Du et al., 2019] Xiaoning Du, Xiaofei Xie, Yi Li, Lei Ma, Yang Liu, and Jianjun Zhao. Deepstellar: Model-based quantitative analysis of stateful deep learning systems. In Proceedings of the 2019 27th ACM Joint Meeting on Euro- pean Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 477-487, 2019.","title":"Deepstellar: Model-based quantitative analysis of stateful deep learning systems","authors":"Xiaoning Du, Xiaofei Xie, Yi Li, Lei Ma, Yang Liu, Jianjun Zhao","year":"2019","venue":"Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Fredrikson et al., 2015] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on com- puter and communications security, pages 1322-1333, 2015.","title":"Model inversion attacks that exploit confidence information and basic countermeasures","authors":"Matt Fredrikson, Somesh Jha, Thomas Ristenpart","year":"2015","venue":"Proceedings of the 22nd ACM SIGSAC conference on computer and communications security","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Ginart et al., 2019] Antonio A. Ginart, Melody Y. Guan, Gregory Valiant, and James Y. Zou. Making ai forget you: Data deletion in machine learning. In NeurIPS, 2019.","title":"Making ai forget you: Data deletion in machine learning","authors":"Antonio A Ginart, Melody Y Guan, Gregory Valiant, James Y Zou","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Golatkar et al., 2020] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 9304-9312, 2020.","title":"Eternal sunshine of the spotless net: Selective forgetting in deep networks","authors":"Aditya Golatkar, Alessandro Achille, Stefano Soatto","year":"2020","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Graves et al., 2021] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In AAAI, 2021.","title":"Amnesiac machine learning","authors":"Laura Graves, Vineel Nagisetty, Vijay Ganesh","year":"2021","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Guo et al., 2020] Chuan Guo, Tom Goldstein, Awni Y. Han- nun, and Laurens van der Maaten. Certified data removal from machine learning models. In ICML, 2020.","title":"Certified data removal from machine learning models","authors":"Chuan Guo, Tom Goldstein, Awni Y Hannun, Laurens Van Der Maaten","year":"2020","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Harding et al., 2019] Elizabeth Liz Harding, Jarno J Vanto, Reece Clark, L Hannah Ji, and Sara C Ainsworth. Under- standing the scope and impact of the california consumer privacy act of 2018. Journal of Data Protection & Privacy, 2(3):234-253, 2019.","title":"Understanding the scope and impact of the california consumer privacy act of 2018","authors":"Liz Elizabeth, Jarno J Harding, Reece Vanto, L Clark, Ji Hannah, Sara C Ainsworth","year":"2019","venue":"Journal of Data Protection & Privacy","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[He et al., 2021] Yingzhe He, Guozhu Meng, Kai Chen, Jin- wen He, and Xingbo Hu. Deepobliviate: A powerful charm for erasing data residual memory in deep neural net- works. arXiv preprint arXiv:2105.06209, 2021.","title":"Deepobliviate: A powerful charm for erasing data residual memory in deep neural networks","authors":"He","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Hendrycks et al., 2019] Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. In Neural Information Processing Systems, 2019.","title":"Using self-supervised learning can improve model robustness and uncertainty","authors":"Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, Dawn Song","year":"2019","venue":"Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Jagielski et al., 2018] Matthew Jagielski, Alina Oprea, Bat- tista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In 2018 IEEE Symposium on Security and Privacy (SP), pages 19-35. IEEE, 2018.","title":"Manipulating machine learning: Poisoning attacks and countermeasures for regression learning","authors":"Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, Bo Li","year":"2018","venue":"IEEE Symposium on Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Kingma and Ba, 2015] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Interna- tional Conference on Learning Representations, 2015.","title":"Adam: A method for stochastic optimization","authors":"P Diederik, Jimmy Kingma, Ba","year":"2015","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Mantelero, 2013] Alessandro Mantelero. The eu proposal for a general data protection regulation and the roots of the 'right to be forgotten'. Computer Law & Security Review, 29(3):229-235, 2013.","title":"The eu proposal for a general data protection regulation and the roots of the 'right to be forgotten","authors":"Alessandro Mantelero","year":"2013","venue":"Computer Law & Security Review","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Orekondy et al., 2019] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4954-4963, 2019.","title":"Knockoff nets: Stealing functionality of black-box models","authors":"Orekondy","year":"2019","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Rahman et al., 2018] Md Atiqur Rahman, Tanzila Rahman, Robert Laganière, Noman Mohammed, and Yang Wang. Membership inference attack against differentially private deep learning model. Trans. Data Priv., 11(1):61-79, 2018.","title":"Membership inference attack against differentially private deep learning model","authors":"Tanzila Md Atiqur Rahman, Robert Rahman, Noman Laganière, Yang Mohammed, Wang","year":"2018","venue":"Trans. Data Priv","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Ruff et al., 2018] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexan- der Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In International conference on machine learning, pages 4393-4402. PMLR, 2018.","title":"Deep one-class classification","authors":"Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Ahmed Shoaib, Alexander Siddiqui, Emmanuel Binder, Marius Müller, Kloft","year":"2018","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Shumailov et al., 2021] Ilia Shumailov, Zakhar Shumaylov, Dmitry Kazhdan, Yiren Zhao, Nicolas Papernot, Murat A Erdogdu, and Ross Anderson. Manipulating sgd with data ordering attacks. arXiv preprint arXiv:2104.09667, 2021.","title":"Manipulating sgd with data ordering attacks","authors":"Ilia Shumailov, Zakhar Shumaylov, Dmitry Kazhdan, Yiren Zhao, Nicolas Papernot, Ross Murat A Erdogdu, Anderson","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Sohn et al., 2021] Kihyuk Sohn, Chun-Liang Li, Jinsung Yoon, Minho Jin, and Tomas Pfister. Learning and evaluat- ing representations for deep one-class classification. ICLR, 2021.","title":"Learning and evaluating representations for deep one-class classification","authors":"Sohn","year":"2021","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Thudi et al., 2021] Anvith Thudi, Hengrui Jia, Ilia Shu- mailov, and Nicolas Papernot. On the necessity of au- ditable algorithmic definitions for machine unlearning. arXiv preprint arXiv:2110.11891, 2021.","title":"Hengrui Jia, Ilia Shumailov, and Nicolas Papernot. On the necessity of auditable algorithmic definitions for machine unlearning","authors":"Thudi","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Zheng et al., 2017] Jian Zheng, Wei Yang, and Xiaohua Li. Training data reduction in deep neural networks with par- tial mutual information based feature selection and corre- lation matching based active learning. In 2017 IEEE In- ternational Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2362-2366. IEEE, 2017.","title":"Training data reduction in deep neural networks with partial mutual information based feature selection and correlation matching based active learning","authors":"Jian Zheng, Wei Yang, Xiaohua Li","year":"2017","venue":"IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}