Leveraging Per-Instance Privacy for Machine Unlearning
Authors: Nazanin Mohammadi Sepahvand, Anvith Thudi, Berivan Isik, Ashmita Bhattacharyya, Nicolas Papernot, Eleni Triantafillou, Daniel M. Roy, Gintare Karolina Dziugaite
ICML 2025 | Venue PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | We present empirical results showing that our theoretical predictions are born out both for Stochastic Gradient Langevin Dynamics (SGLD) as well as for standard fine-tuning without explicit noise. We further demonstrate that per-instance privacy losses correlate well with several existing data difficulty metrics, while also identifying harder groups of data points, and introduce novel evaluation methods based on loss barriers. All together, our findings provide a foundation for more efficient and adaptive unlearning strategies tailored to the unique properties of individual data points. |
| Researcher Affiliation | Collaboration | 1Department of Electrical and Computer Engineering, Mc Gill University, Montreal, Canada 2Mila, Montreal, Canada 3Department of Computer Science, University of Toronto, Toronto, Canada 4Vector Institute, Toronto, Canada 5Google, Mountain View, US 6Google Deep Mind, London, UK 7Department of Statistical Science, University of Toronto, Toronto, Canada 8Department of Computer Science, Mc Gill University, Montreal, Canada 9Google Deep Mind, Toronto, Canada. |
| Pseudocode | No | The paper describes methods and algorithms verbally and mathematically but does not include any explicitly labeled pseudocode or algorithm blocks with structured steps. |
| Open Source Code | No | The paper does not contain an unambiguous statement about releasing code for the described methodology, nor does it provide a direct link to a source code repository. |
| Open Datasets | Yes | Our experiments are performed on the SVHN (Netzer et al., 2011) and CIFAR-10 (Alex, 2009) datasets, with a Res Net-18 architecture (He et al., 2016). |
| Dataset Splits | Yes | Constructing Difficulty-Based Forget Sets To create forget sets with varying difficulty levels, the training dataset is partitioned into five subsets based on privacy scores. First, the samples are sorted in ascending order by their scores. Recursive splits are then performed to identify key thresholds: the lower quartile (Q1), the median (Q2), and the upper quartile (Q3). Using these thresholds, five subsets are constructed: (1) the first 1000 samples, (2) intervals centered around Q1 (Q1 500 samples), (3) intervals centered around Q2 (Q2 500 samples), (4) intervals centered around Q3 (Q3 500 samples), and (5) the last 1000 samples. This approach provides a systematic stratification of the dataset, enabling the evaluation of unlearning performance across varying levels of difficulty as determined by privacy scores. |
| Hardware Specification | Yes | Compute resources Experiments were conducted using L40 and RTX8000 GPUs, and AMD EPYC 7452 CPUs. |
| Software Dependencies | No | The paper mentions software components like Python, PyTorch, or specific libraries, but does not provide explicit version numbers for these software dependencies to ensure reproducibility. |
| Experiment Setup | Yes | Learning rates and training times for SGD The original model, which serves as the starting point for all unlearning techniques (not for SGLD), is trained for 150 epochs using an initial learning rate of 0.01, a weight decay of 0.0005, and a learning rate schedule that reduces the learning rate by an order of magnitude at epochs 80 and 120. Each unlearning method is subsequently fine-tuned for 25 epochs. Additional details for SGLD At every step we added N(0, σ2) Gaussian noise to the minibatch gradient, where we vary σ for ablations. All other hyperparameters were kept the same as SGD. In particular we do not do any additional gradient clipping. Hyperparameter tuning We perform hyperparameter tuning (HPT) for the unlearning methods using the Bayesian optimization method on a random forget set. While fine-tuning involves a single hyperparameter the learning rate L1Sparse additionally optimizes α. To determine the best hyperparameters for each method, we employ Bayesian optimization to find configurations that achieve an optimal balance between privacy and utility. Additionally, to ensure that the selected hyperparameters are also optimized with respect to the number of steps required for unlearning, we identify hyperparameter sets that fall within a 5% margin of error for this trade-off. Among these, we select the configuration that converges the fastest. |