Layer Attack Unlearning: Fast and Accurate Machine Unlearning via
Layer Level Attack and Knowledge Distillation

A “data-driven” approach utilizes data-centric strategies such as partitioning and augmentation (Nguyen et al. 2022) to address unlearning. SISA (Bourtoule et al. 2021) and Selective Forgetting (Shibata et al. 2021) are two representative data-driven unlearning methods. In SISA, data is divided into shard units, sequentially trained in slices, and multiple model checkpoints are created. Once an unlearning query is requested, it reverts the query to the checkpoint before learning and retrains this reverted query with the ensemble technique. However, it is challenging to calculate the probability of encountering unlearning queries on data points.

On the other hand, Selective Forgetting (Shibata et al. 2021) involves lifelong learning to perform unlearning. A “mnemonic code” signal is embedded in the data during training. During the unlearning process, the mnemonic code information is selectively incorporated into the loss function to remove forgetting data. This strategy requires storing mnemonic codes for all data points, considering unlearning queries before building the original model. This could be more practical in a real-world scenario.

A “model-agnostic” approach is a methodology for handling the unlearning process by adjusting the model’s learning parameters to achieve data unlearning (Nguyen et al. 2022). Such approaches include various methods such as Summation form (Cao and Yang 2015), Negative Gradient (Golatkar, Achille, and Soatto 2020), Fisher Forgetting (Golatkar, Achille, and Soatto 2020), Boundary unlearning (Chen et al. 2023), Instance-wise Unlearning (Cha et al. 2023), etc. Some methods utilize adversarial attacks to the original model to avoid naively excluding and deleting forgetting data. Among the mentioned algorithms, approaches like ours include Boundary unlearning and Instance-wise Unlearning. These two algorithms perform unlearning by utilizing adversarial attacks to transition forgettable data to nearby spaces. However, a significant difference between our approach and these methods lies in the target of the attack. Our approach directs the unlearning process towards layers with specific classification objectives instead of using entire layers. Furthermore, we aim to introduce effective ways of utilizing PGD in unlearning.

First, we formulate a machine unlearning problem as follows: We define a training dataset $D_{\text{train}}$ = ${\{{x}^{i},{y}^{i}\}}_{i=1}^{N}$, consisting of inputs ${x}^{i}\in X$ and their corresponding class labels ${y}^{i}\in Y$. The forgetting dataset $D_{f}$ is a subset of $D_{\text{train}}$ that we intend to forget from the pre-trained model. Conversely, the retain dataset $D_{r}=D_{\text{train}}\setminus D_{f}$ is the dataset we want to preserve the overall performance.

Next, we define the original model $\mathcal{M}_{\theta}:\mathbb{R}^{n}\rightarrow\mathbb{R}^{n}$, which comprises a set of feature layers denoted by $\mathcal{F}^{f}_{\theta}:\mathbb{R}^{n}\rightarrow\mathbb{R}^{n}$ and a fully connected layer denoted as $\mathcal{F}^{c}_{\theta}:\mathbb{R}^{n}\rightarrow\mathbb{R}^{n}$, where $\theta$ represents the optimal parameters for the model trained on $D_{\text{train}}$. The following provides a compositional representation of the model $\mathcal{M}_{\theta}$ as $\mathcal{F}^{c}_{\theta}\circ\mathcal{F}^{f}_{\theta}$. Also, we denote $x^{\text{adv}}$ to represent the adversarial examples (Goodfellow, Shlens, and Szegedy 2014) for the input data $x$. In particular, we define $\ell^{\text{adv}}$ as the adversarial example from Partial-PGD, generated from the intermediate latent feature $\ell$ obtained from the outputs of $\mathcal{F}^{f}_{\theta}$, as shown in Fig. 1.

The main reason for employing adversarial examples is to search and identify neighboring candidate spaces more effectively that will assign the forgetting data samples. Assigning forgetting classes to random or irrelevant classes can dramatically reduce downstream task performance.

Therefore, carefully exploring the neighboring space allows us not only to forget $D_{f}$ but also to preserve the decision boundary of other classes. Hence, adversarial attacks (Madry et al. 2017; Chen et al. 2023) can be explored below:

where the parameter $\theta$ represents the weights of the target model under attack, and generated noise for crafting adversarial examples is produced by computing the gradient $\nabla_{x}\mathcal{L}$ of the loss function $\mathcal{L}$ with respect to the input $x$. This noise is added to $x^{t}$ and then projected using the projection method $\Pi$ to calculate $x^{t+1}$, which is repeated ${t}$ times. Once $x^{t+1}$ represents $x^{\text{adv}}$, it is an adversarial example.

However, we clarify the purpose of adversarial examples used in our work, which differs from prior approaches. The original PGD approach may generate excessive noise and slow the unlearning process considerably. Therefore, there is no need to calculate gradients throughout the entire model to create adversarial examples.

Hence, our proposed Partial-PGD utilizes $\mathcal{F}^{c}_{\theta}$ to generate adversarial examples for the unlearning process, as shown in Fig. 1. This technique effectively identifies the neighboring space to allocate $D_{f}$, the forgetting data, similar to conventional PGD. However, it significantly reduces unlearning time by omitting feature layer information, as depicted in Fig. 1. We define our Partial-PGD as follows:

where Partial-PGD applies an adversarial attack to the intermediate latent $\ell$ obtained from $\mathcal{F}^{f}_{\theta}$, where $\ell$ undergoes gradient computation based solely on passing through $\mathcal{F}^{c}_{\theta}$. Then, the result is mapped to the nearby space of a different label of $\ell$ and becomes $\ell^{\text{adv}}$, which we use for unlearning ${D_{f}}$ as knowledge to be forgotten.

While other approaches use entire layers for unlearning, we focus on unlearning only the relevant layers. Inspired by the FF technique, we focus on the classification layer $\mathcal{F}^{c}_{\theta}$ to forget specific classes in the model for class-wise unlearning. Therefore, our layer unlearning focuses on only modifying the parameters of ${\mathcal{F}^{c}_{\theta}}$ tied to classification instead of the entire layers and model $\mathcal{M}_{\theta}$ to forget ${D_{f}}$ effectively.

We define the following equation to describe our unlearning process, where we focus on the $\mathcal{F}^{c}_{\theta}$ during the unlearning process to remove ${D_{f}}$ from the model:

where $\theta^{*}$ is the ideal parameters after forgetting $D_{f}$.

We show that layer unlearning accelerates the unlearning process by selectively updating relevant layer weights and optimizing efficiency. Interestingly, it outperforms models with whole layers in accuracy.

We describe our end-to-end unlearning process, where we apply the KD to improve the overall performance further. As illustrated in Fig. 2, the classification layer ${\mathcal{F}^{c}_{\theta}}$ serves as our student model $\mathcal{S}_{\theta}$. Additionally, at the beginning of each epoch, we duplicate the $\mathcal{S}_{\theta}$ as our teacher $\mathcal{T}_{\theta}$. The model uses forgetting data $D_{f}$ as input to create an intermediate latent feature $\ell_{f}$ through the feature layer $\mathcal{F}_{\theta}^{f}$. Then, $\ell_{f}$ becomes an adversarial example $\ell^{\text{adv}}_{f}$ after applying a Partial-PGD on the $\mathcal{T}_{\theta}$.

Next, $\ell_{f}$ and $\ell^{\text{adv}}_{f}$ are passed through $\mathcal{S}_{\theta}$ and $\mathcal{T}_{\theta}$, respectively, becoming logits for each student and teacher, as shown in Fig. 2. Then, the logit obtained from $\mathcal{S}_{\theta}$ is compared with the ground truth $y_{f}$. If a discrepancy is observed, it is considered unlearned. Then, the unlearned logit replaces the adversarial logit from $\mathcal{T}_{\theta}$. This student’s logit is used to compute the cross-entropy loss as follows:

where $y_{\mathcal{S}_{\theta}}$ represents the predicted label from $\mathcal{S}_{\theta}(\ell_{f})$, and CE is the cross-entropy function. This loss leaves the unlearned data in a state, where it makes wrong (unlearned) predictions. If not, it is trained to be a predicted label $y_{f}^{\text{adv}}$ of adversarial logit, leading to its unlearning process. Next, let $Z$ be the double Softmax representation, which is defined as:

where $\sigma$ represents Softmax function. In Eq. 5, we performed double Softmax to distill knowledge by adjusting the probability distribution of the output from $\mathcal{T}_{\theta}$. This approach is intended to convey soft label information to $\mathcal{S}_{\theta}$. Exclusively unlearning $\mathcal{F}^{c}_{\theta}$ maintains the decision boundaries of retain data, and slightly improves the overall accuracy. But, layer unlearning without double Softmax showed variable accuracy, as shown in the Fashion-MNIST dataset (Xiao, Rasul, and Vollgraf 2017). We show this effect in Section 4.3. Next, we define our distillation loss as follows:

where knowledge is distilled from Z of $\mathcal{T}_{\theta}$ and KL is the KL divergence. During distillation, the computation of loss $\mathcal{L}_{DI}$ between the outputs of $\mathcal{S}_{\theta}$ and $\mathcal{T}_{\theta}$ focuses on creating a similar boundary to the teacher model, ensuring performance while removing information of $D_{f}$. The temperature $T$ is a hyper-parameter. Generally, increasing $T$ will generate smoother soft labels that assists $\mathcal{S}_{\theta}$ in mimicking $\mathcal{T}_{\theta}$. The effects of changes in $T$ are described in Suppl. Mat.

Using $\mathcal{L}_{CE}$ and $\mathcal{L}_{DI}$, our final loss function is constructed as follows:

where the value of $\alpha$ represents the weight assigned to the loss between $\mathcal{L}_{CE}$ and $\mathcal{L}_{DI}$. As a hyper-parameter, $\alpha$ ranges from 0 to 1. Assigning additional weight to $\mathcal{L}_{CE}$ may boost unlearning time but decrease performance. Conversely, if we provide more weight to $\mathcal{L}_{DI}$, the unlearning speed may slow down but can increase accuracy. We conducted the ablation study for $\alpha$ values to capture the trade-off. The effects of changes in the exponent of $T^{2}$ are described in Suppl. Mat.

In addition, we provide the end-to-end unlearning process in Alg. 1. We distill knowledge from $\mathcal{T}_{\theta}$, while gradually reducing boundaries. Algorithm 1 finishes either when all epochs are completed or when $D_{f}$ becomes unlearned within a batch during an epoch. Finally, we obtain our unlearning model $\mathcal{M}_{\theta^{*}}$ by combining $\mathcal{F}^{f}_{\theta}$ with the classification layer, $\mathcal{F}^{c}_{\theta^{*}}$, as shown in Eq. 3.

Summary. In Fig. 3, we pictorially describe our end-to-end unlearning process by displaying the boundary change for the retain and forgetting data.

To achieve the best unlearning performance, it should completely forget information related to $D_{f}$. Therefore, guaranteeing accuracy on a par with those achieved by the Retrain for both $D_{f}$ and $D_{r}$ will be the best. Table 1 presents test results from different classification models, datasets, and metrics. The tested models include VGG16, ResNet18, ResNet50, and ViT. The datasets used for testing were CIFAR-10, Fashion-MNIST, and VGGFace2. In addition to the accuracy metric, we evaluate the performance using the unlearning score (US) as follows:

where $\text{acc}_{r}$ and $\text{acc}_{f}$ denote the accuracy of the retain and forgetting dataset, respectively. If the $D_{tr}$ approaches 100% and $D_{tf}$ approaches 0%, the US metric approaches 1, indicating a stable result on the unlearning process. We provide a more detailed explanation of why this metric is useful for unlearning in Suppl. Mat.

Finally, Table 1 presents the performance of each unlearning method for a specific single class in the aforementioned datasets. We measure the accuracy for datasets $D_{r}$, $D_{f}$, $D_{tr}$, and $D_{tf}$, along with the metric US. For the NG, the unstable variability in the loss of negative gradient contributes to less favorable overall performance results. Fine-tune shows strong performance in forgetting and retaining information. Nevertheless, this methodology requires utilizing the complete dataset $D_{r}$ during training. Such extensive data is time-consuming, and we analyze and compare their worse time performance in Table 2. In the case of Random Label, except for VGGFace2’s ResNet18, most cases have poor accuracy and US. Due to the random nature of forgetting, converging towards arbitrary labels in the classification space is challenging, resulting in low performance.

Fisher Forgetting exhibits poor performance, with low accuracy and US on the overall test. Also, the Fisher matrix information required a significant amount of time. For Boundary Shrink, they also utilized adversarial attack examples, but they used the hard label information of the attack examples on ${D_{f}}$, which resulted in an unstable unlearning process. IWU approach involves utilizing adversarial attack examples while incorporating regularization to achieve a stable unlearning process. However, this gains an average US of 0.8587 in the overall test.

Finally, Ours completely removes the forgetting dataset (0% accuracy) on all the test cases and retains the highest unlearning performance. The accuracy for both $D_{f}$ and $D_{tf}$ reaches 0, while the accuracy for $D_{r}$ and $D_{tr}$ is comparable to or sometimes even higher than the Retrain. Also, ours demonstrates superior performance compared to almost all baseline models across various scenarios, with a high US average of 0.9443. Our approach that utilizes Partial-PGD and KD-based unlearning processes on layers with explicit objectives clearly achieves the best unlearning performance.

Table 2 presents each method’s elapsed time and data usage. The Retrain, Fisher Forgetting, and Fine-tuning leverage the entire $D_{r}$ dataset, resulting in significant time costs for unlearning. Including our method, the rest of the unlearning methods utilize only $D_{f}$. In the case of Fisher Forgetting, it takes a longer time than the Retrain, and its unlearning performance is significantly poor. While the Fine-tune exhibits favorable unlearning performance, it comes with the drawback of consuming a considerable time. However, our method showcases optimal unlearning performance, while consuming only 3.76 seconds in the quickest scenario. To summarize, our approach exhibits higher efficiency, compared to competing methods.

We performed several different ablation experiments to analyze and show the benefits of our approach.

Figure 5 presents the Original, Retrain, and Ours using t-SNE on the CIFAR-10 dataset. The red dots represent samples of ship images, indicated as ${D_{f}}$. As shown in Fig. 5(b), ${D_{f}}$ was totally misclassified in the Retrain. On the other hand, Our unlearning method produces results correctly, as shown in Fig. 5(c), where the decision boundary of ${D_{f}}$ has been successfully absorbed into the surrounding space.