Leveraging Per-Instance Privacy for Machine Unlearning

2025-05-24

AI Summary

This work addresses the key challenge in machine unlearning—quantifying the difficulty of single-sample unlearning—by proposing a fine-grained difficulty assessment method based on per-sample Rényi privacy loss, moving beyond traditional worst-case analysis. Innovatively, it links the Rényi divergence-defined privacy loss to intrinsic data hardness, revealing its strong correlation with loss barriers, and establishes the first interpretable and computationally tractable framework for unlearning difficulty evaluation. Through theoretical analysis grounded in noisy gradient descent and stochastic gradient Langevin dynamics (SGLD), the metric is rigorously validated to accurately identify hard-to-forget samples under both standard fine-tuning and privacy-preserving training. Experimental results demonstrate that the proposed method provides a principled foundation for adaptive unlearning strategies, ensuring thorough forgetting while significantly improving model utility—thereby achieving a superior utility–unlearning trade-off.

Technology Category

• Machine Learning: Privacy
• Reasoning under Uncertainty: Stochastic Optimization
• Search and Optimization: Learning to Search

Application Category

• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems

Abstract

We present a principled, per-instance approach to quantifying the difficulty of unlearning via fine-tuning. We begin by sharpening an analysis of noisy gradient descent for unlearning (Chien et al., 2024), obtaining a better utility-unlearning tradeoff by replacing worst-case privacy loss bounds with per-instance privacy losses (Thudi et al., 2024), each of which bounds the (Renyi) divergence to retraining without an individual data point. To demonstrate the practical applicability of our theory, we present empirical results showing that our theoretical predictions are born out both for Stochastic Gradient Langevin Dynamics (SGLD) as well as for standard fine-tuning without explicit noise. We further demonstrate that per-instance privacy losses correlate well with several existing data difficulty metrics, while also identifying harder groups of data points, and introduce novel evaluation methods based on loss barriers. All together, our findings provide a foundation for more efficient and adaptive unlearning strategies tailored to the unique properties of individual data points.

Problem

• Quantify difficulty of unlearning via per-instance privacy losses
• Improve utility-unlearning tradeoff with instance-specific privacy bounds
• Develop adaptive unlearning strategies for individual data points

Innovation

• Per-instance privacy losses for unlearning
• Improved utility-unlearning tradeoff via fine-tuning
• Novel evaluation methods using loss barriers