Unlearning from Weakly Supervised Learning

1 Introduction

Organizations and companies extensively leverage user data for training machine learning models across various applications, involving movie recommendations or healthcare, etc [Sekhari et al., 2021a]. As increasing concerns about the misuse of privacy data, especially sensitive information like personal emails and medical records [Bourtoule et al., 2021], more and more countries place a greater emphasis on privacy data protection [Mantelero, 2013; Proserpio et al., 2014; Shokri et al., 2017]. Corresponding regulations empower individuals to revoke their authorization for the use of their data in data analysis and machine learning (ML) model training [State of California Department of Justice, 2023]. This arouses new discussions on data privacy and ownership [Shintre et al., 2019], and promotes the emergence of machine unlearning that focuses on forgetting data [Bourtoule et al., 2021; Nguyen et al., 2022].

∗Corresponding author

Existing approaches of machine unlearning can be roughly divided into two categories: exact unlearning [Golatkar et al., 2020] and approximate unlearning [Thudi et al., 2022]. Among them, exact unlearning typically expects that the distribution of the unlearned model is exactly the same as the retraining one. Intuitively, the straightforward approach is to retrain the model from scratch using the data that excludes the information to be unlearned [Yan et al., 2022]. However, the retraining way comes with a substantial computational cost that is prohibitively expensive [Bourtoule et al., 2021; Xu et al., 2024]. To alleviate this problem, many researchers turn to explore alternative machine unlearning strategy: approximate unlearning [Wu et al., 2022; Guo et al., 2020]. Approximate unlearning aims to achieve a similar effect of retraining by modifying model parameters to remove the influence of specific data on parameter updates [Yan et al., 2022; Wu et al., 2022]. Compared to approaches belonging to exact unlearning, approaches of approximate unlearning are less computationally expensive and more efficient for data unlearning [Guo et al., 2020; Huang et al., 2021].

Despite machine unlearning brings a novel inspiration to address the challenge of data unlearning [Sekhari et al., 2021b], existing machine unlearning approaches both explore the data removal within the supervised learning (SL) tasks [Xu et al., 2024; Yan et al., 2022; Wu et al., 2022]. In SL tasks, collecting extensive data with high-quality labels is typically required, while annotating large-scale datasets accurately is costly and time-consuming [Gao and Zhang, 2021; Tang et al., 2024]. Due to collecting weakly supervised learning (WSL) data is less laborious than SL one, the WSL paradigm may be more applicable to real-world scenarios, which allows the model to learn from the data with imprecise or incomplete supervised information [Zhou, 2018; Gao et al., 2023]. The goal of WSL is similar to that of SL, but approaches in WSL are greater flexibility and unrestricted by the quality of data annotation. Since groundtruth labels are unavailable for the training data in the WSL paradigm, previous machine unlearning approaches cannot hold the weakly supervised data.

In this paper, we first propose an approach called Uniform Distribution-guided Regression Unlearning (UDRU) for the WSL problem to achieve data unlearning by updating the model parameters, which can effectively deal with the uncertainty labeling information of WSL data and also excel in the unlearning of supervised learning models. Naturally, when a trained model is asked to forget specific data, the unlearned model's predictions of these data should become indistinguishable or incorrect. Observed by that an untrained model tends to make predictions following uniform distributions. Therefore, we expect the model predictions of removal data to lie in intermediate after unlearning, since the model may still exhibit a memory of removal data when these prediction probabilities are either excessively high or low. To modify the learned output, we design a flexible unlearning target to force predictions of removal data to become indistinguishable by minimizing the divergence between probability distributions of model predictions and a uniform distribution. Different from some previous approaches relying on training data, the proposed approach applies formulated targets to replace classification unlearning as convex regression, which makes a model implement data unlearning without additional training data. Furthermore, the convex regression contributes to reducing computational cost and smoother convergence. UDRU can effectively tackle the WSL problem and still excel in SL models as the flexibility in formulating targets of our approach. The main contributions are summarized below:

• We propose a machine unlearning approach called UDRU for the WSL problem by formulating a flexible target based on a uniform distribution. To the best of our knowledge, moreover, our work explores machine unlearning in the WSL problem for the first time.
• UDRU transforms the process of classification unlearning into convex regression by the formulated targets, which significantly reduces computational cost and eliminates the need for storing extra training data or information during the training process.
• As the flexibility in formulating targets, UDRU is not only suitable for WSL but also well-adapted on the SL tasks. Empirical studies on various learning paradigms across different model scales show the effectiveness of the proposed approach.

The rest of this paper is organized as follows. In Section 2, we review related work and then introduce the proposed approach in Section 3. Experimental results and conclusion are presented in Section 4 and Section 5, respectively.

2 RelatedWork

In this section, we will give a brief review of related work of machine unlearning and the WSL paradigm, including partial label learning (PLL) and noisy label learning (NLL).

2.1 Machine Unlearning

Before proceeding, we provide a brief overview of notations and existing approaches in machine unlearning. To formulate machine unlearning, suppose X ⊂ Rd represents the feature space with d dimensions, and Y = {1, 2, . . . ,K} is the label space with K possible labels. Let Dt = {(xi, yi)}Nt i=1 be the training dataset with Nt instances, where yi ∈ Y is the ground-truth label of xi ∈ X . We define Du ⊂ Dt as the unlearning dataset and Dr = Dt \ Du as the remaining dataset. Given a mapping model f : X → RK and z = f(x, θ), the model parameters θ∗ are trained using a learning algorithm A(·), denoted as θ∗ = A(Dt). To normalize z into a probability distribution p that satisfies ∑Ki=1 pi = 1, we apply a softmax function σ. The i-th element of p is expressed as:

where zi denotes the i-th element of z. As recent line of work in machine unlearning can be divided into two categories: exact unlearning [Ginart et al., 2019; Brophy and Lowd, 2021] and approximate unlearning [Guo et al., 2020; Wu et al., 2022]. Exact unlearning approaches expect that the parameter distribution of the unlearning model is identical to that of the retraining model. This can be formulated as:

where U(·) refers to an exact unlearning process, and T ⊆ H denotes the hypothesis space H after unlearning parameters θ. P(·) and K(·) denote the distribution of parameters and a distribution measurement of KL-divergence, respectively. One representative approach for exact unlearning is ARCANE [Yan et al., 2022], which divided the training data according to labels and trained a one-class classifier for each subset. Here, unlearning specific data only required retraining the one-class classifier corresponding to the labels of unlearning data. However, exact unlearning approaches face challenges in efficiently handling with massive data due to the reliance of the entire training data.

Consequently, many researchers have turned their attention to approximate unlearning to reduce the computational cost of data unlearning. Unlike exact unlearning, approximate unlearning tolerates the divergence between P (U(A(Dt), Dt, Du) ∈ T ) and P (A(Dr) ∈ T ) within specified thresholds, i.e.,

Eq. (3) forms the basis for a series of approximate unlearning approaches, including but not limited to, model-agnostic algorithms [Chundawat et al., 2023], model-intrinsic algorithms [Baumhauer et al., 2022; Izzo et al., 2021] and datadriven algorithms [Huang et al., 2021; Shen et al., 2024b; Shen et al., 2024a]. It is important to note that existing machine unlearning approaches cannot work well on WSL data as they are designed for fully supervised tasks.

2.2 Weakly Supervised Learning

Differing from fully SL tasks that require massive data with accurate supervision information, WSL provides the flexibility of learning with weak supervision. In this paper, we mainly explore machine unlearning for PLL and NLL in WSL. We proceed to introduce these two learning problems as follows.

Partial Label Learning. In the case of PLL, each training instance is associated with a candidate label set, only one of which is the ground-truth label. Let Dp = {(xi, si)}Np i=1 be the training dataset including Np instances for PLL, where si ∈ {2Y \ ∅} is the set of candidate labels for xi. PLL research follows two main strategies: the average-based strategy (ABS) [Zhou and Gu, 2018] and the identification-based strategy (IBS) [Feng and An, 2019a; Wen et al., 2021]. ABSbased approaches treat all labels within the candidate label set equally [Cour et al., 2011]. However, they may suffer from low accuracy since their outputs often overwhelm the ground-truth label [Shi et al., 2023]. Hence, many IBS-based approaches have emerged, which aim to purify each candidate label set and heuristically explore the groundtruth label during the learning process [Cour et al., 2011; Feng and An, 2019b].

Noisy Label Learning. With the advent of highly-curated datasets, deep neural networks have demonstrated promising performance on various classification tasks [Krizhevsky et al., 2012; Noh et al., 2015]. In fact, real-world data is inherently imperfect, which inevitably introduces corruptions commonly known as noise [Zhang and Sabuncu, 2018; Wei et al., 2022]. The training dataset for NLL is denoted as Dn = {(xi, ˜ yi)}Nn i=1 , where an instance (x, ˜ y) has the label ˜ y that does not align with the ground-truth label y. Previous studies have demonstrated that noisy labels pose challenges for overparameterized neural networks, which results in overfitting and performance degradation [Arpit et al., 2017; Zhang et al., 2017]. Therefore, noise-robust algorithms are proposed, which develop loss functions that can tolerate noisy labels [Zhang and Sabuncu, 2018]. Additionally, certain approaches focus on explicitly correcting the loss function by estimating the noise transition matrix to solve the NLL problem [Patrini et al., 2017]. In the following section, we will illustrate UDRU how to implement machine unlearning on WSL and SL paradigms.

3 The Proposed Approach

In this section, we introduce a novel approach called UDRU, which solves machine unlearning by formulating an unlearning target adhering to a uniform distribution. Through analyzing the outputs of different learning paradigms, we formulate distinct unlearning targets tailored to each learning paradigm. We theoretically prove the feasibility of these unlearning targets. Moreover, UDRU employs regression to solve classification unlearning tasks, which significantly reduces computational cost.

3.1 Unlearning in Supervised Learning

Given a SL model f(x, θ∗ ) learned with a learning algorithm A(·) on the training dataset Dt, the goal of machine unlearning is to remove the unlearning dataset Du ⊂ Dt from the model through updating the model's parameters from θ∗ to θu without seriously degrading its prediction performance. Evaluating the efficacy of the unlearning process is crucial for an unlearning approach, which reflects the expected effect of an unlearning approach. Unfortunately, we find that using Eq. (2) or Eq. (3) for a consistent evaluation of unlearning is challenging, because the training dataset may not be available in many cases. Hence, we are eager to design an evaluation measure without the restriction on the availability of the training dataset.

In experiments, we can observe that predictions from an untrained model tend to follow uniform distributions when it is used to assign the ground-truth labels for unseen instances. Conversely, a well-trained model provides distinct probability predictions for the features of input instances. This implies that a trained model, after removing specific data, is expected to exhibit similar predictions for these specific data as an untrained model. Motivated by this, we design an evaluation measure that gets rid of the reliance on the availability of the training dataset. Here, we will investigate the evaluation measure for machine unlearning from the definition of a uniform distribution as follows.

Definition 1 (Uniform Distribution). Let ¯ p ∈ RK be a uniform distribution. When the number of labels is K, the i-th element of ¯ p satisfies ¯ pi = 1K , where i ∈ {1, 2, . . . ,K}.

With only an unlearning dataset Du available, we can substitute Eq. (2) or Eq. (3) with the divergence from an untrained model which has no bias for the features of unlearning data. The evaluation measure is implemented by minimizing the divergence between the uniform distribution ¯ p and the output probability distribution p. KL-Divergence has the ability to measure the difference between two distributions, which is adopted to facilitate the achievement of the evaluation measure. The evaluation measure is expressed as:

Next, we will introduce how to formulate an unlearning target in SL with the evaluation measure. In the process of unlearning specific data, our goal is to diminish the model's bias towards a particular class label while maintaining the performance of the output for other class labels. For this reason, we expect to derive an unlearning target whose prediction has the minimal divergence with predictions of an untrained model and does not influence the outputs of other classes. Due to the structures of neural networks, there are numerous and separated parameters that are only sensitive to relevant features. Therefore, we can assume that the unlearning process has little effect on the i-th output zi (i ̸= y) of the model when the scale of the model is sufficient and relatively irrelevant parameters are not responsible for the unlearning modification. According to this assumption, we only need to keep the outputs corresponding to all labels except the ground-truth one unchanged and assign a moderate value to the output associated with the ground-truth label. Obviously, the unlearning target t ∈ RK should satisfy the conditions shown as follows:

where ti denotes the i-th element of t. To construct the unlearning target t under the conditions of Eq. (5), we derive a function T(z, y) to automatically formulate t according to each instance (x, y), i.e., t = T(z, y). Theorem 2 shows the unlearning target function T (z, y) that satisfies the above conditions.

Theorem 2. To satisfy the conditions shown in Eq. (5), T (z, y) in SL is derived as:

where Ti(z, y) presents the i-th element of T(z, y).

The proof is provided in Appendix A. With this formulated target, we can ensure that the modified predictions attain minimal divergence from the uniform distribution and maintain performance on the outputs except the ground-truth one. After obtaining this target, we derive a convex objective function by introducing a regularization term, which is defined as:

where θ denotes the parameter variable that needs optimization, and δ is a trade-off parameter used to balance the strength of ‖θ - θ∗ ‖2 . Then, the unlearned parameters θu can be obtained by optimizing the following equation:

Building on this regression, UDRU effectively facilitates the unlearning of specific data while preserving performance on the remaining data. Moreover, the utilization of specific targets substantially reduces computational and time cost, leading to smooth and rapid convergence. δ is the only hyperparameter, which falls within a certain range to avoid a significant impact on the final convergence results.

3.2 Unlearning in Partial Label Learning

Suppose θ∗ is the parameters of a PLL model fPL(x, θ∗ ) learned from the PLL training dataset Dp. The solution to the PLL problem is similar to that of the SL problem, which aims to derive θu through constructing an unlearning target. Given an unlearning dataset Du = {(xi, si)}Nu i=1 and Du ⊂ Dp, each candidate set si consists of a ground-truth label of xi and incorrect labels. Due to the supervision information in PLL differing from SL, the formulated unlearning target and the corresponding conditions of PLL have also changed according to the weak supervision information. Theorem 3 shows the unlearning target of PLL and the associated conditions.

Theorem 3. Let z = fPL(x, θ) and zi denotes the i-th element of z. The i-th element of the unlearning target T(z, s) in PLL is expressed as:

which satisfies the following conditions:

The proof is stated in Appendix B. Theorem 3 displays the unlearning target of PLL, which is theoretically inferred by Definition 1 and satisfies certain conditions. Then, the optimized objective for machine unlearning in PLL is defined as:

The unlearned parameters θu can be acquired by minimizing the objective function:

These updated parameters will effectively remove the influence of the unlearning data from PLL models, while maintaining performance on the remaining data. Applying this unlearning approach enables effective handling of situations where the labels contain inaccurate information.

3.3 Unlearning in Noisy Label Learning

Machine unlearning in NLL shares similarities with the aforementioned learning paradigms, which aims to find θu that achieves the ability of unlearning specific data. Given θ∗ as the parameters of a trained NLL model fNL(x, θ), the unlearning dataset is denoted as Du = {(xi, ˜ yi)}Nu i=1 . In the NLL problem, the given label ˜ y of an instance x has a chance of being corrupted. This means that ˜ y may represent the ground-truth label of x, or it may be a noisy label. Hence, we can encompass all scenarios when using the model to predict a label ˆ y for an instance, which are summarized as follows:

1. ˆ y = ˜ y, and ˜ y is the ground-truth label of x;
2. ˆ y = ˜ y, and ˜ y is an incorrect label of x;
3. ˆ y ̸= ˜ y, and one of them is the ground-truth label of x;
4. ˆ y ̸= ˜ y, and are both incorrect.

For scenario (1), it resembles the case in SL. In scenario (2), the model fails to learn the correct information from this particular instance. Scenario (3) reveals that the prediction label may be the ground-truth label, which requires to be unlearned. Scenario (4) shows that the model does not learn correct information from this data. To ensure the model erases any potential information learned from unlearning data, the labeling information of NLL should cover all scenarios. Therefore, we employ a way to construct a set ˜ s that guarantees the unlearning instance x associated with all potential information. If ˆ y = ˜ y, ˜ s = {˜ y}. On the other hand, if ˆ y ̸= ˜ y, we combine ˆ y and ˜ y into ˜ s. The computation of ˜ s is defined as:

With Eq. (10), we can observe that the format of supervision information in NLL is the same as that in PLL. Therefore, the unlearning target T(z, ˜ s) of NLL can be defined as:

where Ti(z, ˜ s) refers to the i-th element of T(z, ˜ s). Finally, the objective function of NLL for machine unlearning is:

The unlearned parameters θu can be obtained by minimizing the objective function:

Minimizing the objective function Jn enables successful unlearning of the data, regardless of the correctness of the label or whether the model has previously learned correct information from the training data. This allows us to effectively remove the influence of unlearning data, and ensure the model's predictions from being influenced by noisy information.

4 Experiments

In this section, we conduct experiments on three learning paradigms: SL, PLL, and NLL, to evaluate the performance of the proposed approach, UDRU. The experiments mainly focus on evaluating unlearning approaches in terms of efficiency in unlearning, the ability of preserving performance, and time consumption. We implement our experiments using PyTorch on NVIDIA RTX 4090. Our code is released at https://github.com/Ehwartz/udru.

4.1 Experimental Settings

Datasets & Pre-processing. We conduct experimental studies on three widely-used datasets: MNIST, Fashion- MNIST (Fashion), and CIFAR10. The MNIST dataset comprises handwritten digits distributed across 10 classes, while the Fashion dataset includes standardized images of fashion items with 10 classes. The CIFAR10 dataset consists of color images grouped into 10 classes. The partial rate of PLL is set as 0.2, and the noise rate of NLL is 0.2. MNIST and Fashion datasets are utilized for studying the unlearning performance of all approaches in PLL and NLL.

Baselines. We select retrain [Bourtoule et al., 2021], Amnesiac ML [Graves et al., 2021] and K-priors [Khan and Swaroop, 2021] as comparison approaches. Retrain, Amnesiac ML and K-priors belong to strategies representing the most basic unlearning strategy, updating parameters by storing gradients during training, and a knowledge adaption strategy, respectively. In the training process, we store gradients for each instance in datasets to apply Amnesiac ML by updating parameters with accumulated gradients. The implementation of K-priors depends on a loss function, which allows us to apply it for experiments by changing suitable loss functions according to different learning paradigms. It is worth noting that Amnesiac ML cannot handle the cases involving Fashion and CIFAR10 due to constraints in storing gradients and hidden layers of CNN and ResNet50 for all training data.

Setup. For machine unlearning tasks, we need to obtain parameters (θ∗ ) of the trained model before using the unlearning approaches to experiment. Therefore, we should train models for different learning paradigms firstly. The selection of appropriate classification models is based on the scales of the datasets and the difficulty of identification. Specifically, MLP, CNN, and ResNet50 are used to identify MNIST, Fashion and CIFAR10, respectively. For the selection of loss functions, Cross-Entropy loss is used to SL, and Classifier- Consistent Loss [Feng et al., 2020] and Generalized Cross Entropy Loss [Zhang and Sabuncu, 2018] are used to train models in PLL and NLL, respectively. We train models using SGD with a learning rate of 10-4 and a weight decay of 10-3 . The batch size and epoch are set as 64 and 256, respectively. Subsequently, we introduce the settings for machine unlearning in three learning paradigms. Batch size for Fashion and CIFAR10 is set as 64, while we do not divide MNIST into batches. Learning rate for three datasets is set as 10-4 , δ in UDRU is set as 1 for MNIST and Fashion, and 10-2 for CIFAR10.

4.2 Empirical Results

As shown in Table 1-3, the unlearning data for each dataset shares the same label, where this label is randomly selected from the label space. In our systematic sampling, we consider 20%, 40%, 60%, 80%, and 100% of the data belonging to the selected label from the training dataset for unlearning. In the tables, "Original" denotes the accuracy of the original training dataset. "Unlearning data" in the tables shows the accuracy of the models on the unlearning data after removing that data, while "remaining data" represents the accuracy of these unlearned models on the remaining data except the data in the same label as the unlearning data. ↓ indicates that the accuracy of approaches is smaller for the unlearning data, indicating better performance. ↑ displays that the accuracy of approaches is higher for the remaining data, the performance is better. The experiments for convergence and the selection of δ are shown in Appendix C.

Efficiency inUnlearning. Analyzing the accuracy reported in Table 1, Table 2, and Table 3, we find that the results of UDRU in "unlearning data" are consistently close to the comparison approaches across all datasets and different unlearning percentages. This demonstrates the effectiveness of UDRU in thoroughly unlearning sampled data, which exhibits close performance to the retraining approach. Although UDRU may not completely erase all unlearning data in some cases, leading to a slight reduction in performance, these findings provide the potential of UDRU as a robust approach for efficient unlearning in the SL, PLL, and NLL scenarios.

The Ability of Preserving Performance. In Table 1, Table 2, and Table 3, we observe that the accuracy of "remaining data" in UDRU exhibits comparable performance across the most cases. This proves that UDRU can effectively preserve models' performance regardless of the number of instances being unlearned. Contrary to Retrain, which struggles to maintain the original performance in larger datasets because of unbalanced training datasets, and Amnesiac ML, which completely erodes models' performance, UDRU maintains an impressive accuracy on the remaining data.

Time Consumption. To evaluate the time consumption of each unlearning approach, we conduct a comparative analysis of the experiment durations presented in Table 1-3 for unlearning 20% of the data. The results, as depicted in Table 4, indicate that UDRU outperforms other approaches, which demonstrates a faster unlearning process across various datasets. This observation highlights the computational efficiency of UDRU, positioning it as a compelling choice for practical applications due to its lower computational cost.

Privacy Protection Against Membership Inference Attack. Amembership inference attack is a privacy attack that aims to determine whether a specific data was used during the process of training a machine learning model [Shokri et al., 2017]. To evaluate the robustness of different unlearning approaches, including UDRU, against membership inference attacks, we conduct experiments using the MNIST dataset. Our experimental setup involves a white-box attack, where we concatenate all hidden layers and gradients in an MLP to train an attacker model. Then, we compare the accuracy when models are required to unlearn 20% data of each class separately. The results presented in Table 5 demonstrate that UDRU can lead to relatively lower precision of the attacker, which implies the effectiveness of UDRU on unlearning and thwarting membership inference attacks.

5 Conclusion

In this paper, we propose a novel approach called UDRU to explore machine unlearning across scenarios ranging from SL to WSL. Motivated by that untrained model's predictions follow a uniform distribution, we formulate an unlearning target for model outputs by minimizing the divergence between the model's prediction distribution and a uniform distribution. This erases the ability of the model to distinguish features from the training data. Recognizing that real-world applications often involve weak supervised information, UDRU can successfully address uncertainty in unlearning by analyzing possible situations in PLL and NLL. Furthermore, formulating targets only from outputs of unlearned data that gets rid of redundant training data, enhancing the flexibility of our approach, particularly when unlearning large models and big datasets. With formulated targets, we apply a regularization to derive an objective function, which converts unlearning task of classification models into convex regression. This contributes to faster convergence and reduced computational cost. Empirical studies show the superiority and robustness of our approach in unlearning across SL, PLL, and NLL tasks while preserving model performance. Additionally, UDRU proves effective against membership inference attacks.

Acknowledgments

The authors wish to thank the anonymous reviewers for their helpful comments and suggestions. This work was supported by the National Science Foundation of China (62225602) and MX is supported by the Australian Research Council (DE230101116). This work was also supported by the Big Data Computing Center of Southeast University.