On Newton’s Method to Unlearn Neural Networks

Abstract

Machine unlearning facilitates personal data ownership, including the “right to be forgotten”. The proliferation of applications of neural networks (NNs) trained on users’ personal data calls for the need to develop algorithms to unlearn an NN. Since retraining is costly, efficiency is often achieved through approximate unlearning which aims to unlearn a trained NN to be close to the retrained one (in distribution). Though the Newton’s method has been used by previous works to approximately unlearn linear models, adapting it for unlearning an NN often encounters degenerate Hessians that make computing the Newton’s update impossible. In this paper, we will first show that when coupled with naive yet often effective solutions to mitigate the degeneracy issue for unlearning, the Newton’s method surprisingly suffers from catastrophic forgetting. To overcome this difficulty, we revise the Newton’s method to include a theoretically justified regularizer and propose a cubic-regularized Newton’s method for unlearning an NN. The cubic regularizer comes with the benefits of not requiring manual finetuning and affording a natural interpretation. Empirical evaluation on several models and real-world datasets shows that our method is more resilient to catastrophic forgetting and performs better than the baselines, especially in sequential unlearning.

1 Introduction

The recent few years have witnessed a rapid development of new and larger machine learning (ML) models trained on vast amounts of data, including their users’ personal data (Leffer, 2023). With the introduction of regulations such as the General Data Protection Regulation (GDPR) 2016 and the California Consumer Privacy Act (CCPA) 2018, ownership is now granted to individual users over their contributed personal data, including the “right to be forgotten” that allows them to have their data erased not only from the data center but also from any system (e.g., ML model) utilizing it. This motivates the study of a critical question: How can the influence of a data instance/point be removed/erased from an ML model upon request from its owner, especially when the cost of model retraining becomes prohibitively expensive in light of the ever-growing model size? To answer this question, machine unlearning (Bourtoule et al., 2021; Cao and Yang, 2015; Nguyen et al., 2022) aims to effectively and efficiently “unlearn” (instead of learn) the ML model from the requested training data points to be erased, while preserving its performance post-unlearning.

The proliferation of ML applications, in particular, that of neural networks (NNs) trained on users’ personal data, calls for the need to develop algorithms to unlearn an NN (Triantafillou et al., 2023), which is challenging due to the complex interactions between the data and NN parameters arising from the iterative training schemes and non-linear operations in NNs, to name a few (Goodfellow et al., 2016). Though exact unlearning of an NN can be achieved by retraining from scratch using all the training data points except that to be erased, it scales poorly to big data and NN size. Hence, one might instead resort to approximate unlearning to gain efficiency and scalability while aiming to unlearn the trained NN to be close to the retrained one (in distribution).

An NN can be approximately unlearned by optimizing a surrogate function that resembles the objective function for the retrained one. This gives rise to a number of parameter update techniques that continually optimize the trained NN on the training data points to be retained (i.e., excluding those to be erased) (Golatkar et al., 2021; Guo et al., 2020; Neel et al., 2021). Intuitively, such a form of approximate unlearning attempts to “overwrite” the NN’s knowledge of the erased data points with that benefiting its predictions on the retained data points. To be efficient (i.e., cost of unlearning is less than that of retraining from scratch), it is natural to only perform few-shot parameter updates. To this end, previous works have considered the Newton’s method due to its fast convergence rate as long as the optimal NN parameters w.r.t. the retraining objective (i.e., trained on the data points to be retained) remain close to that w.r.t. the original objective (i.e., trained on all the data points including that to be erased) (Golatkar et al., 2020b; Guo et al., 2020; Sekhari et al., 2021). Unfortunately, when adapting the Newton’s method for unlearning an NN, it often results in degenerate Hessians that make computing the Newton’s update impossible. Our work here focuses on tackling this non-trivial issue of degeneracy such that when resolved, the Newton’s update can be adapted to unlearn an NN well.

In this paper, we will first show that when coupled with naive yet often effective solutions to mitigate the degeneracy issue (i.e., resorting to pseudoinverse or adding a small dam** factor to the diagonal of the Hessian) for unlearning (Sec. 3.2), the original Newton’s method surprisingly suffers from catastrophic forgetting (Sec. 5.3). To overcome this difficulty, we revise the quadratic approximation of the surrogate function in the Newton’s method to include a cubic regularizer that has been shown in the seminal work of Nesterov and Polyak (2006) to preserve the property of upper bounding the surrogate function (Sec. 4.1). Consequently, we propose a Cubic-regularized Newton’s (CureNewton’s) method for unlearning an NN that does not suffer from the issue of degenerate Hessians (Sec. 4.2). Furthermore, the cubic regularizer comes with the benefit of not requiring manual finetuning and can be optimized to automatically adapt to different requested training data points to be erased under the mild assumption of an $M$-Lipschitz continuous Hessian, which eases the use of CureNewton for unlearning in more practical settings. Interestingly, the cubic regularizer is amenable to a natural interpretation of the distance (in the L2 norm sense) between the unlearned NN parameters vs. the optimal parameters of the original NN (i.e., trained on all data) before unlearning. Empirical evaluation on real-world datasets reveals that CureNewton can effectively unlearn a variety of models with greater resilience to catastrophic forgetting and perform better than the baselines (Sec. 5.3), especially in the sequential unlearning setting (Sec. 5.4).

1.1 Related Works

Exact vs. approximate unlearning. Ideally, addressing machine unlearning requires generating a model that is identical to the one retrained from scratch but without the requested training data points to be erased, i.e., exact unlearning. Earlier works have proposed meticulous learning frameworks capable of exact unlearning in statistical models such as support vector machines, $k$-means clustering, random forests, and item-based collaborative filtering (Brophy and Lowd, 2021; Cao and Yang, 2015; Cauwenberghs and Poggio, 2000; Ginart et al., 2019). To facilitate exact unlearning in neural networks, the exemplary work of Bourtoule et al. (2021) proposes a data-centric method that maintains disjoint data subsets and their corresponding models to reduce the cost of retraining. However, a simple slow-down attack with uniformly distributed requests can significantly increase its cost (Yan et al., 2022). Since precisely unlearning a neural network is difficult and the cost of retraining a network is typically huge, recent literature has adopted a notion of approximate unlearning that seeks an unlearned model similar to the retrained model. This gives rise to various unlearning heuristics, including fine-tuning on random labels, moving in the opposite direction of optimization, or teaching the model to produce unseen-like predictions for the removed points (Chundawat et al., 2023; Tarun et al., 2023; Warnecke et al., 2021). However, they often lack guarantees for the approximation to the retrained model. Rigorously, such approximation error is essential to establish a certification of removal (Guo et al., 2020) and measure the amount of information leakage on the set that has been removed (Golatkar et al., 2020b). Within this taxonomy, our method falls into the category of approximate unlearning and provides an unlearning update that is analytical for its approximation error in the future.

Weak vs. strong unlearning. Approximate unlearning can be further categorized into two subclasses based on the granularity level of indistinguishability to the retrained model (Xu et al., 2024). Weak unlearning seeks an unlearned model with similar predictions to the retrained model, i.e., indistinguishability in the output space. Exemplary techniques include linear filtration in the logit-based classifiers (Baumhauer et al., 2022) and linearizing the final activations via the Neural Tangent Kernel (Golatkar et al., 2020a). On the other hand, strong unlearning methods modify model parameters to obtain indistinguishability in the parameter space. This purpose is reflected in the notion of $(\varepsilon,\delta)$-certified removal (Guo et al., 2020), which is inspired by a similar concept in differential privacy (Dwork, 2006). To tackle strong unlearning, earlier works have used popular optimization techniques to achieve minimal loss on the remaining set and thereby resemble retrained models. First-order methods, such as gradient descent and noisy gradient descent, are used in the work of Neel et al. (2021) and Ullah et al. (2021) to unlearn models with a strong assumption of model stability. More effectively, the second-order methods of Golatkar et al. (2020b); Guo et al. (2020) constitute closed-form unlearning updates with lower approximation error to the retrained solution while naturally aligned with the notion of influence function (Koh and Liang, 2017). Our work generalizes that of Guo et al. (2020) to trained NNs whose Hessians are often degenerate.

2 Preliminaries

2.1 Problem Setting

Let $\mathcal{A}$ denote a learning algorithm that takes a training set $D$ and returns a model $h^{*}\in\mathcal{H}$ trained on $D$ where $\mathcal{H}$ is the hypothesis set. Let us partition $D$ into two disjoint subsets, namely $D_{e}$ of erased data points and $D_{r}$ of retained data points, i.e., $D_{e}\cup D_{r}=D$ and $D_{e}\cap D_{r}=\emptyset$. Our goal is to design an unlearning algorithm $\mathcal{M}$ that takes a tuple $\{h^{*},D_{e},D\}$ and returns a new model $h\in\mathcal{H}$ that is free of $D_{e}$’s influence and performs well on $D_{r}$.

An unlearning algorithm is deemed exact if $h=\mathcal{A}(D_{r})$. Retraining from scratch is an unlearning algorithm that trivially achieves exact unlearning, but scales poorly with large datasets and model size of modern NNs. Therefore, we seek an approximation $h\approx\mathcal{A}(D_{r})$ for NN unlearning. Particularly, given a distance function $g:\mathcal{H}\times\mathcal{H}\rightarrow\mathbb{R}$ between two models, approximate unlearning seeks

$$\mathcal{M}(h^{*},D_{e},D)=\mathop{\arg\!\min}_{h\in\mathcal{H}}g(\mathcal{A}(D_{r}),h)\ .\vspace{-2mm}$$

2.2 Approximate Unlearning through Learning via Newton’s Method

Let $w\in\mathbb{R}^{d}$ denote the parameters of a model $h\in\mathcal{H}$. In retraining, $\mathcal{A}$ performs empirical risk minimization (with loss function $\ell$ and regularizer $\mathcal{C}$) to search for the optimal parameters on $D_{r}$.

$$\mathcal{A}(D_{r}):=\mathop{\arg\!\min}_{w\in\mathbb{R}^{d}}\mathcal{L}_{D_{r}}(w)\quad\text{where}\quad\mathcal{L}_{D_{r}}(w)=\frac{1}{|D_{r}|}\sum_{x\in D_{r}}\ell(x;w)+\mathcal{C}(w)\ .$$

Since it is not known how an objective function should be defined to unlearn the trained NN (i.e., on all data points) to obtain the retrained NN (i.e., excluding the data points to be erased), $\mathcal{L}_{D_{r}}$ can be used as a surrogate function given that $\mathcal{A}(D_{r})$ is constructed by finding $w$ such that $\mathcal{L}_{D_{r}}(w)$ is minimized. Accordingly, let us perform a second-order Taylor expansion of $\mathcal{L}_{D_{r}}$ in the vicinity of $w^{*}$ (i.e., the parameters of $h^{*}:=\mathcal{A}(D)$):

$$\widetilde{\mathcal{L}}_{D_{r}}(w)=\mathcal{L}_{D_{r}}(w^{*})+\langle g^{r}_{w^{*}},w-w^{*}\rangle+\frac{1}{2}\left\langle\mathbf{H}^{r}_{w^{*}}(w-w^{*}),w-w^{*}\right\rangle\vspace{1mm}$$ (1)

where $g^{r}_{w^{*}}:=\nabla\mathcal{L}_{D_{r}}(w^{*})$ and $\mathbf{H}^{r}_{w^{*}}:=\nabla^{2}\mathcal{L}_{D_{r}}(w^{*})$. With $\widetilde{\mathcal{L}}_{D_{r}}$ being the quadratic approximation of the surrogate function $\mathcal{L}_{D_{r}}$, we solve for the first-order optimality condition:

$$w=w^{*}-(\mathbf{H}^{r}_{w^{*}})^{-1}g^{r}_{w^{*}}=w^{*}+(|D|\cdot\mathbf{H}_{w^{*}}-|D_{e}|\cdot\mathbf{H}^{e}_{w^{*}})^{-1}(|D|\cdot g_{w^{*}}-|D_{e}|\cdot g^{e}_{w^{*}})\ .$$ (2)

The former constitutes a Newton-like update for unlearning (through learning on $D_{r}$) and the latter follows from the linearity of differentiation. The work of Guo et al. (2020) proposes to use Newton’s method to unlearn models with convex loss functions, e.g., linear models with strongly convex regularizers. Since the Hessian is positive definite everywhere for convex functions, the post-unlearning parameters $w$ in Eq. 2 would be the global minimizer of the quadratic approximation to the surrogate function (in Eq. 1).

3 Understanding Newton’s Method for Unlearning Trained NN

3.1 From Degenerate Hessians to Ill-Defined Newton’s Method

Among the strong unlearning algorithms (see Sec. 1.1), second-order methods often result in a better approximation of the surrogate function for unlearning (see Sec. 2.2) than first-order methods that heavily rely on model stability (Sec. 5.3) and the choice of hyperparameters (App. D.3.1). However, as a representative second-order unlearning algorithm, Newton’s method (Eq. 2) is under a critical assumption: the Hessian $\mathbf{H}_{w^{*}}^{r}$ must be well-conditioned. In reality, conversely, the Hessian of the surrogate function in an NN often shows severe degeneracy, provided that its eigenspectrum has been discovered to encompass a substantial number of zero eigenvalues with a fast decaying tail and escalate as the optimization progresses (Sagun et al., 2017). This observation is illustrated in Figs. 1 and 2 (see page 6) and formally stated below:

Observation 3.1.

$\mathbf{H}_{w^{*}}^{r}\in\mathbb{R}^{d\times d}$ is degenerate and has eigenvalues $\{\lambda_{1},\ldots,\lambda_{k},0,\ldots,0\}$ where $\lambda_{1}\geq\ldots\geq\lambda_{k}>0$ and $k\in\{1,\ldots,d-1\}$.

A theoretical explanation of this phenomenon attributes its rank deficiency to expanding layers in neural networks and the residual that diminishes during training (Singh et al., 2021). Confronted with the ubiquitous degenerate Hessian, Newton’s update consisting of the inverse Hessian-gradient product becomes ill-defined for the purpose of unlearning in trained NNs. Moreover, given unlearning may occur at any point in the learning procedure, failure to tackle degeneracy in an unlearning update can lead to catastrophic forgetting (Sec. 5.3).

3.2 Baselines

Before properly tackling the degeneracy issue, we first discuss the cons of two naive yet often effective solutions: (i) pseudoinversing the Hessian and (ii) augmenting the degenerate Hessian with a small dam** factor.

Pseudoinverse presents a general method to calculate the inverse of an arbitrary matrix. Consider a matrix $\mathbf{A}\in\mathbb{R}^{m\times n}$ with singular value decomposition $\mathbf{A}=\mathbf{U}\boldsymbol{\Sigma}\mathbf{V}^{T}$ where $\mathbf{U}\in\mathbb{R}^{m\times m}$, $\mathbf{V}\in\mathbb{R}^{n\times n}$ are orthogonal matrices and $\boldsymbol{\Sigma}\in\mathbb{R}^{m\times n}$ is a diagonal matrix of singular values, then $\mathbf{A}^{\dagger}=\mathbf{V}\boldsymbol{\Sigma}^{\dagger}\mathbf{U}^{T}$ where $\boldsymbol{\Sigma}^{\dagger}\in\mathbb{R}^{n\times m}$ is constructed by taking the reciprocal of $\boldsymbol{\Sigma}$’s non-zero singular values.

Remark 3.2.

Under Observation 3.1 and supposing $g_{w^{*}}^{r}\notin\ker(\mathbf{H}_{w^{*}}^{r})$,

$$\left\lVert(\mathbf{H}_{w^{*}}^{r})^{\dagger}g_{w^{*}}^{r}\right\rVert=\sum_{i=1}^{k}\frac{\left|(\tilde{g}_{w^{*}}^{r})_{i}\right|}{\lambda_{i}}\geq\frac{\left|(\tilde{g}_{w^{*}}^{r})_{k}\right|}{\lambda_{k}}$$

where $\tilde{g}$ is $g$ in the eigenbasis of $\mathbf{H}$. Since $\lambda_{k}$ can be arbitrarily close to 0, the update norm can be arbitrarily large, posing risks to the model performance post-unlearning.

Dam** regularizes a degenerate square matrix $\mathbf{A}\in\mathbb{R}^{n\times n}$ by adding to it a diagonal matrix $\gamma\mathbf{I}$ where $\mathbf{I}\in\mathbb{R}^{n\times n}$ is the identity matrix and $\gamma\in\mathbb{R}^{+}$ is a positive dam** factor. The eigenvalues of $\mathbf{A}+\gamma\mathbf{I}$ are uniformly shifted by $\gamma$ while its eigenvectors remain unchanged.

Remark 3.3.

Under Observation 3.1,

$$\left\lVert(\mathbf{H}_{w^{*}}^{r}+\gamma\mathbf{I})^{-1}g_{w^{*}}^{r}\right\rVert=\sum_{i=1}^{k}\frac{\left|(\tilde{g}_{w^{*}}^{r})_{i}\right|}{\lambda_{i}+\gamma}+\sum_{j=k+1}^{n}\frac{\left|(\tilde{g}_{w^{*}}^{r})_{j}\right|}{\gamma}\ .$$

To preserve the curvature information within the original Hessian, this technique is often employed with $\gamma$ to be of relatively small magnitude, e.g., $\gamma=10^{-3}$. However, the smaller the $\gamma$ gets, the higher the chance that the update norm becomes significantly large and risks the post-unlearning performance.

Indeed, as observed in our experiments, both methods are sensitive to the local structure of Hessian at the trained solution (see Sec. 5) and the choice of regularization strength (in dam** method). However, adding the dam** factor offers us a tool to control the magnitude of the update and prevent the model from catastrophic forgetting, i.e., unlearning beyond the unwanted points and thereby fostering disastrous performance. We therefore ask a critical question: How can we find a good regularization to the Hessian that facilitates unlearning, while remaining less sensitive to the choice of the hyperparameter? We present our answer to this question in the next two sections.

4 Cubic-regularized Newton’s (CureNewton’s) Method for Unlearning

4.1 Regularized Approximation

In this section, we consider a modified version of the objective quadratic approximation (Eq. 1) that finally gives rise to a well-defined unlearning update. Let $L$ denote the (scaled) Lipschitz constant of the Hessian of $\mathcal{L}$, equivalently $\forall w_{1},w_{2}\in\Theta,\lVert\nabla^{2}\mathcal{L}(w_{1})-\nabla^{2}\mathcal{L}(w_{2})\rVert\leq 2L\lVert w_{1}-w_{2}\rVert$. Following the work of Nesterov and Polyak (2006), we regularize the quadratic approximation of the surrogate function $\mathcal{L}_{D_{r}}$ with the cubic term (highlighted in blue).

$$\widetilde{\mathcal{L}}_{D_{r}}(w)=\mathcal{L}_{D_{r}}(w^{*})+\left\langle g^{r}_{w^{*}},w-w^{*}\right\rangle+\frac{1}{2}\left\langle\mathbf{H}^{r}_{w^{*}}(w-w^{*}),w-w^{*}\right\rangle+{\color[rgb]{0,0,1}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,1}\frac{L}{3}\lVert w-w^{*}\rVert^{3}}\ .$$ (3)

According, $\widetilde{\mathcal{L}}_{D_{r}}$ is the upper approximation of $\mathcal{L}_{D_{r}}$, i.e., $\forall w\in\Theta,\widetilde{\mathcal{L}}_{D_{r}}(w)\geq\mathcal{L}_{D_{r}}(w)$, so it can be used in optimization to find the minimizer of $\mathcal{L}_{D_{r}}$. In a similar endeavor to the Newton’s method (Sec. 2.2), one may be tempted to solve for the first-order optimality condition, which gives

$$w=w^{*}-\left(\mathbf{H}^{r}_{w^{*}}+L\lVert w_{r}-w^{*}\rVert\mathbf{I}\right)^{-1}g^{r}_{w^{*}}\ .$$

Although this effort does not result in a closed-form update like the Newton’s method, it reminds us of the dam** technique where $\gamma=L\lVert w_{r}-w^{*}\rVert$. Accordingly, let us define $\alpha:=\lVert w_{r}-w^{*}\rVert\geq 0$. We will show how to solve for the optimal $\alpha^{*}$ that optimizes the cubic-regularized approximation of the surrogate function (Eq. 3) in the next section.

4.2 CureNewton’s Method for Unlearning

Algorithm 1 CureNewton’s Update for Unlearning

1:Input: trained solution $w^{*}$, retained set $D_{r}$, (scaled) Hessian Lipschitz constant $L$, tolerate $\varepsilon$.

2:Output: new solution $w_{r}$, regularizer $\alpha^{*}$.

3:$g_{w^{*}}^{r}\leftarrow\nabla\mathcal{L}_{D_{r}}(w^{*})$, $\mathbf{H}_{w^{*}}^{r}\leftarrow\nabla^{2}\mathcal{L}_{D_{r}}(w^{*})$

4:$\alpha\leftarrow\max\{0,-\lambda_{d}(\mathbf{H}_{w^{*}}^{r})\}$, $R\leftarrow{\alpha}/{L}$

5:$\mathbf{L}\leftarrow\text{CholeskyDecomposer}(\mathbf{H}_{w^{*}}^{r}+\alpha\mathbf{I})$

6:$\Delta\leftarrow\text{CholeskySolver}(\mathbf{L},g_{w^{*}}^{r})$

7:$\triangleright$ Solve trust-region subproblem (see App. A)

8:if $\lVert\Delta\rVert>R$ then $\triangleright$ Find boundary solution

9:    repeat

10:         $w\leftarrow\text{TriangularSolver}(\mathbf{L},\Delta)$

11:         $\displaystyle\varphi\leftarrow\frac{1}{\lVert\Delta\rVert}-\frac{1}{R}$, $\displaystyle\varphi^{\prime}\leftarrow\frac{\lVert w\rVert^{2}}{\lVert\Delta\rVert^{3}}+\frac{1}{\alpha R}$

12:         $\alpha\leftarrow\alpha-[\varphi^{\prime}]^{-1}\varphi$, $R\leftarrow{\alpha}/{L}$

13:         $\mathbf{L}\leftarrow\text{CholeskyDecomposer}(\mathbf{H}_{w^{*}}^{r}+\alpha\mathbf{I})$

14:         $\Delta\leftarrow\text{CholeskySolver}(\mathbf{L},g_{w^{*}}^{r})$

15:    until $|\lVert\Delta\rVert-R|\leq\varepsilon$

16:    $\alpha^{*}\leftarrow\alpha$

17:else$\triangleright$ Find interior solution

18:    if $\alpha=0$ or $|\lVert\Delta\rVert-R|\leq\varepsilon$ then

19:         return $w_{r}\leftarrow w^{*}+\Delta$, $\alpha^{*}\leftarrow\alpha$

20:    else

21:         $\displaystyle\alpha^{*}\leftarrow\mathop{\arg\!\max}_{\alpha}\{\alpha=\lVert\Delta+\alpha\cdot v_{d}(\mathbf{H}_{w^{*}}^{r})\rVert\}$

22:    end if

23:end if

24:return $w_{r}\leftarrow w^{*}+\Delta$, $\alpha^{*}$

Figure 1: Hessian rank dynamics during training for a 2-layer CNN trained on the FashionMNIST dataset. Detailed training settings are reported in App. C. Figure 2: Eigenspectrum of the Hessian after training for a 2-layer CNN trained on the FashionMNIST dataset.

Let $\Delta:=w_{r}-w^{*}$ and therefore $\alpha=\lVert\Delta\rVert$. We rewrite Eq. 3 in terms of $\Delta$ and $\alpha$ as follows:

$$v_{u}(\Delta)=\left\langle g_{w^{*}}^{r},\Delta\right\rangle+\frac{1}{2}\left\langle\mathbf{H}_{w^{*}}^{r}\cdot\Delta,\Delta\right\rangle+\frac{L}{3}\alpha^{3}\ .$$ (4)

Solving for $\Delta^{*}$ to minimize Eq. 4 is difficult due to the additional non-convexity introduced by the cubic term. Fortunately, it has been shown in (Nesterov and Polyak, 2006) that $v_{u}(\Delta)$ has the following dual in terms of $\alpha$:

$$v_{l}(\alpha)=-\frac{1}{2}\left\langle\left(\mathbf{H}_{w^{*}}^{r}+\alpha L\mathbf{I}\right)^{-1}g_{w^{*}}^{r},g_{w^{*}}^{r}\right\rangle-\frac{L}{6}\alpha^{3}\ .$$ (5)

When $\alpha$ is searched within the convex set $Q=\{\alpha\in\mathbb{R}:\mathbf{H}_{w^{*}}^{r}+\alpha L\mathbf{I}\succ 0,\alpha\geq 0\}$, the duality is strong, i.e., $\min_{\Delta\in\mathbb{R}^{n}}v_{u}(\Delta)=\sup_{\alpha\in Q}v_{l}(\alpha).$ More remarkably, $\sup_{\alpha\in Q}v_{l}(\alpha)$ is a convex constrained optimization problem, so $\alpha^{*}$ can be solved optimally through trust-region methods (Nocedal and Wright, 2006) with iterative updates, such as Newton’s method in optimization:

$$\alpha_{n}=\alpha_{n-1}+\frac{v_{l}(\alpha_{n-1})}{\partial_{\alpha}v_{l}(\alpha_{n-1})}$$ (6)

where $\alpha_{n}\rightarrow\alpha^{*}$ as $n\rightarrow\infty$. Interested readers can find the detailed procedure in App. A. Our CureNewton’s update for unlearning is hence complete:

$$w_{r}=w^{*}-\left(\mathbf{H}^{r}_{w^{*}}+\alpha^{*}L\mathbf{I}\right)^{-1}g^{r}_{w^{*}}\ .$$ (7)

Algo. 1 shows the pseudocode for our proposed method.

Interpretation of $({L}/{3})\lVert w-w^{*}\rVert^{3}$. The cubic term in Eq. 3 can be interpreted in two ways. Firstly, it encompasses the approximation error in a higher-order expansion, which is truncated in the quadratic approximation (Eq. 1). By choosing an appropriate value for $L$, we can ensure a more accurate upper bound on the objective function for optimization. Secondly, the value $\lVert w-w^{*}\rVert$, presented by $\alpha$, is learnable (Eq. 6) and serves as the gateway to understanding unlearning dynamics: lower $\alpha$ keeps the model close to the original model while higher $\alpha$ provides room for weight update. This function of $\alpha$ is highlighted again in Sec. 5.6.

Practical considerations. Storing the full Hessian requires $\mathcal{O}(d^{2})$ space while forming and inverting the Hessian can take up to $\mathcal{O}(md^{2}+d^{3})$ where $d$ is the number of model parameters and $m$ is the dataset size. Fulfilling these requirements is challenging in practice, given the growing volume of training data and expanding parameters in modern NNs. Therefore, we are motivated to adopt SCuReNewton’s, which is the stochastic variant of the CuReNewton’s method (Tripuraneni et al., 2018), for unlearning with large models/datasets. It is noteworthy that SCuReNewton’s method can efficiently employs the Hessian-vector product and allows the stochastic sampling of gradient and Hessian at each iteration. Besides, the stochastic Hessian-vector product costs almost the same as the stochastic gradient descent. A detailed description is in App. B.

5 Experiments

5.1 Evaluation Metrics

Three criteria are used to measure the performance of the unlearning algorithms:

Erasing quality. We measure the erasing quality of an unlearned model based on its accuracy on the erased set ($D_{e}$ Acc.), which is chosen to contain all samples of a specific class in our experiments.

Model performance. We measure the performance of an unlearned model based on its accuracy on the retained training set ($D_{r}$ Acc.) and a fixed test set ($D_{test}$ Acc.).

Efficiency. We compare the running time (in seconds) of different unlearning algorithms to unlearn a batch of requested data points.

5.2 Baselines for Comparison

We compare our unlearning algorithms against the following baselines: (1) Retraining is an exact unlearning algorithm that retrains the entire model from scratch without the erased data; (2) Original is the model prior to unlearning; (3) Random Labels (Rand. Lbls.) randomly assigns new labels to the erased data points and finetunes the model; (4) Gradient Descent (GD) updates model parameters following the descent direction on the remaining data points; (5) Gradient Ascent (GA) maximizes the loss on the erased data points; (6) Neural Tangent Kernel-based (NTK) (Golatkar et al., 2020a) linearizes the model outputs via NTK matrix and accordingly derives a one-shot unlearning update; (7) PINV-Newton computes Newton’s update with the pseudo-inverse operation on the Hessian; (8) Damped-Newton: computes Newton’s update with a dam** factor $\gamma$ to make the Hessian positive definite; we set $\gamma=10^{-4}$ by default.

5.3 Batch Unlearning

In this experiment, we compare CureNewton, its stochastic variant called SCureNewton, and other tested baselines to unlearn an entire training class in batch unlearning settings. We deliberately choose small-scaled models that allow us to compute the Hessian matrix exactly on two popular image datasets: MNIST (Deng, 2012) and FashionMNIST (Xiao et al., 2017). Both datasets comprise of $60,000$ training and $10,000$ test images in $10$ balanced classes. For MNIST, the model to be unlearned is a simple multilayer perceptron (MLP) with two fully connected layers ($16$ hidden units) and ReLU activation. For FashionMNIST, we use a convolutional neural network (CNN) comprising two $3\times 3$ convolutional layers, each followed by a $2\times 2$ max-pool layer, for feature extraction and two fully connected layers ($16$ hidden units) with ReLU activation for classification. We pick a random class in the training dataset to construct the erased set $D_{e}$ and unlearn all of its training points in a single batch. This design choice allows us to measure the erasing quality effectively using performance indicators (i.e., $D_{e}$ accuracy as the model performance is expected to deteriorate on the erased class). We elaborate our experimental setup in App. C. Besides, we argue that batch unlearning is a practical setting because a data owner can include multiple data points in a single unlearning request, and/or a model owner can opt to perform unlearning periodically to minimize computational overhead.

Tab. 1 provides our results in batch unlearning settings. On both datasets, Retraining achieves $0\%$ $D_{e}$ accuracy. The low performance of Retraining is reasonable because the model hasn’t been trained to classify the erased class. Compared to Retraining, CureNewton and SCureNewton achieve significant forgetting quality with $6.48\%$ and $3.74\%$ accuracy respectively on FashionMNIST and $7.34\%$ and $5.5\%$ respectively on MNIST dataset. Although the influence of $D_{e}$ is not entirely removed, it may attribute to the error of quadratic approximation and can be effectively improved with more stochastic iterations in SCureNewton (detailed in App. D.3.2). Furthermore, both methods can effectively preserve model performance post-unlearning. On the absolute scale, CureNewton and SCureNewton retain decent generalization on $D_{test}$ with $80.77\%$ and $81.55\%$ accuracy respectively on FashionMNIST and $87.05\%$ and $83.25\%$ accuracy respectively on MNIST dataset. On the relative scale, both methods remain close performance to Retraining on $D_{r}$ and consistently being the closest and second closest method to Retraining on $D_{test}$. This severely contrasts to catastrophic forgetting behaviors observed in other baselines (i.e., Rand. Lbls., GA, PINV-Newton, Damped-Newton), as illustrated by disastrous performance degradation post-unlearning. These results (especially with PINV-Newton and Damped-Newton) affirm the insufficiency of naive degeneracy solutions for unlearning (see Sec. 3.2) and show that CureNewton and its stochastic variant called SCureNewton presents more resilient algorithms for unlearning in NNs.

Table 1: Performance comparison between CureNewton, its stochastic variant called SCureNewton, and other tested baselines in one-shot unlearning settings on MNIST and FashionMNIST datasets. Evaluation is averaged across 3 independent runs. Retraining’s performance is our target (the closer, the better). We use boldface to denote best results and underline to denote second best results.

$\mathcal{M}$	FashionMNIST			MNIST
	$D_{e}$ Acc. (%)	$D_{r}$ Acc. (%)	$D_{test}$ Acc. (%)	$D_{e}$ Acc. (%)	$D_{r}$ Acc. (%)	$D_{test}$ Acc. (%)
Retraining (target)	0.0$\pm$0.0	90.92$\pm$0.53	81.13$\pm$0.52	0.0$\pm$0.0	96.28$\pm$0.14	86.84$\pm$0.12
Original	81.45$\pm$7.72	89.01$\pm$0.46	87.53$\pm$0.81	92.82$\pm$1.27	95.18$\pm$0.53	93.95$\pm$0.5
Rand. Lbls.	0.0$\pm$0.0	44.89$\pm$11.41	40.29$\pm$10.23	0.09$\pm$0.16	33.72$\pm$15.17	30.58$\pm$13.42
GD	80.83$\pm$7.14	89.37$\pm$0.38	87.72$\pm$0.76	92.27$\pm$1.37	95.36$\pm$0.43	94.04$\pm$0.43
GA	1.68$\pm$1.2	62.05$\pm$13.78	55.29$\pm$12.42	1.52$\pm$1.55	67.98$\pm$25.33	62.07$\pm$22.79
NTK	32.38$\pm$20.15	90.34$\pm$1.0	83.63$\pm$2.78	85.54$\pm$1.7	95.54$\pm$0.5	93.62$\pm$0.32
PINV-Newton	1.44$\pm$2.49	10.24$\pm$2.72	9.49$\pm$2.17	0.25$\pm$0.43	11.18$\pm$0.13	10.07$\pm$0.06
Damped-Newton	0.06$\pm$0.11	10.03$\pm$1.66	8.98$\pm$1.63	50.93$\pm$45.33	67.82$\pm$42.92	65.51$\pm$42.8
CureNewton (ours)	6.48$\pm$6.96	89.83$\pm$1.08	80.77$\pm$0.92	7.34$\pm$6.9	95.64$\pm$0.33	87.05$\pm$0.69
SCureNewton (ours)	3.74$\pm$1.63	91.0$\pm$0.45	81.55$\pm$0.25	5.5$\pm$3.9	91.52$\pm$2.6	83.25$\pm$2.12

Figure 3: Performance comparison between CureNewton, SCureNewton, and other baselines in sequential unlearning settings. Top row: ResNet18 on CIFAR10. Bottom row: Llama-2 on AG-News.

5.4 Sequential Unlearning

When unlearning is not handled properly for a single request, errors can accumulate and deteriorate model performance over time. To demonstrate this, we conduct worst-case experiments involving unlearning a model multiple times, or sequential unlearning. Specifically, we perform unlearning of a random class in the training dataset over $n$ batch requests (hence, similar to Sec. 5.3, the final model is expected to perform badly on the erased class); each batch request has the same number of erased data points. This design is appealing because it unveils the long-term effectiveness of the unlearning algorithms and helps us identify catastrophic forgetting phenomena more easily. Besides, we argue that sequential unlearning appropriately reflects real-world scenarios when unlearning requests may come in streams and/or when resource constraints (e.g. data accessibility) limit the amount of data that can be unlearned at a certain time. Other experiments on the impact of unlearning on model learning performance are detailed in App. D.2.

In contrast to small-scale models in Sec. 5.3, our experiments in this section are carried on two popular large-scale models for images and text: ResNet18 (He et al., 2016) and Llama-2-7B (Touvron et al., 2023). Specifically, we fine-tune a ResNet18 (pre-trained on ImageNet-1K dataset) on CIFAR10 dataset (Krizhevsky, 2009) comprising of $50,000$ training images and $1000$ test images in $10$ balanced classes. Due to the enormous size of Llama-2, we incorporate Low-Rank Adaption (LoRA) (Hu et al., 2021) to efficiently fine-tune a pre-trained Llama-2-7B  on AG-News dataset, which consists of $30,000$ training and $1,900$ test samples in $4$ balanced classes. The number of batch unlearning requests is set to $5$ for the CIFAR10 experiment and $3$ for the AG-News experiment. Note that for these models, many baseline unlearning algorithms (i.e., NTK, PINV-Newton, and Damped-Newton) and our CureNewton are not applicable as they poorly scale to large model sizes.

Fig. 3 shows our results in the sequential unlearning settings. As can be seen, our SCureNewton is the only algorithm that achieves $D_{e}$ accuracy closest to Retraining on both datasets while maintaining decent accuracy on $D_{test}$ and $D_{r}$. On an absolute scale, the final models using Retraining show $0\%$ $D_{e}$ accuracy, whereas those using SCureNewton achieve around $26-37\%$ $D_{e}$ accuracy. This indicates its ability to obtain high erasing quality while preserving the performance of the post-unlearning model, even after multiple unlearning requests. Especially when compared to the second-best algorithm (i.e. GD), SCureNewton exhibits significantly better erasing quality due to leveraging second-order information (the Hessian) in addition to first-order information (the gradient), which is particularly beneficial for unlearning large-scale models. On the other hand, catastrophic forgetting can be pronouncedly observed in other baseline methods (i.e., GA and Rand. Lbls.), indicating their inadequacy to perform unlearning in long-term settings.

Table 2: Running time efficiency (in seconds) for Retraining, CureNewton, and SCureNewton across different datasets and models. SCureNewton provides an efficient alternative to CureNewton while being significantly faster than Retraining.

Dataset	FashionMNIST	MNIST	CIFAR10	AG-News
Model	2-layer CNN	2-layer MLP	ResNet18	Llama-2-7B (+LoRA)
Model Parameters	20,728	13,002	11,173,962	1,064,960
Retraining	156.50$\pm$39.75	109.08$\pm$10.17	77.86$\pm$2.40	4464.86$\pm$48.83
CureNewton (ours)	9894.87$\pm$118.43	1193.19$\pm$205.31	-	-
SCureNewton (ours)	62.42$\pm$1.89	28.07$\pm$4.14	41.79$\pm$1.08	87.27$\pm$4.63

5.5 Efficiency

Tab. 2 shows running time efficiency (in seconds) for Retraining, CureNewton, and SCureNewton across different datasets and models. The results are based on the average time to perform a batch unlearning request (i.e., divided by $n$ total requests in sequential unlearning experiments). As expected, CureNewton requires extensive computation to calculate and inverse the Hessian matrix, hence the least efficient algorithm. SCureNewton provides a highly efficient alternative to CureNewton and can perform unlearning much faster than Retraining. Therefore, as a rule of thumb, we recommend the adoption of CureNewton when there are few constraints in time and space; otherwise, SCureNewton is preferred at the expense of minor fluctuations in the unlearning performance. We provide more efficiency comparisons in App. D.1.

5.6 Ablation

In this section, we analyze the dynamics of $\alpha^{*}$ found by CureNewton and the sensitivity of choosing $L$ as a hyperparameter in our method. We have also studied the effect of the learning rate in GD (App. D.3.1), the number of stochastic iterations in SCureNewton (App. D.3.2), and clip** $\alpha$ (App. D.3.3).

Dynamics of $\alpha^{*}$. We show the dynamics of $\alpha^{*}$ over the course of class-level sequential unlearning on a 2-layer CNN trained on FashionMNIST in Fig. 4. As more samples of the target class are removed in the later requests, $\alpha^{*}$ consistently decreases up to a point where it increases again at the end of the procedure (around request $50$). Since smaller $\alpha$ indicates a higher degree of update in the model, it aligns well with our intuition that the model weights are gradually shifted more and more to entirely unlearn the influence of the removed class. On the other hand, we argue that the steep increase near the end of unlearning is to prevent the excessively large change in the model near the completion of class removal and leads to $D_{e}$ not totally removed from the model, as observed in Sec. 5.3. Therefore, we suggest that for class unlearning, we may clip the value of $\alpha^{*}$ to keep it monotonically decreasing even to obtain a complete removal of the target class. We include a supplementary experiment for this in App. D.3.3.

Figure 4: Dynamics of CureNewton’s $\alpha^{*}$ in sequential unlearning experiment on FashionMNIST dataset.

Figure 5: $D_{e}$ and $D_{test}$ accuracy for CureNewton and SCureNewton across varying $L$ in batch unlearning experiment on FashionMNIST dataset.

Sensitivity of $L$. We show the performance of CureNewton and SCureNewton for varying values of $L$ ($L$ is searched in the range of $[20,200]$) for sequential unlearning using CNN on FashionMNIST in Fig 5. Aligned with our assumption of $L$ as the (scaled) Hessian Lipschitz constant, we observe minimal monotonic fluctuations in CureNewton performance when $L$ is properly adjusted to be above a certain threshold (shaded area), which indicates a good upper bound on the true objective function. We argue that finding such $L$ is achievable in practice, given that $L$ can be estimated over the course of learning, i.e., before the first unlearning request occurs. On the other hand, varying $L$ causes negligible changes in the performance of SCureNewton. This may be explained by the fact that $L$ in SCureNewton represents the local Hessian Lipschitz constant of the sampled subsets, which is typically smaller than the global $L$ presumed in CureNewton. Generally, we observe that both CureNewton and SCureNewton are less sensitive to the choice of hyperparameters, which highly contrasts with the fluctuation of GD and SGD methods for varying learning rates (App. D.3.1).

6 Conclusion

Despite the proven successes on linear models, using the Newton’s method to unlearn an NN would encounter the critical issue of degenerate Hessians. To resolve this issue, we have proposed the CureNewton’s method for unlearning an NN. Subsequently, we have shown how the added cubic regularizer can be used to understand the unlearning dynamics of the model naturally. We have empirically verified that the NN unlearned with CureNewton can facilitate various unlearning scenarios without catastrophic forgetting. Though CureNewton can effectively address the issue of degenerate Hessians, it faces certain limitations that necessitate further research. While a rigorous algorithmic-level certification about approximate unlearning has not been provided in this work, we have endeavored to approach the problem of unlearning verification from the empirical perspective by incorporating multiple evaluation/performance metrics. For future work, it would be interesting to look at the privacy aspect of our proposed method and provide a guarantee to fit inside the certified removal verification of approximate unlearning algorithms.

Appendix A Trust-Region Subproblem Solver in CureNewton’s Method

Recall that our dual problem is

$$\sup_{\alpha\in Q}v_{l}(\alpha):=-\frac{1}{2}\left\langle\left(\mathbf{H}_{w^{*}}^{r}+\alpha L\mathbf{I}\right)^{-1}g_{w^{*}}^{r},g_{w^{*}}^{r}\right\rangle-\frac{L}{6}\alpha^{3}$$

where $Q=\{\alpha\in\mathbb{R}:\mathbf{H}_{w^{*}}^{r}+\alpha L\mathbf{I}\succ 0,\alpha\geq 0\}$. As this problem is a one-dimensional convex-constrained optimization, we can find its maximizer by solving the following first-order optimality condition:

$$v_{l}^{\prime}(\alpha)=\frac{L}{2}\left(\lVert\mathbf{H}_{w^{*}}^{r}+\alpha L\mathbf{I})^{-1}g_{w^{*}}^{r}\rVert^{2}-\alpha^{2}\right)=0\ .$$

Equivalently, we seek $\alpha^{*}$ such that

$$\alpha^{*}=\lVert(\mathbf{H}_{w^{*}}^{r}+\alpha^{*}L\mathbf{I})^{-1}g_{w^{*}}^{r}\rVert\quad\text{and}\quad\alpha^{*}\geq\frac{1}{L}\max(0,-\lambda_{d})$$ (8)

where $\lambda_{d}$ denotes the smallest eigenvalue of $\mathbf{H}_{w^{*}}^{r}$. Suppose that $\alpha$ is the solution of Eq. 8 without constraints and $\Delta:=(\mathbf{H}_{w^{*}}^{r}+\alpha L\mathbf{I})^{-1}g_{w^{*}}^{r}$. We use $R={1}/{L}$ to denote the boundary of the trust region, i.e., $\lVert\Delta\rVert\leq R$. It is easy to see that:

• Case 1: If $\lVert\Delta\rVert>R$, the solution must lie on the boundary of the trust region, which is often the case for non-convex functions such as neural networks. Consequently, the optimal $\alpha^{*}$ is the root of the equation $\lVert\Delta\rVert=R$ and therefore can be iteratively updated, e.g., via Newton’s method. However, it is worth noting that $\lVert\Delta\rVert=R$ is ill-defined at some specific points and hence should be tackled via the secular equation ${1}/{\Delta}={1}/{R}$ (see Nocedal and Wright (2006)).

• Case 2: If $\lVert\Delta\rVert<R$, the solution must lie in the interior of the trust region. Moreover, the search space for $\alpha$ can be restricted on the corresponding eigenvector $v_{d}$ of $\lambda_{d}$ such that $\alpha^{*}:=\arg\max_{\alpha}\{\lVert\Delta+\alpha\cdot v_{d}\rVert=\alpha\}$.

Appendix B Stochastic CureNewton’s (SCureNewton’s) Method

SCureNewton involves multiple iterations of optimizing the stochastic variant of the cubic-regularized problem in Eq. 3. In each iteration, two independent minibatches are sampled to compute the stochastic gradient and stochastic Hessian-vector product. Subsequently, gradient descent is used to optimize the stochastic cubic problem, in which the stochastic gradient is perturbed to avoid certain hard cases, as described in Carmon and Duchi (2019). During this time, only the stochastic Hessian-vector product needs to be re-calculated while the stochastic gradient is fixed. Yet, the computational costs remain economical given that the calculation of the stochastic Hessian-vector product costs almost the same as the stochastic gradient.

Appendix C Detailed Experimental Setup

We conduct our experiments on the NVIDIA L40 and H100 GPUs. Evaluation is averaged across 3 random seeds $\{1,2,3\}$. The setup of our experiments (by datasets) is detailed below.

MNIST. The dataset contains $28\times 28$ grayscale images of handwritten digits from $[0-9]$. The training set contains $60,000$ samples and the test set contains $10,000$ samples. The model in use is a 2-layer MLP model with $16$ hidden units. For training, we use Adam optimizer with batch size $64$, $10$ training epochs, learning rate $0.01$ decayed at rate $0.5$ every $1000$ step, and weight decay $0.001$. We chose data points of class $0$ to construct $D_{e}$. To unlearn with CureNewton, we set $M=0.5$. To unlearn with SCureNewton, we set $M=0.1$, gradient sample size $128$, Hessian sample size $64$, $15$ outer iterations, and $3$ inner iterations.

FashionMNIST. The dataset contains $28\times 28$ grayscale article images belonging to $10$ classes. The training set contains $60,000$ samples, and the test set contains $10,000$ samples. We use a 2-layer CNN with a convolutional layer (kernel size $3$ and maps to $8$ channels) and a fully connected layer ($10$ hidden units). The model is trained using Adam optimizer with batch size $64$, $15$ training epochs, learning rate $0.01$ decayed at rate $0.5$ every $5000$ step, and weight decay $0.005$. To unlearn with CureNewton, we set $M=5$. To unlearn with SCureNewton, we use $M=1$, gradient sample size $128$, Hessian sample size $64$, $20$ outer iterations, and $5$ inner iterations.

CIFAR10. The dataset contains $32\times 32$ color images in $10$ classes. The training set contains $50,000$ samples, and the test set contains $10,000$ samples. We train a ResNet18 (He et al., 2016) with $11,173,962$ parameters using Adam optimizer with batch size $100$, $10$ training epochs, learning rate $0.001$ decayed at rate $0.5$ every $5000$ step, and weight decay $1\times 10^{-4}$. To unlearn with SCureNewton, we set $M=50$, gradient sample size $40$, Hessian sample size $20$, with $10$ outer iterations and $3$ inner iterations.

AG-News. The dataset contains news titles and descriptions in $4$ topics. The training set contains $30,000$ samples and the test set contains $1,900$ samples. We finetune the bfloat16-pretrained Llama-2-7B model from Hugging Face using LoRA ($r=2$, $\alpha=2$) with learning rate $2\times 10^{-4}$ and weight decay $0.01$. The number of trainable parameters in the model is $1,064,960$. To unlearn with SCureNewton, we set $M=50$, gradient sample size $20$, Hessian sample size $10$, $10$ outer iterations, and $3$ inner iterations.

Appendix D Supplementary Experiments

D.1 Efficiency of Unlearning

Figure 6: Comparison of unlearning time of different methods across various datasets and models.

Here we illustrate the efficiency of our SCureNewton by comparing the unlearning time with other baseline unlearning methods. As shown in figure 6, SCureNewton consistently costs much shorter time than retraining and is more efficient than other unlearning baseline methods in most cases. The higher unlearning time cost for SCureNewton on CIFAR10 may be due to the large model parameters, which hinders the computation of the stochastic Hessian-vector product.

D.2 Sequential Learning/Unlearning

In this experiment, we randomly partition the dataset into $4$ subsets. The model will then be trained on the partitioned subsets sequentially. During this process, an unlearning process is performed right after learning each subset. Specifically, when the training of one subset is completed, we randomly choose $10\%$ of the samples in the subset to unlearn. Afterward, we continue training the unlearned model on the next subset and unlearning until each subset has been trained. In this setting, we would like to verify that our proposed algorithm will not influence the overall learning performance.

The accuracy dynamics on the retained, erased, and test sets under sequential learning/unlearning settings on Llama2 finetuned on the AG-News dataset are visualized in Fig. 7. It can be observed that SCureNewton achieves the most comparable performance to Retrain, demonstrating its competence in long-term learning performance while some other methods fail to preserve the performance.

Figure 7: Sequential learning/unlearning for Llama-2. The plots on the bottom row are zoomed in on the methods with higher accuracy, for a clearer view.

D.3 Supplementary Ablation

D.3.1 Sensitivity of GD on Learning Rate

In the previous experiments, the GD method demonstrates notable unlearning performance while requiring minimal computational expense. However, in practice, the performance of the GD method is profoundly influenced by the selection of the learning rates: subtle adjustments to the learning rates may significantly disturb the performance. This sensitivity is particularly pronounced when the GD method is applied to neural networks. As depicted in Fig. 8, the performance of the GD method on FashionMNIST, especially on $D_{e}$, exhibits considerable variability based on different learning rates under the same sequential unlearning setting as in the main experiment. In addition, Fig. 9 shows the model performance at the last iteration, which further verifies its sensitivity to the choice of learning rate, in contrast to our CureNewton in Fig. 5. This implies that identifying the optimal learning rate to achieve satisfactory performance may present challenges. The necessity to look for the optimal learning rate may hence limit the real-world application of the GD method.

Adopting the stochastic version of GD could not alleviate the sensitivity to hyperparameters either, as shown in Fig. 9. In contrast, our SCureNewton’s method, as depicted in Fig. 5, exhibits greater consistency and better performance across different choices of hyperparameters.

Figure 8: Performance of GD method in terms of different learning rates in sequential unlearning with FashionMNIST dataset.

Figure 9: Performance of GD (left) and SGD (right) methods in the last iteration on $D_{e}$ and $D_{test}$ for varying values of learning rates.

D.3.2 Number of Stochastic Iterations

In this section, we discuss the influence of different numbers of stochastic iterations in the implementation of our SCureNewton’s method. In practice, the number of stochastic iterations can be adjusted to fulfill specific requirements where increasing the number of iterations typically enhances performance but incurs longer computational time. Fig. 10 demonstrates the relationship between the unlearning performance on FashionMNIST and the varying number of stochastic iterations. It can be observed that when a larger number of iterations is adopted, the result becomes closer to that of the Retraining method. This suggests a trade-off between the performance and time efficiency of our SCureNewton’s method: Increasing the number of iterations leads to a better unlearning performance.

Figure 10: Performance of SCureNewton’s method for different numbers of stochastic iterations for unlearning on FashionMNIST.

D.3.3 Clip** of $\alpha$

As suggested in Sec. 5.6, clip** the value of $\alpha$ and forcing it to be monotonically decreasing may allow the model to acquire larger change near the complementing of class removal. Here we would like to verify the effectiveness of the suggested clip** method by naively taking the minimum value of the previous and the currency $\alpha$ values. As shown in Table 3, clip** the CureNewton’s method indeed yields a reduced accuracy and larger error on $D_{e}$ while minorly influencing the performance on $D_{test}$ and $D_{r}$. The result therefore implies a potential direction to enhance forgetting $D_{e}$.

Table 3: Performance of CureNewton with clipped $\alpha$ on the FashionMNIST dataset.

Methods	$D_{test}$ Acc. ($\%$)	$D_{e}$ Acc. ($\%$)	$D_{r}$ Acc. ($\%$)	$D_{e}$ Error	KL divergence ($\downarrow$)	$\ell_{2}$ distance ($\downarrow$ )	Time (s) ($\downarrow$)
Retrain	$82.31_{\pm 0.71}$	$0.00_{\pm 0.00}$	$94.62_{\pm 0.78}$	$9.54_{\pm 1.34}$	$0.00_{\pm 0.00}$	$0.00_{\pm 0.0}$	$2370_{\pm 106.8}$
CureNewton	$86.11_{\pm 1.49}$	$12.48_{\pm 8.49}$	$95.52_{\pm 0.65}$	$2.16_{\pm 0.72}$	$0.16_{\pm 0.04}$	$2.28_{\pm 0.14}$	$1188_{\pm 15.0}$
CureNewton-Clipped	$86.07_{\pm 1.55}$	$11.70_{\pm 8.88}$	$95.56_{\pm 0.66}$	$2.18_{\pm 0.75}$	$0.16_{\pm 0.04}$	$2.28_{\pm 0.14}$	$927_{\pm 231.8}$

Appendix E Impact Statement

This paper introduces a novel machine unlearning approach to effectively remove the influence of unwanted data samples in neural networks, which outperforms the baseline approaches in unlearning performances across various datasets, unlearning requests, and model architecture. The effectiveness of unlearning neural networks hence suggests significant potential applications from the aspect of data protection. For example, it can be adopted to remove a user’s data from trained neural network models upon request, thereby adhering to the “right to be forgotten” (Mantelero, 2013) requirement to enhance user data protection.