הסוד של מודלי AI: איך לגרום להם לשכוח?

So, I will tell you that Deep Neural Networks are a kind of overparameterized models, in the sense that they have many parameters, and they usually tend to memorize their training data. Memorization has various forms and extents. We will consider a strict form of overparameterization and memorization, which is that the trained model perfectly fits its training data set. in the sense that it has a zero or near zero training error, which is quite common in image classification deep networks. Here is an illustration for it. If we take input from the training data set and give them to the trained model, the predicted label will be exactly the same as it was in the training example. And if this happens for all of the training examples in the data set, we have perfect fitting. So, such memorization and perfect fitting in over-parameterized models significantly increases the risks to privacy and to bad functionality, and therefore it increases the importance of machine unlearning. And this leads us to our research question, which is How the parameterization level or the over-parameterization level affects the effectiveness of machine unlearning methods. So in order to examine various parameterization levels, we take a standard architecture, here it's Resnet 34, and change its width across its layers, proportionally change the width of the layers. כך ש-1 נקרא ל"סטנדרט ארכיטקטורה" הראשונה, ו-2 נקרא ל"סטנדרט ארכיטקטורה" הראשונה, כך שאומנם הם רבים, הם עדיין יכולים להיות מעורר-פרמטריים. אנחנו רואים שב-34 רזנטים על סרטון קטן, ב-0.4 רזנטים ומעל, יש מעורר-פרמטריזציה, במובן שהתרנינג הוא... is less than 0.1%;

near perfect fitting. And we will denote under-parameterization as cases where the train error is above 10%. There are various goals for unlearning, various separate

goals that not necessarily come together. The popular one is privacy of training data. meaning that we want that the unlearned example should not be identified as such, compared to test data. In the sense that if one applies a loss-based membership inference attack, it should fail. Membership inference can be done by applying a binary classifier that should estimate if an example is an unlearned example or not. And therefore, better privacy is achieved when the loss distribution more similar, therefore less distinguishable, making the membership inference closer to random guessing. And another very different goal for unlearning is bias removal, where we want to change the model functionality, such that it predicts other labels than those available for these examples in the training data set. זאת אומרת שאנחנו רוצים את הרעיון הקלסיפיקציה כדי שהמספר של המספרים שאי-אפשר להכיר בו יהיה כמו שכן. אנחנו נבחר חלק מהמתודות הלימודים הקודמות של המדעים העברית בקונפרנסים מערכות מעולה. אני לא אוהב את הזמן להיכנס לדעות ולפרומולציות,

אבל אני אומר שהמספר הקודם הוא שהלימודים קבועים בצמצום מידע חשוב של המודל. by an optimization problem that aims to degrade the performance on the examples to forget, while keeping the performance on the examples that we want to retain, not to forget. And usually, unlearning methods use both the "forget" set, the "forget" examples, and the "retain" set, the examples to keep. But some methods, fewer methods, כמו אלו שהם פרסים לילדים, נבנה להתלהב בלי להשתמש באקזמפלים, בלי להשתמש בהם. נעבור לנושא הזה אחר כך. אוקיי,

בעצם אנחנו עוברים לעשות, או עשינו, אקספירימנטים גדולים רבים עם הרבה פעמים להתלהב על מודלים מסוימים, להבין איך הפרמטריזציה מאפקטת את ההתלהב. So the original methods were proposed for the standard architecture, and therefore we cannot use the original hyperparameters. Therefore, we propose validation-based tuning of hyperparameters for machine learning, and to formulate it shortly, the parameters of the original model, not the hyperparameters, the parameters of the model. are denoted as W0. The parameters of the unlearned model are denoted as Wpsi, where Psi is the hyperparameter set for the unlearning function U. And our goal is to find hyperparameter set Psi that minimizes a score function. We search over a grid of hyperparameter options. We defined the validation score as a convex combination of two scores. The first one is the goal for unlearning, it will be for us privacy or bias removal, and we want to minimize such a score, we will define it. And the second is a score for utility degradation. Utility degradation is basically that we don't want that the test error of the classifier would increase due to the unlearning. We are in a validation process, so we define it by a validation error on a validation set, not a test set, validation set. So this is basically the increase in the validation error after unlearning, compared to before unlearning. For the privacy score, we define a proxy metric that should reflect the success of a membership inference. We do not apply actual membership inference because it is computationally expensive for a validation process, we will do it for the evaluation. So, we defined the proxymatric as the distance between the loss of the model, of the unlearned model, on the forget set, compared to the loss on the validation forget set, where these are actually validation examples from the classes. that we

want to forget some other examples. And for the bias removal, the score is simply the negative forget error, because we want to maximize the error on the forget examples, and we have here a minimization problem in the validation task, so we just attach a minus sign to it in order to promote maximization of... אוקיי, אז עכשיו לנתונים של האקספרימנט.

ההצעה הראשונה שלנו היא שהשקעה שלנו תמיד מתקדמת על מודלים מעבר לפרמטרים. כאן אנחנו רואים את זה לגבי גורם הפריביסי, אז הגורם הפריביסי של המגזר הזה הוא גורם הפריביסי במגזר המדעי. It should be closer to 0.5, because 0.5 is just random guessing, so we want to be as low as possible in these diagrams. And the horizontal axis is the utility axis, where we want to have the test tower as low as possible. So we actually want to be as close as possible to the lower left corner of these diagrams, and indeed, we see that the yellow and green markers, which are over-parameterized in this case, are the closest to the best-performing corners of the diagrams. For bias removal, we see similar trend, but here the best-performing corner is the upper-left corner, because the vertical axis is the forget-error that we want to maximize in bias removal. But again, we see the trend that over-parameterized models better achieve the balance between achieving the unlearning growth and utility, except for the L1-sparsity method, that we will return to it later on. Each marker here is a single run of unlearning on a single model. So, we are going to take all the over-parameterized models and average their performance per unlearning method. These are the orange markers of the here. And the black markers are for the average performance of the underparameterized models. So, we see that also on average performance, the overparameterized models perform much better than underparameterized models. Next, we measure the gains in

privacy and the gains in bias removal due to unlearning, meaning, how much the evaluation metric for privacy and for bias removal changed and improved after unlearning compared to before unlearning. So, we want to be in both of these diagrams as high as possible vertically and to the left as possible, because the horizontal axis is the utility loss, the increase in test error. So, we see here that overparameterization promotes unlearning with beneficial high-gain... because the orange markers of overparameterized models are very high in these diagrams. And the black markers of underparameterized models are quite low vertically, meaning that underparameterization restricts the ability of unlearning to low-gain trade-offs, because underparameterization means that the model has a low complexity and therefore unlearning is restricted in its ability to improve privacy or bias removal. Another interesting insight is that other parameterized models may have good unlearning privacy if the original models already had good training data privacy, meaning that the unlearning doesn't damage the original privacy. אבל המקרים האלה לא נמצאים בצורה מאוד טובה, מספר הטסות הוא קצת גדול, אז המקרים האלה לא כל כך גדולים, ועדיין אנחנו מבקשים מודלים מעבר לפרמטריות. ולגבי רימובל מעבר, אנחנו נראה שהרימובל מעבר לפרמטריות הוא עניין לגבי רימובל מעבר לצלילים, וזה גם מבחינת שימוש בפרוגט-סט בפרוסס הלא-לשון. This is the reason that the L1 sparsity method and also retraining from scratch, that is often thought as the golden start-up for unlearning, they are not good for bias removal, for the bias removal goal, because they do not use the "forget" examples. Lastly, I will not get into the details of this, we have more details in the paper. We explored how the decision regions of the classifiers are changed due to unlearning. We defined small local neighborhoods around each of the unlearned examples, and measured how much it changed after unlearning compared to before unlearning, and how much outside of these local neighborhoods the decision regions kept unchanged. And we show that over-parameterization enables unlearning to modify the model decision regions more delicately, and in bias removal it is more locally in the decision region space, without much changes elsewhere, and this again requires the forget set. So, to conclude, we show that validation-based tuning of unlearning hyperparameters is is important and that over-parameterization promotes successful unlearning with high-gain trade-offs, in contrast to under-parameterization, that restricts unlearning to low-gain trade-offs, and for biased removal, over-parameterization and the forget-set are important

for successful biased removal with local changes of decision regions. Much more details and experiments are in... וזה מייל שלי, תודה רבה. יש עוד שאלות לד"ר יהודה? יש עוד שאלות לד"ר יהודה?

האם זה עובד גם על LLMS? האם זה עובד גם על LLMS? על מודל המדע? -המתודות האלה הן ספציפית ל-netוורקס של קלסיפיקציה אימג' אבל יש מתודות ללמדים ללמדים ללמדים למודלים מסוימים, ללמדים VLM, יש מתודות ללמדים ללמדים לכל דבר בעצם, לכל דבר. שאלה לגבי מודלים מעברלמנטריים. האם זה אפשר שאחרי שאתה עושה את המודל... forget something, it still contains data, which is not used, like in a analogy with biology, you sometimes have like inactivated gene, which is still in the organism, just not working. - Of course, of course. This is actually a timely research topic, that I'm also work on it. It is called, can the model relearn again the examples that you... you deleted, you removed. So the answer is yes, and this is a very timely research topic. Thank you. And maybe I'm repeating the question in a different direction, that it seems that forgetting the label is actually relearning a new random label, say, of a half instead of one or a zero. One of the methods... that we explored here, which is already known, is to give random labels to the existing inputs that you want to forget. So, this is actually one of the basic ways to try to forget training examples from a model. Well, I want to complement the two questions, whether we can reach a state when it comes to... privacy, and I like that you call it unlearning than forgetting. Forgetting, sometimes it's about the retrieval, like, you know, we humans, we cannot retrieve something. So, when it comes to privacy, can we reach a state where the model forgets someone entirely without leaving a trace in a reversible way? This is a real research question. Do you believe we were reached? It's difficult to estimate. This is a very timely research topic, and we need to develop metrics that help us to understand whether we really unlearned the data or not. So, there are many open questions on this. And yes, it's very interesting. Thank you very much. Thank you.