Oliver Geer

1 Introduction

1.1 Motivation for Foundation Models

The recent surge in popularity of generative neural network (NN) algorithms has been rapid and led to attempts to use them in many fields of public, industrial and research interest (Gupta et al., 2024), and due to currently having the greatest versatility and capability for interfacing with humans, foundation models have formed the majority of them (Schneider et al., 2024). Foundation models gain their generative abilities by consuming large amounts of diverse data, then are fine-tuned through extra training to guide them to a specific purpose, such as a domain-specific chatbot or an image generator (Schneider et al., 2024).

However, the vastness of the dataset needed for initial training makes filtering such data difficult, and leads developers to use public, uncontrolled, third-party-owned sources like the World Wide Web. This leads to several types of unwanted data which are present in the foundation dataset and influence the network’s output:

• Personal information including digital history and activity (Nguyen et al., 2022), which may legally need to be forgotten once the data subject withdraws their consent, as per the European Union’s GDPR (European Commission, n.d.) and US CCPA (Bourtoule et al., 2021, p. 141).¹

• Intellectual property such as copyrighted works (Eldan & Russinovich, 2023).

• Unsafe or inappropriate content such as nudity, violence, and disinformation, especially relevant in generative models (Wu et al., 2024).

• “Poisonous” training data added by a discontent user that is designed to damage the NN and degrade its performance (Nguyen et al., 2022).

Machine unlearning algorithms can remove all of these from NNs. However, since poisonous training data requires analysis of the NN in a very different way, I will not mention it in this analysis.

1.2 Motivation for other Neural Networks

The previous problems are most relevant for foundation models, but not unique to them. Although unwanted data is most easily communicated to the user through generative NNs, it can still be gained through the reverse engineering of other types of machine learning model. Neural networks can be used in the automated classification and labelling of data based on a training dataset of classified data (supervised machine learning) (Sarker, 2021), and even with a dataset without labels in order to spot patterns or compress autonomously (unsupervised machine learning) (Smys et al., 2020), and both of these also heavily rely on training datasets.

For example, classifier NNs are used in face recognition (Nguyen et al., 2022), and the presence of facial images in the training dataset could cause legal problems when linked with personal data such as location or name when they deanonymise the data (European Commission, n.d.), if the data must no longer be producible when the user withdraws their consent for its inclusion as per the GDPR.

In this case and with non-generative NNs in general, the problem with unwanted training data is not just its presence in ordinary output. Rather, this training data can be inferred by reverse-engineering either the network’s outputs or its internal structure (if it is available, as with networks like Meta’s Llama (“Llama 3.2 Community License Agreement”, n.d.)). In either of the settings mentioned, such reverse engineering can be a model inversion attack which allows the direct extraction of training data from a model, or membership inference which uses a piece of known data and determines whether it was present in the training data (Veale et al., 2018).

It is worth noting that there are also some very different ways in which machine unlearning algorithms could be useful:

• Specialised algorithms can unlearn specific characteristics inferred by the network from its training data rather than those directly input, enabling the reduction of unequal treatment (R. Chen et al., 2023), for example, by computer vision models based on skin colour.

• Unlearning algorithms can also be used to prevent catastrophic forgetting after a given NN learns too many tasks (Nguyen et al., 2022, p. 19).

Since it is very distinct to the other reasons for unlearning, and relates to model architecture rather than data, I will not mention catastrophic forgetting in this analysis.

1.3 Machine Unlearning

An algorithmically trivial method of removing such unwanted data is not including it in the training data at all, and filtering through the data manually or semi-autonomously. However, this causes two problems: firstly, it can be impractical for foundation models since they rely on having a large amount of diverse input data (Schneider et al., 2024). Secondly, it does not cover the scenario where some training data that was once desirable then becomes unwanted, as in the face recognition consent example previously.

As Nguyen et al. (2022, p. 8) notes, differential privacy is one way to allow unwanted training data but prevent it being leaked or influencing outputs excessively. However, differential privacy is currently resource-inefficient, and is often a significant trade-off between accuracy and privacy (Veale et al., 2018, p. 11; Nguyen et al., 2022, p. 8; Carvalho et al., 2022). It also works only against singular pieces of personal information or intellectual property, but not against concepts such as disinformation or inappropriate content.

If unwanted data needs to be removed on demand from an NN, the naive way to do so would be to create and train a new network on the set of training data without the removed data. However, with regular requests for data removal, in a larger NN like a foundation model, this would be a completely impractical use of time and memory/storage (Nguyen et al., 2022), exacerbating the already-recognised impact of foundation models as climate change accelerators (Chien et al., 2023).

This calls for machine unlearning, a class of algorithms that can remove a piece of pretrained data, trained classification, or trained concept plus its influence from a machine learning model without such retraining (Nguyen et al., 2022). However, there currently exists no widely-adopted algorithm for machine unlearning and the technique is still in its research stage (Nguyen et al., 2022). With NNs specifically, which are widely known to have a “black box” structure where training data has a difficult-to-predict effect on the network’s parameters, there emerges a trade-off between effectiveness and time and space efficiency. Thus, as Wang et al. (2024) describe, there are two main approaches in current machine unlearning research:

• Exact Unlearning, which prioritises removing all influence of a removed datapoint from the network, but may reduce the accuracy of the network in doing so.

• Approximate Unlearning, which partially sacrifices its effectiveness in order to reduce time costs, the amount of past data that must be stored, and damage to the network’s general accuracy.

2 Methodology

Neural networks are not the only method of machine unlearning (Nguyen et al., 2022). Despite this, I will limit my research to NNs since despite having a complex structure, which makes unlearning more difficult than in other machine learning systems, they are increasingly widely used in applications where unlearning is needed the most (Schneider et al., 2024). This links to my title, and how I would like to assess production-headed neural networks.

As machine unlearning is such a wide field of research, I have further limited my scope:

In order to consider the practicality and ethics of unlearning, one has to research potential uses of NNs and the unlearning approaches that suit them. To do this, I first picked three fields of application in which machine unlearning is most important, and in which NNs are increasing in popularity (Kumari et al., 2023, Fig. 4; Duarte et al., 2022, Fig. 4; Gupta et al., 2024, Fig. 1) Firstly there is healthcare, where unlearning may be used to protect and withdraw sensitive health data used to train an NN, especially if it can be linked to people through membership inference (Veale et al., 2018, p. 6), Secondly, in advertising and recommender systems, NNs are trained on user activity which a user may ask to withdraw for their privacy or to redact a mistaken search (Nguyen et al., 2022). Thirdly there are generative foundation models such as large language models and text-to-image models trained initially on the World Wide Web then fine-tuned for their purpose, where the foundational training can introduce personal information, copyrighted content, bias and misinformation which should be counteracted (Nguyen et al., 2022). Another benefit, shown in Table 1, is that these applications cover quite a wide range of NN architectures so allow me to review the real-life applicability of unlearning techniques across these as well.

I initially also considered the Autoencoder and Boltzmann Machine unsupervised NNs, which are used in both advertising (Gharibshah et al., 2020) and healthcare (Miotto et al., 2018) to separate unlabelled data into groups, but there is virtually no research into machine unlearning with these. This could be because non-NN machine learning algorithms like k-means clustering are simpler to use for the same purpose so are focused on more in unlearning research (Nguyen et al., 2022).

I also considered researching unlearning for federated learning. However, these algorithms differ in their situation and design greatly (Nguyen et al., 2022, p. 19) so I will not include them here: to be able to cover them in enough depth a separate report would be needed.

3 Unlearning Approaches

3.1 Exact Unlearning

I have defined exact unlearning methods as those which completely remove all influence of the unlearned data from the network. This means they effectively work through retraining (Wang et al., 2024, p. 7). They use a modified NN architecture, or stored values which need not be recalculated, to decrease the amount of retraining needed and thus the time taken. However, they still retain retraining’s need for the availability of the original training data (Wang et al., 2024, p. 7).

3.1.1 Network Partitioning

Bourtoule et al. (2021) introduced SISA training, which contains two key innovations I will discuss. One is the use of a set of NNs rather than a single one:

The training data is split into mutually exclusive groups called “shards”. Each shard of training data is used to train a different isolated NN, and there is no data transfer between the networks. In production, when data is inputted, the input data is passed to all of these networks, and then the networks’ outputs are aggregated. Assuming the output data is a label or category used to classify the input data, as is often the case with NNs, a good default method for this aggregation is to choose the most common output label from the NNs as the final output (Bourtoule et al., 2021).

This approach requires similar datapoints which should influence each other to be in the same shard, especially when the relationships between datapoints are paramount (Xin et al., 2024, p. 858). M. Chen et al. (2022)’s GraphEraser algorithm implements this for Graph Neural Networks through a Balanced Graph Partition algorithm, ensuring each shard contains a group of nodes and edges that are close together in the graph, but also that each shard is a similar size. Shard-creation algorithms have been proposed for recommendation and session-based analysis networks: Xin et al. (2024)’s SRU algorithm is applied to a Recurrent Neural Network (GRU4Rec) and Transformers (SASRec and BERT4Rec), and C. Chen et al. (2022) apply RecEraser to a Graph Neural Network (LightGCN).

However, such an improvement will cause the unlearning to no longer be exact. The algorithm which splits data into shards is based on all of the training data and even though the NNs fully unlearn, this shard selection algorithm cannot be exactly unlearned without retraining the model completely, making the process technically approximate unlearning (M. Chen et al., 2022, p. 504).

Another improvement is using another machine learning algorithm for the output aggregation, since majority voting makes the assumption that all NN’s outputs are of the same significance, which can harm a model’s performance. Both GraphEraser and SRU use additional NN layers for aggregation of the sub-networks’ outputs. Luckily, this feature does not sacrifice exact unlearning in itself like the partition algorithm does: when unlearning only the network for the removed data’s shard and the relatively small aggregation network must be retrained (Xin et al., 2024, p. 858).

3.1.2 Time Checkpoints

SISA training’s other feature is its use of “slices” of training data within each shard and network (Bourtoule et al., 2021). Training occurs sequentially for each slice, and between the training of each slice the network’s parameters – weights and biases, which store all the model needs to remember what it has learned – are saved, as checkpoints. To unlearn a datapoint, the network for the shard does not need to be fully retrained: it can be retrained from the last checkpoint before the datapoint was learned.

3.1.3 Optimised Full Retraining

DeltaGrad (Wu et al., 2020), like the time checkpoint approaches, uses cached data from past training to speed up retraining. The difference is that while time checkpoint approaches directly retrain the network between any checkpoints where data to be unlearned was input, with DeltaGrad, the change to make to the network is continuously calculated more efficiently using cached data and the L-BFGS algorithm. This makes it better suited to when the datapoints to be forgotten were spread throughout the training data, rather than just after one checkpoint.

3.2 Approximate Unlearning

Approximate unlearning algorithms do not guarantee complete erasure of the data to be forgotten, but are often much faster to run than exact unlearning algorithms (Wang et al., 2024, p. 8). Some are relaxations of exact unlearning algorithms ultimately derived from retraining, as previously described. Some other approximate unlearning methods benefit from no longer having to store all initial training data and instead modify the fully trained NN using only the data to be forgotten (Wang et al., 2024, p. 7).

3.2.1 Time Checkpoints

Just as with network partitioning, with time checkpoint approaches, the exact unlearning requirement can be removed to gain an increase in speed. This is an extension of the approaches mentioned in the exact unlearning section.

He et al. (2021) make their DeepObliviate approach approximate by retraining from the slice with the data to forget for several slices, then applying the same changes in weights and biases that were observed in the original training for the remaining slices. These changes are not identical to the changes that would occur in retraining of the unlearned model, so might carry some information about the unlearned data and prevent this from being exact unlearning under my definition, but only begin being applied when they are calculated to be similar to the changes that would occur in retraining.

The Amnesiac method provided by Graves et al. (2021) similarly caches the changes in weights and biases and is even less exact. It finds the difference in the cached values between the checkpoints before and after the model was trained on the data to be forgotten. It then subtracts this difference from the final weights and biases of the network, making it forget the training data between these two checkpoints but in an approximate way. Finally, the network is trained on the data between the checkpoints, excluding the data to be forgotten.

As the state of all NNs depends solely on their weights and biases (Sanderson, 2017), this approach could be applied to any NN and does not cause any data isolation like network partitioning does, so will cause no performance degradation.

3.2.2 Backpropagation Unlearning: Training Data Available

Most NNs use an optimisation algorithm called backpropagation to be trained, and many studies take advantage of it for unlearning as well. The difference between backpropagation for training and for unlearning, and for each different unlearning approach, is the value that is being minimised.

Chundawat et al. (2023)’s Incompetent Teacher approach uses two NNs alongside the original one to calculate the value to be minimised. One is the incompetent teacher, which is randomly initialised and therefore gives outputs uninformed by the training data, and will teach the student to corrupt its knowledge about the data it should forget. There is also a copy of the original pre-unlearning model, the competent teacher, which will teach the student to retain its knowledge about the data it should remember.

For each piece of input data to be unlearned, the Kullback-Leibler (KL) divergence, a measure of difference, between the outputs of the student and incompetent teacher is minimised, so that the network learns to give outputs for the data to be forgotten as if it had never been trained on it. For pieces of its training data to be retained, the KL divergence between the outputs of the student and competent teacher is minimised, so the unlearning does not degrade the network’s performance on data it is meant to retain. These are different ways to calculate loss depending on the piece of data currently being processed in backpropogation.

SCRUB (Kurmanji et al., 2023) is another optimisation-based machine unlearning method which uses student and competent teacher NNs, although it does not have an incompetent teacher. Instead, it minimises the KL divergence between the student and teacher outputs for the data to be retained and maximises this divergence for the data to be unlearned, taking turns training on each of these in order to avoid trying to minimise an oscillating sum. To prevent degrading the network’s accuracy on data to be retained, it spends its final steps just minimising KL divergence for the retain set.

A problem with this single-teacher setup is that purely maximising the divergence on the data to be unlearned can cause over-unlearning, which can be identified because it gives anomalously high-magnitude outputs when the input of a forgotten piece of data has been input (Kurmanji et al., 2023, p. 3). The Incompetent Teacher approach solved this with out-of-distribution data and another teacher, but Kurmanji et al. (2023, p. 3) give a different solution. They state it is not a problem in scenarios like correcting errors in training data or reducing bias, where privacy is not an issue. However, where privacy is an issue, an extra rewind step is added to make SCRUB+R:

A dataset with a similar distribution to the data to be forgotten is constructed, and the loss (difference between the outputted value and correct output) is calculated. The NN is regularly saved during the SCRUB process, and then reverted to the checkpoint where the loss it gave for the actual forget set was closest to the loss for this constructed set.

3.2.3 Backpropagation Unlearning: Training Data Unavailable

The previously mentioned methods require the training data, or at least some of it, to be stored alongside the NN. However, there are backpropagation-powered unlearning methods that do not require this.

For example, for the data to be unlearned Cha et al. (2024)’s Instance-Wise Unlearning maximises the difference between the outputs and correct outputs by minimising its negation. The data to be retained is not available, but solely using the data to be forgotten like this would cause uncontrolled damage to the performance of the NN on data it is meant to remember. This is counteracted in two ways: Firstly, Cha et al. (2024) use an algorithm like MAS to work out which neuron weights are least influential on the output of the NN for the data to be forgotten, then penalise changes to these weights by increasing the value to be minimised when these weights are adjusted. Secondly, they generate adversarial examples from the model which mimic the data to be retained, and minimise the network’s error when given these examples.

Forsaken (Liu et al., 2021) minimises the KL divergence between the outputs given when the data to be unlearned is input, and when out-of-distribution data, say irrelevant differently-formatted data, is input. This ensures the data to be unlearned is forgotten but does not give anomalous outputs. To avoid unlearning overacting and damaging the NN’s general performance, a penalty (the $L_1$ norm regularisation item) is added (with a coefficient) to the KL divergence, and their sum is minimised. This prevents over-unlearning partially but not enough. Once again, just using the data to be unlearned is not sufficient. A very small subset of the data to be retained is kept so it can be used to monitor for catastrophic drops in accuracy and weight the regularisation item accordingly.

Another method specifically for unlearning classification classes is Normalizing Filtration as proposed by Baumhauer et al. (2022). However, it only modifies the final layer of weights before the outputs. It causes the mean of the output probabilities for each of the remaining classes to equal the mean output probability that used to be given for the deleted class. Otherwise, unnaturally low output values would be given which would imply belonging to the unlearned class and therefore allow model inversion attacks.

3.2.4 Unlearning through Further Training

These methods are very similar to the backpropagation unlearning approaches, but they are even more similar to typical training so I have classified them separately. Rather than optimising the outputs for unlearned data away from their correct value, or towards a value which suggests the absence of training data, they generate new input-output pairs on which they then train the network.

Tarun et al. (2024)’s Error-Maximising Noise approach has the ability to remove whole classes of data from a classification NN based on their output classification. Like the previous algorithms, it uses an optimisation algorithm to make the classification probabilities output by the network be as far as possible from the class to be forgotten. However, it does this by generating an input that produces this result, not by directly changing weights and biases, then trains the network on this input. It also attempts to prevent unlearning damaging general performance, similarly to the previous methods. It minimises the norm, often the sum of changes to the weights and biases produced by the training, and finally retrains the network on a small subset of the data to be retained.

Two-Stage Model Unlearning (Kim & Woo, 2022) is a solution tailored to classification NNs. It trains the network to reclassify inputs to be unlearned to the classes sharing the least similarity with the correct classification class. This is quantified as being the class whose neuron outputs the least value, or least probability as being correct, on average when all the data to be unlearned which is from the correct class is inputted.

M. Chen et al. (2023)’s Boundary Unlearning is specifically for classification NNs, and is comprised of two algorithms. Both keep the current NN and train it further to misclassify the data to be forgotten. Firstly, in Boundary Shrink, each piece of input data to be unlearned is reclassified to its nearest but incorrect output label, then the network is trained or fine-tuned on this incorrect classification so it forgets the original correct one. Boundary Expanding is a faster algorithm which, rather than calculating nearest but incorrect labels, adds a new neuron to the output layer of the network and reclassifies the samples to be unlearned to the new class label of this neuron, before removing the neuron. Both were designed to have less of a detrimental effect on the general accuracy of the network than retraining on random misclassifications would, and to avoid the forgetting samples being made more obvious due to being reclassified randomly, problems backpropagation methods regularly encountered and attempted to fix in more complex ways.

Additionally, in foundation models fine-tuning (Church et al., 2021) can be used, where an NN is trained on more data designed to guide its outputs and cover up but not remove some of its knowledge: this can obscure whole concepts or groups of data without removing specific samples, and fulfils a similar purpose to unlearning but to a much lesser extent.

3.2.5 Unlearning Inputted and Inferred Features

All of the approaches so far have focused on unlearning a set of training data samples or output classes. This does form the majority of researched methods of machine unlearning. However, there is also potential for machine unlearning to remove biases (R. Chen et al., 2023), or to more generally remove irrelevant input data fields and inferred characteristics rather than whole datapoints.

Warnecke et al. (2023) provides unlearning for both Features and Labels. Its an unlearning method replaces rather than removing parts of input data samples (features) or output labels, when they are found in several input samples and the whole samples should not be removed themselves. Features can sometimes be revoked from the network by replacing them with zeros then removing the input neurons that correspond to the features. This is all realised through a reverse-backpropagation-like First-Order Update algorithm, or through the improved Second-Order Update, which works best on small networks but requires second-derivative calculations which do not scale well in time and space complexity: approximation must be used when there are many weights and biases.

Guo et al. (2022)’s Attribute Unlearning aims to remove attributes that are not directly present as datapoints in the input data, but instead are inferred. This includes causes of bias such as skin colour or a certain facial feature in an image. It requires the NN to be split in two: the first half will convert input data to a representation of the attributes, and the second half will convert this to the desired outputs, for example classification labels. An auxiliary NN is then used for unlearning, which optimises the intermediate attribute representations such that they do not contain the unlearned attributes.

4 Discussion

There are several factors which differ between exact and approximate unlearning approaches:

4.1 Factors to Consider

4.1.1 Effectiveness

The development of exact and approximate unlearning approaches provides hints for their future: exact methods were initially created as modifications of full retraining and thus unlearn completely, while most approximate methods have multiple parts, each of which aims to further prevent model inversion and membership inference attacks but never reaches theoretically perfect training data removal. Information to be forgotten regularly still remains in an approximately unlearned NN but not because it shows directly in the outputs; rather, its past presence can be deduced from malicious attacks and the effects of unlearning on the network.

4.1.2 Time

The most fundamental exact unlearning approach I mentioned, SISA, was up to 4.63 times faster than naive retraining for the datasets it was tested on (Bourtoule et al., 2021), whereas Chundawat et al. (2023)’s approximate Incompetent Teacher approach was 20 to 70 times faster than retraining in its paper’s tests. Although this is only two cases, the difference in magnitude makes the distinction anecdotally clear and mirrors time savings’ importance as motivation for the development of approximate unlearning (Nguyen et al., 2022).

4.1.3 Data Storage

Approximate unlearning decreases the amount of data that must be stored alongside the NN; exact unlearning requires all training data to be stored plus more information such as which sub-network was trained on it, which checkpoint it was in, and the weights of each checkpoint. This costs money and infrastructure. It could also be seen as a risk if the data is private or sensitive, but this argument has little validity: the need for unlearning implies the data can already be accessed from the network in some form.

4.1.4 Applicability

Some applications of approximate unlearning, such as removing biases through inferred characteristics, or removing whole concepts through fine-tuning, may have no exact unlearning solution. Despite this, for most purposes, there exist both exact and approximate unlearning approaches that theoretically could be used with any type of NN. For exact unlearning, the principle of time checkpoints is architecture agnostic. Network partitioning is also widely applicable to NN architectures, although it must be modified quite significantly to prevent performance degradation in architectures where links between data is important, as with GraphEraser, SRU and RecEraser. Importantly, these modifications regularly make the unlearning no longer exact. Approximate unlearning making use of an NN’s optimiser function such as backpropagation is similarly architecture agnostic, since any NN architecture has an optimiser function. However, other approximate unlearning approaches like Two-Stage Model Unlearning and Boundary Unlearning require an NN that outputs logits, probabilities for a set number of classifications.

4.2 Data to Remove

The factors previously listed have different levels of importance with different uses of unlearning:

4.2.1 Intellectual Property

This is primarily an issue in foundation models.

As copyrighted content can be most easily described as specific training samples, rather than wider concepts, exact unlearning makes more sense. Although it would have downsides in terms of time efficiency compared to approximate methods, exact unlearning still remains a good option, since copyrighted content only needs to be removed once, after which the unlicensed source can be removed from the training sources. Training data storage would increase costs for large neural networks like foundation models, suggesting approximate unlearning, although the size of foundation models means their owners likely already have a great availability of storage resources.

Both exact and approximate unlearning approaches are possible, but the decision of which to use would rely the most on law and ethics. The performance of foundation models may rely on them having enough training data, including copyrighted works, as OpenAI claimed when they stated “it would be impossible to train today’s leading AI models without using copyrighted materials” (OpenAI, 2024). If this is interpreted to be more important than the strength of creators’ intellectual rights over their works, pure recitation may be all that it is reasonable to prevent absolutely, using approximate unlearning.

Meanwhile, if a neural network with traces of copyrighted content were interpreted as a derivative of such content, and thus illegal piracy, rather than being a case of fair use, a legal distinction which is controversial and currently undecided (Alhadeff et al., 2024), exact unlearning could be used. However, more likely in this scenario is the preemptive removal of copyrighted content from training data, and its replacement with public domain or compliantly used open culture content, alongside retrieval-augmented generation to process and direct the user to relevant parts of other information.

4.2.2 Unsafe or Inappropriate Content

This would never be inputted on purpose to an NN where it is unwanted, so would only appear in the uncontrolled training data of a foundation model. Therefore, the same considerations in the first paragraph for intellectual property apply here.

Approximate fine-tuning by concept could also be used to prevent its accidental output even before the dangerous training samples are identified² ; meanwhile, exact unlearning algorithms could be used to remove identified examples of disinformation, information enabling crimes, or age-restricted content. It could be argued, however, that unlearning effectiveness is less important here than with personal information, since the user could always gain such information from the original source on the World Wide Web or Dark Web: approximate unlearning may be enough.

4.2.3 Personal Information

This could be stored in both foundation models which have consumed “doxxing” pages from the Internet, and in conventional classifier networks used for example with medical or facial recognition images which allow the identification of their subject (Veale et al., 2018, p. 6).

As I have mentioned, personally identifiable information is legally protected and consent to store it may be withdrawn after it has been given; it is also often ethically sensitive. The nature of personal information being in specific training data samples suits the use of exact unlearning. However, the potential regularity of withdrawal requests after previous consent may make approximate unlearning more practical. Compared to foundation models with intellectual property, the purposes of healthcare models that consume personal data are generally seen as more ethically positive and potentially life-saving; this may make more risk of incomplete unlearning acceptable. It could make approximate unlearning a valid response when personal data can be extracted, rather than banning this type of neural network without anonymised inputs or severely limiting its knowledge.

In foundation models, fine-tuning could once again be used as a preliminary measure (Charfeddine et al., 2024). However, as foundation models like the in-production ChatGPT can have their fine-tuned moderation practically removed by carefully chosen prompts(Charfeddine et al., 2024), this would not be robust against malicious use. For foundation models exact unlearning is the best approach for specific examples of personal data.

4.2.4 Removing Biases

Bias removal is the removal of inferred characteristics or input features rather than training datapoints; as explained earlier, this requires approximate unlearning. However, for a system inclusive of human diversity, hate speech which is often prejudicial should also be removed, which is potentially more important since it would have less of a potential negative impact on performance.

5 Conclusion

Exact unlearning would be the ideal approach wherever data samples to be removed can be identified specifically, such as with intellectual property, unsafe content and personal information, both in foundation models and other neural networks. However, in order to ensure the greatest potential of such networks, approximate unlearning that is deliberately incomplete may be better, with uses of personal information for life-saving healthcare networks, and potentially with uses of foundation models for generation, although the latter is more debatable. Approximate unlearning may also be necessary if there are insufficient resources for time and space, especially with fast and frequent removal requests such as those created by the GDPR. Approximate unlearning could also be used without tradeoffs alongside other unlearning, to remove concepts from all these categories from a foundation model’s outputs preemptively, and must be used when removing biases.

Finally, one should remember that unlearning is not always the best solution, and that initial training data inspection may be more suitable. Without data inspection, before unlearning, either exact or approximate, the unwanted data can be extracted through model inversion or membership inference attacks, and if the NN’s weights are publicly available (“Llama 3.2 Community License Agreement”, n.d., for example), this will still be possible eternally for anyone with the network. One could also claim that the unlearning of intellectual property is a superficial attempt to reduce the deeper problem or necessity of foundation models being trained on copyrighted data without permission (OpenAI, 2024). Nonetheless, unlearning still retains utility. Uses of machine unlearning where initial training data inspection would not help include data withdrawal after previous consent in private face recognition systems, and removing inferred biases from training data that could not practically be representative.

References

Alhadeff, J., Cuene, C., & Del Real, M. (2024). Limits of Algorithmic Fair Use. Washington Journal of Law, Technology & Arts, 19, 1. https://heinonline.org/HOL/Page?handle=hein.journals/washjolta19&id=1&div=&collection=

Baumhauer, T., Schöttle, P., & Zeppelzauer, M. (2022). Machine unlearning: Linear filtration for logit-based classifiers. Machine Learning, 111(9), 3203–3226. https://doi.org/10.1007/s10994-022-06178-9

Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., & Papernot, N. (2021). Machine Unlearning. 2021 IEEE Symposium on Security and Privacy (SP), 141–159. https://doi.org/10.1109/SP40001.2021.00019

Carvalho, T., Moniz, N., Faria, P., & Antunes, L. (2022, January 13). Towards a Data Privacy-Predictive Performance Trade-off. arXiv: 2201.05226 [cs]. Retrieved November 17, 2024, from http://arxiv.org/abs/2201.05226

Cha, S., Cho, S., Hwang, D., Lee, H., Moon, T., & Lee, M. (2024). Learning to Unlearn: Instance-Wise Unlearning for Pre-trained Classifiers. Proceedings of the AAAI Conference on Artificial Intelligence, 38(10), 11186–11194. https://doi.org/10.1609/aaai.v38i10.28996

Charfeddine, M., Kammoun, H. M., Hamdaoui, B., & Guizani, M. (2024). ChatGPT’s Security Risks and Benefits: Offensive and Defensive Use-Cases, Mitigation Measures, and Future Implications. IEEE Access, 12, 30263–30310. https://doi.org/10.1109/ACCESS.2024.3367792

Chen, C., Sun, F., Zhang, M., & Ding, B. (2022). Recommendation Unlearning. Proceedings of the ACM Web Conference 2022, 2768–2777. https://doi.org/10.1145/3485447.3511997

Chen, M., Gao, W., Liu, G., Peng, K., & Wang, C. (2023). Boundary Unlearning: Rapid Forgetting of Deep Networks via Shifting the Decision Boundary. 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 7766–7775. https://doi.org/10.1109/CVPR52729.2023.00750

Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2022). Graph Unlearning. Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 499–513. https://doi.org/10.1145/3548606.3559352

Chen, R., Yang, J., Xiong, H., Bai, J., Hu, T., Hao, J., Feng, Y., Zhou, J. T., Wu, J., & Liu, Z. (2023). Fast Model DeBias with Machine Unlearning. Advances in Neural Information Processing Systems, 36, 14516–14539. Retrieved July 18, 2024, from https://proceedings.neurips.cc/paper_files/paper/2023/hash/2ecc80084c96cc25b11b0ab995c25f47-Abstract-Conference.html

Chien, A. A., Lin, L., Nguyen, H., Rao, V., Sharma, T., & Wijayawardana, R. (2023). Reducing the Carbon Impact of Generative AI Inference (today and in 2035). Proceedings of the 2nd Workshop on Sustainable Computer Systems, 1–7. https://doi.org/10.1145/3604930.3605705

Chundawat, V. S., Tarun, A. K., Mandal, M., & Kankanhalli, M. (2023). Can Bad Teaching Induce Forgetting? Unlearning in Deep Networks Using an Incompetent Teacher. Proceedings of the AAAI Conference on Artificial Intelligence, 37(6), 7210–7217. https://doi.org/10.1609/aaai.v37i6.25879

Church, K. W., Chen, Z., & Ma, Y. (2021). Emerging trends: A gentle introduction to fine-tuning. Natural Language Engineering, 27(6), 763–778. https://doi.org/10.1017/S1351324921000322

Duarte, V., Zuniga-Jara, S., & Contreras, S. (2022). Machine Learning and Marketing: A Systematic Literature Review. IEEE Access, 10, 93273–93288. https://doi.org/10.1109/ACCESS.2022.3202896

Eldan, R., & Russinovich, M. (2023, October 4). Who’s Harry Potter? Approximate Unlearning in LLMs. arXiv: 2310.02238 [cs]. https://doi.org/10.48550/arXiv.2310.02238

European Commission. (n.d.). What is personal data? - European Commission. Retrieved July 26, 2024, from https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en

Gharibshah, Z., Zhu, X., Hainline, A., & Conway, M. (2020). Deep Learning for User Interest and Response Prediction in Online Display Advertising. Data Science and Engineering, 5(1), 12–26. https://doi.org/10.1007/s41019-019-00115-y

Graves, L., Nagisetty, V., & Ganesh, V. (2021). Amnesiac Machine Learning. Proceedings of the AAAI Conference on Artificial Intelligence, 35(13), 11516–11524. https://doi.org/10.1609/aaai.v35i13.17371

Guo, T., Guo, S., Zhang, J., Xu, W., & Wang, J. (2022, April 16). Efficient Attribute Unlearning: Towards Selective Removal of Input Attributes from Feature Representations. arXiv: 2202.13295 [cs]. Retrieved August 10, 2024, from http://arxiv.org/abs/2202.13295

Gupta, P., Ding, B., Guan, C., & Ding, D. (2024). Generative AI: A systematic review using topic modelling techniques. Data and Information Management, 8(2), 100066. https://doi.org/10.1016/j.dim.2024.100066

He, Y., Meng, G., Chen, K., He, J., & Hu, X. (2021, May 13). DeepObliviate: A Powerful Charm for Erasing Data Residual Memory in Deep Neural Networks. arXiv: 2105.06209 [cs]. Retrieved August 9, 2024, from http://arxiv.org/abs/2105.06209

Kim, J., & Woo, S. S. (2022). Efficient Two-stage Model Retraining for Machine Unlearning. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 4360–4368. https://doi.org/10.1109/CVPRW56347.2022.00482

Kumari, J., Kumar, E., & Kumar, D. (2023). A Structured Analysis to study the Role of Machine Learning and Deep Learning in The Healthcare Sector with Big Data Analytics. Archives of Computational Methods in Engineering, 30(6), 3673–3701. https://doi.org/10.1007/s11831-023-09915-y

Kurmanji, M., Triantafillou, P., Hayes, J., & Triantafillou, E. (2023). Towards Unbounded Machine Unlearning. Advances in Neural Information Processing Systems, 36, 1957–1987. Retrieved August 9, 2024, from https://proceedings.neurips.cc/paper_files/paper/2023/hash/062d711fb777322e2152435459e6e9d9-Abstract-Conference.html

Liu, Y., Ma, Z., Liu, X., Liu, J., Jiang, Z., Ma, J., Yu, P., & Ren, K. (2021, August 2). Learn to Forget: Machine Unlearning via Neuron Masking. arXiv: 2003.10933 [cs, stat]. Retrieved July 18, 2024, from http://arxiv.org/abs/2003.10933

Llama 3.2 Community License Agreement. (n.d.). Llama. Retrieved November 17, 2024, from https://www.llama.com/llama3_2/license/

Miotto, R., Wang, F., Wang, S., Jiang, X., & Dudley, J. T. (2018). Deep learning for healthcare: Review, opportunities and challenges. Briefings in Bioinformatics, 19(6), 1236–1246. https://doi.org/10.1093/bib/bbx044

Nguyen, T. T., Huynh, T. T., Nguyen, P. L., Liew, A. W.-C., Yin, H., & Nguyen, Q. V. H. (2022, October 21). A Survey of Machine Unlearning. arXiv: 2209.02299 [cs]. https://doi.org/10.48550/arXiv.2209.02299

OpenAI. (2024, February 2). House of Lords Communications and Digital Select Committee inquiry: Large language models. Committees - UK Parliament. Retrieved December 9, 2024, from https://committees.parliament.uk/writtenevidence/126981/pdf/

Sanderson, G. (typedirector). (2017, November 3). Backpropagation calculus — Chapter 4, Deep learning [Video]. Retrieved April 18, 2024, from https://www.youtube.com/watch?v=tIeHLnjs5U8

Sarker, I. H. (2021). Deep Learning: A Comprehensive Overview on Techniques, Taxonomy, Applications and Research Directions. SN Computer Science, 2(6), 420. https://doi.org/10.1007/s42979-021-00815-1

Schneider, J., Meske, C., & Kuss, P. (2024). Foundation Models. Business & Information Systems Engineering, 66(2), 221–231. https://doi.org/10.1007/s12599-024-00851-0

Smys, S., Chen, J. I. Z., & Shakya, S. (2020). Survey on Neural Network Architectures with Deep Learning. Journal of Soft Computing Paradigm, 2(3), 186–194. https://doi.org/10.36548/jscp.2020.3.007

Tarun, A. K., Chundawat, V. S., Mandal, M., & Kankanhalli, M. (2024). Fast Yet Effective Machine Unlearning. IEEE Transactions on Neural Networks and Learning Systems, 1–10. https://doi.org/10.1109/TNNLS.2023.3266233

Veale, M., Binns, R., & Edwards, L. (2018). Algorithms that remember: Model inversion attacks and data protection law. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 376(2133), 20180083. https://doi.org/10.1098/rsta.2018.0083

Wang, W., Tian, Z., & Yu, S. (2024, May 12). Machine Unlearning: A Comprehensive Survey. arXiv: 2405.07406 [cs]. Retrieved July 24, 2024, from http://arxiv.org/abs/2405.07406

Warnecke, A., Pirch, L., Wressnegger, C., & Rieck, K. (2023, August 7). Machine Unlearning of Features and Labels. arXiv: 2108.11577 [cs]. Retrieved July 26, 2024, from http://arxiv.org/abs/2108.11577

Wu, Y., Dobriban, E., & Davidson, S. (2020). DeltaGrad: Rapid retraining of machine learning models. Proceedings of the 37th International Conference on Machine Learning, 10355–10366. Retrieved August 9, 2024, from https://proceedings.mlr.press/v119/wu20b.html

Wu, Y., Zhou, S., Yang, M., Wang, L., Zhu, W., Chang, H., Zhou, X., & Yang, X. (2024, May 24). Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradient. arXiv: 2405.15304 [cs]. Retrieved July 26, 2024, from http://arxiv.org/abs/2405.15304

Xin, X., Yang, L., Zhao, Z., Ren, P., Chen, Z., Ma, J., & Ren, Z. (2024). On the Effectiveness of Unlearning in Session-Based Recommendation. Proceedings of the 17th ACM International Conference on Web Search and Data Mining, 855–863. https://doi.org/10.1145/3616855.3635823