Debiasing Machine Unlearning with Counterfactual Examples
Ziheng Chen Jia Wang Jun Zhuang Abbavaram Gowtham Reddy Fabrizio Silvestri Jin Huang Kaushiki Nag Kun Kuang Xin Ning Gabriele Tolomei










Z. Chen et al.



Applied Mathematics and Statistics Department, Stony Brook University The Xi’an Jiaotong-Liverpool University Walmart Global Tech Computer Science Department, Boise State University Indian Institute of Technology Hyderabad Sapienza University of Rome, Italy Zhejiang University Institute of semiconductors, Chinese Academy of Sciences


Debiasing Machine Unlearning with Counterfactual ExamplesSupported by organization x.
    Ziheng Chen1,3 Jia Wang2 Jun Zhuang4 Abbavaram Gowtham Reddy5 Fabrizio Silvestri6 Jin Huang1 Kaushiki Nag3 Kun Kuang7 Xin Ning8 Gabriele Tolomei6
    April 29, 2024
=====================================================================================================================================================




 The right to be forgotten (RTBF) seeks to safeguard individuals from the enduring effects of their historical actions by implementing machine-learning techniques. These techniques facilitate the deletion of previously acquired knowledge without requiring extensive model retraining. However, they often overlook a critical issue: unlearning processes bias. This bias emerges from two main sources: (1) data-level bias, characterized by uneven data removal, and (2) algorithm-level bias, which leads to the contamination of the remaining dataset, thereby degrading model accuracy. In this work, we analyze the causal factors behind the unlearning process and mitigate biases at both data and algorithmic levels. Typically, we introduce an intervention-based approach, where knowledge to forget is erased with a debiased dataset. Besides, we guide the forgetting procedure by leveraging counterfactual examples, as they maintain semantic data consistency without hurting performance on the remaining dataset. Experimental results demonstrate that our method outperforms existing machine unlearning baselines on evaluation metrics.






§ INTRODUCTION



The rise of data protection regulations, notably the “right to be forgotten,” has spurred the need for technologies to selectively erase knowledge acquired while training machine learning/artificial intelligence (ML/AI) models without requiring full retraining. These regulations empower individuals to request personal data removal from ML/AI systems, ensuring privacy compliance. In response, machine unlearning techniques have become vital for efficiently discarding specific model knowledge and addressing data privacy and compliance requirements.

However, the development of machine unlearning methods has overlooked a fundamental challenge: the potential introduction of bias stemming from non-uniform data removal during the unlearning process <cit.>. Moreover, recent methods <cit.> aim to increase error for forgotten data points, potentially assigning them to semantically inconsistent class or even random class <cit.>. Such methods can contaminate the remaining data, resulting in the creation of bias and performance degradation <cit.>.





To mitigate bias during the unlearning process, we examined the impact of retraining an unbiased model without including the samples to be forgotten. Our analysis revealed that such retraining can lead to misclassifying forgotten examples into semantically related categories. Specifically, in the CIFAR-100 dataset, forgetting instances of the “rabbit” class resulted in approximately 82% of those samples being incorrectly classified as either the “hamster”, “mouse”, or “squirrel” classes (37%, 26%,  and 19% respectively), which are closely related felines. Among these images, 73% are classified into the same class as their counterfactual examples (CFs) generated by Semantic Consistent Visual <cit.>. 
A counterfactual example for a given instance is generated by applying the minimal perturbation to the input that alters the prediction, causing the resulting modified sample to cross the decision boundary induced by the model.
CFs have been successfully used to attach post-hoc explanations for predictions in the form: “If A had been different, B would not have occurred” <cit.>.

The finding above inspires us to guide the model to forget. We leverage CFs as pivotal points to encompass forgotten samples into semantically similar classes. As illustrated in Figure 1, our approach aims to make forgotten samples and their counterfactuals (CFs) indistinguishable by the model, effectively broadening the local decision boundary. This strategy minimizes the impact of forgetting on the adjacent remaining samples.

In this work, we adopt a causal perspective <cit.> to examine bias during the unlearning process and address data-level bias through causal intervention. Subsequently, we investigate algorithmic bias and employ counterfactual examples as a mitigation strategy. Our main contributions are summarized as follows:

(i) We propose a causal framework to formulate the machine unlearning procedure and analyze the potential source of bias induced (Section <ref>). 

(ii) We introduce an intervention-based approach to alleviate bias-induced impacts on remembering caused by selective sample deletion during unlearning (Section <ref>). 

(iii) We guide the forgetting procedure leveraging counterfactual examples, as they maintain semantic data consistency without hurting remaining samples (Section <ref>). 

(iv) We validate our approach in both uniform and non-uniform deletion setups (Section <ref>).




§ RELATED WORK



Machine Unlearning.
To ensure security and data privacy, it's vital to enable dataset or model modifications without retraining, termed machine unlearning. Most existing works can be categorized into model-agnostic approaches, model-intrinsic approaches, and data-based approaches <cit.>. Model-agnostic approaches involves statistical query learning <cit.>, decremental learning <cit.>, and knowledge adaptation <cit.>. Meanwhile, model-intrinsic approaches include unlearning methods designed for specific types of models. Conversely, data-based approaches encompass strategies such as data augmentation <cit.>, and data impact <cit.>. Our method improves upon existing machine unlearning techniques by addressing the bias issue inherent in the unlearning process.

Bias in Machine Unlearning. Bias is a common issue in ML/AI models as the model may output unfair results given that the model is trained with a biased dataset. This problem has been widely studied in recent years <cit.>. Most existing studies aim to address the bias issue at the group level <cit.> and the individual level <cit.>.
To address the bias issue in machine unlearning, Zhang et al. first evaluate machine unlearning methods to assess the de-bias implications <cit.>. Oesterling et al. propose a new machine unlearning method to eliminate group bias <cit.>. Our method introduces a novel approach by utilizing counterfactual examples to guide the debiasing procedure, thereby ensuring semantic data consistency to effectively mitigate bias. This innovation leads to a more robust solution to the challenges encountered in machine unlearning.

Counterfactual Explanations.
Counterfactual Examples offer post-hoc explanations for predictions through statements like "If A had been different, B would not have occurred", known as counterfactual explanations. These explanations have been applied in various domains, including natural language understanding <cit.>, data augmentation <cit.>, and medical applications <cit.>. Methods for generating counterfactual explanations can be categorized into model-specific approaches, which tailor machine learning models <cit.>, and model-agnostic approaches, which can provide explanations for different models <cit.>.




§ PROBLEM FORMULATION



Let ⊆^n be an input feature space and  an output label space. Without loss of generality, we consider the K-ary classification setting, i.e., = {0, …, K-1}. The training set can be represented as 𝒟=⋃_i∈{0, …, K-1}𝒟_i where 𝒟_i contains data points corresponding to class i.  We introduce a predictive model : ↦, with parameters , trained on the entire dataset 𝒟 by minimizing the loss function ℒ_(X_i,Y_i) ∈𝒟((X_i),Y_i). We refer to  as the “original model,” which maps input feature vectors X ∈ to predictive labels (X) = Ŷ∈.


In this work, we focus on the problem of deep machine unlearning for classification. This task involves selectively removing specific instances or knowledge from a trained model without retraining the entire model. We denote the set of samples to forget as 𝒟_f ⊂𝒟. 
The set of samples to be retained is denoted as , with the assumption that 𝒟_f is the complement of , i.e., 𝒟_f ∪ = 𝒟 and 𝒟_f∩𝒟_r = ∅. The goal of machine unlearning is to obtain a new model  that removes the information contained in 𝒟_f from  without negatively impacting its performance on . Given the time-consuming nature of fully retraining the model on  to obtain an expected model , our target is to approximate  by evolving  using 𝒟_f as follows:



    ≃





§ STRUCTURAL CAUSAL MODELING FOR CLASSIFICATION






To understand the emergence of bias during unlearning, we start by formulating a Structural Causal Model (SCM)  <cit.>, which captures the underlying causal generative processes of the original model  as depicted in Fig. <ref> <cit.>. Generally, we categorize the latent factors responsible for generating real-world examples X into two groups: background variables V (e.g., image background, style, etc.), controlled by a domain variable B, and causal factors 𝒵=⋃_i=0^K-1 Z_i. Each Z_i corresponds to a specific class Y_i (e.g., Z_i represents the causal factor for rabbits).
Importantly, these causal factors 𝒵 can be grouped into m underlying class-level concepts 𝒰=⋃_j=1^m U_j, and each Z_i has only one class-level concept as its parent: Pa_Z_i=U_j | U_j→ Z_i. For example, both Z_i representing rabbits and Z_j representing mice can be traced back to the common class-level concept root U_j=Pa_Z_j=Pa_Z_i for rodents. Due to similarities within the same class-level concept, the data can be seen as a mixture of causal factors within the same group, interacting with the background variable V (e.g., some rabbit images closely resemble other rodents like mice and squirrels). Formally, for any data point (X_i, Y_i)∈𝒟, the generative model for data X_i can be expressed as follows:


    𝒰∼ P_U,   B ∼ P_B,   Z_i=f_i(Pa_Z_i,B),


    X=g(Z_i, 𝒵_-i, V),   Y_i=l(Z_i),

where 𝒵_-i={ Z_j | Pa_Z_j = Pa_Z_i j≠ i } denotes all the causal factors that share the same parent with Z_i.




 §.§ The Emerging of Bias during Unlearning

Let  be the SCM of an underlying causal model. The presence of confounding variables [We claim that X and Y are confounded some other confounding variable Z whenever Z causally influences both X and Y.] 𝒰 and B poses a risk of amplifying the following bias through spurious causal correlations during the unlearning procedure.



  * Data-level shortcut bias <cit.> via backdoor Z_i ← B → V → X →Ŷ_̂î. The selection of 𝒟_f can lead to a distribution mismatch in the background variable V between 𝒟_r and 𝒟, which may guide  to solely capture the non-invariant spurious correlation between Y_i and V.

Illustrative example: Suppose the original dataset contains images of various animals in different environments, including rabbits against diverse backdrops. After the unlearning process, if the remaining dataset becomes biased towards rabbit instances in a specific background (e.g., grass), the unlearning model may incorrectly infer a spurious correlation between the presence of the grass background and the absence of the rabbit, leading to biased model updates.




  * Data-level label bias <cit.> via backdoor Z_i ← Pa_Z_i→ Z_j → X →Ŷ_̂î. Once there exists a dominating class in ,  tends to enhance the spurious correlation between other images and the majority class.

Illustrative example:
Assume that the dataset comprises an equal number of images for various species like rabbits, mice, and squirrels, representing the biodiversity accurately. Here, we consider the scenario where the unlearning process focuses excessively on eliminating images of squirrels due to certain biases or errors. As a consequence, the remaining dataset might become skewed, with fewer squirrel images compared to rabbits and mice. Consequently, the model updates during unlearning may inadvertently amplify the correlations between the remaining images and the prevalent categories.





  * Algorithmic bias <cit.> is raised by unlearning algorithms targeting on increasing the classification error on  <cit.>. We will elaborate on this in section <ref>.


We now propose a method to address the above biases in machine unlearning.



§ PROPOSED METHOD


In this section, we introduce a teacher-student framework for unlearning. As shown in Fig <ref>, we adopt the original model  as the “teacher”, and our primary objective is to train a “student”  capable of selectively adhering to the teacher's guidance on  (remember)  while deliberately deviating on  (forget). To address potential bias that may arise during this process, we incorporate causal interventions as a means of bias mitigation. 









 §.§ Erasing Data-level Bias in Remembering


We start by guiding the student  to obey the performance of teacher  on  and initialize the parameters of  with the parameters of . Meanwhile, to erase the data-level bias, we decouple the spurious causal correlation by directly intervening on causal factors. Specifically, for a sample X_i from class Y_i,  we adopt P(Ŷ|do(Z_i)) rather than P(Ŷ|X_i) for prediction. This approach, according to do-calculus, cuts off the path V ← B → Z_i and Z_j ← Pa_Z_i→ Z_i, effectively mitigating both shortcut and label bias simultaneously. Formally, P(Ŷ|do(Z_i)) can be expressed as:

    P(Ŷ|Z_i,B, U)    = ∑_vP(V|B,Z_i)∑_𝒵_-iP(Ŷ|Z_i,V,𝒵_-i)P(𝒵_-i|U, Z_i) 
    
    P(Ŷ|do(Z_i),B,U)    = ∑_vP(V=v|B)∑_z_-iP(Ŷ|z_i,v,z_-i)P(𝒵_-i=z_-i|U)
       ≈ P(Ŷ|z_i,∑_vP(v|B)v,∑_z_-iP(z_-i|U)z_-i)



In the last step, we adopt the Normalized Weighted Geometric
Mean (NWGM) approximation <cit.> to move the outer sampling over V and 𝒵_-i into the feature level. 
Driven by the observation that loss gradients from robust models exhibit better alignment with salient data features and human perception, which well outlines the contour of an object
in images <cit.>, we use the magnitude of gradients to extract V and Z_i. Following <cit.>, given an instance X_i with label Y_i, we obtain a mask M, to separate V from Z_i as follows:

    δ=∇((X_i), Y_i),   M=I(δ≤ d)    v=M⊙ X_i,    z_i=(1-M)⊙ X_i,
 where d serves as the threshold and we select the value that excludes 50% features for v as d in all experiments.
Notice that, for tabular data, we also include sensitive attributes (e.g., age, gender) into V. 
For P(v|B) and P(z_-i|U), to avoid dependence of D_r, we assume they follow the uniform distribution. Hence, we have
P(Ŷ|do(Z_i),B,U)  ≈ P(Ŷ|z_i+v̅+γ*z̅_-i). 
Where v̅ and z̅_-i could be obtained via random sampling and averaging. Notice that z̅_-i could only be sampled within an image generated by causal concept Pa_Z_i.
Besides, we set γ to 0.2 for all experiments to ensure the intervention doesn't adversely affect the instance.

Finally,  we train  to unbiasedly maintain the performance of    on D_r  by minimizing the interventional distribution as follows:

    _r=∑_(X_i,Y_i)∈KL(P_(Ŷ|do(Z_i),B,U),P_(Ŷ|do(Z_i),B,U))




 §.§ Erasing Algorithm-level Bias in Forgetting




  §.§.§  Analyzing the causal reasons for algorithm-level bias.

To erase information contained in , existing methods <cit.> typically focus on increasing the classification error on the subset . This involves deliberately assigning incorrect labels to forget samples (X_j, Y_j)∈ <cit.>. However, this strategy poses a potential risk of affecting the performance of  on , as it introduces spurious correlations and undermines the causal relationships learned by . For instance, instructing  to forget rabbit images by misclassifying them as eagles might compel it to rely on shortcut features shared between rodents and birds images, despite their significant differences. This is illustrated in Fig.  <ref> (across confounder), where assigning incorrect labels (Y^'_j) from disparate class-level concepts (U^'_j ≠ U_j) to forget examples (Y_j) can create new confounder pairs (Z_j ↔ U^'_j ↔ Z_2). 

Based on this insight, assigning X_j with a label of a similar class concept is critical, as demonstrated in Fig. <ref> (within confounder). In line with the example above, a strategy for  to “forget” rabbits might involve classifying them as mice, thus emphasizing common rodent features and ignoring rabbit-specific characteristics.




  §.§.§ Debias through counterfactual examples.

To mitigate algorithmic bias, we employ counterfactual examples (CFs) that maintain semantic consistency while reversing the prediction. These CFs act as anchors, enabling the integration of forgotten samples into classes within the same class-level concept.



In explainable machine learning, the focus has been on generating CFs that shift to a different class with minimal changes to causal features. Generally, given an instance X_j its optimal CF is defined as X_j^cf = X_j + δ^* and can be found  by solving the following constrained objective:

    δ^* = _δ∈ Z_j(X_j, X_j + δ)
    subject to:  (X_j)≠()


Here δ represents the optimal action guiding , and the magnitude function M discourages  from being too far away from _j.
Crucially, the condition δ∈ Z_j guarantees that  is formulated by merely altering causal-relevant features and maintaining the remains. To achieve this, we adopt the following algorithms for different types of forgotten data:



  * Headtails <cit.>: 
 For image data, the CF of one sample is generated by only replacing the semantically matching image regions from multiple distractor images sharing the same class-level concept. To flip the label with minimal alteration, the method involves segmenting images into distinct cells and identifying the most discriminative section for replacement.

  * C-CHVAE <cit.>: For tabular data, it adopts a variational autoencoder as a search device to find CFs that are proximate and connected to the input data. Hence, the CFs will be classified into another 
semantically similar category relative to the input data.




  §.§.§ Unbiased Forgetting by Distribution Alignment


With , we aim at guiding  to forget the distinct features of X_j and treat it as the same class as . Naturally, we minimize the KL divergence to align the interventional distribution of X_j closely with that of :

    _f=∑_(X_j,Y_j)∈KL(P_(Ŷ|do(Z_j+δ),B,U),P_(Ŷ|do(Z_j),B,U))






  §.§.§ Unbiased Forgetting by Contrastive Learning
  
Although minimizing Loss <ref> may potentially lead the model  to treat the forget sample and its CFs indistinguishably, it does not guarantee their geometric proximity within the representation space. Inspired by <cit.>, our goal is to reduce the distance between X_j ∈ and , thereby allowing the decision boundary to expand slightly to encompass X_j.  From this intuition, we aim to contrast each forget sample with 1) the corresponding counterfactual example (positive pairs) to pull their representations closer, and 2) remaining samples from distinct classes (negative pairs) and push their representation apart. 

Concretely, we denote the negative sample set as N(X_j)={X^-_k|X^-_k ∈, (X^-_k) ≠(X_j)}. For simplicity, the representation of X_j,  and X^-_k learned by  could be denoted as ξ_j, ξ_j^cf and ξ_k^- respectively.

The contrastive boundary loss aims to maximize the similarity of positive pairs and minimize the similarity of negative pairs as follows:

    _f^CB=∑_X_j ∈-1/|N(X_j)|(ξ_j ·ξ_j^cf/τ)/(ξ_j ·ξ_j^cf/τ)+∑_X_k^-∈ N(X_j)(ξ_j ·ξ_k^-/τ),

where τ is a temperature parameter. In this part, our analysis demonstrates that optimizing _f^CB exerts a small impact on . This conclusion is supported by an analysis of the gradient. 


As shown in the Supplementary, the gradient for ^CB_f with respect to the embedding ξ_k^- has the following form:

    ∇_ξ_k^-^CB_f = (ξ_j ·ξ_k^-/τ)/M·ξ_j/τ,


 M=(ξ_j ·ξ_j^cf/τ)+∑_X^-_k ∈ N(X_j)(ξ_j ·ξ_k^-)/τ).


The proposition shows that the gradient aligns with the direction of ξ_j, and the magnitude of ∇_ξ_k^-^CB_f is contingent on the similarity between ξ_j and ξ_k^-. According to <cit.>, 
the model optimized with cross-entropy loss produces lower geometric similarity among embeddings of samples from different classes. This implies that the product of ξ_j ξ̇_k^- is expected to be minimal. Thus, it is plausible to conclude that updating   via the optimization of ^CB does not significantly affect .



 §.§ Overall Training for Unlearning 

Finally, we get the unlearning model  by minimizing the ℒ:

    ℒ=_r+α_f+β_f^CB+γ∑_(X_i, Y_i)∈ℓ(X_i,Y_i),

where ℓ stands for the cross-entropy loss, and we denote α, β and γ as balanced hyper-parameters.



§ EXPERIMENTS


To evaluate the effectiveness  of our proposed model in addressing the following research questions, we designed a series of experiments:

    
  * Q1: How does the overall performance of our method compare with existing unlearning algorithms under a uniform deletion strategy?
    
  * Q2: How does our algorithm perform under a non-uniform deletion strategy? Moreover, does it mitigate shortcut and label biases in scenarios of selective forgetting?
    
  * Q3: How to determine the contribution of each loss function component to the overall model performance?





 §.§ Experimental Setup


In this section, we present our experimental findings. Initially, we assess the accuracy and efficiency of our method under random data deletion. Then, following <cit.>, we explore the impact of non-uniform data deletion on bias reduction.

Datasets and Models
Our proposed method is evaluated across diverse datasets, including CIFAR-100 <cit.> and CUB200 <cit.> for image classification, and Adult <cit.> and German <cit.> datasets for tabular data classification <cit.>. CIFAR-100 utilizes provided super-classes (e.g., small mammals: rabbits, mice, squirrels) while CUB-200 classes are clustered into 10 concepts based on a confusion matrix, merging frequently confused subclasses into unified super-class. Given that both tabular datasets have binary labels, we didn't consider their class-level concepts. We adopt ResNet18 and ResNet34 architectures for image classification tasks, consistent with prior work <cit.>. For tabular data unlearning, we utilized a 3-layer DNN model <cit.>.


Evaluation Measures 

     
  * Remaining Accuracy (RA) on  <cit.>: This denotes the accuracy of  on , reflecting the fidelity of .
     
  * Forgetting Accuracy (FA) on  <cit.>: This denotes the accuracy of  on , reflecting the ability of  in full class deletion.
     
  * Membership Inference Attack (MIA) on  <cit.>: MIA estimates the number of samples in  correctly predicted as forgotten by a confidence-based MIA predictor.
     
  * Run-Time Efficiency (RTE) <cit.>: RTE quantifies the run-time cost of the proposed algorithm. 
     
  * Disparate Impact (DI) <cit.>: DI measures the ratio of favorable outcomes for the unprivileged group (x=0) to the privileged group (x=1): =P(ŷ=1|x=0)/P(ŷ=1|x=1). 
      
  * Equal opportunity difference(EOD)  <cit.>: EOD evaluates the difference in true positive rate between unprivileged group and privileged group.
      =P(ŷ=1|x=0,y=1)-P(ŷ=1|x=1,y=1)



Counterfactual Explanation Methods As described in Sec <ref>, we adopt Headtails for image data and C-CHVAE for tabular data to generate CFs respectively.

Hyperparameters 
We conduct an ablation study to determine the optimal value of hyperparameters by measuring its performance when β/α∈{0.1, 0.2, 0.6, 1.0} and γ/α∈{0.1, 0.2, 0.6, 1.0}. Finally, we determine the best combination for each task. For the ResNet18 and ResNet34, we use pretrained models. During the unlearning procedure, we run 5 epochs with a learning rate of 0.0001 for all datasets.

Baseline Models.
We adopt the unlearning method as follows: Badteacher (BT) <cit.>, Boundary-shift (BS) <cit.>, SISA <cit.>, 
PUMA <cit.>,
SCRUB <cit.>. These methods achieve unlearning in an already trained model without putting any constraints. F-unlearning <cit.> is an unbiased unlearning method designed for tabular data and we leverage it in non-uniform deletion.
Retrain refers to training from scratch on . In the case of non-uniform deletion, we retrain the model without bias.



 §.§ Overall Performance of Unlearning Model under a Uniform Deletion Strategy (Q1)






  §.§.§ Sample Deletion
 
We evaluate our method's performance under uniform-sample removal by progressively eliminating training data points at percentages of 20% and 40% on four datasets: CUB-200, CIFAR-100, Adult, and German. This evaluation aims to demonstrate performance preservation, data removal effectiveness, and efficiency, measured by RA, MIA, and RTE, respectively. Our method consistently outperforms or performs similarly to other methods, as depicted in Figure <ref>. Notably, our approach achieves an MIA of 0.07, compared to 0.13 for the Badteacher model and 0.11 for the SCRUB. Moreover, our method maintains strong performance even with a larger proportion of forgotten data. Specifically, RA outperforms BT by 8% and SCRUB by 5% when 40% of the data is removed. Although slower than Badteacher, which assigns forgetting data randomly, our method is 1.2 times faster than Boundary and 5.6 times faster than SISA.




  §.§.§ Class Deletion



we evaluate the unlearning model's effectiveness under full-class (single and multiple classes) deletion. Specifically, we randomly selected either 1 or 20 classes and removed all associated samples, repeating this process five times for reliable results. The experiments were conducted using CIFAR100 and CUB200 datasets with ResNet18 and ResNet34 architectures, updating the model for one epoch at a learning rate of 0.001. Our objective was to diminish the model's accuracy for the removed ("forget") classes while maintaining accuracy for the remaining ("remain") classes. One can see from Tab. <ref> that the retrained model shows the ground-truth accuracy on  and zero for  due to the classes' complete removal.  Notably, while the SCRUB method showed decent performance in single class deletions, it struggled in scenarios involving multiple class deletions, securing only 74.9% accuracy for "remain" and 6.3% for "forget", attributed to its random class assignment for forgotten samples. Our methodology surpasses all compared baselines in accuracy metrics, benefiting from a debiased unlearning approach that ensures robust performance across both single and multiple-class deletions. Specifically, our technique exceeds SCRUB by 3% in RA and 13% in FA in the CIFAR-100 scenario with 20 classes removed.




 §.§ Evaluate Model Resilience to Unlearning Bias under a Non-uniform Deletion Strategy(Q2)



  §.§.§ Selective Class Deletion

We evaluate the performance of unlearning models in scenarios where data is selectively forgotten, leading to label bias. We simulate imbalanced datasets by removing 20%, 40%, 60%, and 80% of samples from specific classes—namely, "Rabbit" in CIFAR100 and "Cardinal" in CUB200—and analyze the effectiveness of our method, compared to others, in mitigating this bias by RA.
The results (see Fig <ref>) show that our approach consistently outperforms baseline methods (SCRUB and SISA) across all levels of data deletion. While SCRUB and SISA maintain satisfactory performance at 20% data removal, their effectiveness drops markedly at higher removal percentages. Specifically, when removing 60% data, SCRUB misclassifies 72% of the remaining "Rabbit" instances, compared to our method's lower misclassification rate of 33%. This highlights the superior robustness of our method against increasing levels of label bias due to biased data deletion.





  §.§.§ Selective Feature Deletion

We evaluate our approach in scenarios where data deletion is biased towards specific attributes, leading to a shortcut bias. Here, we adopt two datasets, Adult and German with favourable labels as high salary (ŷ=1) and good credit risks (ŷ=1) respectively. Following <cit.>, in both datasets, we define sex as a sensitive feature, categorizing females as the unprivileged group. We assume that 30% people from unprivileged groups request data removal. To compare the bias mitigation, we conduct the non-uniform deletion and measure the DI, EOD as well as the RA and MIA.  
Initially, we develop an unbiased baseline model (Ori), following <cit.>. Then, we selectively remove instances with specific features from the model. Our results indicate that our method closely matches the performance of an unbiased retraining approach, achieving a DI of 0.85 for Adult and 0.89 for German. Although F-unlearning reduces bias by adjusting its fairness regularization parameter, it significantly decreases utility, resulting in a low accuracy on . This is because directly minimizing the regularizer adversely affects the cross-entropy loss. Our model showcases its superior ability to address shortcut bias inherent in the unlearning process.









 §.§ Ablation Studies on Loss Function (Q3)

We examine the effects of each component of the loss function, by ablating each part from ℒ. Notice that _r is consistently retained within ℒ to guarantee utility on . The ablation study is conducted on CIFAR100 with ResNet18 by uniformly removing 10% and 40% samples. In the full model, we set α=0.6,β=0.2,γ=0.2. 



Comparing the performance drop of each component, we observe that _f crucially impacts the balance between remembering and forgetting. Table <ref> shows that keeping only _f within ℒ leads to good performance with an accuracy of 0.8, compared to the full model's 0.9. However, it is not as effective in forgetting information as _f^CB, which achieves a MIA rate slightly worse than the full model. This is because _f^CB directly reduces the geometric distance between forgotten samples and their corresponding CF in representation space, intentionally guiding the model to overlook certain local features. Hence, combining _f and _f^CB outperforms other settings. Finally, ℓ(X_i, Y_i) contributes to maintaining the accuracy of the remaining samples.




§ CONCLUSION AND FUTURE WORK



In this work, we tackled the problem of mitigating the bias introduced by machine unlearning techniques <cit.>. 
To achieve this goal, we proposed a causal framework that addresses data-level bias through causal intervention <cit.>.
Furthermore, we guided the forgetting procedure using counterfactual examples that mitigate the algorithmic bias maintaining semantic data consistency without impacting the remaining samples <cit.>.
Experimental results demonstrated that our approach outperforms existing machine unlearning baseline on standard quality metrics. In the future, we plan to extend our work on NLP tasks <cit.>.

plain
10

abid2022meaningfully
Abubakar Abid, Mert Yuksekgonul, and James Zou.
Meaningfully debugging model mistakes using conceptual counterfactual
  explanations.
In International Conference on Machine Learning, pages 66–88.
  PMLR, 2022.

ahmad2021s
Khlood Ahmad, Muneera Bano, Mohamed Abdelrazek, Chetan Arora, and John Grundy.
What’s up with requirements engineering for artificial intelligence
  systems?
In 2021 IEEE 29th International Requirements Engineering
  Conference (RE), pages 1–12. IEEE, 2021.

bourtoule2021machine
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui
  Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot.
Machine unlearning.
In 2021 IEEE Symposium on Security and Privacy (SP), pages
  141–159. IEEE, 2021.

cao2015towards
Yinzhi Cao and Junfeng Yang.
Towards making systems forget with machine unlearning.
In 2015 IEEE symposium on security and privacy, pages 463–480.
  IEEE, 2015.

chen2022multi
Jiayu Chen, Jingdi Chen, Tian Lan, and Vaneet Aggarwal.
Multi-agent covering option discovery based on kronecker product of
  factor graphs.
IEEE Transactions on Artificial Intelligence, 2022.

chen2023explainable
Jingdi Chen, Lei Zhang, Joseph Riem, Gina Adam, Nathaniel D Bastian, and Tian
  Lan.
Explainable learning-based intrusion detection supported by
  memristors.
In 2023 IEEE Conference on Artificial Intelligence (CAI), pages
  195–196. IEEE, 2023.

chen2023boundary
Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang.
Boundary unlearning: Rapid forgetting of deep networks via shifting
  the decision boundary.
In Proceedings of the IEEE/CVF Conference on Computer Vision and
  Pattern Recognition, pages 7766–7775, 2023.

chen2019novel
Yuantao Chen, Jie Xiong, Weihong Xu, and Jingwen Zuo.
A novel online incremental and decremental learning algorithm based
  on variable support vector machine.
Cluster Computing, 22:7435–7445, 2019.

chu2024task
Zhixuan Chu, Mengxuan Hu, Qing Cui, Longfei Li, and Sheng Li.
Task-driven causal feature distillation: Towards trustworthy risk
  prediction.
In Proceedings of the AAAI Conference on Artificial
  Intelligence, volume 38, pages 11642–11650, 2024.

chundawat2023can
Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli.
Can bad teaching induce forgetting? unlearning in deep networks using
  an incompetent teacher.
In Proceedings of the AAAI Conference on Artificial
  Intelligence, volume 37, pages 7210–7217, 2023.

cui2023variational
Yufei Cui, Yu Mao, Ziquan Liu, Qiao Li, Antoni B Chan, Xue Liu, Tei-Wei Kuo,
  and Chun Jason Xue.
Variational nested dropout.
IEEE Transactions on Pattern Analysis and Machine Intelligence,
  2023.

das2019separability
Rudrajit Das and Subhasis Chaudhuri.
On the separability of classes with the cross-entropy loss function.
arXiv preprint arXiv:1909.06930, 2019.

fabbrizzi2022survey
Simone Fabbrizzi, Symeon Papadopoulos, Eirini Ntoutsi, and Ioannis
  Kompatsiaris.
A survey on bias in visual datasets.
Computer Vision and Image Understanding, 223:103552, 2022.

gao2024dlora
Chao Gao and Sai Qian Zhang.
Dlora: Distributed parameter-efficient fine-tuning solution for large
  language model.
arXiv preprint arXiv:2404.05182, 2024.

geirhos2020shortcut
Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel,
  Wieland Brendel, Matthias Bethge, and Felix A Wichmann.
Shortcut learning in deep neural networks.
Nature Machine Intelligence, 2(11):665–673, 2020.

guan2024ufid
Zihan Guan, Mengxuan Hu, Sheng Li, and Anil Vullikanti.
Ufid: A unified framework for input-level backdoor detection on
  diffusion models.
arXiv preprint arXiv:2404.01101, 2024.

guidotti2018local
Riccardo Guidotti, Anna Monreale, Salvatore Ruggieri, Dino Pedreschi, Franco
  Turini, and Fosca Giannotti.
Local rule-based explanations of black box decision systems.
arXiv preprint arXiv:1805.10820, 2018.

hardt2016equality
Moritz Hardt, Eric Price, and Nati Srebro.
Equality of opportunity in supervised learning.
Advances in neural information processing systems, 29, 2016.

he2024hierarchical
Wenchong He, Zhe Jiang, Tingsong Xiao, Zelin Xu, Shigang Chen, Ronald Fick,
  Miles Medina, and Christine Angelini.
A hierarchical spatial transformer for massive point samples in
  continuous space.
Advances in Neural Information Processing Systems, 36, 2024.

huang2021unlearnable
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang.
Unlearnable examples: Making personal data unexploitable.
arXiv preprint arXiv:2101.04898, 2021.

kadhe2023fairsisa
Swanand Ravindra Kadhe, Anisa Halimi, Ambrish Rawat, and Nathalie Baracaldo.
Fairsisa: Ensemble post-processing to improve fairness of unlearning
  in llms.
arXiv preprint arXiv:2312.07420, 2023.

kim2019bridging
Beomsu Kim, Junghoon Seo, and Taegyun Jeon.
Bridging adversarial robustness and gradient interpretability.
arXiv preprint arXiv:1903.11626, 2019.

kurmanji2024towards
Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou.
Towards unbounded machine unlearning.
Advances in Neural Information Processing Systems, 36, 2024.

kurmanji2023towards
Meghdad Kurmanji, Peter Triantafillou, and Eleni Triantafillou.
Towards unbounded machine unlearning.
arXiv preprint arXiv:2302.09880, 2023.

lahn2024combinatorial
Nathaniel Lahn, Sharath Raghvendra, and Kaiyi Zhang.
A combinatorial algorithm for approximating the optimal transport in
  the parallel and mpc settings.
Advances in Neural Information Processing Systems, 36, 2024.

li2022revisiting
Jingwei Li, Guoli Wei, Jiacheng Liang, Yanjing Ren, Patrick PC Lee, and
  Xiaosong Zhang.
Revisiting frequency analysis against encrypted deduplication via
  statistical distribution.
In IEEE INFOCOM 2022-IEEE Conference on Computer
  Communications, pages 290–299. IEEE, 2022.

liu2024please
Han Liu, Yuhao Wu, Zhiyuan Yu, and Ning Zhang.
Please tell me more: Privacy impact of explainability through the
  lens of membership inference attack.
In 2024 IEEE Symposium on Security and Privacy (SP), pages
  120–120. IEEE Computer Society, 2024.

liu2023riatig
Han Liu, Yuhao Wu, Shixuan Zhai, Bo Yuan, and Ning Zhang.
Riatig: Reliable and imperceptible adversarial text-to-image
  generation with natural prompts.
In Proceedings of the IEEE/CVF Conference on Computer Vision and
  Pattern Recognition, pages 20585–20594, 2023.

liu2021neural
Lihui Liu, Boxin Du, Heng Ji, ChengXiang Zhai, and Hanghang Tong.
Neural-answering logical queries on knowledge graphs.
In Proceedings of the 27th ACM SIGKDD conference on knowledge
  discovery & data mining, pages 1087–1097, 2021.

lucic2022focus
Ana Lucic, Harrie Oosterhuis, Hinda Haned, and Maarten de Rijke.
Focus: Flexible optimizable counterfactual explanations for tree
  ensembles.
In Proceedings of the AAAI Conference on Artificial
  Intelligence, volume 36, pages 5313–5322, 2022.

lyu2022study
Weimin Lyu, Songzhu Zheng, Tengfei Ma, and Chao Chen.
A study of the attention abnormality in trojaned berts.
arXiv preprint arXiv:2205.08305, 2022.

lyu2023attention
Weimin Lyu, Songzhu Zheng, Lu Pang, Haibin Ling, and Chao Chen.
Attention-enhancing backdoor attacks against bert-based models.
arXiv preprint arXiv:2310.14480, 2023.

ma2022learning
Haixu Ma, Donglin Zeng, and Yufeng Liu.
Learning individualized treatment rules with many treatments: A
  supervised clustering approach using adaptive fusion.
Advances in Neural Information Processing Systems,
  35:15956–15969, 2022.

ma2023learning
Haixu Ma, Donglin Zeng, and Yufeng Liu.
Learning optimal group-structured individualized treatment rules with
  many treatments.
Journal of Machine Learning Research, 24(102):1–48, 2023.

ma2024data
Xiaobo Ma, Abolfazl Karimpour, and Yao-Jan Wu.
Data-driven transfer learning framework for estimating on-ramp and
  off-ramp traffic flows.
Journal of Intelligent Transportation Systems, pages 1–14,
  2024.

mao2023less
Yifan Mao and Shaileshh Bojja Venkatakrishnan.
Less is more: Understanding network bias in proof-of-work
  blockchains.
Mathematics, 11(23):4741, 2023.

mao2022accelerating
Yu Mao, Yufei Cui, Tei-Wei Kuo, and Chun Jason Xue.
Accelerating general-purpose lossless compression via simple and
  scalable parameterization.
In Proceedings of the 30th ACM International Conference on
  Multimedia, pages 3205–3213, 2022.

mao2022trace
Yu Mao, Yufei Cui, Tei-Wei Kuo, and Chun Jason Xue.
Trace: A fast transformer-based general-purpose lossless compressor.
In Proceedings of the ACM Web Conference 2022, pages
  1829–1838, 2022.

nguyen2022survey
Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew,
  Hongzhi Yin, and Quoc Viet Hung Nguyen.
A survey of machine unlearning.
arXiv preprint arXiv:2209.02299, 2022.

oesterling2023fair
Alex Oesterling, Jiaqi Ma, Flavio P Calmon, and Hima Lakkaraju.
Fair machine unlearning: Data removal while mitigating disparities.
arXiv preprint arXiv:2307.14754, 2023.

pawelczyk2020learning
Martin Pawelczyk, Klaus Broelemann, and Gjergji Kasneci.
Learning model-agnostic counterfactual explanations for tabular data.
In Proceedings of The Web Conference 2020, pages 3126–3132,
  2020.

pearl2009causal
Judea Pearl.
Causal inference in statistics: An overview.
Statistics Surveys, 3:96–146, 2009.

peste2021ssse
Alexandra Peste, Dan Alistarh, and Christoph H Lampert.
Ssse: Efficiently erasing samples from trained machine learning
  models.
arXiv preprint arXiv:2107.03860, 2021.

qiang2022counterfactual
Yao Qiang, Chengyin Li, Marco Brocanelli, and Dongxiao Zhu.
Counterfactual interpolation augmentation (cia): A unified approach
  to enhance fairness and explainability of dnn.
In IJCAI, pages 732–739, 2022.

ren2022dice
Qibing Ren, Yiting Chen, Yichuan Mo, Qitian Wu, and Junchi Yan.
Dice: Domain-attack invariant causal learning for improved data
  privacy protection and adversarial robustness.
In Proceedings of the 28th ACM SIGKDD Conference on Knowledge
  Discovery and Data Mining, pages 1483–1492, 2022.

ruan2022learning
Kangrui Ruan and Xuan Di.
Learning human driving behaviors with sequential causal imitation
  learning.
In Proceedings of the AAAI Conference on Artificial
  Intelligence, volume 36, pages 4583–4592, 2022.

ruan2022causal
Kangrui Ruan, Junzhe Zhang, Xuan Di, and Elias Bareinboim.
Causal imitation learning via inverse reinforcement learning.
In The Eleventh International Conference on Learning
  Representations, 2022.

stepin2021survey
Ilia Stepin, Jose M. Alonso, Alejandro Catala, and Martín Pereira-Fariña.
A Survey of Contrastive and Counterfactual Explanation Generation
  Methods for Explainable Artificial Intelligence.
IEEE Access, 9:11974–12001, 2021.

tang2022contrastive
Liyao Tang, Yibing Zhan, Zhe Chen, Baosheng Yu, and Dacheng Tao.
Contrastive boundary learning for point cloud segmentation.
In Proceedings of the IEEE/CVF Conference on Computer Vision and
  Pattern Recognition, pages 8489–8499, 2022.

tian2022debiasing
Bing Tian, Yixin Cao, Yong Zhang, and Chunxiao Xing.
Debiasing nlu models via causal intervention and counterfactual
  reasoning.
In Proceedings of the AAAI Conference on Artificial
  Intelligence, volume 36, pages 11376–11384, 2022.

udeshi2018automated
Sakshi Udeshi, Pryanshu Arora, and Sudipta Chattopadhyay.
Automated directed fairness testing.
In Proceedings of the 33rd ACM/IEEE International Conference on
  Automated Software Engineering, pages 98–108, 2018.

vandenhende2022making
Simon Vandenhende, Dhruv Mahajan, Filip Radenovic, and Deepti Ghadiyaram.
Making heads or tails: Towards semantically consistent visual
  counterfactuals.
In European Conference on Computer Vision, pages 261–279.
  Springer, 2022.

wu2022puma
Ga Wu, Masoud Hashemi, and Christopher Srinivasa.
Puma: Performance unchanged model augmentation for training data
  removal.
In Proceedings of the AAAI Conference on Artificial
  Intelligence, volume 36, pages 8675–8682, 2022.

xiang2023tkil
Jinlin Xiang and Eli Shlizerman.
Tkil: Tangent kernel optimization for class balanced incremental
  learning.
In Proceedings of the IEEE/CVF International Conference on
  Computer Vision, pages 3529–3539, 2023.

xie2022measurement
Zongxing Xie, Yindong Hua, and Fan Ye.
A measurement study of fmcw radar configurations for non-contact
  vital signs monitoring.
In 2022 IEEE Radar Conference (RadarConf22), pages 1–6. IEEE,
  2022.

xie2021vitalhub
Zongxing Xie, Bing Zhou, Xi Cheng, Elinor Schoenfeld, and Fan Ye.
Vitalhub: Robust, non-touch multi-user vital signs monitoring using
  depth camera-aided uwb.
In 2021 IEEE 9th International Conference on Healthcare
  Informatics (ICHI), pages 320–329. IEEE, 2021.

ye2023medlens
Xuesong Ye, Jun Wu, Chengjie Mou, and Weinan Dai.
Medlens: Improve mortality prediction via medical signs selecting and
  regression.
In 2023 IEEE 3rd International Conference on Computer
  Communication and Artificial Intelligence (CCAI), pages 169–175. IEEE,
  2023.

you2022incremental
Chenyu You, Jinlin Xiang, Kun Su, Xiaoran Zhang, Siyuan Dong, John Onofrey,
  Lawrence Staib, and James S Duncan.
Incremental learning meets transfer learning: Application to
  multi-site prostate mri segmentation.
In International Workshop on Distributed, Collaborative, and
  Federated Learning, pages 3–16. Springer, 2022.

zhang2023unleashing
Dan Zhang, Fangfang Zhou, Yuanzhou Wei, Xiao Yang, and Yuan Gu.
Unleashing the power of self-supervised image denoising: A
  comprehensive review.
arXiv preprint arXiv:2308.00247, 2023.

zhang2024forgotten
Dawen Zhang, Shidong Pan, Thong Hoang, Zhenchang Xing, Mark Staples, Xiwei Xu,
  Lina Yao, Qinghua Lu, and Liming Zhu.
To be forgotten or to be fair: Unveiling fairness implications of
  machine unlearning methods.
AI and Ethics, pages 1–11, 2024.

zhao2023stable
Liqun Zhao, Konstantinos Gatsis, and Antonis Papachristodoulou.
Stable and safe reinforcement learning via a barrier-lyapunov
  actor-critic approach.
In 2023 62nd IEEE Conference on Decision and Control (CDC),
  pages 1320–1325. IEEE, 2023.

zhou2023xai
Zhongliang Zhou, Mengxuan Hu, Mariah Salcedo, Nathan Gravel, Wayland Yeung,
  Aarya Venkat, Dongliang Guo, Jielu Zhang, Natarajan Kannan, and Sheng Li.
Xai meets biology: A comprehensive review of explainable ai in
  bioinformatics applications.
arXiv preprint arXiv:2312.06082, 2023.




 