{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T16:10:31Z","timestamp":1777651831308,"version":"3.51.4"},"reference-count":39,"publisher":"Springer Science and Business Media LLC","issue":"9","license":[{"start":{"date-parts":[[2022,7,11]],"date-time":"2022-07-11T00:00:00Z","timestamp":1657497600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,7,11]],"date-time":"2022-07-11T00:00:00Z","timestamp":1657497600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100002428","name":"Austrian Science Fund","doi-asserted-by":"publisher","award":["I 4057"],"award-info":[{"award-number":["I 4057"]}],"id":[{"id":"10.13039\/501100002428","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004955","name":"\u00d6sterreichische Forschungsf\u00f6rderungsgesellschaft","doi-asserted-by":"publisher","award":["866880"],"award-info":[{"award-number":["866880"]}],"id":[{"id":"10.13039\/501100004955","id-type":"DOI","asserted-by":"publisher"}]},{"name":"MCI Management Center Innsbruck \u2013 Internationale Hochschule GmbH"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mach Learn"],"published-print":{"date-parts":[[2022,9]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Recently enacted legislation grants individuals certain rights to decide in what fashion their personal data may be used and in particular a \u201cright to be forgotten\u201d. This poses a challenge to machine learning: how to proceed when an individual retracts permission to use data which has been part of the training process of a model? From this question emerges the field of <jats:italic>machine unlearning<\/jats:italic>, which could be broadly described as the investigation of how to \u201cdelete training data from models\u201d. Our work complements this direction of research for the specific setting of class-wide deletion requests for classification models (e.g. deep neural networks). As a first step, we propose <jats:italic>linear filtration<\/jats:italic> as an intuitive, computationally efficient sanitization method. Our experiments demonstrate benefits in an adversarial setting over naive deletion schemes.<\/jats:p>","DOI":"10.1007\/s10994-022-06178-9","type":"journal-article","created":{"date-parts":[[2022,7,12]],"date-time":"2022-07-12T11:03:06Z","timestamp":1657623786000},"page":"3203-3226","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":74,"title":["Machine unlearning: linear filtration for logit-based classifiers"],"prefix":"10.1007","volume":"111","author":[{"given":"Thomas","family":"Baumhauer","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8710-9188","authenticated-orcid":false,"given":"Pascal","family":"Sch\u00f6ttle","sequence":"additional","affiliation":[]},{"given":"Matthias","family":"Zeppelzauer","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,7,11]]},"reference":[{"key":"6178_CR1","doi-asserted-by":"crossref","unstructured":"Abadi, M., Chu, A., Goodfellow, I., McMahan, B., Mironov, I., Talwar, K., & Zhang, L. (2016). Deep learning with differential privacy. In: 23rd ACM Conference on Computer and Communications Security (ACM CCS)","DOI":"10.1145\/2976749.2978318"},{"key":"6178_CR2","unstructured":"Achille, A., Paolini, G., & Soatto, S. (2019). Where is the information in a deep neural network? arXiv 190512213"},{"key":"6178_CR3","unstructured":"AT&T Laboratories Cambridge (1994) The database of faces"},{"key":"6178_CR4","doi-asserted-by":"publisher","first-page":"317","DOI":"10.1016\/j.patcog.2018.07.023","volume":"84","author":"B Biggio","year":"2018","unstructured":"Biggio, B., & Roli, F. (2018). Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84, 317\u2013331.","journal-title":"Pattern Recognition"},{"key":"6178_CR5","unstructured":"Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C., Jia, H., Travers, A., Zhang, B., Lie, D., & Papernot, N .(2019). Machine unlearning. arXiv preprint arXiv:1912.03817"},{"key":"6178_CR6","doi-asserted-by":"crossref","unstructured":"Cao, Y., & Yang, J . (2015). Towards making systems forget with machine unlearning. In: 2015 IEEE Symposium on Security and Privacy","DOI":"10.1109\/SP.2015.35"},{"key":"6178_CR7","unstructured":"Carlini, N., Liu, C., Erlingsson, \u00da., Kos, J., & Song, D. (2019). The secret sharer: Evaluating and testing unintended memorization in neural networks. In: 28th USENIX Security Symposium (USENIX Security 19)"},{"key":"#cr-split#-6178_CR8.1","unstructured":"Council of European Union (2012) Regulation"},{"key":"#cr-split#-6178_CR8.2","unstructured":"(eu) 2012\/0011. https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:52012PC0011, accessed: 2022\/04\/28 09:23:04"},{"key":"#cr-split#-6178_CR9.1","unstructured":"Council of European Union (2016) Regulation"},{"key":"#cr-split#-6178_CR9.2","unstructured":"(eu) 2016\/679. https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj, accessed: 2022\/04\/28 09:23:04"},{"key":"6178_CR10","doi-asserted-by":"crossref","unstructured":"Dwork, C., & Roth, A .(2014). The algorithmic foundations of differential privacy. Foundations Trends in Theoretical Computer Science, 4(3\u20134):211-407","DOI":"10.1561\/0400000042"},{"key":"6178_CR11","doi-asserted-by":"crossref","unstructured":"Dwork, C., McSherry, F., Nissim, K., & Smith, A .(2006). Calibrating noise to sensitivity in private data analysis. In: Halevi S, Rabin T (eds) Theory of Cryptography","DOI":"10.1007\/11681878_14"},{"key":"6178_CR12","unstructured":"Fredrikson, M., Lantz, E., Jha, S., Lin, S., Page, D., & Ristenpart, T .(2014) . Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing. In: Proceedings of the 23rd USENIX Conference on Security Symposium"},{"key":"6178_CR13","doi-asserted-by":"crossref","unstructured":"Fredrikson, M., Jha, S., & Ristenpart, T. (2015) . Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security","DOI":"10.1145\/2810103.2813677"},{"key":"6178_CR14","unstructured":"Ginart, A., Guan, M., Valiant, G., & Zou, JY .(2019) . Making AI forget you: Data deletion in machine learning. In: Advances in Neural Information Processing Systems, pp 3518\u20133531"},{"key":"6178_CR15","doi-asserted-by":"crossref","unstructured":"Golatkar, A., Achille, A., & Soatto, S .(2020a) . Eternal sunshine of the spotless net: Selective forgetting in deep networks. IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR42600.2020.00932"},{"key":"6178_CR16","doi-asserted-by":"crossref","unstructured":"Golatkar, A., Achille, A., & Soatto, S .(2020b) . Forgetting outside the box: Scrubbing deep networks of information accessible from input-output observations. arXiv 200302960","DOI":"10.1007\/978-3-030-58526-6_23"},{"key":"6178_CR17","unstructured":"Guo, C., Goldstein, T., Hannun, A., & van\u00a0der Maaten, L .(2019) . Certified data removal from machine learning models. arXiv 191103030"},{"key":"6178_CR18","doi-asserted-by":"crossref","unstructured":"Hayes, J., Melis, L., Danezis, G., & De\u00a0Cristofaro, E. (2019). LOGAN: Membership inference attacks against generative models. PoPETs","DOI":"10.2478\/popets-2019-0008"},{"key":"6178_CR19","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., & Sun, J .(2016). Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","DOI":"10.1109\/CVPR.2016.90"},{"key":"6178_CR20","unstructured":"Jacot, A., Gabriel, F., & Hongler, C . (2018) . Neural tangent kernel: Convergence and generalization in neural networks. Advances in Neural Information Processing Systems"},{"issue":"6","key":"6178_CR21","doi-asserted-by":"publisher","first-page":"983","DOI":"10.1145\/293347.293351","volume":"45","author":"M Kearns","year":"1998","unstructured":"Kearns, M. (1998). Efficient noise-tolerant learning from statistical queries. Journal of the ACM, 45(6), 983\u20131006.","journal-title":"Journal of the ACM"},{"issue":"1","key":"6178_CR22","first-page":"5","volume":"IX","author":"A Kerckhoffs","year":"1883","unstructured":"Kerckhoffs, A. (1883). La cryptographie militaire. Journal des sciences militaires, IX(1), 5\u201338.","journal-title":"Journal des sciences militaires"},{"key":"6178_CR23","unstructured":"Koh, PW., & Liang, P . (2017) .Understanding black-box predictions via influence functions. Proceedings of the 34th International Conference on Machine Learning"},{"key":"6178_CR24","volume-title":"Learning multiple layers of features from tiny images","author":"A Krizhevsky","year":"2009","unstructured":"Krizhevsky, A. (2009). Learning multiple layers of features from tiny images. Tech. rep.: University of Toronto."},{"key":"6178_CR25","doi-asserted-by":"crossref","unstructured":"Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998). Gradient-based learning applied to document recognition. Proceedings of the IEEE","DOI":"10.1109\/5.726791"},{"key":"6178_CR26","doi-asserted-by":"crossref","unstructured":"Lee, J., Xiao, L., Schoenholz, S., Bahri, Y., Sohl-Dickstein, J., & Pennington, J .(2019) . Wide neural networks of any depth evolve as linear models under gradient descent. Advances in Neural Information Processing Systems","DOI":"10.1088\/1742-5468\/abc62b"},{"key":"6178_CR28","unstructured":"McSherry, F. (2016). Statistical inference considered harmful. https:\/\/github.com\/frankmcsherry\/blog\/blob\/master\/posts\/2016-06-14.md, accessed: 2022\/04\/28 09:23:04"},{"key":"6178_CR29","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, ZB., & Swami, A. (2016). The limitations of deep learning in adversarial settings. In: 2016 IEEE European symposium on security and privacy (EuroS&P), IEEE, pp 372\u2013387","DOI":"10.1109\/EuroSP.2016.36"},{"key":"6178_CR30","unstructured":"Sablayrolles, A., Douze, M., Schmid, C., Ollivier, Y., & Jegou, H. (2019). White-box vs black-box: Bayes optimal strategies for membership inference. In: International Conference on Machine Learning"},{"key":"6178_CR31","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017). Membership inference attacks against machine learning models. In: 2017 IEEE Symposium on Security and Privacy (SP)","DOI":"10.1109\/SP.2017.41"},{"key":"6178_CR32","unstructured":"Sommer, DM., Song, L., Wagh, S., & Mittal, P. (2020). Towards probabilistic verification of machine unlearning. arXiv 200304247"},{"key":"6178_CR33","unstructured":"State of California (2018) California Consumer Privacy Act. https:\/\/leginfo.legislature.ca.gov\/faces\/billTextClient.xhtml?bill_ id=201720180AB375, accessed: 2022\/04\/28 09:23:04"},{"key":"6178_CR27","unstructured":"van\u00a0der Maaten, L., & Hannun, A.Y. (2020). The trade-offs of private prediction. CoRR abs\/2007.05089, https:\/\/arxiv.org\/abs\/2007.05089, 2007.05089"},{"key":"6178_CR34","volume-title":"Algorithms that remember: Model inversion attacks and data protection law","author":"M Veale","year":"2018","unstructured":"Veale, M., Binns, R., & Edwards, L. (2018). Algorithms that remember: Model inversion attacks and data protection law. Mathematical, Physical and Engineering Sciences: Philosophical Transactions of the Royal Society A."},{"key":"6178_CR35","doi-asserted-by":"crossref","unstructured":"Villaronga, EF., Kieseberg, P., & Li, TJ .(2018) . Humans forget, machines remember: Artificial intelligence and the right to be forgotten. Computer Law & Security Review","DOI":"10.1016\/j.clsr.2017.08.007"},{"key":"6178_CR36","doi-asserted-by":"crossref","unstructured":"Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S .(2018) . Privacy risk in machine learning: Analyzing the connection to overfitting. 2018 IEEE 31st Computer Security Foundations Symposium (CSF)","DOI":"10.1109\/CSF.2018.00027"},{"key":"6178_CR37","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Jia, R., Pei, H., Wang, W., Li, B., & Song, D .(2020) . The secret revealer: generative model-inversion attacks against deep neural networks. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp 253\u2013261","DOI":"10.1109\/CVPR42600.2020.00033"}],"container-title":["Machine Learning"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-022-06178-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10994-022-06178-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10994-022-06178-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,15]],"date-time":"2022-09-15T23:11:57Z","timestamp":1663283517000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10994-022-06178-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,7,11]]},"references-count":39,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2022,9]]}},"alternative-id":["6178"],"URL":"https:\/\/doi.org\/10.1007\/s10994-022-06178-9","relation":{},"ISSN":["0885-6125","1573-0565"],"issn-type":[{"value":"0885-6125","type":"print"},{"value":"1573-0565","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,7,11]]},"assertion":[{"value":"14 September 2020","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 September 2021","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 April 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 July 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"Not Applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval"}},{"value":"Not Applicable.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate"}},{"value":"Not Applicable.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}}]}}