PreprintCited by 193Privacy-Preserving Technologies in DataPrivacy, Security, and Data ProtectionAdversarial Robustness in Machine Learning

The DOI matches its DataCite record; 245 of the 263 references it cites were found in a registry or an index.

A Survey of Machine Unlearning

Open access

Abstract

Today, computer systems hold large amounts of personal data. Yet while such an abundance of data allows breakthroughs in artificial intelligence, and especially machine learning (ML), its existence can be a threat to user privacy, and it can weaken the bonds of trust between humans and AI. Recent regulations now require that, on request, private information about a user must be removed from both computer systems and from ML models, i.e. ``the right to be forgotten''). While removing data from back-end databases should be straightforward, it is not sufficient in the AI context as ML models often `remember' the old data. Contemporary adversarial attacks on trained models have proven that we can learn whether an instance or an attribute belonged to the training data. This phenomenon calls for a new paradigm, namely machine unlearning, to make ML models forget about particular data. It turns out that recent works on machine unlearning have not been able to completely solve the problem due to the lack of common frameworks and resources. Therefore, this paper aspires to present a comprehensive examination of machine unlearning's concepts, scenarios, methods, and applications. Specifically, as a category collection of cutting-edge studies, the intention behind this article is to serve as a comprehensive resource for researchers and practitioners seeking an introduction to machine unlearning and its formulations, design criteria, removal requests, algorithms, and applications. In addition, we aim to highlight the key findings, current trends, and new research areas that have not yet featured the use of machine unlearning but could benefit greatly from it. We hope this survey serves as a valuable resource for ML researchers and those seeking to innovate privacy technologies. Our resources are publicly available at https://github.com/tamlhp/awesome-machine-unlearning.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2209.02299

Cites

245 of 245 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 263 references

Research works printed but not linked: 19

  1. [15][15] Gert Cauwenberghs et al. 2000. Incremental and decremental support vector machine learning. NIPS 13 (2000). -
  2. [22][22] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. 2021. Graph unlearning. arXiv preprint arXiv:2103.14991 (2021). - · arXiv
  3. [26][26] Jiali Cheng, George Dasoulas, Huan He, Chirag Agarwal, and Marinka Zitnik. 2023. GNNDelete: A General Strategy for Unlearning in Graph Neural Networks. In ICLR . -
  4. [36][36] Nicola K Dinsdale, Mark Jenkinson, et al. 2020. Unlearning scanner bias for mri harmonisation. In MICCAI . 369-378. -
  5. [46][46] Stefan Feuerriegel, Mateusz Dolata, and Gerhard Schwabe. 2020. Fair AI. Business & information systems engineering 62, 4 (2020), 379-384. -
  6. [48][48] Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014. Privacy in pharmacogenetics: An { End-to-End } case study of personalized warfarin dosing. In USENIX Security . 17-32. -
  7. [55][55] Johannes Gasteiger, Aleksandar Bojchevski, and Stephan Günnemann. 2019. Combining Neural Networks with Personalized PageRank for Classification on Graphs. In ICLR . -
  8. [65][65] Ruocheng Guo, Lu Cheng, Jundong Li, P Richard Hahn, and Huan Liu. 2020. A survey of learning causality with data: Problems and methods. CSUR 53, 4 (2020), 1-37. -
  9. [69][69] William L Hamilton. 2020. Graph representation learning. Synthesis Lectures on Artifical Intelligence and Machine Learning 14, 3 (2020), 1-159. -
  10. [85][85] Masayuki Karasuyama and Ichiro Takeuchi. 2010. Multiple incremental decremental learning of support vector machines. IEEE Transactions on Neural Networks 21, 7 (2010), 1048-1059. -
  11. [123][123] Salvatore Mercuri, Raad Khraishi, Ramin Okhrati, Devesh Batra, Conor Hamill, Taha Ghasempour, and Andrew Nowlan. 2022. An introduction to machine unlearning. arXiv preprint arXiv:2209.00939 (2022). - · arXiv
  12. [125][125] Junhyun Nam, Hyuntak Cha, Sungsoo Ahn, Jaeho Lee, and Jinwoo Shin. 2020. Learning from failure: De-biasing classifier from biased classifier. NIPS 33 (2020), 20673-20684. -
  13. [130][130] Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. 2022. A Survey of Machine Unlearning. arXiv preprint arXiv:2209.02299 (2022). , , -
  14. [134][134] Stuart L Pardau. 2018. The California consumer privacy act: Towards a Europeanstyle privacy regime in the United States. J. Tech. L. & Pol'y 23 (2018), 68. -
  15. [157][157] S Shan, E Wenger, J Zhang, H Li, H Zheng, and BY Zhao. 2020. Protecting Personal Privacy against Una uthorized Deep Learning Models. In USENIX Security . 1-16. -
  16. [163][163] Abhijeet Singh and Abhineet Anand. 2017. Data leakage detection using cloud computing. IJECS 6, 4 (2017). -
  17. [165][165] Yash Sinha, Murari Mandal, and Mohan Kankanhalli. 2024. Multi-Modal Recommendation Unlearning. arXiv preprint arXiv:2405.15328 (2024). - · arXiv
  18. [189][189] Cheng-Long Wang, Mengdi Huai, and Di Wang. 2023. Inductive graph unlearning. In USENIX . 3205-3222. -
  19. [204][204] Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S. Yu. 2023. Machine Unlearning: A Survey. CSUR 56, 1 (2023), 36. -

Cited by

Sorted by citations

Metadata

Authors
Nguyen, T. T., Huynh, T. T., Ren, Z., Nguyen, P. L., Liew, A. W.-C., Yin, H., & Nguyen, Q. V. H.
Affiliations
  • VinUniversity (VN)
  • University of Bremen (DE)
  • Trường Đại học Khoa học và Công nghệ Hà Nội (VN)
  • Griffith University (AU)
  • The University of Queensland (AU)
Venue
arXiv
Publisher
arXiv
Published
2022
Volume
16
Issue
5
Pages
1-46
ISSN
2157-6904 (ISSN-L)
OpenAlex
W4412565294
Cited by
193
References
263
Citations by year
2026: 75 · 2025: 53 · 2024: 45 · 2023: 20
FWCI
51.16
Type
journal article
Language
en
Open access
Locations
  • ACM Transactions on Intelligent Systems and Technology (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • Griffith Research Online (submittedVersion)
  • arXiv (Cornell University)
Funders
Australian Research Council
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
machine unlearning, right to be forgotten, privacy, adversarial attacks, training data reconstruction, personal data protection, privacy-preserving machine learning

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review