Class Clown: Data Redaction in Machine Unlearning at Enterprise Scale
Open accessAbstract
Individuals are gaining more control of their personal data through recent data privacy laws such the General Data Protection Regulation and the California Consumer Privacy Act. One aspect of these laws is the ability to request a business to delete private information, the so called right to be forgotten or right to erasure. These laws have serious financial implications for companies and organizations that train large, highly accurate deep neural networks (DNNs) using these valuable consumer data sets. However, a received redaction request poses complex technical challenges on how to comply with the law while fulfilling core business operations. We introduce a DNN model lifecycle maintenance process that establishes how to handle specific data redaction requests and minimize the need to completely retrain the model. Our process is based upon the membership inference attack as a compliance tool for every point in the training set. These attack models quantify the privacy risk of all training data points and form the basis of follow-on data redaction from an accurate deployed model; excision is implemented through incorrect label assignment within incremental model updates.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The text we found for this paper looks like another document, so the self-check wasn’t run.
Cites
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · cited 1× · see citing works
“In one of these attacks, the membership inference attack (Shokri et al., 2017), it is possible for Approved for public release, NGA #21-141. an adversary to predict whether a record was in the model’s training set.”
BackgroundBourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., & Papernot, N. (2021) · 2021 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40001.2021.00019 · Cited by 810 · cited 1× · see citing works
“Bourtoule (Bourtoule et al., 2019) addresses deep neural networks with a machine unlearning framework designed to have maximal impact upon algorithms using the stochastic gradient descent (SGD).”
BackgroundLabel-Only Membership Inference AttacksPreprint
Choquette-Choo, C. A., Tramèr, F., Carlini, N., & Papernot, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.14321 · Cited by 215 · cited 1× · see citing works
“This is highlighted in a recent label-only attack (Choquette Choo et al., 2020).”
BackgroundWhen Machine Unlearning Jeopardizes Privacy
Chen, M., Zhang, Z., Wang, T., Backes, M., Humbert, M., & Zhang, Y. (2021) · Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3460120.3484756 · Cited by 195 · cited 1× · see citing works
“Chen (Chen et al., 2020) introduces explicitly leveraging the MI attack to directly measure how much privacy information has been degraded.”
BackgroundMachine unlearning: linear filtration for logit-based classifiers
Baumhauer, T., Schöttle, P., & Zeppelzauer, M. (2022) · Machine Learning · doi:10.1007/s10994-022-06178-9 · Cited by 123 · cited 1× · see citing works
“More recently, Baumhauer (Baumhauer et al., 2020) has considered the setting where an entire class needs to be removed from the model, for instance in biometric applications where the entire class represents an individual.”
BackgroundHave You Forgotten? A Method to Assess if Machine Learning Models Have Forgotten Data
Liu, X., & Tsaftaris, S. A. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-59710-8_10 · Cited by 18 · see citing works
Pinto, J. (2013) · Indian Journal of Psychiatry · doi:10.4103/0019-5545.120578 · Cited by 2
Bootstrap Aggregation for Point-based Generalized Membership Inference AttacksPreprint
Felps, D. L., Schwickerath, A. D., Williams, J. D., et al. (2020) · arXiv.org · doi:10.48550/arxiv.2011.08738 · Cited by 1 · cited 2× · see citing works
“The strength of these attacks has been increasing and it is now possible to efficiently generate point-specific attacks against every point in a known training data set (Felps et al., 2020).”
BackgroundSelf-citation
Flagged first, then by citations
2 of the 10 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Xu, H., Zhu, T., Zhang, L., Zhou, W., & Yu, P. S. (2024) · ACM Computing Surveys · doi:10.1145/3603620 · Cited by 164 · see citing works
“[46] intentionally poisoned the labels of the unlearning dataset and then ine-tuned the model based on the new poisoned dataset.”
BackgroundMethodInfluentialA Survey of Machine Unlearning
Nguyen, T. T., Huynh, T. T., Ren, Z., Nguyen, P. L., Liew, A. W.-C., Yin, H., & Nguyen, Q. V. H. (2022) · arXiv · doi:10.48550/arxiv.2209.02299 · Cited by 193 · see citing works
“More precisely, data redaction aims to poison the label information of the forget data inside the model [40].”
InfluentialZhong, Z., Bao, W., Wang, J., Zhang, S., Zhou, J., Lyu, L., & Lim, W. Y. B. (2025) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52734.2025.02855 · Cited by 26 · see citing works
“The former fine-tunes the model to forget spe-cific samples by introducing interference data or by replacing existing data [11, 14, 34, 36, 49].”
Bonato, J., Cotogni, M., & Sabetta, L. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73232-4_1 · Cited by 11 · see citing works
Certifiable Unlearning Pipelines for Logistic Regression: An Experimental Study
Mahadevan, A., & Mathioudakis, M. (2022) · Machine Learning and Knowledge Extraction · doi:10.3390/make4030028 · Cited by 10 · see citing works
A Systematic Literature Review of Machine Unlearning Techniques in Neural Networks
Cevallos, I., Benalcázar, M. E., Caraguay, Á. L. V., Zea, J. A., & López, L. I. B. (2025) · Computers · doi:10.3390/computers14040150 · Cited by 10 · see citing works
Fast and Accurate SNN Model Strengthening for Industrial Applications
Zhou, D., Chen, W., Chen, K., & Mi, B. (2023) · Electronics · doi:10.3390/electronics12183845 · Cited by 5 · see citing works
Togo, T., Togo, R., Maeda, K., Ogawa, T., & Haseyama, M. (2024) · Sensors · doi:10.3390/s24103087 · Cited by 2 · see citing works
FedSSU: flexible and efficient decentralized unlearning for federated learning
Leng, Y., Xu, L., Liu, J., Zhang, X., Mei, L., Qu, Y., & Xu, C. (2025) · The Journal of Supercomputing · doi:10.1007/s11227-025-07478-2 · Cited by 1 · see citing works
Classification Based Unlearning Through PCL Knowledge Distillation
Srivastava, S., & Sharma, S. (2025) · Lecture notes in electrical engineering · doi:10.1007/978-981-97-9112-5_18
(2025) · Duke University Press eBooks · doi:10.1215/9781478060529-006
Meng, X. (2026) · Big data management · doi:10.1007/978-981-95-5787-5_9
- Authors
- Felps, D., Schwickerath, A., Williams, J., Vuong, T., Briggs, A., Hunt, M., Sakmar, E., Saranchak, D., & Shumaker, T.
- Affiliations
- National Geospatial-Intelligence Agency (US)
- Concurrent Technologies Corporation (US)
- Venue
- Proceedings of the 10th International Conference on Operations Research and Enterprise Systems
- Published
- 2021
- Pages
- 7-14
- OpenAlex
- W3127248274
- Cited by
- 12
- References
- 10
- Citations by year
- 2026: 1 · 2025: 6 · 2024: 2 · 2023: 2 · 2022: 1
- FWCI
- 0.58
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by-nc-nd
- Locations
- International Conference on Operations Research and Enterprise Systems (publishedVersion, cc-by-nc-nd)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Keywords
- machine unlearning, data redaction, right to be forgotten, data privacy, membership inference attacks, deep neural network, incremental model updates, model lifecycle management, GDPR, California Consumer Privacy Act
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
