Once users have shared their data online, it is generally difficult for them
to revoke access and ask for the data to be deleted. Machine learning (ML)
exacerbates this problem because any model trained with said data may have
memorized it, putting users at risk of a successful privacy attack exposing
their information. Yet, having models unlearn is notoriously difficult. We
introduce SISA training, a framework that expedites the unlearning process by
strategically limiting the influence of a data point in the training procedure.
While our framework is applicable to any learning algorithm, it is designed to
achieve the largest improvements for stateful algorithms like stochastic
gradient descent for deep neural networks. SISA training reduces the
computational overhead associated with unlearning, even in the worst-case
setting where unlearning requests are made uniformly across the training set.
In some cases, the service provider may have a prior on the distribution of
unlearning requests that will be issued by users. We may take this prior into
account to partition and order data accordingly, and further decrease overhead
from unlearning. Our evaluation spans several datasets from different domains,
with corresponding motivations for unlearning. Under no distributional
assumptions, for simple learning tasks, we observe that SISA training improves
time to unlearn points from the Purchase dataset by 4.63x, and 2.45x for the
SVHN dataset, over retraining from scratch. SISA training also provides a
speed-up of 1.36x in retraining for complex learning tasks such as ImageNet
classification; aided by transfer learning, this results in a small degradation
in accuracy. Our work contributes to practical data governance in machine
unlearning.