The Right to be Forgotten (And Why It's a Technical Nightmare)
I am staring down a new research rabbit hole for my MSc project, and it all revolves around one fundamental, increasingly terrifying question: How do you make an AI forget?
Under the GDPR (and similar laws like the CCPA), users have the “Right to be Forgotten.” If you sign up for a service and later decide you want out, you can demand they delete all your data. From a traditional software engineering perspective, this is a solved problem. You run a DELETE FROM users WHERE id = 'me', maybe scrub some S3 buckets, and you’re compliant.
But what if your data was used to train a deep neural network?
A neural network doesn’t store data in a neat little table. It dissolves your data into a massive, distributed soup of floating-point weights and biases. When a user asks to be deleted, you can’t just DELETE a neuron. Their influence is baked into the entire model.
The Brute Force Solution
The naive way to handle this is straightforward:
- Delete the user’s data from your training dataset.
- Retrain the model from scratch on the remaining data.
This is the absolute gold standard. A model retrained from scratch literally never saw the deleted data.
The problem? It is computationally impossible to do this at scale. Imagine you are running a production facial recognition model trained on millions of images over weeks on a GPU cluster. If you get 50 deletion requests a week, you can’t retrain the model 50 times. The energy costs and compute time would bankrupt you.
Enter Machine Unlearning
This is where the concept of Machine Unlearning comes in. The holy grail of unlearning is to take a trained model and run a lightweight algorithm that updates the weights just enough so that it behaves exactly as if it had never seen the target data, without ruining the model’s performance on everyone else’s data.
For my thesis, I decided to tackle this problem head-on. But instead of testing it on boring, generic datasets, I wanted to focus on the domain where privacy matters most: Facial Recognition.
There is nothing more visceral than your literal face being used without your permission. If a user discovers their face is in an unauthorized model, the urgency to unlearn it is critical.
The First Roadblock
So, the plan is set: build a deep CNN facial identity classifier, simulate a continuous stream of users demanding their data be deleted, and test state-of-the-art machine unlearning algorithms to see if any of them actually work in reality.
There’s just one massive, glaring problem. To build a facial recognition system to test privacy-preserving algorithms… I need a massive dataset of people’s faces. And gathering a huge dataset of real people’s faces for privacy research is an absolute ethical and legal minefield.
How do you research privacy without violating privacy to get your data?
I’ve been banging my head against this for a week. I think I have a loophole, but I’m going to have to get creative with generative AI to pull it off. I’ll dive into that in the next log.