MSc Project: Unlearning Framework

The core implementation for my MSc project is a dual-head ResNet-18 evaluation framework built specifically to measure machine unlearning at the identity level.

Instead of treating unlearning as a simple classification problem, this framework models a strict GDPR “right to be forgotten” scenario. The model is trained on 750 synthetic identity clusters (SFHQ-VirtualID) and tested across a 15-step sequential deletion protocol, removing 5 identities per step.

The Dual-Head Architecture

To prevent structural degeneracy in the testing phase (where a model could “cheat” by just destroying its own feature extraction capabilities), the framework uses a dual-head approach.

graph TD
    Input["Input Image 224x224"] --> RN18["ResNet-18 Backbone"]
    RN18 --> Pool["AdaptiveAvgPool2d"]
    Pool --> Features["512-d Feature Vector"]
    
    Features --> IDHead["Primary Head: 750-class Identity"]
    Features --> AgeHead["Secondary Head: 4-class Age Group"]
    
    IDHead --> LossID["L_id Loss"]
    AgeHead --> LossAge["L_age Loss"]
    
    LossID --> TotalLoss["Total Loss = L_id + λ * L_age"]
    LossAge --> TotalLoss

The unlearning target is twofold: the model must completely fail to recognize the deleted person’s identity, while simultaneously forgetting their age group—proving the attribute-level features have been scrambled, not just the final classification boundary.

Training & Evaluation Pipeline

The entire system is orchestrated via Slurm for parallel execution on HPC clusters. Training uses a joint loss function with Automatic Mixed Precision (AMP) on CUDA for maximum throughput across the 15 deletion stages.

The Unlearning Fidelity Metric

The evaluation suite doesn’t just look at accuracy drops; it implements a composite unlearning fidelity metric.

flowchart LR
    Start["Model Unlearns Identity"] --> Check1{"Holdout Probe >= 30%?"}
    Check1 -- Yes --> Check2{"Forget Accuracy <= 15%?"}
    Check1 -- No --> Fail["Catastrophic Forgetting"]
    
    Check2 -- Yes --> Check3{"MIA AUC Suppressed?"}
    Check2 -- No --> Fail2["Failed to Forget"]
    
    Check3 -- Yes --> Pass["True Unlearning"]
    Check3 -- No --> Fail3["Vulnerable to MIA"]
  1. Threshold Membership Inference Attacks (MIA): Validates if the model leaks whether an image was in the training set.
  2. Forget-Class Erasure: Hard threshold ensuring the target identity accuracy drops below 15%.
  3. Holdout Probe: Ensures the model retains baseline functionality on the remaining 745 identities (must stay above 30%).

I integrated and ablated several state-of-the-art unlearning methods (like AdaptiForget and MSG-KD) against naive baselines (Fine-Tuning, Gradient Ascent) to provide a clean, empirical ranking of what actually works for identity-level deletion.