Working with models trained based on loss functions

Abstract

To provide a system for processing a model trained based on a loss function.SOLUTION: A system 100 comprises: a data interface 120 configured to access a model 030 and a training dataset 040 on which the model has been trained; a removal request interface 160 configured to receive a removal request message, the removal request message identifying one or more undesired training instances of the training dataset; and a processor subsystem 140 configured to make the model independent of the one or more undesired training instances.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] FIELD OF THEINVENTION The present invention relates to a system and corresponding computer-implemented method for processing a model trained based on a loss function, and further to a computer-readable medium including instructions for carrying out the method. [Background technology]

[0002] 2. Background of the Invention Wearable devices such as smart watches, fitness trackers and sensors attached to the body make it possible to measure and track different quantities of a user, for example physiological quantities such as heart rate or blood pressure, or other kinds of physical quantities such as position, speed, rotational speed, etc. Such measurements are then typically collected in a center and different services that exploit these measurements can be provided, for example activity records or sleep advice. Many of these services apply machine learning models to the information collected from the user, for example to recognize patterns or make predictions. A popular class of machine learning models is that of the so-called "Empirical Risk Minimization" (ERM) type of models, which are trained with a training data set by iteratively optimizing an objective function that includes a loss for each training instance, typically determined according to a non-linear loss function. Examples of this kind of models include neural networks or least squares models or logistic regression models. Apart from applying the model to the information collected from the user, the services usually also use this information to further refine the machine learning models and thus to improve their services. Also, in many other settings, machine learning models are trained with personal information, for example in medical image processing or facial recognition.

[0003] When a machine learning model is trained with a training dataset that includes personal information about a particular person, this means that the machine learning model depends on the personal information in the sense that the training would have resulted in a different model if this personal information had not been included in the dataset. In particular, the set of parameters of the trained model may be different. As a result, a model trained with personal information may provide a different model output than a model trained without personal information, even for at least one input instance to which the trained model may be applied. In some cases, it has been found that these differences make it possible to simply derive information about the individuals in the dataset from the trained model. This is a phenomenon known as "model inversion". More generally, since a trained model is effectively a function of the training dataset including their personal information, it would be desirable to be able to make the trained model substantially independent of the training instances in which they are involved, if the individuals included in the training dataset so wish. Indeed, in many settings, privacy regulations such as the European Union's General Data Protection Regulation (GDPR) or the U.S. Health Insurance Portability and Accountability Act (HIPPA) may require, to various degrees, that data subjects be able to control how much of their personal information can be used, for example to train machine learning models. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] "Privacy-preserving logistic regression" by K. Chaudhuri and C. Monteleoni (Advances in Neural Information Processing Systems, pp. 289-296, 2009) Summary of the Invention [Problem to be solved by the invention]

[0005] A known way to limit the dependence of the model output on any particular training record is by using differentially private perturbation techniques. Differential privacy is a mathematical framework that specifies the maximum amount of deviation to the model output due to the absence of any single training record. In the setting of ERM type models, particularly logistic regression models, K. Chaudhuri and C. Monteleoni, "Privacy-preserving logistic regression," Advances in Neural Information Processing Systems, pp. 289-296, 2009, proposes using an existing trained model and adding enough noise to its output to hide the effect of the presence of a single record. The added noise can thus make the model output largely independent of any single training record. [Means for solving the problem]

[0006] Summary of the Invention Adding noise to the model output of an ERM type model can make the model output more or less independent of a single training record, but doing so provides only statistical guarantees that may be at least partially negated by collecting many model outputs and canceling their noise. Furthermore, adding noise necessarily reduces the accuracy of the model output. Also, Chaudhuri's approach and differential privacy frameworks more generally are concerned with the influence of a single record on the model output, and therefore may not be able to adequately limit the dependence of the model output on multiple training records. Essentially, the more records the model needs to be made independent of, the more noise needs to be added, and therefore the more accuracy needs to be sacrificed. In effect, adding noise provides a trade-off, where making the model output more independent of the training records results in a less accurate model output being obtained. Furthermore, in Chaudhuri's approach, adding noise reduces the privacy impact of the model output, but the stored existing model is still a function of personal information, and thus model inversion may still be possible and / or may still represent personal information. For example, in various circumstances, applying noise to a model output may not be considered a sufficient measure to satisfy the right to be forgotten requirements arising from the GDPR and other similar privacy regulations.

[0007] In a first aspect of the invention, a system for processing a model trained on a loss function is proposed, as specified by claim 1. In another aspect of the invention, a corresponding computer-implemented method is proposed, as specified by claim 13. In an aspect of the invention, a computer-readable medium is provided, as specified by claim 15.

[0008] In various embodiments, a model trained based on a loss function may advantageously be made independent of one or more undesired training instances. This is done after the model is trained, and preferably also after the model is deployed. For example, a deployed model may initially depend on one or more undesired training instances, and may be made independent of these training instances when a deletion request message is received indicating one or more undesired training instances. By receiving and acting on the deletion request message, it is interesting to make the model independent of one or more specific training instances, and not have to make the model independent of any one training instance, which may be unknown. This is a way to, for example, avoid adding a large amount of noise to the model output.

[0009] Surprisingly, the inventors have envisaged that for this purpose, together with the trained model, the training dataset used to train the model may also be retained. Thus, when a deletion request occurs, a residual dataset may be determined by deleting the undesired training instances from the training dataset. An adapted model for the residual dataset may then be determined by initialising a set of parameters of the adapted model based on the parameters of the trained model, and iteratively adapting the set of parameters of the adapted model by optimising the losses of the instances of the residual dataset according to the model's loss function. Independently integrating the model from the undesired training instances may generally be referred to as "untraining" the model with respect to the undesired training instances.

[0010] By making the model independent from the specific training instance, and by doing so only when a delete request message for such specific instance is received, it is possible to allow the training instance to continue to be usable while possible, e.g. while the data subject has not revoked consent. Furthermore, by making the model independent from the specific training instance, it is possible to avoid, e.g. adding a general noise that is large enough to hide any specific training instance. Indeed, the parameters of the adapted model may be optimal for the objective function used to train the model, e.g. both before and after addressing the delete request message, and the model may be able to provide the model output with maximum accuracy, given the records on which the model output may be based. For example, the adapted model may correspond to the model obtained by training on the remaining dataset.

[0011] By optimizing the objective function on the residual data set, an adapted model may be obtained, which is interestingly independent of the one or more undesired training instances, in the sense that the parameters of the adapted model may be obtained by optimizing an objective function that is independent of the one or more undesired training instances. For example, a set of parameters may be obtained by training a model from scratch on the residual data set. In this sense, the one or more undesired training instances may be considered to be completely deleted from the trained model. Thus, after addressing the deletion request, the undesired training records may be considered to be erased from the training data set, from the trained model, and from the model output resulting from the application of the trained model. It is noted that the adaptation of the trained model does not have to be performed by the same party that applies the model to the input instances, and in particular, all parties that use the trained model do not have to have access to the training data set. For example, a system may be configured to respond to a deletion request message and may be configured to determine an adapted model in response to one or more deletion request messages and provide the adapted model to one or more other systems for applying the model to input instances. In such a case, the system that responds to the deletion request message may need access to the training dataset, whereas the system that obtains and applies the adapted model may not need such access. Thus, the disclosure of sensitive information may be limited, further improving security.

[0012] Interestingly, the deletion request message can be efficiently addressed by initializing the parameters of the adapted model based on the parameters of the trained model. For example, a complete retraining of the model based on the residual dataset can be avoided. As the present inventors have recognized, since a set of parameters of the trained model can be trained based on an objective function including the loss for each training instance, this set of parameters can be a relatively good initial guess for the optimization on the residual dataset. For example, this set of parameters itself or a value close to it, for example, a value obtained by adding a relatively small amount of noise, can be used as an initial guess for the optimization on the residual dataset. For example, the objective function can include the sum of the losses of each training instance. If a relatively small number of training instances are deleted, for example, a single instance, a maximum of 10, a maximum of 50, or a maximum of 1% of the training dataset or a maximum of 5% of the training dataset are deleted, the objective function for the residual dataset can mainly include a loss equivalent to the objective function for the original dataset. Therefore, the optimum of the objective function for the residual data set may be expected to be relatively close to the optimum of the objective function for the original training data set. As a result, relatively few iterations may be required to adapt the set of parameters. Such iterative adaptation of the parameters of the adaptive model is generally referred to as "iterative detraining" with respect to the undesired training instances.

[0013] In general, the delete request message may be sent for various reasons. For example, the delete request message may represent a lack of consent to continue using the training instance, e.g., a withdrawal of consent to use the training instance. This may be the case where the training instance contains personal information about a particular user. For example, the user himself may send the withdrawal of consent. Such a withdrawal of consent is sometimes known as a right to be forgotten request or a right to be erased request. The withdrawal of consent may be automatic, e.g., the user may provide conditional consent, e.g., a time-limited consent or consent that depends on other types of conditions, and / or the consent may be revoked by a party other than the user, e.g., another party with whom a data sharing agreement has been entered into. In these and other cases, the delete request message may be received from a consent management system, which is configured to send the delete request message upon detecting that consent to use the training instance from the training dataset is lost. Such a consent management system may be combined with the system for processing the model, e.g., in a single device.

[0014] However, the deletion request message may not necessarily represent a lack of consent to continue using the training instances. For example, in an anomaly detection system, it may be detected that the training instances represent adversarial instances, sometimes also referred to as harmful instances. For example, other parties may provide instances to tamper with the model, e.g., to maliciously perturb the decision boundaries of the model. In such cases, it may still be desirable to make the model independent of such adversarial instances. For example, an instance may be identified as outdated. In such cases, the accuracy of the model may be improved by making the model independent of the unwanted training instances. A model may be made independent of one or more training instances to enable deployment of the model in different locations, e.g., in different countries. For example, consent may not be given for one or more training instances to be processed in different locations, or it may be desirable to deploy different versions of the model in different locations, e.g., a free version and a paid version. In such cases, an adapted model for each location may be determined and provided to each one or more locations.

[0015] The techniques described herein can be used for various kinds of trained models. Of particular interest, the techniques described herein may be applied to non-linear trained models. In various embodiments, the trained model is a classifier, e.g., a model configured to classify input instances into one or more classes. For example, the model may be a binary classifier for two classes or a multi-class classifier for three or more classes. In various embodiments, the trained model is a regression model, e.g., a model configured to predict values ​​for one or more output quantities, e.g., real-valued outputs, given an input instance. In various embodiments, the trained model is an object detection model, e.g., a model configured to detect one or more objects in an input image, e.g., a model configured to output the location of a given type of object detected in the input instance. In various embodiments, the trained model is a segmentation model, e.g., a model configured to associate features of the input instance, e.g., pixels of the input image, to each class level. In various embodiments, the trained model is a generative model, e.g., a model configured to generate instances, e.g., images, based on a latent feature vector. The model may be, for example, a time series model for time series modelling or forecasting.

[0016] The techniques described herein are applicable to various types of data, particularly sensor data such as acoustic data, image data, video data, radar data, LiDAR data, ultrasonic data, motion data, thermal image data, or readings or histories of various individual sensors. For example, in various embodiments, sensor measurements may be obtained from one or more sensors via a sensor interface, such as from a camera, radar, LiDAR, ultrasonic sensor, motion sensor, or thermal sensor, or from various sensors measuring physiological parameters such as heart rate or blood pressure, or any combination. Based on these sensor measurements, an input instance to which a model is applied may be determined.

[0017] Apart from the embodiments generally shown, various additional embodiments are envisioned in which the techniques for processing models described herein may be advantageously applied.

[0018] In some embodiments, the model may be applied to a control system for controlling a computer-controlled machine, such as a robot, a vehicle, a household appliance, a power tool, a manufacturing machine, a personal assistant, an access control system, etc. The control system may be part of the computer-controlled machine or may be separate from the computer-controlled machine. For example, control signals may be determined by the control system based at least in part on the model outputs. As inputs, the model may obtain data representative of the state of the computer-controlled machine and / or the physical environment in which it operates.

[0019] The models may be applied in various systems for conveying information, for example in surveillance systems based on images of buildings or other objects under surveillance, or in medical imaging systems based on images of bodies or body parts, for example. The models may be used in optical quality inspection systems for manufacturing processes, for example to check for defects in manufactured objects, for example such defects may be detected from images of the manufactured objects.

[0020] In some embodiments, the model may be applied in an autonomous vehicle. For example, the input instances may include images of the vehicle's surroundings. For example, the model may be a classifier, e.g., for classifying traffic signs, a detection or segmentation model, e.g., for detecting or segmenting an image into regions representing pedestrians, road surfaces, other vehicles, etc., or a time series prediction model, e.g., for predicting human trajectories. In various cases, the model output may be used, at least in part, to control the autonomous vehicle, e.g., to operate the autonomous vehicle in a safe mode upon detecting an anomaly, e.g., a pedestrian suddenly crossing a road.

[0021] In some embodiments, the model may be applied in medical image analysis, such as medical image classification. For example, the model may be used to detect tumors or other medically relevant objects in images of a body or body part, such as MRI, CT or PET scans. Or, the model may be used to classify images into different medical conditions or other types of medical outcomes.

[0022] In some embodiments, models may be applied to signal processing of measurements from various external devices, e.g., IoT devices. For example, models may be applied to a stream of incoming sensor measurements from a device, e.g., to detect anomalies or other types of events.

[0023] In one embodiment, the model may be applied for predictive maintenance, for example to predict whether a component, such as a screen or battery, of a larger device, such as a car or medical device, needs to be replaced based on usage data, such as time series data.

[0024] In some embodiments, the model may be used in a system for training an autonomous device, such as a robot, to interact with a physical environment, e.g., in a model used to determine inputs to a reinforcement learning system, such as by imitation learning. For example, the model may be a feature extractor configured to determine input features for the reinforcement learning system.

[0025] In some embodiments, the models may be used to predict various measurable quantities of a physical system, e.g., a technical system. Such a system may include a device and the physical environment with which the device interacts. Typically, various technical systems have underlying physical models that are too complex to model explicitly. For example, a model predicting the emission values ​​or other physical quantities of a vehicle engine may depend on its input parameters, e.g., speed and load, or engine control unit (ECU) input parameters, in a complex, nonlinear manner.

[0026] Optionally, the training dataset may include multiple training instances collected from each user. The training instances may thus represent personal information about these users. The delete request message may indicate users whose training instances should be deleted from the training dataset. For example, records may be stored with associated user identifiers, the delete request message specifying the user identifiers. The delete request message may also indicate users by specifying the specific records of the users to be deleted. By allowing data associated with specific users to be deleted, it may be possible to appropriately handle right to erasure requests, also known as right to be forgotten requests, and / or users withdrawing consent. The delete request message may indicate data for multiple users.

[0027] Optionally, a user's training instances may include one or more sensor measurements of the user. For example, the measurements may be an image of the user, measurements of a physiological quantity of the user such as blood pressure or heart rate. The measurements may be the user's genome sequence, fingerprints, etc. The data may be measured using any suitable sensor. Because this type of measured data is inherently related to the user, it may be particularly privacy sensitive, and therefore it may be particularly desirable to be able to remove training instances that include such data from the dataset.

[0028] Optionally, the training instances of the user may be collected by receiving training instances from a user device. Such training instances may include sensor measurements of the user's physiological quantities, such as heart rate and / or blood pressure, by the user device. For example, the user device may be a smart watch, a smartphone, or other type of wearable device, a home medical measurement device, etc. The user device may provide the training instances as instances for which a model output is desired. For example, upon receiving the instance from the user device, a model may be applied to the instance and the model output may be provided to the user device, which is used as a training instance for refining the model at a later stage. Besides the training instances, a deletion request message may also be received from the user device itself, for example, a user may change a setting on the user device to revoke consent to the processing of the measurements of the user device. However, the deletion request message may also be sent by the user from another device, for example by logging into a user account that is also used by the user device.

[0029] Optionally, the trained model may include a feature extractor parameterized by a first set of parameters and a further trained model parameterized by a second set of parameters. The use of separate feature extractors is known per se in image classification, but also in various other machine learning tasks. For example, the VGG net trained by the Oxford Visual Geometry Group is in fact used as a feature extractor for various applications. In such a case, the feature extractor and the further trained model may be trained by different datasets. For example, the feature extractor may be a pre-trained feature extractor, e.g. trained by a relatively large dataset, and the trained model is obtained by taking the pre-trained feature extractor and simply training the further trained model. The feature extractor may be trained by a third party or may be provided as a service to the party applying the trained model, e.g. as part of the Google and Microsoft AI platforms. In various cases, one or more undesired training instances may not be included in the further dataset on which the feature extractor was trained. Thus, the trained model may be adapted by adapting the second set of parameters of the further trained model but not the first set of parameters of the feature extractor. Thus, the use of a separate feature extractor may be beneficial, including but not limited to, because it allows for optimization, e.g., to use a feature extractor that can be trained with a relatively large data set and that can be shared among multiple trained models.Indeed, alternatively, it may become possible to relatively easily update a trained model to remove unwanted training instances, e.g., fewer parameters need to be updated and only parts of the model need to be retrained, improving efficiency.

[0030] Optionally, in one, several or all iterations of adapting the set of parameters of the adaptive model, the adaptation may allow the use of a second derivative of the objective function with respect to the set of parameters of the adaptive model. For example, iterations of a second-order optimization method, such as Newton's method or a variant thereof, may be used to adapt the set of parameters. For example, the Hessian of the objective function may be calculated or at least estimated for the current set of parameters. Interestingly, since the set of parameters of the adaptive model may be initialized based on the set of parameters of the trained model, this initial estimate may already be relatively good, for example because the set is equal to or at least close to the set of parameters of the trained model. As the inventors have recognized, this may allow the use of second-order methods. Second-order methods may not work outside a relatively small region of the solution, but in such cases may converge faster than first-order methods, such as steepest descent methods.

[0031] Optionally, even if a quadratic method may be used in some iterations, a first-order method such as the steepest descent method may be used in other iterations. The best method for the situation at hand may be flexibly selected, for example by flexible switching between first-order and second-order optimization based on which one provides the best improvement to the objective function. Thus, the benefits of using second-order optimization, e.g. resulting from a good initial guess for the set of parameters, may also be obtained in other cases, if possible, for example when the second-order optimization turns out to be far from the optimal solution, and progress continues to be made towards determining an adapted model.

[0032] Optionally, when using quadratic optimization, diagonal noise may be added to the Hessian, making it positive semi-definite. This process, known as such in the art as Hessian damping, may be used to avoid problems with non-invertible Hessians and / or quadratic optimization away from the optimal solution. Note that Hessian damping does not necessarily involve explicitly computing the Hessian itself, e.g., the optimization may work with the inverse of the Hessian to which diagonal noise has been added. It is also possible to add a regularization term, e.g., an L2 regularization term, to the parameters. In effect, a regularization term with constant strength may be viewed as a way of adding diagonal noise of equivalent size to the diagonal of the Hessian.

[0033] Optionally, if the amount of diagonal noise to be added exceeds a certain threshold, the optimization may include applying one or more primary optimization iterations, such as steepest descent iterations, before attempting to perform the secondary optimization again. For example, the primary optimization iterations may be applied for one, two, at most or at least three, or at most or at least five iterations. This is done before the Hessian is determined again, and possibly then the secondary optimization iterations are performed again. In this way, the secondary optimization step may be avoided in situations that would give worse results than the primary optimization, for example, outside the vicinity of the optimum value of the objective function.

[0034] Optionally, the quadratic optimization may involve determining the product of the inverse of the Hessian for the objective function and the gradient of the objective function. This is the case, for example, in Newton iterations and variants thereof. In such cases, this product may be determined by minimizing a quadratic equation in the product and the Hessian, as known per se from Barak A. Pearlmutter, "Fast Exact Multiplication by the Hessian," Neural computation 6(1):147-160, 1994, incorporated herein by reference. Interestingly, in this way, storing and / or inverting the full Hessian may be avoided, improving the performance of the quadratic optimization iterations.

[0035] Optionally, the Hessian or its inverse used in the secondary optimization iterations may be approximated using a quasi-Newton method. In particular, in an iteration, an initial approximation of the Hessian or its inverse may be determined, and in subsequent iterations, the approximation to the Hessian or its inverse may be updated. This involves, for example, updating a set of parameters. Various quasi-Newton methods can also guarantee that the updated Hessian is positive semi-definite, and thus a secondary optimization step is effective to refine the set of parameters. Thus, such methods may avoid recalculating the Hessian for each iteration that requires it, thus further improving performance. Various quasi-Newton methods, such as BFGS and L-BFGS, are known per se in the art and may be applied here.

[0036] Optionally, the trained model may include a non-linear model, such as a neural network. This technique may be combined with various known neural network architectures, such as a convolutional neural network (CNN), a recurrent neural network (RNN), a network including fully connected layers, or any combination. A neural network is also known as an artificial neural network. In this case, the set of parameters may include weights of the nodes of the neural network. For example, the number of layers of the model may be at least 5 or at least 10, and the number of nodes and / or weights may be at least 10,000 or at least 100,000. Depending on the particular application, various known architectures may be used for neural networks and other types of machine-readable models. Other nonlinear models that include optimization objectives and can be applied in combination with the techniques in this application include various guided point Gaussian processes, which are known, for example, from Titsias, "Variational Model Selection for Sparse Gaussian Process Regression," Technical report, University of Manchester, 2009; Hensman, Fusi and Lawrence, "Gaussian Processes for Big Data," 2013, https: / / arxiv.org / abs / 1309.6835; and Salimbeni and Deisenroth, "Doubly Stochastic Variational Inference for Deep Gaussian Processes," https: / / arxiv.org / abs / 1705.08933, 2017 (these three papers are incorporated herein by reference). These nonlinear models typically have their parameter sets determined iteratively, and therefore it is particularly beneficial to iteratively determine an adaptive model based on a good initial estimate, as described herein.

[0037] Optionally, the trained model may include a neural network with multiple layers. In such a case, the adapted model may be determined by iterative adaptation of weights of only a subset of the layers of the neural network. In general, any subset may be selected, for example the last k layers or the first k layers for a given number k, all even layers, etc. By considering only a subset of these layers, the optimization performance can be significantly improved, and the optimum can subsequently be determined in relation to the remaining dataset that does not include the unwanted training instances.

[0038] Optionally, after determining the adapted model, a query instance may be obtained, and the adapted model may be applied to the query instance to obtain a model output independent of one or more undesired training instances. As discussed elsewhere, the adaptation of the model and the application of the model to the query instance may be performed by the same system or by different systems. Both adaptation and / or application may be performed multiple times, e.g., in an interleaved manner, where an application is performed at a time after the adaptation and another adaptation is performed at a time after the application. For example, the system may be configured to obtain multiple respective deletion request messages and / or model application messages and respond to these messages accordingly by adapting or applying the model. Optionally, the party determining the adapted model may have previously trained the model with a training dataset. In such a case, the party may store the training dataset along with the trained model, so that the deletion request message can be processed. Thus, potentially sensitive information in the training dataset may be stored local to the party performing the training and / or adaptation, whereas, for example, the original trained model and its adaptations may be provided to other parties for application to query instances.

[0039] Optionally, multiple deletion request messages may be received and acted upon in a single operation of determining an adaptive model. For example, multiple deletion request messages may be collected, for example, until a certain time window, advantageously a fairly short time window, for example, a time window of up to 1 minute or up to 30 minutes, has passed. Alternatively or additionally, multiple deletion request messages may be collected until a certain maximum amount, for example, up to 10, up to 100 or up to 1% or up to 2% of the training data set of unwanted training instances is reached, and / or until a certain maximum amount, for example, up to 5 or up to 50 messages, is received. By batching multiple deletion request messages accordingly, efficiency is improved. However, the total number of unwanted training instances processed is still advantageously kept relatively low, which ensures that the current set of parameters of the trained model provides a good estimate for the iterative determination of the adaptive model.

[0040] It will be apparent to those skilled in the art that two or more of the above-described embodiments, implementations and / or optional aspects of the invention may be combined in any manner deemed useful.

[0041] Corresponding modifications and variations of any system and / or any computer-readable medium corresponding to the described modifications and variations of the computer-implemented method can be performed by a person skilled in the art based on this description, and similarly for modifications and variations of the method or medium based on the described modifications and variations of the system.

[0042] These and other aspects of the invention will become apparent from and be elucidated with reference to the embodiments described by way of example in the following description and the accompanying drawings, in which: FIG. [Brief description of the drawings]

[0043] [Figure 1]1 illustrates a system for processing a model trained based on a loss function. [Diagram 2] 1 shows a detailed example of how to adapt a trained model to one or more undesirable training instances, and how to apply the adapted trained model to an input instance. [Diagram 3] 13 shows a detailed example of how to adapt a trained model that includes a feature extractor. [Figure 4] 1 illustrates a computer-implemented method for processing a trained model based on a loss function. [Diagram 5] 1 illustrates a computer readable medium containing data.

[0044] It should be noted that the drawings are purely schematic and are not drawn to scale, in which elements corresponding to elements already described may bear the same reference numbers. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0045] Detailed Description of the Embodiments FIG. 1 illustrates a system 100 for processing a model trained based on a loss function. The model may be configured to provide a model output given input instances. The model may be trained with a training dataset by iteratively optimizing an objective function. The objective function may include losses according to the loss function for each training instance of the training dataset. The system 100 may include a data interface 120 and a processor subsystem 140, which may communicate internally via a data communication 121. The data interface 120 may access a model 030 and a training dataset 040 on which the model was trained.

[0046] The processor subsystem 140 may be configured to access the data 030, 040 during operation of the system 100 and use of the data interface 120. For example, as shown in FIG. 1, the data interface 120 may provide access 122 to an external data storage 021 that may contain the data 030, 040 described above. Alternatively, the data 030, 040 may be accessed from an internal data storage that is part of the system 100. Alternatively, the data 030, 040 may be received over a network from another entity. In general, the data interface 120 may be in various forms, such as a network interface to a local or wide area network, e.g., the Internet, a storage interface to an internal or external data storage, etc. The data storage 021 may be in any known and suitable form.

[0047] The system 100 may also include a delete request interface 160 configured to receive a delete request message 124. The delete request message 124 may identify one or more undesired training instances of the training data set. The delete request interface 160 may be in internal communication with the processor subsystem 140 via data communication 123. The delete request interface 160 may be arranged to directly communicate with other systems, e.g., user devices, using, e.g., a USB, IEEE 1394, or similar interface, to receive the delete request message from those systems. The delete request interface 160 may communicate over a computer network, e.g., a wireless personal area network, the Internet, an intranet, a LAN, a WLAN, etc. For example, the delete request interface 160 may include a connector, e.g., a wireless connector, an Ethernet connector, a Wi-Fi, a 4G or 4G antenna, a ZigBee chip, etc., depending on the computer network. The drawing shows a deletion request message 124 received, for example via the Internet, from a smartwatch 070, which may be configured to measure one or more physiological quantities of the user using one or more sensors, for example the sensor 075 shown in the drawing. The system 100 may form a user data processing system together with one or more user devices 070 and / or other systems applying the model.

[0048] The delete request interface 160 may be an internal communication interface, such as a bus, an API, a storage interface, etc. For example, the system 100 may be part of a consent management system that ensures that consent is available for the training data set 040, where another part of the consent management system may send a delete request message to the system 100 described herein. As another example, the system 100 may be part of an anomaly detection system configured to detect and act on unwanted training instances, such as adversarial examples or other types of outliers, where in this case another part of the anomaly detection system may send a delete request message to the system 100 described herein.

[0049] The processor subsystem 140 may be configured to make the model independent of one or more undesired training instances upon receiving the deletion request message 124 during operation of the system 100 and use of the data interface 120. To make the model independent, the processor subsystem 140 may be configured to delete one or more undesired training instances from the training dataset to obtain a residual dataset and for an adapted model for the residual dataset. To determine an adapted model for the residual dataset, the processor subsystem 140 may be configured to initialize a set of parameters of the adapted model based on a set of parameters of the trained model and iteratively adapt the set of parameters of the adapted model by optimizing an objective function with respect to the residual dataset.

[0050] As an optional component, the system 100 may include an image input interface or any other type of input interface (not shown) for acquiring sensor data from a sensor such as a camera. The processor subsystem 140 may be configured to acquire input instances for the trained model based on the acquired sensor data and to apply the adaptive model to the acquired input instances. For example, the camera may be configured to capture image data, and the processor subsystem 140 may be configured to determine the input instances from the image data. The input interface may be configured for various types of sensor signals, such as video signals, radar / LiDAR signals, ultrasonic signals, etc. As an optional component, the system 100 may also include a display output interface or any other type of output interface (not shown) for outputting the output of the adaptive model for the input instances to a rendering device such as a display. For example, the display output interface may generate display data for the display, which renders the model output in a manner that can be sensorily perceived. This may be done, for example, as a visualization on a screen. As an optional component, the system 100 may also include an actuator interface (not shown) for providing actuator data to the actuators, which affect behavior in the system's environment based on model outputs determined for the input interface.

[0051] Various details and aspects of the operation of system 100, including optional aspects thereof, are further elucidated in conjunction with FIGS.

[0052] Generally, the system 100 may be embodied as or within a single device or apparatus, such as a workstation, e.g., a laptop or desktop based workstation, or a server. The device or apparatus may include one or more microprocessors executing appropriate software. For example, the processor subsystem may be embodied by a single central processing unit (CPU), but may also be embodied by a combination or system of such CPUs and / or other types of processing units. The software may be downloaded and / or stored in a corresponding memory, e.g., a volatile memory, e.g., a RAM, or a non-volatile memory, e.g., a flash memory. Optionally, the functional units of the system, e.g., the data interface and the processor subsystem, may be implemented in a device or apparatus in the form of programmable logic, e.g., a field programmable gate array (FPGA) and / or a graphics processing unit (GPU). Generally, each functional unit of the system may be implemented in the form of a circuit. It is noted that the system 100 may be distributed, e.g., including different devices or apparatus, e.g., distributed servers, and may be implemented in the form of cloud computing.

[0053] FIG. 2 shows a detailed, but non-limiting, example of how to adapt a trained model to one or more undesirable training instances and how to apply the adapted trained model to an input instance.

[0054] A trained model TM, 230 and a training dataset TD, 240 on which the model was trained are shown. The trained model may be configured to provide a model output given an input instance. The trained model may have been trained with the training dataset TD using techniques known from the art. The trained model TM and the training dataset TD may be determined as a residual dataset and a corresponding adaptive model, as described herein, for example by removing one or more prior undesired training instances from a previous dataset. The trained model TM may be a non-linear model, for example a neural network. In general, the trained model TM may be trained using supervised learning, for example a training dataset TD of training instances with associated desired outcomes of the trained model. For example, the trained model TM may be a regression model or a classification model. However, it is also possible that the trained model or at least a part of the trained model is trained using unsupervised learning, for example word2vec style embeddings, or self-supervised learning, for example image rotation prediction tasks. Such unsupervised and / or self-supervised modules can also be untrained using the techniques described in this application. For ease of explanation, the iterative untraining of a trained model TM trained by supervised learning is discussed. Several training instances TI1, 241; TIi, 242; TIj, 243 and TIn, 244 are illustrated. In general, the number of training instances may be, for example, at least or at most 10,000, at least or at most 100,000 or at least or at most 1,000,000.

[0055] Mathematically, the training of a model TM trained on a training data set TD may be formulated, in this case in a supervised learning setting, as follows:

number

number

number

number

number

[0056] In general, the training data set TD may include one or more sensor measurements of a user, e.g. images represented by pixels, features, etc., or measurements of different physiological quantities, e.g. in a time series.

[0057] The trained model TM may be trained with the training dataset TD based on a loss function. For example, the trained model TM may be an Empirical Risk Minimization (ERM) model. Examples of such models include regularized least squares regression models, logistic regression models, and various types of neural networks, such as deep neural networks and sparse deep / non-deep Gaussian process models. As shown, such models are typically parameterized by a set of parameters θ, such as the illustrated parameters PAR1,231 to PARk,232. For example, the set of parameters may be at most or at least 1000, at most or at least 10000, or at most or at least 100000.

[0058] For example, in this case, the trained model TM is a regression model, and the model output of the TM for an input instance x is expressed as f(x;θ). As another example, in this case, the trained model TM is a binary classification model, and the model output of the TM for an input instance x is expressed as

number

number

number

number

[0059] Note that in order to apply a trained model TM to input instances, it is typically not necessary to have access to the training dataset TD. For example, in the case of a non-kernelized SVM classifier, the model output in the form of predictions is

number

[0060] Interestingly, however, the training data set TD may still be stored or accessed together with the trained model to address a deletion request message. The figure shows a deletion request message RRM, 210. The deletion request message may indicate one or more unwanted training instances UTI, 245 of the training data set TD. For example, the illustrated deletion request message RRM indicates training instances TIi, 242 to TIj, 243. The unwanted training instances may be indicated in various forms, for example by including the instance in the message or by including an index in the message. As another example, the training data set TD may include multiple training instances collected from each user, and in this case the deletion request message RRM may indicate the user whose training instance should be deleted from the training data set TD, for example in the form of a user identifier.

[0061] Upon receiving a removal request message RRM, the trained model TM may be made independent of one or more undesired training instances UTI. For this purpose, in a removal operation REM, 220, one or more undesired training instances UTI are removed from the training dataset TD, thus obtaining a residual dataset. As shown in the figure, this operation is typically performed on the training dataset TD in-situ. However, it is also possible to create a copy of the training dataset without the undesired training instances.

[0062] Further, in a model adaptation operation MAD, 250, an adaptation model ATM, 260 for the remaining data set may be determined. Mathematically speaking, the unwanted training instances can be expressed as

number

number

[0063] Interestingly, to determine the parameters PAR*' of the adaptive model ATM, these parameters may first be initialized based on, e.g., set equal to, or equal to, the set of parameters PAR* of the original trained model TM, except for a small amount of added noise, etc. Then, the parameters PAR*' may be identical to those used to train the trained model TM, but now adapted iteratively by optimizing an objective function on the residual data set. For example, in terms of the above mathematical representation of the optimization, the parameters PAR*' of the adaptive model may be determined by θ opt ', and optimization:

number

[0064] In general, various methods of iterative adaptation of the set of parameters of the model are known per se in the art and are applicable to the present application. These are, for example, probabilistic approaches such as the stochastic gradient descent method. For example, the Adam optimizer disclosed in Kingma and Ba, Adam: A Method for Stochastic Optimization, available at https: / / arxiv.org / abs / 1412.6980 and incorporated herein by reference, can be used. As is known, and as also applied to the training of the original trained model TM, such optimization methods may be heuristic and / or may reach a local optimum. Training may be performed on an instance-by-instance basis or with batches of at most or at least 64 or at most or at least 256 instances. Various advantageous alternatives and extensions of the gradient descent type are described throughout. The iterative adaptation of the set of parameters PAR*' may involve performing up to a predefined number of iterations and / or terminating the iterative adaptation based on a stopping condition, for example if the change in the objective function is less than a predefined threshold in one or more subsequent iterations, or this may involve using other stopping conditions known per se. In some cases, the use of first-order optimization may be advantageous because, for example, it generally requires less memory than second-order optimization methods.

[0065] Interestingly, the inventors have recognized that the iterative adaptation of the set of parameters PAR*' can be improved by using a second derivative with respect to the objective function in the iterations of the iterative adaptation of the set of parameters of the adapted model. In general, the use of a second derivative in the optimization may be referred to as a second-order optimization, as opposed to a first-order optimization such as a steepest descent method that does not use a second-order derivative. In particular, the use of a second-order optimization method may be particularly effective, since a good initial estimate of the set of parameters PAR*' can be obtained based on the set of parameters PAR* of the original trained model. The second derivative may be evaluated at every iteration, but it is also possible to keep track of the second derivative using a quasi-Newton method, as described below.

[0066] In general, during iterative optimization, primary and secondary optimization steps may be combined, e.g., in one or more iterations a primary optimization step may be applied, while in one or more other iterations a secondary optimization step may be applied. By selecting an appropriate optimization step for each iteration, the overall efficiency of the optimization may be improved. In fact, it may not even be possible to reach the optimum with only the secondary optimization step, e.g., if the initial guess for the set of parameters PAR*' is not sufficiently accurate, in which case additionally performing one or more primary optimization steps may help to reach the optimum completely. In a particularly advantageous embodiment, a secondary optimization step may be performed if it is expected to provide significantly better results than the primary optimization step, e.g., if sufficient conditions for the secondary optimization step that improve the objective function are met and / or if sufficient conditions are met indicating that the secondary step can provide significantly better results than the primary step. One or more primary optimization steps may be performed in other manners. For example, the check of sufficient conditions may be performed earlier than the execution of the secondary iteration itself, in which case a certain performance improvement may be realized. Various examples are presented throughout.

[0067] In particular, a Newton iteration step may be used to update the set of parameters at some or all of the iterations. In particular, in terms of the mathematical formulation presented above, by the definition of first-order optimization:

number

number

number

[0068] In some exceptional cases, the above equations may converge in a single step from an initial set of parameters, e.g., θ opt ~θ opt For example, this is θ opt It may be the case that R'(θ) is quadratic in θ, for example when the approximation of R'(θ) through the first two terms of a Taylor series expansion is accurate. However, in many cases the optimum is not reached by performing a single iteration, and therefore multiple iterations may be performed to reach such an optimum, for example a local optimum, of the objective function. For example, multiple successive Newton steps may be performed. Each step size for the Newton iterations may be determined, for example, via the Wolfe or Goldstein conditions, which are known per se.

[0069] In at least one secondary iteration, the Hessian may not be positive definite. As a result, the Hessian may not be invertible, or the Hessian may be invertible but the secondary iterations may move away from the optimum for the objective function. In general, this is due to the fact that the optimal θ opt ', the set of parameters of the adaptive model is initialized to the values ​​θ opt To counter this, in one or more secondary optimization iterations, diagonal noise may be added to the Hessian, for example by a process known per se as Hessian damping. For example, when Hessian damping is applied, increasing amounts of diagonal noise may be added to the Hessian, e.g., H=H+τI, where

number

[0070] Interestingly, the inventors have realized that it may not be necessary to check for positive definiteness via a Cholesky decomposition, as is sometimes done in the art, to determine the amount of diagonal noise to be added to the Hessian. This type of positive definiteness check can be done in O(nd 3 ) worst case time complexity, where d is the number of parameters of the model and n is the number of training instances. As the inventors have recognized, this performance penalty can be offset by, for example, checking whether the quadratic optimization leads to a descent direction of the objective function, e.g., in the case of Newton iterations,

number

[0071] In some embodiments, after determining the Hessian for the objective function with respect to a set of parameters PAR*', the amount of diagonal noise required to make the Hessian positive definite may be determined. For example, a sufficient condition for positive definiteness, such as one of the conditions described above, may be used to check whether the amount of noise is sufficient. If the amount of diagonal noise to be added exceeds a threshold, the set of parameters PAR*' may be adapted using a first-order optimization method in one or more iterations. This may be, for example, a steepest descent method, optionally with a suitable step size selection mechanism such as a line search. For example, checking whether the amount of diagonal noise exceeds a threshold may include checking whether the amount of diagonal noise is greater than a fixed threshold, which may be, for example, 10 or 100 times the sum of each row of the Hessian. Thus, for example, the use of a second-order method may be avoided in settings where it may lead the optimization in a counterproductive direction when relatively far from a local optimum, and instead a first-order method may be used in this case. The Hessian may then again be determined based thereon, eg, a secondary optimization step may be applied if possible.

[0072] Various quadratic optimization methods, such as Newton iteration, may involve computing and inverting the Hessian matrix. Using known algorithms, this can be done in O(Nd 3 ) operation, where d is the number of rows and columns of the Hessian matrix, e.g., the size of the vector θ. As the inventors have recognized, this may be undesirable in setting up the determination of an adaptive model for the residual data set, since the set of parameters PAR*' may be quite large, e.g., at least 100,000, at least 1 million, or even at least 10 million.

[0073] Interestingly, in various embodiments, the product of the inverse Hessian with respect to the objective function and the gradient of the objective function may be determined by minimizing a quadratic equation in the product and the Hessian, as used, for example, in Newton iterations. Thus, the computation time is O(nd 3 ) time complexity may be reduced to about O(ndm), where m≪d. This is particularly beneficial in the current setting where the number of parameters is relatively large. For example, the conjugate gradient Hessian vector multiplication method disclosed in Barak Pearlmutter, “Fast exact multiplication by the Hessian,” Neural Computation, 6(1):147-160, 1994 (incorporated herein by reference in so far as this technique is concerned). In various embodiments, for example, the product of the inverse of the Hessian with the gradient vector used in the Newton iteration may be estimated probabilistically, which is known per se, for example from P. Koh and P. Liang, “Understanding black-box predictions via influence functions,” Proceedings of ICML 2017 (section 3 of Probabilistic Hessian Estimation is incorporated herein by reference). Also, stochastic Hessian estimation can significantly improve performance, for example, by allowing the iterations to be performed in O(nd) time.

[0074] In various embodiments, the Hessian matrix or its inverse for use in the secondary iteration may be determined by estimating it using a quasi-Newton method. In such a case, in an iteration, a current approximation of the Hessian matrix may be estimated by adapting a previous approximation of the Hessian matrix, or similarly for its inverse. Various such methods, e.g. BFGS or L-BFGS, are known per se and may be applied.

[0075] In various embodiments, the adapted model for the remaining data set may be determined by iterative adaptation of only a subset of the set of parameters of the adapted model ATM. For example, other parameters, including parameters originally trained in the trained model including the undesired training instance, may be copied from the original trained model TM. In particular, in the case of a neural network with multiple layers, weights of only a subset of the layers of the neural network may be adapted in the optimization. Interestingly, the undesired training instance UTI may then be considered to have been sufficiently deleted. Also, the optimization problem may be solved quite efficiently by optimizing only a subset of the set of parameters.

[0076] As shown, once the adaptation model ATM is determined, a model application operation MAP, 280 may be used to apply the adaptation model ATM to the input instance II, 270, resulting in a model output MO, 290. For example, the model application MAP may be performed by the same system that determined the adaptation model, or by another system that obtains the adaptation model. Interestingly, the model output MO may be considered independent of the undesired training instances UTI, at least in the sense that its set of parameters PAR*' may represent an optimum of an objective function defined on the residual data set from which the undesired training instances UTI have been removed. Furthermore, the residual data set itself and the adaptation model ATM may also be considered independent of the undesired training instances UTI in this sense. Thus, a suitable way of dealing with the removal request message RRM is shown.

[0077] Fig. 3 shows a detailed but non-limiting example of a method for adapting a trained model including a feature extractor. This example may be based on the example of Fig. 2. A trained model TM, 330 is shown, which is configured to provide a model output, taking into account input instances. The trained model TM may be trained with a training dataset TD by iterative optimization of an objective function including respective losses according to the loss function of each training instance of the training dataset. For example, training instances TI1, 341; TIi, 342; TIj, 343 and TIn, 344 are shown. As in Fig. 2, one or more training instances may be identified as undesirable training instances from which the trained model TM should be made independent. By way of example, the figure shows training instances TIi and TIj identified as undesirable training instances UTI, 345. A model adaptation operation MAD, 350 may therefore be performed to determine an adapted model ATM, 360 for a residual dataset obtained by removing the undesirable training instances UTI from the training dataset TD.

[0078] Interestingly, in the illustrated example, the trained model TM may include a feature extractor FX, 334 parameterized by a first set of parameters FPAR1, 338 to FPARi, 339. Furthermore, the trained model TM may include a further trained model FTM, 333 parameterized by a second set of parameters PAR1, 331 to PARk, 332. Thus, the trained model TM may be applied to a query instance by applying the feature extractor FX to the query instance to obtain a feature representation of the query instance, and by applying the further trained model FTM to the feature representation to obtain a model output.

[0079] The further trained model FTM may be trained with a training data set TD that includes the undesirable training instances UTI. The trained model TM trained based on a loss function may in such an example refer to at least the further trained model FTM trained based on a loss function, for example by iteratively updating an objective function that includes respective losses according to the loss function for the training instances of the training data set, the input to the further trained model FTM in this case being provided by the feature extractor FX.

[0080] Interestingly, however, the feature extractor FX may be trained with a further data set (not shown) that does not include the undesired training instances. For example, the feature extractor may be a pre-trained feature extractor obtained, for example, from a third party. Although in this figure the feature extractor is shown as including a set of parameters, it will be understood that the feature extractor FX may be an external feature extractor accessed, for example, via an API of a machine learning framework, such as, for example, the Google AI Platform or the Microsoft AI Platform. In general, the feature extractor FX may be shared between multiple trained models. The feature extractor FX may be trained, for example, with a relatively large data set of publicly available data, whereas the further trained model FTM may be trained with a relatively small data set. For example, the feature extractor may be the Oxford University VGG network or a similar commonly pre-trained model. The feature extractor may be trained using a loss function, although this is not required and various other methods of training a feature extractor known in the art may be used, or may be used by a third party to train the feature extractor FX.

[0081] Interestingly, using a general feature extractor FX trained with a relatively large data set may allow a relatively small data set to be sufficient for training the further trained model FTM. For example, the training data set TD may include at most 100, at most 1000 or at most 10000 training instances. On the other hand, the training data set of the feature extractor may include at least 100000 or at least 1000000 training instances, for example. Although using a relatively small data set to train the further trained model may be beneficial in terms of performance and data collection effort, this may make it particularly important to deal appropriately with deletion request messages, since, for example, a single instance of the training data set TD may have a relatively large impact on the parameters PAR* and / or the model output of the further trained model FTM.

[0082] When determining the adaptation model ATM, the parameters FPAR* of the feature extractor FX may be kept unchanged. For example, as shown in the figure, the adaptation model ATM may include a feature extractor FX equivalent to the trained model TM, and the set of parameters PAR1,...,PARi of the feature extractor of the trained model may be used. For example, in some cases, the trained model TM may be adapted on the fly and no adaptation is required for this part of the trained model. Subsequently, this part of the model may be independent of the undesired training instances UTI.

[0083] However, as shown, the adaptation of the trained model TM may include the adaptation of the further trained model FTM, whereby an adapted further trained model FTM', 363 is obtained. The parameters PAR1', 361 to PARk', 362 of the further trained model FTM' of the adaptation model ATM are shown in the figure. These parameters may be adapted as described for the trained model of FIG. 2. For example, the parameters PAR*' may be initialized, for example, based on the set of parameters PAR* from the trained model TM as is done in FIG. 2. In this case, the set of parameters PAR*' of the further trained model FTM' may be iteratively adapted by optimizing an objective function on a residual dataset obtained by deleting the undesired training instances UTI from the training dataset TD. The various techniques for optimizing the objective function discussed for FIG. 2 may be applied here. Interestingly, the further trained model FTM may be smaller than a fully trained model for the same task and / or may have been trained with a relatively small dataset. As a result, iterative optimization iterations may be faster and fewer iterations may be required to reach the optimum, thus improving performance while still determining a model that is independent of undesired training instances UTI.

[0084] Although not shown, the adapted trained model ATM may be applied to the query instance by applying a feature extractor FX of the adapted trained model ATM, e.g. the original feature extractor FX of the trained model TM, to the query instance to obtain a feature representation of the query instance, and further by applying an adapted further trained model FTM′ to the feature representation to obtain a model output.

[0085] FIG. 4 illustrates a block diagram of a computer-implemented method 400 for processing a trained model based on a loss function. The model is configured to provide a model output given input instances. The model may be trained with a training data set by iterative optimization of an objective function. The objective function may include respective losses according to the loss function for each training instance of the training data set. Method 400 may correspond to the operation of system 100 of FIG. 1. However, this is not a limitation and method 400 may be performed using other systems, apparatus, or devices.

[0086] The method 400 may include accessing 410 the model and the training data set on which the model was trained, in an operation referred to as "ACCESSING MODEL, TRAINING DATA."

[0087] The method 400 may further include receiving 420 a removal request message in an operation referred to as "RECEIVING REMOVAL REQUEST MESSAGE." The removal request message may identify one or more undesired training instances in the training data set.

[0088] Method 400 may further include, upon receiving the removal request message, making the model independent from the one or more undesired training instances. To make the model independent from the one or more undesired training instances, method 400 may include removing 430 the one or more undesired training instances from the training dataset to obtain a remaining dataset in an operation referred to as "REMOVING UNDESIRED TRAINING INSTANCES."

[0089] To make the models independent, the method 400 may further include determining 440 an adapted model for the residual dataset in an operation referred to as "DETERMINING ADAPTED MODEL." To determine the adapted model, the method 400 may further include initializing 442 a set of parameters of the adapted model based on a set of parameters of the trained model in an operation referred to as "INITIALIZING PARAMETERS." To determine the adapted model, the method 400 may further include iteratively adapting 444 a set of parameters of the adapted model by optimizing an objective function for the residual dataset in an operation referred to as "ITERATIVELY ADAPTING WITH RESPECT TO REMAINDER DATASET."

[0090] Generally, the operations of method 400 of FIG. 4 may be performed in any suitable order, such as sequentially, simultaneously, or any combination thereof, and where applicable, may follow a particular order necessitated by, for example, input / output relationships.

[0091] The method may be implemented on a computer as a computer-implemented method, as dedicated hardware, or as a combination of both. Also, as shown in Fig. 5, instructions for the computer, e.g. executable code, may be stored on a computer readable medium 500, e.g. in the form of a series of machine-readable physical marks 510 and / or as a series of elements having different electrical, e.g. magnetic or optical properties or values. The executable code may be stored temporarily or non-temporarily. Examples of computer readable media include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Fig. 5 shows an optical disk 500.

[0092] Examples, embodiments, or optional features, whether or not indicated as non-limiting, should not be understood as limiting the claimed invention.

[0093] It should be noted that the above embodiments are illustrative rather than limiting of the invention, and that a person skilled in the art could design many alternative embodiments without departing from the scope of the appended claims. In the claims, reference signs placed between parentheses shall not be construed as limiting the scope of the claims. The verb "comprise" and its conjugations do not exclude the presence of elements or steps other than those stated in the claims. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. An expression such as "at least one" when preceding a list or group of elements denotes the selection of all or any subset of the elements from the list or group. For example, the expression "at least one of A, B, and C" is to be understood as including A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

1. A system (100) for processing a model trained based on a loss function, comprising: the model is configured to provide a model output given input instances, the model being trained with a training dataset by iteratively optimizing an objective function, the objective function including a respective loss according to the loss function for each training instance of the training dataset; The system comprises: a data interface (120) configured to access the model (030) and a training data set (040) on which the model was trained; a deletion request interface (160) configured to receive a deletion request message identifying one or more unwanted training instances of the training data set; a processor subsystem (140) configured to, upon receipt of the deletion request message, render the model independent of the one or more unwanted training instances; wherein the independent - removing the one or more unwanted training instances from the training dataset to obtain a residual dataset; - determining an adapted model for the residual data set; and said determination is made by: - initializing a set of parameters of the adapted model based on a set of parameters of the trained model; - iteratively adapting the set of parameters of the adapted model by optimizing the objective function with respect to the residual data set; It is carried out by the processor subsystem (140) is configured to determine, in an iteration of the iterative adaptation of the set of parameters of the adaptive model, one or more second derivatives with respect to the objective function with respect to the set of parameters, the adaptation of the set of parameters being based on the determined second derivatives; the processor subsystem (140) is configured to adapt the set of parameters using a linear optimization method in further iterations of the iterative adaptation of the set of parameters of the adaptive model. A system (100) for processing a model trained based on a loss function.

2. the training dataset includes a plurality of training instances collected from each user, and the deletion request message indicates a user whose training instance should be deleted from the training dataset. The system (100) of claim 1.

3. A user's training instance includes one or more sensor measurements, e.g., images, of said user. The system (100) of claim 2.

4. The processor subsystem (140) is further configured to collect workout instances of the user by receiving the workout instances from a user device, the workout instances including sensor measurements by the user device of physiological quantities of the user. The system (100) of claim 3.

5. the trained model includes a feature extractor parameterized by a first set of parameters and a further trained model parameterized by a second set of parameters, the feature extractor being trained with a further data set not including the undesired training instances, and the processor subsystem (140) is configured to determine the adapted model by adapting the second set of parameters. The system (100) of any one of claims 1 to 4.

6. The processor subsystem (140) determining an amount of diagonal noise to be added to make the Hessian for the objective function for the set of parameters positive definite; If the amount of diagonal noise to be added exceeds a threshold, adapting the set of parameters in one or more iterations using the linear optimization method. [0023] The system (100) of any one of claims 1 to 5.

7. the processor subsystem (140) is configured to determine a product of an inverse Hessian for the objective function and a gradient of the objective function, the determining being performed by minimizing a quadratic equation in the product and the Hessian; The system (100) of any one of claims 1 to 6.

8. the processor subsystem (140) is configured to approximate the Hessian matrix or the inverse of the Hessian matrix using a quasi-Newton method; The system (100) of any one of claims 1 to 7.

9. The trained model includes a non-linear model, e.g., a neural network. The system (100) of any one of claims 1 to 8.

10. the trained model includes a neural network including a plurality of layers, and the processor subsystem (140) is configured to iteratively adapt the set of parameters of the adapted model by iterative adaptation of weights of only a subset of the plurality of layers of the neural network. The system (100) of any one of claims 1 to 9.

11. 1. A computer-implemented method (400) for processing a trained model based on a loss function, comprising: the model is configured to provide a model output given input instances, the model being trained with a training dataset by iteratively optimizing an objective function, the objective function including a respective loss according to the loss function for each training instance of the training dataset; The method comprises: Accessing (410) the model and the training data set on which the model was trained; Receiving a deletion request message (420) identifying one or more undesired training instances of the training data set; - upon receiving the deletion request message, making the model independent from the one or more unwanted training instances; wherein the independent - removing (430) the one or more unwanted training instances from the training dataset to obtain a residual dataset; - determining (440) an adapted model for the residual dataset; and said determination is made by: Initializing a set of parameters of the adapted model based on a set of parameters of the trained model (442); - iteratively adapting (444) the set of parameters of the adapted model by optimizing the objective function with respect to the residual data set; It is carried out by The method comprises: determining, in an iteration of the iterative adaptation of the set of parameters of the adaptive model, one or more second derivatives with respect to the objective function with respect to the set of parameters, wherein the adaptation of the set of parameters is based on the determined second derivatives; in a further iteration of the iterative adaptation of the set of parameters of the adapted model, adapting the set of parameters using a linear optimization method; Further comprising: A computer-implemented method (400).

12. obtaining a query instance; and applying the adapted model to the query instance to obtain a model output independent of the one or more undesired training instances.

12. The method (400) of claim 11.

13. A computer-readable medium (500) comprising transitory or non-transitory data (510) representing instructions that, when executed by a processor system, cause the processor system to perform a computer-implemented method according to claim 11 or 12.

Images