Methods and systems for vertical machine unlearning

Abstract

A computer-implemented method for machine unlearning (ML) in vertical federated learning (VFL) is provided The method includes receiving a request to unlearn a first party having a first machine learning (ML) model, wherein the request is received by a second party having a second ML model trained using at least the one or more embeddings of the first party. The method includes initializing, in response to the unlearn request, a third ML model. The method includes generating modified input data by removing the one or more embeddings of the first party and / or any intermediate representations relating to the first party from an existing dataset comprising embeddings received from a plurality of parties. The method includes training the third ML model using the modified input data. Based on a need for unlearning of particular information, machine learning (ML) models are re-trained without using the information.

Description

METHODS AND SYSTEMS FOR VERTICAL MACHINE UNLEARNINGTECHNICAL FIELD

[0001] Disclosed are embodiments related to machine learning and unlearning, and in particular, machine learning and unlearning with respect to federated models and telecommunications networks.BACKGROUND

[0002] Federated learning is a machine learning (ML) technique in which models are trained in a distributed learning environment, for instance, using the local data of multiple edge devices. In some cases, only the updates or outputs of the local model(s), and not the underlying training data itself, is sent to a central location. In this respect, federated learning can allow ML models to learn without directly accessing private data, while approximating the performance of centralized training.

[0003] Federated learning can occur in various forms. For example, Vertical Federated Learning (VFL) is a method for learning machine learning models collaboratively. Unlike Horizontal Federated Learning (HFL), there is typically no common model that is aggregated by a parameter server, but instead there are multiple models usually referred as “heads”, that contain different input features and one or more tail models which use the output of the head models to produce the final output of the inference process. As such, the model is split and the model architecture of each participant (or each head) is never revealed. In addition, VFL architecture allows the participants to have a different feature space. This is unlike HFL which typically mandates that every participant has the same features. Since input features are local to each head node, they are not revealed during the training process. These properties (concealing input features and model architecture) have made VFL desirable in the context of 3rd Generation Partnership Project (3GPP), and it is currently standardized in rel-19 as part of the Network Data Analytics Function (NWDAF), and as an extension to HFL.

[0004] Machine learning operations (MLOps) can include many sub-operations performed for ML model maintenance starting from its initialization, training, hyper-parameter tuning, and then further adapting to changes, e.g., data drift, concept drift, to sustain model efficacy. For instance, after a model is trained, a re-training step may be warranted when a subset of data that was used in training needs to be removed. A subset of data may need to be removed from the training dataset for several reasons, such as due to model performance drop, e.g., data drift, conceptdrift, change in environmental, regional or governmental regulations, the data containing sensitive or private information, e.g., may be including sensitive data from end-users, or changes in business related incentives for training a joint model with potentially competitive entities. Machine unlearning is an area of machine learning that studies how ML models “forget” certain information in the interest of preserving privacy e.g., in the case where a machine learning has learned something sensitive that a user has requested to be removed. Additionally, unlearning can be used to rectify errors that originally existed in the training dataset such as faulty or erroneous data, to eliminate bias in machine learning models and last but not least to combat any potential overfitting that may have incurred while training a machine learning model.

[0005] Machine unlearning may be of particular interest with respect to telecommunications due to increasing levels of liability and corresponding strictness in data protection regulations. For example, it may not be desirable or allowed to deploy a ML model that is trained on a dataset collected from a plurality of network operators to serve for a particular operator. In that case, the ownership of a ML model is not well-defined, and it is non-trivial to pinpoint underlying reasons if a ML model under-performs than expected. Similarly, a base station node may consist of different network elements from different vendors, e.g., antenna and radio units from one vendor, while the baseband and power supplier unit from another. A joint model trained on dataset collected from products of different vendors may also create similar challenges with respect to business sensitivity, as well as model ownership and responsibility.

[0006] In “Machine Unlearning: A Survey” by Xu et al. (ACM Computing Surveys,Volume 56, Issue 1, 2023), the authors provide an overview of various machine unlearning approaches. In particular, they consider two categories of technique - data reorganization and model manipulation. Data reorganization focuses on reorganizing data in a certain way that forces the model to acknowledge some parts and discard others. As such, data reorganization-related techniques may necessitate access to the dataset that is used to train the machine learning model, which is often an issue since data retention policies typically do not permit the storage of any data for prolonged periods of time. Model manipulation techniques on the other hand side may only require access to the trained model where the unlearning process is to be applied.

[0007] Certain aspects of unlearning in HFL are described in Greece ProvisionalApplication No. 20230100946 and Application No. 20230100709. However, HFL proposes a different setting than VFL where one has to learn the contribution of each participant towards anaggregated model, and then unlearn that. In VFL there is no single aggregated model, and as such, these HFL approaches do not necessarily apply in VFL. Some aspects of unlearning in VFL are described in “Efficient Vertical Federated Unlearning via Fast Retraining” by Wang et al. (ACM Transactions on Internet Technology, Volume 24, Issue 2, 2024). There, the authors propose an approach that maintains several “bottom models” per participant and checkpoints for the training process stored server-side to alleviate the needed of reaching back to the users during the unlearning process. When a user requests for a feature to be unlearned first the feature is deleted from the participants dataset, then the corresponding “bottom model” is re-initialized and trained from scratch together with checkpoints from the other bottom models. However, the retraining algorithm requires extensive communication with the participating parties, which can lead to bandwidth bottleneck among other issues.

[0008] Certain aspects of unlearning in VFL are described in “Vertical FederatedUnlearning on the Logistic Regression Model,” July 2023, Electronics 12(14):3182, DOI: 10.3390 / electronicsl2143182. The authors here perform unlearning on a logistic regression model, which is much simpler than a neural network. The machine learning models, including neural networks, are the focus of the embodiments disclosed herein, as they generally outperform logistic regression since they are more powerful approximators. In addition, the authors recognize the challenge in their work of how to determine the constraint (labelled with lambda) for the intermedia parameters to achieve unlearning.

[0009] There remains a need for improved techniques for vertical machine unlearning.SUMMARY

[0010] There currently exist certain challenges. For example, unlearning with current techniques may require accessing the original dataset, even in the case where unlearning needs to take place for all features of a given client. This access can be problematic because clients may no longer have such data or because they may not be available to participate in the process. Moreover, machine unlearning approaches known from HFL such as knowledge distillation cannot be applied directly to VFL - in VFL there is no single model to consider for distillation purposes nor the same feature space. Another limitation is that there is currently no support for unlearning specific samples across different participants. Certain aspects of the disclosure and their embodiments may provide solutions to these or other challenges

[0011] According to a first aspect, a computer-implemented method for machine unlearning in vertical federated learning (VFL) is provided. The method includes receiving a request to unlearn a first party having a first machine learning (ML) model, wherein the request is received by a second party having a second ML model trained using at least the one or more embeddings of the first party. The method includes initializing, in response to the unlearn request, a third ML model. The method includes generating modified input data by removing the one or more embeddings of the first party and / or any intermediate representations relating to the first party from an existing dataset comprising embeddings received from a plurality of parties. The method includes training the third ML model using the modified input data.

[0012] In some embodiments, training the third ML model includes generating initial predictions using the second ML model and the existing dataset; generating updated predictions using the third ML model and the modified input data; and determining a total loss based at least in part on the initial predictions and the updated predictions.

[0013] In some embodiments, determining the total loss is based on a sum of a prediction loss and a distillation loss. In some embodiments, the first party is a passive party; the second party is an active party; the first ML model is a head model; the second ML model is a tail model; the one or more embeddings result from a forward pass of the first ML model; and / or the second ML model is a teacher model and the third ML model is a student model.

[0014] In some embodiments, the first ML model and the second ML model are each part of the VFL. In some embodiments, training the third ML model comprises updating the third ML model. In some embodiments, the method includes retrieving the existing dataset. In some embodiments, the existing dataset is a concatenation of embeddings from trained ML models from the plurality of parties; and / or the existing dataset comprises embeddings from two or more parties running different ML models within the same VFL architecture.

[0015] In some embodiments, the second party does not have access to data used by the first ML model for training to generate the one or more embeddings. In some embodiments, the method includes replacing the second ML model with the third ML model in the VFL architecture, wherein the third ML model was trained without using the one or more embeddings of the first party. In some embodiments, the method includes performing an audit to determine the effectiveness of unlearning with respect to the one or more embeddings of the first party.

[0016] In some embodiments, the method includes receiving an audit request from the first party; and providing, in response to the request, an indication to the first party regarding the effectiveness or completion of the unlearning with respect to the one or more embeddings of the first party.

[0017] In some embodiments, the first ML model, the second ML model, and the third ML model are each a neural network (NN). In some embodiments, the request comprises one or more embeddings of the first party or an identifier of what should be unlearned. In some embodiments, the identifier identifies embeddings of features, samples, or participants to be unlearned. In some embodiments, the VFL is used in a telecommunications network or at least one of the first or second party is a node or device of the telecommunications network.

[0018] In some embodiments, the VFL is used in a 3 GPP network architecture. In some embodiments, the third model is based on the second model. In some embodiments, the third model has the same architecture as the second model with randomly initialized weights. In some embodiments, the request to unlearn is a request to unlearn a participant.

[0019] In a second aspect, a computer-implemented method for machine unlearning in vertical federated learning (VFL) is provided. The method includes receiving a request to unlearn a feature of a first machine learning (ML) model of a first party, wherein the first ML model is part of a VFL model distributed amongst a plurality of parties. The method includes initiating a second ML model. The method includes generating one or more first embeddings from the first ML model trained using a dataset including the feature that is requested to be unlearned. The method includes generating one or more second embeddings from the second ML model trained using a dataset that does not include the feature that is requested to be unlearned. The method includes determining a loss based on the one or more first embeddings and the one or more second embeddings. The method includes updating the second ML model.

[0020] In some embodiments, determining the loss is based on a single loss function. In some embodiments, the first party is a passive party; the first ML model is a head model; the second ML model is a passive model; and / or the first ML model is a teacher model and the second ML model is a student model.

[0021] In a third aspect, a computer-implemented method for machine unlearning in vertical federated learning (VFL) is provided. The method includes initiating unlearning of one or more samples of a first party having a first ML model. The method includes performing anunlearning process, wherein the unlearning process comprises: training a second ML model using the one or more samples to generate one or more unlearning embeddings, wherein the second ML model is a ML model of a second party; determining a loss based at least in part on the generated one or more unlearning embeddings and an optimization based on a gradient ascent process, and updating the second ML model. The method includes obtaining an updated sample set. The method includes performing a learning process, wherein the learning process comprises: training the second ML model using the updated sample set.

[0022] In some embodiments, the learning process comprises: generating one or more learning embeddings from the second ML model; determining a loss based at least in part on the generated one or more learning embeddings and an optimization based on a gradient descent process; and updating the second ML model.

[0023] In some embodiments, obtaining the updated sample set comprises: retrieving an original set of samples; and generating an initial updated sample set based on removal of the sample information to be unlearned from the original set of samples. In some embodiments, the method includes selecting a sub-set of samples from the initial updated sample set. In some embodiments, the method includes receiving a request to unlearn the one or more samples.

[0024] In some embodiments, the first party is a passive party, the second party is an active party, the first ML model is a head model, the second ML model is a tail model, the first ML model and the second ML model are both part of the same VFL, and / or the one or more samples of the first party comprises one or more embeddings or activations resulting from a forward pass of the first ML model.

[0025] In some embodiments, the method includes performing an audit to determine the effectiveness of unlearning with respect to the requested sample.

[0026] In a fourth aspect, a computer-implemented method for machine unlearning in vertical federated learning (VFL) in a 3 GPP network architecture is provided. The method includes receiving an initial request for unlearning, wherein the request includes one or more of an analytics ID, area of interest, and / or identification of information to be unlearned. The method includes selecting, from a plurality of parties represented as different Network Data and Analytics Functions (NWDAFs) in a VFL training process, one or more of an effected first party and / or second party based on the received initial request. The method includes performing unlearning according to any of first, second, or third aspects for at least one selected effected party.

[0027] In some embodiments, the method includes sending an unlearning request message, wherein the unlearning request message is sent to and / or received from a Network Data and Analytics Function (NWDAF) configured as a VFL client. In some embodiments, the method includes receiving an unlearning response message, wherein the unlearning response message is received at the NWDAF from the VFL client.

[0028] In a fifth aspect, a computer-implemented method for machine unlearning in vertical federated learning (VFL) in an Open Radio Access Network (ORAN) is provided. The method includes receiving an unlearning request. The method includes retrieving one or more ML models related to the unlearning request. The method includes retrieving embeddings relating to the unlearning request. The method includes performing unlearning on one or more of the retrieved models based on the retrieved data and according to any of the first, second, or third aspects.

[0029] In some embodiments, the method is performed in a producer application for artificial intelligence (Al) or ML services and the unlearning request is received from a consumer application of the AI / ML services. In some embodiments, the one or more ML models are retrieved from a model repository and / or the data is retrieved from a Data Management at Exposure (DME) function. In some embodiments, the retrieved one or more ML models are for an active party, for a passive party, a head model, or a tail model.

[0030] According to a sixth aspect, a node is provided. The node is configured to perform the method according to any of the first, second, third, fourth, or fifth aspects.

[0031] According to a seventh aspect, a computer program is provided. The computer program includes instructions which, when executed by processing circuitry of a node causes the node to perform the method according to any of the first, second, third, fourth, or fifth aspects.

[0032] According to an eighth aspect, a carrier is provided. The carrier contains the computer program of the seventh aspect, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, and a computer readable storage medium.

[0033] According to some embodiments, an approach for unlearning in VFL is provided that allows for unlearning clients or unlearning specific features of a given client. When unlearning clients, in embodiments, the proposed approach requires only tuning the tail model without requiring any interaction with the clients. In the case of unlearning specific features, only thecorresponding head model is affected. The proposed approach is in line with the Network Function (NF) Consumer and NF Producer settings found in NWDAF in 3 GPP, as well as in Open-RAN (ORAN).

[0034] In certain aspects, one or more of the solutions provided herein can leverage the information that is provided by each client to the tail model (mentioned as embeddings) to determine how to produce a new model that is deprived of the learnings of each client. As such, they do not require access to the original data. Conversely, in the case where a specific feature of a given client needs to be unlearned, access to local data of the client is required. However, the tail model (or active party) is not impacted by the process nor the other clients. In addition, as the unlearned model is replaced, a model that offers information on the applicability of member inference attacks is produced. This model serves as a mechanism that validates how well the unlearning process went. Additionally, certain embodiments may provide one or more of the following technical advantages: (i) allowing for unlearning in VFL with minimal utility loss; (ii) no requirement for access to the original data or to the corresponding users that own that data when unlearning all features from a particular user; (iii) allowing for unlearning specific features from users without impacting the tail model; (iv) providing evidence that unlearning has taken place successfully; and / or (v) allowing for unlearning specific samples without the need for accessing the participants. In certain aspects, evidence that unlearning has taken place is evidence that approximate unlearning rather than exact unlearning has occurred. In other words, the unlearned model will underperform when asked something about data that was unlearned.BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate various embodiments.

[0036] FIG. 1 A and FIG. IB are diagrams that illustrate aspects of vertical federated learning and training.

[0037] FIG. 2 is a diagram that illustrates aspects of a passive party unlearning process according to some embodiments.

[0038] FIG. 3 A is a diagram that illustrates aspects of a process for feature unlearning in VFL according to some embodiments, such as passive party feature unlearning.

[0039] FIG. 3B illustrates aspects of sample unlearning.

[0040] FIG. 4 shows an example of data for training / test loss in VFL unlearning of a passive party.

[0041] FIG. 5 shows an example of data for Fl / AUC for passive unlearning.

[0042] FIG. 6 shows an example of data for training / test loss when unlearning most important features.

[0043] FIG. 7 shows an example of data relating to a membership inference attack.

[0044] FIG. 8 shows an example of data for sample unlearning loss.

[0045] FIG. 9 shows an example of data for sample unlearning Fl / AUC impact.

[0046] FIG. 10 shows an example of data relating to performance of MIA for sample unlearning.

[0047] FIG. 11 is a diagram that illustrates aspects of VFL unlearning in NWDAF according to one or more embodiments.

[0048] FIG. 12 is a diagram that illustrates aspects of sample unlearning in NWDAF according to one or more embodiments.

[0049] FIG. 13 is a diagram that illustrates aspects of ORAN unlearning according to one or more embodiments.

[0050] FIGs. 14A-14E are flowcharts illustrating a process according to one or more embodiments.

[0051] FIG. 15 is a block diagram illustrating a network node, a computing device, and an apparatus according to one or more embodiments.

[0052] FIG. 16 is a block diagram of an apparatus according to one or more embodiments.

[0053] FIG. 17 is a block diagram of a node according to one or more embodiments.

[0054] FIG. 18 is a block diagram of a communication system according to one or more embodiments.DETAILED DESCRIPTION

[0055] Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art. Additional information may also be found in the document provided in the Appendix, which is incorporated herein and forms part of the specification.

[0056] Referring now to FIG. 1 A, an example of overall training 100 in vertical federated learning (VFL) is illustrated. As shown in FIG. 1 A, VFL considers a set of passive parties (also known as heads) and one or more active parties (also known as tails). The main difference between active and passive parties is that active parties have access to labels, and as such, can calculate loss / trigger backward propagation processes while passive parties are limited to forward propagation and can only perform backward propagation once they receive input from the active party. For simplicity, a single active party is shown. However, other numbers of passive and active parties may be used according to embodiments.

[0057] According to embodiments, steps 101, 102, and 103 are performed by the different passive parties and result in the accumulation of embeddings (the set of activations of each passive party), which are later concatenated in step 104 and are used as the input to an ML model of the active party. The embeddings or other output data (H) may be the result of running a forward pass on a ML model of the passive party. In step 105, the data from a plurality of passive parties is stored. It is noted that this step is not the typical case in VFL. This step, in some embodiments disclosed herein, is used to perform unlearning and the data can include the embeddings produced previously.

[0058] Once the active party has finished storage and forward propagation (step 106) using the concatenated input from the passive parties, in step 107 it can then calculate the loss between its prediction and the ground truth. Once that has taken place, corresponding partial derivatives are communicated back to each passive party in steps 108-110 for them to perform backward propagation (steps 111-113) and as such recalibrate the “weights” of their models to better estimate the active parties’ ground truth (y). The process 100 repeats for a number of iterations for each batch in each epoch.

[0059] Referring now to FIG. IB, an illustration of a neural architecture 150 for VFL is shown. In this example, the model is split and has of two heads and one tail model. These are all neural networks in this example. Head 1 and Head 2 are close to where the data is collected and have access to different feature spaces, in this case XI and X2. Each head produces an embedding that is the product of forward propagation. For instance, it is usually the output of an activation function such as ReLU. The Tail node is usually remote. The input layer for the tail node uses as input a concatenation of the embeddings produced by the different head nodes. In the example of architecture 150, the Tail node is the one that does the final forward propagation and producesinference (or yA) using the input from the corresponding head models. Head nodes are sometimes referred as passive parties since they typically do not have labels and cannot calculate loss, while the tail node is referred as the activate party since it typically has labels and performs the calculation of loss.

[0060] In machine learning a label can be the output of a machine learning model which is the result of forward propagation. More specifically, in supervised learning, every input to the machine learning is labelled and the model is tasked to find an association between input and the (output) label. An example of input can be an image with features such as Red, Green, Blue and the output would be a description of the image i.e. cat, dog etc. For a machine learning model to associate input and output, a forward propagation process takes place where the model estimates the association between input and output and then calculates the loss or the distance between the prediction (yA) and the ground truth label (yAtrue) where the ground truth is present in the training dataset. Then backward propagation takes place where via gradient descent (stochastic gradient) the partial derivatives (or the rate) for each to be estimated variable are calculated and are used to minimize the loss between yAand y. Typical loss functions in machine learning include mean squared error (for regression problems) and binary cross entropy loss (used for classification). More examples of loss functions exist such as log loss, Huber loss, hinge loss and categorical cross entropy loss. The process of gradient descent, for example, is an optimisation process to minimize loss.

[0061] Referring now to FIG. 2, a process 200 for unlearning is provided according to some embodiments. This may be, for instance, a process of unlearning a passive party (alternatively referred to as a client). This may be, for example, a process for unlearning a party or participant. In the context of 3 GPP, one example of participant could be a wireless carrier or service provider. However, according to embodiments, other participants can be included.

[0062] In embodiments, the process begins with the passive party sending a request to be unlearned at step 201. The request may come with some identification / indication on what should be unlearned, or otherwise identifies the corresponding embeddings that should be removed. In this example, that is denoted that as H u. Once the request is received by the active party the unlearning process begins. In embodiments, the process repeats for every embedding that corresponds to the passive party.

[0063] In this example, knowledge distillation is applied, which appoints the previously trained model to be the teacher model and the new unlearned model to be the student. In step 202, the student model is randomly initialized. In step 203, the relevant data is obtained e.g., a concatenation of received embeddings. In step 204, the teacher model produces predictions using the original embeddings, while the student considers the same embeddings (step 206), which have been deprived of the input of the passive party to be unlearned in step 205. In particular, in step 205, a new dataset H’ is defined based on updating the original data (H - H u). The goal of the process is to produce a student model that generalizes as much as possible as the teacher yet at the same time becomes bad at estimating the data to be unlearned. According to some embodiments, this is achieved by combining two loss functions. In step 207, a first loss is calculated based on the predictions of the student model and the ground truth. For example, yA_true is the ground truth or the real output for the given input and not the estimation (which would be yA_student in this case).

[0064] In step 208, a distillation loss is calculated based on the predictions of the student and the teacher. In step 209, a total loss is calculated. Once the losses are calculated, in embodiments, the student model is updated at step 210.

[0065] The first loss function (Lpred) aims at reducing the loss between the student’s prediction and the ground truth while the second loss function (Ldistu) minimizes the KL divergence between the student’s and teacher’s prediction. Total loss, in embodiments, can be computed as:where a is the distillation rate. Thereafter the model of the active party updates (e.g., in step 210) as follows:where r|i is the learning rate. Alpha is the trade-off between distillation loss and actual loss of the model. Alpha can be determined empirically by testing different values starting from 0.8 and then going to smaller values such as 0.5 and 0.3. During the experiments it was observed that when the distillation loss is higher than prediction loss (or actual loss) then the utility is impaired therefore lower values of alpha are a better choice. Any value between 0.3 to 0.5 appears to work for the given datasets. Therefore, using this approach alpha can be determined with a few iterations.

[0066] In a separate embodiment and in the interest of overcoming the need for determining the learning rate, the active party update can be written as:As such the inverse hessian of the student model is needed instead which expresses the rate of the rate that the student’s model parameters are changing.

[0067] According to some embodiments, during the training process, a model to detect member inference is developed using the input from the original embeddings and the embeddings which are deprived of the contribution of the client to be removed. This model is then used to provide an auditing mechanism which allows the client to get some further feedback on how well unlearning was performed. In some embodiments, at step 211, an audit is performed e.g., by running an audit model based on H and H u. In this respect, the effectiveness of the unlearning process can be evaluated. Additionally, this or similar information can be passed back to the passive party. For instance, in step 212 and audit request is received and in step 213 an audit response is sent. In some embodiments, the process 200 may be performed in a NWDAF or ORAN.

[0068] FIG. 3A illustrates a process 300 for feature unlearning in VFL according to some embodiments. This may be, for example, a process for unlearning a feature. In the context of 3 GPP, one example of a feature could be information from a UE, such as signal strength for a specific frequency that the UE is using or planning to use to attach to the mobile network. However, according to embodiments, the process 300 is applicable to other types of features. In some embodiments, the process 300 may be performed in a NWDAF or ORAN.

[0069] Unlike the previous solution, which does not require access to the passive party and to the passive party’s local data, this solution likely necessitates both. This is because this information (to be unlearned) resides on the passive party since every passive party maintains its own model to preserve privacy. Other parties are not involved, and in certain aspects the active party does not need to be involved either, as passive party feature unlearning is sufficient to reduce the effect of the passive party’s input to the active party’s model. In the context of NWDAF this enables an NWDAF server to advise other NWDAFs that participate in a VFL process to remove features that might be impacting the performance of a machine learning model.

[0070] According to some embodiments, the process begins in step 301 with an unlearn request for a given input feature denoted as F_u. A student model is then initialized in step 302, which is the model that will learn to generalize on the learnings of the previous model (now teacher model) without the effect of the feature to be unlearned. Towards this end, a single loss function is used in embodiments to minimize the KL divergence between the embeddings produced when doing a forward pass with the teacher model and the embeddings produced when doing a forward pass with the student model, but with the student model using an input deprived of the feature to be removed. In embodiments, the passive party model update is done using:where r is the learning rate. Similar to the previous case, and in an alternative embodiments, the passive party update can be re-written as:in which the learning rate can be replaced with the inverse hessian of the student model, thus reducing the need to define the learning rate.

[0071] In process 300 of FIG. 3A, once the student model is initialized in step 302, a loop comprises steps 303-306 according to some embodiments. In step 303, a forward pass of the teacher model generates a first set of embeddings based on input x. In step 304, a forward pass of the student model generates a second set of embeddings based on the feature removal (x - F_u). In step 305, a loss is computed based on the first and second set of embeddings, and in step 306, the student model is updated. In step 307, a membership inference attack (MIA) model is built (build audit model) and an audit is perform using the MIA model to determine the effectiveness of unlearning.

[0072] Referring now to the example of FIG. 3B, in the case of sample unlearning, only the active party needs to be involved. In addition, what is required on the server side is an association between the embeddings that are received for each participant for each sample id. For simplicity, that is illustrated as S_u. It should be noted that in this example one goal is identifying the set of samples to which each embedding corresponds. In FIG. 3B, the unlearning process 350 begins with a gradient ascent phase where the samples to be removed (S_u) are unlearned by maximizing the loss between the true label and the one that is predicted by the model for thesesamples while maintaining small loss for the remaining samples that should not be unlearned. According to embodiments, gradient ascent is the opposite of gradient descent - instead of reducing the loss the goal now is to increase the loss. The gradient ascent phase is repeated until all samples that have been marked to be unlearned have been processed. In embodiments, following a first loop, a regular gradient descent phase is performed to decrease the loss between a subset of the samples that should be retained. This is done to combat any negative effects that might be introduced by the gradient ascent phase. In practice, it can be observed that the gradient descent phase does not require the use of all samples that the model needs to remember, and only a small number of iterations are required as opposed to a naive approach where all remaining samples are to be learned from scratch. In certain aspects, the gradient descent phase operates on a subset of samples which are randomly chosen from the remaining samples. Empirically, a small percentage of those samples (i.e. 10%) has shown to achieve the desired “learning” effect. Monitoring of loss during the re-learning phase can be used to determine if the effects of gradient ascent have been addressed or not. In embodiments, the gradient descent step is iterated until all samples from the subset of samples to be remembered are processed.

[0073] According to some embodiments, the process comprises the following:• Step 351 - receiving an unlearning request (e.g., for sample S_u)• A first loop steps 352-354 - generating predictions using the model with S-u, calculating loss e.g., based on yA, y, and gradient ascent, and updating the model• Step 355 - retrieving a sample set S• Steps 356, 357 - creating an updated sample set S’ based on S-S_u, and then selecting a subset of the samples S”• A second loop steps 358-360 - generating predictions using the updated samples S”, calculating loss e.g., based on yA, y, and gradient descent, and updating the model• Auditing steps 361-362 - building an audit model based on S, S-S_u to evaluate the unlearning process and then reporting e.g., based on an audit request.

[0074] The proposed solutions have been evaluated using 6 public datasets:(a) Adult dataset which contains information about income in relation to education and other characteristics(b) Ai4i which is a predictive maintenance dataset(c) Hepmass which deals with the classification of exotic particles(d) Poqemon which deals with the classification of user experience(e) Susy which is a super symmetry dataset used to determine the difference between two classes using a number of features(f) Wine dataset used to classify the properties of the chemical analysis of wines grown by different cultivars

[0075] In all experiments unlearning takes place at the 25th epoch. We consider that by that epoch, training loss has stabilized and as such we can now consider unlearning. 4 curves are shown in each plot. Unlearning Training (Train / Test) which captures a specific metric while the model is unlearned (unlearning takes place on the 25th as mentioned previously) either using the training set or the test set (or hold out dataset) and retraining (Train / test) which captures a metric in a setting where we train from scratch without the client (or feature) to be unlearned either in the training or in the test set. We consider 3 metrics, loss (which is the total loss mentioned previously), AUC and Fl as we are dealing with binary classification problems.

[0076] As shown in FIG. 4, unlearning sets back (or introduces a spike) in the training process. However, that spike is comparable to that encountered if we were to train from scratch without KD and without the information to be unlearned. In terms of Fl and AUC as shown in FIG. 5, we see that depending on the importance of what is unlearned there is either an impact in Fl and AUC (particularly in dataset d) or there is no major penalty as shown in other datasets. As shown in FIG. 6, a similar behavior (spike during unlearning) is observed when unlearning a specific feature - in this case the most important feature as determined by SHAP analysis. This effect appears to be more pronounced in some datasets (such as a and d) while in cases it is not present. In all cases we find that the model’s train / test loss stabilizes after a few more epochs. In FIG. 7 we present the results of the membership inference attack (MIA). Here we observe that after the unlearning process has begun the MIA model is no longer detecting the embeddings that are supposed to be unlearned, or in most cases evidence of such information falls below 50%. The main exception to this observation is dataset c where we see a drop in accuracy which however is not sufficient to indicate absence of such information. We believe that this is due to the nature of the dataset as embeddings of different exotic particles are very similar. In FIG. 8 we present the findings for sample learning for 5 samples (batch size of 5). Overall, we observe that loss is reduced when unlearning takes place, as opposed to retraining loss (retraining from scratch in the absence of those samples). This is because the model stands to learn less information which leadsto faster convergence. In FIG. 9 we measure Fl and AUC for sample unlearning in the context of unlearning versus the context of retraining from scratch. Overall, we observe small distance between the two cases which shows that unlearning of samples has similar effect as retraining without the to be unlearning information. In FIG. 10 we perform MIA to ascertain the presence or absence of unlearned samples. In all cases except for the adult dataset we maintain a drop in accuracy which shows that unlearned samples cannot be easily identified - at least not as prior to the unlearning process. In the adult dataset a drop is also detected but there is high variance which makes it much harder to assess that this is indeed the case. This exception points back to the nature of the samples which are unlearned which in some cases may not be easy to distinguish from remaining samples that hold similar information or in other words, other adults with similar salary, education, etc.. It should be noted that the results were obtained a batch size of 5. We have performed similar experiments for just 1 sample. In that case we observe - particularly when performing MIA - that it is hard to distinguish the effect of unlearning, which means that unlearning of multiple samples has a more pronounced / easy to detect effect.

[0077] Referring now to FIG. 11, an NWDAF-based embodiment 1100 is provided. In this embodiment, the unlearning process in NWDAF is started by the NWDAF Server (MTLF), which uses the analytics id (indicator of use case) to determine the location of the different active (or passive if we consider feature unlearning) parties that are to be unlearned for a specific feature to be unlearned or for an entire passive party. In embodiments, in step 1101 a VFL request for unlearning is received or generated, and in step 1102 the relevant passive and active parties are identified. The request, or a similar message, is then forwarded in step 1103 to the NF (or NEF), which in certain aspects provides the means of identifying the IP address of the affected party. In step 1104, the NEF proxies the request to the affected party, then unlearning (step 1105) and auditing (step 1106) takes place as described in the previous algorithms. Afterwards, once the process is complete, a response (steps 1107 and 1108) is given back to the NWDAF server indicating how well unlearning was performed for the given request.

[0078] And referring now to FIG. 12, an embodiment 1200 is provided. In the example case of sample unlearning of samples in NWDAF, samples correspond to Subscription Permanent Identifiers (SUPIs), which are a unique identifier for a UE associated to the UE’s subscription. In embodiments, a process begins with step 1201 in which a UE revokes user consent. This may be communicated, for instance, to the UDM. In step 1202, the UDM sends the unlearn request to theNWDAF server using the SUPIs. In step 1203, the NWDAF server selects the effected VFL active party. In steps 1204, 1205, a message is sent to the VFL client via the NEF. Then unlearning (step 1206) and auditing (step 1207) takes place as described in the previous algorithms. The relevant responses (steps 1208-1210), e.g., reporting on unlearning, can be communicated back to the UE / UDM via the NEF and NWDAF.

[0079] Referring now to FIG. 13, a process 1300 for unlearning in ORAN is provided according to some embodiments. In embodiments, the process starts from an AI / ML consumer app which makes an unlearning request at step 1301 to a producer. In embodiments, a response 1302 is returned. The producer then retrieves (step 1303) the corresponding model to be unlearned and the needed data which can either be the embeddings of the passive party to be unlearned by an active party or the dataset (step 1304) of a passive party for unlearning a specific feature. Both the data and model can be retrieved using the R1 interface according to embodiments. Unlearning is then performed at step 1305 using one or more of the different algorithms described herein. Afterwards, upon the successful completion (1308) of the process, the unlearned model is stored (step 1309) back into the model repository and the unlearning job status can be communicated at step 1310 back to the consumer. In embodiments, this includes the results from the membership inference attack model. In some embodiments, the consumer app may query (step 1306) the produce app regarding the status of the unlearning, and the produce app may provide a response with the status (step 1307).

[0080] Referring now to FIG. 14A, a process 1400 is illustrated according to some embodiments. The process 1400 may begin with step sl402.

[0081] Step sl402 comprises receiving a request to unlearn a first party having a first machine learning (ML) model, wherein the request is received by a second party having a second ML model trained using at least the one or more embeddings of the first party.

[0082] Step sl404 comprises initializing, in response to the unlearn request, a third ML model.

[0083] Step sl406 comprises generating modified input data by removing the one or more embeddings of the first party and / or any intermediate representations relating to the first party from an existing dataset comprising embeddings received from a plurality of parties.

[0084] Step sl408 comprises training the third ML model using the modified input data.

[0085] In some embodiments, training the third ML model includes generating initial predictions using the second ML model and the existing dataset; generating updated predictions using the third ML model and the modified input data; and determining a total loss based at least in part on the initial predictions and the updated predictions.

[0086] In some embodiments, determining the total loss is based on a sum of a prediction loss and a distillation loss. In some embodiments, the first party is a passive party; the second party is an active party; the first ML model is a head model; the second ML model is a tail model; the one or more embeddings result from a forward pass of the first ML model; and / or the second ML model is a teacher model and the third ML model is a student model.

[0087] In some embodiments, the first ML model and the second ML model are each part of the VFL. In some embodiments, training the third ML model comprises updating the third ML model. In some embodiments, the method includes retrieving the existing dataset. In some embodiments, the existing dataset is a concatenation of embeddings from trained ML models from the plurality of parties; and / or the existing dataset comprises embeddings from two or more parties running different ML models within the same VFL architecture.

[0088] In some embodiments, the second party does not have access to data used by the first ML model for training to generate the one or more embeddings. In some embodiments, the method includes replacing the second ML model with the third ML model in the VFL architecture, wherein the third ML model was trained without using the one or more embeddings of the first party. In some embodiments, the method includes performing an audit to determine the effectiveness of unlearning with respect to the one or more embeddings of the first party.

[0089] In some embodiments, the method includes receiving an audit request from the first party; and providing, in response to the request, an indication to the first party regarding the effectiveness or completion of the unlearning with respect to the one or more embeddings of the first party.

[0090] In some embodiments, the first ML model, the second ML model, and the third ML model are each a neural network (NN). In some embodiments, the request comprises one or more embeddings of the first party or an identifier of what should be unlearned. In some embodiments, the identifier identifies embeddings of features, samples, or participants to be unlearned. In some embodiments, the VFL is used in a telecommunications network or at least one of the first or second party is a node or device of the telecommunications network.

[0091] In some embodiments, the VFL is used in a 3 GPP network architecture. In some embodiments, the third model is based on the second model. In some embodiments, the third model has the same architecture as the second model with randomly initialized weights. In some embodiments, the request to unlearn is a request to unlearn a participant.

[0092] Referring now to FIG. 14B, a process 1420 is illustrated according to some embodiments. The process 1420 may begin with step sl422.

[0093] Step sl422 comprises receiving a request to unlearn a feature of a first machine learning (ML) model of a first party, wherein the first ML model is part of a VFL model distributed amongst a plurality of parties.

[0094] Step sl424 comprises initiating a second ML model.

[0095] Step sl426 comprises generating one or more first embeddings from the first ML model trained using a dataset including the feature that is requested to be unlearned.

[0096] Step sl428 comprises generating one or more second embeddings from the secondML model trained using a dataset that does not include the feature that is requested to be unlearned.

[0097] Step sl430 comprises determining a loss based on the one or more first embeddings and the one or more second embeddings.

[0098] Step sl432 comprises updating the second ML model.

[0099] In some embodiments, determining the loss is based on a single loss function. In some embodiments, the first party is a passive party; the first ML model is a head model; the second ML model is a passive model; and / or the first ML model is a teacher model and the second ML model is a student model.

[0100] Referring now to FIG. 14C, a process 1440 is illustrated according to some embodiments. The process 1440 may begin with step sl442.

[0101] Step sl442 comprises initiating unlearning of one or more samples of a first party having a first ML model.

[0102] Step sl444 comprises performing an unlearning process, wherein the unlearning process comprises (a) training a second ML model using the one or more samples to generate one or more unlearning embeddings, wherein the second ML model is a ML model of a second party; (b) determining a loss based at least in part on the generated one or more unlearningembeddings and an optimization based on a gradient ascent process; and (c) updating the second ML model.

[0103] Step sl446 comprises obtaining an updated sample set.

[0104] Step sl448 comprises performing a learning process, wherein the learning process comprises: training the second ML model using the updated sample set.

[0105] In some embodiments, the learning process comprises: generating one or more learning embeddings from the second ML model; determining a loss based at least in part on the generated one or more learning embeddings and an optimization based on a gradient descent process; and updating the second ML model.

[0106] In some embodiments, obtaining the updated sample set comprises: retrieving an original set of samples; and generating an initial updated sample set based on removal of the sample information to be unlearned from the original set of samples. In some embodiments, the method includes selecting a sub-set of samples from the initial updated sample set. In some embodiments, the method includes receiving a request to unlearn the one or more samples.

[0107] In some embodiments, the first party is a passive party, the second party is an active party, the first ML model is a head model, the second ML model is a tail model, the first ML model and the second ML model are both part of the same VFL, and / or the one or more samples of the first party comprises one or more embeddings or activations resulting from a forward pass of the first ML model.

[0108] In some embodiments, the method includes performing an audit to determine the effectiveness of unlearning with respect to the requested sample.

[0109] Referring now to FIG. 14D, a process 1460 in a 3GPP network architecture is illustrated according to some embodiments. The process 1460 may begin with step sl462.

[0110] Step sl462 comprises receiving an initial request for unlearning, wherein the request includes one or more of an analytics ID, area of interest, and / or identification of information to be unlearned.

[0111] Step sl464 comprises selecting, from a plurality of parties represented as different Network Data and Analytics Functions (NWDAFs) in a VFL training process, one or more of an effected first party and / or second party based on the received initial request.

[0112] Step sl466 comprises performing unlearning according to any of the processes disclosed herein, including methods 1400, 1420, and 1440, for at least one selected effected party.

[0113] In some embodiments, the method includes sending an unlearning request message, wherein the unlearning request message is sent to and / or received from a Network Data and Analytics Function (NWDAF) configured as a VFL client. In some embodiments, the method includes receiving an unlearning response message, wherein the unlearning response message is received at the NWDAF from the VFL client.

[0114] Referring now to FIG. 14E, a process 1480 in an Open Radio Access Network (ORAN) is illustrated according to some embodiments. The process 1480 may begin with step S1482.

[0115] Step sl482 comprises receiving an unlearning request.

[0116] Step sl484 comprises retrieving one or more ML models related to the unlearning request.

[0117] Step sl486 comprises retrieving embeddings relating to the unlearning request.

[0118] Step sl488 comprises performing unlearning on one or more of the retrieved models based on the retrieved data and according to any of the processes disclosed herein, including methods 1400, 1420, and 1440.

[0119] In some embodiments, the method is performed in a producer application for artificial intelligence (Al) or ML services and the unlearning request is received from a consumer application of the AI / ML services. In some embodiments, the one or more ML models are retrieved from a model repository and / or the data is retrieved from a Data Management at Exposure (DME) function. In some embodiments, the retrieved one or more ML models are for an active party, for a passive party, a head model, or a tail model.

[0120] FIG. 15 is a block diagram illustrating a network node, a computing device, and an apparatus 1500 - i.e., device 1500 — according to one or more embodiments, that can perform one or more of the processes disclosed herein, including methods 1400, 1420, 1440, 1460, and 1480. As shown in FIG. 15, device 1500 may comprise: processing circuitry (PC) 1502, which may include one or more processors (P) 1555 (e.g., one or more general purpose microprocessors and / or one or more other processors, such as an application specific integrated circuit (ASIC), field- programmable gate arrays (FPGAs), and the like), which processors may be co-located in a singlehousing or in a single data center or may be geographically distributed (e.g., device 1500 may be a distributed computing apparatus comprising two or more computers or a monolithic computing apparatus consisting of a single computer); at least one network interface 1548 (e.g., a physical interface or air interface) comprising a transmitter (Tx) 1545 and a receiver (Rx) 1547 for enabling device 1500 to transmit data to and receive data from other nodes connected to network 1510 (e.g., an Internet Protocol (IP) network) to which network interface 1448 is connected (physically or wirelessly) (e.g., network interface 1548 may be coupled to an antenna arrangement comprising one or more antennas for enabling device 1500 to wirelessly transmit / receive data); and a storage unit (a.k.a., “data storage system”) 1508, which may include one or more non-volatile storage devices and / or one or more volatile storage devices. In embodiments where PC 1502 includes a programmable processor, a computer readable storage medium (CRSM) 1542 may be provided. CRSM 1542 may store a computer program (CP) 1543 comprising computer readable instructions (CRI) 1544. CRSM 1542 may be a non-transitory computer readable medium, such as, magnetic media (e.g., a hard disk), optical media, memory devices (e.g., random access memory, flash memory), and the like. In some embodiments, the CRI 1544 of computer program 1543 is configured such that when executed by PC 1502, the CRI causes apparatus 1500 to perform the steps described herein (e.g., steps described herein with reference to the flow charts). In other embodiments, device 1500 may be configured to perform the steps described herein without the need for code. That is, for example, PC 1502 may consist merely of one or more ASICs. Hence, the features of the embodiments described herein may be implemented in hardware and / or software.

[0121] FIG. 16 is a block diagram of an apparatus according to some embodiments. The apparatus includes one or more modules 1600, each of which is implemented in software. The module(s) 1600 can provide the functionality of apparatus 1500.

[0122] FIG. 17 is a block diagram of a node 1700 or other device according to some embodiments. Generally, the node 1700 may comprise any component or network function (e.g. any hardware or software module) in the communications network suitable for performing the functions described herein. For example, a node may comprise equipment capable, configured, arranged and / or operable to communicate directly or indirectly with a UE (such as a wireless device) and / or with other network nodes or equipment in the communications network to enable and / or provide wireless or wired access to the UE and / or to perform other functions (e.g.,administration) in the communications network. As used herein, a UE refers to a device capable, configured, arranged and / or operable to communicate wirelessly with network nodes and / or other UEs. Examples of a UE include, but are not limited to, a smart phone, mobile phone, cell phone, voice over IP (VoIP) phone, wireless local loop phone, desktop computer, personal digital assistant (PDA), wireless cameras, gaming console or device, music storage / playback device, wearable terminal device, wireless endpoint, mobile station, tablet, laptop, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), an Augmented Reality (AR) or Virtual Reality (VR) device, wireless customer-premise equipment (CPE), vehicle, vehicle-mounted or vehicle embedded / integrated wireless device, etc. Other examples include any UE identified by the 3 GPP, including a narrow band internet of things (NB-IoT) UE, a machine type communication (MTC) UE, and / or an enhanced MTC (eMTC) UE. A UE may support device-to-device (D2D) communication, for example by implementing a 3 GPP standard for sidelink communication, Dedicated Short-Range Communication (DSRC), vehicle-to-vehicle (V2V), vehicle-to- infrastructure (V2I), or vehicle-to-everything (V2X). In other examples, a UE may not necessarily have a user in the sense of a human user who owns and / or operates the relevant device. Instead, a UE may represent a device that is intended for sale to, or operation by, a human user but which may not, or which may not initially, be associated with a specific human user (e.g., a smart sprinkler controller). Alternatively, a UE may represent a device that is not intended for sale to, or operation by, an end user but which may be associated with or operated for the benefit of a user (e.g., a smart power meter). Examples of nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, NodeBs, evolved NodeBs (eNBs) and NR NodeBs (gNBs)). Further examples of nodes include but are not limited to core network functions such as, for example, core network functions in a Fifth Generation Core network (5GC). In this example, the node 1700 is configured (e.g. adapted, operative, or programmed) to perform any of the embodiments of the methods described herein. It will be appreciated that the node 1700 may comprise one or more virtual machines running different software and / or processes. The node 1700 may therefore comprise one or more servers, switches and / or storage devices and / or may comprise cloud computing infrastructure or infrastructure configured to perform in a distributed manner, that runs the software and / or processes. The node 1700 may comprise a processor (e.g. processing circuitry or logic) 1702. The processor 1702 may control the operation of the node 1700 in the manner described herein. The processor 1702 can comprise oneor more processors, processing units, multi-core processors or modules that are configured or programmed to control the node 1700 in the manner described herein. In particular implementations, the processor 1702 can comprise a plurality of software and / or hardware modules that are each configured to perform, or are for performing, individual or multiple steps of the functionality of the node 1700 as described herein.

[0123] The node 1700 may comprise a memory 1704. In some embodiments, the memory 1704 of the node 1700 can be configured to store program code or instructions 1706 that can be executed by the processor 1702 of the node 1700 to perform the functionality described herein. Alternatively or in addition, the memory 1704 of the node 1700, can be configured to store any requests, resources, information, data, signals, or similar that are described herein. The processor 1702 of the node 1700 may be configured to control the memory 1704 of the node 1700 to store any requests, resources, information, data, signals, or similar that are described herein.

[0124] It will be appreciated that the node 1700 may comprise other components in addition or alternatively to those indicated in FIG. 17. For example, in some embodiments, the node 1700 may comprise a communications interface. The communications interface may be for use in communicating with other nodes in the communications network, (e.g. such as other physical or virtual nodes). For example, the communications interface may be configured to transmit to and / or receive from other nodes or network functions requests, resources, information, data, signals, or similar. The processor 1702 of node 1700 may be configured to control such a communications interface to transmit to and / or receive from other nodes or network functions requests, resources, information, data, signals, or similar.

[0125] Although the computing devices described herein (e.g., UEs, network nodes, hosts) may include the illustrated combination of hardware components, other embodiments may comprise computing devices with different combinations of components. It is to be understood that these computing devices may comprise any suitable combination of hardware and / or software needed to perform the tasks, features, functions and methods disclosed herein. Determining, calculating, obtaining or similar operations described herein may be performed by processing circuitry, which may process information by, for example, converting the obtained information into other information, comparing the obtained information or converted information to information stored in the network node, and / or performing one or more operations based on the obtained information or converted information, and as a result of said processing making adetermination. Moreover, while components are depicted as single boxes located within a larger box, or nested within multiple boxes, in practice, computing devices may comprise multiple different physical components that make up a single illustrated component, and functionality may be partitioned between separate components. For example, a communication interface may be configured to include any of the components described herein, and / or the functionality of the components may be partitioned between the processing circuitry and the communication interface. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware and computationally intensive functions may be implemented in hardware.

[0126] Figure 18 shows an example of a communication system 1800 in accordance with some embodiments.

[0127] In the example, the communication system 1800 includes a telecommunication network 1802 that includes an access network 1804, such as a radio access network (RAN), and a core network 1806, which includes one or more core network nodes 1808. The access network 1804 includes one or more access network nodes, such as network nodes 1810a and 1810b (one or more of which may be generally referred to as network nodes 1810), or any other similar 3rd Generation Partnership Project (3GPP) access nodes or non-3GPP access points. Moreover, as will be appreciated by those of skill in the art, a network node is not necessarily limited to an implementation in which a radio portion and a baseband portion are supplied and integrated by a single vendor. Thus, it will be understood that network nodes include disaggregated implementations or portions thereof. For example, in some embodiments, the telecommunication network 1802 includes one or more Open-RAN (ORAN) network nodes. An ORAN network node is a node in the telecommunication network 1802 that supports an ORAN specification (e.g., a specification published by the O-RAN Alliance, or any similar organization) and may operate alone or together with other nodes to implement one or more functionalities of any node in the telecommunication network 1802, including one or more network nodes 1810 and / or core network nodes 1808.

[0128] Examples of an ORAN network node include an open radio unit (O-RU), an open distributed unit (O-DU), an open central unit (O-CU), including an O-CU control plane (O-CU- CP) or an O-CU user plane (O-CU-UP), a RAN intelligent controller (near-real time or non-real time) hosting software or software plug-ins, such as a near-real time control application (e.g.,xApp) or a non-real time control application (e.g., rApp), or any combination thereof (the adjective “open” designating support of an ORAN specification). The network node may support a specification by, for example, supporting an interface defined by the ORAN specification, such as an Al, Fl, Wl, El, E2, X2, Xn interface, an open fronthaul user plane interface, or an open fronthaul management plane interface. Moreover, an ORAN access node may be a logical node in a physical node. Furthermore, an ORAN network node may be implemented in a virtualization environment (described further below) in which one or more network functions are virtualized. For example, the virtualization environment may include an O-Cloud computing platform orchestrated by a Service Management and Orchestration Framework via an 0-2 interface defined by the 0-RAN Alliance or comparable technologies. The network nodes 1810 facilitate direct or indirect connection of user equipment (UE), such as by connecting UEs 1812a, 1812b, 1812c, and 1812d (one or more of which may be generally referred to as UEs 1812) to the core network 1806 over one or more wireless connections.

[0129] Example wireless communications over a wireless connection include transmitting and / or receiving wireless signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for conveying information without the use of wires, cables, or other material conductors. Moreover, in different embodiments, the communication system 1800 may include any number of wired or wireless networks, network nodes, UEs, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals whether via wired or wireless connections. The communication system 1800 may include and / or interface with any type of communication, telecommunication, data, cellular, radio network, and / or other similar type of system.

[0130] The UEs 1812 may be any of a wide variety of communication devices, including wireless devices arranged, configured, and / or operable to communicate wirelessly with the network nodes 1810 and other communication devices. Similarly, the network nodes 1810 are arranged, capable, configured, and / or operable to communicate directly or indirectly with the UEs 1812 and / or with other network nodes or equipment in the telecommunication network 1802 to enable and / or provide network access, such as wireless network access, and / or to perform other functions, such as administration in the telecommunication network 1802.

[0131] In the depicted example, the core network 1806 connects the network nodes 1810 to one or more host computing systems, such as host 1816. These connections may be direct orindirect via one or more intermediary networks or devices. In other examples, network nodes may be directly coupled to hosts. The core network 1806 includes one more core network nodes (e.g., core network node 1808) that are structured with hardware and software components. Features of these components may be substantially similar to those described with respect to the UEs, network nodes, and / or hosts, such that the descriptions thereof are generally applicable to the corresponding components of the core network node 1808. Example core network nodes include functions of one or more of a Mobile Switching Center (MSC), Mobility Management Entity (MME), Home Subscriber Server (HSS), Access and Mobility Management Function (AMF), Session Management Function (SMF), Authentication Server Function (AUSF), Subscription Identifier De-concealing function (SIDF), Unified Data Management (UDM), Security Edge Protection Proxy (SEPP), Network Exposure Function (NEF), and / or a User Plane Function (UPF).

[0132] The host 1816 may be under the ownership or control of a service provider other than an operator or provider of the access network 1804 and / or the telecommunication network 1802. The host 1816 may host a variety of applications to provide one or more service. Examples of such applications include live and pre-recorded audio / video content, data collection services such as retrieving and compiling data on various ambient conditions detected by a plurality of UEs, analytics functionality, social media, functions for controlling or otherwise interacting with remote devices, functions for an alarm and surveillance center, or any other such function performed by a server.

[0133] As a whole, the communication system 1800 of Figure 18 enables connectivity between the UEs, network nodes, and hosts. In that sense, the communication system may be configured to operate according to predefined rules or procedures, such as specific standards that include, but are not limited to: Global System for Mobile Communications (GSM); Universal Mobile Telecommunications System (UMTS); Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, 5G standards, or any applicable future generation standard (e.g., 6G); wireless local area network (WLAN) standards, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards (WiFi); and / or any other appropriate wireless communication standard, such as the Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, Near Field Communication (NFC) ZigBee, LiFi, and / or any low-power wide-area network (LPWAN) standards such as LoRa and Sigfox.

[0134] In some examples, the telecommunication network 1802 is a cellular network that implements 3GPP standardized features. Accordingly, the telecommunications network 1802 may support network slicing to provide different logical networks to different devices that are connected to the telecommunication network 1802. For example, the telecommunications network 1802 may provide Ultra Reliable Low Latency Communication (URLLC) services to some UEs, while providing Enhanced Mobile Broadband (eMBB) services to other UEs, and / or Massive Machine Type Communication (mMTC) / Massive loT services to yet further UEs.

[0135] In some examples, the UEs 1812 are configured to transmit and / or receive information without direct human interaction. For instance, a UE may be designed to transmit information to the access network 1804 on a predetermined schedule, when triggered by an internal or external event, or in response to requests from the access network 1804. Additionally, a UE may be configured for operating in single- or multi -RAT or multi-standard mode. For example, a UE may operate with any one or combination of Wi-Fi, NR (New Radio) and LTE, i.e. being configured for multi-radio dual connectivity (MR-DC), such as E-UTRAN (Evolved-UMTS Terrestrial Radio Access Network) New Radio - Dual Connectivity (EN-DC).

[0136] In the example, the hub 1814 communicates with the access network 1804 to facilitate indirect communication between one or more UEs (e.g., UE 1812c and / or 1812d) and network nodes (e.g., network node 1810b). In some examples, the hub 1814 may be a controller, router, content source and analytics, or any of the other communication devices described herein regarding UEs. For example, the hub 1814 may be a broadband router enabling access to the core network 1806 for the UEs. As another example, the hub 1814 may be a controller that sends commands or instructions to one or more actuators in the UEs. Commands or instructions may be received from the UEs, network nodes 1810, or by executable code, script, process, or other instructions in the hub 1814. As another example, the hub 1814 may be a data collector that acts as temporary storage for UE data and, in some embodiments, may perform analysis or other processing of the data. As another example, the hub 1814 may be a content source. For example, for a UE that is a VR device, display, loudspeaker, or other media delivery device, the hub 1814 may retrieve VR assets, video, audio, or other media or data related to sensory information via a network node, which the hub 1814 then provides to the UE either directly, after performing local processing, and / or after adding additional local content. In still another example, the hub 1814 actsas a proxy server or orchestrator for the UEs, in particular if one or more of the UEs are low energy loT devices.

[0137] The hub 1814 may have a constant / persistent or intermittent connection to the network node 1810b. The hub 1814 may also allow for a different communication scheme and / or schedule between the hub 1814 and UEs (e.g., UE 1812c and / or 1812d), and between the hub 1814 and the core network 1806. In other examples, the hub 1814 is connected to the core network 1806 and / or one or more UEs via a wired connection. Moreover, the hub 1814 may be configured to connect to an M2M service provider over the access network 1804 and / or to another UE over a direct connection. In some scenarios, UEs may establish a wireless connection with the network nodes 1810 while still connected via the hub 1814 via a wired or wireless connection. In some embodiments, the hub 1814 may be a dedicated hub - that is, a hub whose primary function is to route communications to / from the UEs from / to the network node 1810b. In other embodiments, the hub 1814 may be a non-dedicated hub - that is, a device which is capable of operating to route communications between the UEs and network node 1810b, but which is additionally capable of operating as a communication start and / or end point for certain data channels.

[0138] In some embodiments, a computing device for unlearning in VFL is provided. The computing device includes a memory; and processing circuitry coupled to the memory, wherein the processor is configured to perform one or more of the processes or algorithms described herein.

[0139] In some embodiments, an apparatus is provided including processing circuitry and a memory, the memory containing instructions executable by the processing circuitry, whereby the apparatus is operative to perform any of the methods disclosed herein. In some embodiments, the processing circuitry includes one or more of: a central processing unit (CPU), a graphics processing unit (GPU), a field-programmable gate array (FPGA), an application specific integrated circuit (ASIC), and / or other machine learning or unlearning hardware.

[0140] In some embodiments, a computer program is provided comprising instructions for adapting an apparatus to perform any of the methods disclosed herein. In another aspect, there is provided a carrier containing the computer program wherein the carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium.

[0141] According to embodiments, some or all of the functions described herein may be implemented as virtual components executed by one or more virtual machines (VMs) implemented in one or more virtual environments hosted by one or more of hardware nodes, such as a hardwarecomputing device that operates as a network node, UE, core network node, or host. Further, in embodiments in which the virtual node does not require radio connectivity (e.g., a core network node or host), then the node may be entirely virtualized. In some embodiments, a virtualization environment includes components defined by the O-RAN Alliance, such as an O-Cloud environment orchestrated by a Service Management and Orchestration Framework via an 0-2 interface. Virtualization may facilitate distributed implementations of a network node, UE, core network node, or host. Applications (which may alternatively be called software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) are run in the virtualization environment to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein. In the present context, virtualizing means creating virtual versions of apparatuses or devices which may include virtualizing hardware platforms, storage devices and networking resources. As used herein, virtualization can be applied to any device described herein, or components thereof, and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components.

[0142] While various embodiments are described herein, it should be understood that they have been presented by way of example only, and not limitation. Thus, the breadth and scope of this disclosure should not be limited by any of the above-described exemplary embodiments. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed by the disclosure unless otherwise indicated herein or otherwise clearly contradicted by context.

[0143] Additionally, as used herein, transmitting a message to a device encompasses transmitting the message directly to the device or transmitting the message indirectly to the device (i.e., one or more nodes are used to relay the message from the source to the device). Likewise, as used herein, receiving a message from a device encompasses receiving the message directly from the device or indirectly from the device (i.e., one or more nodes are used to relay the message from the device to the receiving node).

[0144] Additionally, while the processes described above and illustrated in the drawings are shown as a sequence of steps, this was done solely for the sake of illustration. Accordingly, it is contemplated that some steps may be added, some steps may be omitted, the order of the steps may be re-arranged, and some steps may be performed in parallel.

Claims

CLAIMS:

1. A computer-implemented method (1400) for machine unlearning in vertical federated learning ,VFL, comprising: receiving (si 402) a request to unlearn a first party having a first machine learning, ML model, wherein the request is received by a second party having a second ML model trained using at least the one or more embeddings of the first party; initializing (sl404), in response to the unlearn request, a third ML model; generating (si 406) modified input data by removing the one or more embeddings of the first party and / or any intermediate representations relating to the first party from an existing dataset comprising embeddings received from a plurality of parties; and training (si 408) the third ML model using the modified input data.

2. The method according to claim 1, wherein training the third ML model comprises: generating initial predictions using the second ML model and the existing dataset; generating updated predictions using the third ML model and the modified input data; and determining a total loss based at least in part on the initial predictions and the updated predictions.

3. The method according to claims 1 or 2, wherein determining the total loss is based on a sum of a prediction loss and a distillation loss.

4. The method according to any of claims 1-3, wherein:(i) the first party is a passive party;(ii) the second party is an active party;(iii) the first ML model is a head model;(iv) the second ML model is a tail model;(v) the one or more embeddings result from a forward pass of the first ML model; and / or(vi) the second ML model is a teacher model and the third ML model is a student model.

5. The method according to any of claims 1-4, wherein the first ML model and the second ML model are each part of the VFL.

6. The method according to any of claims 1-5, wherein training the third ML model comprises updating the third ML model.

7. The method according to any of claims 1-6, further comprising: retrieving the existing dataset.

8. The method according to any of claims 1-7, wherein:(i) the existing dataset is a concatenation of embeddings from trained ML models from the plurality of parties; and / or(ii) the existing dataset comprises embeddings from two or more parties running different ML models within the same VFL architecture.

9. The method according to any of claims 1-8, wherein the second party does not have access to data used by the first ML model for training to generate the one or more embeddings.

10. The method according to claim 5, further comprising: replacing the second ML model with the third ML model in the VFL architecture, wherein the third ML model was trained without using the one or more embeddings of the first party.

11. The method according to any of claims 1-10, further comprising: performing an audit to determine the effectiveness of unlearning with respect to the one or more embeddings of the first party.

12. The method according to claim 11, further comprising: receiving an audit request from the first party; and providing, in response to the request, an indication to the first party regarding the effectiveness or completion of the unlearning with respect to the one or more embeddings of the first party.

13. The method according to any of claims 1-12, wherein the first ML model, the second ML model, and the third ML model are each a neural network, NN.

14. The method according to any of claims 1-13, wherein the request comprises one or more embeddings of the first party or an identifier of what should be unlearned.

15. The method according to any of claims 1-14, wherein the identifier identifies embeddings of features, samples, or participants to be unlearned.

16. The method according to any of claims 1-15, wherein the VFL is used in a telecommunications network or at least one of the first or second party is a node or device of the telecommunications network.

17. The method according to any of claims 1-16, wherein the VFL is used in a 3GPP network architecture.

18. The method according to any of claims 1-17, wherein the third model is based on the second model.

19. The method according to claim 18, wherein the third model has the same architecture as the second model with randomly initialized weights.

20. The method according to any of claims 1-19, wherein the request to unlearn is a request to unlearn a participant.

21. A computer-implemented method (1420) for machine unlearning in vertical federated learning, VFL, comprising: receiving (si 422) a request to unlearn a feature of a first machine learning, ML model of a first party, wherein the first ML model is part of a VFL model distributed amongst a plurality of parties; initiating (sl424) a second ML model; generating (si 426) one or more first embeddings from the first ML model trained using a dataset including the feature that is requested to be unlearned; generating (si 428) one or more second embeddings from the second ML model trained using a dataset that does not include the feature that is requested to be unlearned; determining (si 430) a loss based on the one or more first embeddings and the one or more second embeddings; and updating (si 432) the second ML model.

22. The method according to claim 21, wherein determining the loss is based on a single loss function.

23. The method according to claims 21 or 22, wherein:(i) the first party is a passive party;(ii) the first ML model is a head model;(iii) the second ML model is a passive model; and / or(iv) the first ML model is a teacher model and the second ML model is a student model.

24. A computer-implemented method (1440) for machine unlearning in vertical federated learning, VFL, comprising: initiating (si 442) unlearning of one or more samples of a first party having a first machine learning, ML, model; performing (sl444) an unlearning process, wherein the unlearning process comprises: training a second ML model using the one or more samples to generate one or more unlearning embeddings, wherein the second ML model is a ML model of a second party; determining a loss based at least in part on the generated one or more unlearning embeddings and an optimization based on a gradient ascent process, and updating the second ML model; obtaining (si 446) an updated sample set; and performing (sl448) a learning process, wherein the learning process comprises: training the second ML model using the updated sample set.

25. The method according to claim 24, wherein the learning process comprises: generating one or more learning embeddings from the second ML model; determining a loss based at least in part on the generated one or more learning embeddings and an optimization based on a gradient descent process; and updating the second ML model.

26. The method according to claim 24 or 25, wherein obtaining the updated sample set comprises: retrieving an original set of samples; and generating an initial updated sample set based on removal of the sample information to be unlearned from the original set of samples.

27. The method according to claim 26, further comprising: selecting a sub-set of samples from the initial updated sample set.

28. The method according to any of claims 24-27, further comprising: receiving a request to unlearn the one or more samples.

29. The method according to any of claims 24-28, wherein(i) the first party is a passive party,(ii) the second party is an active party,(iii) the first ML model is a head model,(iv) the second ML model is a tail model,(v) the first ML model and the second ML model are both part of the same VFL, and / or(vi) the one or more samples of the first party comprises one or more embeddings or activations resulting from a forward pass of the first ML model.

30. The method according to any of claims 24-29, further comprising: performing an audit to determine the effectiveness of unlearning with respect to the requested sample.

31. A computer-implemented method (1460) for machine unlearning in vertical federated learning, VFL in a 3GPP network architecture, comprising: receiving (si 462) an initial request for unlearning, wherein the request includes one or more of an analytics ID, area of interest, and / or identification of information to be unlearned; selecting (sl464), from a plurality of parties represented as different Network Data and Analytics Functions, NWDAFs, in a VFL training process, one or more of an effected first party and / or second party based on the received initial request; and performing (si 466) unlearning according to any of claims 1-30 for at least one selected effected party.

32. The method according to claim 31, further comprising: sending an unlearning request message, wherein the unlearning request message is sent to and / or received from a Network Data and Analytics Function, NWDAF, configured as a VFL client.

33. The method according to claims 31 or 32, further comprising: receiving an unlearning response message, wherein the unlearning response message is received at the NWDAF from the VFL client.

34. A computer-implemented method (1480) for machine unlearning in vertical federated learning, VFL in an Open Radio Access Network, ORAN, comprising: receiving (si 482) an unlearning request; retrieving (sl484) one or more machine learning, ML, models related to the unlearning request; retrieving (si 486) embeddings relating to the unlearning request; andperforming (sl488) unlearning on one or more of the retrieved models based on the retrieved data and according to any of claims 1-30.

35. The method according to claim 34, wherein the method is performed in a producer application for artificial intelligence, Al, or ML services and the unlearning request is received from a consumer application of the AI / ML services.

36. The method according to claims 35 or36, wherein the one or more ML models are retrieved from a model repository and / or the data is retrieved from a Data Management at Exposure, DME, function.

37. The method according to any of claims 34-36, wherein the retrieved one or more ML models are for an active party, for a passive party, a head model, or a tail model.

38. A node configured to performed any of claims 1-37.

39. A computer program comprising instructions which, when executed by processing circuitry of a node causes the node to perform the method according to any of claims 1-37.

40. A carrier containing the computer program of claim 39, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, and a computer readable storage medium.

Images