ZK-APEX: Zero-Knowledge Approximate Personalized Unlearning with Executable Proofs

2025-12-09

AI Summary

To address the challenge of verifiably deleting specified samples in edge-based personalized model unlearning—where the server cannot validate whether clients have genuinely erased targeted data—we propose the first verifiable and lightweight edge unlearning framework. Methodologically, we pioneer the integration of zero-knowledge proofs (Halo2) with curvature-aware sparse compensation: leveraging block-wise empirical Fisher matrices to guide Group OBS-based sparse masking, enabling provable unlearning without accessing client data or model parameters, retraining, or model uploads. Our approach restores 99.8% and 70% of personalized accuracy on ViT and OPT-125M, respectively. Proof generation requires only two hours, consumes under 1 GB memory, and yields proofs of ~400 MB; verification is six orders of magnitude faster than retraining-based alternatives. The framework simultaneously ensures privacy preservation, utility retention, and practical deployability on resource-constrained edge devices.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Computer Vision: Large Vision Models
• Search and Optimization: Learning to Search

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Machine unlearning aims to remove the influence of specific data points from a trained model to satisfy privacy, copyright, and safety requirements. In real deployments, providers distribute a global model to many edge devices, where each client personalizes the model using private data. When a deletion request is issued, clients may ignore it or falsely claim compliance, and providers cannot check their parameters or data. This makes verification difficult, especially because personalized models must forget the targeted samples while preserving local utility, and verification must remain lightweight on edge devices. We introduce ZK APEX, a zero-shot personalized unlearning method that operates directly on the personalized model without retraining. ZK APEX combines sparse masking on the provider side with a small Group OBS compensation step on the client side, using a blockwise empirical Fisher matrix to create a curvature-aware update designed for low overhead. Paired with Halo2 zero-knowledge proofs, it enables the provider to verify that the correct unlearning transformation was applied without revealing any private data or personalized parameters. On Vision Transformer classification tasks, ZK APEX recovers nearly all personalization accuracy while effectively removing the targeted information. Applied to the OPT125M generative model trained on code data, it recovers around seventy percent of the original accuracy. Proof generation for the ViT case completes in about two hours, more than ten million times faster than retraining-based checks, with less than one gigabyte of memory use and proof sizes around four hundred megabytes. These results show the first practical framework for verifiable personalized unlearning on edge devices.

Problem

• Verifies unlearning compliance without revealing private data
• Enables lightweight verification on resource-constrained edge devices
• Removes targeted data influence while preserving model personalization

Innovation

• Zero-knowledge proofs verify unlearning without revealing data
• Sparse masking and Group OBS compensation enable lightweight updates
• Blockwise empirical Fisher matrix provides curvature-aware low-overhead transformation