对比18种方法,找到高效清除模型记忆的最优解。
Deep Unlearn: Benchmarking Machine Unlearning for Image Classification
- 测试10万+模型,系统评估深度学习模型删数能力。
- MSG和CT方法在准确率与速度上表现更优。
- 建议用新基线方法和调参提升评估可靠性。
机器删数(MU)旨在消除特定数据点对已训练模型参数的影响,这对数据隐私、模型可信度和安全性至关重要。由于深度神经网络(如卷积网络或视觉变压器)容易记忆训练数据的大量内容,实现有效删数尤为困难。然而,当前社区缺乏针对深度神经网络的严谨且多维度的删数方法研究。本文系统评估了18种前沿删数方法在多种基准数据集和模型上的表现,每项实验进行10次随机初始化,共涉及超过10万次模型训练。结果表明,在合理超参数设置下,掩码小梯度(MSG)和转置卷积(CT)在不同模型、数据集和初始化条件下,均在模型准确率和运行效率上表现更佳,经群体性成员推断攻击(MIA)和逐样本删数似然比攻击(U-LiRA)验证。此外,研究揭示仅与常用基线(如梯度上升GA或连续随机重标记SRL)比较是不足的,需采用如负梯度加(NG+)等更优基线并配合恰当调参。
原文摘要 · Abstract (English)
Machine unlearning (MU) aims to remove the influence of particular data points from the learnable parameters of a trained machine learning model. This is a crucial capability in light of data privacy requirements, trustworthiness, and safety in deployed models. MU is particularly challenging for deep neural networks (DNNs), such as convolutional nets or vision transformers, as such DNNs tend to memorize a notable portion of their training dataset. Nevertheless, the community lacks a rigorous and multifaceted study that looks into the success of MU methods for DNNs. In this paper, we investigate 18 state-of-the-art MU methods across various benchmark datasets and models, with each evaluation conducted over 10 different initializations, a comprehensive evaluation involving MU over 100K models. We show that, with the proper hyperparameters, Masked Small Gradients (MSG) and Convolution Transpose (CT), consistently perform better in terms of model accuracy and run-time efficiency across different models, datasets, and initializations, assessed by population-based membership inference attacks (MIA) and per-sample unlearning likelihood ratio attacks (U-LiRA). Furthermore, our benchmark highlights the fact that comparing a MU method only with commonly used baselines, such as Gradient Ascent (GA) or Successive Random Relabeling (SRL), is inadequate, and we need better baselines like Negative Gradient Plus (NG+) with proper hyperparameter selection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。