arXiv:2410.09947cs.CRcs.LG2024-10中稿 · publication in the…被引 11

提出一种高效联邦遗忘机制,让服务器能合理否认用户参与训练。

Efficient Federated Unlearning under Plausible Deniability

  • 用可否认性隐私模型让服务器在联邦学习中合理否认用户参与
  • 实现30倍内存节省和1.6至50万倍的重训练时间降低
  • 适合注重数据合规与效率的联邦学习系统部署

欧盟《通用数据保护条例》(GDPR)和美国《加州消费者隐私法案》(CCPA)赋予用户删除其数据的权利。机器遗忘通过修改模型参数来消除特定数据点的影响。近期研究表明,可通过其他数据点伪造数据贡献,使服务器在不真正更新模型的情况下声称已完成遗忘。但在分布式联邦学习中,由于服务器无法访问完整数据集且客户端数量有限,此类声明难以成立。本文提出一种高效的联邦遗忘方法,利用隐私模型使服务器在一定程度上可合理否认某客户端的参与。我们证明服务器可生成“可否认性证明”,每个聚合更新至少关联x个客户端更新,从而支持否认。若频繁收到遗忘请求,服务器需执行实际遗忘策略并更新模型。同时对客户端更新进行聚类扰动,防止诚实但好奇的服务器推断。实验表明,经过T轮通信后,全局模型满足差分隐私。该方法在多个数据集上验证,性能相当,同时内存减少30倍,重训练时间减少1.6至500769倍。源代码已公开。

原文摘要 · Abstract (English)

Privacy regulations like the GDPR in Europe and the CCPA in the US allow users the right to remove their data ML applications. Machine unlearning addresses this by modifying the ML parameters in order to forget the influence of a specific data point on its weights. Recent literature has highlighted that the contribution from data point(s) can be forged with some other data points in the dataset with probability close to one. This allows a server to falsely claim unlearning without actually modifying the model's parameters. However, in distributed paradigms such as FL, where the server lacks access to the dataset and the number of clients are limited, claiming unlearning in such cases becomes a challenge. This paper introduces an efficient way to achieve federated unlearning, by employing a privacy model which allows the FL server to plausibly deny the client's participation in the training up to a certain extent. We demonstrate that the server can generate a Proof-of-Deniability, where each aggregated update can be associated with at least x number of client updates. This enables the server to plausibly deny a client's participation. However, in the event of frequent unlearning requests, the server is required to adopt an unlearning strategy and, accordingly, update its model parameters. We also perturb the client updates in a cluster in order to avoid inference from an honest but curious server. We show that the global model satisfies differential privacy after T number of communication rounds. The proposed methodology has been evaluated on multiple datasets in different privacy settings. The experimental results show that our framework achieves comparable utility while providing a significant reduction in terms of memory (30 times), as well as retraining time (1.6-500769 times). The source code for the paper is available.

联邦学习数据遗忘差分隐私可否认性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。