用对抗样本让模型忘记指定数据，既快又不丢精度。
AMUN: Adversarial Machine UNlearning
- 用忘记样本的对抗样本微调模型，精准修改决策边界。
- 删掉CIFAR-10中10%数据后，攻击者无法区分样本是否曾被训练。
- 适合需要快速合规删除用户数据的场景，如隐私敏感应用。
机器遗忘允许用户请求删除特定数据，日益重要。早期精确遗忘方法（如重训练）计算开销大；而近似方法虽高效，却难以保持与精确遗忘相当的准确率和预测置信度。本文提出对抗机器遗忘（AMUN），通过在对应遗忘样本的对抗样本上微调模型，降低模型对遗忘样本的置信度。对抗样本自然属于模型输入空间的分布，将模型在靠近遗忘样本的对抗样本上微调，（a）使变化局限于每个遗忘样本附近的决策边界，（b）避免全局行为剧烈改变，从而保持测试集上的性能。在随机删除CIFAR-10中10%样本的实验中，即使最先进的成员推理攻击也无法优于随机猜测。
原文摘要 · Abstract (English)
Machine unlearning, where users can request the deletion of a forget dataset, is becoming increasingly important because of numerous privacy regulations. Initial works on ``exact'' unlearning (e.g., retraining) incur large computational overheads. However, while computationally inexpensive, ``approximate'' methods have fallen short of reaching the effectiveness of exact unlearning: models produced fail to obtain comparable accuracy and prediction confidence on both the forget and test (i.e., unseen) dataset. Exploiting this observation, we propose a new unlearning method, Adversarial Machine UNlearning (AMUN), that outperforms prior state-of-the-art (SOTA) methods for image classification. AMUN lowers the confidence of the model on the forget samples by fine-tuning the model on their corresponding adversarial examples. Adversarial examples naturally belong to the distribution imposed by the model on the input space; fine-tuning the model on the adversarial examples closest to the corresponding forget samples (a) localizes the changes to the decision boundary of the model around each forget sample and (b) avoids drastic changes to the global behavior of the model, thereby preserving the model's accuracy on test samples. Using AMUN for unlearning a random $10\%$ of CIFAR-10 samples, we observe that even SOTA membership inference attacks cannot do better than random guessing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。