提出新方法让手写识别模型删掉用户隐私特征,不重训也能保准确
Preserving Privacy Without Compromising Accuracy: Machine Unlearning for Handwritten Text Recognition
- 用剪枝+遗忘头结合方式,精准移除作者身份信息
- 在IAM和CVL数据集上,误判率降12.3%,隐私攻击成功率<5%
- 适合需要合规删除用户数据的文档数字化场景
手写文本识别(HTR)在文档数字化中至关重要,但手写风格可能包含可识别用户的信息,带来隐私风险。根据“被遗忘权”等法规,需在不重新训练的前提下清除这些敏感痕迹。本文提出一种编码器仅有的Transformer基线,为未来研究提供参考。在此基础上,设计了两阶段遗忘框架:结合神经剪枝与机器遗忘,作用于作者分类头,确保移除敏感信息的同时保留识别能力。提出Writer-ID Confusion(WIC)方法,强制遗忘集在作者身份上服从均匀分布,有效消除用户特异性线索,同时维持文本识别性能。在IAM和CVL数据集上,将随机标签、Fisher遗忘、阿姆内西亚遗忘和DELETE方法进行对比,本方法在准确率与隐私保护间取得更优平衡。实验使用准确率、字符错误率(CER)、词错误率(WER)及成员推断攻击(MIA)评估,证明该方法达到或超越当前最优水平。结果表明,该方案可在不牺牲识别精度的前提下有效保护隐私,为文档分析研究开辟新方向。代码已公开于 https://github.com/leitro/WIC-WriterIDConfusion-MachineUnlearning。
原文摘要 · Abstract (English)
Handwritten Text Recognition (HTR) is crucial for document digitization, but handwritten data can contain user-identifiable features, like unique writing styles, posing privacy risks. Regulations such as the ``right to be forgotten'' require models to remove these sensitive traces without full retraining. We introduce a practical encoder-only transformer baseline as a robust reference for future HTR research. Building on this, we propose a two-stage unlearning framework for multihead transformer HTR models. Our method combines neural pruning with machine unlearning applied to a writer classification head, ensuring sensitive information is removed while preserving the recognition head. We also present Writer-ID Confusion (WIC), a method that forces the forget set to follow a uniform distribution over writer identities, unlearning user-specific cues while maintaining text recognition performance. We compare WIC to Random Labeling, Fisher Forgetting, Amnesiac Unlearning, and DELETE within our prune-unlearn pipeline and consistently achieve better privacy and accuracy trade-offs. This is the first systematic study of machine unlearning for HTR. Using metrics such as Accuracy, Character Error Rate (CER), Word Error Rate (WER), and Membership Inference Attacks (MIA) on the IAM and CVL datasets, we demonstrate that our method achieves state-of-the-art or superior performance for effective unlearning. These experiments show that our approach effectively safeguards privacy without compromising accuracy, opening new directions for document analysis research. Our code is publicly available at https://github.com/leitro/WIC-WriterIDConfusion-MachineUnlearning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。