通过轻量补丁修复实现可验证的神经网络遗忘，高效保护数据删除权。
PRUNE: A Patching Based Repair Framework for Certifiable Unlearning of Neural Networks
- 用最小补丁修改原模型，实现指定数据点的可验证遗忘。
- 迭代选择代表性数据点，可批量删除整个类别数据。
- 效果媲美主流方法，内存与效率更优，适合监管审计场景。
在训练好的神经网络中移除特定训练数据（即“遗忘”）具有重要意义，尤其在符合近期法规要求的数据主体被遗忘权背景下。现有方法通常需重新训练替代模型，成本高且难以验证。本文提出一种新思路：通过对原始模型施加精心设计的“补丁”，实现对指定数据的定向遗忘。受神经网络修复研究启发，我们提出寻找最小且轻量的补丁，以保证可验证的遗忘效果。针对大量数据点或整类数据的遗忘需求，进一步提出迭代选取代表性数据点进行遗忘的方法，达到整体遗忘效果。在多个分类数据集上的实验表明，该方法在保持模型性能的同时，实现了可度量的遗忘效果，在效率和内存消耗方面优于多种基线方法。
原文摘要 · Abstract (English)
It is often desirable to remove (a.k.a. unlearn) a specific part of the training data from a trained neural network model. A typical application scenario is to protect the data holder's right to be forgotten, which has been promoted by many recent regulation rules. Existing unlearning methods involve training alternative models with remaining data, which may be costly and challenging to verify from the data holder or a thirdparty auditor's perspective. In this work, we provide a new angle and propose a novel unlearning approach by imposing carefully crafted "patch" on the original neural network to achieve targeted "forgetting" of the requested data to delete. Specifically, inspired by the research line of neural network repair, we propose to strategically seek a lightweight minimum "patch" for unlearning a given data point with certifiable guarantee. Furthermore, to unlearn a considerable amount of data points (or an entire class), we propose to iteratively select a small subset of representative data points to unlearn, which achieves the effect of unlearning the whole set. Extensive experiments on multiple categorical datasets demonstrates our approach's effectiveness, achieving measurable unlearning while preserving the model's performance and being competitive in efficiency and memory consumption compared to various baseline methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。