提出抗重学攻击的权重空间正则化方法，让模型真正遗忘。
From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization
- 通过权重空间距离和连接性预测模型是否易被重学。
- 仅用保留集微调，旧知识准确率可从50%升至近100%。
- 新方法在多种场景下实现最强抗重学能力，适合隐私敏感应用。
现有大模型遗忘方法易受重学攻击：即使仅用少量（甚至无关）样本微调，被遗忘的知识也会重现。我们在视觉分类器中系统研究了实例级遗忘的这一现象。令人意外的是，遗忘后准确率约50%的模型，仅通过保留集微调（零个遗忘样本），准确率即可恢复至近100%——此现象在多种遗忘方法中普遍存在。而从头训练排除遗忘集的模型（黄金标准）则保持在50%水平。我们发现，模型对重学攻击的抵抗能力可由权重空间特性预测，尤其是原始模型与遗忘后模型间的 $L_2$ 距离和线性模式连通性。基于此，我们提出一类新型方法，在多项指标上达到当前最优的抗重学性能。
原文摘要 · Abstract (English)
Recent unlearning methods for LLMs are vulnerable to relearning attacks: knowledge believed-to-be-unlearned re-emerges by fine-tuning on a small set of (even seemingly-unrelated) examples. We study this phenomenon in a controlled setting for example-level unlearning in vision classifiers. We make the surprising discovery that forget-set accuracy can recover from around 50% post-unlearning to nearly 100% with fine-tuning on just the retain set -- i.e., zero examples of the forget set. We observe this effect across a wide variety of unlearning methods, whereas for a model retrained from scratch excluding the forget set (gold standard), the accuracy remains at 50%. We observe that resistance to relearning attacks can be predicted by weight-space properties, specifically, $L_2$-distance and linear mode connectivity between the original and the unlearned model. Leveraging this insight, we propose a new class of methods that achieve state-of-the-art resistance to relearning attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。