提出新方法解决遗忘模型泄露信息问题，提升隐私安全性。
On the Necessity of Output Distribution Reweighting for Effective Class Unlearning
- 通过调整输出分布逼近重训练模型的类间概率，缓解遗忘漏洞。
- 在CIFAR-10上使最先进方法的评分差距缩小19%至46%。
- 适合关注模型隐私与安全性的研究人员使用。
本文揭示了现有类别遗忘评估中的关键缺陷：忽略类别几何结构会导致遗忘类信息泄露。为此，我们提出一种简单有效的遗忘策略。引入类别成员推理攻击（CMIA），利用模型对邻近类的概率分配来检测被遗忘样本。发现现有方法在多个数据集上均易受该攻击。我们进一步设计新的微调目标，通过估计类间相似性并倾斜目标模型分布，使遗忘类输入的输出分布逼近从头训练模型的结果。由此生成的倾斜重加权（TREW）分布作为微调时的理想目标。实验表明，在多个基准测试中，TREW在原有遗忘指标上达到或超越现有方法；在CIFAR-10上，相较于当前最优方法，其U-LiRA和CMIA得分分别降低19%和46%。代码已公开于https://github.com/CrowdDynamicsLab/ICML_TREW。
原文摘要 · Abstract (English)
In this paper, we reveal a significant shortcoming in class unlearning evaluations: overlooking the underlying class geometry can cause information leakage about the forgotten class. We further propose a simple unlearning strategy to mitigate this issue. We introduce Class Membership Inference Attack (CMIA) that uses the probabilities assigned by the model to neighboring classes to detect unlearned samples. We find that existing unlearning methods are vulnerable to CMIA across multiple datasets. We then propose a new fine-tuning objective that mitigates this privacy leakage by approximating, for forget-class inputs, the distribution over the remaining classes that a retrained-from-scratch model would produce. To construct this approximation, we estimate inter-class similarity and tilt the target model's distribution accordingly. The resulting Tilted REWeighting (TREW) distribution serves as the desired distribution during fine-tuning. We also show that across multiple benchmarks, TREW matches or surpasses existing unlearning methods on prior unlearning metrics. More specifically, on CIFAR-10, it reduces the gap with retrained models by 19% and 46% for U-LiRA and CMIA scores, accordingly, compared to the SOTA method for each category. Our code is publicly available at https://github.com/CrowdDynamicsLab/ICML_TREW.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。