arXiv:2507.07754cs.LGcs.AI2025-07被引 3

提出新方法让模型真正抹去数据记忆,防止被逆向恢复。

One-Point Contraction: Erasing Representational Separability toward Irreversible Deep Forgetting

  • 通过收缩遗忘数据特征至原点,实现表示层彻底擦除。
  • 现有方法仅隐藏信息,新方法使遗忘后数据无法重建,准确率仅降1%。
  • 适合关注隐私安全的模型训练者,尤其对抗数据泄露场景。

机器遗忘通常通过分类器输出评估:遗忘集准确率、置信度、成员推断得分。我们发现这不够充分。在CIFAR-10和SVHN上,14种代表性遗忘方法中,仅用一个在保留校准集上拟合的线性映射(无需访问遗忘数据),可在数秒内逆转遗忘,将遗忘集准确率恢复至原始模型的几百分比以内。恢复的特征甚至可通过通用解码器支持像素级重建,我们称此现象为特征映射恢复(FM-recovery)。该模式揭示统一规律:当前遗忘方法并未从表示中删除信息,而是施加可逆线性畸变,使其对特定预测头不可见。我们提出一点收缩(OPC)遗忘目标,将遗忘集特征收缩至原点,同时保持保留集几何结构不变。我们证明该收缩等价于将预测分布推向最大熵,从而同步实现行为遗忘与表示层擦除。遗忘查询落入网络视为分布外的区域,其梯度信号随特征一同崩溃。OPC是基准中唯一能抵御FM恢复、重学习与梯度反演攻击的方法,且在特征纠缠情况下解耦遗忘与保留特征,同时不牺牲保留或测试准确率。

原文摘要 · Abstract (English)

Machine unlearning is usually evaluated by what the classifier outputs: forget-set accuracy, confidence, membership-inference scores. We show that this is not enough. Across 14 representative unlearning methods on CIFAR-10 and SVHN, a single linear map fitted on a held-out calibration set, with no access to the forgotten data, reverses the unlearning in seconds and recovers forget-set accuracy to within a few percent of the original model. Recovered features even support pixel-level reconstruction through a generic decoder. We call this diagnostic Feature Mapping Recovery (FM-recovery). The pattern it exposes is uniform: current unlearning methods do not erase information from the representation, they apply an invertible linear distortion that hides it from one particular prediction head. We propose One-Point Contraction (OPC), an unlearning objective that collapses forget-set features to the origin while leaving the retain-set geometry intact. We prove that this contraction is equivalent to driving the predictive distribution to maximum entropy, so the same mechanism delivers behavioral forgetting and representation-level erasure at once. Forgotten queries land in a region the network treats as out-of-distribution, and the gradient signal on those queries collapses along with their features. OPC is the only method in our benchmark that survives FM-recovery, resists relearning and gradient-inversion attacks, and decouples forget from retain features in entangled settings, all without sacrificing retain or test accuracy.

机器遗忘隐私保护特征压缩

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。