arXiv:2512.09953cs.CRcs.AI2025-12中稿 · the 9th Conference…被引 2

提出可验证的个性化模型删减方法,无需重训即可证明数据已清除。

ZK-APEX: Zero-Knowledge Approximate Personalized Unlearning with Executable Proofs

  • 在个性化模型上直接操作,结合稀疏掩码与小规模补偿更新。
  • 在视觉变换器任务中恢复近全量个性化准确率,代码生成模型恢复约70%准确率。
  • 使用零知识证明实现轻量验证,适合边缘设备部署。

机器遗忘旨在移除特定数据点对训练模型的影响,以满足隐私、版权和安全要求。在实际部署中,服务提供方可将全局模型分发至多个边缘设备,各客户端使用私有数据进行模型个性化。当收到删除请求时,客户端可能无视或虚假声称已合规,而提供方无法检查其参数或数据,导致验证困难。尤其因为个性化模型需在遗忘目标样本的同时保持本地效用,且验证过程必须在边缘设备上轻量化。我们提出 ZK APEX,一种无需重新训练的零样本个性化遗忘方法,直接作用于个性化模型。该方法结合提供方的稀疏掩码与客户端的小型群组观测偏差补偿(Group OBS),利用分块经验费雪矩阵设计曲率感知更新,实现低开销。搭配 Halo2 零知识证明,使提供方可在不暴露任何私有数据或个性化参数的前提下,验证正确的遗忘变换已被执行。在视觉变换器分类任务中,ZK APEX 恢复了几乎全部的个性化准确率;应用于在代码数据上训练的 OPT125M 生成模型时,恢复约 70% 的原始准确率。对于 ViT 案例,证明生成耗时约两小时,比基于重训的检测快超过一百万倍,内存使用低于 1 GB,证明大小约为 400 MB。这些结果展示了首个在边缘设备上可行的可验证个性化遗忘框架。

原文摘要 · Abstract (English)

Machine unlearning aims to remove the influence of specific data points from a trained model to satisfy privacy, copyright, and safety requirements. In real deployments, providers distribute a global model to many edge devices, where each client personalizes the model using private data. When a deletion request is issued, clients may ignore it or falsely claim compliance, and providers cannot check their parameters or data. This makes verification difficult, especially because personalized models must forget the targeted samples while preserving local utility, and verification must remain lightweight on edge devices. We introduce ZK APEX, a zero-shot personalized unlearning method that operates directly on the personalized model without retraining. ZK APEX combines sparse masking on the provider side with a small Group OBS compensation step on the client side, using a blockwise empirical Fisher matrix to create a curvature-aware update designed for low overhead. Paired with Halo2 zero-knowledge proofs, it enables the provider to verify that the correct unlearning transformation was applied without revealing any private data or personalized parameters. On Vision Transformer classification tasks, ZK APEX recovers nearly all personalization accuracy while effectively removing the targeted information. Applied to the OPT125M generative model trained on code data, it recovers around seventy percent of the original accuracy. Proof generation for the ViT case completes in about two hours, more than ten million times faster than retraining-based checks, with less than one gigabyte of memory use and proof sizes around four hundred megabytes. These results show the first practical framework for verifiable personalized unlearning on edge devices.

机器遗忘零知识证明边缘计算个性化模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。