用更少噪声实现同样安全的模型删改，提升效率与效果
Less Noise, Same Certificate: Retain Sensitivity for Unlearning
- 提出保留敏感度，仅关注被删数据影响，而非全数据集
- 实验显示在多种任务中噪声减少30%以上，性能不变
- 适合需要高效安全删改的场景，如医疗或金融数据处理
认证机器删改旨在通过生成与在保留集 $R:=S\setminus U$ 上重新训练输出无统计差异的输出，来可证明地移除删除集 $U$ 对模型的影响。现有方法多借鉴差分隐私（DP）技术，以全局敏感度为基础添加噪声，即所有相邻数据集下的最坏情况输出变化。本文指出，该做法对删改任务过于保守，因删改无需保护保留数据 $R$ 的隐私。为此，我们定义‘保留敏感度’：固定 $R$ 时，删除 $U$ 引起的最坏输出变化。此度量虽不足以满足差分隐私，但恰好足以支持删改认证，允许在相同证书下使用更少噪声。我们在最小生成树权重、主成分分析（PCA）和经验风险最小化（ERM）等任务中理论与实证验证了噪声降低。进一步，基于保留敏感度重新分析两种主流删改算法，利用 $R$ 的规律性进一步减少噪声，提升模型效用。
原文摘要 · Abstract (English)
Certified machine unlearning aims to provably remove the influence of a deletion set $U$ from a model trained on a dataset $S$, by producing an unlearned output that is statistically indistinguishable from retraining on the retain set $R:=S\setminus U$. Many existing certified unlearning methods adapt techniques from Differential Privacy (DP) and add noise calibrated to global sensitivity, i.e., the worst-case output change over all adjacent datasets. We show that this DP-style calibration is often overly conservative for unlearning, based on a key observation: certified unlearning, by definition, does not require protecting the privacy of the retained data $R$. Motivated by this distinction, we define retain sensitivity as the worst-case output change over deletions $U$ while keeping $R$ fixed. While insufficient for DP, retain sensitivity is exactly sufficient for unlearning, allowing for the same certificates with less noise. We validate these reductions in noise theoretically and empirically across several problems, including the weight of minimum spanning trees, PCA, and ERM. Finally, we refine the analysis of two widely used certified unlearning algorithms through the lens of retain sensitivity, leveraging the regularity induced by $R$ to further reduce noise and improve utility.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。