arXiv:2603.07529cs.LG2026-03NeurIPS被引 1

提出新方法消除模型中的敏感属性,同时更好保留有用信息。

Obliviator Reveals the Cost of Nonlinear Guardedness in Concept Erasure

论文配图:Obliviator Reveals the Cost of Nonlinear Guardedness in Concept Erasure
图 1 · 摘自论文原文
  • 从函数视角建模擦除,通过迭代优化捕捉非线性依赖关系。
  • 首次量化非线性防护的代价,揭示保护与性能间的动态权衡。
  • 适用于需高安全性的场景,尤其对复杂模型表示效果更优。

概念擦除旨在移除学习表示中不希望存在的属性(如社会或人口特征),同时保持其任务相关效用。尽管目标是抵御所有攻击者,现有方法仍易受非线性攻击影响,原因在于未能充分捕捉表示与无关属性之间的复杂非线性统计依赖。此外,虽然效用与擦除之间存在预期权衡,但该权衡在擦除过程中的演变——即擦除成本——尚未被研究。本文提出Obliviator,一种后处理擦除方法,能完整捕捉非线性统计依赖。我们从函数角度建模擦除,形成涉及核函数复合的优化问题,无闭式解。因此采用迭代方法,逐步变形特征空间以实现更保用的擦除。与以往方法不同,Obliviator可抵御非线性攻击。其渐进式策略量化了非线性防护的成本,并揭示了擦除过程中属性保护与效用保持的动态关系。由Obliviator获得的效用-擦除权衡曲线优于基线,展现出强泛化能力:当应用于更具解耦能力的模型所学表示时,其擦除效果更保用。

原文摘要 · Abstract (English)

Concept erasure aims to remove unwanted attributes, such as social or demographic factors, from learned representations, while preserving their task-relevant utility. While the goal of concept erasure is protection against all adversaries, existing methods remain vulnerable to nonlinear ones. This vulnerability arises from their failure to fully capture the complex, nonlinear statistical dependencies between learned representations and unwanted attributes. Moreover, although the existence of a trade-off between utility and erasure is expected, its progression during the erasure process, i.e., the cost of erasure, remains unstudied. In this work, we introduce Obliviator, a post-hoc erasure method designed to fully capture nonlinear statistical dependencies. We formulate erasure from a functional perspective, leading to an optimization problem involving a composition of kernels that lacks a closed-form solution. Instead of solving this problem in a single shot, we adopt an iterative approach that gradually morphs the feature space to achieve a more utility-preserving erasure. Unlike prior methods, Obliviator guards unwanted attribute against nonlinear adversaries. Our gradual approach quantifies the cost of nonlinear guardedness and reveals the dynamics between attribute protection and utility-preservation over the course of erasure. The utility-erasure trade-off curves obtained by Obliviator outperform the baselines and demonstrate its strong generalizability: its erasure becomes more utility-preserving when applied to the better-disentangled representations learned by more capable models.

概念擦除非线性防御模型安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。