通过行为差异控制实现无需模型参数的隐私数据遗忘。
CBD: API-Only LLM Black-Box Unlearning through Controlled Behavioral Divergence

- 利用辅助模型生成目标与保留输入的行为差异,构建遗忘信号。
- 在高相似提示下仍能精准区分需遗忘与需保留内容,遗忘效果提升15%。
- 仅需API调用,适合部署在边缘设备上保护敏感信息。
边缘设备越来越多地通过API调用大语言模型(LLM)实现上下文感知的边缘智能,但边缘生成的数据可能被用于改进模型,引入敏感、受版权保护、有害或过时的信息。机器遗忘提供了一种无需重训练即可消除不良数据影响的实用方法。然而现有方法仍面临两大挑战:一是仅能通过API访问黑盒模型,无法获取参数和内部logits;二是当需遗忘数据与保留数据具有高度相似的提示结构或语义模式时,如何保持保留数据的可用性。为此,我们提出受控行为发散(CBD)框架,仅使用API接口实现黑盒遗忘。CBD通过两个辅助模型,在保留输入与遗忘目标输入间制造可控行为差异,将该差异转化为遗忘相关性评分,并引导相关提示远离目标LLM。为提升在高相似度下的判别精度,CBD基于经验弗希特矩阵估计构建梯度统计判别基,通过求解正则化广义特征值问题,使遗忘信号聚焦于目标特定信息而非共享提示结构。相比十一种白盒与灰盒基线,CBD在遗忘效用权衡上表现更优,且性能在不同设置下变化小。在ToFU forget10上,其对遗忘集的表现接近重新训练基准,同时保留模型效用达74.90,比第二佳基线高出约15%。在WMDP上,其有害知识准确率降至25.68(接近随机猜测),同时保持MMLU准确率为52.67。代码已开源:https://github.com/DGL-codes/CBD。
原文摘要 · Abstract (English)
Edge devices increasingly invoke large language models (LLMs) through API services for context aware edge intelligence, while edge generated data may be collected to improve LLMs and may introduce sensitive, copyrighted, harmful, or outdated information into model behavior. Machine unlearning offers a practical way to remove the influence of undesired data without retraining LLMs. However, existing methods still face two gaps. The first is API only black box access, where target model parameters and internal logits are unavailable. The second is how to preserve retained utility when unlearning target data and retained data share highly similar prompt structures or semantic patterns. To address these challenges, we propose Controlled Behavioral Divergence (CBD), an API only black box unlearning framework. CBD uses two auxiliary models to create controlled behavioral divergence between retained inputs and unlearning target inputs, converts this divergence into an unlearning relevance score, and routes unlearning related prompts away from the target LLM. To improve discrimination accuracy under high similarity between target and retained data, CBD constructs a gradient statistics based discriminative basis by estimating empirical Fisher matrices and solving a regularized generalized eigenvalue problem, guiding the unlearning signal toward target specific information rather than shared prompt structures. Compared with eleven white box and gray box unlearning baselines, CBD achieves a better unlearning utility trade off and its performance varies little across settings. On ToFU forget10, CBD approaches the retrained reference on the forget set while raising model utility to 74.90, about 15% above the second best baseline. On WMDP, it lowers hazardous knowledge accuracy to 25.68, near random guessing, while preserving MMLU accuracy of 52.67. Code is at https://github.com/DGL-codes/CBD.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。