不依赖原始数据,也能让被遗忘的类别重新出现,揭示了模型遗忘的漏洞。
Source-Free Class Relearning: Diagnosing Forgetting in Class Unlearning

- 仅用未学习模型和合成样本,通过梯度更新恢复被遗忘类别
- 在多个数据集上发现多种遗忘方法存在显著可复现性,部分甚至超过重训练
- 提出新评估指标RS,同时衡量恢复能力和保留性能,适合安全审计
类遗忘旨在消除模型对指定遗忘类别的识别能力,同时保持对保留类别的性能。然而,遗忘后低准确率并不意味着类别结构已被彻底抹除。近似遗忘方法可能改变分类器决策边界,但在表征空间中仍保留可恢复的结构。先前研究已表明遗忘类别可被重建,但现有方法需真实遗忘或保留样本、辅助数据或参考检查点。本文在严格无源设置下研究类重学习,探讨是否可通过仅使用未学习模型的分类头更新来恢复遗忘类别。基于理论分析,我们提出一个白盒源自由重学习审计(SFRA):生成表示空间中的候选嵌入,利用模型引导的置信度过滤构建高置信保留探针与低置信边界邻近探针,并将其重标记为遗忘类别。默认采用高斯采样和Softmax置信度,消融实验显示可恢复性不依赖于具体选择。为量化可恢复性,引入重学习得分(RS),联合衡量遗忘类恢复与保留性能保持,报告与重训练参照相比的类匹配ΔRS。在CIFAR-10、CIFAR-100和TinyImageNet上使用ResNet-18、ViT-B/16和Swin-T的实验表明,多种遗忘方法存在显著源自由可恢复性,且部分方法的可恢复性超过匹配的重训练参照。
原文摘要 · Abstract (English)
Class unlearning aims to remove a model's ability to recognize designated forget classes while preserving performance on retain classes. However, low forget accuracy after unlearning does not necessarily mean the class structure has been erased. Approximate unlearning methods can alter classifier decision boundaries while leaving recoverable structure in the representation. Prior work has shown that forget classes can be recovered, but existing approaches require real forget or retain samples, auxiliary data, or reference checkpoints. We study class relearning in a strictly source-free setting, asking whether a forget class can be recovered through a classifier-head update using only the unlearned model. Our approach rests on a theoretical analysis establishing a sufficient alignment condition under which a single gradient step on a synthetic probe set increases the expected logit margin of the forget class. Building on this, we propose a white-box Source-Free Relearning Audit (SFRA), which generates candidate embeddings in representation space and uses model-guided confidence filtering to construct high-confidence retain probes and low-confidence boundary-adjacent probes that are relabelled as the forget class. Gaussian sampling and Softmax confidence are used by default, while ablations with alternative proposal distributions and uncertainty criteria show that recoverability is not specific to these choices. To quantify recoverability, we introduce the Relearning Score (RS), which jointly measures forget-class recovery and retain-accuracy preservation, and report class-matched $\Delta$RS relative to a retrained reference. Experiments on CIFAR-10, CIFAR-100, and TinyImageNet with ResNet-18, ViT-B/16, and Swin-T show that several unlearning methods exhibit substantial source-free recoverability, and that for a subset of methods this recoverability exceeds the matched retrained reference.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。