单点收缩：擦除表示可分性以实现不可逆的深度遗忘
One-Point Contraction: Erasing Representational Separability toward Irreversible Deep Forgetting
AI总结：
本研究发现现有机器遗忘方法可被FM-recovery逆转，提出OPC方法，可实现行为与表示级遗忘，抵御攻击且不牺牲准确率。
摘要：
机器遗忘通常通过分类器的输出进行评估：遗忘集准确率、置信度、成员推理分数。我们表明这并不足够。在CIFAR-10和SVHN上针对14种代表性遗忘方法，我们利用一个在保留的校准集上拟合的单一线性映射（无需访问被遗忘数据），可在数秒内逆转遗忘过程，使遗忘集准确率恢复至原始模型的几个百分点范围内。恢复的特征甚至可通过通用解码器支持像素级重建。我们将这一诊断方法称为特征映射恢复（FM-recovery）。其揭示的模式是统一的：当前的遗忘方法并未从表示中擦除信息，而是应用了可逆线性变换，将信息隐藏于某一特定预测头。我们提出单点收缩（One-Point Contraction，OPC），这是一种遗忘目标，可将遗忘集特征收缩至原点，同时保留保留集的几何结构。我们证明该收缩等价于将预测分布驱动至最大熵，因此同一机制可同时实现行为遗忘和表示级擦除。被遗忘查询会落入网络视为分布外的区域，这些查询的梯度信号会随其特征一同收缩。OPC是我们基准中唯一能抵御FM-recovery、抵抗重学习和梯度反转攻击、在纠缠设置中分离遗忘与保留特征，且不牺牲保留或测试准确率的方法。
英文摘要：
Machine unlearning is usually evaluated by what the classifier outputs: forget-set accuracy, confidence, membership-inference scores. We show that this is not enough. Across 14 representative unlearning methods on CIFAR-10 and SVHN, a single linear map fitted on a held-out calibration set, with no access to the forgotten data, reverses the unlearning in seconds and recovers forget-set accuracy to within a few percent of the original model. Recovered features even support pixel-level reconstruction through a generic decoder. We call this diagnostic Feature Mapping Recovery (FM-recovery). The pattern it exposes is uniform: current unlearning methods do not erase information from the representation, they apply an invertible linear distortion that hides it from one particular prediction head. We propose One-Point Contraction (OPC), an unlearning objective that collapses forget-set features to the origin while leaving the retain-set geometry intact. We prove that this contraction is equivalent to driving the predictive distribution to maximum entropy, so the same mechanism delivers behavioral forgetting and representation-level erasure at once. Forgotten queries land in a region the network treats as out-of-distribution, and the gradient signal on those queries collapses along with their features. OPC is the only method in our benchmark that survives FM-recovery, resists relearning and gradient-inversion attacks, and decouples forget from retain features in entangled settings, all without sacrificing retain or test accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
