BlindU: 无需暴露删除数据的盲机器无学习
BlindU: Blind Machine Unlearning without Revealing Erasing Data
AI总结：
BlindU通过压缩表示实现无需暴露删除数据的盲机器无学习，结合信息瓶颈机制和差分隐私方法，提升隐私保护和无学习效果。
摘要：
机器无学习使数据持有者能够从训练模型中移除其指定样本的贡献，以保护其隐私。然而，大多数无学习方法要求无学习请求者首先将数据上传到服务器作为无学习的前提条件，这在许多隐私保护场景中不可行，例如联邦学习（FL）。在本文中，我们探讨如何在不暴露删除数据给服务器的条件下实现无学习。我们提出了Blind Unlearning（BlindU），它使用压缩表示代替原始输入进行无学习。BlindU仅涉及服务器和无学习用户：用户在本地生成隐私保护的表示，服务器仅在这些表示及其标签上执行无学习。对于FL模型训练，我们采用信息瓶颈（IB）机制。基于IB的FL模型的编码器学习表示，以最大程度地扭曲输入中的无关任务信息，使FL用户能够本地生成压缩表示。为了有效使用压缩表示进行无学习，BlindU整合了两个专门针对IB模型设计的无学习模块，并使用多梯度下降算法来平衡遗忘和保留效用。尽管IB压缩已经为输入的任务无关信息提供了保护，但为了进一步增强隐私保护，我们引入了一种无噪声差分隐私（DP）掩膜方法，在压缩前处理原始删除数据。理论分析和广泛的实验结果表明，BlindU在隐私保护和无学习效果方面优于现有的最佳隐私保护无学习基准。
英文摘要：
Machine unlearning enables data holders to remove the contribution of their specified samples from trained models to protect their privacy. However, it is paradoxical that most unlearning methods require the unlearning requesters to firstly upload their data to the server as a prerequisite for unlearning. These methods are infeasible in many privacy-preserving scenarios where servers are prohibited from accessing users' data, such as federated learning (FL). In this paper, we explore how to implement unlearning under the condition of not uncovering the erasing data to the server. We propose \textbf{Blind Unlearning (BlindU)}, which carries out unlearning using compressed representations instead of original inputs. BlindU only involves the server and the unlearning user: the user locally generates privacy-preserving representations, and the server performs unlearning solely on these representations and their labels. For the FL model training, we employ the information bottleneck (IB) mechanism. The encoder of the IB-based FL model learns representations that distort maximum task-irrelevant information from inputs, allowing FL users to generate compressed representations locally. For effective unlearning using compressed representation, BlindU integrates two dedicated unlearning modules tailored explicitly for IB-based models and uses a multiple gradient descent algorithm to balance forgetting and utility retaining. While IB compression already provides protection for task-irrelevant information of inputs, to further enhance the privacy protection, we introduce a noise-free differential privacy (DP) masking method to deal with the raw erasing data before compressing. Theoretical analysis and extensive experimental results illustrate the superiority of BlindU in privacy protection and unlearning effectiveness compared with the best existing privacy-preserving unlearning benchmarks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
