SMI: 统计成员推断用于可靠未学习模型审计
SMI: Statistical Membership Inference for Reliable Unlearned Model Auditing
AI总结：
本文提出SMI方法，通过统计成员混合比例评估未学习模型的遗忘率，无需训练影子模型，有效解决传统成员推断攻击的局限性。
摘要：
机器未学习（MU）对于确保机器学习系统中的'被遗忘权'至关重要。MU的关键挑战是如何可靠地审计模型是否真正忘记了指定的训练数据。成员推断攻击（MIAs）广泛用于未学习模型审计，其中逃避成员检测的样本被视为成功遗忘。我们证明这一假设根本性错误：成员推断失败并不意味着真正的遗忘。我们证明未学习样本在特征空间中与非成员样本占据根本不同的位置，使这种对齐偏差不可避免且不可观测，导致系统性乐观的未学习性能评估。同时，为MIAs训练影子模型会带来显著的计算开销。为解决这两个限制，我们提出了统计成员推断（SMI），一种无需训练的审计框架，将审计重新公式化为估计未学习特征分布中的非成员混合比例。除了估计遗忘率外，SMI还提供bootstrap参考范围以量化审计可靠性。广泛实验表明，SMI在所有基于MIAs的基线方法上表现一致，无需训练影子模型。总体而言，SMI建立了基于原理和效率的替代方案，具有理论保证和强实验证明。
英文摘要：
Machine unlearning (MU) is essential for enforcing the right to be forgotten in machine learning systems. A key challenge of MU is how to reliably audit whether a model has truly forgotten specified training data. Membership Inference Attacks (MIAs) are widely used for unlearned model auditing, where samples that evade membership detection are regarded as successfully forgotten. We show this assumption is fundamentally flawed: failed membership inference does not imply true forgetting. We prove that unlearned samples occupy fundamentally different positions in the feature space than non-member samples, making this alignment bias unavoidable and unobservable, which leads to systematically optimistic evaluations of unlearning performance. Meanwhile, training shadow models for MIA incurs substantial computational overhead. To address both limitations, we propose Statistical Membership Inference (SMI), a training-free auditing framework that reformulates auditing as estimating the non-member mixture proportion in the unlearned feature distribution. Beyond estimating the forgetting rate, SMI also provides bootstrap reference ranges for quantified auditing reliability. Extensive experiments show that SMI consistently outperforms all MIA-based baselines, with no shadow model training required. Overall, SMI establishes a principled and efficient alternative to MIA-based auditing methods, with both theoretical guarantees and strong empirical performance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
