ROKA: 面对对抗者的鲁棒知识反学习
ROKA: Robust Knowledge Unlearning against Adversaries
AI总结：
ROKA通过神经愈合机制实现鲁棒的知识反学习，有效对抗间接反学习攻击，同时保护保留数据的准确性。
摘要：
机器学习中的反学习需求对于数据隐私至关重要，但现有方法往往导致知识污染，通过无意中损害相关知识。这种在反学习后模型性能下降的现象最近被用于新的推理和后门攻击。大多数研究设计了需要中毒或复制训练数据的对抗性反学习请求。在本研究中，我们引入了一种新的反学习诱导攻击模型，即间接反学习攻击，该攻击不需要数据操作，而是利用知识污染的后果来扰动安全关键预测的模型准确性。为了缓解这种攻击，我们引入了一个理论框架，将神经网络建模为神经知识系统。基于此，我们提出了ROKA，一种以神经愈合为中心的鲁棒反学习策略。与传统反学习方法仅破坏信息不同，ROKA通过消除遗忘数据的影响并加强其概念邻居来重构模型。据我们所知，我们的工作是首次为反学习过程中的知识保护提供理论保证。在各种大型模型，包括视觉转换器、多模态模型和大型语言模型上的评估显示，ROKA能够有效反学习目标，同时保持甚至提升保留数据的准确性，从而缓解间接反学习攻击。
英文摘要：
The need for machine unlearning is critical for data privacy, yet existing methods often cause Knowledge Contamination by unintentionally damaging related knowledge. Such a degraded model performance after unlearning has been recently leveraged for new inference and backdoor attacks. Most studies design adversarial unlearning requests that require poisoning or duplicating training data. In this study, we introduce a new unlearning-induced attack model, namely indirect unlearning attack, which does not require data manipulation but exploits the consequence of knowledge contamination to perturb the model accuracy on security-critical predictions. To mitigate this attack, we introduce a theoretical framework that models neural networks as Neural Knowledge Systems. Based on this, we propose ROKA, a robust unlearning strategy centered on Neural Healing. Unlike conventional unlearning methods that only destroy information, ROKA constructively rebalances the model by nullifying the influence of forgotten data while strengthening its conceptual neighbors. To the best of our knowledge, our work is the first to provide a theoretical guarantee for knowledge preservation during unlearning. Evaluations on various large models, including vision transformers, multi-modal models, and large language models, show that ROKA effectively unlearns targets while preserving, or even enhancing, the accuracy of retained data, thereby mitigating the indirect unlearning attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
