Abstract
Machine unlearning enables data holders to remove the contribution of their specified samples from trained models to protect their privacy. However, it is paradoxical that most unlearning methods require the unlearning requesters to firstly upload their data to the server as a prerequisite for unlearning. These methods are infeasible in many privacy-preserving scenarios where servers are prohibited from accessing users' data, such as federated learning (FL). In this paper, we explore how to implement unlearning under the condition of not uncovering the erasing data to the server. We propose \textbf{Blind Unlearning (BlindU)}, which carries out unlearning using compressed representations instead of original inputs. BlindU only involves the server and the unlearning user: the user locally generates privacy-preserving representations, and the server performs unlearning solely on these representations and their labels. For the FL model training, we employ the information bottleneck (IB) mechanism. The encoder of the IB-based FL model learns representations that distort maximum task-irrelevant information from inputs, allowing FL users to generate compressed representations locally. For effective unlearning using compressed representation, BlindU integrates two dedicated unlearning modules tailored explicitly for IB-based models and uses a multiple gradient descent algorithm to balance forgetting and utility retaining. While IB compression already provides protection for task-irrelevant information of inputs, to further enhance the privacy protection, we introduce a noise-free differential privacy (DP) masking method to deal with the raw erasing data before compressing. Theoretical analysis and extensive experimental results illustrate the superiority of BlindU in privacy protection and unlearning effectiveness compared with the best existing privacy-preserving unlearning benchmarks.
Abstract (translated)
机器遗忘技术允许数据持有者从训练好的模型中移除特定样本的贡献，以保护隐私。然而，大多数遗忘方法要求发起请求的用户首先将他们的数据上传到服务器，这在许多需要保护隐私的情景下是不可行的，比如联邦学习（FL），因为在这些情况下，服务器被禁止访问用户的原始数据。 本文探讨了如何实现在不向服务器揭示要删除的数据的情况下进行机器遗忘。我们提出了**盲遗忘 (BlindU)** 方法，该方法使用压缩表示而非原始输入来进行遗忘操作。在 BlindU 中，只有服务端和发起请求的用户参与：用户在当地生成隐私保护表示，并且服务端仅基于这些表示及其标签执行遗忘操作。 对于联邦学习模型训练，我们采用了信息瓶颈（IB）机制。基于 IB 的联邦学习模型中的编码器从输入中提取最大任务无关的信息失真表示，使得 FL 用户能够在本地生成压缩表示。为了有效使用压缩表示进行遗忘，BlindU 集成了两个专门针对 IB 模型设计的遗忘模块，并采用多梯度下降算法来平衡遗忘和保持效用的能力。 虽然信息瓶颈压缩已经为输入的任务无关信息提供了保护，但为了进一步增强隐私保护，我们引入了一种无噪声差分隐私 (DP) 掩码方法，在压缩之前处理原始删除数据。理论分析和广泛的实验结果表明，BlindU 在隐私保护和遗忘有效性方面优于现有的最佳隐私保护遗忘基准。 总结来说，BlindU 为在不向服务器揭示敏感数据的情况下实现机器遗忘提供了一种新颖的方法，并通过使用信息瓶颈机制、专用的遗忘模块和差分隐私掩码方法提高了隐私保护和模型性能。
URL
https://arxiv.org/abs/2601.07214
