Machine learning forgetting method against model inversion attacks

Abstract

The application discloses a machine learning forgetting method resisting model inversion attacks, and belongs to the technical field of artificial intelligence privacy security. In view of the problem that the parameter difference before and after model forgetting in the existing forgetting technology is easy to be utilized by attackers to cause privacy leakage, the forgetting process is constructed as a multi-objective optimization problem, and two mechanisms of directional parameter adjustment and dynamic noise enhancement are integrated. The directional parameter adjustment analyzes the gradient sensitivity difference of parameters to forgotten data and reserved data, only updates a parameter subset which is strongly related to the forgotten data, and blocks a feature leakage path; the dynamic noise enhancement adds noise to the forgotten samples according to a decay strategy in the training process, and destroys the accurate memory of sensitive features of the model. While realizing efficient data forgetting, the application effectively suppresses the ability of the attacker to reconstruct the original samples from the model difference, and achieves a better balance between model utility and privacy security.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence privacy and security technology, specifically relating to a machine learning forgetting method resistant to model inversion attacks. Background Technology

[0002] With the rapid development of artificial intelligence technology, the privacy and security of user data during the training process of machine learning models has become increasingly prominent. Global privacy regulations have introduced the "right to be forgotten," requiring not only the deletion of original data but also the elimination of its impact on trained models. While complete retraining can rigorously achieve forgetting, its computational cost is extremely high, making it impractical, especially for large-scale deep neural networks. Therefore, machine learning forgetting techniques have emerged, aiming to efficiently remove the influence of specific training data without requiring complete retraining.

[0003] Existing machine learning forgetting methods are mainly divided into two categories: exact forgetting and approximate forgetting. Exact forgetting methods, such as the SISA framework, reduce retraining overhead through data partitioning, but still incur storage and computational burdens. Approximate forgetting methods, on the other hand, quickly eliminate the influence of data through gradient ascent, knowledge distillation, or parameter pruning, resulting in higher efficiency. However, most existing research focuses on forgetting efficiency, paying insufficient attention to the security vulnerabilities of the forgetting process itself.

[0004] A typical security threat is model inversion attacks. Existing research has demonstrated that attackers can reconstruct private information from training data by analyzing model output or parameters. In machine learning forgetting scenarios, because the forgetting operation alters model parameters, if an attacker can access both the pre- and post-forgetting versions of the model, they can exploit the parameter differences to extract target data information that should have been forgotten. More seriously, even complete retraining, considered the gold standard, cannot completely defend against model inversion attacks. This privacy risk fundamentally contradicts the original intention of machine learning forgetting to protect data privacy.

[0005] In existing forgetting methods, parameter updates are often performed globally, lacking differentiation in parameter sensitivity. Blindly updating all parameters can easily destroy key parameters of the retained data, leading to a significant decrease in model performance on the retained data. At the same time, global updates result in the differences between the model before and after forgetting being widely distributed in the parameter space and having a predictable structure, increasing the risk of being exploited by attackers.

[0006] To address the aforementioned issues, existing technologies have proposed various improvement schemes. Some methods attempt to introduce selective update mechanisms, limiting the parameter update range by identifying neurons sensitive to forgotten data (e.g., Chinese invention patent application number CN202510496214.0). While such schemes can reduce the damage to retention performance to some extent, their parameter selection is based solely on sensitivity to forgotten data, without considering the impact of the selected parameters on the retained data. This can lead to the potential for inadvertently damaging key parameters of the retained data during the update process, making it difficult to achieve a fine balance between the forgetting effect and retention performance.

[0007] Other methods attempt to utilize noise enhancement mechanisms, interfering with model memory by adding error-maximizing noise to forgotten samples (e.g., Chinese invention patent application number CN202411835567.0). Although these methods employ a periodic iterative update strategy to adjust noise intensity, they still belong to a single noise enhancement mechanism, lacking fine-grained differentiation of parameter sensitivity. When the noise intensity is high, they are prone to damaging key features of the retained data, while when the noise intensity is low, they are difficult to achieve the desired forgetting effect.

[0008] However, the aforementioned improvement schemes generally face the challenge of balancing the forgetting effect with attack resistance. Selective update methods only select parameters based on the forgotten set, failing to consider the impact of parameters on the retained data; noise enhancement methods lack fine-grained differentiation of parameter sensitivity. No scheme has yet been found that co-designs directional parameter tuning and dynamic noise enhancement based on both the forgotten and retained datasets, making it difficult to achieve a balance between forgetting effectiveness and attack resistance. Therefore, how to achieve efficient data forgetting while effectively resisting model inversion attacks has become a pressing technical problem to be solved in this field. Summary of the Invention

[0009] This invention aims to solve the technical problem in the prior art where the differences in model parameters after machine learning forgetting are easily exploited by attackers, leading to privacy leaks. It provides a machine learning forgetting method and system that is resistant to model inversion attacks.

[0010] To achieve the above objectives, this invention provides a machine learning forgetting method resistant to model inversion attacks, comprising the following steps:

[0011] S1: Obtain the original model that has been trained on the original dataset, as well as the target forgotten dataset and the retained dataset obtained by dividing the original dataset;

[0012] S2: Based on the target forgotten dataset and the retained dataset, construct a multi-objective loss function, which includes a retention loss term, a forgetting loss term, and a regularization loss term;

[0013] S3: Perform directional parameter adjustment, and generate a parameter mask based on the forgotten loss term and the retained loss term. The parameter mask is used to filter the subset of parameters to be updated.

[0014] S4: Perform dynamic noise enhancement. In each iteration, determine the current noise intensity according to the preset noise attenuation strategy, and add noise of the corresponding intensity to the forgotten sample to obtain the noisy forgotten sample.

[0015] S5: Based on the noisy forgotten samples, the retained dataset, and the parameter mask, update the model for the current round using the multi-objective loss function;

[0016] S6: Repeat steps S3 to S5 until the preset convergence condition is met to obtain the target forgetting model.

[0017] Furthermore, in S1, the target forgotten dataset and the retained dataset, which are derived from the original training data, are obtained. The original training data is all the data used by the original trained model; the target forgotten dataset is the data requested to be deleted by the user, wherein the target forgotten dataset can be a number of samples (sample-level forgetting) or the entire category (category-level forgetting); the retained dataset is the remaining data in the original training data after removing the forgotten data.

[0018] Secondly, in S2, a multi-objective loss function is constructed: ;in, For classification loss based on the preserved dataset, To make the predicted output of forgotten data approximate the loss of the preset target distribution, A regularization term to constrain the difference between the current model parameters and the original model parameters. , , These are the weight hyperparameters. The loss function comprises three core parts:

[0019] The first part is the retention loss term, which is used to maintain the model's performance on the retained dataset. The retention loss adopts a classification loss based on the retained dataset, so that the model's predictions on the retained data are as close as possible to the true labels, thereby ensuring that the forgetting operation does not excessively impair the model's classification ability.

[0020] The second part is the forgetting loss term, used to achieve the forgetting effect on the forgotten dataset. The forgetting loss employs a loss mechanism that forces the model's predicted output for the forgotten data to approximate a pre-defined target distribution (e.g., a uniform distribution). When the model's output approaches this pre-defined distribution, it means the model has weakened its memory of the true label information of these samples, achieving the purpose of forgetting. Compared to methods like gradient ascent that forcibly increase the loss, the forgetting strategy based on approximating the target distribution achieves forgetting more smoothly and avoids introducing incorrect class bias.

[0021] The third part is the regularization loss term, which constrains the magnitude of model parameter updates. The regularization loss uses a regularization term (e.g., the sum of squares of parameter changes) that constrains the differences between the current model parameters and the original model parameters. This constraint limits the overall scale of parameter updates, prevents the forgetting process from excessively damaging the model structure, thereby protecting the model's generalization ability on both preserved and unseen data, and indirectly controls the size of model differences that could be exploited by attackers.

[0022] The three loss terms mentioned above are balanced by weight hyperparameters to form a complete multi-objective loss function, and the importance of each term can be adjusted according to the specific task requirements.

[0023] Furthermore, in S3, a targeted parameter tuning mechanism is implemented. Deep neural networks contain millions of parameters, and the importance of different parameters to forgotten and retained data varies. Ideally, only parameters that are sensitive to forgotten data but not to retained data should be updated to avoid the performance degradation caused by blindly updating all parameters, while also making the model differences sparse, increasing the difficulty for attackers to reconstruct forgotten data through parameter differences.

[0024] The specific implementation method for adjusting the directional parameters is as follows:

[0025] In each training iteration, mini-batches of data are randomly sampled from the retained and forgotten datasets, and the retention and forgetting losses on the mini-batches are calculated. Then, for each parameter in the model, the forgetting loss is calculated separately for that parameter. gradient (This is called the forgetting gradient) and the retention loss on this parameter gradient (This is called the preserved gradient); where i represents the index. The absolute value of the gradient reflects the sensitivity of the parameter to the corresponding data.

[0026] Based on these two gradient values, calculate the orthogonality score for each parameter. : Where ε is a small constant excluding zero. , The weighting coefficients are used to calculate the orthogonality score. The orthogonality score consists of two terms: the first is the ratio of the absolute value of the forgotten gradient to the absolute value of the retained gradient, measuring the relative importance of the parameter to the forgotten data; the second is the difference between the absolute value of the forgotten gradient and the absolute value of the retained gradient (this difference is taken if it is positive, otherwise it is 0), measuring the absolute advantage of the parameter to the forgotten data. These two terms are balanced using weighting coefficients to obtain the final orthogonality score. This score comprehensively reflects the difference in sensitivity of the parameter to forgotten and retained data; a higher score indicates that the parameter is more suitable as a target for forgetting updates.

[0027] A threshold τ is set based on the orthogonal score distribution of all parameters, so that the top proportion of the highest scores are... The selected parameter generates a binary mask that corresponds one-to-one with the parameter. The selected parameter has a mask value of 1, while the other parameters have a mask value of 0. This mask will play a role in subsequent model updates; only parameters with a mask value of 1 will participate in gradient updates.

[0028] Furthermore, in S4, a dynamic noise enhancement mechanism is implemented. To further weaken the model's accurate memory of forgotten samples, while preventing attackers from retrieving sensitive features from model differences, this invention adds dynamic noise at the input level.

[0029] The specific implementation method of dynamic noise enhancement is as follows:

[0030] A cosine decay strategy is used to dynamically determine the noise intensity in each iteration. : ;in Let be the initial maximum noise intensity, t be the current iteration number, and T be the total number of iterations. In the early stages of training, the noise intensity is high, which can quickly disrupt the model's accurate memory of forgotten samples. As training progresses, the noise intensity gradually decreases, approaching zero in the later stages to facilitate model convergence on the retained data. This dynamic adjustment method can minimize the negative impact of noise on model performance while ensuring the forgetting effect.

[0031] For each forgotten sample in the current batch, noise of the current intensity is added to obtain a noisy forgotten sample. The noise is added at the input data level, that is, by directly adding random perturbations to the pixel values ​​or feature values ​​of the original samples. The samples with added noise retain the basic structure of the original samples while introducing sufficient randomness, making it difficult for the model to form an accurate memory of sensitive features. It is worth noting that noise is only added to the forgotten samples; the retained samples remain unchanged to ensure that the model's performance on the retained data is not affected.

[0032] Then, the forgetting loss is recalculated based on the noisy forgotten samples and used to replace the original forgetting loss in subsequent model updates.

[0033] Furthermore, in S5, model updates are performed. Combining the preceding steps, the final total loss is obtained by a weighted sum of the retention loss, the forgetting loss based on noisy samples, and the regularization loss. The gradient of the total loss with respect to each parameter is calculated, and the parameters are updated according to the previously generated parameter mask. Only parameters with a mask value of 1 participate in the gradient update; the remaining parameters remain frozen. The parameter update rule is as follows: Where η is the learning rate, For model parameters, The parameter mask is as described above. For multi-objective loss functions with respect to parameters The gradient is calculated by subtracting the learning rate, mask value, and gradient from the current parameters.

[0034] Furthermore, in S6, steps S3 to S5 are repeated until the preset convergence condition is reached, and the final target forgetting model is the forgetting model that can resist model inversion attacks.

[0035] The present invention achieves the following beneficial technical effects compared to the prior art:

[0036] 1. The machine learning forgetting method against model inversion attacks provided by this invention calculates the orthogonal score of parameters based on the gradient sensitivity difference between forgetting loss and retention loss through a targeted parameter adjustment mechanism, and generates a parameter mask. This accurately identifies and modifies only a subset of parameters that are strongly correlated with forgotten data and weakly correlated with retained data, avoiding the performance degradation caused by blindly updating all parameters. At the same time, it makes the parameter differences before and after the model update sparse, increasing the difficulty for attackers to reconstruct forgotten data through parameter differences, thereby effectively resisting model inversion attacks.

[0037] 2. The machine learning forgetting method against model inversion attacks provided by this invention uses a dynamic noise enhancement mechanism to dynamically determine the current noise intensity in each iteration according to the cosine decay strategy, and adds noise of corresponding intensity to the forgotten samples in the current batch. This destroys the model's accurate memory of sensitive features at the input level, further weakening the attacker's ability to reconstruct the original samples through model inversion. At the same time, the dynamic decay of noise intensity ensures the normal convergence of the model on the retained data in the later stages of training.

[0038] 3. The machine learning forgetting method against model inversion attacks provided by this invention models the forgetting process as a multi-objective optimization problem. By weighted balancing of retention loss, forgetting loss and regularization loss, it achieves efficient forgetting while ensuring the model's performance on retained data. It also achieves excellent anti-attack performance on both sample-level and category-level forgetting tasks, significantly outperforming existing methods. Attached Figure Description

[0039] Figure 1 A flowchart of a machine learning forgetting method resistant to model inversion attacks provided in an embodiment of the present invention;

[0040] Figure 2 A framework diagram of a machine learning forgetting method for resisting model inversion attacks provided in this embodiment of the invention, including directional parameter tuning and dynamic noise enhancement;

[0041] Figure 3 The figure shows the experimental results comparing the reconstructed image quality under model inversion attack with other forgetting methods using the machine learning forgetting method (this method) provided in this embodiment of the invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0043] The core of this invention is to provide a machine learning forgetting method that resists model inversion attacks. Through the synergistic effect of two mechanisms, directional parameter adjustment and dynamic noise enhancement, it can effectively resist model inversion attacks while achieving efficient data forgetting.

[0044] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0045] Figure 1 A flowchart of a machine learning forgetting method resistant to model inversion attacks provided in an embodiment of the present invention is shown below. Figure 1 As shown, it includes the following steps:

[0046] S1: Obtain the original model that has been trained on the original dataset, as well as the target forgotten dataset and the retained dataset obtained by dividing the original dataset.

[0047] Specifically, assuming there is already a dataset in the complete dataset On the pre-trained original model The model parameters are Upon receiving a data forgetting request, determine the target dataset to be forgotten. and the datasets that need to be retained In this embodiment, Forgetting can be achieved by selecting a number of randomly chosen samples (sample-level forgetting) or by using the entire category (category-level forgetting). For example, in the CIFAR-10 dataset, 32 training samples are randomly selected as samples for forgetting. When forgetting at the categorical level, all samples labeled "cat" are treated as... The remaining 9 types of samples are used as .

[0048] S2: Based on the target forgotten dataset and the retained dataset, construct a multi-objective loss function, which includes a retention loss term, a forgetting loss term, and a regularization loss term.

[0049] Specifically, in order to simultaneously achieve the forgetting effect, maintain model performance, and limit parameter changes, a multi-objective loss function is constructed. : ;in, , , This is a weighting hyperparameter used to balance the importance of various losses. In this embodiment, we take... , , .

[0050] Retain loss items Based on the preserved dataset The standard cross-entropy loss is used to maintain the model's classification ability on the retained data.

[0051] Forgotten loss items Based on the forgetting dataset The KL divergence loss forces the model's predicted output for forgotten data to approximate a uniform distribution, thus achieving the forgetting effect. The calculation formula is: ;in, Indicates a uniform distribution in the category space. For the model to forget samples The predicted probability distribution. The specific expansion of the KL divergence is: in, The total number of categories, The model predicts the first Class probability. This loss function makes the model output approach a uniform distribution, eliminating correct classifications while avoiding the introduction of incorrect class biases.

[0052] Regularization loss term Based on the current forgetting model parameters Compared with the original model parameters The L2 distance is used to control the magnitude of parameter updates and prevent the forgetting process from causing excessive damage to the model structure. ;in This represents the model parameters after forgetting. This loss term limits the overall scale of parameter updates and indirectly controls the model discrepancies that could be exploited by attackers. Size.

[0053] S3: Perform directional parameter adjustment, and generate a parameter mask based on the forgotten loss term and the retained loss term. The parameter mask is used to filter the subset of parameters to be updated.

[0054] Specifically, such as Figure 2 As shown on the left, after training the original model using the raw data, the following steps are performed:

[0055] Gradient calculation: In each training iteration, from and Randomly sampled small batches of data and Calculate the retention loss on mini-batch. and loss of forgetting For each parameter Calculate the two gradients: .

[0056] Orthogonal fraction calculation: Calculate the orthogonal fraction for each parameter according to the following formula. : Where ε is a small constant to prevent zero (e.g., taking...). ), , These are the weighting coefficients;

[0057] Mask generation: Set a threshold based on the orthogonal score distribution of all parameters. This makes the highest scorer the top The selected parameter will generate a binary parameter mask. : This mask identifies a subset of parameters to be updated; only parameters with a mask value of 1 will participate in gradient descent in subsequent updates.

[0058] S4: Perform dynamic noise enhancement. In each iteration, determine the current noise intensity according to the preset noise attenuation strategy, and add noise of the corresponding intensity to the forgotten sample to obtain the noisy forgotten sample.

[0059] Specifically, such as Figure 2 As shown on the right, dynamic noise enhancement is performed to induce forgetting:

[0060] Noise intensity calculation: A cosine attenuation strategy is used to dynamically determine the noise intensity in each iteration. : ;in, The initial maximum noise intensity (in this embodiment, it is taken as...) ), This represents the current iteration number. The total number of iterations (in this embodiment, we take...) ).

[0061] Noise addition: For each forgotten sample in the current batch Adding Gaussian noise yields noisy forgotten samples. : , ;in, This is the identity matrix. Noise is added only to forgotten samples, while retained samples remain unchanged to ensure that the model's performance on the retained data is not affected. This embodiment uses Gaussian noise, but in practical applications, uniform noise or other random perturbations conforming to a preset distribution type can also be used, as long as they can disrupt the model's accurate memory of sensitive features.

[0062] Forgetting loss based on noisy samples: Recalculate the forgetting loss using noisy forgotten samples: This loss term replaces the original one. Participate in subsequent model updates.

[0063] S5: Based on the noisy forgotten samples, the retained dataset, and the parameter mask, update the model for the current round using the multi-objective loss function.

[0064] Specifically, taking into account the aforementioned steps, the final total loss is: ;calculate For each parameter gradient Gradient updates are performed based on the parameter mask, allowing only parameters with a mask value of 1 to participate in the update: ;in, For learning rate, For model parameters, The parameter mask is as described above. For multi-objective loss functions with respect to parameters The gradient. In this embodiment, the sample-level forgetting task takes... Category-level forgetting task retrieval .

[0065] S6: Repeat steps S3 to S5 until the preset convergence condition is met to obtain the target forgetting model.

[0066] Specifically, in this invention, the "preset convergence condition" refers to a pre-defined criterion for terminating the iteration. As one specific implementation, the convergence condition is reaching a preset number of iterations. (In this embodiment) As an alternative implementation, the convergence criterion can also be a dynamic criterion, for example: a multi-objective loss function in five consecutive iterations. The absolute values ​​of the changes are all less than Or the absolute value of the average update magnitude of the parameters selected by the parameter mask is less than When the convergence condition is met, the iteration stops, and the final target forgetting model is obtained. Those skilled in the art can set appropriate convergence conditions according to specific tasks, and these are all within the scope of protection of this invention.

[0067] Specifically, such as Figure 3 Experimental results comparing the image quality reconstructed from model inversion attacks under different forgetting methods are presented. The left side shows the forgotten image, and the right side shows the reconstructed image. Our proposed method demonstrates outstanding effectiveness in defending against model inversion attacks, suppressing the quality of the reconstructed image to an almost completely unrecognizable level. The average PSNR (Peak Signal-to-Noise Ratio, lower values ​​indicate worse reconstruction quality) is only 3.7 dB, while the MSE (Mean Squared Error, higher values ​​indicate greater reconstruction error) is significantly higher than the comparative methods.

[0068] The foregoing has provided a detailed description of the machine learning forgetting method resistant to model inversion attacks. The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably.

[0069] The contents not described in detail in this specification are existing technologies known to those skilled in the art.

Claims

1. A machine learning forgetting method resistant to model inversion attacks, characterized in that, Includes the following steps: S1: Obtain the original model that has been trained on the original dataset, as well as the target forgotten dataset and the retained dataset obtained by dividing the original dataset; S2: Based on the target forgotten dataset and the retained dataset, construct a multi-objective loss function, which includes a retention loss term, a forgetting loss term, and a regularization loss term; S3: Perform directional parameter adjustment, and generate a parameter mask based on the forgotten loss term and the retained loss term. The parameter mask is used to filter the subset of parameters to be updated. S4: Perform dynamic noise enhancement. In each iteration, determine the current noise intensity according to the preset noise attenuation strategy, and add noise of the corresponding intensity to the forgotten sample to obtain the noisy forgotten sample. S5: Based on the noisy forgotten samples, the retained dataset, and the parameter mask, update the model for the current round using the multi-objective loss function; S6: Repeat steps S3 to S5 until the preset convergence condition is met to obtain the target forgetting model.

2. The method according to claim 1, characterized in that, The multi-objective loss function mentioned in step S2 Represented as: ;in, For classification loss based on the preserved dataset, To make the predicted output of forgotten data approximate the loss of the preset target distribution, The regularization term constrains the difference between the current model parameters and the original model parameters. γ, α, and β are weight hyperparameters.

3. The method according to claim 1, characterized in that, The specific steps in step S3 to generate the parameter mask include: Calculate the forgetting loss with respect to parameters gradient and retention loss with respect to parameters gradient ;in For parameter index; Calculate the orthogonality fraction of each parameter according to the following formula. : The first term measures the relative sensitivity of the parameters to forgotten data, and the second term calculates the portion of the absolute value of the forgotten gradient that exceeds the absolute value of the retained gradient. In the formula, ε is a small constant to prevent division by zero, and λ and μ are weighting coefficients. A threshold τ is set based on the orthogonal score distribution, so that parameters with the highest orthogonal scores in the top predetermined proportion are selected, and a parameter mask is generated. ;in, If and only if Otherwise .

4. The method according to claim 1, characterized in that, The noise intensity of dynamic noise enhancement in step S4 Determined according to the cosine attenuation strategy: ;in Let t be the initial maximum noise intensity, t be the current iteration number, and T be the total number of iterations. To forgotten samples Adding noise to obtain a noisy sample And calculate the forgetting loss based on the noisy samples.

5. The method according to claim 1, characterized in that, The parameter update method in step S5 is as follows: ;in For learning rate, For model parameters, The parameter mask is as described above. For multi-objective loss functions with respect to parameters The gradient.

Images