A gan-based forgetting measurement model and a working method thereof

Abstract

The application discloses a kind of based on GAN's forgetting measure model, including the self-encoding device connected in turn, the original model obtained using training set training ResNet18, and the forgetting model obtained after applying forgetting strategy on original model, self-encoding device contains an encoder and a decoder, the first layer of encoder is two-dimensional convolution layer, the channel number of input is 3, and the output channel number is 64.Convolution kernel size is 3x3, and step is 1, and padding is 1.Activation function is LeakyReLU, when input value is less than 0, set output to 0.2 times input value, the second layer is two-dimensional convolution layer, and the channel number of input is 64, and the output channel number is 128.Convolution kernel size is 4x4, and step is 2.The present application can solve the technical problems that the accuracy and recall rate of existing forgetting measure model cannot accurately measure whether the processing ability of model to the data is completely eliminated after the specific data is forgotten, and the existing index cannot accurately measure the change of processing ability of model to past data.

Description

A GAN-based forgetting measurement model and its working method Technical Field

[0001] This invention belongs to the field of machine learning technology, and more specifically, it relates to a forgetting measurement model based on Generative Adversarial Network (GAN) and its working method. Background Technology

[0002] Users may want to retract certain information they've posted, but models trained on this data don't automatically eliminate the impact of the retracted data, thus failing to adequately protect user privacy. Simply deleting specific data from the training dataset doesn't achieve true "machine forgetting" because this data has already influenced the model's parameters during the learning process, and these parameter changes carry information about that specific data. Machine forgetting addresses this problem by eliminating the impact of deleted data on the training model, and it has broad application prospects, becoming an emerging topic in machine learning in recent years. Existing machine forgetting methods not only need to consider how to achieve forgetting, but also how to measure the effectiveness of forgetting strategies—a problem that urgently needs to be solved.

[0003] The measurement of machine forgetting effect mainly focuses on two aspects: on the one hand, discussing the model's performance on the data to be deleted, i.e., the forgetting effect; on the other hand, considering whether the model retains its processing ability on the remaining data.

[0004] However, existing forgetting measurement models generally have some significant drawbacks:

[0005] First, the problem of insufficient depth measurement: accuracy and recall cannot accurately measure whether the model's ability to process specific data has been completely eliminated after it has been forgotten. Existing metrics cannot accurately measure the change in the model's ability to process past data.

[0006] Second, the balance between generalization and forgetting effect: Even if the model has completely eliminated the influence of the data to be forgotten, due to the model's generalization ability, the model still shows good accuracy and recall on the data to be forgotten, making it difficult to accurately and intuitively measure the model's forgetting effect. Summary of the Invention

[0007] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides a GAN-based forgetting measurement model and its working method. The aim is to solve the technical problems of existing forgetting measurement models, such as the inability of precision and recall to accurately measure whether the model's processing ability for forgotten data has been completely eliminated, the inability of existing indicators to accurately measure changes in the model's processing ability for past data, and the difficulty in accurately and intuitively measuring the model's forgetting effect when the model still exhibits good precision and recall performance on data to be forgotten due to its generalization capabilities.

[0008] To achieve the above objectives, according to one aspect of the present invention, a GAN-based forgetting measurement model is provided, comprising three sequentially connected parts: an autoencoder, an original model obtained by training ResNet18 using a training set, and a forgetting model obtained by applying a forgetting strategy to the original model. The autoencoder includes an encoder and a decoder, and the structure of the encoder is as follows:

[0009] The first layer is a 2D convolutional layer with 3 input channels (corresponding to RGB color channels) and 64 output channels. The kernel size is 3x3, the stride is 1, and the padding is 1. The activation function is LeakyReLU, which sets the output to 0.2 times the input value when the input value is less than 0.

[0010] The second layer is a two-dimensional convolutional layer with 64 input channels and 128 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1.

[0011] The third layer is a two-dimensional batch normalization layer with 128 input channels, LeakyReLU activation function, and 128 output channels, used to normalize 128 feature maps.

[0012] The fourth layer is a two-dimensional convolutional layer with 128 input channels and 256 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1.

[0013] The fifth layer is a two-dimensional batch normalization layer with 256 input channels, LeakyReLU activation function, and 256 output channels, used to normalize 256 feature maps.

[0014] The specific structure of the decoder is as follows:

[0015] The first layer is a 2D transposed convolutional layer with 256 input channels and 128 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1 to increase the size of the feature map.

[0016] The second layer is a two-dimensional batch normalization layer with 128 input channels, ReLU activation function, and 128 output channels, used to normalize 128 feature maps.

[0017] The third layer is a 2D transposed convolutional layer with 128 input channels and 64 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1.

[0018] The fourth layer is a two-dimensional batch normalization layer with 64 input channels, ReLU activation function, and 64 output channels, used to normalize 64 feature maps.

[0019] The fifth layer is a two-dimensional convolutional layer with 64 input channels and 3 output channels. The kernel size is 3x3, the stride is 1, and the padding is 1.

[0020] According to another aspect of the present invention, a working method for a GAN-based forgetting measurement model is provided, comprising the following steps:

[0021] (1) Obtain the dataset, divide the dataset into training set and test set, use the training set to train the ResNet18 model to obtain the original model, and divide the training set into the remaining dataset and the forgotten dataset in an 8:2 ratio.

[0022] (2) The parameters in the original model obtained in step (1) were slightly perturbed by using Random-K, Top-K, EU-K and CF-K forgetting strategies in sequence to obtain a forgetting model. The remaining dataset obtained in step (1) was used to train the forgetting model to obtain a trained forgetting model.

[0023] (3) Combine the original model obtained in step (1) and the forgetting model trained in step (2) to obtain a joint discriminator. Use the GAN-based forgetting measurement model (hereinafter referred to as the GAN-based forgetting measurement model) to train the joint discriminator to obtain a generator.

[0024] (4) Input the forgotten dataset obtained in step (1) into the generator obtained in step (3) to generate noise data for the forgotten data in the forgotten dataset. Add the generated noise data to the forgotten data to obtain the corresponding anti-forgetting sample. Input the anti-forgetting sample into the forgetting model obtained in step (2) to obtain the difference between the performance of the forgetting model on the anti-forgetting sample and the performance of the forgetting model on the forgotten dataset, and then measure the machine forgetting effect.

[0025] Preferably, step (3) includes the following sub-steps:

[0026] (3-1) Input the training set obtained in step (1) into the generator G(·) of the GAN-based forgetting measurement model for encoding and decoding to obtain noise data G(x) of the same size as the training set.

[0027] (3-2) Add the noise data G(x) obtained in step (3-1) to the training set to obtain the adversarial sample x′;

[0028] Specifically, this step uses the following formula:

[0029] x′=G(x)+x

[0030] (3-3) Input the adversarial sample x′ obtained in step (3-2) into the original model D obtained in step (1). s and the forgetting model D obtained in step (2) U In the joint discriminator, the generator is iteratively trained to obtain the final generator.

[0031] Preferably, the encoding and decoding process is represented by the following formula:

[0032] Encoder:

[0033] h = f(Wx + b)

[0034] Encoder:

[0035] r = g(W′h + b′)

[0036] Where: x is the input data, h is the encoder output, r is the decoder output, W and W′ are weight matrices, b and b′ are bias vectors, and f and g are activation functions.

[0037] Preferably, in the encoder of the generator, the activation function adopts the following formula:

[0038]

[0039] Where α = 0.2.

[0040] Preferably, in the decoder of the generator, the activation function adopts the following formula:

[0041] g(x) = max(0,x)

[0042] In the decoder of the generator, the last layer controls the output value to be in the range of [-1, 1], specifically using the following formula:

[0043]

[0044] Where e is the base of the natural logarithm.

[0045] Preferably, step (3-3) specifically includes:

[0046] First, obtain the loss of the adversarial example x′ on the original model. source By analyzing the loss source Minimize the adversarial sample x′ to make it close to the data x in the training set.

[0047] Then, obtain the loss of the adversarial example x′ on the forgetting model. unlearn By analyzing the loss unlearn The goal is to maximize the forgetting of adversarial examples x′ and data x in the training set, making the model's classification as inconsistent as possible, thus obtaining the loss of the GAN-based forgetting measure model:

[0048] L = loss source -λloss unlearn

[0049] Where λ represents the coefficient of expected risk in the forgetting model, and its value ranges from 0 to 1, preferably 0.005.

[0050] Finally, repeat the above process 100 times to obtain the final generator.

[0051] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects:

[0052] (1) Since the present invention uses the original model and the forgetting model as a joint discriminator, it can guarantee the performance of the anti-forgetting dataset on the original model. Combined with metrics such as accuracy, it reflects the model's processing ability on different datasets in a more granular way and accurately tracks and measures the performance changes of the model in the data forgetting process. Therefore, it can solve the technical problem of insufficient measurement depth in existing models.

[0053] (2) Since the present invention adopts a GAN-based forgetting measurement method, it can break the independent and identically distributed characteristics between the forgotten dataset and the remaining dataset, making the forgetting effect of the forgetting model more intuitive. Therefore, it can solve the technical problem of existing models having difficulty in accurately and intuitively measuring the forgetting effect of the model. Attached Figure Description

[0054] Figure 1 is a schematic diagram of the working method of the forgetting measurement model based on GAN of the present invention;

[0055] Figure 2 is a network structure diagram of the forgetting measurement model based on GAN of this invention;

[0056] Figure 3 shows the effect of the forgetting measurement model based on GAN of this invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0058] The basic idea of ​​this invention is to introduce noise by selecting the K parameters in the model that are most sensitive to perturbation. At this level, the model is forced to forget information. These methods are set as the forgetting strategy used in this invention. On the other hand, a generator is trained so that when the generated noise is added to the data to be forgotten, its accuracy on the original model is comparable to that of the original forgotten data on the original model. However, the accuracy of the perturbed forgotten data on the forgetting model is greatly reduced, thus more intuitively showing the effectiveness of the model's forgetting.

[0059] In the experiments of this invention, a ResNet18 model was used and tested on the CIFAR10 image dataset. This invention employs multiple forgetting strategies: for Random-K, K=10%; for Top-K, K=25, meaning that the 25 most sensitive parameters in the model are slightly perturbed before training with the remaining dataset to complete the model forgetting process; for EU-K and CF-K, the last K layers of the model are perturbed, with K set to 5 and 10 respectively. The GAN-based forgetting measurement model proposed in this invention can amplify the decrease in accuracy of perturbed samples on the forgotten model while maintaining greater than 95% accuracy of adversarial examples on the original model. On the ResNet18 model, the accuracy of perturbed samples is around 10%.

[0060] As shown in Figure 2, this invention provides a GAN-based forgetting measurement model, which includes three parts connected in sequence: an autoencoder, an original model obtained by training ResNet18 using a training set, and a forgetting model obtained by applying a forgetting strategy to the original model.

[0061] Specifically, an autoencoder consists of an encoder and a decoder. The encoder has the following structure:

[0062] The first layer is a 2D convolutional layer with 3 input channels (corresponding to RGB color channels) and 64 output channels. The kernel size is 3x3, the stride is 1, and the padding is 1. The activation function is LeakyReLU, which sets the output to 0.2 times the input value when the input value is less than 0.

[0063] The second layer is a two-dimensional convolutional layer with 64 input channels and 128 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1.

[0064] The third layer is a two-dimensional batch normalization layer with 128 input channels, LeakyReLU activation function, and 128 output channels, used to normalize 128 feature maps.

[0065] The fourth layer is a two-dimensional convolutional layer with 128 input channels and 256 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1.

[0066] The fifth layer is a two-dimensional batch normalization layer with 256 input channels, LeakyReLU activation function, and 256 output channels, used to normalize 256 feature maps.

[0067] The specific structure of the decoder is as follows:

[0068] The first layer is a 2D transposed convolutional layer with 256 input channels and 128 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1 to increase the size of the feature map.

[0069] The second layer is a two-dimensional batch normalization layer with 128 input channels, ReLU activation function, and 128 output channels, used to normalize 128 feature maps.

[0070] The third layer is a 2D transposed convolutional layer with 128 input channels and 64 output channels. The kernel size is 4x4, the stride is 2, and the padding is 1.

[0071] The fourth layer is a two-dimensional batch normalization layer with 64 input channels, ReLU activation function, and 64 output channels, used to normalize 64 feature maps.

[0072] The fifth layer is a 2D convolutional layer with 64 input channels and 3 output channels. The kernel size is 3x3, the stride is 1, and the padding is 1. The output of this layer is the final output of the decoder, with 3 channels corresponding to the RGB color channels. The activation function is Tanh, used to control the output value range within [-1, 1] to match the original input image.

[0073] As shown in Figure 1, this invention provides a working method for a GAN-based forgetting measurement model, comprising the following steps:

[0074] (1) Obtain the dataset, divide the dataset into training set and test set, use the training set to train the ResNet18 model to obtain the original model, and divide the training set into the remaining dataset and the forgotten dataset in an 8:2 ratio.

[0075] (2) The parameters in the original model obtained in step (1) were slightly perturbed by using Random-K, Top-K, EU-K and CF-K forgetting strategies in sequence to obtain a forgetting model. The remaining dataset obtained in step (1) was used to train the forgetting model to obtain a trained forgetting model.

[0076] (3) Combine the original model obtained in step (1) and the forgetting model trained in step (2) to obtain a joint discriminator. Use the GAN-based forgetting measurement model (hereinafter referred to as SPD-GAN) to train the joint discriminator to obtain a generator.

[0077] This step is specifically as follows:

[0078] (3-1) Input the training set obtained in step (1) into the generator G(·) of SPD-GAN for encoding and decoding to obtain noise data G(x) of the same size as the training set.

[0079] Specifically, the encoding and decoding process is represented by the following formula:

[0080] Encoder:

[0081] h = f(Wx + b)

[0082] Encoder:

[0083] r = g(W′h + b′)

[0084] Where: x is the input data, h is the encoder output, r is the decoder output, W and W′ are weight matrices, b and b′ are bias vectors, and f and g are activation functions.

[0085] Specifically, in the encoder of the generator, the activation function uses the following formula:

[0086]

[0087] Where α = 0.2.

[0088] In the decoder of the generator, the activation function uses the following formula:

[0089] g(x) = max(0,x)

[0090] In the decoder of the generator, the last layer controls the output value to be in the range of [-1, 1], specifically using the following formula:

[0091]

[0092] Here, e is the base of the natural logarithm. After the above processing, a noise matrix with the same size as the input, but much smaller, can be obtained.

[0093] (3-2) Add the noise data G(x) obtained in step (3-1) to the training set to obtain the adversarial sample x′;

[0094] Specifically, this step uses the following formula:

[0095] x′=G(x)+x

[0096] The advantage of this step is that it uses GANs to generate noise, thereby breaking the independent and identically distributed characteristics of the dataset, which causes the model's generalization ability to fail on adversarial examples.

[0097] (3-3) Input the adversarial sample x′ obtained in step (3-2) into the original model D obtained in step (1). s and the forgetting model D obtained in step (2) U In the joint discriminator, the generator is iteratively trained to obtain the final generator.

[0098] This step is specifically as follows:

[0099] First, obtain the loss of the adversarial example x′ on the original model. soutce By analyzing the loss soutce Minimize the adversarial sample x′ to make it close to the data x in the training set.

[0100] Then, obtain the loss of the adversarial example x′ on the forgetting model. unlearn By analyzing the loss unlearn The goal is to maximize the amount of time that the adversarial example x′ and the data x in the training set are forgotten, making the model's classification inconsistent. Therefore, the loss of SPD-GAN is:

[0101] L = loss source -λloss unlearn

[0102] Where λ represents the coefficient of expected risk in the forgetting model, and its value ranges from 0 to 1, preferably 0.005.

[0103] Finally, repeat the above process 100 times to obtain the final generator.

[0104] The advantage of this step is that the original model is used as one of the discriminators to control the difference between the adversarial examples and the training set, and the forgetting model is used as another discriminator to change the independent and identically distributed characteristics of the data as much as possible, so that the performance of the adversarial examples on the forgetting model decreases, thus more intuitively showing the forgetting effect.

[0105] (4) Input the forgotten dataset obtained in step (1) into the generator obtained in step (3) to generate noise data for the forgotten data in the forgotten dataset. Add the generated noise data to the forgotten data to obtain the corresponding anti-forgetting sample. Input the anti-forgetting sample into the forgetting model obtained in step (2) to obtain the difference between the performance of the forgetting model on the anti-forgetting sample and the performance of the forgetting model on the forgotten dataset, and then measure the machine forgetting effect.

[0106] The advantage of this step is that the distribution of the forgotten dataset is perturbed using SPD-GAN, breaking the independent and identically distributed property between the forgotten dataset and the remaining dataset. By using a joint discriminator, noise is selectively added, resulting in a small change in performance on the original model, but further demonstrating the forgetting effectiveness of the forgetting model.

[0107] Experimental results

[0108] The experimental environment for this invention was as follows: NVIDIA A100 GPU was used, and the algorithm was implemented using the PyTorch framework. Specific settings were as follows: batch size was 128; for Top-K, K = 25; for Random-K, K = 10%; for EU-K and CF-K, K was set to 5 and 10 respectively; the JS divergence factor was 0.1; and the forgetting model loss factor was 0.005.

[0109] To demonstrate the effectiveness of the method and its memory function for the remaining dataset, we randomly selected 20% of the data from the CIFAR10 training set as the forgotten data, with the remainder as the remaining dataset. Based on this, we used the SPD-GAN model to measure the forgetting effect of the forgetting models obtained from the various forgetting strategies mentioned above. Other metrics were set as the accuracy D of the forgotten dataset. UL Acc, Remaining Dataset Accuracy D RE Acc, forgetting rate (FR), memory retention rate (MMR), and perturbation parameters. The evaluation results are shown in Table 1 below, where arrows indicate better indicator values:

[0110] Table 1

[0111]

[0112] Based on the performance of the forgetting model trained on ResNet18 for 50 epochs as shown in the table above, it can be seen that Random-K of this invention stands out in the forgetting dataset with the lowest accuracy (73.83%) and the highest forgetting rate (0.2617). However, Random-K has a lower D... RE The high accuracy (91.345) compromised the model's generalization performance. EU-K and CF-K performed well in terms of memory retention. Notably, despite perturbing only 25 model parameters, Top-K achieved a 20% accuracy difference between the forgotten dataset and the remaining set, outperforming other methods with the lowest perturbation rates. Both Top-K and Random-K had higher forgetting rates, indicating that they achieved forgetting more quickly.

[0113] To further illustrate whether the SPD-GAN proposed in this invention can more intuitively demonstrate the forgetting effect of the forgetting model on forgetting datasets that break independent and identically distributed forgetting patterns, ResNet18 was used as the model, and adversarial forgetting data D was used. p Accuracy PoU and D on the forgetting model p The accuracy, PoS, on the original model was used as the metric, and the results are shown in Figure 3.

[0114] When the SPD-GAN of this invention was applied to generate adversarial examples on various forgetting strategies and trained for 10 rounds, Figure 3 shows that the PoS (accuracy of the perturbed forgetting dataset on the original model) reached nearly 100% under each forgetting strategy, while the PoU (accuracy of the perturbed forgetting dataset on the forgetting model) was around 10%. This demonstrates that by breaking the independent and identically distributed property, the forgetting model can more intuitively show the forgetting effect.

[0115] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A working method for a GAN-based forgetting measurement model, comprising three sequentially connected parts: an autoencoder, an original model trained with ResNet18 on a training set, and a forgetting model obtained by applying a forgetting strategy to the original model. The autoencoder consists of an encoder and a decoder. The encoder structure is as follows: the first layer is a two-dimensional convolutional layer with 3 input channels, corresponding to RGB... The first layer has 64 input channels and 128 output channels; the kernel size is 3x3, stride is 1, and padding is 1; the activation function is LeakyReLU, which sets the output to 0.2 times the input value when the input value is less than 0. The second layer is a 2D convolutional layer with 64 input channels and 128 output channels; the kernel size is 4x4, stride is 2, and padding is 1. The third layer is a 2D batch normalization layer with 128 input channels, using LeakyReLU activation and 128 output channels, used to normalize 128 feature maps. The fourth layer is a 2D convolutional layer with 128 input channels and 128 output channels. The decoder has 256 output channels; a 4x4 kernel size, a stride of 2, and padding of 1; the fifth layer is a 2D batch normalization layer with 256 input channels, a LeakyReLU activation function, and 256 output channels, used to normalize the 256 feature maps; the decoder's specific structure is as follows: the first layer is a 2D transposed convolutional layer with 256 input channels and 128 output channels; the kernel size is 4x4, the stride is 2, and padding is 1, used to increase the size of the feature maps; the second layer is a 2D batch normalization layer with 128 input channels, a ReLU activation function, and 128 output channels. The first layer is used to normalize 128 feature maps; the second layer is a 2D transposed convolutional layer with 128 input channels and 64 output channels; the kernel size is 4x4, the stride is 2, and the padding is 1; the third layer is a 2D batch normalization layer with 64 input channels, the activation function is ReLU, and the output channel is 64, used to normalize 64 feature maps; the fourth layer is a 2D convolutional layer with 64 input channels and 3 output channels; the kernel size is 3x3, the stride is 1, and the padding is 1; its characteristic is that... The working method includes the following steps: (1) Obtaining an image dataset, dividing the image dataset into a training set and a test set, using the training set to train the ResNet18 model to obtain the original model, and dividing the training set into a residual dataset and a forgotten dataset in an 8:2 ratio; (2) Using Random-K sequentially, The Top-K, EU-K, and CF-K forgetting strategies slightly perturb the parameters in the original model obtained in step (1) to obtain a forgetting model; the remaining dataset obtained in step (1) is used to train the forgetting model to obtain a trained forgetting model; (3) the original model obtained in step (1) and the forgetting model trained in step (2) are combined to obtain a joint discriminator, and the joint discriminator is trained using a GAN-based forgetting measurement model to obtain a generator; (4) the forgetting dataset obtained in step (1) is input into the generator obtained in step (3) to generate noise data for the forgotten data in the forgetting dataset, and the generated noise data is added to the forgetting data to obtain the corresponding adversarial forgetting sample, and the adversarial forgetting sample is input into the forgetting model obtained in step (2) to obtain the difference between the performance of the forgetting model on the adversarial forgetting sample and the performance of the forgetting model on the forgetting dataset, and thus measure the machine forgetting effect.

2. The working method of the GAN-based forgetting measurement model according to claim 1, characterized in that, Step (3) includes the following sub-steps: (3-1) Input the training set obtained in step (1) into the generator of the GAN-based forgetting measurement model. Encoding and decoding are performed to obtain noise data of the same size as the training set. (3-2) The noise data obtained in step (3-1) Add to the training set to obtain adversarial examples. Specifically, this step uses the following formula: (3-3) The adversarial examples obtained in step (3-2) Input the original model obtained in step (1) and the forgetting model obtained in step (2) In the joint discriminator, the generator is iteratively trained to obtain the final generator.

3. The working method of the GAN-based forgetting measurement model according to claim 2, characterized in that, The encoding and decoding process is represented by the following formula: Encoder: Encoder: ;in: It is the input data. It is the output of the encoder. It is the output of the decoder. and It is a weight matrix. and It is a bias vector. and It is an activation function.

4. The working method of the GAN-based forgetting measurement model according to claim 3, characterized in that, In the encoder of the generator, the activation function is expressed by the following formula: ;in 。 5. The working method of the GAN-based forgetting measurement model according to claim 4, characterized in that, In the decoder of the generator, the activation function uses the following formula: In the decoder of the generator, the last layer of control output value is in the range of [-1, 1], specifically using the following formula: ;in, It is the base of the natural logarithm.

6. The working method of the GAN-based forgetting measurement model according to claim 5, characterized in that, Step (3-3) specifically involves: First, obtaining adversarial examples. Loss on the original model Through the Minimize to make adversarial examples Data close to the training set ； Then, obtain adversarial examples. Loss on the forgetting model Through the Maximize the adversarial examples and the data in the training set To minimize the inconsistency between the forgotten model and the classification, the loss of the GAN-based forgetting model is obtained: ;in This is represented as the coefficient of expected risk on the forgetting model, with a value ranging from 0 to 1; finally, the above process is repeated 100 times to obtain the final generator.

Images