Abstract:

Recently, generative models have advanced rapidly and demonstrated remarkable capabilities in image synthesis, artistic creation, and other fields. However, although these models improve generation performance, they introduce significant privacy risks: the private information contained in the training data may be leaked through the generated content. To address this issue, machine unlearning techniques have been proposed to weaken the memorization of specific data by the model, thereby preventing the leakage of private information during generation tasks. Among these, Identity (ID) unlearning methods for face generation aim to prevent a model from generating images with specific identities, thereby protecting personal privacy. However, the existing ID unlearning methods suffer from insufficient robustness. Attackers can exploit a small amount of data from the forgotten identity to fine-tune the model in a limited number of steps, thereby recovering the forgotten identity, a threat known as the relearning attack. Although traditional ID unlearning methods can effectively reduce the similarity between the target identity and generated images, the unlearning effect is easily reversed after a relearning attack, compromising their robustness. To address this problem, a relearning attack method is constructed to expose the robustness deficiency of existing ID unlearning methods. On this basis, a robust ID unlearning method is proposed that enables the model to maintain a stable and effective unlearning performance even under relearning attacks. First, a relearning attack method targeting Generative Adversarial Networks (GAN) is proposed. Building on an already unlearned model, this method performs a limited number of gradient updates using a small amount of data from the forgotten identity, driving the generated images back toward the forgotten identity representation, thereby evaluating the robustness of the ID unlearning methods. Second, a Robust ID Unlearning (RIDU) method based on smoothness optimization is proposed. During the unlearning training process, this method applies random perturbations to the model's weight parameters; therefore, the optimization not only pursues the unlearning effect at the current parameter point but also considers the overall stability within the parameter neighborhood, thus forming a smooth and stable unlearning region. Thus, the unlearning effect no longer relies on a single fragile local optimum, making it difficult for relearning attacks to recover forgotten identities. Moreover, the method employs appropriate loss functions to ensure a balance between the unlearning objective and the generation quality of the model. Experimental results on the CelebAHQ dataset demonstrate that under nonattack conditions, RIDU significantly reduces the similarity between the target identity and generated images, outperforming traditional methods. Under relearning attacks, although the unlearning effect of traditional methods is easily reversed, RIDU maintains strong unlearning capability and effectively suppresses the recovery of the target identity. This method enables the model to forget specific identities while preserving its generation quality with minimal degradation.

Key words: machine unlearning, ID unlearning, generative models, robustness, smoothness optimization

摘要：

近年来, 生成模型快速发展, 在图像合成、艺术创作等领域展现出极强能力。然而, 这类模型在提升生成性能的同时, 也带来了显著的隐私风险, 即训练数据中涉及隐私的信息可能在生成内容中泄露。为此, 机器遗忘技术被提出, 用以削弱模型对特定数据的记忆, 防止隐私信息在生成任务中被泄露。其中, 面向人脸生成的ID遗忘方法旨在使模型不再生成具有特定身份的图片, 从而保护个人隐私信息。然而, 现有ID遗忘方法仍存在鲁棒性不足的问题, 攻击者可以利用少量被遗忘身份的数据对模型进行有限步数再训练以恢复被遗忘的身份, 即再学习攻击。传统ID遗忘方法虽然能够有效降低目标身份与生成图像的相似性, 但经过再学习攻击后, 遗忘效果很容易被逆转, 使得其鲁棒性降低。针对这一问题, 构建一种再学习攻击方法, 用以揭示现有ID遗忘方法鲁棒性不足的问题, 在此基础上, 提出一种增强鲁棒性的ID遗忘方法, 使模型在面对再学习攻击时仍能保持稳定有效的遗忘效果。首先, 提出一种针对生成对抗网络(GAN)的再学习攻击方法, 该方法在已有遗忘模型的基础上, 利用少量被遗忘身份数据进行有限步梯度更新, 使模型生成图像重新接近被遗忘的身份表征, 从而评估ID遗忘方法的鲁棒性; 其次, 提出一种基于平滑优化的鲁棒ID遗忘(RIDU)方法, 该方法在遗忘训练过程中对模型权重参数施加随机扰动, 使优化不仅追求当前参数点的遗忘效果, 同时考虑参数邻域内的整体稳定性, 从而形成平滑且稳定的遗忘区域。通过这种方式, 遗忘效果不再依赖单一脆弱的局部最优点, 从而使得再学习攻击难以恢复被遗忘的身份。同时, 该方法采用相应损失函数确保遗忘目标与模型生成质量的平衡。实验结果表明: 在CelebAHQ数据集上, RIDU方法在未受攻击条件下能够显著降低目标身份与生成图像的相似性, 相比传统方法效果更优; 在面对再学习攻击时, 传统方法的遗忘效果容易被逆转, 而RIDU方法仍能保持较强的遗忘能力, 可显著抑制目标身份的恢复。该方法使得模型能够遗忘特定身份, 同时保持生成能力不受较大影响。

关键词: 机器遗忘, ID遗忘, 生成模型, 鲁棒性, 平滑优化