Abstract: In recent years, generative models have rapidly advanced, demonstrating strong capabilities in image synthesis, artistic creation, and digital portrait generation. However, while improving generation performance, these models also pose significant privacy risks, as private information in the training data may be leaked in the generated content. To address this issue, machine unlearning has been proposed to reduce a model’s memory of specific data, preventing the disclosure of private information. In particular, ID unlearning for face generation aims to prevent the model from generating images of specific identities, thereby protecting personal privacy. Nevertheless, existing ID unlearning methods still suffer from insufficient robustness. Attackers can exploit a small amount of unlearned identity data to perform limited steps of retraining, thereby recovering the unlearned identity, a process known as relearning attack. Experiments on the CelebAHQ dataset show that, although existing ID unlearning methods can effectively unlearn specific identity, the unlearned effect can be easily reversed under relearning attacks, indicating limited robustness in such scenarios. Therefore, while existing methods achieve reasonable unlearning in initial evaluations, they remain vulnerable in practical attack settings. To address this problem, this work has two objectives: first, to construct a relearning attack method to evaluate the robustness of existing ID unlearning methods; second, to propose a robust ID unlearning method that can maintain effective unlearning under such attacks. Technically, we first design a relearning attack method for generative adversarial networks (GANs), which updates the model with a small amount of unlearned identity data using limited gradient steps, causing the generated images to approach the unlearned identity representations and thereby assessing the robustness of ID unlearning. Second, we propose robust ID unlearning via smoothness optimization (RIDU), a robust ID unlearning method based on smooth optimization. During training, RIDU applies random perturbations to the model parameters, allowing optimization to not only achieve unlearning at the current parameter point but also maintain stability across neighboring regions, forming a smooth and stable unlearning zone. In this way, the unlearning effect does not rely on a fragile local optimum, making it difficult for relearning attacks to restore the unlearned identity. Furthermore, RIDU incorporates appropriate loss functions to balance unlearning objectives with generation quality. Experiments on multiple public datasets demonstrate the effectiveness of RIDU. On the CelebAHQ dataset, RIDU significantly reduces the similarity between specific identity and generated images under non-attack conditions, outperforming existing methods. Under relearning attacks, existing methods are easily reversed, whereas RIDU maintains strong unlearning, effectively suppressing identity recovery. Additional experiments indicate that RIDU preserves the model’s generative capability while unlearning specific identities. In summary, our work introduces a relearning attack to evaluate the robustness of existing ID unlearning methods and proposes RIDU, which integrates smooth optimization with ID unlearning to enhance robustness. RIDU also ensures effective unlearning under relearning attacks while simultaneously maintaining the model’s generative capability.

摘要： 近年来，生成模型快速发展，在图像合成、艺术创作和数字人像生成等领域展现出极强能力。然而，这类模型在提升生成性能的同时，也带来了显著的隐私风险：训练数据中的涉及隐私的信息可能在生成内容中泄露。为此，机器遗忘技术被提出，用以削弱模型对特定数据的记忆，防止隐私信息在生成任务中被泄露。其中，面向人脸生成的ID遗忘方法旨在使模型不再生成具有特定身份的图片，从而保护个人隐私信息。然而，现有ID遗忘方法仍存在鲁棒性不足的问题。攻击者可以利用少量被遗忘身份的数据对模型进行有限步数再训练以恢复被遗忘的身份，即再学习攻击。实验表明，在 CelebAHQ数据集上，传统 ID 遗忘方法虽然能够有效降低目标身份与生成图像的相似性，但经过再学习攻击后，遗忘效果很容易被逆转，显示出其在再学习攻击下的鲁棒性不足的问题。由此可见，虽然传统方法在初始测试中能够达到较好的遗忘效果，但在实际攻击场景中仍存在鲁棒性不足的问题。针对这一问题，本文的研究目标包括两方面：一是构建一种再学习攻击方法，用以揭示现有ID遗忘方法鲁棒性不足的问题；二是在此基础上提出一种增强鲁棒性的 ID 遗忘方法，使模型在面对再学习攻击时仍能保持稳定有效的遗忘效果。在技术实现上，本文首先提出了针对生成对抗网络的再学习攻击方法。该方法在已有遗忘模型基础上，利用少量被遗忘身份数据进行有限步梯度更新，使模型生成图像重新接近被遗忘的身份表征，从而评估ID遗忘方法的鲁棒性。其次，本文提出一种基于平滑优化的鲁棒 ID 遗忘方法 (RIDU)。该方法在遗忘训练过程中对模型权重参数施加随机扰动，使优化不仅追求当前参数点的遗忘效果，同时考虑参数邻域内的整体稳定性，从而形成平滑且稳定的遗忘区域。通过这种方式，遗忘效果不再依赖单一脆弱的局部最优点。这使得再学习攻击难以恢复被遗忘身份。同时，该方法采用相应损失函数确保遗忘目标与模型生成质量的平衡。在实验方面，本文在多个公开数据集上验证了方法有效性。以 CelebAHQ 数据集为例，RIDU方法在未受攻击条件下能够显著降低目标身份与生成图像的相似性，相比传统方法效果更优；在面对再学习攻击时，传统方法的遗忘效果容易被逆转，而RIDU方法在攻击下仍能保持较强的遗忘能力，可显著抑制目标身份的恢复。同时有相关实验表明，该方法使得模型在遗忘特定身份的同时，也能保持生成能力不受较大影响。综合来讲，本文提出了一种再学习攻击来评估当前ID遗忘方法的鲁棒性。同时也将平滑优化和ID遗忘结合，提出具有更强鲁棒性的RIDU方法。RIDU方法通过引入参数扰动的平滑优化策略，使得模型在面对再学习攻击时仍能维持有效的遗忘效果。此外，RIDU方法在进行ID遗忘的同时还能够较好地保护模型的生成能力。