| 引用本文： |
-
陈得鹏,李鹏飞,蒋啸,崔杰,仲红.面向困难样本构造的机器遗忘对抗攻击研究[J].信息安全学报,已采用 [点击复制]
- Chen De Peng,Li Pengfei,Jiang Xiao,Cui Jie,zhong Hong.Adversarial Attacks on Machine Unlearning via Hard Sample Construction[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 为满足《通用数据保护条例》《个人信息保护法》等法规中"被遗忘权"的合规要求，机器学习即服务（Machine Learning as a Service, MLaaS）平台正积极部署机器遗忘算法。然而，这类服务通常假设训练数据与遗忘请求均来自良性用户，缺乏对对抗性用户行为的安全分析。对此问题，本文面向MLaaS场景提出了一种基于困难样本构造的机器遗忘对抗攻击模型。该攻击通过联合设计数据投毒与合法遗忘请求，在遗忘数据与保留数据之间构建特征纠缠，使目标样本演化为难以被遗忘算法彻底消除的困难样本，从而在维持表面遗忘效果的同时显著增强模型中的知识残留。进一步地，本文通过引入锚定损失函数强化遗忘样本与模型表征之间的稳定关联，提高攻击的持续性与稳健性。实验结果表明，在该攻击模型下，多种主流机器遗忘算法均表现出明显的信息残留，其实际隐私保护能力显著低于其表面遗忘表现。本文研究揭示了MLaaS机器遗忘服务在对抗环境下的安全边界，为设计更加鲁棒的遗忘机制及安全评估方法提供了重要参考。 |
| 关键词: 机器遗忘 机器学习及服务系统 困难遗忘攻击 |
| DOI： |
| 投稿时间：2026-04-11修订日期：2026-07-15 |
| 基金项目:国家自然科学基金联合基金重点项目：智能网联汽车一体化安全防护体系及关键技术，U23A20308 |
|
| Adversarial Attacks on Machine Unlearning via Hard Sample Construction |
|
Chen De Peng, Li Pengfei, Jiang Xiao, Cui Jie, zhong Hong
|
| (Anhui University) |
| Abstract: |
| To comply with the "right to be forgotten" requirements mandated by regulations such as the General Data Protection Regulation and the Personal Information Protection Law, Machine Learning as a Service (MLaaS) platforms have begun deploying machine unlearning algorithms to process data removal requests. However, these services typically assume benign training data and unlearning requests, and lack systematic security analysis under adversarial settings. To address this gap, this paper proposes a novel adversarial attack model against machine unlearning in MLaaS based on hard sample construction. Specifically, the proposed attack jointly exploits data poisoning and legitimate unlearning requests to create deep feature entanglement between forgotten and retained data, thereby transforming target samples into hard-to-unlearn instances. This allows the attack to preserve significant residual knowledge of the target data while maintaining the appearance of compliant unlearning. Furthermore, an anchoring loss is introduced to strengthen the representational binding between target samples and the model, improving the persistence and robustness of the attack. Experimental results show that, under the proposed attack, several representative machine unlearning methods exhibit substantial information residuals, suggesting that their actual privacy protection capability is significantly weaker than their apparent unlearning performance. Our findings expose the security boundaries of MLaaS-based machine unlearning services under adversarial conditions and provide insights for designing more robust unlearning mechanisms and security evaluation frameworks. |
| Key words: machine unlearning machine learning as a service hard unlearning attack |
