完全去中心化的可认证机器遗忘
Fully Decentralized Certified Unlearning
为视觉模型提供可认证的数据删除机制：在无中心协调的去中心化拓扑上，用随机游走+投影梯度上升/下降配合子采样高斯噪声，在给定(ε,δ)下移除指定图像数据的影响，可直接用于隐私合规或清除投毒样本，并把后门攻击成功率压到随机猜测水平。
原文依据 reducing backdoor accuracy (ASR) to the random-guessing baseline
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论机器遗忘（MU）旨在响应隐私请求或数据投毒，从已训练模型中移除指定数据的影响。尽管可认证遗忘已在集中式和服务器编排的联邦设置中得到分析（通过类似于差分隐私（DP）的保证），但在同伴之间无协调者通信的去中心化设置中仍研究不足。我们研究固定拓扑去中心化网络中的可认证遗忘，并提出 \methodname，一种随机游走过程：在遗忘客户端上对遗忘集执行一步投影梯度上升，在其他位置对保留数据执行几何分布数量的投影下降步，并结合子采样高斯噪声与向原始模型周围信任域的投影。我们提供：(i) 凸情形下的收敛保证与非凸情形下的平稳性保证；(ii) 通过带片段级子采样的子采样高斯 Renyi DP（RDP）在客户端视图上给出 (\varepsilon,\delta) 网络遗忘证书；(iii) 删除容量界，其随遗忘数据与本地数据之比缩放，并量化去中心化（网络混合与随机子采样）对隐私-效用权衡的影响。在图像基准上的实验表明，\methodname 在满足给定 (\varepsilon,\delta) 的同时，测试准确率高于去中心化 DP 基线，并将后门准确率（ASR）降至随机猜测基线（约 10%）。
英文原文摘要 1507 字符
Machine unlearning (MU) seeks to remove the influence of specified data from a trained model in response to privacy requests or data poisoning. While certified unlearning has been analyzed in centralized and server-orchestrated federated settings (via guarantees analogous to differential privacy, DP), the decentralized setting--where peers communicate without a coordinator--remains underexplored. We study certified unlearning in decentralized networks with fixed topologies and propose \methodname, a random-walk procedure that performs one projected gradient ascent step on the forget set at the unlearning client and a geometrically distributed number of projected descent steps on the retained data elsewhere, combined with subsampled Gaussian noise and projection onto a trust region around the original model. We provide (i) convergence guarantees in the convex case and stationarity guarantees in the nonconvex case, (ii) (\varepsilon,\delta) network-unlearning certificates on client views via subsampled Gaussian Renyi DP (RDP) with segment-level subsampling, and (iii) deletion-capacity bounds that scale with the forget-to-local data ratio and quantify the effect of decentralization (network mixing and randomized subsampling) on the privacy-utility trade-off. Empirically, on image benchmarks, \methodname matches a given (\varepsilon,\delta) while achieving higher test accuracy than decentralized DP baselines and reducing backdoor accuracy (ASR) to the random-guessing baseline ((~ 10%)).