[BODY]
A technology has been developed to prevent personal information or copyright-infringing data deleted from artificial intelligence (AI) models from being restored through only a small amount of retraining.
The Ulsan National Institute of Science and Technology (UNIST) announced on the 21st that a joint research team led by Professor Yoon Sung-hwan of the Graduate School of Artificial Intelligence and Professor Park Sae-rom of the Department of Industrial Engineering has developed "Spotter," a machine unlearning technology that selectively erases only specific information learned by an AI while protecting similar normal information from being removed alongside the deletion target.
Machine unlearning is a technology that selectively removes only the influence of specific data or concepts from a trained AI model. It can be used to erase the facial information of a person who has requested deletion from a facial recognition AI, or to remove personal information, harmful content, and copyright-infringing materials included in training data. Until now, the technology has suffered from an "excessive unlearning" problem, in which not only the deletion target but also similar normal information is erased along with it. For example, deleting information about cats from an AI model would also reduce the recognition accuracy of tigers or leopards, which have similar shapes.
Another limitation is that the features of the deleted information remain inside the AI model and can be restored through retraining. If an attacker re-inputs a few photos related to the deletion target, the erased recognition capability can be revived based on the remaining features. When the research team applied existing unlearning technology to an AI model and retrained it by inputting five photos of the deletion target, the recognition accuracy of that target recovered from 71.10% to as much as 99.98%.
Spotter is designed as a plug-in that can be additionally combined with existing unlearning technologies. It is expected to be used for deleting identity information in facial recognition systems and removing personal information, copyright infringement, and harmful content from generative AI. Spotter prevents the recognition performance of normal information from declining, while also making it difficult for an attacker to rediscover the common features of the deletion target even if they secure a small number of photos. As a result, Spotter lowered the recognition accuracy of the deletion target to 0%. Even after a retraining attack using five photos, the accuracy remained at just 0.24%. The recognition accuracy of the remaining categories that were not deleted was maintained at 99.96%.
The findings were accepted at "ICML 2026," an international machine learning conference.
