Technical Summary: Auditable Machine Unlearning for Privacy-Compliant Ransomware Detection Using Multi-Shard SISA and Deep Reinforcement Learning

1. Problem Statement

Ransomware attacks are evolving rapidly, utilizing obfuscation and polymorphic variants that render traditional signature-based detection ineffective. While behavior-based machine learning (ML) and deep learning (DL) detectors have shown strong predictive capabilities, they typically operate under the assumption of fixed training data. This creates a critical conflict with modern privacy regulations, such as the GDPR and CCPA, which mandate the "right to be forgotten." In cybersecurity contexts, organizations may need to remove specific user data, mislabeled samples, or adversarial traces from deployed models. Conventional approaches to satisfy these requests involve full model retraining, which is computationally expensive and impractical for continuously updated systems. Furthermore, existing reinforcement learning (RL) based detection systems have not adequately addressed how to selectively remove training samples while maintaining policy stability and verifying that the removal was successful without compromising privacy.

2. Methodology

The authors propose a unified framework integrating Double Deep Q-Networks (DDQN) with a Multi-Shard SISA (Sharded, Isolated, Sliced, and Aggregated) architecture to enable auditable machine unlearning for ransomware detection.

2.1. Dataset and Environment

• Dataset: A balanced behavioral dataset of 2,000 Windows 11 samples (1,000 ransomware, 1,000 benign) was constructed using 30 distinct ransomware families. Features were extracted from sandbox execution traces (ANY.RUN), resulting in 103-dimensional behavioral vectors covering file system, registry, process, API, and network activities.
• RL Formulation: Ransomware detection is modeled as a Markov Decision Process (MDP).
  • State: The 103-dimensional behavioral feature vector.
  • Action: Binary classification (0: Benign, 1: Ransomware).
  • Reward Function: An asymmetric reward structure is employed to reflect security costs: +1 for correct classification, -2 for false negatives (missed ransomware), and -0.5 for false positives. This prioritizes security-critical outcomes.
  • Discount Factor: Set to $\gamma=0.1$ to emphasize immediate classification accuracy over long-term returns.

2.2. The DDQN–SISA Framework

The framework operates in four phases:

1. Sharding: The dataset is partitioned into $M$ non-overlapping shards ($M \in \{5, 10, 20\}$) using stratified allocation to maintain class balance.
2. Isolated Training: Independent DDQN agents are trained on each shard with separate replay buffers and target networks. This isolates the influence of any training sample to its specific shard.
3. Sliced Deletion (Unlearning): Upon a deletion request, the system identifies affected shards containing the samples to be removed. Only these specific shards are retrained on the remaining data ($\mathcal{D}_r = \mathcal{D} \setminus \mathcal{D}_f$). Unaffected shards remain unchanged.
4. Aggregation: Final predictions are generated via majority voting across all shard models. The ensemble Q-margin (difference between Q-values for ransomware vs. benign) is used for confidence scoring and privacy auditing.

2.3. Verification and Auditing Protocols

To ensure the framework meets compliance and security standards, three evaluation mechanisms are implemented:

• Oracle-Verified Forgetting: An "oracle" model is retrained from scratch on the retained dataset ($\mathcal{D}_r$). The unlearned model's predictions are compared against this oracle to verify that the deletion process approximates the ideal full retraining.
• Membership Inference Attack (MIA) Auditing: A proxy MIA is conducted using the ensemble Q-margins. The goal is to verify that forgotten samples become indistinguishable from never-observed data (i.e., MIA success rates drop to random guessing, $\approx 0.5$).
• Computational Efficiency: The system measures retraining time, communication overhead, and memory usage, comparing shard-level retraining against full retraining.

3. Key Contributions

The paper claims three primary contributions:

1. DDQN–SISA Framework: The first integration of a value-based RL detector with multi-shard SISA for ransomware detection, enabling selective shard-level retraining to satisfy privacy mandates without full model rebuilding.
2. Dual-Mechanism Verification: A novel audit protocol combining oracle-verified forgetting (to confirm deletion accuracy) and membership-inference auditing (to verify privacy leakage), specifically tailored for RL-based security systems.
3. Systematic Deletion-Stress Evaluation: A comprehensive empirical study across 270 configurations, varying shard counts, deletion fractions (1%, 5%, 10%), and repeated deletion rounds (1, 5, 10) to characterize the trade-offs between utility, privacy, and efficiency.

4. Experimental Results

The framework was evaluated on a Windows 11 behavioral dataset using 5-fold cross-validation.

• Baseline Performance: The baseline DDQN detector achieved an F1-score of 0.9925 and an AUC of 0.9983, demonstrating high detection accuracy comparable to state-of-the-art methods.
• Utility Preservation:
  • Single-Shard: Unlearning resulted in minimal utility degradation ($\Delta F1 < 0.003$) across all deletion scenarios.
  • Multi-Shard: Moderate shard counts ($M=5, 10$) maintained stability under low-to-moderate deletion pressure. However, high granularity ($M=20$) combined with aggressive deletion (10% over 10 rounds) led to severe instability and utility collapse (F1 dropping to near 0), attributed to data starvation in small shards.
• Oracle Verification: Single-shard retraining showed low disagreement with the oracle model. Multi-shard configurations exhibited higher disagreement under high deletion stress, particularly for $M=10$ and $M=20$, indicating that localized retraining becomes less accurate as the number of affected shards increases.
• Privacy (MIA): Membership inference scores remained close to 0.5 (random guessing) across most configurations, indicating limited privacy leakage. Even under aggressive deletion, the increase in distinguishability was modest.
• Efficiency:
  • Retraining Time: Single-shard unlearning took approximately 5–6 seconds. Multi-shard unlearning took 20–30 seconds (depending on the number of affected shards).
  • Comparison: This is significantly faster than full retraining, which required 80–330 seconds.
  • Communication Overhead: Remained low (approx. 11 ms for single-shard, 53–55 ms for multi-shard).

5. Significance and Claims

The paper positions its work as a practical solution to the "right to be forgotten" in the context of high-stakes cybersecurity.

• Compliance without Compromise: The framework demonstrates that organizations can achieve GDPR/CCPA compliance by removing specific training samples without incurring the prohibitive computational costs of full retraining.
• Auditable Security: By integrating oracle verification and MIA auditing, the system provides a verifiable guarantee that deleted data no longer influences the model and that privacy is preserved, addressing a gap in existing RL-based detection literature.
• Operational Trade-offs: The study modestly concludes that while the framework is highly effective, there is a stability-efficiency trade-off. It recommends moderate shard counts ($M=5–10$) as the optimal operating regime, balancing retraining efficiency with policy stability. It explicitly notes that very high shard granularity ($M=20$) is unsuitable for sustained deletion pressure due to data fragmentation.
• Novelty: The authors claim this is the first ransomware detection framework to jointly combine value-based RL, shard-local unlearning, and dual-channel audit verification within a single evaluation pipeline.

The paper acknowledges limitations, including the use of a moderate-sized dataset (2,000 samples), reliance on a Q-margin-based MIA proxy rather than adaptive attacks, and the lack of evaluation on streaming data. Future work is suggested to explore larger datasets, stronger privacy attacks, and distributed deployment scenarios.