Physics-Aware Machine Unlearning for Cyber-Physical Systems
Organizations: Analytics for Cyber Defense (ACyD) Lab, Florida International University, USA
Abstract
This paper proposes a physics-guided gradient-ascent-based machine unlearning method that couples the forgetting signal with the physical residual of the target cyber-physical systems, ensuring that weight updates during unlearning are steered toward physically feasible regions of the weight space. The physics residual acts as a safety fence during gradient ascent: the model is steered away from the poisoned behavioral basin and simultaneously toward physics-compliant territory, rather than toward an arbitrary alternative that may still violate domain constraints. We evaluate the proposed method against four baselines: naive gradient ascent, exact unlearning, SISA, and full retraining on an IEEE 34-bus distribution system, driven by two physics-informed neural network-based distribution energy resource controllers and validated through high-fidelity OpenDSS power-flow co-simulation. From the evaluation, we found that our proposed physics-guided model simultaneously removes poison and restores physical compliance, which are essential for the safe deployment of safety-critical cyber-physical systems
Figures & tables
| Scenario | Poison MSE | Clean MSE | PVR (%) | VVR (%) |
| Baseline | 0.51 .01 | 0.012 .001 | 0.8 .1 | 0.0 |
| Poisoned (no defense) | 0.003 .001 | 0.21 .02 | 34.2 2.1 | 61.4 3.2 |
| Naive GA | 0.47 .03 | 0.018 .002 | 18.7 1.9 | 26.3 2.4 |
| PhyGAMuL | 0.51 .02 | 0.014 .001 | 1.4 .3 | 2.1 .4 |
| Exact Unlearning | 0.50 .02 | 0.015 .001 | 2.8 .5 | 3.7 .6 |
| SISA | 0.49 .03 | 0.016 .002 | 3.9 .7 | 5.2 .8 |
| Scenario | VVR (%) | Min (p.u.) | Losses (kWh) | (kW) | (kW) | Imbal. (kW) | ||
| Baseline | 3.47 | 0.947 | 5,867 | 27.0 | 0.0016 | 44.2 | 0.0 | 230.8 |
| Poisoned | 100.0 | 0.929 | 7,627 | 500.0 | 0.3294 | 44.6 | 0.2199 | 703.5 |
| Naive GA | 100.0 | 0.944 | 6,181 | 115.3 | 0.0554 | 44.1 | 0.0 | 319.2 |
| PhyGAMuL | 3.48 | 0.947 | 5,867 | 27.0 | 0.0007 | 44.2 | 0.0 | 230.9 |
| Exact | 3.48 | 0.947 | 5,867 | 27.0 | 0.0017 | 44.2 | 0.0 | 230.9 |
| SISA | 3.48 | 0.947 | 5,867 | 27.0 | 0.0017 | 44.2 | 0.0 | 230.9 |
| PhyGAMuL | SISA | Exact | |
| Works on deployed model | Yes | No | No |
| Physics guaranteed | At unlearning | Incidental | Incidental |
| Data at unlearning | Poison only | Full shard data | Checkpoint + data |
| Late attack discovery | Yes | N/A | No |
| Federated-compatible | Per-client | Complex | Complex |
| Unlearning time (EVCS) | 38 s | 39 s | 2 s |
| Scenario | Power Balance | Cap. Guard | Over- current | Avg. Viol. |
| Baseline | 25.4% | 1.8% | 0.0% | 6.8% |
| Poisoned | 0.0% | 100.0% | 0.0% | 25.0% |
| Naive GA | 66.3% | 0.0% | 0.0% | 16.6% |
| PhyGAMuL | 15.1% | 0.1% | 1.1% | 4.1% |
| Exact | 25.7% | 2.0% | 0.1% | 6.9% |
| SISA | 18.4% | 12.8% | 0.3% | 7.9% |
| Scenario | MPPT Exceeded | Night Injection | Reverse Power | Avg. Viol. |
| Baseline | 0.0% | 0.0% | 0.0% | 0.0% |
| Poisoned | 82.1% | 3.4% | 0.0% | 21.4% |
| Naive GA | 0.0% | 0.0% | 0.0% | 0.0% |
| PhyGAMuL | 0.0% | 0.0% | 0.0% | 0.0% |
| Exact | 0.0% | 0.0% | 0.0% | 0.0% |
| SISA | 0.0% | 0.0% | 0.0% | 0.0% |
| EVCS | PMS | |||||
| Poison MSE | Clean MSE | PVR (%) | Poison MSE | Clean MSE | PVR (%) | |
| 0.0 (Naive GA) | 0.51 .02 | 0.046 .003 | 15.4 1.8 | 0.25 .02 | 0.103 .006 | 2.8 .5 |
| 0.5 | 0.51 .02 | 0.041 .002 | 6.6 0.9 | 0.30 .01 | 0.139 .005 | 0.5 .3 |
| 1.0 | 0.51 .01 | 0.042 .002 | 4.5 0.6 | 0.31 .01 | 0.146 .004 | 0.0 .0 |
| 2.0 (PhyGAMuL) | 0.51 .01 | 0.045 .002 | 3.6 .4 | 0.32 .01 | 0.152 .004 | 0.0 .0 |
| 5.0 | 0.51 .01 | 0.052 .003 | 1.2 .3 | 0.32 .01 | 0.156 .005 | 0.0 .0 |
| EVCS | PMS | |||||||
| PhyGAMuL | Naive GA | PhyGAMuL | Naive GA | |||||
| MSE | PVR | MSE | PVR | MSE | PVR | MSE | PVR | |
| 200 | 0.051 .004 | 5.8 .7 | 0.047 .003 | 15.9 1.7 | 0.152 .005 | 0.8 .3 | 0.103 .006 | 2.4 .4 |
| 500 | 0.048 .003 | 5.1 .6 | 0.046 .003 | 15.7 1.7 | 0.152 .004 | 0.2 .2 | 0.103 .006 | 2.4 .4 |
| 800 | 0.047 .002 | 4.3 .5 | 0.046 .003 | 15.6 1.6 | 0.152 .004 | 0.0 .0 | 0.103 .006 | 2.4 .4 |
| 1000 | 0.046 .002 | 4.0 .5 | 0.046 .003 | 15.5 1.6 | 0.152 .004 | 0.0 .0 | 0.103 .005 | 2.4 .4 |
Machine Unlearning
Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.
See all 343 papers