Auditable Machine Unlearning for Privacy-Compliant Ransomware Detection Using Multi-Shard SISA and Deep Reinforcement Learning

Abstract: Ransomware poses an escalating cybersecurity threat as attackers continuously modify behavioral patterns to evade static defenses. Although existing machine learning-based detectors often achieve strong predictive performance, they generally assume fixed training data and do not support the selective removal of previously learned samples. This limitation conflicts with privacy regulations such as the GDPR and CCPA, which require the removal of sensitive user data upon request. To address this challenge, we propose an auditable ransomware detection and unlearning framework that integrates deep reinforcement learning with multi-shard SISA retraining. In the proposed system, a Double Deep Q-Network (DDQN) learns a reward-guided detection policy from behavioral features under asymmetric security costs, while multi-shard SISA enables privacy-compliant selective sample removal through shard-level retraining. The framework was evaluated using four criteria: utility preservation, oracle-based forgetting validation, membership inference auditing, and computational efficiency. On a balanced Windows 11 behavioral dataset comprising 2,000 samples and 103 features, the baseline DDQN detector achieved an F1 score of 0.9925 and an AUC of 0.9983. The experimental results show that single-shard unlearning maintains minimal utility degradation and low oracle disagreement, whereas moderate shard counts (M = 5-10) provide the best efficiency-performance trade-off, reducing retraining time to 5-30 s compared with 80-330 s for full retraining. In addition, the membership inference scores remain close to 0.5 across most configurations, indicating limited privacy leakage after unlearning. These findings demonstrate that a privacy-compliant ransomware detection framework can jointly achieve high detection performance, auditable deletion verification, and efficient sample removal.

• The paper combines a Double Deep Q-Network with multi-shard SISA unlearning, oracle verification, and membership-inference auditing, achieving baseline F1 above 0.992.
• Selective retraining cuts update time from roughly 80–330 seconds to 5.6–30 seconds, while moderate shard counts of 5–10 preserve detection quality and closely match oracle predictions.
• Sustained deletions can exhaust finely divided shards and collapse ensemble utility, highlighting the need for adaptive shard allocation, stronger privacy attacks, and larger-scale validation.

Motivation and problem statement

Ransomware detection systems based on machine learning are typically trained once and deployed as static artifacts, an assumption that conflicts with privacy regulations such as the GDPR and CCPA, which grant data subjects a "right to be forgotten." When a deletion request arrives, the affected sample's influence must be removed from the trained detector without full retraining. This paper addresses that gap by proposing a framework that combines a Double Deep Q-Network (DDQN) ransomware detector with multi-shard SISA (Sharded, Isolated, Sliced, Aggregated) unlearning, augmented with two audit mechanisms: oracle-based forgetting verification and membership-inference (MIA) privacy auditing via Q-value margins (2607.06860). The work extends a preliminary single-shard study into a systematic deletion-stress evaluation spanning 270 configurations.

System design

The framework operates on a balanced behavioral dataset of 2,000 Windows 11 executable samples (1,000 ransomware from 30 families including LockBit, Conti, BlackCat, and WannaCry; 1,000 benign), each represented by 103 features extracted from ANY.RUN sandbox execution traces. Sample labeling is strengthened by requiring detection by at least 45 antivirus engines, explicit ransomware identification by at least 15 engines, and majority family agreement.

Detection is formulated as a contextual Markov decision process with a binary action space and an asymmetric reward function: +1 for correct classification, −2 for false negatives, and −0.5 for false positives, encoding the higher operational cost of missed detections. A low discount factor ($\gamma = 0.1$) focuses learning on immediate classification decisions. The authors justify value-based RL over policy-gradient methods on three grounds: discrete binary actions favor direct Q-value estimation; Q-margins $Q(s,1)-Q(s,0)$ provide a natural confidence signal reusable for ROC analysis and MIA auditing; and off-policy learning with independent per-shard replay buffers integrates cleanly with SISA isolation.

The SISA layer partitions training data into $M \in \{5, 10, 20\}$ stratified shards, trains one DDQN per shard in isolation, and aggregates predictions via majority voting with ensemble Q-margin scoring. On deletion requests, only shards containing forgotten samples are retrained (2,000 steps per affected shard versus 5,000 for initial training). Unlearning correctness is verified against an oracle model retrained from scratch on retained data only, and privacy is audited by measuring ROC-AUC of ensemble Q-margins before and after deletion, with post-deletion AUC near 0.5 indicating negligible membership leakage.

Baseline detection performance

Under five-fold stratified cross-validation, DDQN achieved an F1 score of $0.9925 \pm 0.0025$ and Q-margin AUC of 0.99833, marginally outperforming DQN ($0.9920 \pm 0.0045$) with lower variance, at modest additional cost (33.72 s vs. 30.20 s training time). Both models exhibited a false-negative rate of 0.008. In a contextual comparison with representative prior detectors—which report accuracies from 97.48% to 99.69% but offer no unlearning support—the framework matches state-of-the-art detection performance while adding deletion capability, oracle verification, and MIA auditing. The authors appropriately note this comparison is for positioning rather than direct benchmarking, given differing datasets and protocols.

Utility preservation under sequential deletion

The central empirical finding is a pronounced stability–granularity trade-off. Single-shard retraining preserves utility almost perfectly: $\Delta F1$ remains below 0.003 across all forget fractions (1–10%) and deletion rounds (1–10), with utility drops of at most 0.00812 under the most aggressive condition. Multi-shard configurations remain stable under mild deletions but degrade sharply under sustained pressure. Under 10% forget fraction over 10 rounds, $\Delta F1$ reaches −0.78207 for $M=10$ and −0.95745 for $M=20$, the latter collapsing to zero F1 entirely.

The paper attributes this collapse to shard exhaustion rather than implementation error: with ~100 samples per shard at $M=20$, cumulative deletions can reduce shards below the minimum viable threshold of 10 samples, nullifying them from the ensemble and destroying majority-vote diversity. This is an honest boundary-condition analysis, and the resulting deployment recommendation—moderate shard counts of $Q(s,1)-Q(s,0)$0–10—is well supported. Notably, the baseline F1 before unlearning varies with shard count (0.97968 at $Q(s,1)-Q(s,0)$1 down to 0.95257 at $Q(s,1)-Q(s,0)$2), so finer sharding also costs initial accuracy.

Oracle-verified forgetting and privacy auditing

Oracle disagreement rates confirm that single-shard retraining closely approximates ideal full retraining: forget-set disagreement stays below roughly 0.04 even under aggressive settings for $Q(s,1)-Q(s,0)$3 and $Q(s,1)-Q(s,0)$4, with retained-set disagreement between 0.015 and 0.045. Multi-shard retraining under extreme stress diverges substantially—forget-set disagreement rises to 0.402 ($Q(s,1)-Q(s,0)$5) and 0.525 ($Q(s,1)-Q(s,0)$6)—indicating that repeated deletions distort predictions on retained data as well. One anomaly deserves mention: single-shard $Q(s,1)-Q(s,0)$7 shows high variance at 1% deletion ($Q(s,1)-Q(s,0)$8), which the paper acknowledges but does not fully explain.

Membership-inference results are uniformly favorable: MIA AUC remains close to 0.5 across nearly all configurations, with the largest deviation being $Q(s,1)-Q(s,0)$9 (multi-shard, $M \in \{5, 10, 20\}$0, 10% × 10 rounds). This suggests limited privacy leakage after unlearning, though the strength of this conclusion depends on the audit methodology, discussed below.

Computational efficiency

Selective retraining reduces update time from 80–330 s (full retraining or full SISA construction) to approximately 5.6–6.5 s for single-shard retraining and 20–30 s for multi-shard retraining under moderate deletions. Communication overhead scales with the number of affected shards (~11 ms single-shard, ~53–55 ms multi-shard). Interestingly, unlearning time decreases under aggressive deletions (to 10–18 s) because starved shards retain fewer samples—an artifact consistent with the shard-exhaustion mechanism underlying the utility collapse.

Limitations and open questions

The paper concedes several constraints that bound its claims. The evaluation uses a moderate 2,000-sample dataset, raising questions about whether the identified operating regimes transfer to production-scale telemetry corpora. Privacy auditing relies on a lightweight Q-margin MIA proxy rather than adaptive or stronger attacks, so the near-0.5 AUC results may overstate privacy guarantees; no formal privacy certificates (e.g., differential-privacy-based unlearning verification) are provided. The environment is a deterministic contextual bandit-like process with fixed transitions, which simplifies the RL problem relative to interactive security settings, and continual adaptation on streaming data is not assessed. Finally, the oracle itself requires full retraining on retained data, meaning audit cost—not just unlearning cost—scales with dataset size. Open questions include how shard-allocation strategies should adapt dynamically as cumulative deletions accumulate, and how repeated deletions interact with Q-policy stability under adversarial deletion patterns.

Conclusion

This paper demonstrates that shard-localized machine unlearning can be integrated with value-based deep reinforcement learning for ransomware detection while preserving detection quality (F1 > 0.992), achieving auditable deletion through dual oracle and MIA verification, and reducing retraining time by roughly an order of magnitude. Its most valuable contribution may be the careful characterization of failure modes: fine-grained sharding under sustained deletion pressure causes ensemble collapse, and the paper explicitly identifies $M \in \{5, 10, 20\}$1–10 as the practical operating regime. The framework establishes a concrete template for compliance-oriented ML pipelines in cybersecurity, though its privacy conclusions await validation against stronger adversarial audits and larger datasets.