Adversarial Machine Unlearning for Privacy-Preserving Threat Intelligence Sharing

Abstract

In the era of collaborative cybersecurity, the sharing of threat intelligence models across organizations has become critical for proactive defence. However, such sharing raises significant privacy concerns, as machine learning models trained on proprietary or sensitive security data can inadvertently leak information through model inversion or membership inference attacks. This paper introduces a novel framework for adversarial machine unlearning to enable privacy-preserving threat intelligence sharing. Our approach integrates unlearning mechanisms with adversarial training to ensure that specific data—such as organization-specific attack traces or internal system logs—can be selectively forgotten from threat detection models without requiring full retraining. We define a robust threat model to evaluate potential privacy leakage post-unlearning and introduce novel metrics for quantifying forgetting efficacy and utility retention. Experiments on benchmark cybersecurity datasets, including network traffic, malware behaviour, and intrusion detection logs, demonstrate that our method effectively mitigates data leakage risks while maintaining high detection performance. This work lays the foundation for secure and compliant knowledge transfer in federated security operations and collaborative defence ecosystems.