Unlearning to Protect: A Distilled Reinforcement Learning Framework with Privacy-Preserving Feature Unlearning and XAI for IoT Security

2026-07-08

AI Summary

This work addresses the vulnerability of IoT devices to botnet attacks and the limitations of existing AI-based detection models, which incur high computational overhead and lack mechanisms to efficiently unlearn sensitive or obsolete features without full retraining. To overcome these challenges, the authors propose DiRLU, a lightweight reinforcement learning framework that uniquely integrates reversible feature unlearning, Advantage Actor-Critic (A2C) reinforcement learning, knowledge distillation, and LIME-based explainability. DiRLU enables efficient edge-based botnet detection while complying with GDPR’s “right to be forgotten.” Experimental results on the BoT-IoT dataset demonstrate that DiRLU achieves 99.60% accuracy and 99.80% F1-score with only 2,370 FLOPS, offering approximately 3.87× higher efficiency than the current state-of-the-art methods.

Abstract

Botnets pose a significant cybersecurity threat, enabling attacks such as DDoS, data theft, and service disruptions on IoT devices. These devices often lack built-in botnet traffic filtering, leaving them highly exposed. Existing AI-based solutions improve detection capabilities but have limitations: (i) they are too heavy for IoT deployment, and (ii) they lack unlearning capabilities to forget sensitive or outdated features without retraining. To address these challenges, we propose DiRLU, a lightweight, reinforcement learning driven framework, while ensuring privacy by selectively unlearning sensitive or outdated features without requiring retraining. The framework leverages knowledge distillation to transfer knowledge from a teacher model into a lightweight student model, with both models trained using A2C. A post-hoc unlearning mechanism modifies weights to remove targeted features, while restored features show negligible performance loss, confirming reversibility. Unlike many benchmark models that used only 5% of the BoT-IoT dataset, this research leverages 25%, allowing us to develop a strong teacher model. Both the teacher and student models were trained using the A2C reinforcement learning algorithm, achieving impressive results, with the student model achieving 99.60% accuracy and a 99.80% F1 score. To enhance transparency, we integrated Explainable AI (XAI), particularly LIME, which helps interpret the model's decisions and identify the key features influencing its predictions. Moreover, DiRLU requires only 2,370 FLOPS, approximately 3.87x more efficient than the state-of-the-art model, highlighting its efficiency for edge deployment. DiRLU combines efficiency with privacy, aligning with GDPR standards (right to be forgotten) to provide practical and scalable IoT security solution.

Problem

• IoT security
• botnet detection
• model unlearning
• privacy-preserving
• lightweight AI

Innovation

• Feature Unlearning
• Knowledge Distillation
• Reinforcement Learning
• Explainable AI (XAI)
• IoT Security