Unlearning to Protect: A Distilled Reinforcement Learning Framework with Privacy-Preserving Feature Unlearning and XAI for IoT Security
Source: arXiv:2607.07635 · Published 2026-07-08 · By Md. Nahid Hasan, Golam Rabiul Alam
TL;DR
This paper addresses the critical challenge of detecting botnet attacks on IoT devices, which are highly vulnerable due to their limited computational resources and lack of built-in filtering. Existing AI solutions often have heavy models unsuitable for edge deployment and cannot selectively forget sensitive or outdated features without retraining, limiting privacy compliance and adaptability. To overcome these issues, the authors propose DiRLU, a distilled reinforcement learning framework leveraging knowledge distillation and asynchronous advantage actor-critic (A2C) training to transfer knowledge from a large teacher model trained on a sizable 25% subset of the Bot-IoT dataset to a lightweight student model optimized for edge use. DiRLU also incorporates a novel post-hoc feature unlearning mechanism, zeroing weights tied to sensitive or obsolete features to enforce privacy without full retraining, with a reversible process validated by reintroducing features and observing negligible performance degradation. Furthermore, explainable AI (XAI) using LIME is integrated to provide transparency into the model’s decision-making.
The results demonstrate DiRLU’s effectiveness: the student model achieves 99.60% accuracy and 99.80% F1 score on Bot-IoT, significantly improving efficiency by requiring only 2,370 FLOPS, about 3.87 times fewer operations than state-of-the-art models. The approach balances strong detection performance, edge feasibility, GDPR-aligned privacy via selective unlearning, and interpretability. By training on a larger dataset portion than prior works and validating privacy-preserving unlearning, this research advances practical, scalable botnet detection suitable for constrained IoT environments.
Key findings
- Using 25% of the Bot-IoT dataset (~15 million records) enabled development of a strong teacher model and better class coverage compared to prior works using only 5%.
- Student model achieved 99.60% accuracy and 99.80% F1 score, nearly matching teacher performance but with significantly fewer parameters.
- DiRLU requires only 2,370 FLOPS for inference, making it approximately 3.87× more efficient than state-of-the-art models on comparable tasks.
- Post-hoc feature unlearning zeroed weights of sensitive/outdated features without retraining, and reintroducing those features caused negligible performance loss, demonstrating reversibility.
- SMOTE oversampling balanced the highly imbalanced dataset (original ratio ~98:2 attack:benign) to ~67:33 before training.
- XAI via LIME provided interpretability by highlighting features influencing predictions, increasing trustworthiness for cybersecurity analysts.
- Knowledge distillation from A2C-trained teacher to student model reduced model size and complexity, making edge deployment feasible without sacrificing accuracy.
- Random data splits with 70:10:20 train:validation:test ratio ensured robust model evaluation on large-scale, real-world botnet data.
Threat model
The adversary is a remote bot herder controlling compromised IoT devices to launch attacks such as DDoS, information theft, reconnaissance scans, keylogging, and data exfiltration. The adversary can generate malicious network traffic patterns attempting to evade detection but cannot modify the internal model weights or directly access training data after deployment. The defender aims to detect these attacks early with a lightweight model that can selectively remove sensitive or outdated feature dependencies to preserve privacy and adapt without full retraining.
Methodology — deep read
The authors' threat model assumes adversaries controlling botnets launching diverse network attacks (DoS, DDoS, reconnaissance, information theft, keylogging, etc.) against IoT devices that lack inherent traffic filtering. The adversary can generate malicious traffic patterns but cannot access or modify model internals. The goal is to detect botnet traffic early with privacy compliance via selective forgetting of sensitive or outdated features.
Data used consists of 25% of the publicly available Bot-IoT dataset from UNSW Canberra, containing over 15 million records with 31 populated features after pruning. This subset includes both benign and multiple attack traffic types, with a heavy class imbalance (~98% attacks). To mitigate imbalance, SMOTE oversampling was applied, balancing classes roughly 67% attack and 33% benign. Data was randomly split into train (70%), validation (10%), and test (20%) partitions.
Data preprocessing involved dropping non-useful categorical features, label encoding the attack class, and min-max normalization of numerical features. Missing values were removed by dropping features without data, leading to 27 viable features.
The core modeling employed reinforcement learning via the Asynchronous Advantage Actor-Critic (A2C) algorithm to train a large teacher network capturing complex attack patterns. Knowledge distillation was used to transfer the teacher's softened output distributions to a smaller student model optimized with fewer hyperparameters, maintaining high accuracy while substantially reducing size and computational cost.
A novel post-hoc feature unlearning method selectively zeroed the weight matrix rows in the student model corresponding to sensitive or outdated input features, effectively removing their influence without retraining the entire model. The process was reversible by restoring those weights, with experiments confirming negligible impact on overall performance.
Performance was evaluated primarily on accuracy and F1 score on the held-out test set. The authors benchmarked against prior state-of-the-art results using 5% of the dataset and demonstrated improvements via extensive training on a larger dataset portion and the compact distilled student model. XAI via LIME offered interpretability by identifying key predictive features.
Training involved large-scale data with millions of samples, but exact hyperparameters like epochs, batch sizes, hardware details, and random seeds were not comprehensively detailed in the text. The reproducibility of the work was not explicitly addressed, and no code or pretrained models were mentioned as publicly released.
For example, a batch of normalized IoT network traffic flows, balanced with SMOTE and passed through the distilled student model, would yield class predictions for botnet or benign traffic, with feature contributions interpretable via LIME. When unlearning is applied, weight rows linked to targeted features are zeroed post-training, immediately removing their effect while preserving the rest of the model intact.
This stepwise methodology balances detection accuracy, lightweight edge deployment, interpretability, and privacy through unlearning—key factors for practical IoT botnet defense.
Technical innovations
- Integration of knowledge distillation with A2C reinforcement learning to create a lightweight, high-performance student model suitable for edge IoT security.
- A post-hoc feature unlearning mechanism that modifies weights corresponding to sensitive or outdated input features without requiring complete retraining, enabling privacy-preserving model adaptation.
- Validation of unlearning reversibility by reintroducing removed features and showing negligible degradation in performance.
- Use of LIME-based explainability integrated into the RL-based botnet detection pipeline to offer transparent feature importance for security analysts.
Datasets
- Bot-IoT — 15,000,000 records (25% subset) — Public from UNSW Canberra Cyber Range Lab
Baselines vs proposed
- LightGBM ensemble classifier [4]: AUC=0.987, AUPRC=0.994 (~98.34% accuracy) vs DiRLU Student: 99.60% accuracy
- SVM full features [5]: 99.99% accuracy vs DiRLU Student: 99.60% accuracy (using larger, more balanced dataset)
- Decision Tree ensemble bag [6]: 100% accuracy vs DiRLU Student: 99.60% accuracy
- A3C deep RL [17]: 98.68% accuracy vs DiRLU Student: 99.60%
- Prior models at 5% Bot-IoT subset vs DiRLU at 25% Bot-IoT subset showing improved generalization and robustness
- DiRLU FLOPS: 2,370 compared to state-of-the-art models needing ~9,170 FLOPS (3.87× efficiency gain)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.07635.
Fig 1: A high-level overview of the proposed research
Fig 2: A detailed architecture of the DiRLU framework, where the teacher transfers knowledge to the student via knowledge
Fig 3: Schematic overview of the proposed DiRLU framework based on knowledge distillation and post-hoc weight modification
Fig 4: Comparison of before and after applying SMOTE
Fig 5: Actor-Critic model architecture
Fig 6: Architecture of knowledge distillation (KD) framework
Fig 7: Architecture of feature unlearning process
Fig 8: Training accuracy and loss at each epoch of Teacher
Limitations
- Exact hyperparameters, training epochs, hardware details, and random seed strategies are not fully specified, potentially hindering exact reproducibility.
- No adversarial robustness evaluation against adaptive or evasion botnet attacks was reported, limiting security guarantees.
- Unlearning was evaluated only on selective features post-hoc with limited analysis on the impact across multiple layers or jointly correlated features.
- No public release of code or pretrained model weights was mentioned, reducing immediate replicability.
- Evaluation confined to a single dataset (Bot-IoT) subset without testing cross-dataset generalization or distributional shifts in IoT traffic.
- Explainability integration via LIME, while valuable, is inherently approximate and may not capture all model decision nuances.
Open questions / follow-ons
- How does the feature unlearning mechanism perform under adversarial attempts to bypass or poison the model?
- Can the unlearning technique be extended to multiple correlated features or layers beyond input weight zeroing?
- What are the trade-offs between unlearning granularity, speed, and model accuracy in dynamic IoT environments?
- How well does DiRLU generalize to other IoT datasets or networks with different attack distributions and feature sets?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners focused on IoT security, this research highlights a novel approach combining reinforcement learning with knowledge distillation to create compact models feasible for edge deployment. The ability to perform privacy-preserving feature unlearning aligns closely with regulatory requirements such as GDPR's 'right to be forgotten,' an increasingly critical capability for security systems handling sensitive data. Integrating explainability via LIME also aids human analysts in understanding detection rationales, building trust in automated defenses.
Practitioners can consider adopting similar distilled RL-based frameworks along with feature unlearning for scalable botnet traffic filtering on resource-constrained devices. However, the study’s limitations, including lack of adversarial robustness evaluation and full reproducibility details, suggest caution in direct deployment without further validation. Its approach informs how future bot-defense models might balance accuracy, efficiency, privacy, and interpretability in increasingly decentralized IoT threat environments.
Cite
@article{arxiv2607_07635,
title={ Unlearning to Protect: A Distilled Reinforcement Learning Framework with Privacy-Preserving Feature Unlearning and XAI for IoT Security },
author={ Md. Nahid Hasan and Golam Rabiul Alam },
journal={arXiv preprint arXiv:2607.07635},
year={ 2026 },
url={https://arxiv.org/abs/2607.07635}
}