Source-linked AI summary
Federated Unlearning with Knowledge Distillation
Chen Wu, Sencun Zhu, Prasenjit Mitra
TL;DR
Federated learning models can retain client information, creating a need to remove a client’s contribution under privacy requirements and security concerns. The paper subtracts accumulated historical updates and applies server-side knowledge distillation without client data, recovering test performance within five epochs while maintaining a 0% backdoor attack success rate in the reported evaluation. The method is evaluated on three datasets and does not rely on client participation.
Problem
Federated models may retain or leak client information, while existing unlearning approaches can be costly, centralized, unsuitable for deep networks, or dependent on client participation and data.
Method
The method subtracts a target client’s historical parameter updates and uses the old global model as a teacher for server-side knowledge distillation without client data.
Results
The model’s test accuracy was quickly recovered within five distillation epochs while backdoor attack success remained 0%.
Takeaways & Limitations
Experiments on three canonical datasets demonstrate the effectiveness of a federated unlearning method that does not rely on client participation or client datasets.
Takeaways & Limitations
Historical-update subtraction can create increasing skew when the target client’s contribution is small, requiring correction after later training rounds.
Abstract
from arXiv · showhide
Federated Learning (FL) is designed to protect the data privacy of each client during the training process by transmitting only models instead of the original data. However, the trained model may memorize certain information about the training data. With the recent legislation on right to be forgotten, it is crucially essential for the FL model to possess the ability to forget what it has learned from each client. We propose a novel federated unlearning method to eliminate a client's contribution by subtracting the accumulated historical updates from the model and leveraging the knowledge distillation method to restore the model's performance without using any data from the clients. This method does not have any restrictions on the type of neural networks and does not rely on clients' participation, so it is practical and efficient in the FL system. We further introduce backdoor attacks in the training process to help evaluate the unlearning effect. Experiments on three canonical datasets demonstrate the effectiveness and efficiency of our method.
1 Introduction
Federated unlearning addresses the need to remove a client's influence from a trained global model when privacy, security, or data-quality concerns require deletion. The proposed approach subtracts historical client updates and uses server-side knowledge distillation to recover performance without client participation or data.
- Motivation: Privacy regulations and model memorization create a need to remove clients’ contributions from trained federated models.Global-model predictions may retain or leak client information even when original data was never shared.
- Motivation: Removing malicious or low-quality clients can improve the security and reliability of federated learning.Prior work shows that malicious clients can compromise FL through data-poisoning attacks.
- Limitations of Existing Methods: Retraining from scratch is costly, while existing unlearning methods often assume centralized data access or do not support complex deep neural networks.The prior FL unlearning method provides limited improvement over retraining from scratch.
- Problem and Evaluation: The paper defines federated unlearning as thoroughly and efficiently removing a designated client’s contribution after federated training.Backdoor attacks are introduced to evaluate whether the client’s influence has been removed.
- Method: The proposed method subtracts the attacker’s historical parameter updates and uses the old global model as a teacher for knowledge distillation.Distillation runs entirely on the server without labeled client data or client-side communication.
2 Related Work
Prior machine-unlearning methods either target centralized settings, require specific model structures, or rely on client participation and historical data in federated learning. These limitations motivate a federated method that can operate without those requirements.
- Machine Unlearning: Early machine-unlearning methods update summations instead of retraining, but apply only to traditional models expressible in summation form.Their efficiency comes from modifying a small portion of the accumulated computations.
- Machine Unlearning: Other unlearning frameworks address specialized tasks such as lifelong anomaly detection rather than general federated deep learning.The cited framework corrects false-negative or false-positive labels in anomaly detection.
- Federated Unlearning: The prior federated unlearning method adjusts clients’ historical updates through federated retraining and reconstructs the model.It relies on client participation, historical datasets, and additional communication rounds.
3 Problem Definition
Federated unlearning removes a target client’s contribution so the resulting model approximates training without that client. The problem is difficult because federated updates are incremental, stochastic, and computed without server access to client data.
- Federated Learning Setup: Federated learning keeps training data on clients, which send model updates to a server for aggregation into a global model.The server combines client updates using averaged aggregation such as FedAvg.
- Unlearning Objective: The unlearning objective is to remove all updates from a target client and produce a final model as if that client had never participated.The target contribution includes updates made across the federated training rounds.
- Challenges: Because each update depends on previous updates, removing one client’s update can invalidate subsequent client updates and may require retraining from scratch.The resulting changes propagate through later rounds of the incremental training process.
- Challenges: Random client selection and stochastic local training make federated retraining nondeterministic, so repeated training can converge to different models.This makes test-accuracy comparison with a retrained model less convincing as an unlearning evaluation.
- Evaluation: The proposed evaluation uses backdoor attacks: a successful unlearned model should retain ordinary performance while reducing backdoor success on triggered inputs.The paper presents this behavior as a way to measure whether the target influence remains.
- Algorithm: Algorithm 1 takes the final global model, target-client historical updates, and an outsourced unlabeled dataset, then returns a distilled unlearning model.The teacher and student outputs on the unlabeled data define the distillation loss used during server-side training.
4 Unlearning Method
The method removes a target client's historical updates, then uses server-side knowledge distillation to correct the resulting model skew without relying on client participation or training data.
- Historical update removal and recovery: The method first erases all historical parameter updates from the target client and then repairs the resulting model damage through knowledge distillation.The server keeps per-client update history and uses the original global model as the teacher for recovery.
- Historical update removal and recovery: The final global model is represented as the initial model plus aggregated updates across training rounds, so unlearning targets the client's contribution at each round.The method assumes N participating clients per round and removes the target client's update from each global update.
- Historical update removal and recovery: Directly subtracting the target updates creates skew because later updates depend on earlier global models, and the correction term can grow over subsequent rounds.When the target client's contribution is small, the remaining update is still rescaled, increasing the resulting skew.
- Knowledge distillation: The method uses knowledge distillation because the skew cannot be calculated without retraining on original data, which may no longer be available from clients.The original global model supplies soft class probabilities, while the skewed unlearning model is trained on unlabeled server-side data.
- Knowledge distillation: A higher temperature produces softer class-probability distributions, and the server can combine soft labels with hard labels when labeled data is available.Traditional training uses temperature T = 1; higher T makes class probabilities more uniform.
5 Experiments
Experiments across MNIST, CIFAR-10, and GTSRB evaluate server-side federated unlearning using historical-update subtraction, knowledge distillation, and continued training without the target client. The method removes the backdoor influence, rapidly restores model performance, and approaches retraining accuracy.
- Experimental Setup: Experiments use MNIST, CIFAR-10, and GTSRB with different model architectures and client configurations.MNIST and CIFAR-10 use 10 clients; GTSRB uses 5 clients, and distillation uses unlabeled sampled data excluding client data.
- Experimental Setup: Backdoor attacks target digit “1”→“9” in MNIST, “truck”→“car” in CIFAR-10, and “Stop Sign”→“Speed limit Sign (120 km/h)” in GTSRB.The attacks modify pixels in benign inputs to create backdoor patterns for evaluating unlearning.
- Unlearning Before Distillation: After subtracting the target client’s historical updates, attack success rate remains 0%, but test accuracy stays below 60% and slightly decreases with more FL rounds.Subtraction thoroughly removes the target client’s influence while creating a substantial model skew.
- Knowledge Distillation: Knowledge distillation quickly recovers test accuracy within five epochs while keeping backdoor attack success rate at 0%.The loss approaches that of the original global model because distillation does not use target-client data to activate the backdoor.
- Integrated Results: Across integrated results, distilled unlearning accuracy is almost identical to retraining from scratch, with differences less than 1%.Post-training can further improve accuracy, while the target client’s attributes are not transferred through distillation.
6 Conclusion and Future Work
The paper presents federated unlearning that removes a client’s historical contribution through server-side update subtraction and repairs the resulting model skew through knowledge distillation. Experiments on three canonical datasets support its effectiveness and server-side efficiency without client participation or client datasets.
- Conclusion: The method subtracts a client’s historical parameter updates and uses knowledge distillation to remedy the resulting model skew.The procedure is conducted on the server’s side and does not rely on client participation or client datasets.
- Conclusion: Backdoor attacks provide an evaluation mechanism for measuring whether the target client’s influence has been removed in federated learning.The paper introduces these attacks to help evaluate the unlearning effect.
- Conclusion: Experiments on three canonical datasets demonstrate the effectiveness of the proposed federated unlearning method.The paper frames the method as a starting point for further study, including training-time distillation and distillation without any dataset.
- Conclusion: Server-side execution provides running-time and energy-cost efficiency compared with methods requiring additional client-server communication.The stated efficiency advantage follows from conducting the method purely on the server’s side.