Source-linked AI summary
Federated Unlearning: How to Efficiently Erase a Client in FL?
Anisa Halimi, Swanand Kadhe, Ambrish Rawat, Nathalie Baracaldo
TL;DR
Federated unlearning must remove one client's entire local-data influence even though centralized methods do not directly fit distributed training. The paper combines target-client local unlearning with a few rounds of federated learning among the remaining clients, achieving comparable performance to retraining while substantially reducing communication costs.
Problem
Federated learning complicates machine unlearning because clients jointly train a global model while keeping their data local, creating a need to erase one client's contribution.
Method
The target client locally reverses its learning, and the server and remaining clients use that model to initialize a few federated-learning rounds.
Results
The method achieves comparable performance to retraining from scratch and reduces communication costs by 5× to 24×.
Takeaways & Limitations
The method empirically demonstrates efficacy, fidelity, and efficiency without requiring clients or the server to retain parameter-update histories.
Takeaways & Limitations
The study focuses on approximate unlearning of a single client in the cross-silo or enterprise setting.
Abstract
from arXiv · showhide
With privacy legislation empowering the users with the right to be forgotten, it has become essential to make a model amenable for forgetting some of its training data. However, existing unlearning methods in the machine learning context can not be directly applied in the context of distributed settings like federated learning due to the differences in learning protocol and the presence of multiple actors. In this paper, we tackle the problem of federated unlearning for the case of erasing a client by removing the influence of their entire local data from the trained global model. To erase a client, we propose to first perform local unlearning at the client to be erased, and then use the locally unlearned model as the initialization to run very few rounds of federated learning between the server and the remaining clients to obtain the unlearned global model. We empirically evaluate our unlearning method by employing multiple performance measures on three datasets, and demonstrate that our unlearning method achieves comparable performance as the gold standard unlearning method of federated retraining from scratch, while being significantly efficient. Unlike prior works, our unlearning method neither requires global access to the data used for training nor the history of the parameter updates to be stored by the server or any of the clients.
1. Introduction
Federated unlearning addresses removing one client's entire local-data influence from a trained global model, a task centralized methods cannot directly solve in federated learning. The proposed method combines local unlearning with brief federated post-training and avoids storing update histories.
- Privacy regulations and model memorization motivate removing specific training-data influence while preserving model performance.
- Centralized unlearning methods do not directly apply to federated learning because multiple clients jointly contribute to the global model while retaining data locally.
- The method requires neither global access to training data nor storage of client or global parameter-update histories.
- The method first has the target client locally reverse learning, then initializes a few federated-learning rounds with the remaining clients from that locally unlearned model.
- 5× to 24× communication-cost reductions are reported compared with retraining from scratch while achieving comparable performance.
2. Related Work
Prior federated-unlearning work includes client-contribution removal, but existing approaches may require storing every round's client updates, creating feasibility and privacy concerns.
- Centralized unlearning methods cannot directly transfer to federated learning because no participant has access to the entire dataset.
- Prior federated-unlearning studies considered removing a client's contribution but required the server to store client updates from every round.
- Server-side storage of model updates may be infeasible under strict privacy regulations because updates can leak information.
3. Background on Federated Learning
Federated learning trains a shared model through client-local objectives and server aggregation without sharing client data. The paper focuses on cross-silo settings with few organizations and substantial local datasets.
- Federated learning trains a shared model through an aggregator while clients contribute without sharing their data with other participants.
- The global objective is a weighted sum of local client objectives, with each client assigned an aggregation weight.
- FedAvg sends the current global model to clients, who perform multiple mini-batch SGD steps before returning local models.
- The server computes a weighted average of local models to produce the next global model, repeating this process for T rounds.
- In the cross-silo setting, clients are organizations such as banks or hospitals; participation is typically complete and client count is small.
4. Unlearning a Client
The proposed client-erasure procedure performs approximate local unlearning by reversing the target client's learning within a reference-model neighborhood, then uses brief FL post-training to recover retained-data performance.
- 4.1. Federated Unlearning Setup: The target client requests removal of its entire local-data influence after T rounds, with approximate unlearning evaluated against retraining.
- 4.2. Unlearning with Projected Gradient Descent: The procedure has two phases: local unlearning by the target client, followed by a few FL rounds among the server and retained clients.
- Local Unlearning: Local unlearning reverses training by maximizing the target client's empirical loss rather than minimizing it.
- Local Unlearning: The unlearned model is constrained near a reference model formed from the other clients' models, using an ℓ2-norm ball of radius δ.
- Local Unlearning: Projected gradient descent updates the target client's model, with early stopping when its distance from the unlearned model falls below threshold τ.
- FL post-training: The server and retained clients start post-training from the locally unlearned model to improve performance on retained-client data.
5. Evaluation
The evaluation measures unlearning efficacy, fidelity, and efficiency across backdoor and flipping scenarios. The proposed PGD-based method generally matches retraining while requiring substantially less communication and fewer training rounds.
- Unlearning efficacy: Backdoor accuracy and membership-inference attack accuracy are substantially reduced to levels similar to retraining, indicating comparable unlearning efficacy.Backdoor accuracy is evaluated on triggered data, while membership inference assesses retained information about the target client’s data.
- Unlearning fidelity: Clean accuracy remains similar to retraining in both backdoor and flipping scenarios, demonstrating high fidelity on retained clients’ data.Clean accuracy is measured on hold-out images without backdoors or flipping.
- Unlearning efficiency: In the MNIST backdoor scenario, reaching 98.13% clean accuracy requires 167 MB for the proposed method versus 453 MB for retraining, making it 2.7× more efficient.The reported communication cost is based on the total size of client model updates sent to the server.
- Training rounds: After one post-training round on MNIST, the proposed method reaches 95.3% clean accuracy and 11.38% backdoor accuracy, whereas retraining needs more than five rounds for similar performance.The locally unlearned model provides the initialization for post-training.
- Unlearning efficiency: For the flipping scenario, achieving 98.13% clean accuracy requires 566 MB with the proposed method versus 1039 MB with retraining, yielding 1.8× greater efficiency.Across this scenario, the method is reported to be up to 5.8× more efficient than retraining from scratch.
- Overall assessment: Across both scenarios, the method reduces communication costs while achieving comparable fidelity and efficacy, and its fewer rounds also reduce computation relative to retraining.The paper notes that computation costs were not explicitly measured.
6. Conclusion
The proposed method efficiently unlearns any client’s contribution without requiring stored parameter-update histories, and its evaluation covers efficacy, fidelity, and efficiency.
- The method efficiently unlearns the contribution of any client.
- It combines local unlearning at the target client with a few subsequent federated-learning rounds involving the remaining clients.
- Unlike prior federated-unlearning approaches, it does not require the server or other clients to retain parameter-update histories.
- The authors evaluate the method using backdoor triggers and flipping, measuring efficacy, fidelity, and efficiency.
A. Details on Hyperparameters
The experiments use SGD with fixed momentum, learning-rate, batch-size, and epoch settings for FL training, PGD-based unlearning, and post-training.
- FL training uses SGD with momentum β = 0.9, learning rate η = 0.01, batch size B = 128, and E = 1 epoch.FedAvg is used for aggregation.
- PGD-based unlearning uses momentum β = 0.9, learning rate ηu = 0.01, batch size Bu = 1024, and Eu = 5 epochs.The method also uses an ℓ2-norm constraint, grid-searched early stopping, and gradient clipping.
- The PGD unlearning radius δ is one third of the average Euclidean distance between wref and 10 random models.This choice keeps the model closer to the reference model than to a random model.
- FL post-training uses momentum β = 0.9, learning rate ηp = 0.01, batch size Bp = 128, and FedAvg aggregation.The number of post-training rounds Tp is specified in the cited experimental sections and figures.
Schematic overview of local unlearning
Local unlearning finds a model near the original reference model that performs poorly on deleted data, after which a few FL steps recover retained-data accuracy.
- Local unlearning is formulated as constrained optimization over a model near the original model that performs poorly on the data being removed.The neighborhood is an ℓ2-norm ball of radius δ around wref.
- Even with a slight compromise in clean accuracy, the locally unlearned model quickly recovers after a few FL post-training steps.
B. Membership Inference Attacks
The paper describes Shokri’s and Yeom’s membership-inference attacks, which infer whether a sample belonged to training data using model behavior or loss.
- Shokri’s attack: Shokri’s attack trains shadow models and attack models to infer membership from target-model posterior outputs.The attacker assumes knowledge of the target model’s type and architecture and access to same-distribution data.
- Yeom’s attack: Yeom’s attack compares a target sample’s loss with the model’s average training loss.A sample is classified as a member when its loss is smaller than the average training loss.
C. Efficiency Evaluation in Backdoors
For N = 10 clients, local unlearning bootstraps post-training, reaching comparable backdoor performance to retraining from scratch in substantially fewer FL rounds.
- After one post-training round, the proposed method reaches 96.6% clean accuracy and 12.35% backdoor accuracy on MNIST.
- The retraining-from-scratch baseline requires more than 5 FL rounds to achieve similar performance.
- Local unlearning at the target client bootstraps the process and reduces the required number of FL rounds.
D. Efficiency Evaluation in Flipping
Across N = 5 and N = 10 client settings, the proposed method reaches comparable flipping performance to full retraining while requiring substantially fewer FL rounds.
- For N = 10 on MNIST, one post-training round achieves 95.47% clean accuracy and 55.57% flipped accuracy.
- The retraining-from-scratch baseline requires more than 10 FL rounds to achieve similar performance in this setting.
- Figures 12 and 13 compare clean and flipped accuracy against FL rounds for N = 5 and N = 10 clients.
- The comparisons cover MNIST and EMNIST datasets and use full FL retraining from scratch as the gold-standard baseline.