PaperlayerView exact revision on arXiv

Source-linked AI summary

Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning

Yijun Quan, Giovanni Montana

arXiv:2609.04475v1cs.CRcs.LG

TL;DR

Federated unlearning seeks to remove client data without centralizing raw data or retraining from scratch, but repeated full-classifier releases can expose the summaries used for exact deletion. The paper characterizes active probing and tests unrestricted and attacker-data probes, finding exact high-precision label recovery in the tested settings alongside limits from precision, defenses, and protocol assumptions.

  • Problem

    Efficient federated unlearning can use additive training summaries and broadcast updated classifiers, raising the question of what an active client can learn from those releases.

    Source: §1 · p. 1

  • Method

    The paper identifies server states from responses to known probes, compares states around an isolated deletion, and derives a second estimator using additions from attacker data.

    Source: §1 · p. 2, Attacker-Data Additions · p. 6, §5 · pp. 11–12

  • Results

    Every tested high-precision designed attack succeeds, and with 104 attacker-data responses per state every tested high-precision sample label is recovered; lower precision sharply reduces sample recovery but leaves larger class aggregates more accurate.

    Source: §5 · p. 12

  • Takeaways & Limitations

    Recovering a sample’s feature and label is a confidentiality failure, while replaying a class or client aggregate can reverse the requested deletion.

    Source: §5 · p. 12

    The attack requires complete classifier releases, a quiet interval, fixed regularization, one isolated deletion of known size, and full feature rank; the evaluated additions also assume duplicate submissions are accepted.

    Source: §5 · p. 12

Abstract

from arXiv · show

Federated unlearning aims to remove a client's data from a shared model without retraining from scratch. Some efficient systems make deletion exact by storing compact, additive summaries of the training features and broadcasting an updated linear classifier after every accepted change. We show that these broadcasts can also reveal the hidden summaries. A malicious client can submit known changes, use the returned classifiers to identify the server state, and compare states immediately before and after an isolated deletion. This exposes the deleted sample, class, or client summary and can enable its reinsertion. We characterize exactly when the observations contain enough independent information, give a matching optimal construction for unrestricted probes, and derive a more realistic estimator based on additions formed from the attacker's own data. On MNIST and CIFAR-10, high-precision broadcasts permit exact label recovery for every tested sample deletion with both probe types. Lower-precision broadcasts sharply reduce fine-grained recovery, and insufficiently diverse responses prevent identification altogether. Unrestricted probes are readily detected by their size; most individual attacker-data additions resemble honest batches, although we do not claim that the complete sequence is inconspicuous. The results identify a concrete privacy and integrity risk, its algebraic cause, and practical limits involving broadcast precision, update verification, response rate, and concurrent activity.

1 Introduction

Federated unlearning seeks to remove a client’s contribution while keeping data distributed and avoiding retraining from scratch. This paper shows how repeated classifier releases can let an active client identify hidden server summaries, recover an isolated deletion, and potentially replay it.

1 Introduction

  • Federated unlearning must balance data locality and efficient deletion with fidelity to retraining on retained data.A removal request may concern a sample, a class, or a client’s entire contribution.Source: §1 · p. 1
  • Efficient exact unlearning can rely on additive feature and feature–label summaries that clients can add or subtract to update a lightweight linear classifier.The classifier can be recomputed from these sufficient statistics without starting over.Source: §1 · p. 1
  • Prior deletion attacks use model changes caused by deletion, while this participating-client attack first identifies server states and then recovers the deleted aggregate.The paper contrasts its constructive attack with prior model-inversion approaches.Source: §1 · pp. 1–2
  • Repeated classifier releases let a client submit known changes, identify the server’s training summary, and recover the aggregate removed by an isolated deletion.The unchanged regularization term cancels when comparing the identified states before and after deletion.Source: §1 · p. 2
  • The paper proves an exact state-identification condition, gives a matching unrestricted probe construction, and derives an estimator using additions formed from attacker data.It also studies recovery and replay of sample-, class-, and client-level deletions.Source: §1 · p. 2

2 Background

The studied protocol exchanges compact matrix summaries and recomputes a ridge classifier from the server’s aggregated state. A returned classifier alone does not uniquely reveal that state.

2 Background

  • Clients exchange two matrix summaries, and the server maintains a retained-statistics ledger for the global add and delete statistics.The supplied protocol description identifies feature-product and feature–label summaries, though the equations are not fully present here.Source: §2 · pp. 2–3
  • The server recovers the ridge-head parameters in closed form from its aggregated statistics, with the regularization coefficient included in the feature-product matrix.A logical probe is a chosen net perturbation followed by one full-head broadcast.Source: §2 · p. 3
  • A returned head alone cannot identify the server’s statistics because multiple ridge states can produce the same classifier.The attack addresses this ambiguity by collecting responses to known summary changes.Source: §2 · p. 3

3 Threat Model

The threat model assumes an active client can submit chosen changes and observe full classifier broadcasts, with an isolated deletion bracketed by probing sequences. The methods characterize exact identification, adapt estimation to attacker-data additions, and use identified pre- and post-deletion states to recover and replay the removed contribution.

3 Threat Model

  • The attack assumes the client knows its own messages and frozen encoder, while other clients’ data and statistics remain hidden.It also requires full-head releases after chosen probes.Source: §3 · p. 3
  • The protocol guarantees retraining-equivalent deletion only for records in the requesting client’s retained data, and the attack tests a server that does not verify ownership or duplicates.The attack also needs a quiet interval and exactly one deletion of known size between probe sequences.Source: §3 · p. 3

Exact Identification from Moment Differences

  • Moment-only probes can realize any desired Q by combining add/delete summaries that leave the Gram matrix unchanged.The algebraic construction may use feature vectors the shared encoder cannot produce, and its deletion may fail ownership checks.Source: Exact Identification from Moment… · p. 4
  • A state is exactly identifiable when the response differences span the full feature space; otherwise distinct feasible ridge states can produce the same observations.The necessity argument is over the algebraic state class and does not require the alternative state to come from a particular labelled dataset.Source: Exact Identification from Moment… · p. 4
  • The minimum unrestricted query count is ⌈d/c⌉ logical full-head responses per unknown state, achieved by a full-row-rank probe construction.The construction assumes arbitrary algebraic moment probes are accepted and does not use additional dataset-realizability structure.Source: Exact Identification from Moment… · p. 5

Attacker-Data Additions

  • Attacker-data additions identify the state when the stacked classifier changes have full rank, but require at least d distinct examples with full feature rank.Those conditions are not sufficient because prediction residuals and batching also affect the known right-hand sides.Source: Attacker-Data Additions · p. 6

Recovering and Replaying an Isolated Deletion

  • Comparing identified states around one deletion recovers its contribution, which can be added back to restore the sufficient statistics and head exactly in exact arithmetic.The recovery relies on the same fixed regularization coefficient in both states.Source: Recovering and Replaying an Isolated… · p. 6
  • If several honest events occur between identified states, the equations recover only their signed aggregate net change and cannot attribute it to a particular event or client.A change in regularization between states also shifts the Gram difference by (γ_pre − γ_post)I.Source: Recovering and Replaying an Isolated… · p. 6

4 Probing Attack Evaluation

The evaluation tests recovery and replay of deleted sample, class, and client contributions using designed probes and additions formed from attacker data. Results show how identification rank, broadcast precision, deletion size, and message detectability constrain the attacks.

4 Probing Attack Evaluation

  • Across five random probe sequences per dataset, m=51 always produced rank 510 and failed; at m=52, every stack reached rank 512 and succeeded, as did the designed 52-response probe.The designed probe’s float64 state error was 1.51 × 10−12 on MNIST and 6.55 × 10−13 on CIFAR-10.Source: §4 · p. 7, Table 1 · p. 8
  • Designed probes were conspicuous: at τ=104, their message norm was 2.98 × 10^5 times the honest-update 99th percentile; most tested attacker-data additions stayed below calibrated thresholds.None of 520 MNIST additions and 13 of 520 CIFAR-10 additions exceeded the thresholds; the detectability test excluded cancellations and replay, so it does not establish that the complete sequence is inconspicuous.Source: §4 · pp. 7, 9, 10
  • All 2,220 float64 designed-probe attacks identified both states; sample labels were always recovered, with aggregate errors from 10^-12 to 10^-7 depending on deletion size.The attacks used 52 responses per state, excluding the baseline.Source: §4 · p. 7, Table 2 · p. 8
  • At 104 attacker-data additions, every tested stack passed rank tolerance 10^-10; with 52 additions, only 14/50 MNIST and 16/50 CIFAR-10 attacks succeeded.Full feature rank is necessary but not sufficient; every stack remained full rank from tolerance 10^-7 through 10^-10, while some MNIST directions were marginal at 10^-6.Source: §4 · p. 9, Table 3 · p. 10
  • With float32 responses, attacker-data sample-label recovery was 9.8% on MNIST and 36.6% on CIFAR-10, while rounding the final classifier changed none of 10,000 test predictions.The reported honest-classifier accuracies remained 97.15% and 85.94%, respectively.Source: §4 · p. 10

Sample-level probing

  • Among correctly labeled float64 samples, mean relative feature error was 4.32 × 10^-7 on MNIST and 2.75 × 10^-8 on CIFAR-10.Selected attacker-trained decoders illustrate possible content interpretation from recovered features.Source: Sample-level probing · p. 11

Class-level probing

  • Replayed class blocks restored final accuracy to 97.15% on MNIST and 85.94% on CIFAR-10, versus 9.82% and 8.94% on the honest branches.The attacked branches’ final relative head errors from the original head were 2.42 × 10^-12 and 6.65 × 10^-13, respectively.Source: Class-level probing · p. 11

Client-level probing

  • Across 1,000 deleted-client blocks, replayed contributions yielded mean final relative head errors of (6.29 ± 0.65) × 10^-12 on MNIST and (1.42 ± 0.11) × 10^-12 on CIFAR-10.Client aggregates reveal classwise feature sums and one overall second moment, but generally do not identify individual examples.Source: Client-level probing · p. 11

5 Discussion and Conclusions

Repeated classifier releases can reveal the compact summaries behind exact ridge-based unlearning, allowing recovery and replay of an isolated deletion. The experiments show that attack success depends on precision and probe type, while the attack has operational and scope limits.

5 Discussion and Conclusions

  • Every tested high-precision designed attack succeeds, and 104 attacker-data responses per state recover every tested high-precision sample label.The authors also report that some attacker-data response stacks remain rank deficient despite meeting the theoretical minimum response count.Source: §5 · p. 12
  • Float32 sharply reduces sample recovery while leaving larger class aggregates more accurate, so it is not a uniform safeguard.The security consequence also varies with deletion size: recovering one sample's feature and label violates confidentiality, while replay can reverse a class or client deletion.Source: §5 · p. 12
  • A norm threshold detects unrestricted probes but misses most individual attacker-data additions, which recover every label from float64 responses.With float32 responses, the norm threshold still permits recovery of 92 of 100 MNIST labels and all 100 CIFAR-10 labels.Source: §5 · p. 12
  • The attack requires complete classifier broadcasts, a quiet interval, fixed regularization, and one isolated deletion of known size; duplicate checking would block the evaluated additions.The authors do not claim that the complete attack sequence is stealthy.Source: §5 · p. 12
  • Suggested defenses include ownership verification, duplicate rejection, replay authentication, less frequent or partial classifier releases, batching, and noise.The authors call for future tests with held-out data under concurrency.Source: §5 · p. 12

Supplementary Material: Recovering and Replaying Deleted

This supplement develops exact identification and deletion-recovery methods for ridge states using known summary perturbations and returned classifier heads. It characterizes rank and response requirements, probe constructions, and limits imposed by finite precision and attacker-data features.

Notation and Observation Model

  • At a stable probing interval, the server state is represented by a baseline head and known total moment perturbations associated with each returned head.The notation distinguishes independently restored probes from cumulative probes.Source: Notation and Observation Model · p. 14

Exact Recovery Theorem

  • Exact state identification holds if and only if the collected response stack has full feature rank; at that rank, the state is uniquely recovered.The identified quantity is A=S+γI; when γ is unknown, A and S cannot be separated, but a fixed γ cancels in pre/post deletion differences.Source: Exact Recovery Theorem · p. 14

Exact Logical-Response Complexity

  • The exact noiseless query complexity is ⌈d/c⌉ logical full-head responses per unknown state in the unrestricted algebraic model.For d=512 and c=10, this is 52 responses per state, excluding its baseline; an initial two-state attack totals 109 server responses, while a later event with a cached pre-state totals 55.Source: Exact Logical-Response Complexity · p. 15

B Finite-Precision Recovery

  • Finite-precision recovery estimates are affected by errors in both probe responses and the shared baseline, while probe scale controls signal-to-roundoff and cancellation drift.The estimator symmetrizes the direct A estimate; any positive-definite projection is reported separately.Source: B Finite-Precision Recovery · pp. 15–16

C Algebraically Admissible Moment Probes

  • Algebraic probe constructions can realize arbitrary moment perturbations with zero net Gram change, but do not establish encoder realizability or deletion ownership.Same-feature, different-label probes can reuse genuine attacker features; each block has rank at most c−1, giving a 57-response lower bound for d=512 and c=10, with full rank still depending on attacker feature span.Source: C Algebraically Admissible Moment Probes · p. 16

D Known Gram and Moment Probes

  • For probes with known Gram and moment changes, state identification holds if and only if the stacked response differences have full feature rank.For cumulative attacker-owned additions, at least d examples and full attacker feature rank are necessary but not sufficient; residuals and batching also affect identifiability.Source: D Known Gram and Moment Probes · p. 17

E Deleted-Update Recovery and Replay

Once the states immediately before and after an isolated deletion are identified, their difference recovers the deleted summary and permits replay. Passive observation of the two heads alone does not identify a general aggregate deletion over the algebraic state class.

E Deleted-Update Recovery and Replay

  • Identified pre- and post-deletion states recover the deleted Gram and moment blocks, whose addition back to the post-deletion ledger restores the pre-deletion head.The fixed regularizer cancels in the difference; if multiple events intervene, only their signed aggregate net change is recovered, and changing regularization contaminates the Gram difference.Source: E Deleted-Update Recovery and Replay · pp. 17–18
  • For comparable state-estimation errors, smaller deletion blocks are harder to recover, and sample-label recovery is guaranteed when the deleted-moment error is below half the feature norm.This error-size ordering does not establish deletion size as the only source of error.Source: E Deleted-Update Recovery and Replay · p. 18

F Passive Heads Do Not Identify an Aggregate Deletion

  • Passive pre/post heads do not identify a general aggregate deletion because different feasible states can yield the same heads but different deleted Gram blocks.Additional single-sample structure can make passive reconstruction possible.Source: F Passive Heads Do Not Identify an… · p. 18

G Sample-Level Leakage

A recovered sample-level moment identifies its one-hot label and feature, while rank-one Gram information alone leaves a global sign ambiguity. The supplement also cautions that restoring a head is not proof of ledger equality and documents the cumulative-probe estimator's diagnostics.

G Sample-Level Leakage

  • The unique nonzero column of a recovered sample moment identifies its label and equals its feature; rank-one Gram information alone identifies the feature only up to sign.A sample label is guaranteed when the moment-error norm is below half the feature norm.Source: G Sample-Level Leakage · p. 19

H Why Head Restoration Is Not a State Certificate

I Cumulative-Probe State-Recovery Algorithm

  • The cumulative-probe algorithm recovers A and H independently, then reports symmetry, definiteness, residual, and agreement diagnostics rather than hiding failures.Identification requires numerical full rank and positive-definite direct estimates; replay is evaluated with the raw deleted block, with PSD-projected replay used as a diagnostic.Source: I Cumulative-Probe State-Recovery… · pp. 19–20

J Experimental Protocol and Additional Results

The appendix specifies the attack’s evaluation protocol and examines how returned-head precision affects designed-probe recovery. Float32 responses still permit label recovery, but differencing estimated states amplifies errors for smaller deletions.

J Experimental Protocol and Additional Results

  • Experiments use a 512-dimensional ResNet-18 ridge head, 50-client Dirichlet partitions, and 100 sample targets, all ten classes, or 50-client deletions.Sample and client experiments also include data-derived targets; the data-derived and DINOv2 checks use seeds 0–4.Source: J Experimental Protocol and Additional… · p. 21
  • Attacker-data additions use full-rank clients and 104 non-overlapping batches, but reuse examples already in the training ledger as duplicate submissions.A first complete attack sends 212 client messages and receives 213 server responses, including the initial baseline.Source: J Experimental Protocol and Additional… · p. 21
  • The evaluation cancels probes before and after one designated deletion, then replays the recovered block; recovery errors average successful identifications while failures remain in success denominators.Returned heads and known probe summaries drive recovery; the simulator’s hidden ledger is used only for the deletion and scoring.Source: J Experimental Protocol and Additional… · p. 21

Designed-Probe Precision

  • Float32 heads preserve all CIFAR-10 labels and 92 of 100 MNIST labels, while aggregate errors increase for finer deletions.Table 4 reports recovery with 52 designed-probe responses per state; errors are means and standard deviations over successful attacks.Source: Designed-Probe Precision · p. 21, Table 4 · p. 22
  • The response stack, not just the designed input stack, controls finite-precision recovery: its condition numbers are 1.064 × 10^6 on MNIST and 4.148 × 10^4 on CIFAR-10.The designed perturbation stack has condition number one at τ=104; corresponding float64 direct state errors are 1.506 × 10^-12 and 6.549 × 10^-13.Source: Designed-Probe Precision · p. 22

Attacker-Data Additions

Attacker-data additions can identify states when their response stacks have sufficient rank, but rank success alone does not ensure accurate recovery. Numerical diagnostics also expose replay constraints from non-positive-semidefinite estimates.

Attacker-Data Additions

  • At 104 additions and tolerance 10^-10, all sample, class, and client stacks reach rank 512, but float32 success does not guarantee accurate identification.At 52 additions, most post-class-deletion stacks have rank 468; the range is 468–512. Median condition numbers at 104 additions are 4.06 × 10^5 on MNIST and 1.43 × 10^5 on CIFAR-10.Source: Attacker-Data Additions · p. 22
  • Full attacker feature rank is necessary but not sufficient for the data-derived estimator.Even with full rank, numerical success does not imply accurate state recovery.Source: Attacker-Data Additions · pp. 22–23
  • At 10^-7 through 10^-10, all float32 stacks remain full rank; at 10^-6, all CIFAR-10 stacks but only six of ten MNIST stacks do.Table 6 evaluates one pre-deletion and one post-class-deletion stack for each of five seeds.Source: Attacker-Data Additions · p. 23

Numerical Diagnostics

  • Float64 state and cancellation checks report small residuals, with hidden ledgers used only for evaluation and never by the recovery procedure.Across successful attacker-data experiments, maximum cancellation errors are at most 7.89 × 10^-13 on MNIST and 2.07 × 10^-13 on CIFAR-10.Source: Numerical Diagnostics · p. 23
  • Some recovered Gram blocks have small negative eigenvalues, so rejecting every non-PSD replay would reject raw blocks; projection improves validity but worsens head matching.Projected replay errors remain below 6 × 10^-9 in float64.Source: Numerical Diagnostics · p. 23, Table 8 · p. 24

DINOv2 Encoder Robustness

The paper tests one-state identification with a higher-dimensional frozen DINOv2 encoder and separately examines probe detectability and rounded-head utility. The DINOv2 check does not rerun deletion or decoder evaluations.

DINOv2 Encoder Robustness

  • With 768-dimensional DINOv2 features, 104-response attacker-data estimates are positive definite, but the dimensional response bound does not guarantee observed rank.The experiment identifies one state only; it does not rerun deletion or decoder evaluations. Table 10 summarizes five seeded splits and sequences.Source: DINOv2 Encoder Robustness · p. 24, Table 10 · p. 24
  • At 104 responses, DINOv2 relative G errors range from 1.87 × 10^-11 to 5.67 × 10^-11 on MNIST and 3.26 × 10^-12 to 8.61 × 10^-12 on CIFAR-10.The dimensional lower bound rises from 52 responses at dimension 512 to 77 at dimension 768.Source: DINOv2 Encoder Robustness · p. 24
  • The DINOv2 decoder examples are selected qualitative outputs, not a quantitative reconstruction evaluation.They include exact-target-feature decoding to distinguish feature-recovery error from decoder loss.Source: Figure 2 · p. 25

Designed-Probe Scale and Detectability

  • Clipping designed requests to the honest 99th-percentile magnitude retains 20/20 success, but the induced head change remains 149 times the honest 99th percentile.Per-message attacker-data additions trigger 0 of 520 MNIST and 13 of 520 CIFAR-10 thresholds; temporal and frequency-based detection are not tested.Source: Designed-Probe Scale and Detectability · p. 25
  • Rounding the final honest ResNet-18 head to float32 changes no prediction among 10,000 test examples on either dataset.Accuracy remains 97.15% on MNIST and 85.94% on CIFAR-10; this tests inference from a rounded broadcast, not float32 ledger utility.Source: Designed-Probe Scale and Detectability · p. 25

K Additional Reconstruction and Replay Figures

The additional figures illustrate coarse visual leakage from recovered frozen features and replay after class- and client-level deletions. The examples do not establish faithful pixel recovery.

K Additional Reconstruction and Replay Figures

  • Figure 5 tracks client-level replay over 50 sequential deletion rounds across 20 independently sampled client partitions.Thin curves represent individual partitions and emphasized curves their medians.Source: Figure 5 · p. 26
  • Local and auxiliary-data decoders illustrate coarse visual leakage and, for MNIST examples, individual digit identities, but not faithful pixel-level recovery.The auxiliary TinyImageNet-trained diffusion decoder shows coarse leakage despite domain shift; Figure 3’s samples are not pixel-faithful reconstructions.Source: Figure 3 · p. 26, K Additional Reconstruction and Replay… · p. 27
  • After each class deletion, replaying the estimated aggregate block restores test accuracy to its pre-deletion level.Figure 4 compares immediate probing and reinsertion with honest unlearning; final honest/attacked accuracy is 9.82%/97.15% on MNIST and 8.94%/85.94% on CIFAR-10.Source: Figure 4 · p. 26, K Additional Reconstruction and Replay… · p. 27
Loading 2609.04475v1…