The DOI matches its Crossref record; 37 of the 38 references it cites were found in a registry or an index.
FedEraser: Enabling Efficient Client-Level Data Removal from Federated Learning Models
Abstract
Federated learning (FL) has recently emerged as a promising distributed machine learning (ML) paradigm. Practical needs of the "right to be forgotten" and countering data poisoning attacks call for efficient techniques that can remove, or unlearn, specific training data from the trained FL model. Existing unlearning techniques in the context of ML, however, are no longer in effect for FL, mainly due to the inherent distinction in the way how FL and ML learn from data. Therefore, how to enable efficient data removal from FL models remains largely under-explored. In this paper, we take the first step to fill this gap by presenting FedEraser, the first federated unlearning method-ology that can eliminate the influence of a federated client’s data on the global FL model while significantly reducing the time used for constructing the unlearned FL model. The basic idea of FedEraser is to trade the central server’s storage for unlearned model’s construction time, where FedEraser reconstructs the unlearned model by leveraging the historical parameter updates of federated clients that have been retained at the central server during the training process of FL. A novel calibration method is further developed to calibrate the retained updates, which are further used to promptly construct the unlearned model, yielding a significant speed-up to the reconstruction of the unlearned model while maintaining the model efficacy. Experiments on four realistic datasets demonstrate the effectiveness of FedEraser, with an expected speed-up of 4× compared with retraining from the scratch. We envision our work as an early step in FL towards compliance with legal and ethical criteria in a fair and transparent manner.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Two evaluation parameters are specified: attack precision and attack recall , where attack precision denotes the proportion of unlearned samples that is expected to participate in the training process.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“In calibration training and update calibration steps, several rounds of a calibration retraining process are performed to approximate the unlearning updates without the target client.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“In addition, a prediction difference metric is also provided, which measures the difference in prediction probabilities between the original global model and the unlearned model.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“Second, this solution also requires caching of intermediate data, which will cost more storage.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“In the calibrated update aggregating and the unlearned model updating steps, standard federated learning aggregation operations are used to aggregate those unlearning updates and further update the global model.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“Liu et al. [54] present an experimental verification method based on a membership inference attack.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“Based on the idea of trading the central server's storage for the unlearned model's construction, Liu et al. [54] proposed an efficient federated unlearning methodology, FedEraser .”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“Historical parameter updates from the clients are stored in the central server during the training process, and then the unlearning process unfolds in four steps: (1) calibration training , (2) update calibrating , (3) calibrated update aggregating , and (4) unlearned model updating , to achieve the unlearning purpose.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“This eliminates the influence of the target data.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“However, the effectiveness of this scheme will decrease dramatically as the number of unlearning requests increases; this is because the gradients are cached during the training phase, and the unlearning process will not update these gradients to satisfy subsequent unlearning requests [54].”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“Attack recall denotes the fraction of unlearned samples that can be correctly inferred as part of the training dataset.”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“They are mostly designed to leverage the special characteristics of a particular learning process or training scheme [24, 47, 54].”
From Machine Unlearning: A Survey (2024) · cites this paper as [54]
In the citing paper
“The calibration process during the unlearned model training relies on the historical updates of the participating clients. The limited store capability of the hardware makes it hard to deploy in practice.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [224]
In the citing paper
“In [224], the federated unlearning methodology, namely, FedEraser, is proposed. In this scheme, the central server stores the historical updates received from clients during the global model training process. Once the global model converges, the FedEraser reconstructs an unlearned model in the central server based on the stored historical parameters.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [224]
In the citing paper
“In the FedEraser design, no substantial modification is required to the existing WFL architecture and the training process of the participants. Thus, the proposed method is easy to implement.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [224]
In the citing paper
“although the training data and the training process are not required, the FedEraser must target the attacker client, which is also pretty hard in actual implementation.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [224]
In the citing paper
“However, such defense methods [218], [224] require the historical information of local model updates and are not compatible with SecAgg, which brings more difficulty in the practical implementation.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [224]
Citations
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210
Dwork, C. (2006) · Lecture notes in computer science · doi:10.1007/11787006_1 · Cited by 6,125
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754
Federated Learning: Strategies for Improving Communication Efficiency
Konečný, J., McMahan, H. B., Yu, F. X., Richtárik, P., Suresh, A. T., & Bacon, D. (2016) · arXiv · doi:10.48550/arxiv.1610.05492 · Cited by 3,766
The EU General Data Protection Regulation (GDPR)
Voigt, P., & von dem Bussche, A. (2017) · doi:10.1007/978-3-319-57959-7 · Cited by 3,001
Nasr, M., Shokri, R., & Houmansadr, A. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00065 · Cited by 1,760
Exploiting Unintended Feature Leakage in Collaborative Learning
Melis, L., Song, C., De Cristofaro, E., & Shmatikov, V. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00029 · Cited by 1,734
Federated Optimization: Distributed Machine Learning for On-Device Intelligence
Konečný, J., McMahan, H. B., Ramage, D., & Richtárik, P. (2016) · arXiv · doi:10.48550/arxiv.1610.02527 · Cited by 1,563
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001
Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., & Backes, M. (2019) · Proceedings 2019 Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23119 · Cited by 852
Bourtoule, L., Chandrasekaran, V., Choquette-Choo, C. A., Jia, H., Travers, A., Zhang, B., Lie, D., & Papernot, N. (2021) · 2021 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40001.2021.00019 · Cited by 810 · cited 3×
“Most recently, Bourtoule et al. [16] introduce a more general algorithm named SISA, which takes advantage of sharding and slicing during the training.”
BackgroundMethodTowards Making Systems Forget with Machine Unlearning
Cao, Y., & Yang, J. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.35 · Cited by 622 · cited 2×
“The term “machine unlearning” is introduced by Cao et al. [14], where an efficient forgetting algorithm in the restricted context of statistical query learning is proposed.”
BackgroundDBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 472
The Eu General Data Protection Regulation (Gdpr): A Practical Guide
Voigt, P., & Bussche, A. V. D. (2017) · Cited by 456
Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networks
Golatkar, A., Achille, A., & Soatto, S. (2020) · 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr42600.2020.00932 · Cited by 394
The Limitations of Federated Learning in Sybil Settings
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2020) · Recent Advances in Intrusion Detection · Cited by 265
Analyzing User-Level Privacy Attack Against Federated Learning
Song, M., Wang, Z., Zhang, Z., Song, Y., Wang, Q., Ren, J., & Qi, H. (2020) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2020.3000372 · Cited by 262
Making AI Forget You: Data Deletion in Machine Learning
Ginart, A., Guan, M. Y., Valiant, G., & Zou, J. (2019) · arXiv · doi:10.48550/arxiv.1907.05012 · Cited by 175
Certified Data Removal from Machine Learning Models
Guo, C., Goldstein, T., Hannun, A., & van der Maaten, L. (2019) · arXiv · doi:10.48550/arxiv.1911.03030 · Cited by 160
Understanding the scope and impact of the California Consumer Privacy Act of 2018
Harding, E. (., Vanto, J. J., Clark, R. E., Ji, L., & Ainsworth, S. C. (2019) · Journal of data protection & privacy. · doi:10.69554/tcfn5165 · Cited by 146
Machine unlearning: linear filtration for logit-based classifiers
Baumhauer, T., Schöttle, P., & Zeppelzauer, M. (2022) · Machine Learning · doi:10.1007/s10994-022-06178-9 · Cited by 141
Practical Blind Membership Inference Attack via Differential Comparisons
Hui, B., Yang, Y., Yuan, H., Burlina, P., Gong, N. Z., & Cao, Y. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24293 · Cited by 127
Self-citationGolatkar, A., Achille, A., & Soatto, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58526-6_23 · Cited by 122
Machine Unlearning: Linear Filtration for Logit-based Classifiers
Baumhauer, T., Schöttle, P., & Zeppelzauer, M. (2020) · arXiv · doi:10.48550/arxiv.2002.02730 · Cited by 110
Nasr, M., Shokri, R., & Houmansadr, A. (2018) · arXiv (Cornell University) · Cited by 104
SocInf: Membership Inference Attacks on Social Media Health Data With Machine Learning
Liu, G., Wang, C., Peng, K., Huang, H., Li, Y., & Cheng, W. (2019) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2019.2916086 · Cited by 96
Self-citationKeep Your Data Locally: Federated-Learning-Based Data Privacy Preservation in Edge Computing
Liu, G., Wang, C., Ma, X., & Yang, Y. (2021) · IEEE Network · doi:10.1109/mnet.011.2000215 · Cited by 58
Self-citationRadioactive data: tracing through trainingPreprint
Sablayrolles, A., Douze, M., Schmid, C., & Jeǵou, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.00937 · Cited by 54
Wishart Mechanism for Differentially Private Principal Components Analysis
Jiang, W., Xie, C., & Zhang, Z. (2016) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v30i1.10185 · Cited by 52
Towards Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2020) · arXiv · doi:10.48550/arxiv.2003.04247 · Cited by 38
Distributed Differentially Private Algorithms for Matrix and Tensor Factorization
Imtiaz, H., & Sarwate, A. D. (2018) · IEEE Journal of Selected Topics in Signal Processing · doi:10.1109/jstsp.2018.2877842 · Cited by 32
Differentially Private Regression Diagnostics
Chen, Y., Machanavajjhala, A., Reiter, J. P., & Barrientos, A. F. (2016) · Proceedings · doi:10.1109/icdm.2016.0019 · Cited by 23
Approximate Data Deletion from Machine Learning Models: Algorithms and Evaluations.Preprint
Izzo, Z., Smart, M. A., Chaudhuri, K., & Zou, J. (2020) · arXiv (Cornell University) · Cited by 15
Research works printed but not linked: 2
- kone?n?, 2016, Federated learning: Strategies for improving communication efficiency, CoRR
- chen, 2016, Differ-entially private regression diagnostics, Proceedings of IEEE ICDM, 81
Cited by
Sorted by citations
The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retraining
Liu, Y., Xu, L., Yuan, X., Wang, C., & Li, B. (2022) · IEEE INFOCOM 2022 - IEEE Conference on Computer Communications · doi:10.1109/infocom48880.2022.9796721 · Cited by 202
Self-citationXu, H., Zhu, T., Zhang, L., Zhou, W., & Yu, P. S. (2024) · ACM Computing Surveys · doi:10.1145/3603620 · Cited by 164
“They are mostly designed to leverage the special characteristics of a particular learning process or training scheme [24, 47, 54].”
BackgroundMethodInfluentialFederated Unlearning via Class-Discriminative Pruning
Wang, J., Guo, S., Xie, X., & Qi, H. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512222 · Cited by 157
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152
“Since all defense methods inherently eliminate the suspicious backdoor effect by clipping the possible malicious updates, inevitably, a portion of honest updates will be neglected by mistake.”
BackgroundNguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130
Metadata
- Authors
- Liu, G., Ma, X., Yang, Y., Wang, C., & Liu, J.
- Affiliations
- Huazhong University of Science and Technology (CN)
- Hubei University (CN)
- Simon Fraser University (CA)
- Venue
- 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS)
- Publisher
- IEEE
- Published
- 2021-06-25
- Pages
- 1-10
- ISSN
- 1548-615X (ISSN-L)
- OpenAlex
- W3197363474
- Cited by
- 248
- References
- 38
- Citations by year
- 2026: 66 · 2025: 94 · 2024: 62 · 2023: 23 · 2022: 3
- FWCI
- 10.08
- Type
- conference paper
- Language
- en
- Open access
- closed
- Licence
- Locations
- International Workshop on Quality of Service (publishedVersion)
- Funders
- National Natural Science Foundation of China
- Fundamental Research Funds for the Central Universities
- Natural Science Foundation of Hubei Province
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- federated learning, data deletion, right to be forgotten, data poisoning, model reconstruction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
