{"id":"011a52fe-b0e4-49b4-866a-43e533cf7ee5","arxiv_id":"2412.05529","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"FUI claims to erase a client's data in differentially private federated learning by retracting the local model and adding calibrated Gaussian noise to mimic retraining.","lead":"The paper proposes FUI, a two-step method for removing one client's data from a differentially private federated model, using local loss-maximizing retraction and calibrated Gaussian noise. The authors claim the unlearned model is statistically indistinguishable from a retrained model and use a Stackelberg game to choose the unlearning parameters.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The core guarantee rests on a false theorem: η-DP does not imply η²/2-indistinguishability, so the calibration in Theorem 4 is unsupported.","rationale":"The reader's REJECT verdict is appropriate, and my independent stress-test identifies the same load-bearing flaw. Theorem 1 is presented as the foundation for the entire unlearning guarantee: it is used in Section IV-A to claim that local retraction already achieves η²/2-indistinguishability, and Section IV-B's calibration formulas and Theorem 4 directly build on that exponent. Because the theorem is false, the derived noise scales and the final ϵ-indistinguishability claim have no valid basis. The counterexample is simple and unambiguous: any mechanism satisfying η-DP can have events with probability ratio exactly e^η, so the claimed stronger e^{η²/2} bound cannot hold in general. The reader's additional point about local model retraction is also valid: w_ref subtracts only the target's latest noisy upload, leaving contributions from earlier rounds, and no argument shows w_LR is distributionally close to a retrained model. However, even setting that issue aside, the false Theorem 1 alone invalidates the central claim. I therefore agree with the reader's weakest_assumption and see no reason to change the verdict.","tokens_in":16316,"tokens_out":7354,"duration_ms":68869,"concrete_test":"Implement the two-point randomized response mechanism with η=0.1: let M(D) return 0 with probability e^η/(1+e^η) and 1 otherwise, and let M(D') swap the probabilities. Then compute sup_Z Pr[M(D)∈Z]/Pr[M(D')∈Z] over all events Z; it will equal e^{0.1}. If Theorem 1 were correct, this supremum would be at most e^{η²/2}=e^{0.005}. Running this check decisively refutes the theorem on which the paper's privacy guarantee depends.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central guarantee of FUI is Theorem 4, which promises an unlearning model that is ϵ-indistinguishable from the retrained model. The quantitative basis is Theorem 1 (Section IV-A), which asserts that every η-DP mechanism's outputs are η²/2-indistinguishable. This implication is false: η-DP is exactly the statement that Pr[X∈O] ≤ e^η Pr[Y∈O] for all events O, so the best exponent guaranteed is η, not η²/2. The proof's Rényi-divergence manipulation is invalid: from D_α(X∥Y) ≤ η it writes Σ_x (Pr[Y=x]/Pr[Y'=x])^{α−1} ≤ e^{(α−1)η}, then substitutes α−1 = η to obtain Σ_x (Pr[Y=x]/Pr[Y'=x])^η ≤ e^{η²}, and finally inserts the same ratio to a power η/2 twice to get a factor e^{η²/4}e^{η²/4}. No such step follows from the divergence bound. A concrete counterexample: randomized response with η=0.1 gives an event whose probability ratio is e^{0.1}, which is greater than e^{0.005}=e^{η²/2}. Consequently, Section IV-B's noise scales σ̃1=√(2d)/(2η) and σ̃2=d/√ϵ, and the variance-calibration rule σcali=√(σ̃2²−σ̃1²), are not derived from any valid indistinguishability bound. For two Gaussians with different means on an unbounded domain, the likelihood ratio is unbounded, so no finite additive Gaussian noise can enforce Definition IV.1 for all events. The local-retraction premise is also unsupported: w_ref=(Nw_t−w_t^i)/(N−1) subtracts only the latest noisy upload, and L-BFGS maximization of F_i from that point is not a DP mechanism with w_RE as its neighboring output.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes Federated Unlearning with Indistinguishability (FUI) for differentially private federated learning (DPFL). The protocol has two stages: the target client performs local model retraction by maximizing its loss function with L-BFGS starting from a reference model that removes its latest noisy upload, and the server calibrates additional Gaussian noise to make the unlearning model ϵ-indistinguishable from a retrained model. The paper also formulates a two-stage Stackelberg game to choose the privacy parameter ϵ and penalty factor p, proves convergence of the federated learning process, and reports experiments on four datasets. The central claim is that FUI produces a model that is ϵ-indistinguishable from retraining while requiring only the server and target client to participate.","tokens_in":16652,"tokens_out":6818,"duration_ms":64610,"significance":"The problem addressed is important: federated unlearning in DPFL has not been systematically studied, and a scheme that reuses DP noise to avoid full retraining would be practically valuable. The paper provides a concrete protocol, a game-theoretic parameter selection, and a broad experimental comparison including accuracy, loss, runtime, and membership inference attack resistance. These are useful contributions if the privacy guarantee were valid. However, the main theoretical result (Theorem 1) is false, the noise-calibration formulas do not follow from the stated definitions, and the local retraction step does not remove historical influence; as a result, the claimed ϵ-indistinguishability guarantee is not established. The experimental evaluation does not directly test the formal privacy guarantee, so the paper's central claim remains unsupported.","major_comments":[{"comment":"The statement that η-DP implies η²/2-indistinguishability is false. η-DP only guarantees Pr[X∈O] ≤ e^η Pr[Y∈O] for every event O; the exponent cannot be improved to η²/2 without additional assumptions. The proof's Rényi-divergence manipulation is invalid: from D_α(Y||Y') ≤ η it writes Σ_x (Pr[Y=x]/Pr[Y'=x])^{α−1} ≤ e^{(α−1)η}, but the Rényi divergence is an expectation with weight Pr[Y=x], so the displayed bound does not follow. The subsequent substitutions α−1=η and insertion of the ratio to the power η/2 are also unjustified. A concrete counterexample is randomized response with η=0.1, for which there exists an event whose probability ratio is e^{0.1} > e^{0.005}=e^{η²/2}. Since Theorem 1 is the basis for the η²/2-indistinguishability claim after local retraction, the central argument collapses.","section":"Section IV-A, Theorem 1"},{"comment":"The calibration formulas σ̃1 = √(2d)/(2η) and σ̃2 = d/√ϵ are dimensionally inconsistent (σ̃1 scales as √d while σ̃2 scales as d), and no valid derivation from Definition IV.1 is provided. More fundamentally, Definition IV.1 requires the probability ratio to be bounded by e^ϵ for all subsets Z of the parameter space; for two Gaussian distributions with different means on an unbounded domain, the likelihood ratio is unbounded, so no finite additive Gaussian noise can satisfy the definition. The proof of Theorem 4 attempts to show Pr[M(X)=z] ≤ e^{η²/2} Pr[M(Y)=z] for all z, but the left-to-right ratio is unbounded as z→∞. Thus the global noise calibration step cannot deliver the promised ϵ-indistinguishability.","section":"Section IV-B, Theorem 4"},{"comment":"The reference model w_ref = (N w_t − w_t^i)/(N−1) subtracts only the target client's most recent noisy upload w_t^i from the current global model w_t. It does not remove the client's contributions to earlier global models w_1,...,w_{t−1}, nor does it undo the effect of those contributions on the optimization trajectory. Consequently, the premise that w_LR after L-BFGS loss maximization is statistically close to the retrained model w_RE is not established. No argument shows that the L-BFGS procedure is a DP mechanism with w_RE as a neighboring output, and the paper does not address this gap.","section":"Section IV-A, local model retraction"},{"comment":"The optimal strategy formulas for the Stackelberg game are stated without proof. The expressions involve quantities H, J, and |D_{-i}| that are not defined in the theorem statements or the preceding text, and the conditions for the two cases (e.g., ∂²U_c/∂ϵ² ≤ 0) are not verified for the stated parameter ranges. Since the game-theoretic parameter selection is one of the paper's main contributions, these results need a full derivation or a reference to a complete proof.","section":"Section V-B, Theorems 2 and 3"}],"minor_comments":[{"comment":"The convergence theorem is a generic FedAvg-style bound and does not reference the unlearning model w_UN, so it does not establish convergence of FUI specifically; the proof also uses undefined notation such as w_r^i and g_{k,t}^i.","section":"Section VI-B, Theorem 5"},{"comment":"The distance bound d is said to be 'calculated by (36) in [19]', but no equation (36) is reproduced and the units or dimension of d are never specified, which matters because σ̃1 and σ̃2 have different functional dependence on d.","section":"Section IV-B"},{"comment":"The proof conflates the mechanism output and neighboring datasets by writing M(X) and M(Y) without specifying which arguments correspond to w_LR and w_RE; the relationship between the noise scales and the actual model distributions is not formalized.","section":"Section IV-B, proof of Theorem 4"},{"comment":"The while condition in Line 3 checks ||w_k − w_ref||₂ ≤ δ, but the optimization problem is defined over the ball {v: ||v−w_ref||₂ ≤ δ}; the loop termination condition based on τ is not connected to δ, and the algorithm may exit without satisfying the stated constraint.","section":"Algorithm 1"},{"comment":"The game parameters a, b, r, s, l, Ψ_s, Ψ_c, and ϵ_min are introduced without guidance on how they would be calibrated in practice, and the experimental section does not show sensitivity of the equilibrium to these constants.","section":"Section V"},{"comment":"The experiments do not directly verify the claimed ϵ-indistinguishability; membership inference attack precision and recall are indirect proxy measures and cannot confirm the formal guarantee in Definition IV.1.","section":"Section VII-B"},{"comment":"There are several typographical and notation inconsistencies, such as 'F ederated' in the abstract, σ_cali versus σcali in Equation (2), and the constraint in Theorem 3 written as p∈{0,pmax} when the model specifies 0 < p ≤ pmax.","section":"Throughout"}],"recommendation":"reject","confidential_remarks":"The paper addresses an important and timely problem, and the experimental effort is substantial. However, the core privacy guarantee is built on a false theorem (Theorem 1), and the proposed pure ϵ-indistinguishability definition is incompatible with additive Gaussian noise on unbounded parameter spaces; these are load-bearing errors that cannot be fixed by local edits. The local retraction step also fails to account for the target client's historical contributions across earlier rounds, and the Stackelberg theorems are stated without proof. I would not recommend acceptance in the current form. A resubmission would need to replace the central guarantee with a mathematically valid formulation (e.g., (ε,δ)-DP or a bounded-domain model), provide a correct derivation of any calibration noise, and give complete proofs for the game-theoretic results."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line up front: the privacy guarantee is not just shaky, it is false. Theorem 1 claims that η-DP implies η²/2-indistinguishability, but the proof's exponent manipulation is invalid. A simple randomized-response counterexample (η = 0.1 gives an event whose probability ratio is e^0.1, not e^0.005) shows the implication is wrong. Since Theorem 4's noise scales are derived directly from Theorem 1, the main unlearning guarantee collapses. The local-retraction premise is also unsupported: w_ref = (N w_t − w_t^i)/(N−1) subtracts only the latest noisy upload, and L-BFGS loss maximization from that point is not a DP mechanism relative to the retrained model. So the central argument fails on two independent grounds.\n\nWhat is genuinely here: the paper identifies a real gap—unlearning in DPFL—and proposes a two-stage pipeline (client-side L-BFGS retraction, then server-side noise calibration) that involves only the target client and the server. The Stackelberg game formulation is a reasonable framework for choosing the unlearning parameter, though it is only as good as the hand-picked utility functions. The experimental comparison against FedEraser, FedRecovery, and PGD is a useful sanity check for system-level behavior, and the paper is clearly written.\n\nThe soft spots go beyond the false theorem. The novelty is thin: FedRecovery [19] already uses indistinguishability and noise calibration for unlearning in differentially private FL; the new elements are the L-BFGS step and the game, not the core mechanism. The noise-gap calculation is dimensionally inconsistent (σ̃1 has units of sqrt(d)/η, σ̃2 has units of d/√ϵ, so subtracting them is not meaningful), and for shifted Gaussians on an unbounded domain the likelihood ratio is unbounded, so variance calibration alone cannot enforce Definition IV.1. The convergence theorem is a generic strongly-convex bound that does not apply to the CNN experiments, and the experiments lack error bars, seeds, and code, so the comparisons cannot be independently checked.\n\nWho is this for? A reader working on federated unlearning systems might find the pipeline and game useful as a starting point, but not as a privacy result. I would desk reject rather than send to reviewers: the load-bearing theorem is false, and no amount of revision can repair the main guarantee without changing the method.","headline":"The paper's central guarantee is unsupported: Theorem 1 misuses Rényi divergence, and the noise calibration built on it cannot deliver ϵ-indistinguishability.","tokens_in":17287,"tokens_out":3450,"would_cite":false,"duration_ms":35310,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FUI proposes to satisfy the right to be forgotten in differentially private federated learning by retracting the client's local model and calibrating noise to match retraining.","keywords":["federated unlearning","differential privacy","federated learning","indistinguishability","noise calibration","Stackelberg game","L-BFGS","machine unlearning"],"falsifier":"Run FUI on a pair of neighboring datasets with a fixed eta, record the retracted model w_LR over many trials, and directly estimate P(w_LR in O) for the two datasets; if the ratio exceeds e^($eta^{2}$/2) for some outcome set O, the baseline indistinguishability on which the calibration rests is contradicted.","tokens_in":16009,"feed_emoji":"🧹","tokens_out":5553,"duration_ms":52170,"temperature":0.7,"pith_summary":"The paper proposes the first federated-unlearning scheme designed for differentially private federated learning (DPFL), where existing unlearning methods fail because DP noise degrades them. The central idea is to treat the DP noise as a resource: after the target client runs L-BFGS loss maximization to 'retract' its local contribution, the noise already injected during training gives a baseline level of indistinguishability from the retrained model. The server then measures the noise gap and adds calibrated Gaussian noise so that the final model is epsilon-indistinguishable from the model that would be obtained by full retraining. The same mechanism is governed by a two-stage Stackelberg game that sets the server's penalty factor and the client's privacy requirement. A sympathetic reader would care because this gives a path to enforce the right to be forgotten in DPFL without engaging all remaining clients.","feed_headline":"Noise in private federated learning becomes the unlearning tool","feed_subtitle":"Only the target client and the server participate; the result provably matches a retrained model.","key_machinery":"The mechanism is the 'upcycling' of DP noise: the noise added at the clients and at the server during DPFL is not discarded but reused to give the retracted model a free level of indistinguishability. The mathematical engine is the link between eta-DP and $eta^{2}$/2-indistinguishability (Theorem 1), the L-BFGS optimizer for loss maximization, and the noise-gap formula g = sigma_tilde_1 - sigma_tilde_2 with calibration scale sigma_cali = $\\sqrt$($sigma_tilde_2^{2}$ - $sigma_tilde_1^{2}$). The Stackelberg game supplies the parameter-selection layer that determines when and how much extra noise to add.","core_discovery":"The paper's central claim is that FUI makes an unlearning model statistically indistinguishable from the retrained model in DPFL. It does so in two steps: local model retraction, in which the target client maximizes its loss with L-BFGS starting from a reference model; and global noise calibration, in which the server checks whether the achieved indistinguishability level $eta^{2}$/2 already meets the requested epsilon and, if not, adds Gaussian noise of scale $\\sqrt$($sigma_tilde_2^{2}$ - $sigma_tilde_1^{2}$). Theorem 4 states this guarantees epsilon-indistinguishability, and Theorem 5 gives O(1/T) convergence. The paper further claims that formulating the server-client interaction as a Stackelberg game yields optimal strategies (penalty factor p and privacy requirement epsilon) that balance model utility and privacy benefit.","pith_inferences":["If Theorem 1's derivation of eta^2/2 indistinguishability were replaced by a direct Renyi-DP bound, the calibration formulas would need a matching correction; a reader testing the bound numerically on the actual retraction trajectory would settle this.","The same 'noise upcycling' idea could be applied to unlearning multiple clients at once, an extension the paper lists as future work; the noise gap would then need to account for the combined retraction of several local models.","Because the calibration step only adds Gaussian noise, this scheme is likely compatible with other DP formalisms such as concentrated DP, where the composition of the learning noise and the calibration noise could be tracked analytically.","The utility functions in the game contain constants a, b, r, s, l that would need to be measured per deployment; a sensitivity analysis of the Nash equilibrium to those constants would be a natural next check."],"forward_implications":["A DPFL server can honor a client's erasure request with only the target client and the server participating, avoiding costly full retraining or involvement of other clients.","The unlearning model provably meets the epsilon-indistinguishability requirement, so an adversary cannot distinguish it from the retrained model at level epsilon.","The Stackelberg-derived choices of p and epsilon give both the server and the target client their best utilities at the Nash equilibrium, making unlearning economically consistent.","The DPFL training process remains convergent at rate O(1/T) when FUI is used for unlearning.","On the tested benchmarks, FUI keeps accuracy close to retraining and beats FedEraser, FedRecovery, and PGD while running in seconds rather than minutes."],"supporting_citations":[{"why":"Supplies the DPFL protocol and noise scales for the uplink and downlink channels that FUI upcycles.","marker":"[6]"},{"why":"Supplies the L-BFGS algorithm used for local model retraction by loss maximization.","marker":"[22]"},{"why":"Provides the bound d on the distance between model parameters and the indistinguishability-based unlearning target that FUI adopts.","marker":"[19]"},{"why":"Used in Theorem 1 to connect eta-DP to Renyi divergence and derive the eta^2/2 indistinguishability level.","marker":"[31]"},{"why":"Supplies the Gaussian noise composition formula used to compute the calibrated noise scale in global noise calibration.","marker":"[32]"},{"why":"Provides the PGD baseline that FUI is compared against in the experiments.","marker":"[13]"},{"why":"Provides the FedEraser baseline that FUI is compared against in the experiments.","marker":"[9]"},{"why":"Supplies the membership inference attack used to measure unlearning effectiveness.","marker":"[35]"}],"fun_headline_variants":["Upcycling noise: federated unlearning's secret weapon","DP noise isn't waste—it's the unlearning tool","Federated unlearning: turning noise into forgetfulness","How DP noise becomes the forgetful friend","Noise to the rescue: private federated unlearning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire calibration guarantee rests on the claim that the DP noises already in the system make the locally retracted model $eta^{2}$/2-indistinguishable from the retrained model; if that claim fails, the noise-gap calculation and the added noise do not deliver epsilon-indistinguishability.","fun_headline_variants_meta":{"raw":{"variants":["Upcycling noise: federated unlearning's secret weapon","DP noise isn't waste—it's the unlearning tool","Federated unlearning: turning noise into forgetfulness","How DP noise becomes the forgetful friend","Noise to the rescue: private federated unlearning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000375,"raw_usage":{"total_tokens":2021,"prompt_tokens":984,"completion_tokens":1037,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":600,"completion_tokens_details":{"reasoning_tokens":958}},"tokens_in":600,"tokens_out":1037,"duration_ms":10811,"temperature":1.0,"reasoning_tokens":958,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:39:01.408504+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run FUI on a pair of neighboring datasets with a fixed eta, record the retracted model w_LR over many trials, and directly estimate P(w_LR in O) for the two datasets; if the ratio exceeds e^($eta^{2}$/2) for some outcome set O, the baseline indistinguishability on which the calibration rests is contradicted.","supporting_citations":[{"cited_title":"Fedrecovery: Dif- ferentially private machine unlearning for federated learning frameworks,","cited_arxiv_id":null,"evidence_quote":"Provides the bound d on the distance between model parameters and the indistinguishability-based unlearning target that FUI adopts."},{"cited_title":"Independent component analysis in the presence of gaussian noise by maximizing joint likelihood,","cited_arxiv_id":null,"evidence_quote":"Supplies the Gaussian noise composition formula used to compute the calibrated noise scale in global noise calibration."}],"review_version":1}