{"id":"a954146b-61bd-4337-8a4c-86928cc8646c","arxiv_id":"2501.11848","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A malicious federated-learning client can flip the global model's prediction on a target sample by crafting feature-unlearning requests on influence-function-selected samples.","lead":"A security paper shows that a malicious participant in federated learning can manipulate the unlearning process so that the shared model misclassifies a chosen person's data. The attack reportedly succeeds in 80 percent of cases while touching only 0.3 percent of the attacker's local data, exposing a new failure mode for the right to be forgotten.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The black-box threat model is inconsistent with the ISI stage: Eq. (6) requires the attacker's own local model and its Hessian and gradients, so the claim of 'only black-box access to the global model' needs clarification about how the attacker obtains a suitable local model.","rationale":"The reader's weakest assumption identifies the same load-bearing point: the influence-function selection stage must transfer from the attacker's local model to the global unlearning step. The reader's verdict CONDITIONAL is appropriate. My stress-test sharpens the concern in two directions. First, the threat model's black-box claim is not merely an implementation detail; the ISI stage is defined by Eq. (6) using the attacker's local model. If the attacker has full white-box access to its own local model, the black-box claim must be rewritten to say 'the attacker only needs black-box access to the global model and other clients.' Second, the empirical evidence for transfer is indirect: Tables I-II and IV show that the full method works, but the absence of variance and the strong dependence on the dataset (Credit Score ASR 0.55) and on MUG's epsilon suggest the 80% ASR at 0.3% requests is configuration-specific. The Rand+MUG baseline (Figs. 4-5) is the clearest internal evidence that the local influence signal is load-bearing; if the authors could show that the signal survives under an honest black-box threat model, the main claim would stand. The defense section introduces an additional circularity: the IQR-based defense is evaluated on the same datasets without a separate tuning set, and the lambda sweep (Fig. 10) shows that lambda=0.1 reduces ASR by roughly half in three datasets, but no statistical test or variance is reported. These issues do not amount to fraud or self-contradiction of the central construction, but they do justify a conditional verdict and a request for stronger empirical grounding.","tokens_in":22342,"tokens_out":1971,"duration_ms":18334,"concrete_test":"Run the attack with the ISI stage replaced by influence values computed on a fully black-box approximation that does not use the attacker's local model's Hessian or gradients (e.g., random-selected samples but with a larger request budget, or influence computed on an auxiliary public model). If ASR drops to the Rand+MUG baseline level, then the attack's success depends on white-box access to the attacker's local model, contradicting the stated threat model. Alternatively, replay the reported configuration (FedEraser on MNIST, IID, 20 clients, 2 malicious, 0.3% requests, 40 targets) with 5 random seeds and report per-seed ASR and standard deviation; if the average ASR falls below 60% or the variance exceeds 0.2, the 80% claim is not reproducible.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central advance over prior unlearning attacks is the ISI stage, which the Rand+MUG baseline shows is essential: with random sample selection, ASR collapses. Section III-B explicitly claims a black-box setting in which the attacker obtains no knowledge of the global model or other clients' models, including architecture and parameters. Yet the ISI computation in Eq. (5)-(6) requires the attacker to evaluate gradients and Hessian-inverse-vector products of a model with respect to its own local training loss. Such gradient/Hessian access is white-box relative to the model being used for influence computation. Even if one interprets the black-box claim as meaning the attacker's own local model suffices, the transfer of influence computed on the attacker's local model to the server-side global unlearning step must be justified. The authors acknowledge that directly unlearning influential samples is ineffective due to aggregation, and their MUG adds a heuristic feature-space manipulation, but no analysis is provided for why the influence ranking computed on the attacker's local model, under FedAvg or Byzantine-robust aggregation, should rank samples whose unlearning flips the global model's prediction on the target sample. Tables I-II and IV show high ASR with two malicious clients and 0.3% requests, but without variance or detailed protocol, the strong claim that 'only 0.3% malicious unlearning requests' yields 80% ASR is not robustly supported: the 80% figure in the abstract refers to FedEraser-specific settings, while the average ASR in Table I varies by dataset and aggregation (e.g., 0.75-0.95). The inconsistency between the five datasets listed in Section VII-A and the abstract/conclusion claiming three is a concrete correctness gap.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FedMUA, a malicious unlearning attack against federated learning, in which a client crafts feature-perturbed unlearning requests for influential samples identified via influence functions, aiming to flip the global model's prediction on a target sample from another client. The authors evaluate the attack under FedEraser and KNOT with FedAvg, Median, Trimmed-mean, and Krum aggregation on five datasets, report high attack success rates at low request ratios, and propose a defense based on interquartile-range detection of large gradient updates followed by gradient shrinkage. The paper also releases code for reproducibility.","tokens_in":22528,"tokens_out":2664,"duration_ms":30596,"significance":"If the central claim holds, FedMUA identifies a genuinely new attack surface: federated unlearning, designed to remove data, can be abused by a single malicious client to manipulate predictions on other clients' data while preserving average accuracy. The empirical coverage is broad (two unlearning methods, four aggregation rules, IID and non-IID partitions, multiple datasets), and the Rand+MUG baseline convincingly shows that the influence-based selection is essential, not decorative. The paper also ships reproducible code, which strengthens the work. However, the significance is tempered by a threat-model gap between the stated black-box assumption and the gradient/Hessian computation in the attack, and by the absence of statistical characterization of the headline ASR figures.","major_comments":[{"comment":"The threat model in Section III-B states that the attacker has no knowledge of the global model or other clients' models, including architecture and parameters, yet the ISI stage requires the attacker to compute gradients and Hessian-inverse-vector products of a model with respect to its own local loss. The authors should clarify that the attacker's own local model is available through normal FL participation, and that the black-box assumption applies only to the global model. More importantly, the paper does not justify why influence values computed on the attacker's local model rank samples whose unlearning will flip the global model's prediction after server-side aggregation. Since the Rand+MUG baseline in Figs. 4 and 5 shows that random selection collapses ASR, this transfer property is load-bearing. The authors should provide either a theoretical argument or an empirical analysis (e.g., correlation between local influence and post-aggregation unlearning effect) to support this premise.","section":"Section III-B and Section V-A, Eqs. (5)-(6)"},{"comment":"The abstract and Section VII-C claim an 80% attack success rate with only 0.3% malicious unlearning requests, but the reported ASR values in Tables I and II are averages across settings and are given without variance or significance tests; the 80% figure is not tied to a specific configuration. Since ASR is the central metric, the authors should report ASR as mean plus standard deviation over multiple target sets and runs, state the number of trials, and provide the exact protocol that yields the 80% figure. Without this, the headline claim is not robustly supported.","section":"Section VII-C and Tables I-II"},{"comment":"The proposed defense is motivated by an observation on MNIST gradient norms (Fig. 3) and depends on an IQR threshold and a manually chosen shrinkage parameter λ, but the paper does not evaluate the defense across attack ratios, non-IID settings, or a range of threshold choices beyond λ in {0.1, 0.5, 1}. Since the defense is presented as a contribution, the authors should demonstrate that its parameters are not overfit to the specific attack configuration and that it remains effective when the attacker uses different request ratios or numbers of malicious clients.","section":"Section VI and Fig. 10"}],"minor_comments":[{"comment":"The notation 'max_n(IF(D_m))' is undefined; please specify that it selects the n samples with the largest absolute negative influence values.","section":"Section V-A, Eq. (7)"},{"comment":"The operation S_p(D_n) is not formally defined; please clarify how samples with the identical label are selected.","section":"Section V-A, Eq. (8)"},{"comment":"The sentence 'Building upon the identification of D_m' appears to refer to D_inf from Eq. (8); please correct this typo.","section":"Section V-B"},{"comment":"The upward arrows (e.g., '97.39 ±0.06↑') are not explained in the table captions or the text; please state what they indicate.","section":"Tables I and II"},{"comment":"Reference [15] duplicates reference [9]; please remove the duplicate.","section":"References"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Plainly: the paper shows a real, new attack on the federated unlearning pipeline. A small number of malicious unlearning requests, crafted by an attacker client, can flip the global model's prediction on a chosen target sample from another client, with global accuracy roughly unchanged. The influence-function-guided selection is doing the work—random selection collapses the attack—and the evaluation across two FU methods, four aggregation rules, and multiple datasets is a genuine plus. The authors are also honest that directly unlearning influential samples fails under aggregation, which is why they add the feature-space MUG step.\n\nThe soft spots are real but manageable. The threat model is described as black-box, and that is fine in the sense that the attacker uses only its own local model, but the paper should say so explicitly: Eq. (6) requires gradients and a Hessian of the attacker's model, not the global model. What is not justified, and should be discussed as an open question or given a small analysis, is why influence scores computed on the attacker's local model transfer to the global unlearning step after aggregation. The empirical comparison against Rand+MUG shows the transfer is load-bearing, but the paper does not explain it.\n\nThe headline number, 80% ASR with 0.3% requests, is presented without error bars. Tables I–II and IV–V report ASR as a single average; AccG and gAccG get ± values, so the omission is conspicuous. Also, the abstract and conclusion say three datasets, while Section VII-A lists five and Table V includes Credit Score and CIFAR-100. That needs fixing. The defense is a heuristic—IQR on gradient norms plus a shrink factor λ—tuned and evaluated on the same datasets. That is mild circularity, and the paper should acknowledge the limitation. None of this sinks the central claim; the attack clearly does something.\n\nVerdict: conditional acceptance with major revisions. This is a paper for FL security and privacy researchers actively working on unlearning or on FL poisoning/backdoors. It deserves a serious referee despite the presentation issues. I would send it to review.","headline":"A plausible new attack on federated unlearning, worth refereeing despite sloppy threat-model wording and missing ASR error bars.","tokens_in":23244,"tokens_out":2545,"would_cite":true,"duration_ms":26690,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A malicious client can hijack a federated model's unlearning step to flip the prediction on a chosen user of another client without degrading global accuracy.","keywords":["federated learning","federated unlearning","malicious unlearning attack","influence functions","right to be forgotten","model manipulation","gradient anomaly defense"],"falsifier":"Run FedMUA with Influential Sample Identification replaced by an equal-size random selection of same-label samples while keeping Malicious Unlearning Generation identical; the authors report that this random baseline collapses to near-zero attack success on MNIST and to roughly 20% on CIFAR-10. Any federated setup where the random baseline matches or exceeds FedMUA's success would show that the influence-ranking premise, rather than the unlearning mechanism, is what carries the attack.","tokens_in":22009,"feed_emoji":"🎯","tokens_out":8131,"duration_ms":74373,"temperature":0.7,"pith_summary":"Federated unlearning is the erasure step that lets a server remove a client's data from a jointly trained model without retraining. This paper claims that this erasure step can be turned into an attack: a malicious client can submit a handful of crafted unlearning requests so that the erased global model misclassifies a specific user whose data live on a different client. The attack works by identifying the attacker's own training samples that most strongly support the target user's correct prediction and then asking the server to unlearn those samples after pushing their features close to the target sample. The paper reports an average attack success rate near 80% with only 0.3% of unlearning requests malicious, across several datasets, unlearning methods, and aggregation rules, while the model's accuracy on other users stays roughly unchanged. If correct, this means the right-to-be-forgotten mechanism itself introduces a new attack surface for federated learning.","feed_headline":"A hostile client can flip a user's prediction in federated learning","feed_subtitle":"Crafting 0.3% of unlearning requests flips another client's target prediction 80% of the time, with accuracy intact.","key_machinery":"The load-bearing mechanism is the influence-function ranking in Eq. (6), $I_{up,loss}(z,z_t) = -\\nabla_w L(z_t,\\hat w)^\\top H_{\\hat w}^{-1} \\nabla_w L(z,\\hat w)$, computed on the attacker's local model: it estimates how much increasing the weight of a training sample $z$ would raise the loss on the target sample $z_t$, and the attacker keeps only samples with the most negative values and the same label as the target. The second component rewrites each selected sample as $x'_j = x_j - \\delta_j$ with $\\|x'_j - x_t\\| \\le \\zeta$ and $\\|\\delta_j\\| \\le \\epsilon$, so the server unlearns near-target features rather than the original sample. The proposed defense uses the interquartile range of per-client gradient norms to flag requests and multiplies flagged gradients by a small $\\lambda$ to shrink their effect.","core_discovery":"The paper's central claim is that a malicious client can make the unlearned target model satisfy $M_t(x_t, w^u_t) \\neq y_t$: the model held by the target user's client predicts a label different from the true one for the target sample $x_t$, even though that sample never left its owner's device and no training update was poisoned. The attack does not corrupt the federated learning training phase; it corrupts the unlearning phase by sending malicious feature unlearning requests for samples that influence the target prediction. The first step, Influential Sample Identification, selects the influential samples inside the attacker's local data using influence functions, keeping those with the strongest negative influence on the target loss that share the target's label. The second step, Malicious Unlearning Generation, moves the selected samples' features toward the target sample before the unlearning request. The evaluation claims the attack flips the target prediction at roughly 80% average success with 0.3% malicious requests, reaches 100% when the request ratio is raised to 10%, and leaves the global model's accuracy on non-target users essentially unchanged.","pith_inferences":["An implication the authors leave implicit: the whole attack leans on the assumption that influence values computed on the attacker's local model survive server aggregation and predict the global model's post-unlearning behavior. Their own random-selection baseline suggests this transfer is doing the work, since random selection collapses to near-zero success; verifying this directly on the global ","Because the defense shrinks large gradients after they arrive, a natural follow-up is an arms race: an attacker who clips or normalizes the malicious gradient before submission may evade the interquartile-range trigger. The paper does not evaluate this countermeasure.","Their multi-target experiment shows success falls by roughly 45% as the number of simultaneous targets grows from 1 to 9; an untested extension is whether that decay comes from overlapping influential-sample sets or from a fixed perturbation budget, which would decide whether group-targeting attacks can be scaled up in practice.","The much lower success on the tabular credit-score data (55%) than on image data suggests the feature-shift perturbation is the binding constraint; testing FedMUA on embedding-based tabular models would clarify whether this gap is a property of the data or of the model."],"forward_implications":["Existing federated unlearning pipelines are exposed to a new attacker: one malicious client can single out a user from another client through legitimate-looking unlearning requests, without poisoning training data.","Byzantine-robust aggregation rules such as coordinate-wise median, trimmed mean, and Krum do not stop the attack, because the malicious signal enters after aggregation through the unlearning channel.","Attack success is tunable: raising the fraction of malicious unlearning requests from 0.3% to 10% pushes reported success to 100%, so the threat grows with the attacker's request budget.","The proposed gradient-scaling defense reduces average attack success by roughly half when the shrinking factor is $\\lambda=0.1$, showing the vulnerability is mitigated but not closed, and that defenses should audit the unlearning request stream."],"supporting_citations":[{"why":"It supplies the influence-function formula (Eq. 6) that Influential Sample Identification uses to rank the attacker's training samples by their effect on the target loss.","marker":"[14]"},{"why":"It provides the client-level federated unlearning baseline that the attack is evaluated against and whose unlearning step the malicious requests exploit.","marker":"[10]"},{"why":"It provides the asynchronous clustered federated unlearning baseline that the attack is evaluated against.","marker":"[11]"},{"why":"It defines FedAvg, the non-robust aggregation rule whose gradients the attack manipulates and the defense inspects.","marker":"[38]"},{"why":"It defines the coordinate-wise median and trimmed-mean Byzantine-robust aggregators tested against the attack.","marker":"[39]"},{"why":"It defines Krum, the distance-based robust aggregator tested as a target of the attack.","marker":"[40]"},{"why":"It provides the hidden-poison baseline that the paper extends to federated learning and shows to be far weaker than FedMUA.","marker":"[19]"},{"why":"It provides the selective-forgetting attack baseline that FedMUA is compared against.","marker":"[21]"},{"why":"It supplies the interquartile-range outlier rule used by the paper's defense to flag malicious unlearning gradients.","marker":"[35]"}],"fun_headline_variants":["Malicious unlearning flips federated predictions 80% of the time","Federated learning flaw: 0.3% bad requests flip a user's label","Attacker hijacks federated unlearning to flip target predictions","Malicious unlearning attack: 80% success with tiny request rate","Flipping predictions in federated learning via malicious unlearning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the influence ranking computed on the attacker's own local model still identifies, after server aggregation, the samples whose unlearning flips the global model's prediction on the target sample.","fun_headline_variants_meta":{"raw":{"variants":["Malicious unlearning flips federated predictions 80% of the time","Federated learning flaw: 0.3% bad requests flip a user's label","Attacker hijacks federated unlearning to flip target predictions","Malicious unlearning attack: 80% success with tiny request rate","Flipping predictions in federated learning via malicious unlearning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000234,"raw_usage":{"total_tokens":1559,"prompt_tokens":1072,"completion_tokens":487,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":688,"completion_tokens_details":{"reasoning_tokens":390}},"tokens_in":688,"tokens_out":487,"duration_ms":4643,"temperature":1.0,"reasoning_tokens":390,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T17:48:06.569800+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run FedMUA with Influential Sample Identification replaced by an equal-size random selection of same-label samples while keeping Malicious Unlearning Generation identical; the authors report that this random baseline collapses to near-zero attack success on MNIST and to roughly 20% on CIFAR-10. Any federated setup where the random baseline matches or exceeds FedMUA's success would show that the influence-ranking premise, rather than the unlearning mechanism, is what carries the attack.","supporting_citations":[{"cited_title":"Understanding black-box predictions via influence functions,","cited_arxiv_id":null,"evidence_quote":"It supplies the influence-function formula (Eq. 6) that Influential Sample Identification uses to rank the attacker's training samples by their effect on the target loss."},{"cited_title":"Federaser: Enabling efficient client-level data removal from federated learning models,","cited_arxiv_id":null,"evidence_quote":"It provides the client-level federated unlearning baseline that the attack is evaluated against and whose unlearning step the malicious requests exploit."},{"cited_title":"Communication-efficient learning of deep networks from decentralized data,","cited_arxiv_id":null,"evidence_quote":"It defines FedAvg, the non-robust aggregation rule whose gradients the attack manipulates and the defense inspects."},{"cited_title":"Byzantine-robust dis- tributed learning: Towards optimal statistical rates,","cited_arxiv_id":null,"evidence_quote":"It defines the coordinate-wise median and trimmed-mean Byzantine-robust aggregators tested against the attack."},{"cited_title":"Machine learning with adversaries: Byzantine tolerant gradient descent,","cited_arxiv_id":null,"evidence_quote":"It defines Krum, the distance-based robust aggregator tested as a target of the attack."},{"cited_title":"Hidden poison: Machine unlearning enables camouflaged poisoning attacks,","cited_arxiv_id":null,"evidence_quote":"It provides the hidden-poison baseline that the paper extends to federated learning and shows to be far weaker than FedMUA."},{"cited_title":"Static and sequential malicious attacks in the context of selective forgetting,","cited_arxiv_id":null,"evidence_quote":"It provides the selective-forgetting attack baseline that FedMUA is compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It supplies the interquartile-range outlier rule used by the paper's defense to flag malicious unlearning gradients."}],"review_version":1}