{"id":"567a1e32-34ae-43b6-bbf0-86a8ad42403c","arxiv_id":"2505.11097","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Gradient differences submitted as proof of federated unlearning leak enough information for a trained inversion model to reconstruct the supposedly forgotten images.","lead":"A new attack shows that the per-sample gradient differences some systems use as proof of unlearning in federated learning can be inverted to reconstruct forgotten images. The paper also proposes an obfuscation defense, so it matters to anyone building privacy-compliance mechanisms where deletion proofs are required.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The attack requires a per-sample gradient-difference PoFU format and auditor model-query access; the paper does not show that cited verifiable FU protocols provide either.","rationale":"Reader's CONDITIONAL is the right verdict. My stress-test converges on the same load-bearing assumption: the existence of verifiable FU protocols that hand the auditor raw per-sample gradient differences and model-query access. Without that, the IGF inversion model has no input in real deployments. The paper's Section 3.1 verification rule is also not a sound proof (the zero vector passes), which underscores that the modeled PoFU is not established as a real protocol message. I do not see an internal contradiction in the reconstruction method itself: given per-sample Δg and paired auxiliary gradients, a supervised inversion model is a reasonable attack, and the experiments are consistent with that claim. The main uncertainty is external validity, so the verdict stays CONDITIONAL rather than ACCEPT or REJECT. Secondary observation: the orthogonal obfuscation defense in Eq. (10) does not preserve the L2 norm of Δg as claimed—Gram-Schmidt projection changes the norm—so the defense's verification-utility claim also needs correction; this does not alter the conditional verdict but should be fixed.","tokens_in":14818,"tokens_out":11267,"duration_ms":120400,"concrete_test":"Inspect the PoFU message formats defined in VeriFI [5] and 'Proof of Unlearning' [6] (and, if needed, [7,8]); check whether the auditor receives per-sample gradient differences Δg_j or only an aggregate/commitment/ZKP. If no cited protocol exposes per-sample Δg, re-run the IGF pipeline on the actual message of one of those protocols and report reconstruction fidelity; if fidelity collapses, the central claim should be scoped to the hypothetical per-sample PoFU format rather than to verifiable FU as deployed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on the PoFU payload being raw per-sample gradient differences. Section 3.1 defines PoFU as Δg_j = ∇θℓ(M(x_j;θ_T),y_j) − ∇θℓ(uM(x_j;θ′),y_j), and the verification is merely ∥Δg_j∥_2 ≤ τ. This is not a sound proof of unlearning: an unlearned client can submit Δg_j = 0 and pass, so the modeled protocol is at best a hypothesized message format. The paper cites [5–8] but never shows that any of those verifiable FU protocols discloses per-sample gradient differences to the auditor; they may release aggregated updates, commitments, or zero-knowledge proofs. The attack additionally requires the auditor to collude with the server to query gradients of arbitrary samples from both M and uM (Threat Assumption, §3.1), an access model that is not established for the cited protocols. If real PoFU is aggregated or ZKP-based, the auditor never sees the per-sample Δg that the IGF inversion model consumes, and the abstract's claim that 'gradient differences ... enable data reconstruction in federated unlearning' loses its target. This is not a flaw in the inversion network itself—the experiments are internally plausible—but it is the load-bearing external assumption on which the contribution rests.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies privacy leakage in federated unlearning (FU) when the Proof of Federated Unlearning (PoFU) is issued as per-sample gradient differences between the original and the unlearned model. The authors propose a learning-based reconstruction attack, IGF, which trains a pixel-level inversion network on an auxiliary dataset using SVD-projected gradient differences and a composite MSE plus VGG-perceptual loss. IGF is evaluated on CIFAR-10, CIFAR-100, MNIST, and Fashion-MNIST under exact and approximate FU and under sample-, class-, and client-level unlearning. The paper also proposes an orthogonal obfuscation defense that perturbs the direction of gradient differences while preserving their L2 norm. The authors report large MSE reductions and LPIPS improvements compared with the GIAMU baseline and provide visual reconstructions.","tokens_in":15026,"tokens_out":6102,"duration_ms":58665,"significance":"If the threat model is accepted, the paper identifies a new attack surface in verifiable federated unlearning: an honest-but-curious auditor with auxiliary data and model-query access can train an inversion model to reconstruct forgotten samples from per-sample gradient-difference PoFU. The method is technically sound in its internal mechanics, the ablations are reasonably thorough, and the code is released. The significance is tempered by the fact that the modeled PoFU format is not tied to a concrete existing protocol, and the quantitative claims rely on a single seed and an out-of-setting baseline comparison.","major_comments":[{"comment":"The paper defines PoFU as per-sample gradient differences Δg_j = ∇θℓ(M(x_j;θ_T),y_j) − ∇θℓ(uM(x_j;θ′),y_j) and verification as ∥Δg_j∥₂≤τ without demonstrating that any cited verifiable FU protocol (refs [5]–[8]) actually emits this format to the auditor. If these protocols disclose aggregated updates, commitments, or zero-knowledge proofs, the auditor never sees the per-sample Δg that IGF's inversion model consumes, so the attack surface described in the abstract may not exist in practice. Moreover, this verification rule is not a sound proof of unlearning: a client can submit Δg_j=0 and pass, so the modeled protocol is at best a hypothesized message format. The authors should either identify a concrete existing protocol with this format or explicitly scope the claim as a conditional vulnerability.","section":"§3.1 (Eq. (2))"},{"comment":"All GIAMU numbers are taken from [16] rather than rerun in the authors' federated unlearning setup. This is not a controlled comparison: the FU scenario, number of forgotten samples, global model, and data partitions differ from those in [16]. The reported 88% MSE reduction and roughly 33% LPIPS improvement are therefore not established on a level playing field. The authors should reimplement GIAMU under the same settings or remove the direct comparison claims.","section":"§4.2, Table 1"},{"comment":"All experiments are run with a fixed random seed of 1234 and no repeated trials, so Tables 1 and 2 report single samples without variance. Given the stochasticity in FL training, unlearning, and inversion-model training, the numerical improvements over baselines may not be stable. At least 3–5 seeds with mean±std should be reported for the main reconstruction tables.","section":"§4.1, Table 1"},{"comment":"The abstract promises 'high-fidelity reconstruction of large-scale samples,' but Table 1 shows PSNR of roughly 17 dB on CIFAR-10 and 14–16 dB on CIFAR-100, which are well below typical high-fidelity thresholds (often >25 dB). The visual examples in Figure 4 are visibly blurry. The wording should be moderated or supported by additional evidence, such as a human evaluation or examples at substantially higher PSNR.","section":"Abstract, Table 1"},{"comment":"The orthogonal obfuscation defense is evaluated only visually (Figure 5); no quantitative metrics (MSE/PSNR/LPIPS) are reported under the defense. The abstract claims 'robustness of the defense,' but without numbers this is not established. The paper should report the reconstruction metrics under the defense and clarify how much utility remains for the auditor's verification, especially since the proposed defense preserves only the L2 norm.","section":"§3.3, §4.2 (Orthogonal Obfuscation Defense)"}],"minor_comments":[{"comment":"The heading 'Comparison with Basline' contains a typo and should read 'Comparison with Baseline.'","section":"§4.2"},{"comment":"The text refers to 'Fashion-MINST'; the correct dataset name is 'Fashion-MNIST.'","section":"§4.2"},{"comment":"The y-axis label of Figure 8(b) appears as 'PS/glyph1197R'; the PSNR label is corrupted and should be rendered as 'PSNR.'","section":"Figure 8(b)"},{"comment":"The sentence 'affect the p of reconstruction attacks' is missing a word and should read 'affect the performance of reconstruction attacks.'","section":"§C.1"},{"comment":"The limitation statement about black-box settings in Appendix A is useful and should be referenced in the main text, since it materially scopes the attack's applicability.","section":"Appendix A"}],"recommendation":"major_revision","confidential_remarks":"The paper is a competently executed attack study with a clear method and extensive ablations, but its scope is narrower than the abstract suggests because the modeled PoFU format may not match deployed verifiable FU protocols. The authors should be asked to anchor the threat model to a concrete protocol or explicitly frame the work as an attack on a generic gradient-difference PoFU interface. The single-seed experiments and copied baseline weaken the quantitative claims. I would support reconsideration after major revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe interesting bit is the attack surface: gradient differences used as proof of federated unlearning (PoFU). That specific channel hasn't been analyzed before, and the paper makes a reasonable case that if such a proof is expressed as per-sample raw gradients, a curious auditor with auxiliary data can invert them to reconstruct the forgotten samples. The framework is standard learning-to-invert—SVD projection plus a conv net with MSE and VGG perceptual loss—but it is competently put together, and the experiments cover four datasets, two FU methods, and three unlearning granularities. The visual results are convincing enough that the internal mechanism is plausible.\n\nThe soft spot is external validity. Section 3.1 defines PoFU as per-sample gradient differences Δg_j and verification as ∥Δg_j∥₂ ≤ τ. This is a self-defined protocol, and it is a weak one: a client could submit Δg_j = 0 and pass the check, so it is not a sound proof of unlearning. More importantly, the paper cites [5–8] for verifiable FU but never shows that any of those protocols actually discloses per-sample gradient differences to an auditor. They could release aggregated updates, commitments, or zero-knowledge proofs. The attack also requires the auditor to collude with the server to query gradients of arbitrary samples from both the original and unlearned models, an access model that is not established for the cited schemes. If real PoFU does not look like this, the contribution shrinks to a cautionary note about a hypothetical design.\n\nThe evaluation has smaller issues. All results are one seed, no error bars, so we don't know how stable the 17 dB PSNR on CIFAR-10 is. The GIAMU baseline numbers are copied from [16] rather than rerun in the same setting, which makes the 88% MSE improvement less trustworthy. And the proposed orthogonal obfuscation defense is only shown qualitatively—no quantitative metrics—which is thin for a claimed defense.\n\nIs this worth a serious referee? Yes. The question is timely, the attack idea is new, and the paper deserves a chance to address the protocol-assumption problem. But the authors need to either demonstrate that an existing verifiable FU scheme actually exposes this format, or reframe the contribution as 'if you build a PoFU this way, you are vulnerable.' As it stands, the abstract overclaims.\n\nFor your reading group: worth a slot if you discuss security of federated unlearning. I would probably cite it as a cautionary example, with the caveat.\n\nCheers.","headline":"The attack is real under its own threat model, but the paper never shows that any actual verifiable FU protocol emits the per-sample gradient differences it needs, so treat the external claim as conditional.","tokens_in":15611,"tokens_out":4066,"would_cite":true,"duration_ms":39501,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Per-sample gradient-difference proof-of-unlearning can be inverted to reconstruct the forgotten data.","keywords":["federated unlearning","gradient inversion attack","proof of federated unlearning","data reconstruction","privacy attack","singular value decomposition","orthogonal obfuscation","machine unlearning"],"falsifier":"Take a deployed verifiable FU protocol whose PoFU is one aggregated gradient-difference vector per client (or a signed/quantized summary) and run IGF against it; if reconstruction fidelity on its proofs is no better than random noise on the same datasets, the paper's central claim that gradient-difference proofs enable reconstruction fails for that protocol.","tokens_in":14578,"feed_emoji":"🔓","tokens_out":8505,"duration_ms":81461,"temperature":0.7,"pith_summary":"This paper sets out to show that the very artifact meant to prove that data has been forgotten—the per-sample gradient difference between the original model and the unlearned model—can be inverted to recover the forgotten images. If true, verifiable federated unlearning as currently practiced is not just ineffective at protecting privacy but actively leaks the data it claims to erase, because the auditor who checks the proof can also read what was deleted. The proposed attack, IGF, trains a pixel-level network on gradient differences computed from an auxiliary dataset, uses SVD to compress the high-dimensional differences, and then reconstructs whole batches of forgotten samples from a single proof. Experiments across four image datasets and two model architectures report high-fidelity reconstructions under both exact and approximate unlearning, along with a defense that restores privacy by randomizing proof directions while keeping the norm auditors verify.","feed_headline":"Unlearning proofs leak the forgotten data back to auditors","feed_subtitle":"An inversion model turns per-sample gradient-difference proofs into high-fidelity images, even for 1000 samples at once.","key_machinery":"The load-bearing object is the per-sample gradient difference $\\Delta g_j = \\nabla_\\theta \\ell(M(x_j;\\theta), y_j) - \\nabla_\\theta \\ell(uM(x_j;\\theta'), y_j)$ between the original and unlearned models. The paper argues this vector retains enough directional information about $(x_j, y_j)$ that a learned map can recover the image. The machinery that makes the map practical is (i) an SVD projection of the matrix of auxiliary gradient differences onto its top $k$ right-singular vectors, chosen by explained variance, which cuts the input dimension from the full parameter count to a few hundred; and (ii) a pixel-level convolutional inversion network with PixelShuffle upsampling, trained with a composite loss $L_{\\text{attack}} = L_M + \\beta L_P$ combining pixel MSE and a VGG-based perceptual term. The defense uses the same object: replacing each $\\Delta g_j$ with a random vector orthogonal to it, via Gram-Schmidt, preserves the L2 norm used for audit checks while destroying the directional correlation the inversion model depends on.","core_discovery":"The paper claims that when a verifiable federated-unlearning protocol uses per-sample gradient differences as proof of unlearning, an honest-but-curious auditor who can query both the original and the unlearned model on auxiliary data can train a pixel-level inversion network to map those differences back to the forgotten images. The inversion network is made practical by projecting the high-dimensional gradient differences onto the top singular vectors of the auxiliary difference matrix, which concentrates the signal and suppresses redundancy, and by training with a composite loss that combines pixel-wise MSE with a VGG-based perceptual term. With this machinery the paper reports reconstructing batches of 1000 forgotten samples per client PoFU on CIFAR-10 with substantially lower MSE and better perceptual similarity than the existing centralized-unlearning inversion baseline, and similar success on CIFAR-100, MNIST, and Fashion-MNIST under both exact and approximate unlearning. The paper introduces a matching defense that randomizes each proof vector's direction while preserving its L2 norm, so that auditors can still verify the norm bound but the inversion network outputs only noise.","pith_inferences":["An unstated consequence is that the safest protocol-level fix is to certify unlearning with aggregated statistics rather than individual gradient differences; the paper does not evaluate this fix.","The same learn-to-invert recipe should apply to any per-sample difference signal, such as parameter updates between federated rounds or fine-tuning deltas, so the leak is likely a general property of linear per-sample updates rather than a quirk of PoFU formats.","The orthogonal defense preserves only the L2 norm, so an audit protocol that verifies direction or distributional properties of proofs would need a different defense, and an adversary could potentially exploit the defense's own random vectors if the random seed is shared or predictable.","A direct extension would be to test IGF on a deployed protocol with real proof formats; if those proofs are aggregated, the attack would require a different inversion model and the reported fidelity numbers would not transfer."],"forward_implications":["A verifiable FU protocol that emits per-sample gradient differences as proofs cannot be considered privacy-preserving against an auditor with auxiliary data and model-query access.","Because the inversion model maps a whole proof at once, a single PoFU containing many sample gradients can leak hundreds or thousands of forgotten images, not just one.","Approximate unlearning methods that use gradient ascent do not close the gap; the paper reports only modest quality loss compared to exact retraining, so approximate forgetting still leaks.","The five common gradient defenses evaluated (pruning, sign compression, Gaussian noise, perturbation, smoothing) leave reconstruction largely intact, whereas the proposed orthogonal obfuscation collapses reconstructions to noise.","Reconstruction quality depends on global model architecture; deeper networks like ResNet20 weaken but do not eliminate the leak."],"supporting_citations":[{"why":"Cited as the verifiable-federated-unlearning protocols whose proofs are based on gradient differences, grounding the claimed attack surface.","marker":"[5, 6, 7, 8]"},{"why":"Establishes that shared gradients can be inverted to reconstruct training samples, motivating the threat model.","marker":"[14]"},{"why":"Provides the gradient-inversion methodology and the perceptual similarity metric used to evaluate reconstruction fidelity.","marker":"[15]"},{"why":"Supplies the existing unlearning-inversion attack that IGF is compared against and reported to outperform.","marker":"[16]"},{"why":"Supplies adaptive learning-to-invert training techniques and the five common defense mechanisms tested against IGF.","marker":"[30]"},{"why":"Defines the federated averaging procedure used to train the original and unlearned global models.","marker":"[31]"},{"why":"Provides the Gram-Schmidt orthogonalization used to construct the orthogonal obfuscation defense.","marker":"[32]"},{"why":"Defines the VGG-based perceptual loss used in the composite objective for high-fidelity reconstruction.","marker":"[36]"}],"fun_headline_variants":["Federated unlearning proofs leak forgotten images to auditors","Gradient-difference proofs let auditors rebuild erased data","Auditors can invert unlearning proofs to recover erased images","Reconstructing forgotten data from federated unlearning proofs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack only works if the auditor actually receives per-sample gradient differences as the proof and is allowed to query both models' gradients on an auxiliary dataset; if real protocols aggregate, mask, or refuse such queries, the reconstruction channel does not open.","fun_headline_variants_meta":{"raw":{"variants":["Federated unlearning proofs leak forgotten images to auditors","Gradient-difference proofs let auditors rebuild erased data","Auditors can invert unlearning proofs to recover erased images","Reconstructing forgotten data from federated unlearning proofs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000544,"raw_usage":{"total_tokens":2636,"prompt_tokens":1010,"completion_tokens":1626,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":626,"completion_tokens_details":{"reasoning_tokens":1560}},"tokens_in":626,"tokens_out":1626,"duration_ms":11468,"temperature":1.0,"reasoning_tokens":1560,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:58:29.301853+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a deployed verifiable FU protocol whose PoFU is one aggregated gradient-difference vector per client (or a signed/quantized summary) and run IGF against it; if reconstruction fidelity on its proofs is no better than random noise on the same datasets, the paper's central claim that gradient-difference proofs enable reconstruction fails for that protocol.","supporting_citations":[{"cited_title":"Inverting gradients- how easy is it to break privacy in federated learning?Advances in neural information processing systems, 33:16937–16947, 2020","cited_arxiv_id":null,"evidence_quote":"Provides the gradient-inversion methodology and the perceptual similarity metric used to evaluate reconstruction fidelity."},{"cited_title":"Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning","cited_arxiv_id":null,"evidence_quote":"Supplies the existing unlearning-inversion attack that IGF is compared against and reported to outperform."},{"cited_title":"In Encyclopedia of Mathematics","cited_arxiv_id":null,"evidence_quote":"Provides the Gram-Schmidt orthogonalization used to construct the orthogonal obfuscation defense."}],"review_version":1}