Pith. sign in

REVIEW 5 major objections 5 minor 40 references

Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated Unlearning

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Per-sample gradient-difference proof-of-unlearning can be inverted to reconstruct the forgotten data.

desk verdict The attack is real under its own threat model, but the paper never shows that any actual verifiable FU protocol emits the per-sample gradient differences it needs, so treat the external claim as conditional. read the letter →

arxiv 2505.11097 v1 pith:DGH5BTWS submitted 2025-05-16 cs.CR

Fuyao Zhang , Wenjie Li , Yurong Hao , Xinyu Yan , Yang Cao , Wei Yang Bryan Lim This is my paper · ORCID
classification cs.CR
keywords federatedunlearninggradientinversionattackproofofdatareconstructionprivacysingularvaluedecompositionorthogonalobfuscationmachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that the very artifact meant to prove that data has been forgotten—the per-sample gradient difference between the original model and the unlearned model—can be inverted to recover the forgotten images. If true, verifiable federated unlearning as currently practiced is not just ineffective at protecting privacy but actively leaks the data it claims to erase, because the auditor who checks the proof can also read what was deleted. The proposed attack, IGF, trains a pixel-level network on gradient differences computed from an auxiliary dataset, uses SVD to compress the high-dimensional differences, and then reconstructs whole batches of forgotten samples from a single proof. Experiments across four image datasets and two model architectures report high-fidelity reconstructions under both exact and approximate unlearning, along with a defense that restores privacy by randomizing proof directions while keeping the norm auditors verify.

What carries the argument

The load-bearing object is the per-sample gradient difference $\Delta g_j = \nabla_\theta \ell(M(x_j;\theta), y_j) - \nabla_\theta \ell(uM(x_j;\theta'), y_j)$ between the original and unlearned models. The paper argues this vector retains enough directional information about $(x_j, y_j)$ that a learned map can recover the image. The machinery that makes the map practical is (i) an SVD projection of the matrix of auxiliary gradient differences onto its top $k$ right-singular vectors, chosen by explained variance, which cuts the input dimension from the full parameter count to a few hundred; and (ii) a pixel-level convolutional inversion network with PixelShuffle upsampling, trained with a composite loss $L_{\text{attack}} = L_M + \beta L_P$ combining pixel MSE and a VGG-based perceptual term. The defense uses the same object: replacing each $\Delta g_j$ with a random vector orthogonal to it, via Gram-Schmidt, preserves the L2 norm used for audit checks while destroying the directional correlation the inversion model depends on.

What would settle it

Take a deployed verifiable FU protocol whose PoFU is one aggregated gradient-difference vector per client (or a signed/quantized summary) and run IGF against it; if reconstruction fidelity on its proofs is no better than random noise on the same datasets, the paper's central claim that gradient-difference proofs enable reconstruction fails for that protocol.

Watch

Extended reading notes

Core claim

The paper claims that when a verifiable federated-unlearning protocol uses per-sample gradient differences as proof of unlearning, an honest-but-curious auditor who can query both the original and the unlearned model on auxiliary data can train a pixel-level inversion network to map those differences back to the forgotten images. The inversion network is made practical by projecting the high-dimensional gradient differences onto the top singular vectors of the auxiliary difference matrix, which concentrates the signal and suppresses redundancy, and by training with a composite loss that combines pixel-wise MSE with a VGG-based perceptual term. With this machinery the paper reports reconstructing batches of 1000 forgotten samples per client PoFU on CIFAR-10 with substantially lower MSE and better perceptual similarity than the existing centralized-unlearning inversion baseline, and similar success on CIFAR-100, MNIST, and Fashion-MNIST under both exact and approximate unlearning. The paper introduces a matching defense that randomizes each proof vector's direction while preserving its L2 norm, so that auditors can still verify the norm bound but the inversion network outputs only noise.

Load-bearing premise

The attack only works if the auditor actually receives per-sample gradient differences as the proof and is allowed to query both models' gradients on an auxiliary dataset; if real protocols aggregate, mask, or refuse such queries, the reconstruction channel does not open.

Editorial extensions

If this is right

  • A verifiable FU protocol that emits per-sample gradient differences as proofs cannot be considered privacy-preserving against an auditor with auxiliary data and model-query access.
  • Because the inversion model maps a whole proof at once, a single PoFU containing many sample gradients can leak hundreds or thousands of forgotten images, not just one.
  • Approximate unlearning methods that use gradient ascent do not close the gap; the paper reports only modest quality loss compared to exact retraining, so approximate forgetting still leaks.
  • The five common gradient defenses evaluated (pruning, sign compression, Gaussian noise, perturbation, smoothing) leave reconstruction largely intact, whereas the proposed orthogonal obfuscation collapses reconstructions to noise.
  • Reconstruction quality depends on global model architecture; deeper networks like ResNet20 weaken but do not eliminate the leak.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An unstated consequence is that the safest protocol-level fix is to certify unlearning with aggregated statistics rather than individual gradient differences; the paper does not evaluate this fix.
  • The same learn-to-invert recipe should apply to any per-sample difference signal, such as parameter updates between federated rounds or fine-tuning deltas, so the leak is likely a general property of linear per-sample updates rather than a quirk of PoFU formats.
  • The orthogonal defense preserves only the L2 norm, so an audit protocol that verifies direction or distributional properties of proofs would need a different defense, and an adversary could potentially exploit the defense's own random vectors if the random seed is shared or predictable.
  • A direct extension would be to test IGF on a deployed protocol with real proof formats; if those proofs are aggregated, the attack would require a different inversion model and the reported fidelity numbers would not transfer.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper studies privacy leakage in federated unlearning (FU) when the Proof of Federated Unlearning (PoFU) is issued as per-sample gradient differences between the original and the unlearned model. The authors propose a learning-based reconstruction attack, IGF, which trains a pixel-level inversion network on an auxiliary dataset using SVD-projected gradient differences and a composite MSE plus VGG-perceptual loss. IGF is evaluated on CIFAR-10, CIFAR-100, MNIST, and Fashion-MNIST under exact and approximate FU and under sample-, class-, and client-level unlearning. The paper also proposes an orthogonal obfuscation defense that perturbs the direction of gradient differences while preserving their L2 norm. The authors report large MSE reductions and LPIPS improvements compared with the GIAMU baseline and provide visual reconstructions.

Significance. If the threat model is accepted, the paper identifies a new attack surface in verifiable federated unlearning: an honest-but-curious auditor with auxiliary data and model-query access can train an inversion model to reconstruct forgotten samples from per-sample gradient-difference PoFU. The method is technically sound in its internal mechanics, the ablations are reasonably thorough, and the code is released. The significance is tempered by the fact that the modeled PoFU format is not tied to a concrete existing protocol, and the quantitative claims rely on a single seed and an out-of-setting baseline comparison.

major comments (5)
  1. [§3.1 (Eq. (2))] The paper defines PoFU as per-sample gradient differences Δg_j = ∇θℓ(M(x_j;θ_T),y_j) − ∇θℓ(uM(x_j;θ′),y_j) and verification as ∥Δg_j∥₂≤τ without demonstrating that any cited verifiable FU protocol (refs [5]–[8]) actually emits this format to the auditor. If these protocols disclose aggregated updates, commitments, or zero-knowledge proofs, the auditor never sees the per-sample Δg that IGF's inversion model consumes, so the attack surface described in the abstract may not exist in practice. Moreover, this verification rule is not a sound proof of unlearning: a client can submit Δg_j=0 and pass, so the modeled protocol is at best a hypothesized message format. The authors should either identify a concrete existing protocol with this format or explicitly scope the claim as a conditional vulnerability.
  2. [§4.2, Table 1] All GIAMU numbers are taken from [16] rather than rerun in the authors' federated unlearning setup. This is not a controlled comparison: the FU scenario, number of forgotten samples, global model, and data partitions differ from those in [16]. The reported 88% MSE reduction and roughly 33% LPIPS improvement are therefore not established on a level playing field. The authors should reimplement GIAMU under the same settings or remove the direct comparison claims.
  3. [§4.1, Table 1] All experiments are run with a fixed random seed of 1234 and no repeated trials, so Tables 1 and 2 report single samples without variance. Given the stochasticity in FL training, unlearning, and inversion-model training, the numerical improvements over baselines may not be stable. At least 3–5 seeds with mean±std should be reported for the main reconstruction tables.
  4. [Abstract, Table 1] The abstract promises 'high-fidelity reconstruction of large-scale samples,' but Table 1 shows PSNR of roughly 17 dB on CIFAR-10 and 14–16 dB on CIFAR-100, which are well below typical high-fidelity thresholds (often >25 dB). The visual examples in Figure 4 are visibly blurry. The wording should be moderated or supported by additional evidence, such as a human evaluation or examples at substantially higher PSNR.
  5. [§3.3, §4.2 (Orthogonal Obfuscation Defense)] The orthogonal obfuscation defense is evaluated only visually (Figure 5); no quantitative metrics (MSE/PSNR/LPIPS) are reported under the defense. The abstract claims 'robustness of the defense,' but without numbers this is not established. The paper should report the reconstruction metrics under the defense and clarify how much utility remains for the auditor's verification, especially since the proposed defense preserves only the L2 norm.
minor comments (5)
  1. [§4.2] The heading 'Comparison with Basline' contains a typo and should read 'Comparison with Baseline.'
  2. [§4.2] The text refers to 'Fashion-MINST'; the correct dataset name is 'Fashion-MNIST.'
  3. [Figure 8(b)] The y-axis label of Figure 8(b) appears as 'PS/glyph1197R'; the PSNR label is corrupted and should be rendered as 'PSNR.'
  4. [§C.1] The sentence 'affect the p of reconstruction attacks' is missing a word and should read 'affect the performance of reconstruction attacks.'
  5. [Appendix A] The limitation statement about black-box settings in Appendix A is useful and should be referenced in the main text, since it materially scopes the attack's applicability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the IGF inversion model is trained on auxiliary gradient-difference/image pairs and evaluated on held-out forgotten samples, so the central result is not derived from its own target data.

full rationale

The paper's derivation chain is an empirical attack pipeline: the auditor defines PoFU as per-sample gradient differences (Section 3.1), queries gradients of auxiliary data from the original and unlearned models (Eq. 3), trains an inversion model to map projected gradient differences to images (Eqs. 6-8), and then applies that trained model to PoFU gradient differences to reconstruct forgotten samples (Eq. 9). The forgotten samples are not used to fit the inversion model; the auxiliary dataset provides the training pairs and the evaluation is on held-out forgotten samples, so the main claim is not equivalent to its inputs by construction. The only self-reference is the citation of the authors' prior work [11] for the taxonomy of unlearning scenarios (sample-level, class-level, client-level), which is a definitional convenience and is not load-bearing for the reconstruction result. The comparison with GIAMU uses numbers sourced from [16] rather than reimplementation, and the threat model assumes a per-sample gradient-difference PoFU format that the cited Verifiable FU protocols may not actually emit; these are correctness and soundness concerns about the attack's applicability, not circularity. No step in the paper reduces a prediction to a fitted parameter or to a self-citation chain. Therefore the paper is self-contained with respect to its empirical reconstruction claim and receives a circularity score of 0.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central attack rests on two hand-chosen hyperparameters (β, ν) and three domain assumptions about PoFU format, auditor query access, and SVD subspace transfer. No new physical or conceptual entities are postulated. These items determine whether the reported attack works outside the paper's exact setup.

free parameters (2)
  • β (perceptual loss weight) = Not stated for the main table; ablated over {0.1, 1.0, 2.0} in Appendix C.5
    Eq. (6) defines L_attack = L_M + β L_P; the default used in Table 1 is not reported, and reconstruction quality depends on this hand-chosen trade-off.
  • ν (SVD cumulative variance threshold) = ≈0.95 (Appendix C.4 says 'e.g., 95%')
    Eq. (5) selects the smallest k whose cumulative variance reaches ν; this decides how much gradient-difference signal survives projection before inversion.
assumptions (3)
  • domain assumption PoFU is emitted as per-sample gradient differences between the original and unlearned models.
    Section 3.1 defines ∆g element-wise for each sample in the forgotten set. The attack and defense both operate on this exact format.
  • domain assumption The auditor can query both the original and unlearned models for arbitrary auxiliary inputs and holds a relevant auxiliary dataset.
    Threat Assumption in Section 3.1 grants gray-box collusion with the server and possession of Daux. Without these queries, the inversion model has no training signal.
  • domain assumption The SVD subspace computed from auxiliary gradient differences captures the informative directions of the target PoFU vectors.
    Eqs. (4)-(5) build V[k] from Daux and Eq. (9) projects each target PoFU with the same V[k]; target signal outside that subspace is discarded before inversion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated Unlearning." pith.science (2026). https://pith.science/paper/DGH5BTWS

@misc{pith2026250511097,
  author       = {Pith},
  title        = {Pith review of: Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DGH5BTWS}},
  note         = {Machine review of arXiv:2505.11097}
}
read the original abstract

Federated Unlearning (FU) has emerged as a critical compliance mechanism for data privacy regulations, requiring unlearned clients to provide verifiable Proof of Federated Unlearning (PoFU) to auditors upon data removal requests. However, we uncover a significant privacy vulnerability: when gradient differences are used as PoFU, honest-but-curious auditors may exploit mathematical correlations between gradient differences and forgotten samples to reconstruct the latter. Such reconstruction, if feasible, would face three key challenges: (i) restricted auditor access to client-side data, (ii) limited samples derivable from individual PoFU, and (iii) high-dimensional redundancy in gradient differences. To overcome these challenges, we propose Inverting Gradient difference to Forgotten data (IGF), a novel learning-based reconstruction attack framework that employs Singular Value Decomposition (SVD) for dimensionality reduction and feature extraction. IGF incorporates a tailored pixel-level inversion model optimized via a composite loss that captures both structural and semantic cues. This enables efficient and high-fidelity reconstruction of large-scale samples, surpassing existing methods. To counter this novel attack, we design an orthogonal obfuscation defense that preserves PoFU verification utility while preventing sensitive forgotten data reconstruction. Experiments across multiple datasets validate the effectiveness of the attack and the robustness of the defense. The code is available at https://anonymous.4open.science/r/IGF.

Figures

Figures reproduced from arXiv: 2505.11097 by the authors.

Figure 1
Figure 1. Audition in verifiable FU The widespread adoption of Federated Learning (FL) en￾ables distributed entities, such as financial institutions, healthcare providers, and IoT networks, to collaboratively train models without sharing raw data. This decentral￾ized approach mitigates risks associated with data transfer, enhancing privacy and security for data owners. How￾ever, compliance with regulations like the right to b… view at source ↗
Figure 2
Figure 2. Schematic overview of IGF framework. A. Learning Phase: Clients collaboratively train the global model via FL. B. Unlearning Phase: The unlearned clients are required to forget specific data contributions and submit the proof of federated unlearning (PoFU). C. Verification & Attack Phase: The honest-but-curious auditor verifies PoFUs, while attempting to infer forgotten data using a pre-trained inversion model I. cl… view at source ↗
Figure 3
Figure 3. Schematic of or￾thogonal obfuscation defense For each PoFU ∆g(ni) of unlearned client i, i needs to modify the direction of each entry ∆g(ni) j but maintain its L2-norm. We intro￾duce random vectors r (ni) that are orthogonal to ∆g(ni) element￾wisely. The construction begins by sampling an initial random vector r (ni) j with the same dimensionality as ∆g(ni) j , drawn from a stan￾dard normal distribution r (ni) j ∼ … view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Original forgotten images and our reconstructed images on the CIFAR-10 dataset when the [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Forgotten images and our reconstructed images on the CIFAR-10 dataset under Orthogonal [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Forgotten images and our reconstructed images using our inversion model across different [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: The reconstruction performance under different federated aggregation methods. [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: The reconstruction performance with different auxiliary dataset sizes. [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: Comparison of the reconstruction effectiveness with applying SVD and Hash dimensionality [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]
Figure 10
Figure 10. Figure 10: The reconstruction performance under different [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: Architecture of the proposed pixel-level inversion model. [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]
Figure 12
Figure 12. Figure 12: Forgotten and reconstructed images on MNIST and Fashion-MNIST within 1,000 ran [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]
Figure 13
Figure 13. Figure 13: Forgotten and reconstructed images on CIFAR-100. [PITH_FULL_IMAGE:figures/full_fig_p018_13.png]
Figure 14
Figure 14. Figure 14: Forgotten and reconstructed images on CIFAR-10 for the unlearned class (car). [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 23 canonical work pages

  1. [16]

    Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning

    Hongsheng Hu, Shuo Wang, Tian Dong, and Minhui Xue. Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning. In 2024 IEEE Symposium on Security and Privacy (SP), pages 3257–3275. IEEE, 2024

    work page 2024

  2. [5]

    Verifi: Towards verifiable federated unlearning

    Xiangshan Gao, Xingjun Ma, Jingyi Wang, Youcheng Sun, Bo Li, Shouling Ji, Peng Cheng, and Jiming Chen. Verifi: Towards verifiable federated unlearning. IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  3. [8]

    In29th USENIX security symposium (USENIX Security 20), pages 1291–1308, 2020

    Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang.{Updates- Leak}: Data set inference and reconstruction attacks in online learning. In29th USENIX security symposium (USENIX Security 20), pages 1291–1308, 2020

    work page 2020

  4. [1]

    The right to be forgotten

    Jeffrey Rosen. The right to be forgotten. Stan. L. Rev. Online, 64:88, 2011

    work page 2011

  5. [2]

    The california consumer privacy act: Towards a european-style privacy regime in the united states

    Stuart L Pardau. The california consumer privacy act: Towards a european-style privacy regime in the united states. J. Tech. L. & Pol’y, 23:68, 2018

    2018

  6. [3]

    Federated unlearning

    Gaoyang Liu, Xiaoqiang Ma, Yang Yang, Chen Wang, and Jiangchuan Liu. Federated unlearning. arXiv preprint arXiv:2012.13891, 2020

    arXiv 2012

  7. [4]

    Federated unlearning in financial applications

    Cassandra Lindstrom. Federated unlearning in financial applications. preprints202409.1816, 2024

    work page arXiv 2024

  8. [6]

    Proof of unlearning: Definitions and instantiation

    Jiasi Weng, Shenglong Yao, Yuefeng Du, Junjie Huang, Jian Weng, and Cong Wang. Proof of unlearning: Definitions and instantiation. IEEE Transactions on Information Forensics and Security, 19:3309–3323, 2024

    work page 2024

Show all 40 references
  1. [7]

    Feder- ated learning with blockchain-enhanced machine unlearning: A trustworthy approach

    Xuhan Zuo, Minghao Wang, Tianqing Zhu, Lefeng Zhang, Shui Yu, and Wanlei Zhou. Feder- ated learning with blockchain-enhanced machine unlearning: A trustworthy approach. IEEE Transactions on Services Computing, pages 1–15, 2025

    2025

  2. [9]

    Federated unlearning with knowledge distillation

    Chen Wu, Sencun Zhu, and Prasenjit Mitra. Federated unlearning with knowledge distillation. arXiv preprint arXiv:2201.09441, 2022

    2022 arXiv

  3. [10]

    Federated unlearning via class-discriminative pruning

    Junxiao Wang, Song Guo, Xin Xie, and Heng Qi. Federated unlearning via class-discriminative pruning. In Proceedings of the ACM web conference 2022, pages 622–632, 2022

    2022

  4. [11]

    Unlearning through knowledge overwriting: Reversible federated unlearning via selective sparse adapter

    Zhengyi Zhong, Weidong Bao, Ji Wang, Shuai Zhang, Jingxuan Zhou, Lingjuan Lyu, and Wei Yang Bryan Lim. Unlearning through knowledge overwriting: Reversible federated unlearning via selective sparse adapter. arXiv preprint arXiv:2502.20709, 2025

    2025 arXiv

  5. [12]

    When the curious abandon honesty: Federated learning is not private

    Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 175–199. IEEE, 2023

    2023

  6. [13]

    Privacy-preserving federated learning with malicious clients and honest-but-curious servers

    Junqing Le, Di Zhang, Xinyu Lei, Long Jiao, Kai Zeng, and Xiaofeng Liao. Privacy-preserving federated learning with malicious clients and honest-but-curious servers. IEEE Transactions on Information Forensics and Security, 18:4329–4344, 2023

    2023

  7. [14]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019

    2019

  8. [15]

    Inverting gradients- how easy is it to break privacy in federated learning?Advances in neural information processing systems, 33:16937–16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients- how easy is it to break privacy in federated learning?Advances in neural information processing systems, 33:16937–16947, 2020

    2020

  9. [17]

    On the necessity of auditable algorithmic definitions for machine unlearning

    Anvith Thudi, Hengrui Jia, Ilia Shumailov, and Nicolas Papernot. On the necessity of auditable algorithmic definitions for machine unlearning. In 31st USENIX Security Symposium (USENIX Security 22), pages 4007–4022, Boston, MA, August 2022. USENIX Association. 10

    2022

  10. [18]

    Auditing privacy defenses in federated learning via generative gradient leakage

    Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Auditing privacy defenses in federated learning via generative gradient leakage. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10132–10142, 2022

    2022

  11. [19]

    The right to be forgotten in feder- ated learning: An efficient realization with rapid retraining

    Yi Liu, Lei Xu, Xingliang Yuan, Cong Wang, and Bo Li. The right to be forgotten in feder- ated learning: An efficient realization with rapid retraining. In IEEE INFOCOM 2022-IEEE conference on computer communications, pages 1749–1758. IEEE, 2022

    2022

  12. [20]

    Federated unlearning: How to efficiently erase a client in fl?, 2022

    Anisa Halimi, Swanand Kadhe, Ambrish Rawat, and Nathalie Baracaldo. Federated unlearning: How to efficiently erase a client in fl?, 2022. URL https://arxiv. org/abs/2207.05521, 2022

    2022 arXiv

  13. [21]

    Fedu: Federated unlearning via user-side influence approximation forgetting

    Weiqi Wang, Chenhan Zhang, Zhiyi Tian, and Shui Yu. Fedu: Federated unlearning via user-side influence approximation forgetting. IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  14. [22]

    Update selective parameters: Federated machine unlearning based on model explanation

    Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and S Yu Philip. Update selective parameters: Federated machine unlearning based on model explanation. IEEE Transactions on Big Data, 2024

    2024

  15. [23]

    Unlearning during learning: An efficient federated machine unlearning method

    Hanlin Gu, Gongxi Zhu, Jie Zhang, Xinyuan Zhao, Yuxing Han, Lixin Fan, and Qiang Yang. Unlearning during learning: An efficient federated machine unlearning method. arXiv preprint arXiv:2405.15474, 2024

    2024 arXiv

  16. [24]

    Fedmua: Exploring the vulnerabilities of federated learning to malicious unlearning attacks

    Jian Chen, Zehui Lin, Wanyu Lin, Wenlong Shi, Xiaoyan Yin, and Di Wang. Fedmua: Exploring the vulnerabilities of federated learning to malicious unlearning attacks. IEEE Transactions on Information Forensics and Security, 2025

    2025

  17. [25]

    Poisoning attacks and defenses to federated unlearning

    Wenbin Wang, Qiwen Ma, Zifan Zhang, Yuchen Liu, Zhuqing Liu, and Minghong Fang. Poisoning attacks and defenses to federated unlearning. arXiv preprint arXiv:2501.17396, 2025

    2025 arXiv

  18. [26]

    Generative gradient inversion via over-parameterized networks in federated learning

    Chi Zhang, Zhang Xiaoman, Ekanut Sotthiwat, Yanyu Xu, Ping Liu, Liangli Zhen, and Yong Liu. Generative gradient inversion via over-parameterized networks in federated learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 5126–5135, 2023

    2023

  19. [27]

    Gradient inversion with generative image prior

    Jinwoo Jeon, Kangwook Lee, Sewoong Oh, Jungseul Ok, et al. Gradient inversion with generative image prior. Advances in neural information processing systems, 34:29898–29908, 2021

    2021

  20. [28]

    Gifd: A generative gradi- ent inversion method with feature domain optimization

    Hao Fang, Bin Chen, Xuan Wang, Zhi Wang, and Shu-Tao Xia. Gifd: A generative gradi- ent inversion method with feature domain optimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4967–4976, 2023

    2023

  21. [29]

    Yu Sun, Gaojian Xiong, Xianxun Yao, Kailang Ma, and Jian Cui. Gi-pip: Do we require impractical auxiliary dataset for gradient inversion attacks? In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 4675–

    2024

  22. [30]

    Learning to invert: Simple adaptive attacks for gradient inversion in federated learning

    Ruihan Wu, Xiangyu Chen, Chuan Guo, and Kilian Q Weinberger. Learning to invert: Simple adaptive attacks for gradient inversion in federated learning. In Uncertainty in Artificial Intelligence, pages 2293–2303. PMLR, 2023

    2023

  23. [31]

    Communication-efficient learning of deep networks from decentralized data

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017

    2017

  24. [32]

    In Encyclopedia of Mathematics

    Orthogonalization. In Encyclopedia of Mathematics . EMS Press, 2001. https:// encyclopediaofmath.org/wiki/Orthogonalization

    2001

  25. [33]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Placeholder Journal, 2009

    2009

  26. [34]

    Gradient-based learning applied to document recognition

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998. 11

    1998

  27. [35]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms

    Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  28. [36]

    The unrea- sonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018

    2018

  29. [37]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  30. [38]

    Federated optimization in heterogeneous networks

    Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429–450, 2020

    2020

  31. [39]

    Adaptive federated optimization

    Sashank Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Koneˇcn`y, Sanjiv Kumar, and H Brendan McMahan. Adaptive federated optimization. arXiv preprint arXiv:2003.00295, 2020

    2003 arXiv

  32. [40]

    Feature hashing for large scale multitask learning

    Kilian Weinberger, Anirban Dasgupta, John Langford, Alex Smola, and Josh Attenberg. Feature hashing for large scale multitask learning. In Proceedings of the 26th annual international conference on machine learning, pages 1113–1120, 2009. 12 A Discussion and Limitations To the...

    2009

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.