Pith. sign in

REVIEW 4 major objections 7 minor 39 references

Upcycling Noise for Federated Unlearning

T0 review · 4 major / 7 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FUI proposes to satisfy the right to be forgotten in differentially private federated learning by retracting the client's local model and calibrating noise to match retraining.

desk verdict The paper's central guarantee is unsupported: Theorem 1 misuses Rényi divergence, and the noise calibration built on it cannot deliver ϵ-indistinguishability. read the letter →

arxiv 2412.05529 v1 pith:4EY6WLSW submitted 2024-12-07 cs.LG cs.CRcs.DC

Jianan Chen , Qin Hu , Fangtian Zhong , Yan Zhuang , Minghui Xu This is my paper · ORCID
classification cs.LGcs.CRcs.DC
keywords federatedunlearningdifferentialprivacylearningindistinguishabilitynoisecalibrationStackelberggameL-BFGSmachine
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes the first federated-unlearning scheme designed for differentially private federated learning (DPFL), where existing unlearning methods fail because DP noise degrades them. The central idea is to treat the DP noise as a resource: after the target client runs L-BFGS loss maximization to 'retract' its local contribution, the noise already injected during training gives a baseline level of indistinguishability from the retrained model. The server then measures the noise gap and adds calibrated Gaussian noise so that the final model is epsilon-indistinguishable from the model that would be obtained by full retraining. The same mechanism is governed by a two-stage Stackelberg game that sets the server's penalty factor and the client's privacy requirement. A sympathetic reader would care because this gives a path to enforce the right to be forgotten in DPFL without engaging all remaining clients.

What carries the argument

The mechanism is the 'upcycling' of DP noise: the noise added at the clients and at the server during DPFL is not discarded but reused to give the retracted model a free level of indistinguishability. The mathematical engine is the link between eta-DP and $eta^{2}$/2-indistinguishability (Theorem 1), the L-BFGS optimizer for loss maximization, and the noise-gap formula g = sigma_tilde_1 - sigma_tilde_2 with calibration scale sigma_cali = $\sqrt$($sigma_tilde_2^{2}$ - $sigma_tilde_1^{2}$). The Stackelberg game supplies the parameter-selection layer that determines when and how much extra noise to add.

What would settle it

Run FUI on a pair of neighboring datasets with a fixed eta, record the retracted model w_LR over many trials, and directly estimate P(w_LR in O) for the two datasets; if the ratio exceeds e^($eta^{2}$/2) for some outcome set O, the baseline indistinguishability on which the calibration rests is contradicted.

Watch

Extended reading notes

Core claim

The paper's central claim is that FUI makes an unlearning model statistically indistinguishable from the retrained model in DPFL. It does so in two steps: local model retraction, in which the target client maximizes its loss with L-BFGS starting from a reference model; and global noise calibration, in which the server checks whether the achieved indistinguishability level $eta^{2}$/2 already meets the requested epsilon and, if not, adds Gaussian noise of scale $\sqrt$($sigma_tilde_2^{2}$ - $sigma_tilde_1^{2}$). Theorem 4 states this guarantees epsilon-indistinguishability, and Theorem 5 gives O(1/T) convergence. The paper further claims that formulating the server-client interaction as a Stackelberg game yields optimal strategies (penalty factor p and privacy requirement epsilon) that balance model utility and privacy benefit.

Load-bearing premise

The entire calibration guarantee rests on the claim that the DP noises already in the system make the locally retracted model $eta^{2}$/2-indistinguishable from the retrained model; if that claim fails, the noise-gap calculation and the added noise do not deliver epsilon-indistinguishability.

Editorial extensions

If this is right

  • A DPFL server can honor a client's erasure request with only the target client and the server participating, avoiding costly full retraining or involvement of other clients.
  • The unlearning model provably meets the epsilon-indistinguishability requirement, so an adversary cannot distinguish it from the retrained model at level epsilon.
  • The Stackelberg-derived choices of p and epsilon give both the server and the target client their best utilities at the Nash equilibrium, making unlearning economically consistent.
  • The DPFL training process remains convergent at rate O(1/T) when FUI is used for unlearning.
  • On the tested benchmarks, FUI keeps accuracy close to retraining and beats FedEraser, FedRecovery, and PGD while running in seconds rather than minutes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If Theorem 1's derivation of eta^2/2 indistinguishability were replaced by a direct Renyi-DP bound, the calibration formulas would need a matching correction; a reader testing the bound numerically on the actual retraction trajectory would settle this.
  • The same 'noise upcycling' idea could be applied to unlearning multiple clients at once, an extension the paper lists as future work; the noise gap would then need to account for the combined retraction of several local models.
  • Because the calibration step only adds Gaussian noise, this scheme is likely compatible with other DP formalisms such as concentrated DP, where the composition of the learning noise and the calibration noise could be tracked analytically.
  • The utility functions in the game contain constants a, b, r, s, l that would need to be measured per deployment; a sensitivity analysis of the Nash equilibrium to those constants would be a natural next check.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. This paper proposes Federated Unlearning with Indistinguishability (FUI) for differentially private federated learning (DPFL). The protocol has two stages: the target client performs local model retraction by maximizing its loss function with L-BFGS starting from a reference model that removes its latest noisy upload, and the server calibrates additional Gaussian noise to make the unlearning model ϵ-indistinguishable from a retrained model. The paper also formulates a two-stage Stackelberg game to choose the privacy parameter ϵ and penalty factor p, proves convergence of the federated learning process, and reports experiments on four datasets. The central claim is that FUI produces a model that is ϵ-indistinguishable from retraining while requiring only the server and target client to participate.

Significance. The problem addressed is important: federated unlearning in DPFL has not been systematically studied, and a scheme that reuses DP noise to avoid full retraining would be practically valuable. The paper provides a concrete protocol, a game-theoretic parameter selection, and a broad experimental comparison including accuracy, loss, runtime, and membership inference attack resistance. These are useful contributions if the privacy guarantee were valid. However, the main theoretical result (Theorem 1) is false, the noise-calibration formulas do not follow from the stated definitions, and the local retraction step does not remove historical influence; as a result, the claimed ϵ-indistinguishability guarantee is not established. The experimental evaluation does not directly test the formal privacy guarantee, so the paper's central claim remains unsupported.

major comments (4)
  1. [Section IV-A, Theorem 1] The statement that η-DP implies η²/2-indistinguishability is false. η-DP only guarantees Pr[X∈O] ≤ e^η Pr[Y∈O] for every event O; the exponent cannot be improved to η²/2 without additional assumptions. The proof's Rényi-divergence manipulation is invalid: from D_α(Y||Y') ≤ η it writes Σ_x (Pr[Y=x]/Pr[Y'=x])^{α−1} ≤ e^{(α−1)η}, but the Rényi divergence is an expectation with weight Pr[Y=x], so the displayed bound does not follow. The subsequent substitutions α−1=η and insertion of the ratio to the power η/2 are also unjustified. A concrete counterexample is randomized response with η=0.1, for which there exists an event whose probability ratio is e^{0.1} > e^{0.005}=e^{η²/2}. Since Theorem 1 is the basis for the η²/2-indistinguishability claim after local retraction, the central argument collapses.
  2. [Section IV-B, Theorem 4] The calibration formulas σ̃1 = √(2d)/(2η) and σ̃2 = d/√ϵ are dimensionally inconsistent (σ̃1 scales as √d while σ̃2 scales as d), and no valid derivation from Definition IV.1 is provided. More fundamentally, Definition IV.1 requires the probability ratio to be bounded by e^ϵ for all subsets Z of the parameter space; for two Gaussian distributions with different means on an unbounded domain, the likelihood ratio is unbounded, so no finite additive Gaussian noise can satisfy the definition. The proof of Theorem 4 attempts to show Pr[M(X)=z] ≤ e^{η²/2} Pr[M(Y)=z] for all z, but the left-to-right ratio is unbounded as z→∞. Thus the global noise calibration step cannot deliver the promised ϵ-indistinguishability.
  3. [Section IV-A, local model retraction] The reference model w_ref = (N w_t − w_t^i)/(N−1) subtracts only the target client's most recent noisy upload w_t^i from the current global model w_t. It does not remove the client's contributions to earlier global models w_1,...,w_{t−1}, nor does it undo the effect of those contributions on the optimization trajectory. Consequently, the premise that w_LR after L-BFGS loss maximization is statistically close to the retrained model w_RE is not established. No argument shows that the L-BFGS procedure is a DP mechanism with w_RE as a neighboring output, and the paper does not address this gap.
  4. [Section V-B, Theorems 2 and 3] The optimal strategy formulas for the Stackelberg game are stated without proof. The expressions involve quantities H, J, and |D_{-i}| that are not defined in the theorem statements or the preceding text, and the conditions for the two cases (e.g., ∂²U_c/∂ϵ² ≤ 0) are not verified for the stated parameter ranges. Since the game-theoretic parameter selection is one of the paper's main contributions, these results need a full derivation or a reference to a complete proof.
minor comments (7)
  1. [Section VI-B, Theorem 5] The convergence theorem is a generic FedAvg-style bound and does not reference the unlearning model w_UN, so it does not establish convergence of FUI specifically; the proof also uses undefined notation such as w_r^i and g_{k,t}^i.
  2. [Section IV-B] The distance bound d is said to be 'calculated by (36) in [19]', but no equation (36) is reproduced and the units or dimension of d are never specified, which matters because σ̃1 and σ̃2 have different functional dependence on d.
  3. [Section IV-B, proof of Theorem 4] The proof conflates the mechanism output and neighboring datasets by writing M(X) and M(Y) without specifying which arguments correspond to w_LR and w_RE; the relationship between the noise scales and the actual model distributions is not formalized.
  4. [Algorithm 1] The while condition in Line 3 checks ||w_k − w_ref||₂ ≤ δ, but the optimization problem is defined over the ball {v: ||v−w_ref||₂ ≤ δ}; the loop termination condition based on τ is not connected to δ, and the algorithm may exit without satisfying the stated constraint.
  5. [Section V] The game parameters a, b, r, s, l, Ψ_s, Ψ_c, and ϵ_min are introduced without guidance on how they would be calibrated in practice, and the experimental section does not show sensitivity of the equilibrium to these constants.
  6. [Section VII-B] The experiments do not directly verify the claimed ϵ-indistinguishability; membership inference attack precision and recall are indirect proxy measures and cannot confirm the formal guarantee in Definition IV.1.
  7. [Throughout] There are several typographical and notation inconsistencies, such as 'F ederated' in the abstract, σ_cali versus σcali in Equation (2), and the constraint in Theorem 3 written as p∈{0,pmax} when the model specifies 0 < p ≤ pmax.

Circularity Check

1 steps flagged · score 7.0 of 10

The ε-indistinguishability guarantee is definitional: calibrated noise is set to the very noise scale previously defined to achieve ε-indistinguishability, and Theorem 4 restates that construction.

  1. self definitional [Section IV-B (Global Noise Calibration) and Theorem 4 (Section VI-A); Algorithm 1, lines 12-18.]
    "where σ̃1 and σ̃2 are the noise scales required for achieving η²/2-indistinguishability and ε-indistinguishability, respectively ... By adding additional noise with scale: σcali = √(σ̃2² − σ̃1²) into noise with scale σ̃1, we now obtain the equivalent noise scale as σ̃1² + σ²_cali = σ̃2². Since σ̃2 ≥ d/√ε we can get: Pr[M(X) = z] ≤ e^ε Pr[M(Y) = z]."

    The target property is inserted as the calibration constant: σ̃2 is defined as 'the noise scale required for achieving ε-indistinguishability', and σcali = √(σ̃2²−σ̃1²) forces the total variance to equal σ̃2². Theorem 4 then concludes ε-indistinguishability from precisely that variance identity, so the guarantee is a restatement of the construction rather than an independent derivation. The Gaussian-ratio step is asserted for all z although the likelihood ratio of two equal-variance Gaussians with different means is unbounded as z→−∞, so no finite additive Gaussian noise can enforce Definition IV.1 over all subsets of the unbounded parameter space; the local-retraction premise that w_LR behaves as an η-DP output is also asserted, not derived.

full rationale

The central privacy guarantee is circular/definitional. In Section IV-B the paper defines σ̃2 as the noise scale 'required for achieving ε-indistinguishability', then sets σcali to close the variance gap to σ̃2²; Theorem 4 verifies the very condition used to choose the noise. This is not a self-citation chain, and there is no reliance on the authors' own prior work, but the reduction-by-construction affects the main theoretical claim: the ε-indistinguishability result does not follow from an independently established mechanism bound. Separately, Theorem 1's assertion that η-DP implies η²/2-indistinguishability is mathematically unsupported (the proof's Rényi manipulation does not imply the claimed exponent), which makes the local-retraction premise of the calibration step also unverified. The experimental comparison against Retrain and other baselines is external and self-contained, but it does not repair the definitional character of the privacy analysis. Score 7 reflects a central guarantee that reduces by construction while some independent empirical content remains.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on Theorem 1's implication from DP to indistinguishability, the assumed Gaussian form and bounded distance of w_LR versus w_RE, a cited distance bound d, convexity assumptions for convergence that are not met in experiments, and hand-chosen utility functions for the game. The paper provides no independent evidence for any of these.

free parameters (5)
  • Retraction radius delta
    Algorithm 1 line 3 bounds the L-BFGS retraction inside an l2 ball of radius delta. The paper never states how delta is set in experiments.
  • L-BFGS step size alpha and convergence threshold tau
    These are inputs in Algorithm 1, but no default values are given in Section VII.
  • Privacy parameters eta and epsilon = eta=5, epsilon=5 in default experiments
    Chosen by hand as defaults. They directly set the noise scales and the claimed indistinguishability level, and the Stackelberg game chooses epsilon.
  • Distance bound d = cited from [19] Eq. (36), not numerically specified
    The central calibration formulas use d as the upper bound of the distance between model parameters, but the formula is only cited, not derived here, and the dimensional inconsistency in sigma_1 suggests an error.
  • Game constants a, b, r, s, epsilon_min, p_max, Psi_s, Psi_c = a=1.5, b=10, s=2, epsilon_min=0.1, p_max=15, Psi_s=5, Psi_c=3
    Hand-set constants in the Stackelberg simulation. There is no fitting to real utility data, so the optimal strategies are optimal only for these arbitrary functions.
assumptions (5)
  • ad hoc to paper eta-DP implies eta-squared-over-2 indistinguishability of output random variables.
    Theorem 1 uses this to claim local retraction already achieves eta-squared-over-2 indistinguishability. The implication is false; DP alone does not yield the stronger eta-squared-over-2 bound, and the proof's exponent algebra is inconsistent.
  • domain assumption The retracted model w_LR and the retrained model w_RE are Gaussian random variables with variance sigma_1-squared and mean separation bounded by d.
    Global noise calibration in Section IV-B and Theorem 4 assume Gaussian density ratio formulas. No mechanism is given for why L-BFGS retraction produces such a distribution.
  • domain assumption The distance bound d from [19] Eq. (36) is a valid and computable bound for DPFL models.
    All noise gap calculations depend on d, but it is only cited and not defined in this paper.
  • domain assumption Loss functions F_i are mu-strongly convex and Upsilon-smooth with bounded stochastic gradient variance.
    The convergence proof in Theorem 5 assumes these properties, but the experiments use ReLU CNNs on MNIST and CIFAR-10, which are neither strongly convex nor smooth.
  • domain assumption Model performance as a function of epsilon and data size follows the specified log and reciprocal forms.
    The Stackelberg utility functions cite [33] and [34] but treat the forms as exact. The optimality results hold only for these postulated functions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Upcycling Noise for Federated Unlearning." pith.science (2026). https://pith.science/paper/4EY6WLSW

@misc{pith2026241205529,
  author       = {Pith},
  title        = {Pith review of: Upcycling Noise for Federated Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4EY6WLSW}},
  note         = {Machine review of arXiv:2412.05529}
}
read the original abstract

In Federated Learning (FL), multiple clients collaboratively train a model without sharing raw data. This paradigm can be further enhanced by Differential Privacy (DP) to protect local data from information inference attacks and is thus termed DPFL. An emerging privacy requirement, ``the right to be forgotten'' for clients, poses new challenges to DPFL but remains largely unexplored. Despite numerous studies on federated unlearning (FU), they are inapplicable to DPFL because the noise introduced by the DP mechanism compromises their effectiveness and efficiency. In this paper, we propose Federated Unlearning with Indistinguishability (FUI) to unlearn the local data of a target client in DPFL for the first time. FUI consists of two main steps: local model retraction and global noise calibration, resulting in an unlearning model that is statistically indistinguishable from the retrained model. Specifically, we demonstrate that the noise added in DPFL can endow the unlearning model with a certain level of indistinguishability after local model retraction, and then fortify the degree of unlearning through global noise calibration. Additionally, for the efficient and consistent implementation of the proposed FUI, we formulate a two-stage Stackelberg game to derive optimal unlearning strategies for both the server and the target client. Privacy and convergence analyses confirm theoretical guarantees, while experimental results based on four real-world datasets illustrate that our proposed FUI achieves superior model performance and higher efficiency compared to mainstream FU schemes. Simulation results further verify the optimality of the derived unlearning strategies.

Figures

Figures reproduced from arXiv: 2412.05529 by the authors.

Figure 1
Figure 1. Illustration of DPFL. using its own dataset Di = {(xj , yj )} |Di| j=1, where xj is the j-th input sample, yj is the corresponding label, and |Di | is the number of training samples in Di . 2 Each client ci aims to find a vector w˜i , i.e., the local model, to minimize the loss function Fi( ˜wi), where w˜i will be injected with Gaussian noise nU ∼ G(0, σ2 U ) to protect the sensitive information from being inferred,… view at source ↗
Figure 2
Figure 2. Comparison of MIA performance among different FU methods. [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 4
Figure 4. Impact of strategies on server’s utility with different parameters. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Impact of strategies on client’s utility with different parameters. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 16 canonical work pages

  1. [19]

    Fedrecovery: Dif- ferentially private machine unlearning for federated learning frameworks,

    L. Zhang, T. Zhu, H. Zhang, P. Xiong, and W. Zhou, “Fedrecovery: Dif- ferentially private machine unlearning for federated learning frameworks,” IEEE Transactions on Information Forensics and Security , 2023

    work page 2023

  2. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282

    2017

  3. [2]

    Inverting gradients-how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems , vol. 33, pp. 16 937–16 947, 2020

    work page 2020

  4. [3]

    Feature inference attack on model predictions in vertical federated learning,

    X. Luo, Y . Wu, X. Xiao, and B. C. Ooi, “Feature inference attack on model predictions in vertical federated learning,” in 2021 IEEE 37th International Conference on Data Engineering (ICDE) . IEEE, 2021, pp. 181–192

    work page 2021

  5. [4]

    Auditing privacy defenses in federated learning via generative gradient leakage,

    Z. Li, J. Zhang, L. Liu, and J. Liu, “Auditing privacy defenses in federated learning via generative gradient leakage,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 10 132–10 142

    2022

  6. [5]

    Differentially private federated learning: A client level perspective,

    R. C. Geyer, T. Klein, and M. Nabi, “Differentially private federated learning: A client level perspective,” arXiv preprint arXiv:1712.07557 , 2017

    arXiv 2017

  7. [6]

    Federated learning with differential privacy: Algorithms and performance analysis,

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V . Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” IEEE Transactions on Information Forensics and Security, vol. 15, pp. 3454–3469, 2020

    2020

  8. [7]

    Regulation (eu) 2016/679 of the european parliament and of the council,

    P. Regulation, “Regulation (eu) 2016/679 of the european parliament and of the council,” Regulation (eu), vol. 679, p. 2016, 2016

    2016

Show all 39 references
  1. [8]

    The eu general data protection regu- lation (gdpr),

    P. V oigt and A. V on dem Bussche, “The eu general data protection regu- lation (gdpr),” A Practical Guide, 1st Ed., Cham: Springer International Publishing, vol. 10, no. 3152676, pp. 10–5555, 2017

    2017

  2. [9]

    Federaser: Enabling efficient client-level data removal from federated learning models,

    G. Liu, X. Ma, Y . Yang, C. Wang, and J. Liu, “Federaser: Enabling efficient client-level data removal from federated learning models,” in 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS). IEEE, 2021, pp. 1–10

    2021

  3. [10]

    Federated unlearning with momentum degradation,

    Y . Zhao, P. Wang, H. Qi, J. Huang, Z. Wei, and Q. Zhang, “Federated unlearning with momentum degradation,” IEEE Internet of Things Journal, 2023

    2023

  4. [11]

    Federated unlearning for on-device recommendation,

    W. Yuan, H. Yin, F. Wu, S. Zhang, T. He, and H. Wang, “Federated unlearning for on-device recommendation,” in Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining, 2023, pp. 393–401

    2023

  5. [12]

    The right to be forgotten in federated learning: An efficient realization with rapid retraining,

    Y . Liu, L. Xu, X. Yuan, C. Wang, and B. Li, “The right to be forgotten in federated learning: An efficient realization with rapid retraining,” in IEEE INFOCOM 2022-IEEE Conference on Computer Communications . IEEE, 2022, pp. 1749–1758

    2022

  6. [13]

    Federated unlearning: How to efficiently erase a client in fl?

    A. Halimi, S. Kadhe, A. Rawat, and N. Baracaldo, “Federated unlearning: How to efficiently erase a client in fl?” arXiv preprint arXiv:2207.05521, 2022

    2022 arXiv

  7. [14]

    Fedrecover: Recovering from poisoning attacks in federated learning using historical information,

    X. Cao, J. Jia, Z. Zhang, and N. Z. Gong, “Fedrecover: Recovering from poisoning attacks in federated learning using historical information,” in 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2023, pp. 1366–1383

    2023

  8. [15]

    Incentive mechanism design for federated learning and unlearning,

    N. Ding, Z. Sun, E. Wei, and R. Berry, “Incentive mechanism design for federated learning and unlearning,” in Proceedings of the Twenty- fourth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing , 2023, pp. 11–20

    2023

  9. [16]

    Federated unlearning with knowledge distillation,

    C. Wu, S. Zhu, and P. Mitra, “Federated unlearning with knowledge distillation,” arXiv preprint arXiv:2201.09441 , 2022

    2022 arXiv

  10. [17]

    Federated unlearning via class- discriminative pruning,

    J. Wang, S. Guo, X. Xie, and H. Qi, “Federated unlearning via class- discriminative pruning,” in Proceedings of the ACM Web Conference 2022, 2022, pp. 622–632

    2022

  11. [18]

    Fedme 2: Memory evaluation & erase promoting federated unlearning in dtmn,

    H. Xia, S. Xu, J. Pei, R. Zhang, Z. Yu, W. Zou, L. Wang, and C. Liu, “Fedme 2: Memory evaluation & erase promoting federated unlearning in dtmn,” IEEE Journal on Selected Areas in Communications , 2023

    2023

  12. [20]

    Get rid of your trail: Remotely erasing backdoors in federated learning,

    M. Alam, H. Lamri, and M. Maniatakos, “Get rid of your trail: Remotely erasing backdoors in federated learning,” arXiv preprint arXiv:2304.10638, 2023

    2023 arXiv

  13. [21]

    Bayesian variational federated learning and unlearning in decentralized networks,

    J. Gong, O. Simeone, and J. Kang, “Bayesian variational federated learning and unlearning in decentralized networks,” in 2021 IEEE 22nd International Workshop on Signal Processing Advances in Wireless Communications (SPAWC). IEEE, 2021, pp. 216–220

    2021

  14. [22]

    On the limited memory bfgs method for large scale optimization,

    D. C. Liu and J. Nocedal, “On the limited memory bfgs method for large scale optimization,” Mathematical programming, vol. 45, no. 1, pp. 503–528, 1989

    1989

  15. [23]

    Learn- ing differentially private recurrent language models,

    H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang, “Learn- ing differentially private recurrent language models,” arXiv preprint arXiv:1710.06963, 2017

    2017 arXiv

  16. [24]

    Ldp-fed: Federated learning with local differential privacy,

    S. Truex, L. Liu, K.-H. Chow, M. E. Gursoy, and W. Wei, “Ldp-fed: Federated learning with local differential privacy,” in Proceedings of the third ACM international workshop on edge systems, analytics and networking, 2020, pp. 61–66

    2020

  17. [25]

    Shuffled model of differential privacy in federated learning,

    A. Girgis, D. Data, S. Diggavi, P. Kairouz, and A. T. Suresh, “Shuffled model of differential privacy in federated learning,” in International Conference on Artificial Intelligence and Statistics . PMLR, 2021, pp. 2521–2529

    2021

  18. [26]

    Federated learning with differential privacy for resilient vehicular cyber physical systems,

    F. O. Olowononi, D. B. Rawat, and C. Liu, “Federated learning with differential privacy for resilient vehicular cyber physical systems,” in2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC). IEEE, 2021, pp. 1–5

    2021

  19. [27]

    Local differential privacy-based federated learning for internet of things,

    Y . Zhao, J. Zhao, M. Yang, T. Wang, N. Wang, L. Lyu, D. Niyato, and K.-Y . Lam, “Local differential privacy-based federated learning for internet of things,” IEEE Internet of Things Journal , vol. 8, no. 11, pp. 8836–8853, 2020

    2020

  20. [28]

    Differential privacy-enabled federated learning for sensitive health data,

    O. Choudhury, A. Gkoulalas-Divanis, T. Salonidis, I. Sylla, Y . Park, G. Hsu, and A. Das, “Differential privacy-enabled federated learning for sensitive health data,” arXiv preprint arXiv:1910.02578 , 2019

    1910 arXiv

  21. [29]

    Federated learning and differential privacy for medical image analysis,

    M. Adnan, S. Kalra, J. C. Cresswell, G. W. Taylor, and H. R. Tizhoosh, “Federated learning and differential privacy for medical image analysis,” Scientific reports, vol. 12, no. 1, p. 1953, 2022

    1953

  22. [30]

    Federated quantum machine learning with differential privacy,

    R. Rofougaran, S. Yoo, H.-H. Tseng, and S. Y .-C. Chen, “Federated quantum machine learning with differential privacy,” in ICASSP 2024- 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2024, pp. 9811–9815

    2024

  23. [31]

    Concentrated differential privacy: Simplifications, extensions, and lower bounds,

    M. Bun and T. Steinke, “Concentrated differential privacy: Simplifications, extensions, and lower bounds,” in Theory of Cryptography Conference . Springer, 2016, pp. 635–658

    2016

  24. [32]

    Independent component analysis in the presence of gaussian noise by maximizing joint likelihood,

    A. Hyvärinen, “Independent component analysis in the presence of gaussian noise by maximizing joint likelihood,” Neurocomputing, vol. 22, no. 1-3, pp. 49–67, 1998

    1998

  25. [33]

    The value of collaboration in convex machine learning with differential privacy,

    N. Wu, F. Farokhi, D. Smith, and M. A. Kaafar, “The value of collaboration in convex machine learning with differential privacy,” in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 304–317

    2020

  26. [34]

    Strategic data revocation in federated unlearning,

    N. Ding, E. Wei, and R. Berry, “Strategic data revocation in federated unlearning,” arXiv preprint arXiv:2312.01235 , 2023

    2023 arXiv

  27. [35]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  28. [36]

    Becker and R

    B. Becker and R. Kohavi, “Adult,” UCI Machine Learning Repository, 1996, DOI: https://doi.org/10.24432/C5XW20

    1996 doi

  29. [37]

    Acquire valued shoppers challenge,

    W. C. DMDave, Todd B, “Acquire valued shoppers challenge,” 2014. [Online]. Available: https://kaggle.com/competitions/ acquire-valued-shoppers-challenge

    2014

  30. [38]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  31. [39]

    Learning multiple layers of features from tiny images,

    K. Alex, “Learning multiple layers of features from tiny images,” https://www. cs. toronto. edu/kriz/learning-features-2009-TR. pdf , 2009

    2009

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.