Pith. sign in

REVIEW 4 major objections 6 minor 65 references

A malicious federated-learning client can hide a backdoor that activates only after a legitimate unlearning request removes the camouflage samples.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A malicious federated-learning client can hide a backdoor by adding trigger-labeled samples plus camouflage samples, then activate it by requesting unlearning of the camouflage samples.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection BadFU is a credible first demonstration that federated unlearning can activate dormant backdoors; the core claim survives, but the paper needs to fix its unlearning-method instantiations and reporting before I'd trust the breadth claims. the 4 major comments →

arxiv 2508.15541 v1 pith:BAOWV6ZK submitted 2025-08-21 cs.CR cs.LG

BadFU: Backdoor Federated Learning through Adversarial Machine Unlearning

Bingguang Lu , Hongsheng Hu , Yuantian Miao , Shaleeza Sohail , Chaoxiang He , Shuo Wang , Xiao Chen This is my paper
classification cs.CR cs.LG
keywords federated learningmachine unlearningbackdoor attackdata poisoningcamouflage samplesunlearning-triggered attackcross-silo FLadversarial machine unlearning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims to be the first to show that a legitimate unlearning request can act as the trigger for a backdoor in federated learning. The malicious client trains the global model on two kinds of poisoned samples that cancel each other out: backdoor samples that push triggered inputs toward a target class, and camouflage samples with the same trigger but their original labels, which push the other way. During training the model looks normal; once the server honors the request to unlearn the camouflage samples, the balancing signal disappears and the model misclassifies triggered inputs. The claim matters because unlearning services are designed to honor deletion requests, not to treat them as adversarial, and the experiments show the effect across several FL aggregation rules, unlearning methods, and datasets. If true, offering sample-level data removal in cross-silo federated learning creates a new backdoor attack surface.

Core claim

Central claim: federated unlearning is an activation switch, not just a compliance service. BadFU has a malicious client add two disjoint poison sets — backdoor samples (trigger + target label) and camouflage samples (same trigger, original label) — whose gradients oppose each other. After aggregation, the global model looks normal (pre-activation ASR in the single digits to roughly 40 percent; benign accuracy within about 1–3 percent of an honest model). Deleting the camouflage samples removes the opposing gradient, and ASR jumps to roughly 50–99 percent. This is validated across three datasets, several architectures, three FL aggregators, and four unlearning methods; Median/Trimean and Neu

What carries the argument

The load-bearing object is the camouflage sample: an attacker-controlled training sample that carries the same backdoor trigger as the poison sample but keeps its original label. Its training gradient opposes the poison gradient, and in federated aggregation this opposition keeps the backdoor dormant during training. The unlearning request is the activation switch — it removes the camouflage samples' influence at sample granularity, leaving the poison gradient unopposed and flipping the global model into the backdoored state.

Load-bearing premise

The attack depends on the unlearning service removing exactly the camouflage samples' influence at sample granularity from a client that stays in the federation, leaving the backdoor samples' influence intact, and processing the deletion request without auditing its contents.

What would settle it

Run the same BadFU setup but have the server unlearn a control set of the same size drawn from random clean samples of the malicious client, and compare post-unlearning ASR; the gradient-cancellation mechanism predicts no activation from the control, so a large ASR jump there would refute the central claim. A simpler check is inspecting the deleted samples: if the camouflage samples do not all carry the attack trigger, the activation should not occur.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Any cross-silo FL service that honors per-sample deletion requests must treat the stream of unlearning requests as adversarial input, not just a compliance operation.
  • Because BadFU composes with existing trigger-injection techniques, unlearning-activated backdoors could appear under a variety of visual triggers, including subtle blended patterns.
  • Attackers can tune the camouflage-to-poison ratio to improve stealth without sacrificing post-activation potency, so low trigger accuracy during training is not evidence that a backdoor is absent.
  • Training-time defenses such as robust aggregation or Neural Cleanse did not stop the attack in the paper's experiments, so defenses must look at the post-unlearning model or at the requests themselves.
  • The attack works across exact retraining and approximate unlearning methods, meaning that adopting efficient federated unlearning does not by itself close the vulnerability.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • An implication the paper does not test: the cancel-and-delete mechanism should generalize to non-backdoor poisoning goals, such as targeted misclassification, whenever a poison signal can be paired with a deletable counter-signal — making sample-level deletion rights a generic poisoning vector.
  • The deleted camouflage samples all share the trigger pattern with the surviving backdoor samples, so a server that audits unlearning requests for repeated patterns would have a cheap, likely effective defense that the paper does not evaluate.
  • Because the experiments are limited to image classification, the next natural test is whether the gradient cancellation survives in transformer-based or generative models, where feature geometry differs; if it does not, the vulnerability may be narrower than the paper's framing suggests.
  • The paper's claimed independence from the backdoor dataset and the global model is what makes the attack practical without influence functions; if that independence holds, the attack works even for adversaries with no knowledge of model internals.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes BadFU, a backdoor attack against federated learning that is activated by a legitimate federated unlearning request. A malicious client trains locally on a mixture of clean, backdoor (trigger + target label), and camouflage (trigger + original label) samples. During federated training the camouflage samples are claimed to suppress the backdoor, yielding low pre-activation ASR and preserved accuracy; after the malicious client requests unlearning of the camouflage samples, the backdoor is claimed to activate. Experiments cover MNIST, CIFAR-10, and CIFAR-100; BadNet and Blended triggers; FedAvg, FedSGD, and FedProx; and retraining, FedEraser, FedU, and SIFU unlearning. The central reported pattern is a large ASR increase after unlearning (roughly 11-40% pre-activation to 50-99% post-activation) with ACC approximately unchanged.

Significance. If the central claim holds, the paper identifies a genuinely new attack surface: a malicious FL client can use the unlearning mechanism itself as a backdoor trigger, while submitting updates that are not anomalous during training. The inclusion of a benign-unlearning control (Table V) is a good experimental design choice, and the source-code release is a strength. However, the current evidence for the broad claim across approximate federated unlearning methods is not established, and several reported numbers are internally inconsistent. The novelty relative to prior centralized unlearning-activated backdoors (UBA-Inf, BAMU) is clear, but the federated-specific validation needs substantial repair before the contribution can be assessed.

major comments (4)
  1. [Sections IV-D, VI-D, VII-H; Table VIII] The threat model requires sample-level removal: only the camouflage samples D_c of a continuing malicious client are unlearned, while D_bd remains. FedEraser and SIFU are client-level federated unlearning methods: FedEraser removes a client's recorded updates, and SIFU adds calibrated noise to erase a client's influence. The paper does not specify how these methods are adapted to delete only a subset of a continuing client's local samples. If the implementation removed the whole malicious client, D_bd would also be erased and the stated mechanism would not hold; if a custom sample-level adaptation was used, the experiments no longer evaluate the published FedEraser/SIFU algorithms. The Table VIII claims of 60.12% and 85.59% post-activation ASR for FedU and SIFU are therefore unsupported. This is load-bearing because the advertised 'broad applicability' across unlearning strategies rests
  2. [Algorithm 1, lines 8-9] In DataPrepare, both D_bd and D_c are reset to the empty set immediately before the poisoning loops (lines 8-9). The function then returns empty datasets, so Algorithm 1 as printed cannot produce the backdoor and camouflage sets used in the experiments. This is not a presentation typo; it makes the pseudocode inconsistent with the executed method. The authors must correct the algorithm and ensure the printed code matches the released implementation.
  3. [Tables III, IX, and II; Figure 2] The claim that BadFU keeps the backdoor 'dormant' or leaves the model 'unaffected' during training is undercut by pre-activation ASRs that are far above chance: 40.31% on MNIST with Blended under Dirichlet (Table III), 39.62% and 39.43% on CIFAR-100 (Table IX), and roughly 30% in several FedProx conditions (Table II). For 10-class and 100-class tasks these are not low values. Additionally, Table II reports CIFAR-10 FedProx BadNet ACC as 97.52/97.53%, while the same dataset/model in Table I gives 84.84%, a 12-percentage-point discrepancy that is not explained. These inconsistencies affect the core stealth claim and the aggregation comparison and must be resolved.
  4. [Section VII-A, Tables I and IV] The exact-retraining rows in Tables I, III, IV, and IX are close to construction: retraining from scratch on the data without the camouflage samples is equivalent to a standard backdoor training run, so a high post-retraining ASR is unsurprising. The non-circular empirical content of the paper lies in the pre-activation dormancy and in the approximate-unlearning transitions. The retraining baseline should be framed as a sanity check rather than as independent evidence that unlearning 'activates' the backdoor. Once the sample-level implementation of FedEraser/SIFU is clarified, the novel burden of proof shifts entirely to those approximate methods, which currently lack sufficient detail.
minor comments (6)
  1. [Section VII-A, paragraph 3] The text states FedEraser ASR is '65% for VGG-16 and 50% for LeNet-5', but Table I reports 49.23% for VGG-16 and 68.55% for LeNet-5. The example values are swapped and inaccurate.
  2. [Section VI-B] The paper states each experiment was repeated three times and averages are reported, but no standard deviations, confidence intervals, or per-seed values are shown. Given that some pre/post differences are modest (e.g., FedEraser on LeNet-5, Table I), the absence of variance information makes it hard to judge the stability of the results.
  3. [Section VII-H, Table VIII] Each approximate unlearning method is evaluated on a single dataset/model pair, with no comparison to the exact-retraining or FedEraser baselines under identical conditions. This limits the generality of the claim that BadFU is 'effective' across FedU and SIFU.
  4. [Figure 2] The x-axis label 'Camouflage Ratio' is ambiguous. The text indicates it is the ratio of camouflage samples to backdoor samples, but the axis should be labeled explicitly (e.g., |D_c|/|D_bd|).
  5. [Appendix X-A] There is a typo: 'FedA VG' should be 'FedAvg'.
  6. [Section VII-G, Table VII] The statement that NC indices are 'unstable across repeated experiments' is not backed by any reported repeated-run statistics. The threshold discussion also assumes the reader knows the NC index scale; a brief explanation of what the values mean would improve clarity.

Circularity Check

1 steps flagged

Partial circularity: post-activation under exact retraining is the standard backdoor model by construction; pre-activation dormancy and approximate-unlearning results retain independent empirical content.

specific steps
  1. self definitional [Section V-D (Backdoor Activation via Federated Unlearning), Eqs. (7)-(8); cf. Algorithm 1]
    "From a gradient perspective, the unlearning process revokes the influence of ∇Lc, such that only ∇Lbd remains, assuming the federated unlearning mechanism effectively removes the information associated with the camouflage samples. As a result, the backdoor gradients take full effect, causing the model to exhibit backdoor behavior when the trigger is present."

    In Eq. (7), the local objective is Lclean + Lbd + Lc, where Dbd is defined as backdoor samples (trigger inserted, label flipped to yt) and Dc as camouflage samples (trigger inserted, original labels retained). Section V-D defines activation as removing ∇Lc. Therefore, the post-unlearning model is, by construction, the model trained on benign data plus Dbd alone — i.e., a standard backdoor-poisoned model. The high post-activation ASR under exact retraining is then just the standard backdoor effect of the injected Dbd, not an independent consequence of the unlearning operation. The transition is built into which samples the attacker chooses to delete. The independent empirical content is the low pre-activation ASR (dormancy) and the behavior under approximate unlearning methods, which do not

full rationale

BadFU is fundamentally an attack-construction paper, and most of its reported results are genuine experiments rather than fitted predictions. No parameter is fitted to data and then renamed a prediction; there is no load-bearing self-citation chain, and no uniqueness theorem is imported from the authors' prior work. However, one component of the central claim — that the global model becomes backdoored after exact retraining unlearning — reduces by construction. The paper's own model (Section V-D, Eq. 7-8) defines unlearning of Dc as revoking ∇Lc, leaving exactly the backdoor loss ∇Lbd. Retraining without Dc is definitionally training with Dbd present, so the high post-activation ASR in the retraining rows of Tables I-IV is a standard backdoor-training outcome rather than an independent validation of unlearning as a trigger. The genuinely non-circular findings are the pre-activation dormancy (Tables I-IV, Fig. 2) and the incomplete-activation behavior under approximate unlearning (FedEraser, FedU, SIFU). Separately, the breadth claim across FedEraser/SIFU is a correctness/reproducibility concern, not a circularity: those are client-level unlearning methods, and Section VII-H/Table VIII does not specify how sample-level removal of only Dc from a continuing malicious client is instantiated; the printed Algorithm 1 also sets Dbd and Dc to empty before use (lines 8-9). Those issues should be weighed as experimental validity risks, not as evidence of circular derivation. On balance, the exact-retraining activation result is partially self-definitional, while the attack's core stealth claim is independent, giving a partial circularity score of 6.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

No new physical entities, forces, or conserved quantities are introduced. The camouflage samples are a dataset construction, not an independently evidenced entity; their effectiveness is only demonstrated inside this paper's testbed, so they carry no external falsifiable handle beyond the reported experiments.

free parameters (4)
  • camouflage-to-backdoor sample ratio = default 1x; scanned 0.5x, 1x, 1.5x, 2x
    Attacker-chosen; Figure 2 shows pre-activation ASR falls as the ratio grows, so the stealth level is a hand-set tradeoff.
  • backdoor poisoning budget = 1,000 samples (MNIST), 850 (CIFAR-10/100); under 2% of the global dataset
    Hand-chosen; the paper notes higher poison counts raise post-unlearning ASR under FedU. Locally this is roughly 14% of the malicious client's data, which is not reported and affects the indistinguishability claim.
  • trigger pattern and placement = 3x3 corner patch (BadNet); blended watermark (Blended)
    Hand-chosen; both backdoor and camouflage samples share the same trigger, so the attacker must fix the trigger before generating camouflage.
  • target class yt = not reported for most runs (class 0 in the NC experiment)
    Attacker-chosen; threat model assumes the malicious client's local data is dominated by this class.
axioms (4)
  • domain assumption The unlearning mechanism faithfully removes exactly the camouflage samples' influence at sample granularity and leaves the backdoor samples' influence intact.
    Enters at Section IV-D and Section V-D; the whole activation step relies on it. FedEraser and SIFU are client-level methods and the paper does not show how partial within-client removal is implemented.
  • domain assumption The server honors unlearning requests without inspecting the deleted samples, which contain the trigger pattern.
    The camouflage samples are (x + trigger, y), so the deletion request itself exposes the trigger. The paper's own mitigation (Section VIII) proposes auditing unlearning requests, which would break the attack's stealth.
  • domain assumption A malicious client holds a majority of target-class data and has a small auxiliary set spanning all labels.
    Threat model Section IV-C; needed to build both poison and camouflage sets and to give the backdoor enough weight to survive aggregation.
  • ad hoc to paper FL aggregation and non-IID heterogeneity amplify the camouflage effect so the global model stays clean pre-activation.
    Section V-C, Equation (8): the cancellation of backdoor and camouflage gradients is asserted qualitatively, with the paper admitting camouflage alone is insufficient in centralized learning; no derivation is given.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of BadFU: Backdoor Federated Learning through Adversarial Machine Unlearning." pith.science (2026). https://pith.science/paper/BAOWV6ZK

@misc{pith2026250815541,
  author       = {Pith},
  title        = {Pith review of: BadFU: Backdoor Federated Learning through Adversarial Machine Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BAOWV6ZK}},
  note         = {Machine review of arXiv:2508.15541}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Federated learning (FL) has been widely adopted as a decentralized training paradigm that enables multiple clients to collaboratively learn a shared model without exposing their local data. As concerns over data privacy and regulatory compliance grow, machine unlearning, which aims to remove the influence of specific data from trained models, has become increasingly important in the federated setting to meet legal, ethical, or user-driven demands. However, integrating unlearning into FL introduces new challenges and raises largely unexplored security risks. In particular, adversaries may exploit the unlearning process to compromise the integrity of the global model. In this paper, we present the first backdoor attack in the context of federated unlearning, demonstrating that an adversary can inject backdoors into the global model through seemingly legitimate unlearning requests. Specifically, we propose BadFU, an attack strategy where a malicious client uses both backdoor and camouflage samples to train the global model normally during the federated training process. Once the client requests unlearning of the camouflage samples, the global model transitions into a backdoored state. Extensive experiments under various FL frameworks and unlearning strategies validate the effectiveness of BadFU, revealing a critical vulnerability in current federated unlearning practices and underscoring the urgent need for more secure and robust federated unlearning mechanisms.

Figures

Figures reproduced from arXiv: 2508.15541 by Bingguang Lu, Chaoxiang He, Hongsheng Hu, Shaleeza Sohail, Shuo Wang, Xiao Chen, Yuantian Miao.

Figure 1
Figure 1. Figure 1: Workflow of BadFU: i) The malicious client prepares backdoor samples to implant a backdoor into the global model; ii) To ensure the global model behaves normally during federated training, the malicious client also prepares camouflage samples to mask the backdoor’s effect; iii) After the global model has been trained, the malicious client submits an unlearning request to remove the camouflage samples, ther… view at source ↗
Figure 2
Figure 2. Figure 2: Attack Success Rate (ASR) versus different camouflage sample/poison sample ratio on MNIST and CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

65 extracted references · 48 canonical work pages

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial Intelligence and Statistics . PMLR, 2017, pp. 1273– 1282

    work page 2017

  2. [2]

    A survey on feder- ated learning applications in healthcare, finance, and data privacy/data security,

    T. Nevrataki, A. Iliadou, G. Ntolkeras, I. Sfakianakis, L. Lazaridis, G. Maraslidis, N. Asimopoulos, and G. F. Fragulis, “A survey on feder- ated learning applications in healthcare, finance, and data privacy/data security,” in AIP Conference Proceedings , vol. 2909, no. 1. AIP Publishing, 2023

    work page 2023

  3. [3]

    Federated learning for mobile keyboard prediction,

    A. Hard, K. Rao, R. Mathews, S. Ramaswamy, F. Beaufays, S. Augen- stein, H. Eichner, C. Kiddon, and D. Ramage, “Federated learning for mobile keyboard prediction,” arXiv preprint arXiv:1811.03604 , 2018

    Pith/arXiv arXiv 2018

  4. [4]

    Ffd: A federated learning based method for credit card fraud detection,

    W. Yang, Y . Zhang, K. Ye, L. Li, and C.-Z. Xu, “Ffd: A federated learning based method for credit card fraud detection,” in Big data– bigData 2019: 8th International Congress, held as part of the Services Conference Federation, SCF 2019, San Diego, CA, USA, June 25–30, 2019, proceedings 8 . Springer, 2019, pp. 18–32

    work page 2019

  5. [5]

    Federated learning with non-iid data,

    Y . Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V . Chandra, “Federated learning with non-iid data,” arXiv preprint arXiv:1806.00582 , 2018

    Pith/arXiv arXiv 2018

  6. [6]

    A review on machine unlearning,

    H. Zhang, T. Nakamura, T. Isohara, and K. Sakurai, “A review on machine unlearning,” SN Computer Science , vol. 4, no. 4, p. 337, 2023

    work page 2023

  7. [7]

    CJEU - C 131/12 / Judgment | European Union Agency for Fundamental Rights,

    “CJEU - C 131/12 / Judgment | European Union Agency for Fundamental Rights,” Apr. 2015. [Online]. Available: https://fra.europa. eu/en/caselaw-reference/cjeu-c-13112-judgment

    work page 2015

  8. [8]

    Federated unlearning: A survey on methods, design guidelines, and evaluation metrics,

    N. Romandini, A. Mora, C. Mazzocca, R. Montanari, and P. Bellav- ista, “Federated unlearning: A survey on methods, design guidelines, and evaluation metrics,” IEEE Transactions on Neural Networks and Learning Systems, 2024

    work page 2024

  9. [9]

    Federaser: Enabling efficient client-level data removal from federated learning models,

    G. Liu, X. Ma, Y . Yang, C. Wang, and J. Liu, “Federaser: Enabling efficient client-level data removal from federated learning models,” in 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS). IEEE, 2021, pp. 1–10

    2021

  10. [10]

    Asynchronous federated unlearning,

    N. Su and B. Li, “Asynchronous federated unlearning,” in IEEE INFO- COM 2023-IEEE Conference on Computer Communications . IEEE, 2023, pp. 1–10

    work page 2023

  11. [11]

    Federated un- learning: How to efficiently erase a client in fl?

    A. Halimi, S. Kadhe, A. Rawat, and N. Baracaldo, “Federated un- learning: How to efficiently erase a client in fl?” arXiv preprint arXiv:2207.05521, 2022

    Pith/arXiv arXiv 2022

  12. [12]

    Federated unlearning: Guarantee the right of clients to forget,

    L. Wu, S. Guo, J. Wang, Z. Hong, J. Zhang, and Y . Ding, “Federated unlearning: Guarantee the right of clients to forget,” IEEE Network , vol. 36, no. 5, pp. 129–135, 2022

    work page 2022

  13. [13]

    The right to be forgotten in federated learning: An efficient realization with rapid retraining,

    Y . Liu, L. Xu, X. Yuan, C. Wang, and B. Li, “The right to be forgotten in federated learning: An efficient realization with rapid retraining,” in IEEE INFOCOM 2022-IEEE Conference on Computer Communications. IEEE, 2022, pp. 1749–1758

    work page 2022

  14. [14]

    Federated unlearning and its privacy threats,

    F. Wang, B. Li, and B. Li, “Federated unlearning and its privacy threats,” IEEE Network, vol. 38, no. 2, pp. 294–300, 2023

    work page 2023

  15. [15]

    Fedmua: Exploring the vulnerabilities of federated learning to malicious unlearn- ing attacks,

    J. Chen, Z. Lin, W. Lin, W. Shi, X. Yin, and D. Wang, “Fedmua: Exploring the vulnerabilities of federated learning to malicious unlearn- ing attacks,” IEEE Transactions on Information Forensics and Security , 2025

    work page 2025

  16. [16]

    Robust federated unlearning,

    X. Sheng, W. Bao, and L. Ge, “Robust federated unlearning,” in Proceedings of the 33rd ACM International Conference on Information and Knowledge Management , 2024, pp. 2034–2044

    work page 2024

  17. [17]

    A duty to forget, a right to be assured? exposing vulnerabilities in machine unlearning services,

    H. Hu, S. Wang, J. Chang, H. Zhong, R. Sun, S. Hao, H. Zhu, and M. Xue, “A duty to forget, a right to be assured? exposing vulnerabilities in machine unlearning services,” in NDSS, 2024

    work page 2024

  18. [18]

    Hidden poison: Machine unlearning enables camouflaged poisoning attacks,

    J. Z. Di, J. Douglas, J. Acharya, G. Kamath, and A. Sekhari, “Hidden poison: Machine unlearning enables camouflaged poisoning attacks,” in NeurIPS ML Safety Workshop , 2022

    work page 2022

  19. [19]

    {UBA-Inf}: Unlearning activated backdoor attack with {Influence-Driven} camouflage,

    Z. Huang, Y . Mao, and S. Zhong, “ {UBA-Inf}: Unlearning activated backdoor attack with {Influence-Driven} camouflage,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 4211–4228

    work page 2024

  20. [20]

    Backdoor attack through machine unlearning,

    P. Zhang, J. Sun, M. Tan, and X. Wang, “Backdoor attack through machine unlearning,” CoRR, 2023

    work page 2023

  21. [21]

    A survey on federated unlearning: Challenges, methods, and future directions,

    Z. Liu, Y . Jiang, J. Shen, M. Peng, K.-Y . Lam, X. Yuan, and X. Liu, “A survey on federated unlearning: Challenges, methods, and future directions,” ACM Computing Surveys , vol. 57, no. 1, pp. 1–38, 2024

    work page 2024

  22. [22]

    Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning,

    H. Hu, S. Wang, T. Dong, and M. Xue, “Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 2024, pp. 3257–3275

    work page 2024

  23. [23]

    Unlearn and burn: Adversarial machine unlearning requests destroy model accuracy,

    Y . Huang, D. Liu, L. Chua, B. Ghazi, P. Kamath, R. Kumar, P. Manu- rangsi, M. Nasr, A. Sinha, and C. Zhang, “Unlearn and burn: Adversarial machine unlearning requests destroy model accuracy,” in The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025 . OpenReview.net, 2025

    work page 2025

  24. [24]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International Conference on Artificial Intelligence and Statistics . PMLR, 2020, pp. 2938–2948

    work page 2020

  25. [25]

    When machine unlearning jeopardizes privacy,

    M. Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y . Zhang, “When machine unlearning jeopardizes privacy,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 896–911

    work page 2021

  26. [26]

    The privacy onion effect: Memorization is relative,

    N. Carlini, M. Jagielski, C. Zhang, N. Papernot, A. Terzis, and F. Tramer, “The privacy onion effect: Memorization is relative,”Advances in Neural Information Processing Systems , vol. 35, pp. 13 263–13 276, 2022

    work page 2022

  27. [27]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP) . IEEE, 2017, pp. 3–18

    work page 2017

  28. [28]

    Data duplication: A novel multi-purpose attack paradigm in machine unlearning,

    D. Ye, T. Zhu, J. Li, K. Gao, B. Liu, L. Y . Zhang, W. Zhou, and Y . Zhang, “Data duplication: A novel multi-purpose attack paradigm in machine unlearning,” in 34rd USENIX Security Symposium (USENIX Security 25), 2025

    work page 2025

  29. [29]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017

    Pith/arXiv arXiv 2017

  30. [30]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    Pith/arXiv arXiv 2017

  31. [31]

    Label-consistent backdoor at- tacks,

    A. Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor at- tacks,” arXiv preprint arXiv:1912.02771 , 2019

    Pith/arXiv arXiv 1912

  32. [32]

    Neural network semantic backdoor detection and mitigation: A {Causality-Based} approach,

    B. Sun, J. Sun, W. Koh, and J. Shi, “Neural network semantic backdoor detection and mitigation: A {Causality-Based} approach,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 2883– 2900

    work page 2024

  33. [33]

    Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions,

    T. D. Nguyen, T. Nguyen, P. Le Nguyen, H. H. Pham, K. D. Doan, and K.-S. Wong, “Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions,” Engineering Appli- cations of Artificial Intelligence , vol. 127, p. 107166, 2024

    work page 2024

  34. [34]

    Can you really backdoor federated learning?

    Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?” arXiv preprint arXiv:1911.07963 , 2019

    Pith/arXiv arXiv 1911

  35. [35]

    Attack of the tails: Yes, you really can backdoor federated learning,

    H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.- y. Sohn, K. Lee, and D. Papailiopoulos, “Attack of the tails: Yes, you really can backdoor federated learning,” Advances in Neural Information Processing Systems, vol. 33, pp. 16 070–16 084, 2020

    work page 2020

  36. [36]

    Batch label inference and replacement attacks in black-boxed vertical federated learning,

    Y . Liu, T. Zou, Y . Kang, W. Liu, Y . He, Z. Yi, and Q. Yang, “Batch label inference and replacement attacks in black-boxed vertical federated learning,” arXiv preprint arXiv:2112.05409 , 2021

    Pith/arXiv arXiv 2021

  37. [37]

    Unlearning backdoor attacks in federated learning,

    C. Wu, S. Zhu, P. Mitra, and W. Wang, “Unlearning backdoor attacks in federated learning,” in 2024 IEEE Conference on Communications and Network Security (CNS) . IEEE, 2024, pp. 1–9

    work page 2024

  38. [38]

    Fedsweep: Unlearning back- doors in federated learning,

    Z. Qiu, Q. Zhong, M. Qi, and L. Zhang, “Fedsweep: Unlearning back- doors in federated learning,” in Pacific-Asia Conference on Knowledge Discovery and Data Mining . Springer, 2025, pp. 133–145

    work page 2025

  39. [39]

    Vertical federated unlearning via backdoor certification,

    M. Han, T. Zhu, L. Zhang, H. Huo, and W. Zhou, “Vertical federated unlearning via backdoor certification,” IEEE Transactions on Services Computing, 2025

    work page 2025

  40. [40]

    Cross-silo federated learning: Chal- lenges and opportunities,

    C. Huang, J. Huang, and X. Liu, “Cross-silo federated learning: Chal- lenges and opportunities,” arXiv preprint arXiv:2206.12949 , 2022

    Pith/arXiv arXiv 2022

  41. [41]

    Backdoor learning: A survey,

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , vol. 35, no. 1, pp. 5–22, 2022

    work page 2022

  42. [42]

    Machine unlearning,

    L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” in 2021 IEEE Symposium on Security and Privacy (SP) . IEEE, 2021, pp. 141–159

    2021

  43. [43]

    Fedu: Federated unlearning via user-side influence approximation forgetting,

    W. Wang, C. Zhang, Z. Tian, and S. Yu, “Fedu: Federated unlearning via user-side influence approximation forgetting,” IEEE Transactions on Dependable and Secure Computing , 2024

    work page 2024

  44. [44]

    Sifu: Sequential informed federated unlearning for efficient and provable client unlearning in federated optimization,

    Y . Fraboni, M. Van Waerebeke, K. Scaman, R. Vidal, L. Kameni, and M. Lorenzi, “Sifu: Sequential informed federated unlearning for efficient and provable client unlearning in federated optimization,” in Interna- tional Conference on Artificial Intelligence and Statistics. PMLR, 2024, pp. 3457–3465. 14

    work page 2024

  45. [45]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” Proceedings of Machine Learning and Systems , vol. 2, pp. 429–450, 2020

    2020

  46. [46]

    The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’,

    A. Mantelero, “The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’,” Computer Law & Security Review, vol. 29, no. 3, pp. 229–235, 2013

    work page 2013

  47. [47]

    An introduction to the california consumer privacy act (ccpa),

    E. Goldman, “An introduction to the california consumer privacy act (ccpa),” Santa Clara Univ. Legal Studies Research Paper , 2020

    work page 2020

  48. [48]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in Neural Information Processing Systems , vol. 32, 2019

    work page 2019

  49. [49]

    Index of /exdb/mnist

    “Index of /exdb/mnist.” [Online]. Available: http://yann.lecun.com/exdb/ mnist/

    work page

  50. [50]

    CIFAR-10 and CIFAR-100 datasets

    “CIFAR-10 and CIFAR-100 datasets.” [Online]. Available: https: //www.cs.toronto.edu/∼kriz/cifar.html

    work page

  51. [51]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  52. [52]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778

    2016

  53. [53]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014

    Pith/arXiv arXiv 2014

  54. [54]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” in International Conference on Machine Learning . Pmlr, 2018, pp. 5650–5659

    work page 2018

  55. [55]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 707–723

    work page 2019

  56. [56]

    Understanding generalization of federated learning via stability: Heterogeneity matters,

    Z. Sun, X. Niu, and E. Wei, “Understanding generalization of federated learning via stability: Heterogeneity matters,” in International Confer- ence on Artificial Intelligence and Statistics. PMLR, 2024, pp. 676–684

    work page 2024

  57. [57]

    Ma- chine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Ma- chine learning with adversaries: Byzantine tolerant gradient descent,” Advances in Neural Information Processing Systems , vol. 30, 2017

    work page 2017

  58. [58]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” in Proceedings of NDSS , 2021

    work page 2021

  59. [59]

    Dp- fl: a novel differentially private federated learning framework for the unbalanced data,

    X. Huang, Y . Ding, Z. L. Jiang, S. Qi, X. Wang, and Q. Liao, “Dp- fl: a novel differentially private federated learning framework for the unbalanced data,” World Wide Web, vol. 23, no. 4, pp. 2529–2545, 2020

    work page 2020

  60. [60]

    A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future direc- tions,

    X. Yin, Y . Zhu, and J. Hu, “A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future direc- tions,” ACM Computing Surveys (CSUR), vol. 54, no. 6, pp. 1–36, 2021

    work page 2021

  61. [61]

    A survey on federated learning,

    C. Zhang, Y . Xie, H. Bai, B. Yu, W. Li, and Y . Gao, “A survey on federated learning,” Knowledge-Based Systems , vol. 216, p. 106775, 2021

    work page 2021

  62. [62]

    Federated optimization: Distributed machine learning for on-device intelligence,

    J. Kone ˇcn`y, H. B. McMahan, D. Ramage, and P. Richt ´arik, “Federated optimization: Distributed machine learning for on-device intelligence,” arXiv preprint arXiv:1610.02527 , 2016

    Pith/arXiv arXiv 2016

  63. [63]

    Machine unlearning of features and labels,

    A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck, “Machine unlearning of features and labels,” arXiv preprint arXiv:2108.11577 , 2021

    Pith/arXiv arXiv 2021

  64. [64]

    Rethinking machine unlearning for large language models,

    S. Liu, Y . Yao, J. Jia, S. Casper, N. Baracaldo, P. Hase, Y . Yao, C. Y . Liu, X. Xu, H. Li et al., “Rethinking machine unlearning for large language models,” Nature Machine Intelligence , pp. 1–14, 2025

    work page 2025

  65. [65]

    Reinforcement unlearning,

    D. Ye, T. Zhu, C. Zhu, D. Wang, K. Gao, Z. Shi, S. Shen, W. Zhou, and M. Xue, “Reinforcement unlearning,” in NDSS, 2025. APPENDIX X. R ELATED WORK We provide a detailed introduction of related works of federated learning and machine unlearning as follows. A. Federated Learning Federated learning is a collaborative learning paradigm that enables multiple c...

    work page 2025

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.