Pith. sign in

REVIEW 5 major objections 5 minor 43 references

Unlearning Clients, Features and Samples in Vertical Federated Learning

T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read VFU-KD and VFU-GA achieve approximate unlearning in vertical federated learning for passive parties, features, and samples without any communication between active and passive parties during the unlearning phase, while keeping utility…

desk verdict A real but niche contribution to VFL unlearning, weakened by overclaimed utility numbers and a weak audit; deserves serious revision, not a desk reject. read the letter →

arxiv 2501.13683 v1 pith:SS7AWXF6 submitted 2025-01-23 cs.LG cs.AI

Ayush K. Varshney , Konstantinos Vandikas , Vicenç Torra This is my paper · ORCID
classification cs.LGcs.AI
keywords federatedlearningunlearningverticalauditingmembershipinferenceattackknowledgedistillationgradientascent
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes that in vertical federated learning, unlearning a client, a feature, or a set of samples can be done by the active party alone, without any extra communication with the passive parties, provided it has saved the embeddings sent during training. For removing a client or feature, VFU-KD trains a smaller student model with knowledge distillation from the old active model on the stored embeddings with the target contribution deleted. For removing samples, VFU-GA runs gradient ascent on the target samples' stored embeddings while minimizing loss on the rest. Across six tabular and two image datasets, the authors report utility close to retraining from scratch or the R2S baseline, and they audit the removal with a membership inference attack. If correct, this gives vertical federated learning a low-overhead path to satisfying right-to-be-forgotten requests.

What carries the argument

The central object is the active party's stored history of concatenated embeddings, $\mathbf{H}_t = \mathrm{concat}(\mathbf{H}_1,\dots,\mathbf{H}_K)$ for each training round $t$, together with the knowledge-distillation loss $\mathcal{L} = \alpha\,\mathrm{KL}(\hat{y}_{\text{student}},\hat{y}_{\text{teacher}}) + (1-\alpha)\,\mathcal{L}_{\text{pred}}$ that trains a shrunken student model on $\mathbf{H}_t \setminus \mathbf{H}_u$. This makes model compression (fewer input neurons after removing a party or feature) and unlearning happen in one step, with no need to ask remaining parties for new data. For sample unlearning, the same stored embeddings enable a gradient ascent update $\Theta^{t+1}_K = \Theta^t_K - \eta_1 \nabla L_{\text{retain}} + \lambda \nabla L_{\text{target}}$ that pushes the active model away from the forgotten samples.

What would settle it

Run VFU-KD to unlearn a client at epoch 25, then let one remaining client perform additional local training for five epochs, and compare the unlearned active model against a model retrained from scratch with the same updated client; if predictions on a holdout set diverge by more than the paper's reported 1–5% utility gap, the assumption of static stored embeddings is violated.

Watch

Extended reading notes

Core claim

The paper's central claim is that approximate unlearning in vertical federated learning can be made communication-free: because the active party already stores the per-batch embeddings sent by passive parties during training, it can reconstruct the effect of a retrained model without contacting those parties again. VFU-KD handles client and feature unlearning by initializing a student model with the reduced input size, using the old active model (or the old passive model) as teacher, and minimizing a combination of prediction loss and KL-divergence to the teacher's logits; for feature unlearning within a passive party, the loss is just the KL divergence between the student's and teacher's embeddings. VFU-GA handles sample unlearning by taking a few gradient ascent steps on the embeddings of the target samples and descent steps on the retain set. The paper reports that these methods match or slightly exceed retraining-from-scratch utility in many cases, with modest 1–5% losses otherwise, and that a membership inference attack can detect the unlearning.

Load-bearing premise

The stored historical embeddings still represent what the remaining passive parties would currently produce; if any of those parties updates its local model after the unlearning moment, or the sample alignment changes, the unlearned model is built from outdated embeddings and would not match a freshly retrained model.

Editorial extensions

If this is right

  • A passive party can be removed from a VFL model without that party or any other passive party exchanging a single message with the active party during unlearning, as long as the active party kept the training-time embeddings.
  • Feature unlearning becomes possible for passive parties that never see labels: the party can shrink its own local model by distillation on its own data, and the active model no longer receives that feature's contribution.
  • Sample unlearning can be completed in a few gradient steps on stored embeddings rather than retraining the whole federation, cutting the cost of right-to-be-forgotten requests.
  • The active party's storage requirement becomes the price of communication-free unlearning; the paper shows this trade-off explicitly by reporting the gigabytes R2S would need to communicate for benchmarks.
  • Membership inference attacks can serve as an audit signal for VFL unlearning, since the attack's accuracy drops after unlearning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If a remaining passive party continues local training after the unlearning point, the stored embeddings become stale; testing VFU-KD under that drift would show whether the no-communication property survives evolving models, or whether it needs periodic refresh.
  • The same distillation-on-stored-embeddings recipe could plausibly be extended to unlearning clusters of samples or to sequential unlearning requests, since each request only edits $\mathbf{H}_t$ and re-runs the student training.
  • The reported utility parity with retraining suggests that a larger-scale study across heterogeneous feature partitions and label distributions is a natural next step, rather than a guaranteed outcome.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes two unlearning methods for vertical federated learning (VFL): VFU-KD, which uses knowledge distillation to remove a passive party or a feature within a passive party from the active model without communication between active and passive parties, and VFU-GA, which uses gradient ascent on the forget set to remove training samples. The active party stores historical embeddings during training, enabling these methods to operate without additional communication. The paper evaluates utility (AUC, F1) on six tabular and two image datasets against retraining from scratch and an R2S fast-retraining baseline, and audits unlearning with a membership inference attack (MIA). The central claims are that VFU-KD and VFU-GA achieve approximate unlearning with utility comparable to retraining (0-2% improvement or 1-5% loss in most cases), and that no communication is needed during unlearning at the cost of storing historical embeddings.

Significance. If validated, the paper would fill a real gap: most federated unlearning work targets horizontal FL, while VFL has distinct constraints (label server, communication cost, and model-size changes when removing parties or features). The no-communication property and the treatment of client, feature, and sample unlearning in one framework are timely and potentially useful for practical VFL deployments. The paper is also transparent about its storage overhead and the weakness of its MIA audit. However, the evidence supporting the central unlearning claim is currently insufficient: the KD objective is not shown to remove target-party influence, the audit attack is self-admittedly weak, and some utility numbers contradict the stated 1-5% loss range. The contribution is therefore conditional on a substantially strengthened evaluation.

major comments (5)
  1. [Section 3, Algorithm 2, Eq. (5)] The distillation objective trains the randomly initialized student to match the logits of the old active model, but that teacher was trained on H_t that includes the target party's embeddings (line 5 computes the teacher prediction before H_u is removed on line 6). The paper's lower-bound argument on KL divergence shows only that the student diverges from the teacher; it does not show that the student is close to a model retrained without the target party, nor that target-specific information has been removed. This is the central unlearning claim and needs either a formal argument relating the divergence to closeness to a retrained model, or substantially stronger empirical auditing (e.g., a stronger MIA, linear-probing tests on the student's representation, or targeted queries where the target party's contribution is known to matter).
  2. [Section 3, Algorithm 3, Eqs. (6)-(7)] The same issue applies to feature unlearning: the student's embedding is distilled toward the teacher embedding, and the teacher model was trained with the target feature present. Minimizing KL between student and teacher embeddings, without any label or task signal on the reduced feature set, can preserve the teacher's target-feature-dependent behavior in the student. The paper should provide evidence that the student's embedding is not merely a compressed version of the teacher's but actually removes the target feature's influence, for example by showing that an attacker cannot distinguish target-feature contributions in the student or by comparing against a model trained from scratch without that feature.
  3. [Section 4.4 and Section 4.5, limitation (3)] The MIA audit used to support the unlearning claim is a single-hidden-layer 32-neuron model trained for 10 epochs on output logits, and the paper itself states in Section 4.5(3) that this is a 'relatively weak' attack. No error bars or statistical significance tests are reported for the attack accuracy, despite the paper stating that each experiment was repeated three times. A weak attacker can easily fail to detect residual influence, especially when the target party's features do not strongly shift the output distribution. The audit therefore does not establish approximate unlearning; the authors should use a stronger, better-calibrated MIA (e.g., the LiRA-style attack they cite as future work in the conclusion) and report attack performance on the unlearned model versus a retrained model with error bars.
  4. [Section 4.1, Tables 1 and 2] The abstract and Section 4.1 claim that remaining cases show only a modest utility loss of 1-5%, but the tables contradict this. In Table 2, the Poqemon row at the 5th epoch shows VFU-KD F1=0.54 versus 0.75 for retraining from scratch, an absolute drop of 0.21, and the 15th, 35th, and 45th epoch rows show drops of 0.06-0.10; Table 1's Poqemon AUC at the 5th epoch is 0.88 versus 0.94. These are well outside the claimed 1-5% range. Additionally, although the experiments were repeated three times, no table reports standard deviations or per-run values, so small differences between methods are not shown to be statistically meaningful. The utility claims need to be corrected and the results need error bars.
  5. [Section 4.5, limitation (4), and Algorithm 2] The paper acknowledges the storage cost of historical embeddings but does not address the staleness of those embeddings. Algorithm 2 trains the student entirely on stored H_t after removing H_u. If the remaining passive parties' models were trained jointly with the target party, those stored embeddings may encode target influence, and after unlearning the remaining parties may continue to update their local models. In either case, the stored embeddings need not correspond to the embeddings that a retrained-from-scratch model would see. Since the no-communication property depends on the stored H_t being a valid stand-in for current passive-party behavior, this assumption should be stated explicitly and tested, for example by comparing VFU-KD against a variant in which the remaining passive parties' embeddings are recomputed after retraining.
minor comments (5)
  1. [Section 2.2, Eq. (1) vs Section 3, Eq. (5)] The loss in Eq. (1) is written with (1-alpha) on the prediction loss and no explicit coefficient on the KL term, whereas Eq. (5) writes L = alpha * L_distill + (1-alpha) * L_pred. Please define the coefficients consistently and state the default value of alpha in one place.
  2. [Table 3] The Hepmass entry at the 45th epoch is 11.3 GB, which is smaller than the 35th epoch entry of 88.2 GB; this looks like a typo (possibly 113.0). Also, the Poqemon row uses '22' without a decimal point while other rows have one decimal place.
  3. [Figures 3 and 5] The captions refer to shading indicating unlearning epochs, but the figures are reproduced in grayscale in the text and the shading is difficult to interpret. Please add a legend, distinct line styles, or explicit vertical markers for the unlearning epoch.
  4. [Section 4.4, Figures 8 and 10] The x-axis labels in the MIA plots skip some of the experimental epochs (e.g., 15 and 50), and the plots do not show any measure of variance. Please align the x-axis with the epochs listed in Section 4 and add error bars or confidence bands.
  5. [Section 4.2 and Figure 14] The text says feature importance is computed with feature ablation, but it does not describe how the 'most important' and 'least important' features are selected when features are distributed across multiple passive parties. Figure 14 also appears to lack axis labels for the Poqemon panel; please make the feature-selection procedure explicit.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: VFU-KD and VFU-GA are standard distillation/gradient-ascent procedures evaluated against retraining baselines, and no fitted parameter is renamed as a prediction.

full rationale

The paper's derivation chain is self-contained with respect to the circularity patterns considered. VFU-KD (Algorithm 2) trains a randomly initialized student on stored embeddings H_t\H_u using a convex combination of prediction loss and KL-divergence to a fixed teacher; the teacher's inclusion of the target party's influence is a design choice that could weaken the unlearning guarantee, but it is not an input that is then re-derived as the output. VFU-GA (Algorithm 4) applies the standard gradient-ascent update Lambda * grad L_target plus retain-set descent, again a known optimization procedure rather than a circular reduction. No model parameter is fitted to the unlearning target and then reported as a prediction; the utility comparisons are against retrained-from-scratch and R2S baselines, and the MIA is an external audit. The acknowledged limitation in Section 4.5(3) that the MIA is 'relatively weak' is a validity concern about the strength of the evidence, not a circularity. Likewise, the storage requirement in Section 4.5(4) and the staleness of stored embeddings are assumptions about the setting, not definitional equivalences. No load-bearing self-citation, imported uniqueness theorem, or ansatz-smuggling citation appears in the argument. Concerns about residual influence from the teacher are substantive correctness risks but do not satisfy the evidentiary standard for circularity because the paper does not define unlearning success solely in terms of the teacher or the MIA drop in a way that makes the claim true by construction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entities are introduced; all components are standard ML constructs (teacher/student models, embeddings, gradient ascent).

free parameters (3)
  • Distillation coefficient alpha = 0.3
    Eq. 5 and Algorithm 2 use alpha to balance prediction loss and distillation loss; the paper states it is set to 0.3, chosen arbitrarily rather than tuned.
  • Unlearning rate lambda = not reported
    Algorithm 4 and Eq. 8 control the strength of gradient ascent on target samples; the value is not given in the experiments.
  • Gradient ascent unlearning epochs u_ep = 5
    Section 4.3 states the number of GA steps was set to 5 'chosen arbitrarily'.
assumptions (5)
  • domain assumption Active party holds labels; passive parties hold distinct feature subsets and no labels, with sample alignment done via private set intersection.
    Section 2.1 defines the VFL setting; all three algorithms rely on this information structure.
  • domain assumption Stored historical embeddings H_t remain representative of the remaining passive parties' models at the time of unlearning.
    Algorithm 2 trains the student model entirely on stored H_t\H_u. If remaining parties' local models or data have changed, the stored embeddings are stale and the unlearned model does not match a retrained model.
  • domain assumption Knowledge distillation loss is a sufficient signal to produce an unlearned model approximating retraining.
    The paper relies on KL divergence between teacher and student outputs (Eq. 5, Algorithms 2-3) without proving equivalence to retraining; this is validated only empirically.
  • ad hoc to paper The KL divergence between teacher and student is lower bounded by some delta measuring the degree of unlearning.
    Section 3 states this lower bound without proof and uses it to justify measuring unlearning; it is an unverified theoretical construct.
  • domain assumption MIA accuracy drop is a valid audit signal for unlearning.
    Section 3.1 and 4.4 treat a drop in membership inference attack accuracy as evidence of unlearning, but no baseline or confidence intervals are provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Unlearning Clients, Features and Samples in Vertical Federated Learning." pith.science (2026). https://pith.science/paper/SS7AWXF6

@misc{pith2026250113683,
  author       = {Pith},
  title        = {Pith review of: Unlearning Clients, Features and Samples in Vertical Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SS7AWXF6}},
  note         = {Machine review of arXiv:2501.13683}
}
abstract

Federated Learning (FL) has emerged as a prominent distributed learning paradigm. Within the scope of privacy preservation, information privacy regulations such as GDPR entitle users to request the removal (or unlearning) of their contribution from a service that is hosting the model. For this purpose, a server hosting an ML model must be able to unlearn certain information in cases such as copyright infringement or security issues that can make the model vulnerable or impact the performance of a service based on that model. While most unlearning approaches in FL focus on Horizontal FL (HFL), where clients share the feature space and the global model, Vertical FL (VFL) has received less attention from the research community. VFL involves clients (passive parties) sharing the sample space among them while not having access to the labels. In this paper, we explore unlearning in VFL from three perspectives: unlearning clients, unlearning features, and unlearning samples. To unlearn clients and features we introduce VFU-KD which is based on knowledge distillation (KD) while to unlearn samples, VFU-GA is introduced which is based on gradient ascent. To provide evidence of approximate unlearning, we utilize Membership Inference Attack (MIA) to audit the effectiveness of our unlearning approach. Our experiments across six tabular datasets and two image datasets demonstrate that VFU-KD and VFU-GA achieve performance comparable to or better than both retraining from scratch and the benchmark R2S method in many cases, with improvements of $(0-2\%)$. In the remaining cases, utility scores remain comparable, with a modest utility loss ranging from $1-5\%$. Unlike existing methods, VFU-KD and VFU-GA require no communication between active and passive parties during unlearning. However, they do require the active party to store the previously communicated embeddings.

Figures

Figures reproduced from arXiv: 2501.13683 by the authors.

Figure 1
Figure 1. Vertical federated learning framework (1) A novel vertical federated unlearning framework with knowl￾edge distillation to unlearn a passive party. (2) A novel feature unlearning framework for a passive party in VFL. (3) A novel sample unlearning framework using gradient ascent in VFL. (4) A membership inference attack to audit the unlearning in VFL. (5) Empirical analysis on tabular as well as image datasets. The re… view at source ↗
Figure 2
Figure 2. MIA attack model. The choice of unlearning rate 𝜆 plays a crucial role in determining the speed of convergence and stability. A poor choice of 𝜆 may result in the model parameters getting stuck in local optimum. In comparison with fine-tuning (eq. 9), the model accelerates with 𝜆 𝛿𝐿𝑡𝑎𝑟𝑔𝑒𝑡 Θ 𝑡 𝐾 to quickly unlearn the updates from target set with Algo￾rithm 4. The choice of 𝜆 and 𝑢𝑒𝑝 can further be used to determine … view at source ↗
Figure 3
Figure 3. The training and test loss of VFU-KD compared to the retrained model from scratch and R2S method. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: The training (red) and test loss (blue) of VFU-KD [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: The loss curves of VFU-KD compared to the re [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The training and test loss of VFU-KD for most [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 8
Figure 8. Figure 8: The MIA attack accuracy (y-axis) of VFU-KD. [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 10
Figure 10. Figure 10: The MIA attack accuracy (y-axis) of VFU-GA. [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 12
Figure 12. Figure 12: The training and test loss values of VFU-KD for [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]
Figure 13
Figure 13. Figure 13: The F1 and AUC score of VFU-KD for the wine [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]
Figure 14
Figure 14. Figure 14: The feature importance plot. Each bar, from left to right, represents the features in order from the first to the last [PITH_FULL_IMAGE:figures/full_fig_p014_14.png]
Figure 15
Figure 15. Figure 15: The training and test loss of VFU-GA (1 batch) for [PITH_FULL_IMAGE:figures/full_fig_p014_15.png]
Figure 16
Figure 16. Figure 16: The MIA attack accuracy (y-axis) of VFU-GA (1 [PITH_FULL_IMAGE:figures/full_fig_p015_16.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 24 canonical work pages

  1. [1]

    Lamine Amour, Souihi Sami, Said Hoceini, and Abdelhamid Mellouk. 2015. Build- ing a large dataset for model-based QoE prediction in the mobile environment. In Proceedings of the 18th ACM International Conference on Modeling, Analysis and Simulation of Wireless and Mobile Systems . 313–317

    work page 2015

  2. [2]

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. In International conference on artificial intelligence and statistics . PMLR, 2938–2948

    2020

  3. [3]

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hen- grui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP) . IEEE, 141–159

    2021

  4. [4]

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. 2022. Membership inference attacks from first principles. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 1897–1914

    2022

  5. [5]

    Adam Coates, Andrew Ng, and Honglak Lee. 2011. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth inter- national conference on artificial intelligence and statistics . JMLR Workshop and Conference Proceedings, 215–223

    2011

  6. [6]

    Zihao Deng, Zhaoyang Han, Chuan Ma, Ming Ding, Long Yuan, Chunpeng Ge, and Zhe Liu. 2023. Vertical federated unlearning on the logistic regression model. Electronics 12, 14 (2023), 3182

    work page 2023

  7. [7]

    Changyu Dong, Liqun Chen, and Zikai Wen. 2013. When private set intersection meets big data: an efficient and scalable protocol. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security . 789–800

    work page 2013

  8. [8]

    Dashan Gao, Sheng Wan, Lixin Fan, Xin Yao, and Qiang Yang. 2024. Complemen- tary Knowledge Distillation for Robust and Privacy-Preserving Model Serving in Vertical Federated Learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 19832–19839

    work page 2024

Show all 43 references
  1. [9]

    Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. 2019. Making ai forget you: Data deletion in machine learning. Advances in neural information processing systems 32 (2019)

    2019

  2. [10]

    Jianping Gou, Baosheng Yu, Stephen J Maybank, and Dacheng Tao. 2021. Knowl- edge distillation: A survey. International Journal of Computer Vision 129, 6 (2021), 1789–1819

    2021

  3. [11]

    Laura Graves, Vineel Nagisetty, and Vijay Ganesh. 2021. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 35. 11516–11524

    2021

  4. [12]

    Anisa Halimi, Swanand Kadhe, Ambrish Rawat, and Nathalie Baracaldo. 2022. Federated unlearning: How to efficiently erase a client in fl? arXiv preprint arXiv:2207.05521 (2022)

    2022 arXiv

  5. [13]

    Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 (2015)

    2015 arXiv

  6. [14]

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2022. Membership inference attacks on machine learning: A survey.ACM Computing Surveys (CSUR) 54, 11s (2022), 1–37

    2022

  7. [15]

    Yu Jiang, Jiyuan Shen, Ziyao Liu, Chee Wei Tan, and Kwok-Yan Lam. 2024. To- wards efficient and certified recovery from poisoning attacks in federated learning. arXiv preprint arXiv:2401.08216 (2024)

    2024 arXiv

  8. [16]

    Markelle Kelly, Rachel Longjohn, and Kolby Nottingham. 2023. The UCI machine learning repository. URL https://archive. ics. uci. edu (2023)

    2023

  9. [17]

    Alex Krizhevsky. 2009. Learning Multiple Layers of Features from Tiny Images. (2009). https://api.semanticscholar.org/CorpusID:18268744

    2009

  10. [18]

    Guanghao Li, Li Shen, Yan Sun, Yue Hu, Han Hu, and Dacheng Tao. 2023. Subspace based federated unlearning. arXiv preprint arXiv:2302.12448 (2023)

    2023 arXiv

  11. [19]

    Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, and Bingsheng He. 2021. A survey on federated learning systems: Vision, hype and reality for data privacy and protection. IEEE Transactions on Knowledge and Data Engineering 35, 4 (2021), 3347–3366

    2021

  12. [20]

    Gaoyang Liu, Xiaoqiang Ma, Yang Yang, Chen Wang, and Jiangchuan Liu. 2021. Federaser: Enabling efficient client-level data removal from federated learning models. In 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS). IEEE, 1–10

    2021

  13. [21]

    Liyuan Liu, Haoming Jiang, Pengcheng He, Weizhu Chen, Xiaodong Liu, Jianfeng Gao, and Jiawei Han. 2019. On the variance of the adaptive learning rate and beyond. arXiv preprint arXiv:1908.03265 (2019)

    2019 arXiv

  14. [22]

    Yang Liu, Tao Fan, Tianjian Chen, Qian Xu, and Qiang Yang. 2021. Fate: An industrial grade platform for collaborative learning with data protection. Journal of Machine Learning Research 22, 226 (2021), 1–6

    2021

  15. [23]

    Yang Liu, Yan Kang, Tianyuan Zou, Yanhong Pu, Yuanqin He, Xiaozhou Ye, Ye Ouyang, Ya-Qin Zhang, and Qiang Yang. 2024. Vertical federated learning: Concepts, advances, and challenges. IEEE Transactions on Knowledge and Data Engineering (2024)

    2024

  16. [24]

    Linpeng Lu and Ning Ding. 2020. Multi-party private set intersection in vertical federated learning. In 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) . IEEE, 707–714

    2020

  17. [25]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial intelligence and statistics . PMLR, 1273–1282

    2017

  18. [26]

    Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In2019 IEEE symposium on security and privacy (SP). IEEE, 739–753

    2019

  19. [27]

    Prayitno, Chi-Ren Shyu, Karisma Trinanda Putra, Hsing-Chung Chen, Yuan-Yu Tsai, KSM Tozammel Hossain, Wei Jiang, and Zon-Yin Shae. 2021. A systematic review of federated learning in the healthcare area: From the perspective of data properties and applications. Applied Sciences...

    2021

  20. [28]

    Othmane Sebbouh, Marco Cuturi, and Gabriel Peyré. 2022. Randomized stochastic gradient descent ascent. In International Conference on Artificial Intelligence and Statistics. PMLR, 2941–2969

    2022

  21. [29]

    Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli

  22. [30]

    Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. 2022. Unrolling sgd: Understanding factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) . IEEE, 303–319

    2022

  23. [31]

    Fei Wang, Baochun Li, and Bo Li. 2023. Federated unlearning and its privacy threats. IEEE Network (2023), 463–480. https://doi.org/10.1109/MNET.004.2300056

    2023 doi

  24. [32]

    Zichen Wang, Xiangshan Gao, Cong Wang, Peng Cheng, and Jiming Chen. 2024. Efficient Vertical Federated Unlearning via Fast Retraining. ACM Transactions on Internet Technology 24, 2 (2024), 1–22

    2024

  25. [33]

    Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck

  26. [34]

    Kang Wei, Jun Li, Chuan Ma, Ming Ding, Sha Wei, Fan Wu, Guihai Chen, and Thilina Ranbaduge. 2022. Vertical federated learning: Challenges, methodologies and experiments. arXiv preprint arXiv:2202.04309 (2022)

    2022 arXiv

  27. [35]

    Chen Wu, Sencun Zhu, and Prasenjit Mitra. 2022. Federated unlearning with knowledge distillation. arXiv preprint arXiv:2201.09441 (2022)

    2022 arXiv

  28. [36]

    Zhaomin Wu, Junyi Hou, Yiqun Diao, and Bingsheng He. 2024. Federated Trans- former: Multi-Party Vertical Federated Learning on Practical Fuzzily Linked Data. arXiv preprint arXiv:2410.17986 (2024)

    2024 arXiv

  29. [37]

    Dongkeun Yoon, Joel Jang, Sungdong Kim, and Minjoon Seo. 2023. Gradient As- cent Post-training Enhances Language Model Generalization. In The 61st Annual Meeting Of The Association For Computational Linguistics

    2023

  30. [38]

    Chong Yu, Shuaiqi Shen, Shiqiang Wang, Kuan Zhang, and Hai Zhao. 2024. Communication-Efficient Hybrid Federated Learning for E-Health With Hori- zontal and Vertical Data Partitioning. IEEE Transactions on Neural Networks and Learning Systems (2024)

    2024

  31. [39]

    Haibo Zhang, Toru Nakamura, Takamasa Isohara, and Kouichi Sakurai. 2023. A review on machine unlearning. SN Computer Science 4, 4 (2023), 337

    2023

  32. [40]

    Fanglan Zheng, Kun Li, Jiang Tian, Xiaojia Xiang, et al. 2020. A vertical federated learning method for interpretable scorecard and its application in credit scoring. arXiv preprint arXiv:2009.06218 (2020)

    2020 arXiv

  33. [41]

    Xiangrong Zhu, Guangyao Li, and Wei Hu. 2023. Heterogeneous federated knowledge graph embedding learning and unlearning. In Proceedings of the ACM web conference 2023. 2444–2454. A HESSIAN UTILITY SCORE Fig. 11 shows the F1 and AUC scores for client unlearning with H−1. Here a...

    2023

  34. [2021]

    arXiv preprint arXiv:2108.11577 (2021)

    Machine unlearning of features and labels. arXiv preprint arXiv:2108.11577 (2021)

    2021 arXiv

  35. [2023]

    Fast yet effective machine unlearning.IEEE Transactions on Neural Networks and Learning Systems (2023)

    2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.