Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning
Researchers show malicious federated learning clients can probe broadcast classifiers to recover deleted samples, exposing exact label leakage on MNIST and CIFAR-10.
The paper shows that federated unlearning systems broadcasting updated linear classifiers leak compact additive training summaries to clients. A malicious client can submit known changes, identify server states from returned classifiers, and compare states around an isolated deletion to expose the deleted sample, class, or client summary, potentially enabling reinsertion. On MNIST and CIFAR-10, high-precision broadcasts allowed exact label recovery for every tested deletion, while lower precision sharply reduced fine-grained recovery.
- Classifier broadcasts in federated unlearning reveal hidden additive training summaries.
- Probing around isolated deletions exposes deleted samples, classes, or client summaries.
- High-precision broadcasts enable exact label recovery on MNIST and CIFAR-10.
- Lower broadcast precision and low response diversity sharply limit or prevent recovery.
From the original article
1 min read at arxiv.orgFederated unlearning aims to remove a client's data from a shared model without retraining from scratch. Some efficient systems make deletion exact by storing compact, additive summaries of the training features and broadcasting an updated linear classifier after every accepted change. We show that these broadcasts can also reveal the hidden summaries.
By Yijun Quan · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.