{"id":"ea4c8743-6d76-4821-9f35-ea305e5d0642","arxiv_id":"2412.11476","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A gradient-ascent unlearning algorithm verified by backdoor accuracy is proposed for federated models, but the experimental setup and the unenforced constraint weaken the central VFL claim.","lead":"To delete one participant's contribution from a federated model, this paper runs gradient ascent on that participant's data, keeping the model near a reference built from the remaining participants, and uses an injected backdoor pattern as a check that the data was forgotten.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 2 does not implement the ℓ2-ball constraint in Eq. 8: no projection or radius check appears, so the claimed bounded gradient ascent is not the procedure actually tested.","rationale":"I read the paper in good faith: its goal is vertical federated unlearning via gradient ascent guided by a constrained model, with a backdoor-based verification metric. For the central claim to hold, two conditions are necessary: (1) Wcon in Eq. 7 must approximate a model trained without the target client's contribution, and (2) the optimization must actually be constrained so that the unlearned model remains near Wcon. The reader's weakest_assumption is condition (1), but I find condition (2) even more fundamental because the paper's own Algorithm 2 omits the constraint. The only reference to the ℓ2 ball is the phrase 'subject to Wi ∈ {Z : ||Z − Wcon||2 ≤ R}' in line 4; no projection step, no radius check, and no use of R appear in the pseudocode or in the described evaluation. The early-stopping rule compares against the original model W_i^(E−1), not against Wcon, so it does not indirectly enforce the ball either. This is an internal inconsistency, not merely a disagreement with external consensus: the method text promises a bound, the algorithm does not implement it, and the radius-ablation tables do not provide a mechanism linking R to the trajectory. The concrete test of inspecting the public code will settle this directly. If no projection exists in the code, the empirical support is for a different algorithm—unconstrained gradient ascent plus early stopping—whose novelty reduces to prior work [46], and the REJECT verdict is strongly supported. Credit is due for publicly releasing code and reporting several metrics, but code availability does not repair an algorithmic mismatch between the stated method and the implementation. Since my concern reinforces the reader's REJECT rather than changing it, the appropriate verdict status is unchanged.","tokens_in":19977,"tokens_out":5410,"duration_ms":52046,"concrete_test":"Inspect the official repository at https://github.com/mengde-han/VFL-unlearn and instrument the unlearning loop to log ||W_i^(k) − Wcon||_2 at every iteration together with R. Also search the unlearning code for any projection or clipping operation onto the ℓ2 ball. If the distance exceeds R at any step, or if no projection exists, then the constraint in Eq. 8 is not enforced and the reported results cannot be attributed to the claimed bounded optimization.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim in Section IV-A is that unlearning is performed by gradient ascent within an ℓ2-norm ball of radius R centered on the constrained model Wcon, and that this bound is what preserves utility. But the method as specified never enforces that constraint. Equation 8 defines the constrained maximization problem, yet Algorithm 2's update step (line 4) is plain gradient ascent; there is no projection onto {Z : ||Z − Wcon||2 ≤ R}, no feasibility check, and no use of R anywhere in the loop. The early-stopping condition in line 5 compares ||W_i^(k) − W_i^(E−1)||2 to threshold T, not the distance to Wcon or the radius R. Consequently, Wcon and R play no algorithmic role in the implementation as written; the actual procedure is unconstrained gradient ascent plus an ad hoc stopping rule. This is more load-bearing than the proxy quality of Eq. 7: even if Wcon were a perfect proxy for the retrained model, the described algorithm would not be guided by it because the stated bound is never applied to the trajectory. The empirical results in Table IV, Figures 6, and Tables VI–IX therefore do not test the bounded optimization that the paper claims as its contribution. If the public repository contains an omitted projection step, that omission is still a serious reproducibility gap; if it does not, the central mechanism is absent.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a vertical federated unlearning method based on constrained gradient ascent, together with a backdoor-based verification mechanism. The method defines a constrained model Wcon by algebraically reweighting the global and target-client models (Eq. 7), then states a constrained maximization problem in an ℓ2-norm ball around Wcon (Eq. 8). Algorithm 2 supposedly performs gradient ascent subject to this constraint, and the paper reports experiments on MNIST, Fashion-MNIST, and CIFAR-10 showing that backdoor accuracy drops to zero and that post-training restores clean accuracy to levels comparable to retraining from scratch. The paper also reports membership-inference results and time-complexity comparisons in support of the claimed efficiency of the unlearning procedure.","tokens_in":20291,"tokens_out":4011,"duration_ms":38781,"significance":"If the proposed mechanism were correctly implemented and its verification were non-circular, the paper would address an important gap: vertical federated unlearning for image data with a lightweight verification method. The idea of using a reference model to bound gradient ascent is reasonable in principle, and the paper ships a public code repository, which is a practical strength. However, the central algorithmic constraint is not actually enforced in the described algorithm, and the backdoor metric is defined in a way that makes the main empirical result a near-tautology. The comparison against retraining is therefore not yet supported by the evidence as presented.","major_comments":[{"comment":"The ℓ2-ball constraint that is the central claim of the method is never enforced in Algorithm 2. Line 4 performs plain gradient ascent and only labels the update with the phrase 'subject to Wi ∈ {Z : ∥Z − Wcon∥2 ≤ R}'; there is no projection step, no feasibility check, and the radius R is never used inside the loop. The early-stopping condition in line 5 compares ∥W_i^(k) − W_i^(E−1)∥2 to T, not the distance to Wcon or the radius R. Consequently, the experiments in Tables IV, VI–IX and Figures 5–6 do not test the bounded optimization problem stated in Eq. (8). If the public repository contains an omitted projection step, that omission is a serious reproducibility gap; if it does not, the central mechanism of the paper is absent.","section":"Section IV-C, Eq. (8) and Algorithm 2"},{"comment":"The derivation of the constrained model assumes that exactly half of the target client's data is clean, but the experimental setup states that up to 80% of the target client's images are backdoored. The expression Wcon = (2N W^(k) − W_i^(k−1))/(2N−1) is derived from the 'preserve half of its model' rationale, and it is unclear how this formula represents the clean-client model when the poisoning fraction is 80%. Since Wcon is the anchor for the entire unlearning procedure, the paper needs to justify this formula under the actual poisoning rates or report results when the poisoning fraction is exactly 50%.","section":"Section IV-C, Eq. (7) vs. Section V-B"},{"comment":"The backdoor 'certification' is largely circular. Algorithm 2 maximizes the loss L(W_i; xB_i, y_i) on exactly the target client's backdoored data, and the same backdoored data are used to compute backdoor accuracy in the evaluation. Driving the loss on those samples to a high value therefore makes the backdoor accuracy drop to zero by construction; the 0.0 entries in Table IV do not provide independent evidence that the influence of the target client has been removed. A meaningful certification would use a held-out trigger set not seen by the gradient-ascent objective, or would unlearn on clean data and then test backdoor persistence.","section":"Section IV-C and Table IV"},{"comment":"Equation (10) defines backdoor accuracy as (1/N) Σ 1(G(x_i) = y_i), where y_i is described as the 'corresponding label' of the poisoned sample. For a backdoor attack with target label '8', the success criterion should be G(x_i) = 8, not G(x_i) = y_i. As written, the formula measures ordinary classification accuracy on poisoned inputs, which is not the standard backdoor accuracy and makes the headline 'Backdoor Acc' values in Table IV and Figures 5–6 hard to interpret.","section":"Section V-B, Eq. (10)"},{"comment":"The manuscript conflates the number of VFL parties with the number of FedAvg clients. The VFL framework in Section III-C has two parties, A and B, but Algorithm 1 and Eq. (7) treat N clients with local models W_i^(k). The experiments split each image into two vertical halves for parties A and B, then claim N=5 and N=10 clients. The paper never specifies how the two-party SplitNN protocol interacts with the N-client FedAvg aggregation, so it is not clear that the experiments actually test a vertical federated learning system. A precise protocol with the coordinator's loss, the party-level losses, and the aggregation over N clients is needed.","section":"Sections III-C, V-A, and Algorithm 1"},{"comment":"All reported accuracies and recalls appear to come from a single run, with no error bars or multiple-seed statistics. For example, Table V reports MIA recall to 16 decimal places (e.g., 0.9899403874813711) and exactly 0 for the unlearn methods, which is not credible without variance or a detailed explanation. Without repeated runs, the claimed equivalence to Retrain is not statistically supported.","section":"Tables IV and V, general experimental reporting"}],"minor_comments":[{"comment":"The sentence 'First of all, it contains most of shadow model that' is incomplete and appears to be a typo; it should be removed or completed.","section":"Section I, contribution list"},{"comment":"In Table I, W is described as 'the gradient of the model' but is used throughout as model parameters; Eq. (6) also writes i ∈ Di, which is a subscript error since i already denotes the client index.","section":"Section III-A and Eq. (6)"},{"comment":"The symbols SGDA and SGDB are used without definition; the pseudocode should state that these are stochastic gradient descent updates for party A and party B respectively.","section":"Algorithm 1, line 15"},{"comment":"There is a typo in 'Fashihon-MNIST' that should read 'Fashion-MNIST'.","section":"Section V-C, subsection 2"},{"comment":"The description of the radius R says 'Dist represents the average Euclidean distance between Wcon and a random model, calculated by averaging over 10 random models, with the early stop threshold activated.' This definition is unclear: it should specify which model the distance is measured from and how early stopping affects the distance.","section":"Section V-C, subsection 6"}],"recommendation":"reject","confidential_remarks":"The central contribution as written is not implemented: the constrained optimization in Eq. (8) is not enforced in Algorithm 2, and the backdoor metric is measured on the same data that the unlearning objective attacks. These are load-bearing issues that affect every empirical claim. The paper could in principle be revised by adding a real projection step, using a held-out trigger set, fixing the backdoor-accuracy formula, and re-running all experiments, but that would constitute a substantially new submission rather than a minor fix."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is an engineering sketch for removing one client's feature contribution in a SplitNN-style setup, with public code and experiments on three datasets. The core idea—reverse the training direction with gradient ascent, guided by a FedAvg-derived constrained model—is a reasonable heuristic, and the empirical pattern (backdoor accuracy dropping to 0, clean accuracy recovering after a few post-training rounds) is encouraging if the implementation is sound. The MIA check and time-complexity comparison are useful additions.\n\nThe problems start with the central mechanism. Equation 8 defines a constrained maximization inside an ℓ2 ball around Wcon, but Algorithm 2 never enforces that constraint. There is no projection step, no feasibility check, and R appears nowhere in the loop. The early-stopping condition compares to W_i^(E−1), not to Wcon. So as written, the method is unconstrained gradient ascent plus an ad hoc stopping rule. That is load-bearing, because the paper's stated contribution is the bounded optimization that preserves utility. The parameter tables for R suggest the radius may actually be used somewhere, but the manuscript doesn't say how. The code could resolve this, but the submitted text does not.\n\nThe second issue is the VFL framing. The method describes parties A and B holding complementary feature halves, yet the experiments use N clients, each seemingly with both halves, aggregated via FedAvg. That conflation makes it unclear what \"vertical\" means here and whether the unlearning target is a client or a party. The paper should be explicit about the system model.\n\nSmaller soft spots: no error bars (single runs), T is grid-searched per dataset, and the \"certification\" is just a backdoor-accuracy metric, not a formal guarantee. The constrained-model formula in Eq. 7 is also hand-wavy, relying on \"half the data compromised\" without rigorous justification.\n\nThe central claim is therefore not established by the manuscript as written. But this is not a vacuous paper: the problem is real, the code is promised, and a serious referee could sort out whether the constraint is actually enforced. I would send it to peer review with the expectation of major revision, not desk reject. The authors need to either add the projection to the algorithm and experiments, or honestly drop the constrained-optimization framing and reposition the method as early-stopped gradient ascent. Either way, the VFL setup needs clarification and the empirical claims need error bars.\n\nFor my own work, I wouldn't cite it until the constraint question is resolved. It could be a useful reading-group example of a reproducibility gap hiding in a pseudocode skeleton.","headline":"A constrained-unlearning paper whose algorithm doesn't actually enforce the constraint, on top of a confusing VFL setup; worth a referee's time to verify the code and demand a rewrite.","tokens_in":20798,"tokens_out":3275,"would_cite":false,"duration_ms":31362,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a bounded gradient-ascent procedure, guided by a constrained model, can erase a single client's contribution from a vertical federated model, with a backdoor accuracy collapse serving as a certificate of erasure.","keywords":["vertical federated learning","federated unlearning","gradient ascent","backdoor certification","membership inference attack","machine unlearning","data privacy","right to be forgotten"],"falsifier":"Run the method on a VFL task where the target client's feature block is the only informative signal for one output class, then test whether perturbing or zeroing that block still changes the model's predictions after unlearning. If the predictions still move, the expensive retrained baseline and the unlearned model differ in a way that accuracy averages hide.","tokens_in":19751,"feed_emoji":"🔒","tokens_out":6811,"duration_ms":56303,"temperature":0.7,"pith_summary":"The paper confronts the right to be forgotten in vertical federated learning, where different parties hold different features of the same individuals, so forgetting one client means erasing an entire feature block rather than deleting sample rows. Its central claim is that a bounded gradient-ascent step can accomplish this erasure: after ordinary FedAvg training, the target client maximizes its own loss while staying inside an $\\ell^2$-norm ball around a constrained model that approximates the remaining clean clients. A handful of post-training rounds without the target client then restores accuracy, and the paper reports that the result is comparable to retraining from scratch at a fraction of the cost. To make the erasure observable, the paper embeds a backdoor in the target party's data and uses the collapse of backdoor accuracy, together with membership inference attacks, as certificates that the influence is gone.","feed_headline":"Gradient ascent erases a client's data in vertical federated learning","feed_subtitle":"A few post-training rounds match retraining accuracy while wiping backdoor and membership traces.","key_machinery":"The load-bearing object is the constrained model $W_{\\mathrm{con}}$, a closed-form reweighting of the global model and the target client's local model that serves as a proxy for the ensemble of clean clients. Around it, the paper defines an $\\ell^2$-norm ball of radius $R$ that acts as a leash: gradient ascent on the target client's loss pulls the model away from the target's data while the projection keeps it near the clean reference, preserving utility. An early-stopping threshold $T$ on the distance between the unlearning gradient and the target's gradient decides when the ascent has erased enough without causing collapse. The verification machinery is a backdoor trigger planted in the target party's training images; unlearning success is certified by backdoor accuracy falling to roughly zero and by membership inference attacks failing to distinguish the target's data.","core_discovery":"The discovery is that unlearning a client in VFL can be posed as a constrained maximization that reverses the training trajectory. Given the global model $W^{(k)}$ and the target client's previous-round model $W_i^{(k-1)}$, the paper constructs a reference point $W_{\\mathrm{con}} = \\frac{1}{2N-1}(2N W^{(k)} - W_i^{(k-1)})$, which averages the clean clients' models under the assumption that the target client has half of its data compromised. Unlearning becomes gradient ascent on the target client's loss, projected into the ball $\\{Z : \\lVert Z - W_{\\mathrm{con}}\\rVert_2 \\le R\\}$, so the model forgets the target's data without drifting into a useless random state. With an early-stopping threshold on the distance to the target's gradient, this yields an unlearned model whose backdoor accuracy is zero; a few post-training FedAvg rounds excluding the target bring clean accuracy close to a full retrain (e.g., 92.11 percent versus 95.85 percent on MNIST, $N=5$) while backdoor accuracy stays near chance and membership inference recall drops to zero.","pith_inferences":["The procedure implicitly assumes the server or coordinator can see the target client's individual model $W_i^{(k-1)}$; in a stronger privacy regime where only encrypted aggregates are visible, the constrained model would have to be computed through secure aggregation, which may change its accuracy.","The 'half compromised' assumption is a specific sweet spot; a natural extension is to test compromise fractions other than 50 percent and derive an adjusted $W_{\\mathrm{con}}$, since real data-poisoning scenarios rarely land at exactly half.","Backdoor accuracy is a sufficient certificate of erasure, not a necessary one: a model could in principle pass this test while still memorizing benign statistics of the target's features, so the method likely under-claims rather than over-claims forgetfulness.","The bounded-ascent recipe could transfer to other settings where one must subtract a contributor's influence from a shared model, such as model unlearning in split learning or personalized federated learning, provided a reference model analogous to $W_{\\mathrm{con}}$ can be constructed."],"forward_implications":["If the central claim holds, a VFL platform can honor a deletion request for one client in well under a second of compute, versus the minutes required by retraining from scratch on the reported datasets.","The backdoor-collapse test becomes an operational certificate: a backdoor accuracy near chance (around 10 percent on 10-class tasks) is evidence that the target's feature influence was removed, not merely masked.","Membership inference recall of zero implies the unlearned model does not leak whether the target's data was in training, which is the privacy property that right-to-be-forgotten regulation targets.","The method needs no storage of per-round parameter updates during training and no access to the full original data, only the final global model and the target client's previous local model, so it fits the data-minimization posture of federated learning."],"supporting_citations":[{"why":"FedAvg, the training algorithm whose aggregated model is the starting point for the unlearning procedure.","marker":"[44]"},{"why":"SplitNN, the vertical federated architecture used for the local/global model split.","marker":"[45]"},{"why":"Halimi et al., the gradient-ascent inspiration for reversing the training trajectory.","marker":"[46]"},{"why":"Yeom et al., the membership inference attack used as a second verification method.","marker":"[3]"},{"why":"Gu et al., the BadNets backdoor mechanism that the paper adapts for certification.","marker":"[31]"},{"why":"Deng et al., the prior vertical federated unlearning method limited to tabular data, whose gap this paper addresses.","marker":"[30]"},{"why":"Liu et al., federated unlearning via gradient ascent in horizontal FL, which motivates the approach.","marker":"[1]"},{"why":"Adversarial Robustness Toolbox, used to implement the backdoor trigger pattern.","marker":"[50]"}],"fun_headline_variants":["Gradient ascent erases clients in vertical federated learning","Backdoor-certified unlearning for vertical federated models","Forget a VFL client without full retraining: gradient ascent","Constrained ascent wipes client data in vertical federated learning","Reverse learning trajectory to unlearn in vertical federated AI"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The assumption that defines the constrained model, $W_{\\mathrm{con}} = \\frac{1}{2N-1}(2N W^{(k)} - W_i^{(k-1)})$, is that the target client has exactly half of its data compromised, so algebraically reweighting the global and local models yields a faithful stand-in for a model trained without that client; if that separation is not clean, the gradient ascent guidance and the early-stopping criterion lose their grounding, and the unlearned model would not really correspond to removing the client's influence.","fun_headline_variants_meta":{"raw":{"variants":["Gradient ascent erases clients in vertical federated learning","Backdoor-certified unlearning for vertical federated models","Forget a VFL client without full retraining: gradient ascent","Constrained ascent wipes client data in vertical federated learning","Reverse learning trajectory to unlearn in vertical federated AI"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000173,"raw_usage":{"total_tokens":1322,"prompt_tokens":1031,"completion_tokens":291,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":647,"completion_tokens_details":{"reasoning_tokens":206}},"tokens_in":647,"tokens_out":291,"duration_ms":2811,"temperature":1.0,"reasoning_tokens":206,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:53:45.349977+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the method on a VFL task where the target client's feature block is the only informative signal for one output class, then test whether perturbing or zeroing that block still changes the model's predictions after unlearning. If the predictions still move, the expensive retrained baseline and the unlearned model differ in a way that accuracy averages hide.","supporting_citations":[{"cited_title":"Vertical federated unlearning on the logistic regression model,","cited_arxiv_id":null,"evidence_quote":"Deng et al., the prior vertical federated unlearning method limited to tabular data, whose gap this paper addresses."}],"review_version":1}