Pith. sign in

REVIEW 5 major objections 6 minor 48 references

One-time retraining cannot erase data once an agent network keeps learning.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 01:32 UTC pith:LQRKAWGY

load-bearing objection Real new problem in federated unlearning, but MUTE's evidence is weaker than the claims: the influence model is unvalidated, IRR is partly circular, and experiments are single-run. the 5 major comments →

arxiv 2607.28829 v1 pith:LQRKAWGY submitted 2026-07-30 cs.NI cs.LG

When Unlearning Fails: Reliable Data Deletion under Post-Training in Agent Networks

Zihao Ding , Jun Huang , Liang Dong This is my paper
classification cs.NI cs.LG
keywords federated unlearningself-improving agent networksinfluence echoreliable data deletioninfluence tracingbehavioral leakageedge AI privacydeletion scheduling
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper studies data deletion in self-improving federated agent networks — systems where deployed models collect new trajectories and feed them back into later training rounds. It tries to establish that a one-time retraining on retained data does not settle a deletion request: the forgotten data has already shaped later retained trajectories, so the deleted behavior gradually returns as the network keeps operating. To make deletion durable, the paper proposes MUTE, which traces where the forgotten data's influence has flowed using a lightweight server ledger, removes the current model residue with a forget-retain update, contains high-influence retained trajectories by quarantine or down-weighting, and schedules additional erasure under an uplink budget. The claimed payoff is that behavioral leakage and influence regeneration stay near zero while task utility is preserved, at a fraction of the communication cost of full retraining.

Core claim

On its own terms, the paper claims that in a closed-loop federated agent network, the influence of forgotten data propagates through two edges: aggregation (from local data to the global model) and collection (from the deployed policy to new trajectories). This 'influence echo' survives retraining on the retain set, grows with the fraction of retained data collected under a forget-shaped policy, and can be traced from deployment, collection, and aggregation records. The proposed solution, MUTE, converts those records into a per-round influence score via a scalar recurrence, uses the score to suppress model-side residue and to quarantine or down-weight high-influence retained trajectories, an

What carries the argument

The central object is the 'influence echo' — the way forgotten data reshapes later retained trajectories through the deployed policy. It is quantified by a per-trajectory influence score γ(x) = η·γ[t_x], where the version influence γ[t] evolves by a recurrence over aggregation weights and client-side data influence (Eq. 4), and η calibrates how strongly the deployed policy shapes collection. This score lets the server estimate influence without moving raw trajectories. The same state-transition view (Eq. 6) is used to argue that sustained unlearning is feasible when the long-run spectral radius ρ(M_∞) < 1. The method combines a forget-retain update with negative preference optimization for m

Load-bearing premise

Everything hinges on the scalar influence recurrence (Eqs. 4-5) accurately capturing how forgotten data propagates to later retained trajectories, yet the paper provides no derivation or ground-truth validation and treats η both as an upper bound and as a fitted constant.

What would settle it

Run a leave-one-out counterfactual: train a network with and without a forget set, identify which retained trajectories actually revive the forgotten behavior after continued learning, and compare that ground truth to MUTE's influence scores; if a trajectory scored below τ_d still causes IRR to rise above the tolerance when learning resumes, the tracing model is falsified.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the influence-echo model is correct, any federated unlearning method that fixes the retain set at request time is insufficient for self-improving networks; deletion guarantees must be re-checked and re-enforced as learning continues.
  • MUTE's ledger-based tracing shows that raw trajectories can stay on clients while the server still estimates where influence has flowed, at a replay cost of O(T N) for the scalar sequence.
  • The containment step (quarantine/down-weighting) offers a reversible middle ground: quarantined trajectories remain on the client and can be released once their influence score falls below the threshold.
  • The stability condition ρ(M_∞)<1 recasts sustained deletion as a scheduling problem: pick the lowest-communication action sequence that makes influence decay, subject to response deadline and utility floor.
  • The reported numbers — IRR well below retraining, BLI near chance, SR within 0.04 of retraining, and roughly 3-5x lower uplink — suggest the approach is affordable even on edge-like hardware.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same echo mechanism should appear in any online learning loop where the model's own outputs shape future training data — recommendation systems, autonomous data collection, self-play — so the tracing-and-containment logic may transfer beyond federated agents.
  • A natural next test: calibrate η per client or per task from a small leave-one-out counterfactual study; if the scalar recurrence cannot rank trajectories correctly, the method may need finer-grained attribution to meet strong privacy guarantees.
  • The paper's framing implies that regulators and auditors should treat 'deletion' in self-improving systems as a continuous constraint verified over time, not a one-time action verifiable at the moment of the request.
  • The sensitivity sweep hints that under strong collection shaping (large η or small data heterogeneity α), the scheduler may need to pause collection entirely to keep ρ(M_∞)<1; the paper does not explore that regime in depth.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper studies deletion requests in federated agent networks that continue self-improving after deployment. It reports three observations: one-time retraining on retained data does not silence the influence of forget data, and the forgotten behavior is gradually revived during continued operation (Observation 1, Figs. 2); the regeneration scales with the fraction of forget-shaped retained data (Observation 2, Fig. 3a); and the echo is traceable from server-side collection/aggregation records (Observation 3, Fig. 3b). To address this, the paper proposes MUTE, which computes an influence score from a server ledger (Eqs. 4-5), performs model-side erasure with an NPO-based forget-retain update plus gradient projection, contains high-influence retained trajectories via quarantine/down-weighting (Section IV-B), and schedules future erasures under an uplink budget using a spectral-radius stability condition (Section IV-C). Evaluation on LIBERO with MiniVLA and π0 backbones, three deletion granularities, and a physical Jetson-based testbed is reported, showing lower IRR and BLI and much lower communication cost than full retraining (Table II).

Significance. If the claims hold, the paper identifies a genuine and understudied failure mode: in self-improving federated agent networks, a one-time unlearning update can be undone by policy-driven data collection, so deletion must be sustained over time. The problem formulation (Eq. 3) is useful, and the idea of tracing influence from a lightweight server ledger while keeping raw trajectories local is attractive. The strengths are the clear identification of the echo phenomenon, the use of two VLA backbones, and the attempt to validate on a physical edge testbed. However, the current evidence is not yet sufficient: the experiments are single-run point estimates, the influence propagation model is unvalidated and internally inconsistent about η, the stability condition is asserted rather than proved, and the IRR metric is partially circular with MUTE's own containment mechanism. These issues bear directly on the central claim that MUTE provides reliable deletion, so they must be addressed before the paper can be accepted.

major comments (5)
  1. [Section V-A, Table II, Fig. 5] Section V-A states 'We run the whole network once for each backbone,' and Table II reports a single number per cell with no error bars, seeds, or significance tests. All central comparisons (MUTE vs Retrain for IRR, BLI, Comm) are point estimates from one trajectory of a stochastic process (heterogeneous data splits, policy rollouts, training). The empirical claim that MUTE outperforms Retrain is not statistically supported. Please report multiple independent runs with mean and variance, and where possible a paired significance test across the same data/network initializations.
  2. [Section IV-A, Eqs. (4)-(5); Section V-B, Fig. 5] The influence score γ(x)=η γ[t_x] is the backbone of MUTE's tracing, containment thresholds (τ_d, τ_q), and scheduling, but it is never validated against any ground-truth influence measure (e.g., counterfactual retraining or a per-sample attribution method). The text in Section IV-A says 'η is an upper bound rather than a fitted constant,' yet Section V-B and Fig. 5 describe η as a calibrated constant that 'works best at its fitted value ... near η=0.6,' and Table I sets η=0.6. An upper bound should be set conservatively high (η=1); tuning it down means trajectories collected under a heavily shaped policy may be systematically under-scored, so the very carriers that must be contained can escape. Equation (4) is also a heuristic scalar recurrence with no derivation from the actual aggregation and collection process. Without validation of γ(x), the low IRR/BLI numbers in Table II could be
  3. [Section IV-C, Eq. (6)] The claim that sustained unlearning is feasible when ρ(M_∞)<1 is an assertion, not a proof. The transition matrix M(a[t]) in Eq. (6) is never defined concretely, no construction of M_∞ is given, and no argument links the spectral-radius condition to constraints (C1)-(C4). The scheduler is described as 'selecting the lowest-communication schedule ... while keeping this stability condition,' but the reader cannot verify how the schedule is computed or why it satisfies the constraint. This is load-bearing for the paper's central guarantee of reliable deletion, and it needs either a concrete proof or an empirically verified construction with the actual aggregation, collection, containment, and erasure operations.
  4. [Section V-C3, Eq. (9); Section IV-B] IRR is measured by continuing self-improvement 'on high-influence retained data' to form θ_unl[K]. MUTE's data-side containment (Section IV-B) quarantines or down-weights exactly those high-influence retained trajectories. Thus MUTE's low IRR is partly by construction: the method removes from the training stream the very trajectories used to evaluate regeneration, while the Retrain baseline keeps them. The comparison is not a fair measure of whether the forgotten behavior would return under continued operation. Please define an evaluation protocol that is not directly manipulated by the containment step — for example, compute IRR on all retained data without applying quarantine/down-weighting during the evaluation rollout, or use a fixed data collection policy that is identical for MUTE and Retrain.
  5. [Section VI] The paper claims validation on a physical Jetson-based edge testbed, but no testbed-specific quantitative results are reported. The 'Overall Results' subsection refers back to Table II, which is a LIBERO simulation table; there is no table or text reporting actual uplink bytes, deletion response time, or behavioral recurrence measured on the Jetson hardware. The abstract's claim that the method is 'further check[ed] on a physical Jetson-based edge testbed' is unsupported as written. Please include the measured hardware results or remove the claim.
minor comments (6)
  1. [Eq. (7)] L_forget and L_retain in Eq. (7) are only named, not defined. Please give explicit equations for the NPO term and the retain term, including how θ_ref is used and how the gradient-projection subspace is computed and updated.
  2. [Table I] Table I lists τ_q but not τ_d, although τ_d is used in Section IV-B. Please add τ_d and explain how both thresholds are derived from the leakage target.
  3. [Eq. (3), Table II] The constraints in the problem formulation are not checked against the experimental results: no values for τ_max, δ, ε, or ϱ are given, and Table II does not report whether C1-C4 are satisfied per round. Please state target values and show compliance.
  4. [Section V-C2, Eq. (8)] The held-out non-member set D_o is not defined in the experiments. Please specify how large it is, how it is constructed, and whether it is disjoint from both the forget set and the training data.
  5. [Section V-A] The 'counterfactual network θ*' is said to be computed in simulation, but no results using θ* are presented anywhere. Please clarify its role or remove the reference.
  6. [Section VI] In Section VI, the text says 'we measure the actual uplink bytes, the deletion response time, and the behavioral recurrence,' but these measurements are not reported. Please add this data or delete the sentence.

Circularity Check

2 steps flagged

IRR is partially circular: MUTE's containment removes the very high-influence retained data on which the regeneration test is trained, and η is tuned against the headline metrics it is claimed to upper-bound.

specific steps
  1. self definitional [Section IV-B (data-side containment) and Section V-C3 / Eq. (9) (IRR definition)]
    "For data-side containment, each client grades its trajectories by γ(x). Trajectories with γ(x)≥τ_q are quarantined and removed from later training. ... IRR is the recovered fraction: IRR = FSR(θunl[K])−FSR(θunl) / FSR(θref)−FSR(θunl), clipped to [0,1]. IRR is 0 when the behavior stays erased and 1 when it fully returns."

    IRR is measured by continuing self-improvement on 'high-influence retained data'. In MUTE, 'high-influence' is defined by the same score γ(x) (Eq. 5) that drives data-side containment: trajectories with γ(x)≥τ_q are quarantined and removed from the training stream, and those with τ_d≤γ(x)<τ_q are down-weighted. Thus the shadow model used to compute IRR is trained on data that MUTE is allowed to delete, so a low IRR is partly guaranteed by the measurement construction rather than by the full trace-erase-audit mechanism. The Retrain baseline keeps those trajectories, so the reported IRR gap is partly the difference between deleting the test data and not deleting it. The paper does not define the IRR shadow set using an independent ground-truth influence measure.

  2. fitted input called prediction [Section IV-A (Eq. 5) vs Section V-B and Fig. 5]
    "The factor η is an upper bound rather than a fitted constant. ... The calibration η works best at its fitted value; IRR and BLI form a shallow valley near η=0.6 and grow when η is set too low or too high."

    The paper asserts that η is an upper bound, which would be set conservatively high to avoid under-scoring influence carriers; but Table I fixes η=0.6 and Fig. 5 explicitly tunes it to minimize the headline metrics IRR and BLI. The influence score γ(x)=ηγ[t_x] is the input to all containment thresholds and scheduling decisions, so choosing η on the very metrics later reported as MUTE's performance makes the leakage results partly a fitted output. This also contradicts the claimed upper-bound property, since an upper bound should not be lowered for better evaluation numbers.

full rationale

The paper's strongest empirical observations—retraining fails and regeneration scales with forget-shaped retained data—are not circular; they are standalone experiments against a computed counterfactual. The unlearning formulation and the communication-cost results also have independent content. However, the central IRR evaluation is partially circular by construction: the regeneration test trains a shadow model on 'high-influence retained data', while MUTE's data-side module quarantines or down-weights exactly the trajectories that the paper's own influence score γ(x) labels as high-influence. Unless the IRR shadow set is chosen by an external ground-truth influence measure, the IRR gap over retraining is partly the result of removing the test data from the training stream. A second, smaller issue is that η is described as an upper bound but is actually fitted to the target metrics, making the reported BLI/IRR values partly tuning artifacts. The paper's self-citations are numerous but are not used as load-bearing evidence for the derivation; the lack of validation for Eqs. (4)-(5) and the unconstructed condition ρ(M_∞)<1 are correctness risks rather than circular steps. Overall, the central mechanism is not fully circular, but the headline regeneration result is partly self-confirming, so a score of 6 is appropriate.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 1 invented entities

The central claim depends on the ad hoc influence-propagation model (Eqs. 4-5), unproven stability scheduling, and paper-defined metrics BLI/IRR. The method adds four free parameters (eta, tau_q, tau_d, lambda), of which tau_d is unspecified. No new physical entities are introduced; the influence score is a heuristic construct without independent evidence.

free parameters (4)
  • eta (collection-shaping calibration) = 0.6
    Controls how strongly deployed policy shapes data collection in Eq. (5). Text claims it is an upper bound, but Fig. 5 states it 'works best at its fitted value', so it is tuned to the data.
  • tau_q (quarantine threshold) = 0.45
    Trajectories with influence score >= tau_q are quarantined. Chosen from the leakage target (Section IV-B), i.e., tuned to make BLI pass.
  • lambda (NPO balance weight) = 5.0
    Balances forget and retain losses in Eq. (7); hand-chosen, not justified by a principled criterion.
  • tau_d (down-weighting threshold) = not reported
    Threshold below tau_q for down-weighting trajectories; value not given in the paper, so replication is incomplete.
axioms (6)
  • ad hoc to paper Influence propagation follows the scalar recurrence (4)-(5) with beta[t] and eta
    This is the core model of how forget-data influence moves through aggregation and collection; it is asserted, not derived, and not validated against a ground-truth influence measure.
  • ad hoc to paper The stability condition rho(M_infinity) < 1 ensures sustained deletion (C4)
    Section IV-C asserts feasibility follows from the spectral radius of transition matrix M_infinity, but M(a[t]) is not concretely defined and no proof is given.
  • domain assumption NPO plus gradient projection prevents re-fitting of the erased direction
    Section IV-B: 'Projection is needed for the same reason the echo exists'; this is an empirical assumption, not proven.
  • domain assumption BLI and IRR are valid measures of deletion success
    BLI assumes loss-based MIA on canaries; IRR assumes FSR of a shadow model on high-influence data captures regeneration; both are paper-defined metrics without independent validation.
  • domain assumption Verifier in the self-improving loop accepts trajectories that are causally downstream of forget data
    The problem exists because collected trajectories are policy-driven; the verifier is the benchmark success check, and no analysis is provided for cases where the verifier rejects tainted trajectories.
  • standard math Standard federated averaging and LoRA adapters
    Eq. (2) aggregation and low-rank adapter training are standard practices assumed without proof.
invented entities (1)
  • Influence score gamma(x) no independent evidence
    purpose: Estimates how much a retained trajectory is shaped by forget data, used for quarantine/down-weighting and audit scheduling.
    No external falsifiable handle; depends on the ad hoc recurrence and calibrated eta. It is validated only indirectly through BLI/IRR, which are also paper-defined.

pith-pipeline@v1.3.0-alltime-deepseek · 14543 in / 9545 out tokens · 99903 ms · 2026-08-03T01:32:18.526258+00:00 · methodology

0 comments
read the original abstract

Self-improving federated agent networks keep training after deployment by collecting new trajectories with the current policy and feeding them back into later rounds. This closed loop makes unlearning harder than a one-time model repair. When a data owner requests deletion, the target data may have already shaped later retained trajectories, so retraining or model-side unlearning can leave an influence echo that returns as the network continues to operate. We show that this echo survives retained-data retraining, grows with the amount of forget-shaped retained data, and can be traced from deployment, collection, and aggregation records. To address this problem, we propose MUTE, a Muting Unlearned Trajectories' Echoes method for reliable deletion in self-improving federated agent networks. MUTE estimates downstream influence from a lightweight server ledger, removes the current residue through a forget-retain update, contains high-influence retained trajectories through quarantine or down-weighting, and audits later behavior to schedule additional erasure under an uplink budget. Experiments on LIBERO with two vision-language-action backbones, three deletion granularities, and a physical Jetson-based edge testbed show that MUTE keeps behavioral leakage and influence regeneration low while preserving task utility and using much less communication than full retraining.

Figures

Figures reproduced from arXiv: 2607.28829 by Jun Huang, Liang Dong, Zihao Ding.

Figure 1
Figure 1. Figure 1: Influence echo in a self-improving federated agent network. Forget [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Retraining fails during continued operation. Both forget-set FSR and [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: Physical testbed for system-level validation: a Jetson Thor server and [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Sensitivity of MUTE on LIBERO with two backbones, MiniVLA and π0. The three rows report IRR, BLI, and SR. The four columns each sweep one endogenous parameter: the quarantine threshold τ q , the uplink budget m, the collection-shaping calibration η, and the Dirichlet concentration α. Every panel draws six curves, one for each backbone and deletion granularity, and each parameter varies around its default i… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

48 extracted references · 5 linked inside Pith

  1. [1]

    A Review of Continual Learning in Edge AI,

    B. Wu, Z. Ding, and J. Huang, “A Review of Continual Learning in Edge AI,”IEEE Transactions on Network Science and Engineering, vol. 13, pp. 6571–6588, 2026

    2026

  2. [2]

    Promoting collab- oration in cross-silo federated learning: Challenges and opportunities,

    C. Huang, M. Tang, Q. Ma, J. Huang, and X. Liu, “Promoting collab- oration in cross-silo federated learning: Challenges and opportunities,” IEEE Commun. Mag., vol. 62, no. 4, pp. 82–88, 2024

    2024

  3. [3]

    Combating knowledge diver- sity and catastrophic forgetting in uav-assisted collaborative vehicular learning: A game-theoretic approach,

    Z. Ding, J. Huang, Y . Zhao, and Z. Cai, “Combating knowledge diver- sity and catastrophic forgetting in uav-assisted collaborative vehicular learning: A game-theoretic approach,”ACM Trans. Auton. Adapt. Syst., Jun. 2026, just Accepted

    2026

  4. [4]

    RELIEF: Turning Missing Modalities into Training Acceleration for Federated Learning on Heterogeneous IoT Edge,

    B. Wu, Z. Ding, and J. Huang, “RELIEF: Turning Missing Modalities into Training Acceleration for Federated Learning on Heterogeneous IoT Edge,” arXiv preprint arXiv:2604.04243, 2026

    Pith/arXiv arXiv 2026

  5. [5]

    A Fast UA V Tra- jectory Planning Framework in RIS-Assisted Communication Systems With Accelerated Learning via Multithreading and Federating,

    J. Huang, B. Wu, Q. Duan, L. Dong, and S. Yu, “A Fast UA V Tra- jectory Planning Framework in RIS-Assisted Communication Systems With Accelerated Learning via Multithreading and Federating,”IEEE Transactions on Mobile Computing, pp. 1–16, 2025

    2025

  6. [6]

    Enhancing Vehic- ular Platooning With Wireless Federated Learning: A Resource-Aware Control Framework,

    B. Wu, J. Huang, Q. Duan, L. Dong, and Z. Cai, “Enhancing Vehic- ular Platooning With Wireless Federated Learning: A Resource-Aware Control Framework,”IEEE/ACM Transactions on Networking, pp. 1–1, 2025

    2025

  7. [7]

    Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory,

    B. Wu, Z. Ding, J. Huang, and Y . Zhao, “Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory,” arXiv preprint arXiv:2606.25115, 2026

    Pith/arXiv arXiv 2026

  8. [8]

    Transmission Games in RIS-Aided MIMO Interference Channels With Nonlinear Energy Harvesting,

    L. Dong, J. Huang, and G. Ye Li, “Transmission Games in RIS-Aided MIMO Interference Channels With Nonlinear Energy Harvesting,”IEEE Transactions on Wireless Communications, vol. 25, pp. 20 353–20 369, 2026

    2026

  9. [9]

    1–88, 2016

    European Parliament and Council of the European Union, “Regulation (EU) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/EC (general data protection regulation),” Official Journal o...

    2016

  10. [10]

    Federated unlearning: A survey on methods, design guidelines, and evaluation metrics,

    N. Romandini, A. Mora, C. Mazzocca, R. Montanari, and P. Bellavista, “Federated unlearning: A survey on methods, design guidelines, and evaluation metrics,”IEEE Trans. Neural Networks Learn. Syst., vol. 36, no. 7, pp. 11 697–11 717, 2025

    2025

  11. [11]

    Toward trustworthy federated unlearning for mobile autonomous systems,

    Z. Ding and J. Huang, “Toward trustworthy federated unlearning for mobile autonomous systems,”IEEE Network, pp. 1–9, 2026

    2026

  12. [12]

    Federaser: Enabling efficient client-level data removal from federated learning models,

    G. Liu, X. Ma, Y . Yang, C. Wang, and J. Liu, “Federaser: Enabling efficient client-level data removal from federated learning models,” in 29th IEEE/ACM International Symposium on Quality of Service, IWQOS 2021, Tokyo, Japan, June 25-28, 2021. IEEE, 2021, pp. 1–10

    2021

  13. [13]

    Fedrecovery: Differentially private machine unlearning for federated learning frame- works,

    L. Zhang, T. Zhu, H. Zhang, P. Xiong, and W. Zhou, “Fedrecovery: Differentially private machine unlearning for federated learning frame- works,”IEEE Trans. Inf. Forensics Secur., vol. 18, pp. 4732–4746, 2023

    2023

  14. [14]

    Verifi: Towards verifiable federated unlearning,

    X. Gao, X. Ma, J. Wang, Y . Sun, B. Li, S. Ji, P. Cheng, and J. Chen, “Verifi: Towards verifiable federated unlearning,”IEEE Trans. Depend- able Secur. Comput., vol. 21, no. 6, pp. 5720–5736, 2024

    2024

  15. [15]

    SIFU: sequential informed federated unlearning for efficient and provable client unlearning in federated optimization,

    Y . Fraboni, M. V . Waerebeke, K. Scaman, R. Vidal, L. Kameni, and M. Lorenzi, “SIFU: sequential informed federated unlearning for efficient and provable client unlearning in federated optimization,” in International Conference on Artificial Intelligence and Statistics, 2-4 May 2024, Palau de Congressos, Valencia, Spain, ser. Proceedings of Machine Learni...

    2024

  16. [16]

    SCALE: Sensitivity-Aware Federated Unlearning with Information Freshness Optimization for Mobile Edge Computing,

    Z. Ding, B. Wu, and J. Huang, “SCALE: Sensitivity-Aware Federated Unlearning with Information Freshness Optimization for Mobile Edge Computing,” inProceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS), 2026

    2026

  17. [17]

    Securing Smart Agriculture with Communication-Efficient Federated Unlearning,

    U. Pudasaini, Z. Ding, and J. Huang, “Securing Smart Agriculture with Communication-Efficient Federated Unlearning,” inProceedings of the IEEE International Conference on High Performance Switching and Routing (HPSR). IEEE, 2026, pp. 1–8

    2026

  18. [18]

    Data feedback loops: Model-driven am- plification of dataset biases,

    R. Taori and T. Hashimoto, “Data feedback loops: Model-driven am- plification of dataset biases,” inInternational Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, ser. Proceedings of Machine Learning Research, A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Scarlett, Eds., vol. 202. PMLR, 2023, pp. 33 883–33 920

    2023

  19. [19]

    AI models collapse when trained on recursively generated data,

    I. Shumailov, Z. Shumaylov, Y . Zhao, N. Papernot, R. J. Anderson, and Y . Gal, “AI models collapse when trained on recursively generated data,” Nat., vol. 631, no. 8022, pp. 755–759, 2024

    2024

  20. [20]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tram `er, “Membership inference attacks from first principles,” in43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022. IEEE, 2022, pp. 1897–1914

    2022

  21. [21]

    Source inference attacks: Beyond membership inference attacks in federated learning,

    H. Hu, X. Zhang, Z. Salcic, L. Sun, K. R. Choo, and G. Dobbie, “Source inference attacks: Beyond membership inference attacks in federated learning,”IEEE Trans. Dependable Secur. Comput., vol. 21, no. 4, pp. 3012–3029, 2024

    2024

  22. [22]

    Federated unlearning and its privacy threats,

    F. Wang, B. Li, and B. Li, “Federated unlearning and its privacy threats,” IEEE Netw., vol. 38, no. 2, pp. 294–300, 2024

    2024

  23. [23]

    Hier-fun: Hierarchical federated learning and unlearning in heteroge- neous edge computing,

    Z. Ma, H. Tu, L. Zhou, P. Ji, X. Yan, H. Xu, Z. Wang, and S. Chen, “Hier-fun: Hierarchical federated learning and unlearning in heteroge- neous edge computing,”IEEE Internet Things J., vol. 12, no. 7, pp. 8653–8668, 2025

    2025

  24. [24]

    Toward efficient and robust federated unlearning in iot networks,

    Y . Yuan, B. Wang, C. Zhang, Z. Xiong, C. Li, and L. Zhu, “Toward efficient and robust federated unlearning in iot networks,”IEEE Internet Things J., vol. 11, no. 12, pp. 22 081–22 090, 2024

    2024

  25. [25]

    Edge unlearning is not

    X. Xia, Z. Wang, R. Sun, B. Liu, I. Khalil, and M. Xue, “Edge unlearning is not ”on edge”! an adaptive exact unlearning system on resource- constrained devices,” inIEEE Symposium on Security and Privacy, SP 2025, San Francisco, CA, USA, May 12-15, 2025, M. Blanton, W. Enck, and C. Nita-Rotaru, Eds. IEEE, 2025, pp. 2546–2563

    2025

  26. [26]

    EASE: Federated Multimodal Un- learning via Entanglement-Aware Anchor Closure,

    Z. Ding, B. Wu, and J. Huang, “EASE: Federated Multimodal Un- learning via Entanglement-Aware Anchor Closure,” arXiv preprint arXiv:2605.00733, 2026

    Pith/arXiv arXiv 2026

  27. [27]

    Lifecycle-Aware Federated Continual Learning in Mobile Autonomous Systems,

    B. Wu and J. Huang, “Lifecycle-Aware Federated Continual Learning in Mobile Autonomous Systems,” arXiv preprint arXiv:2604.20745, 2026

    Pith/arXiv arXiv 2026

  28. [28]

    From Alpha to Omega: Lifecycle- Aware Forgetting Defense in Federated Continual Learning for Planetary Exploration,

    B. Wu, J. Huang, and Y . Zhao, “From Alpha to Omega: Lifecycle- Aware Forgetting Defense in Federated Continual Learning for Planetary Exploration,” inProceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS), 2026

    2026

  29. [29]

    Negative preference optimization: From catastrophic collapse to effective unlearning,

    R. Zhang, L. Lin, Y . Bai, and S. Mei, “Negative preference optimization: From catastrophic collapse to effective unlearning,” inFirst Conference on Language Modeling, 2024

    2024

  30. [30]

    Sim- plicity prevails: Rethinking negative preference optimization for LLM unlearning,

    C. Fan, J. Liu, L. Lin, J. Jia, R. Zhang, S. Mei, and S. Liu, “Sim- plicity prevails: Rethinking negative preference optimization for LLM unlearning,”CoRR, vol. abs/2410.07163, 2024

    arXiv 2024

  31. [31]

    On large language model continual unlearning,

    C. Gao, L. Wang, K. Ding, C. Weng, X. Wang, and Q. Zhu, “On large language model continual unlearning,” inThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025. OpenReview.net, 2025

    2025

  32. [32]

    Catastrophic failure of LLM unlearning via quantization,

    Z. Zhang, F. Wang, X. Li, Z. Wu, X. Tang, H. Liu, Q. He, W. Yin, and S. Wang, “Catastrophic failure of LLM unlearning via quantization,” in The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025. OpenReview.net, 2025

    2025

  33. [33]

    ROVER: robust generative continual identity unlearning against relearning attacks,

    T. Huang, Q. Chen, B. Hu, Y . Zhao, H. Xu, Z. Chen, Y . Chen, and X. Su, “ROVER: robust generative continual identity unlearning against relearning attacks,” inFortieth AAAI Conference on Artificial Intelligence, Thirty-Eighth Conference on Innovative Applications of Artificial Intelligence, Sixteenth Symposium on Educational Advances in Artificial Intell...

    2026

  34. [34]

    Learning to Defend: A Multi-Agent Reinforcement Learning Framework for Stackelberg Security Game in Mobile Edge Computing,

    Z. Ding, J. Huang, and J. Qi, “Learning to Defend: A Multi-Agent Reinforcement Learning Framework for Stackelberg Security Game in Mobile Edge Computing,” inProceedings of the International Confer- ence on Computing, Networking and Communications (ICNC), 2026, pp. 769–774

    2026

  35. [35]

    A Dual-Level Game-Theoretic Approach for Collaborative Learning in UA V-Assisted Heterogeneous Vehicle Networks,

    Z. Ding, J. Huang, Q. Duan, C. Zhang, Y . Zhao, and S. Gu, “A Dual-Level Game-Theoretic Approach for Collaborative Learning in UA V-Assisted Heterogeneous Vehicle Networks,” inProceedings of the IEEE International Performance, Computing, and Communications Conference (IPCCC), 2025, pp. 1–8

    2025

  36. [36]

    FedTD3: An Accelerated Learning Approach for UA V Trajectory Planning,

    B. Wu, J. Huang, and Q. Duan, “FedTD3: An Accelerated Learning Approach for UA V Trajectory Planning,” inInternational Conference on Wireless Artificial Intelligent Computing Systems and Applications (WASA). Springer, 2025, pp. 13–24

    2025

  37. [37]

    AoI-Aware Resource Management for Smart Health via Deep Reinforcement Learning,

    B. Wu, Z. Cai, W. Wu, and X. Yin, “AoI-Aware Resource Management for Smart Health via Deep Reinforcement Learning,”IEEE Access, 2023

    2023

  38. [38]

    Real-Time Intelligent Healthcare Enabled by Federated Digital Twins With AoI Optimization,

    B. Wu, J. Huang, and Q. Duan, “Real-Time Intelligent Healthcare Enabled by Federated Digital Twins With AoI Optimization,”IEEE Network, vol. 40, no. 2, pp. 184–191, 2025

    2025

  39. [39]

    Understanding black-box predictions via in- fluence functions,

    P. W. Koh and P. Liang, “Understanding black-box predictions via in- fluence functions,” inProceedings of the 34th International Conference on Machine Learning, ICML 2017, Sydney, NSW, Australia, 6-11 August 2017, ser. Proceedings of Machine Learning Research, D. Precup and Y . W. Teh, Eds., vol. 70. PMLR, 2017, pp. 1885–1894

    2017

  40. [40]

    Estimating training data influence by tracing gradient descent,

    G. Pruthi, F. Liu, S. Kale, and M. Sundararajan, “Estimating training data influence by tracing gradient descent,” inAdvances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., 2020

    2020

  41. [41]

    Gradient projection memory for continual learning,

    G. Saha, I. Garg, and K. Roy, “Gradient projection memory for continual learning,” in9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021

    2021

  42. [42]

    A Stochastic Geometry-Based Analysis of SWIPT-Assisted Underlaid Device-to-Device Energy Har- vesting,

    C.-C. Xing, Z. Ding, and J. Huang, “A Stochastic Geometry-Based Analysis of SWIPT-Assisted Underlaid Device-to-Device Energy Har- vesting,”SIGAPP Appl. Comput. Rev., vol. 25, no. 4, pp. 18–34, 2026

    2026

  43. [43]

    Reinforcement Learning- Based Energy-Aware Coverage Path Planning for Precision Agriculture,

    J. Huang, B. Wu, Z. Ding, and L. Ostigaard, “Reinforcement Learning- Based Energy-Aware Coverage Path Planning for Precision Agriculture,” inProceedings of the International Conference on Research in Adaptive and Convergent Systems (RACS). Association for Computing Machin- ery, 2026

    2026

  44. [44]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” inThe 23rd International Conference on Artificial Intelligence and Statistics, AISTATS 2020, 26-28 August 2020, Online [Palermo, Sicily, Italy], ser. Proceedings of Machine Learning Research, S. Chiappa and R. Calandra, Eds., vol. 108. PMLR, 2020, pp. 2938–2948

    2020

  45. [45]

    Openvla: An open-source vision-language-action model,

    M. J. Kim, K. Pertsch, S. Karamcheti, T. Xiao, A. Balakrishna, S. Nair, R. Rafailov, E. P. Foster, P. R. Sanketi, Q. Vuong, T. Kollar, B. Burchfiel, R. Tedrake, D. Sadigh, S. Levine, P. Liang, and C. Finn, “Openvla: An open-source vision-language-action model,” inProceedings of The 8th Conference on Robot Learning, ser. Proceedings of Machine Learning Res...

    2025

  46. [46]

    π 0: A vision-language-action flow model for general robot control,

    K. Black, N. Brown, D. Driess, A. Esmail, M. Equi, C. Finn, N. Fusai, L. Groom, K. Hausman, B. Ichter, S. Jakubczak, T. Jones, L. Ke, S. Levine, A. Li-Bell, M. Mothukuri, S. Nair, K. Pertsch, L. X. Shi, J. Tanner, Q. Vuong, A. Walling, H. Wang, and U. Zhilinsky, “π 0: A vision-language-action flow model for general robot control,”CoRR, vol. abs/2410.24164, 2024

    Pith/arXiv arXiv 2024

  47. [47]

    LIBERO: benchmarking knowledge transfer for lifelong robot learn- ing,

    B. Liu, Y . Zhu, C. Gao, Y . Feng, Q. Liu, Y . Zhu, and P. Stone, “LIBERO: benchmarking knowledge transfer for lifelong robot learn- ing,” inAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023, A. Oh, T. Naumann, A. Globerson, K. S...

    2023

  48. [48]

    “X of Information

    B. Wu, J. Huang, and S. Yu, ““X of Information” Continuum: A Survey on AI-Driven Multi-Dimensional Metrics for Next-Generation Net- worked Systems,”IEEE Communications Surveys & Tutorials, vol. 28, pp. 5307–5344, 2026

    2026