Pith. sign in

REVIEW 6 major objections 5 minor 51 references

Vertical Federated Unlearning via Backdoor Certification

T0 review · 6 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a bounded gradient-ascent procedure, guided by a constrained model, can erase a single client's contribution from a vertical federated model, with a backdoor accuracy collapse serving as a certificate of erasure.

desk verdict A constrained-unlearning paper whose algorithm doesn't actually enforce the constraint, on top of a confusing VFL setup; worth a referee's time to verify the code and demand a rewrite. read the letter →

arxiv 2412.11476 v1 pith:UC6OVSZC submitted 2024-12-16 cs.LG

Mengde Han , Tianqing Zhu , Lefeng Zhang , Huan Huo , Wanlei Zhou This is my paper · ORCID
classification cs.LG
keywords verticalfederatedlearningunlearninggradientascentbackdoorcertificationmembershipinferenceattackmachinedataprivacyrighttobeforgotten
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper confronts the right to be forgotten in vertical federated learning, where different parties hold different features of the same individuals, so forgetting one client means erasing an entire feature block rather than deleting sample rows. Its central claim is that a bounded gradient-ascent step can accomplish this erasure: after ordinary FedAvg training, the target client maximizes its own loss while staying inside an $\ell^2$-norm ball around a constrained model that approximates the remaining clean clients. A handful of post-training rounds without the target client then restores accuracy, and the paper reports that the result is comparable to retraining from scratch at a fraction of the cost. To make the erasure observable, the paper embeds a backdoor in the target party's data and uses the collapse of backdoor accuracy, together with membership inference attacks, as certificates that the influence is gone.

What carries the argument

The load-bearing object is the constrained model $W_{\mathrm{con}}$, a closed-form reweighting of the global model and the target client's local model that serves as a proxy for the ensemble of clean clients. Around it, the paper defines an $\ell^2$-norm ball of radius $R$ that acts as a leash: gradient ascent on the target client's loss pulls the model away from the target's data while the projection keeps it near the clean reference, preserving utility. An early-stopping threshold $T$ on the distance between the unlearning gradient and the target's gradient decides when the ascent has erased enough without causing collapse. The verification machinery is a backdoor trigger planted in the target party's training images; unlearning success is certified by backdoor accuracy falling to roughly zero and by membership inference attacks failing to distinguish the target's data.

What would settle it

Run the method on a VFL task where the target client's feature block is the only informative signal for one output class, then test whether perturbing or zeroing that block still changes the model's predictions after unlearning. If the predictions still move, the expensive retrained baseline and the unlearned model differ in a way that accuracy averages hide.

Watch

Extended reading notes

Core claim

The discovery is that unlearning a client in VFL can be posed as a constrained maximization that reverses the training trajectory. Given the global model $W^{(k)}$ and the target client's previous-round model $W_i^{(k-1)}$, the paper constructs a reference point $W_{\mathrm{con}} = \frac{1}{2N-1}(2N W^{(k)} - W_i^{(k-1)})$, which averages the clean clients' models under the assumption that the target client has half of its data compromised. Unlearning becomes gradient ascent on the target client's loss, projected into the ball $\{Z : \lVert Z - W_{\mathrm{con}}\rVert_2 \le R\}$, so the model forgets the target's data without drifting into a useless random state. With an early-stopping threshold on the distance to the target's gradient, this yields an unlearned model whose backdoor accuracy is zero; a few post-training FedAvg rounds excluding the target bring clean accuracy close to a full retrain (e.g., 92.11 percent versus 95.85 percent on MNIST, $N=5$) while backdoor accuracy stays near chance and membership inference recall drops to zero.

Load-bearing premise

The assumption that defines the constrained model, $W_{\mathrm{con}} = \frac{1}{2N-1}(2N W^{(k)} - W_i^{(k-1)})$, is that the target client has exactly half of its data compromised, so algebraically reweighting the global and local models yields a faithful stand-in for a model trained without that client; if that separation is not clean, the gradient ascent guidance and the early-stopping criterion lose their grounding, and the unlearned model would not really correspond to removing the client's influence.

Editorial extensions

If this is right

  • If the central claim holds, a VFL platform can honor a deletion request for one client in well under a second of compute, versus the minutes required by retraining from scratch on the reported datasets.
  • The backdoor-collapse test becomes an operational certificate: a backdoor accuracy near chance (around 10 percent on 10-class tasks) is evidence that the target's feature influence was removed, not merely masked.
  • Membership inference recall of zero implies the unlearned model does not leak whether the target's data was in training, which is the privacy property that right-to-be-forgotten regulation targets.
  • The method needs no storage of per-round parameter updates during training and no access to the full original data, only the final global model and the target client's previous local model, so it fits the data-minimization posture of federated learning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The procedure implicitly assumes the server or coordinator can see the target client's individual model $W_i^{(k-1)}$; in a stronger privacy regime where only encrypted aggregates are visible, the constrained model would have to be computed through secure aggregation, which may change its accuracy.
  • The 'half compromised' assumption is a specific sweet spot; a natural extension is to test compromise fractions other than 50 percent and derive an adjusted $W_{\mathrm{con}}$, since real data-poisoning scenarios rarely land at exactly half.
  • Backdoor accuracy is a sufficient certificate of erasure, not a necessary one: a model could in principle pass this test while still memorizing benign statistics of the target's features, so the method likely under-claims rather than over-claims forgetfulness.
  • The bounded-ascent recipe could transfer to other settings where one must subtract a contributor's influence from a shared model, such as model unlearning in split learning or personalized federated learning, provided a reference model analogous to $W_{\mathrm{con}}$ can be constructed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes a vertical federated unlearning method based on constrained gradient ascent, together with a backdoor-based verification mechanism. The method defines a constrained model Wcon by algebraically reweighting the global and target-client models (Eq. 7), then states a constrained maximization problem in an ℓ2-norm ball around Wcon (Eq. 8). Algorithm 2 supposedly performs gradient ascent subject to this constraint, and the paper reports experiments on MNIST, Fashion-MNIST, and CIFAR-10 showing that backdoor accuracy drops to zero and that post-training restores clean accuracy to levels comparable to retraining from scratch. The paper also reports membership-inference results and time-complexity comparisons in support of the claimed efficiency of the unlearning procedure.

Significance. If the proposed mechanism were correctly implemented and its verification were non-circular, the paper would address an important gap: vertical federated unlearning for image data with a lightweight verification method. The idea of using a reference model to bound gradient ascent is reasonable in principle, and the paper ships a public code repository, which is a practical strength. However, the central algorithmic constraint is not actually enforced in the described algorithm, and the backdoor metric is defined in a way that makes the main empirical result a near-tautology. The comparison against retraining is therefore not yet supported by the evidence as presented.

major comments (6)
  1. [Section IV-C, Eq. (8) and Algorithm 2] The ℓ2-ball constraint that is the central claim of the method is never enforced in Algorithm 2. Line 4 performs plain gradient ascent and only labels the update with the phrase 'subject to Wi ∈ {Z : ∥Z − Wcon∥2 ≤ R}'; there is no projection step, no feasibility check, and the radius R is never used inside the loop. The early-stopping condition in line 5 compares ∥W_i^(k) − W_i^(E−1)∥2 to T, not the distance to Wcon or the radius R. Consequently, the experiments in Tables IV, VI–IX and Figures 5–6 do not test the bounded optimization problem stated in Eq. (8). If the public repository contains an omitted projection step, that omission is a serious reproducibility gap; if it does not, the central mechanism of the paper is absent.
  2. [Section IV-C, Eq. (7) vs. Section V-B] The derivation of the constrained model assumes that exactly half of the target client's data is clean, but the experimental setup states that up to 80% of the target client's images are backdoored. The expression Wcon = (2N W^(k) − W_i^(k−1))/(2N−1) is derived from the 'preserve half of its model' rationale, and it is unclear how this formula represents the clean-client model when the poisoning fraction is 80%. Since Wcon is the anchor for the entire unlearning procedure, the paper needs to justify this formula under the actual poisoning rates or report results when the poisoning fraction is exactly 50%.
  3. [Section IV-C and Table IV] The backdoor 'certification' is largely circular. Algorithm 2 maximizes the loss L(W_i; xB_i, y_i) on exactly the target client's backdoored data, and the same backdoored data are used to compute backdoor accuracy in the evaluation. Driving the loss on those samples to a high value therefore makes the backdoor accuracy drop to zero by construction; the 0.0 entries in Table IV do not provide independent evidence that the influence of the target client has been removed. A meaningful certification would use a held-out trigger set not seen by the gradient-ascent objective, or would unlearn on clean data and then test backdoor persistence.
  4. [Section V-B, Eq. (10)] Equation (10) defines backdoor accuracy as (1/N) Σ 1(G(x_i) = y_i), where y_i is described as the 'corresponding label' of the poisoned sample. For a backdoor attack with target label '8', the success criterion should be G(x_i) = 8, not G(x_i) = y_i. As written, the formula measures ordinary classification accuracy on poisoned inputs, which is not the standard backdoor accuracy and makes the headline 'Backdoor Acc' values in Table IV and Figures 5–6 hard to interpret.
  5. [Sections III-C, V-A, and Algorithm 1] The manuscript conflates the number of VFL parties with the number of FedAvg clients. The VFL framework in Section III-C has two parties, A and B, but Algorithm 1 and Eq. (7) treat N clients with local models W_i^(k). The experiments split each image into two vertical halves for parties A and B, then claim N=5 and N=10 clients. The paper never specifies how the two-party SplitNN protocol interacts with the N-client FedAvg aggregation, so it is not clear that the experiments actually test a vertical federated learning system. A precise protocol with the coordinator's loss, the party-level losses, and the aggregation over N clients is needed.
  6. [Tables IV and V, general experimental reporting] All reported accuracies and recalls appear to come from a single run, with no error bars or multiple-seed statistics. For example, Table V reports MIA recall to 16 decimal places (e.g., 0.9899403874813711) and exactly 0 for the unlearn methods, which is not credible without variance or a detailed explanation. Without repeated runs, the claimed equivalence to Retrain is not statistically supported.
minor comments (5)
  1. [Section I, contribution list] The sentence 'First of all, it contains most of shadow model that' is incomplete and appears to be a typo; it should be removed or completed.
  2. [Section III-A and Eq. (6)] In Table I, W is described as 'the gradient of the model' but is used throughout as model parameters; Eq. (6) also writes i ∈ Di, which is a subscript error since i already denotes the client index.
  3. [Algorithm 1, line 15] The symbols SGDA and SGDB are used without definition; the pseudocode should state that these are stochastic gradient descent updates for party A and party B respectively.
  4. [Section V-C, subsection 2] There is a typo in 'Fashihon-MNIST' that should read 'Fashion-MNIST'.
  5. [Section V-C, subsection 6] The description of the radius R says 'Dist represents the average Euclidean distance between Wcon and a random model, calculated by averaging over 10 random models, with the early stop threshold activated.' This definition is unclear: it should specify which model the distance is measured from and how early stopping affects the distance.

Circularity Check

2 steps flagged · score 6.0 of 10

Backdoor 'certification' is self-referential: the gradient-ascent unlearning objective is defined on the same backdoored samples used as the verification metric, so the reported 0% backdoor accuracy is an optimization outcome, not independent evidence of unlearning; threshold T is also grid-searched to produce the claimed trade-off.

  1. self definitional [Section IV-C (Unlearning via Gradient Ascent), Eq. (9); Section V-B, Eq. (10); Table IV]
    "To verify the unlearning, we introduced a backdoor-based method, which injects backdoors into the dataset of the target client associated with the selected party. The decreasing in backdoor accuracy indicates a successful unlearning of the targeted data. ... W_i^(k) ← W_i^(k−1) + ηu∇L(W_i^(k−1); x^B_i, y_i)"

    The update rule in Eq. (9) performs gradient ascent on exactly the target client's backdoored selected-party samples (x^B_i, y_i), i.e., it explicitly maximizes the loss on the tampered data. The verification metric, Eq. (10), measures backdoor accuracy on those same tampered samples. Maximizing loss on a sample directly moves the model's prediction away from the assigned trigger label, so the reported 0.0 backdoor accuracy in Table IV is a mathematical consequence of the optimization objective, not evidence that the client's underlying contribution was removed. The 'certification' is therefore defined in terms of the quantity the algorithm is built to destroy.

  2. fitted input called prediction [Section V-C.6 (Performance Evaluation of Parameters), Tables VI and VII]
    "To strike a balance, T must be chosen carefully—not too small and not too large. For N = 5, an optimal value of T = 15 achieves a backdoor accuracy of 0... Similarly, for N = 10, T = 11 achieves the same balance... we conduct a grid search over a reasonable interval, applying this strategy to determine T values for other datasets."

    The early-stopping threshold T is grid-searched per dataset specifically so that backdoor accuracy falls to 0 and clean accuracy remains high. The resulting clean/backdoor accuracy numbers are therefore the selection criterion that produced T, not an independent prediction of unlearning quality. This makes the headline 'backdoor accuracy 0' a fitted choice rather than a measured consequence of the unlearning mechanism.

full rationale

The main circular element is the backdoor certification: Equation (9) maximizes loss on exactly the same backdoored samples whose accuracy Equation (10) then reports as the verification result, so the observed 0% backdoor accuracy is essentially an identity of the optimizer and the metric. The early-stopping threshold T is also tuned per dataset to force the reported trade-off, so part of the headline result is selected rather than predicted. The paper's self-citations in related work (e.g., [10], [22], [29]) are not load-bearing, and the missing ℓ2-radius projection in Algorithm 2 is a correctness/reproducibility gap rather than circularity. The clean-accuracy recovery after post-training is independent empirical content, which prevents the whole derivation from being a pure tautology; the circularity is partial and concentrated in the verification design. Score 6.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central method rests on the algebraic constrained-model formula and several tuned hyperparameters. No formal proof is provided for the unlearning guarantee, and the backdoor verification is self-referential.

free parameters (4)
  • l2 radius R = Dist/3 (chosen from Tables VIII-IX)
    Set to one third of the average distance between the constrained model and a random model, based on observed trade-offs in the Fashion-MNIST experiments. No principled derivation.
  • early stopping threshold T = e.g., 15 (Fashion-MNIST N=5), 11 (N=10), grid-searched per dataset
    Grid search is used to balance clean accuracy versus backdoor accuracy; the values are chosen to make the reported results look good.
  • post-training epochs = 10 for MNIST, 1-3 for Fashion-MNIST and CIFAR-10
    Selected by observing convergence in Fig. 6; not justified by any principled criterion.
  • learning rates and batch sizes = not specified in text
    Algorithm inputs list eta, eta_u, m, mu but no values are reported; without these, replication is impossible.
assumptions (3)
  • ad hoc to paper The global FedAvg model W and the target client's previous local model W_i^(E-1) are sufficient to define a constrained model that approximates the clean clients' average.
    Eq. 7 derives Wcon as an algebraic manipulation of the global average and the target's previous model, but there is no justification that halving the target's model weight corresponds to removing its contribution.
  • domain assumption Gradient ascent on the target client's local data, when early-stopped by a distance threshold, will remove the target's influence without destroying global utility.
    This is the central heuristic of the method; no theoretical guarantee is provided, and the experiments show it actually does destroy utility (clean accuracy drops to ~80%) until post-training.
  • ad hoc to paper The backdoor accuracy metric is a valid proxy for the degree to which the target client's data has been forgotten.
    The paper injects its own backdoor and defines success as its removal, which is circular and not an external certification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Vertical Federated Unlearning via Backdoor Certification." pith.science (2026). https://pith.science/paper/UC6OVSZC

@misc{pith2026241211476,
  author       = {Pith},
  title        = {Pith review of: Vertical Federated Unlearning via Backdoor Certification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UC6OVSZC}},
  note         = {Machine review of arXiv:2412.11476}
}
read the original abstract

Vertical Federated Learning (VFL) offers a novel paradigm in machine learning, enabling distinct entities to train models cooperatively while maintaining data privacy. This method is particularly pertinent when entities possess datasets with identical sample identifiers but diverse attributes. Recent privacy regulations emphasize an individual's \emph{right to be forgotten}, which necessitates the ability for models to unlearn specific training data. The primary challenge is to develop a mechanism to eliminate the influence of a specific client from a model without erasing all relevant data from other clients. Our research investigates the removal of a single client's contribution within the VFL framework. We introduce an innovative modification to traditional VFL by employing a mechanism that inverts the typical learning trajectory with the objective of extracting specific data contributions. This approach seeks to optimize model performance using gradient ascent, guided by a pre-defined constrained model. We also introduce a backdoor mechanism to verify the effectiveness of the unlearning procedure. Our method avoids fully accessing the initial training data and avoids storing parameter updates. Empirical evidence shows that the results align closely with those achieved by retraining from scratch. Utilizing gradient ascent, our unlearning approach addresses key challenges in VFL, laying the groundwork for future advancements in this domain. All the code and implementations related to this paper are publicly available at https://github.com/mengde-han/VFL-unlearn.

Figures

Figures reproduced from arXiv: 2412.11476 by the authors.

Figure 1
Figure 1. The architecture of a vertical federated learning system [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The VFL framework adopted in the paper. In vertical federated learning, various parties function within a shared sample space, yet they handle distinct feature spaces. Each participating entity maintains a local model that is trained using their own private data. This training enables them to compute intermediate parameters at each stage of the learning process. Subsequently, these intermediate parameters are upload… view at source ↗
Figure 3
Figure 3. An example of the vertically partitioned image and the implemented [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Accuracy results on the clean dataset for different datasets and values [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 6
Figure 6. Figure 6: Clean and backdoor accuracy of unlearning methods after rounds of [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 19 canonical work pages

  1. [1]

    Federated unlearning,

    G. Liu, X. Ma, Y . Yang, C. Wang, and J. Liu, “Federated unlearning,” arXiv preprint arXiv:2012.13891 , 2020. JOURNAL OF LATEX CLASS FILES 13

    arXiv 2012

  2. [2]

    Forget-svgd: Particle- based bayesian federated unlearning,

    J. Gong, J. Kang, O. Simeone, and R. Kassab, “Forget-svgd: Particle- based bayesian federated unlearning,” in 2022 IEEE Data Science and Learning Workshop (DSLW). IEEE, 2022, pp. 1–6

    work page 2022

  3. [3]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st computer security foundations symposium (CSF) . IEEE, 2018, pp. 268–282

    2018

  4. [4]

    Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption,

    S. Hardy, W. Henecka, H. Ivey-Law, R. Nock, G. Patrini, G. Smith, and B. Thorne, “Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption,” arXiv preprint arXiv:1711.10677, 2017

    arXiv 2017

  5. [5]

    Federated machine learning: Concept and applications,

    Q. Yang, Y . Liu, T. Chen, and Y . Tong, “Federated machine learning: Concept and applications,” ACM Transactions on Intelligent Systems and Technology (TIST), vol. 10, no. 2, pp. 1–19, 2019

    2019

  6. [6]

    Measure contribution of partici- pants in federated learning,

    G. Wang, C. X. Dang, and Z. Zhou, “Measure contribution of partici- pants in federated learning,” in 2019 IEEE international conference on big data (Big Data) . IEEE, 2019, pp. 2597–2604

    work page 2019

  7. [7]

    Privacy preserv- ing vertical federated learning for tree-based models,

    Y . Wu, S. Cai, X. Xiao, G. Chen, and B. C. Ooi, “Privacy preserv- ing vertical federated learning for tree-based models,” arXiv preprint arXiv:2008.06170, 2020

    arXiv 2008

  8. [8]

    Vf-ps: How to select important participants in vertical feder- ated learning, efficiently and securely?

    J. Jiang, L. Burkhalter, F. Fu, B. Ding, B. Du, A. Hithnawi, B. Li, and C. Zhang, “Vf-ps: How to select important participants in vertical feder- ated learning, efficiently and securely?” Advances in Neural Information Processing Systems, vol. 35, pp. 2088–2101, 2022

    work page 2022

Show all 51 references
  1. [9]

    Adversarial attacks and defenses in deep learning: From a perspective of cyberse- curity,

    S. Zhou, C. Liu, D. Ye, T. Zhu, W. Zhou, and P. S. Yu, “Adversarial attacks and defenses in deep learning: From a perspective of cyberse- curity,” ACM Computing Surveys , vol. 55, no. 8, pp. 1–39, 2022

    2022

  2. [10]

    More than privacy: Applying differential privacy in key areas of artificial intelligence,

    T. Zhu, D. Ye, W. Wang, W. Zhou, and S. Y . Philip, “More than privacy: Applying differential privacy in key areas of artificial intelligence,”IEEE Transactions on Knowledge and Data Engineering , vol. 34, no. 6, pp. 2824–2843, 2020

    2020

  3. [11]

    Fairvfl: A fair vertical federated learning framework with contrastive adversarial learning,

    T. Qi, F. Wu, C. Wu, L. Lyu, T. Xu, H. Liao, Z. Yang, Y . Huang, and X. Xie, “Fairvfl: A fair vertical federated learning framework with contrastive adversarial learning,” Advances in Neural Information Processing Systems, vol. 35, pp. 7852–7865, 2022

    2022

  4. [12]

    Fedsdg- fs: Efficient and secure feature selection for vertical federated learning,

    A. Li, H. Peng, L. Zhang, J. Huang, Q. Guo, H. Yu, and Y . Liu, “Fedsdg- fs: Efficient and secure feature selection for vertical federated learning,” arXiv preprint arXiv:2302.10417 , 2023

    2023 arXiv

  5. [13]

    Towards making systems forget with machine unlearning,

    Y . Cao and J. Yang, “Towards making systems forget with machine unlearning,” in 2015 IEEE symposium on security and privacy . IEEE, 2015, pp. 463–480

    2015

  6. [14]

    Lifelong anomaly detection through unlearning,

    M. Du, Z. Chen, C. Liu, R. Oak, and D. Song, “Lifelong anomaly detection through unlearning,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 1283– 1297

    2019

  7. [15]

    Making ai forget you: Data deletion in machine learning,

    A. Ginart, M. Guan, G. Valiant, and J. Y . Zou, “Making ai forget you: Data deletion in machine learning,” Advances in neural information processing systems, vol. 32, 2019

    2019

  8. [16]

    Machine unlearning,

    L. Bourtoule, V . Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, “Machine unlearning,” in 2021 IEEE Symposium on Security and Privacy (SP) . IEEE, 2021, pp. 141–159

    2021

  9. [17]

    Descent-to-delete: Gradient-based methods for machine unlearning,

    S. Neel, A. Roth, and S. Sharifi-Malvajerdi, “Descent-to-delete: Gradient-based methods for machine unlearning,” in Algorithmic Learn- ing Theory. PMLR, 2021, pp. 931–962

    2021

  10. [18]

    Remember what you want to forget: Algorithms for machine unlearning,

    A. Sekhari, J. Acharya, G. Kamath, and A. T. Suresh, “Remember what you want to forget: Algorithms for machine unlearning,” Advances in Neural Information Processing Systems , vol. 34, pp. 18 075–18 086, 2021

    2021

  11. [19]

    On the necessity of auditable algorithmic definitions for machine unlearning,

    A. Thudi, H. Jia, I. Shumailov, and N. Papernot, “On the necessity of auditable algorithmic definitions for machine unlearning,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 4007– 4022

    2022

  12. [20]

    Fast yet effective machine unlearning,

    A. K. Tarun, V . S. Chundawat, M. Mandal, and M. Kankanhalli, “Fast yet effective machine unlearning,” IEEE Transactions on Neural Networks and Learning Systems , 2023

    2023

  13. [21]

    Zero- shot machine unlearning,

    V . S. Chundawat, A. K. Tarun, M. Mandal, and M. Kankanhalli, “Zero- shot machine unlearning,” IEEE Transactions on Information Forensics and Security, 2023

    2023

  14. [22]

    Machine unlearning: A survey,

    H. Xu, T. Zhu, L. Zhang, W. Zhou, and P. S. Yu, “Machine unlearning: A survey,” ACM Computing Surveys , vol. 56, no. 1, pp. 1–36, 2023

    2023

  15. [23]

    Erm-ktp: Knowledge-level machine unlearning via knowledge transfer,

    S. Lin, X. Zhang, C. Chen, X. Chen, and W. Susilo, “Erm-ktp: Knowledge-level machine unlearning via knowledge transfer,” in Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 20 147–20 155

    2023

  16. [24]

    Federated unlearning with knowledge distillation,

    C. Wu, S. Zhu, and P. Mitra, “Federated unlearning with knowledge distillation,” arXiv preprint arXiv:2201.09441 , 2022

    2022 arXiv

  17. [25]

    User- level privacy-preserving federated learning: Analysis and performance optimization,

    K. Wei, J. Li, M. Ding, C. Ma, H. Su, B. Zhang, and H. V . Poor, “User- level privacy-preserving federated learning: Analysis and performance optimization,” IEEE Transactions on Mobile Computing , vol. 21, no. 9, pp. 3388–3401, 2021

    2021

  18. [26]

    Federated unlearning for on-device recommendation,

    W. Yuan, H. Yin, F. Wu, S. Zhang, T. He, and H. Wang, “Federated unlearning for on-device recommendation,” in Proceedings of the Six- teenth ACM International Conference on Web Search and Data Mining , 2023, pp. 393–401

    2023

  19. [27]

    Heterogeneous federated knowledge graph embedding learning and unlearning,

    X. Zhu, G. Li, and W. Hu, “Heterogeneous federated knowledge graph embedding learning and unlearning,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2444–2454

    2023

  20. [28]

    Asynchronous federated unlearning,

    N. Su and B. Li, “Asynchronous federated unlearning,” in IEEE INFO- COM 2023-IEEE Conference on Computer Communications . IEEE, 2023, pp. 1–10

    2023

  21. [29]

    Fedrecovery: Differentially private machine unlearning for federated learning frame- works,

    L. Zhang, T. Zhu, H. Zhang, P. Xiong, and W. Zhou, “Fedrecovery: Differentially private machine unlearning for federated learning frame- works,” IEEE Transactions on Information Forensics and Security, 2023

    2023

  22. [30]

    Vertical federated unlearning on the logistic regression model,

    Z. Deng, Z. Han, C. Ma, M. Ding, L. Yuan, C. Ge, and Z. Liu, “Vertical federated unlearning on the logistic regression model,” Electronics, vol. 12, no. 14, p. 3182, 2023

    2023

  23. [31]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  24. [32]

    Local model poisoning attacks to {Byzantine-Robust} federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20) , 2020, pp. 1605–1622

    2020

  25. [33]

    Invisible backdoor attacks on deep neural networks via steganography and regularization,

    S. Li, M. Xue, B. Z. H. Zhao, H. Zhu, and X. Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 5, pp. 2088–2105, 2020

    2020

  26. [34]

    Data poisoning attacks against federated learning systems,

    V . Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in Computer Security–ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14–18, 2020, Proceedings, Part I 2...

    2020

  27. [35]

    Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,

    Y . Wan, Y . Qu, W. Ni, Y . Xiang, L. Gao, and E. Hossain, “Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,” IEEE Communications Surveys & Tutorials, 2024

    2024

  28. [36]

    Deep learning based attack detection for cyber-physical system cybersecurity: A survey,

    J. Zhang, L. Pan, Q.-L. Han, C. Chen, S. Wen, and Y . Xiang, “Deep learning based attack detection for cyber-physical system cybersecurity: A survey,” IEEE/CAA Journal of Automatica Sinica , vol. 9, no. 3, pp. 377–391, 2021

    2021

  29. [37]

    Deep model poisoning attack on federated learning,

    X. Zhou, M. Xu, Y . Wu, and N. Zheng, “Deep model poisoning attack on federated learning,” Future Internet, vol. 13, no. 3, p. 73, 2021

    2021

  30. [38]

    Detecting vulnerability on iot device firmware: A survey,

    X. Feng, X. Zhu, Q.-L. Han, W. Zhou, S. Wen, and Y . Xiang, “Detecting vulnerability on iot device firmware: A survey,” IEEE/CAA Journal of Automatica Sinica, vol. 10, no. 1, pp. 25–41, 2022

    2022

  31. [39]

    Fl- wbc: Enhancing robustness against model poisoning attacks in federated learning from a client perspective,

    J. Sun, A. Li, L. DiValentin, A. Hassanzadeh, Y . Chen, and H. Li, “Fl- wbc: Enhancing robustness against model poisoning attacks in federated learning from a client perspective,” Advances in Neural Information Processing Systems, vol. 34, pp. 12 613–12 624, 2021

    2021

  32. [40]

    Fldetector: Defending federated learning against model poisoning attacks via detecting ma- licious clients,

    Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “Fldetector: Defending federated learning against model poisoning attacks via detecting ma- licious clients,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, pp. 2545–2555

    2022

  33. [41]

    Privacyeafl: Privacy- enhanced aggregation for federated learning in mobile crowdsensing,

    M. Zhang, S. Chen, J. Shen, and W. Susilo, “Privacyeafl: Privacy- enhanced aggregation for federated learning in mobile crowdsensing,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  34. [42]

    A privacy-preserving and untraceable group data sharing scheme in cloud computing,

    J. Shen, H. Yang, P. Vijayakumar, and N. Kumar, “A privacy-preserving and untraceable group data sharing scheme in cloud computing,” IEEE Transactions on Dependable and Secure Computing , vol. 19, no. 4, pp. 2198–2210, 2021

    2021

  35. [43]

    The dark side of explanations: Poisoning recommender systems with counterfactual examples,

    Z. Chen, F. Silvestri, J. Wang, Y . Zhang, and G. Tolomei, “The dark side of explanations: Poisoning recommender systems with counterfactual examples,” arXiv preprint arXiv:2305.00574 , 2023

    2023 arXiv

  36. [44]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282

    2017

  37. [45]

    Distributed learning of deep neural network over multiple agents,

    O. Gupta and R. Raskar, “Distributed learning of deep neural network over multiple agents,” Journal of Network and Computer Applications , vol. 116, pp. 1–8, 2018

    2018

  38. [46]

    Federated un- learning: How to efficiently erase a client in fl?

    A. Halimi, S. Kadhe, A. Rawat, and N. Baracaldo, “Federated un- learning: How to efficiently erase a client in fl?” arXiv preprint arXiv:2207.05521, 2022. JOURNAL OF LATEX CLASS FILES 14

    2022 arXiv

  39. [47]

    The mnist database of handwritten digits,

    Y . LeCun, “The mnist database of handwritten digits,” http://yann. lecun. com/exdb/mnist/, 1998

    1998

  40. [48]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  41. [49]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  42. [50]

    Adversarial robustness toolbox v1. 0.0,

    M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V . Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig et al., “Adversarial robustness toolbox v1. 0.0,” arXiv preprint arXiv:1807.01069 , 2018. Mengde Han received the B.S. degree from Shan- dong University, Chi...

    2018 arXiv

  43. [2017]

    degree with the University of Technology Sydney, Australia

    He is currently pursuing the Ph.D. degree with the University of Technology Sydney, Australia. His research interests are federated learning, fairness and privacy preserving. Tianqing Zhu is a professor and associate dean of the Faculty of Data Science in City University of Ma...

    2000

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.