aiqbench analysis
This research exposes a critical privacy vulnerability in federated unlearning systems where high-precision model broadcasts inadvertently leak deleted data summaries to malicious clients. By mathematically characterizing the information leakage through state comparisons, the study defines the exact conditions under which deleted samples can be recovered or reinserted into the model. These findings highlight the inherent tension between computational efficiency in deletion protocols and the preservation of data integrity against probing attacks.
Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning
arXiv:2609.04475v1 Announce Type: cross Abstract: Federated unlearning aims to remove a client's data from a shared model without retraining from scratch. Some efficient systems make deletion exact by storing compact, additive summaries of the training features and broadcasting an updated linear classifier after every accepted change. We show that these broadcasts can also reveal the hidden summaries. A malicious client can submit known changes, use the returned classifiers to identify the server state, and compare states immediately before and after an isolated deletion. This exposes the deleted sample, class, or client summary and can enable its reinsertion. We characterize exactly when the observations contain enough independent information, give a matching optimal construction for unrestricted probes, and derive a more realistic estimator based on additions formed from the attacker's own data. On MNIST and CIFAR-10, high-precision broadcasts permit exact label recovery for every tested sample deletion with both probe types. Lower-precision broadcasts sharply reduce fine-grained recovery, and insufficiently diverse responses prevent identification altogether. Unrestricted probes are readily detected by their size; most individual attacker-data additions resemble honest batches, although we do not claim that the complete sequence is inconspicuous. The results identify a concrete privacy and integrity risk, its algebraic cause, and practical limits involving broadcast precision, update verification, response rate, and concurrent activity.
Abstract:Federated unlearning aims to remove a client's data from a shared model without retraining from scratch. Some efficient systems make deletion exact by storing compact, additive summaries of the training features and broadcasting an updated linear classifier after every accepted change. We show that these broadcasts can also reveal the hidden summaries. A malicious client can submit known changes, use the returned classifiers to identify the server state, and compare states immediately before and after an isolated deletion. This exposes the deleted sample, class, or client summary and can enable its reinsertion. We characterize exactly when the observations contain enough independent information, give a matching optimal construction for unrestricted probes, and derive a more realistic estimator based on additions formed from the attacker's own data. On MNIST and CIFAR-10, high-precision broadcasts permit exact label recovery for every tested sample deletion with both probe types. Lower-precision broadcasts sharply reduce fine-grained recovery, and insufficiently diverse responses prevent identification altogether. Unrestricted probes are readily detected by their size; most individual attacker-data additions resemble honest batches, although we do not claim that the complete sequence is inconspicuous. The results identify a concrete privacy and integrity risk, its algebraic cause, and practical limits involving broadcast precision, update verification, response rate, and concurrent activity.
Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2609.04475 [cs.CR]
(or arXiv:2609.04475v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.04475 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 306 words
Related coverage
Exact Federated Continual Unlearning for Ridge Heads on Frozen Foundation Models
arXiv · Jun 16, 2026
$f$-FUM: Federated Unlearning via min--max and $f$-divergence
arXiv · Sep 30, 2026
MMFGU: Multimodal Federated Graph Unlearning
arXiv · Aug 3, 2026
FIRM: Fisher-Informed Retention Merging for Federated LLM Unlearning
arXiv · Oct 17, 2026