Federated Unlearning

Federated unlearning operates across distributed nodes without ever aggregating raw data. When a client invokes a deletion request, the central server orchestrates a targeted model update that subtracts the client's historical contribution from the aggregated global weights. This process leverages historical gradient updates or parameter delta logs stored during the original federated training rounds to compute the inverse operation, ensuring the global model behaves as if the client never participated.

Certified federated unlearning often relies on differential privacy (DP) guarantees to provide formal mathematical bounds on information removal. By training with DP-SGD during the original federated process, each client's contribution is already bounded by a calibrated epsilon budget. Unlearning then involves absorbing the target client's privacy loss into a group privacy accountant, providing a certified removal guarantee that is cryptographically verifiable rather than merely empirical.

A pragmatic approach to federated unlearning involves clustered retraining rather than global model rollback. Clients are partitioned into disjoint shards during training, similar to SISA (Sharded, Isolated, Sliced, Aggregated) frameworks. When a deletion request targets a specific client, only the sub-model trained on that client's shard requires retraining. The unaffected shards remain intact, and the final global model is reaggregated, dramatically reducing the computational overhead compared to full federated retraining.

In settings where historical client updates are stored, federated unlearning can be executed via aggregated gradient ascent. The server retrieves the sequence of model deltas submitted by the target client during training and applies their inverse to the current global model. This process effectively erases the client's influence by reversing the optimization trajectory. However, this method requires careful learning rate calibration to avoid catastrophic forgetting of other clients' contributions and may leave residual statistical traces detectable by membership inference attacks.

Verifying federated unlearning without access to raw data requires backdoor-based auditing techniques. During training, the target client injects a unique, imperceptible trigger pattern into their local data. After the unlearning procedure, auditors test whether the global model still responds to this trigger. A successful unlearning operation renders the model insensitive to the backdoor, providing a black-box verification mechanism. This approach is complemented by shadow model testing to estimate residual information leakage.

Federated unlearning strategies diverge significantly between cross-silo and cross-device settings. In cross-silo environments with a small number of reliable institutional clients, exact unlearning via sharded retraining is feasible. In cross-device settings with millions of ephemeral edge devices, approximate methods like historical gradient subtraction or knowledge distillation from a cleansed teacher model are necessary. The latter must account for straggler devices and asynchronous participation that complicate precise contribution tracking.