Class-wise Federated Unlearning: Harnessing Active Forgetting with Teacher-Student Memory Generation

TL;DR

This work addresses privacy preservation in federated learning under RTBF by introducing FedAF, a neuro-inspired framework for fine-grained class-wise unlearning. FedAF integrates a memory generator and a knowledge preserver into an active-forgetting loop, using teacher-student memory generation and refined Elastic Weight Consolidation to overwrite target memories while preserving non-target knowledge, without storing historical updates. Empirical results on MNIST, CIFAR-10, and CelebA demonstrate that FedAF achieves strong unlearning completeness and maintains model utility with high efficiency, including robust performance under backdoor unlearning scenarios. The method is architecture-agnostic and scalable to practical federated deployments, offering a feasible path toward real-world RTBF compliance in distributed learning systems.

Abstract

Privacy concerns associated with machine learning models have driven research into machine unlearning, which aims to erase the memory of specific target training data from already trained models. This issue also arises in federated learning, creating the need to address the federated unlearning problem. However, federated unlearning remains a challenging task. On the one hand, current research primarily focuses on unlearning all data from a client, overlooking more fine-grained unlearning targets, e.g., class-wise and sample-wise removal. On the other hand, existing methods suffer from imprecise estimation of data influence and impose significant computational or storage burden. To address these issues, we propose a neuro-inspired federated unlearning framework based on active forgetting, which is independent of model architectures and suitable for fine-grained unlearning targets. Our framework distinguishes itself from existing methods by utilizing new memories to overwrite old ones. These new memories are generated through teacher-student learning. We further utilize refined elastic weight consolidation to mitigate catastrophic forgetting of non-target data. Extensive experiments on benchmark datasets demonstrate the efficiency and effectiveness of our method, achieving satisfactory unlearning completeness against backdoor attacks.

Figures (7)

• Figure 1: An overview of different federated unlearning approaches (right) and targets (left). $\theta$ and $\theta_{\lnot}$ denote original and unlearned models respectively. $\mathcal{D}$, $\mathcal{R}$, and $\mathcal{D}'$ denote the original training dataset, the target data (to be unlearned), and the updated dataset without the target data ($\mathcal{D} \backslash \mathcal{R}$) respectively.
• Figure 2: An overview of FedAF which integrates the unlearning loop into the local training loop of a client. The unlearning loop consists of a memory generator and a knowledge preserver, where $\mathcal{M}$ denotes new memory (manipulated data), $\mathcal{D}$ is the dataset, $\mathcal{R}$ denotes unlearning request (target data), and $\theta$ denotes model parameters.
• Figure 3: The difference between conventional training and EWC training. The outermost circle denotes the space of model $\theta$. Assuming that the model is trained on tasks $\mathcal{D}_k$ and $\mathcal{M}$ sequentially. The circles of $\theta^*_{\mathcal{D}_k}$ and $\theta^*_\mathcal{M}$ denote possible solution spaces for task $\mathcal{D}_k$ and $\mathcal{M}$ respectively. Conventional training picks up the best possible parameters for task $\mathcal{M}$, i.e., $\theta^*_\mathcal{M}$, which leads to catastrophic forgetting of task $\mathcal{D}_k$. EWC training elastically regularizes the parameters on both tasks, and picks up the parameters in the overlapping solution space, i.e., $\theta^*_{\mathcal{D}_k \mathcal{M}}$.
• Figure 4: Illustrations of original images (Ori, i.e., the first row) in the datasets, and the images that are implanted with backdoor triggers (BKD, i.e., the second row).
• Figure 5: Results of overlapping validation where we respectively manipulate each class by fake labels and report the accuracy of the target class in the testing set (the lower the better). We report the box plots (blue) and the average results (red) of 10 trials. The first, second, and third rows show the results on MNIST, CIFAR10, and CelebA respectively.

Theorems & Definitions (1)

• Theorem 1: Error Upper Bound li2021lifelong