Federated Unlearning: A Survey on Methods, Design Guidelines, and Evaluation Metrics

TL;DR

This study includes a detailed analysis of the metrics for evaluating unlearning in FL, an in-depth literature review categorizing state-of-the-art FU contributions under a novel taxonomy, and outlines the most relevant and still open technical challenges.

Abstract

Federated learning (FL) enables collaborative training of a machine learning (ML) model across multiple parties, facilitating the preservation of users' and institutions' privacy by maintaining data stored locally. Instead of centralizing raw data, FL exchanges locally refined model parameters to build a global model incrementally. While FL is more compliant with emerging regulations such as the European General Data Protection Regulation (GDPR), ensuring the right to be forgotten in this context - allowing FL participants to remove their data contributions from the learned model - remains unclear. In addition, it is recognized that malicious clients may inject backdoors into the global model through updates, e.g., to generate mispredictions on specially crafted data examples. Consequently, there is the need for mechanisms that can guarantee individuals the possibility to remove their data and erase malicious contributions even after aggregation, without compromising the already acquired "good" knowledge. This highlights the necessity for novel federated unlearning (FU) algorithms, which can efficiently remove specific clients' contributions without full model retraining. This article provides background concepts, empirical evidence, and practical guidelines to design/implement efficient FU schemes. This study includes a detailed analysis of the metrics for evaluating unlearning in FL and presents an in-depth literature review categorizing state-of-the-art FU contributions under a novel taxonomy. Finally, we outline the most relevant and still open technical challenges, by identifying the most promising research directions in the field.

Figures (6)

• Figure 1: Illustrative organization of the paper.
• Figure 2: FU overview. When the client $u$ requests to be forgotten, the FL server erases its contributions from the global model $w_t$, generating a new version $w_t^{\bar{u}}$.
• Figure 3: Visualization of FU objectives. We consider four clients in the federation, i.e., clients A, B, C, and D, and four total classes for the data held by clients, i.e., L1, L2, L3, and L4. The figure reports the label that corresponds to a specific sample in the local dataset of clients (e.g., data sample 1 in client A's dataset belongs to class L1).
• Figure 4: The global model's accuracy on test data (solid line) versus the global model's accuracy on client $u$'s train data (dashed line) across many FL rounds. Grey bars indicate that client $u$ has participated in that round. The upper row of charts considers IID data distribution among clients. The bottom row of charts considers non-IID data distribution among clients, simulated via distribution-based labels skew (with concentration parameter $\alpha$=0.1). The last column of charts depicts the global model's test accuracy with or without client $u$ in the federation across rounds.
• Figure 5: The KL divergence between the global model's output probability on client $u$'s train data and a uniformly distributed output probability (as proposed in gao2022verifi), across many FL rounds. The red line refers to regular training (client $u$ is included in the federation only for the first 50 rounds). Red bars indicate that client $u$ has participated in that round. The gray line refers to retraining (sanitized federation) where client $u$ never participates.