Client-Verifiable and Efficient Federated Unlearning in Low-Altitude Wireless Networks

Abstract: In low-altitude wireless networks (LAWN), federated learning (FL) enables collaborative intelligence among unmanned aerial vehicles (UAVs) and integrated sensing and communication (ISAC) devices while keeping raw sensing data local. Due to the "right to be forgotten" requirements and the high mobility of ISAC devices that frequently enter or leave the coverage region of UAV-assisted servers, the influence of departing devices must be removed from trained models. This necessity motivates the adoption of federated unlearning (FUL) to eliminate historical device contributions from the global model in LAWN. However, existing FUL approaches implicitly assume that the UAV-assisted server executes unlearning operations honestly. Without client-verifiable guarantees, an untrusted server may retain residual device information, leading to potential privacy leakage and undermining trust. To address this issue, we propose VerFU, a privacy-preserving and client-verifiable federated unlearning framework designed for LAWN. It empowers ISAC devices to validate the server-side unlearning operations without relying on original data samples. By integrating linear homomorphic hash (LHH) with commitment schemes, VerFU constructs tamper-proof records of historical updates. ISAC devices ensure the integrity of unlearning results by verifying decommitment parameters and utilizing the linear composability of LHH to check whether the global model accurately removes their historical contributions. Furthermore, VerFU is capable of efficiently processing parallel unlearning requests and verification from multiple ISAC devices. Experimental results demonstrate that our framework efficiently preserves model utility post-unlearning while maintaining low communication and verification overhead.

• The paper introduces a novel client-verifiable federated unlearning protocol, VerFU, that leverages hybrid cryptography to securely remove a device's contributions without using original data.
• It demonstrates minimal model utility degradation with less than a 1.3% accuracy drop and full recovery within 2–4 rounds under varying unlearning rates.
• The framework supports scalable, concurrent verification in dynamic LAWN deployments, ensuring compliance with privacy regulations and robust edge intelligence.

Client-Verifiable Federated Unlearning for LAWN: The VerFU Framework

Context and Motivation

Federated learning (FL) is integral to Low-Altitude Wireless Networks (LAWN), enabling UAV-assisted servers and highly mobile integrated sensing and communication (ISAC) devices to collaboratively learn global models without sharing raw sensing data. LAWN deployments feature rapid device turnover due to mobility, task reassignment, and privacy requests, making compliance with "right to be forgotten" regulations nontrivial. Federated unlearning (FUL) is required to erase historical contributions of departed devices to ensure regulatory compliance and sustain trust in edge intelligence. Existing FUL protocols operate under implicit trust in the aggregation server’s honesty, which introduces vulnerabilities: untrusted or adversarial UAV servers may ignore or partially honor unlearning requests, risking privacy leakage through residual client information. Direct client-side verification of unlearning correctness is thus required.

VerFU Architecture and Protocol

The VerFU framework proposes a privacy-preserving, client-verifiable FUL protocol optimized for LAWN. Crucially, VerFU obviates reliance on original data samples for verification, which is essential for devices with ephemeral or privacy-sensitive datasets. The architecture employs a hybrid cryptography stack comprising linear homomorphic hash (LHH), non-interactive equivocal commitments, and additive homomorphic encryption (specifically, the Paillier system) to enable cryptographically robust aggregation and verifiable unlearning.

Figure 1: The VerFU architecture, showing workflow among ISAC devices, UAV-assisted servers, and cryptographic verification components.

The protocol proceeds in three stages:

1. Preparation: ISAC devices locally train, encrypt gradients, compute homomorphic hashes, generate commitments, and upload both encrypted and commitment artifacts.
2. Aggregation and Unlearning: The UAV server aggregates client updates in the encrypted domain. Upon unlearning requests, historical contributions are cryptographically subtracted from the global model update.
3. Verification: The server broadcasts updated models and received commitment strings. Unlearning requesters verify commitment opening and then use LHH linear composition to confirm their historical updates were removed.

This design allows multiple ISAC devices to process unlearning—and subsequent verification—concurrently, with minimal extra communication or computation per client, an essential property for scalable LAWN deployment.

Security and Verification Guarantees

VerFU's security analysis formalizes strong adversarial models, where the server and external entities may attempt to forge, partially execute, or simulate unlearning operations. Security follows from:

• Collision resistance of LHH: Ensures update integrity, as adversaries cannot substitute or tamper hash commitments undetected.
• Binding and equivocality of commitments: Guarantees the immutability and privacy of historical update commitments.
• IND-CPA security of Paillier encryption: Upholds non-disclosure of client gradients, even under chosen-ciphertext attacks.

Verification comprises two cryptographic checks:

1. Commitment decommitment matching for gradient or historical update hashes, which detects tampering.
2. Linear homomorphic hash computation over aggregation outputs and status-tagged client hashes (state tag $f_i$), confirming that the unlearning and aggregation algebra performed by the server matches the claimed operations.

The authors rigorously prove that any deviation by a PPT adversary will be detected with negligible probability of error, under standard cryptographic assumptions.

Empirical Results: Utility and Efficiency

Model utility, under dynamic and large-scale unlearning, is evaluated using MNIST, Fashion-MNIST, and EMNIST benchmarks in a simulated LAWN with 500 devices and non-IID local data. Across varying unlearning rates (up to 40%), the post-unlearning model accuracy drop is strictly bounded ($<1.3\%$), and full accuracy recovery is achieved within 2–4 FL rounds. (Figure 2), (Figure 3), and (Figure 4) detail these outcomes:

Figure 2: MNIST accuracy trajectories at different unlearning rates; high stability and no divergence are sustained.

Figure 3: Loss curves for MNIST under varying unlearning rates; recovery is consistent and rapid.

Figure 4: Impact of unlearning on model utility—accuracy drop, loss increase, and recovery epochs are tightly bounded.

In all settings, model utility degradation due to unlearning is minimal, with transient effects promptly amortized by subsequent rounds. The communication cost for verification is negligible (<1 kB per device per round). The most intensive optional configuration with HE increases cumulative communication to ~74 MB per device after 100 rounds—still considerably more scalable than existing privacy-preserving verification baselines (e.g., PoLHE and zkPoT), which incur hundreds of MB to GB overheads per device.

Furthermore, computational latency for verification is minimal (11–15 s for a full run), at least an order of magnitude lower than reference PoL, PoLHE, or zkPoT protocols on all datasets.

Practical and Theoretical Implications

Practically, VerFU’s architecture directly enables compliant, efficient federated intelligence in LAWN, UAV, and vehicular learning infrastructures where frequent device churn occurs and server trust is nontrivial. The protocol’s efficiency allows deployment under wireless resource constraints. Its sample-independent verification paradigm addresses a growing need for unlearning in privacy-critical and dynamic edge scenarios where access to prior raw data is infeasible or impermissible. The protocol’s concurrency and cryptographic soundness make it well-suited to regulatory-anchored environments, such as those governed by GDPR or CCPA.

Theoretically, VerFU’s design sets a new baseline for client-verifiable FUL systems with cryptographic assurances of both aggregation and unlearning. The combination of homomorphic hash and commitment, not reliant on statistical signature alteration or test set monitoring, represents a more robust and universally applicable strategy for verifiable deletion in decentralized ML. This methodology is directly extensible to other domains requiring verifiable participation exclusion, including privacy-preserving collaborative filtering, federated medical applications, or edge monitoring ecosystems.

Future directions include upgrading VerFU with more communication-efficient HE instantiations (e.g., RLWE-based schemes), exploring adversarial ISAC devices, integrating zero-knowledge succinct proofs, and dynamic aggregation topologies. Furthermore, fine-grained selective unlearning (removal of records or gradient subsets rather than whole clients) remains an open research area.

Conclusion

VerFU presents a cryptographically sound, communication- and computation-efficient framework for client-verifiable federated unlearning in LAWN (2603.29688). Its architecture guarantees privacy of local updates, robust detection of unlearning misbehavior, and maintenance of post-unlearning model utility under dynamic real-world participation. VerFU enables practical enforcement of user-driven data erasure in decentralized machine learning, tightly aligning with modern privacy regulations and trust requirements in edge intelligence systems.