Client Unlearning in Federated Learning

• Client unlearning is the process of completely removing a client’s data influence from a federated model to emulate retraining with only the remaining data.
• It employs methodologies such as retraining, contribution editing, and architectural isolation to achieve precise and efficient data deletion.
• Empirical evaluations show that these methods can maintain high model accuracy while mitigating risks like data poisoning and privacy breaches.

Searching arXiv for the core paper ids and topic to ground the article in current literature. Client unlearning is the federated-learning problem of removing the influence of an entire client’s data from a trained model so that the resulting model approximates one trained without that client. In the literature, this objective is usually tied to the “right to be forgotten,” but it is also motivated by poisoning removal, correction of mislabeled or low-quality sources, and governance over institutional participation (Halimi et al., 2022). Across horizontal FL, split learning, vertical FL, federated graph learning, low-altitude wireless networks, and decentralized FL, the common requirement is that a departed client’s historical contribution should no longer affect predictions, ideally in a way that is close to retraining from scratch on the remaining participants (Xu et al., 31 Mar 2026, Chen et al., 10 Jun 2026, Varshney et al., 23 Jan 2025, Wu et al., 10 Jan 2026).

1. Formalization and scope

In the standard federated setting used by several works, the server broadcasts a global model $w_t$, clients compute local updates $v_{t+1}^{(i)}$, and aggregation yields

$$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$

If a subset of clients later requests deletion, federated unlearning requires the new model to be statistically equivalent to training only on the remaining clients $U_{\text{nor}} = U \setminus U_{\text{unl}}$, for example

$$w_{t+1}^{\text{(unl)}} = w_t + \frac{1}{|U_{\text{nor}}|} \sum_{u_i \in U_{\text{nor}}} v_{t+1}^{(i)}.$$

VerFU makes this formulation explicit and defines each device’s historical contribution as $cv_i = \sum_t v_t^{(i)}$, so client unlearning becomes removal of $cv_i$ from the trained model state (Xu et al., 31 Mar 2026).

Several papers stress that client unlearning is the strongest federated deletion granularity because the target is not a class or a few samples but all data owned by one client, often under non-IID conditions (Chundawat et al., 2024). In classical FedAvg-style FL, each client update affects a single monolithic parameter vector, so the final model contains no explicit record of “which weights belong to which client.” Fed-FBD states this directly: in FedAvg, FedProx, FedNova, and SCAFFOLD, every client’s gradient touches every parameter, which means unlearning typically requires retraining from scratch or expensive approximate procedures such as checkpoint management, partial retraining, or gradient editing (Chen et al., 10 Jun 2026).

A more formal version appears in decentralized FL. There, certified unlearning is defined by indistinguishability between the distribution of models produced by an unlearning algorithm and the distribution of models produced by retraining on the retained data. The DFL formulation expresses this as decentralized $(\epsilon,\delta)$-unlearning over the full tuple of local models rather than a single centralized model (Wu et al., 10 Jan 2026).

2. Methodological families

The literature represented here suggests several recurring designs for client unlearning.

Family	Core mechanism	Representative papers
Retraining and rollback	Rebuild a model without the target client, fully or partially	(Halimi et al., 2022, Wu et al., 2022)
Contribution editing	Modify parameters using stored client contributions, subspaces, or dampening	(Chundawat et al., 2024, Li et al., 2023, Pan et al., 2024, Huynh et al., 2024)
Architectural isolation	Encode client influence into separate blocks, slices, colors, or auxiliary modules	(Chen et al., 10 Jun 2026, Yu et al., 2023, Gu et al., 2024, Varshney et al., 23 Jan 2025, Ai et al., 4 Aug 2025)
Cryptographic or certified FU	Make unlearning verifiable, enforced, or formally certified	(Xu et al., 31 Mar 2026, Mohammadi et al., 11 Aug 2025, Liu et al., 2024, Wu et al., 10 Jan 2026)

Retraining remains the gold standard because it directly approximates the ideal “as if the client never participated” semantics, but it is repeatedly described as impractical in FL because it requires the remaining clients to participate again and often presumes that original data are still available (Halimi et al., 2022). FedEraser (Liu et al., 2021), SISA-style unlearning (Bourtoule et al., 2021), and related checkpoint-based methods are standard reference points, but they scale with training duration or require stored histories and client-side recomputation (Chen et al., 10 Jun 2026, Yu et al., 2023).

A second family edits the trained model directly. ConDa tracks each client’s average gradient contribution and applies selective synaptic dampening to parameters strongly influenced by the forget client, without retraining or data access at unlearning time (Chundawat et al., 2024). SFU constructs an input-gradient subspace from the remaining clients and performs gradient ascent on the target client in the orthogonal complement of that subspace, thereby attempting to degrade the target client’s contribution while minimally perturbing the others (Li et al., 2023). FedOSD replaces unstable gradient ascent with an unlearning cross-entropy objective optimized by orthogonal steepest descent, explicitly mitigating gradient conflicts and the tendency of post-training to revert toward the pre-unlearning model (Pan et al., 2024). Fast-FedUL similarly removes the target client’s influence round by round without retraining and provides a theoretical upper bound between the unlearned model and the exact retrained model (Huynh et al., 2024).

A third family bakes unlearning into model structure or orchestration. These methods treat client influence as an architectural property rather than a post hoc correction. Fed-FBD does this with block ownership and contributor traces (Chen et al., 10 Jun 2026); SplitWiper does it with SISA in split learning (Yu et al., 2023); FedAU attaches a lightweight auxiliary unlearning module during training and then performs a linear operation at unlearning time (Gu et al., 2024); VFU-KD and VFU-GA do the analogous thing in VFL using stored embeddings (Varshney et al., 23 Jan 2025); PAGE in federated graph learning uses adversarial graph generation and negative knowledge distillation to erase cross-client knowledge permeation (Ai et al., 4 Aug 2025).

3. Architectural isolation and surgical unlearning

Fed-FBD is the clearest architectural account of client unlearning in cross-silo FL. It decomposes a ResNet-18 backbone into six functional blocks—the stem, four residual groups, and the classification head—and maintains a warehouse of $N$ color variants, each assembled from independently tracked block tensors with unique hash IDs and contributor stamps (Chen et al., 10 Jun 2026). The shipping plan restricts each client to a known subset of colors, and the server performs store_weights as full tensor replacement rather than averaging. This means a client excluded from a block-color pair can never influence that block.

That design yields a direct unlearning mechanism. If client $c$ requests deletion, the server scans all block traces, marks every block whose trace contains $v_{t+1}^{(i)}$0 as tainted, computes a replacement tensor for each block position by averaging the clean blocks untouched by $v_{t+1}^{(i)}$1, and replaces every tainted block with that clean aggregate (Chen et al., 10 Jun 2026). Fed-FBD distinguishes exclusively owned blocks, for which it claims exact unlearning, from co-owned blocks, for which it uses aggregate replacement as a constant-time approximate unlearning procedure. In the reported experiments on BloodMNIST, PneumoniaMNIST, and PathMNIST, average $v_{t+1}^{(i)}$2AUC after unlearning one client was $v_{t+1}^{(i)}$3, approximately $v_{t+1}^{(i)}$4, and $v_{t+1}^{(i)}$5, worst-case $v_{t+1}^{(i)}$6AUC stayed below $v_{t+1}^{(i)}$7 AUC, and the operation completed in under 1 second (Chen et al., 10 Jun 2026).

SplitWiper applies a related idea to split learning rather than horizontal FL. It treats client datasets as SISA shards and replaces standard bidirectional split-learning training with a one-way-one-off propagation scheme: clients locally train and freeze their client-side models, send intermediate activations once, and the server trains on cached activations without repeated client interaction (Yu et al., 2023). For unlearning, only the requesting client retrains its local shard and refreshes its cached activations; all other clients remain untouched. The abstract reports 0% accuracy for unlearned labels, 8% better accuracy for retained labels than non-SISA unlearning in split learning, 99% lower computational and communication costs, and 90% label privacy in SplitWiper+ (Yu et al., 2023).

FedAU moves the same principle into horizontal FL by adding an auxiliary unlearning module during training and then performing a linear operation at unlearning time (Gu et al., 2024). It supports sample-, class-, and client-level unlearning, as well as concurrent unlearning requests from multiple clients. VFU-KD and VFU-GA extend the idea to VFL: VFU-KD uses knowledge distillation to unlearn clients and features by compressing away the removed party or features, while VFU-GA uses gradient ascent for sample unlearning; both avoid communication between active and passive parties during unlearning, but require the active party to store previously communicated embeddings (Varshney et al., 23 Jan 2025).

In federated graph learning, PAGE treats client unlearning as a two-stage problem: the removed client itself is reset to a random-initialized “no-knowledge” model, and adversarial graph generation plus negative knowledge distillation are used to purge the removed client’s residual influence from the remaining clients (Ai et al., 4 Aug 2025). This explicitly targets cross-client knowledge permeation, which is particularly acute in graph domains.

4. Verification, privacy, and enforcement

A separate line of work argues that deleting influence is not sufficient unless clients can verify or enforce it. VerFU addresses this in low-altitude wireless networks with UAV-assisted servers and mobile ISAC devices (Xu et al., 31 Mar 2026). It combines Paillier homomorphic encryption, a linear homomorphic hash, and commitment schemes so that unlearning devices can verify that the server actually subtracted their cumulative historical contribution $v_{t+1}^{(i)}$8, without using original training data. The protocol supports parallel unlearning requests, and the reported verification-specific communication is under 1 KB per device even at 40% unlearning rate, with verification latency around 11.53–12.06 seconds across MNIST, Fashion-MNIST, and EMNIST (Xu et al., 31 Mar 2026).

EFU pushes this further by hiding even the fact that unlearning is happening. It wraps arbitrary client-side FU algorithms inside a functional-encryption layer based on DMCFE, so the server can decrypt only the prescribed aggregation function and cannot distinguish learning updates from unlearning updates (Mohammadi et al., 11 Aug 2025). The paper states two core guarantees: decryption enforces complete aggregation of all clients’ ciphertexts for the round label, and update-type indistinguishability makes the server’s advantage in telling “learn” from “unlearn” negligible. Empirically, EFU reports near-random accuracy on forgotten data while maintaining retained-task performance comparable to full retraining (Mohammadi et al., 11 Aug 2025).

Starfish addresses the privacy problem created by keeping historical updates for FU. Its solution is to split those updates between two non-colluding servers and run secure two-party computation over the shares, so historical gradients and model deltas required by FU are never visible in plaintext to any single party (Liu et al., 2024). It then derives a theoretical bound on the difference between the Starfish-unlearned model and the retrained model, which the paper presents as certified client removal.

Certified decentralized unlearning adds yet another perspective. In DFL, the deleted client’s influence diffuses through the mixing graph, so every local model contains part of that influence. The Newton-style certified DFL method quantifies that propagation, constructs corrective updates using Hessian or Fisher information, perturbs those corrections with calibrated Gaussian noise, and broadcasts them through the network, proving decentralized $v_{t+1}^{(i)}$9-unlearning for the tuple of local models (Wu et al., 10 Jan 2026).

Privacy-by-design also appears without cryptography. Fed-FBD reports that its membership-inference advantage $$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$0 is at most 0.005 before and after unlearning, even without DP noise or secure aggregation, because each block is exposed only to a limited client subset and colors are regularized by a KL consistency term (Chen et al., 10 Jun 2026). This does not make the framework verifiable in the cryptographic sense, but it changes the privacy role of unlearning: unlearning becomes more about governance and adversarial mitigation than about rescuing a privacy failure after the fact.

5. Evaluation criteria and empirical trade-offs

Client-unlearning papers rely on a remarkably consistent evaluation pattern. The usual reference point is retraining from scratch on the retained clients. Utility is then measured on retained data by quantities such as R-Set accuracy, Rm-Acc, AUC, or F1; forgetting is measured on the removed client or removed class by U-Set accuracy, Ul-Acc, attack success rate, or $$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$1; privacy is frequently audited by membership inference; and efficiency is reported in wall-clock time, communication, or extra rounds (Chundawat et al., 2024, Shen et al., 26 May 2026).

ConDa illustrates the contribution-editing style of evaluation particularly clearly. On MNIST, CIFAR-10, and CIFAR-100, it reports R-Set/U-Set accuracy close to retraining and reduces membership inference accuracy from about 95% to around 50% on the forget client’s data, which is essentially chance. It also reports that ConDa is the fastest federated unlearning method, outperforming the nearest state-of-the-art approach by at least 100x, and on CIFAR-10 with ResNet-18 it is approximately 5,882× faster than PGA, 3,584× faster than FedEraser, and 43,408× faster than NegGrad (Chundawat et al., 2024).

Fed-FBD’s trade-off is different: it pays a modest accuracy gap for stronger isolation guarantees. On adequately sized IID datasets it reports an ensemble-vs-FedAvg AUC gap of 0.3–3.1 percentage points, while still confining all six studied adversarial attacks to the poisoned client’s own blocks, with clean colors drifting by no more than $$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$2 AUC (Chen et al., 10 Jun 2026). Under mild non-IID heterogeneity ($$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$3), it remains within 0.8–4.0 percentage points of FedAvg on three of four datasets, but under stronger skew it can collapse, revealing a clear dependence on the product of per-client data size and heterogeneity (Chen et al., 10 Jun 2026).

Fast-FedUL emphasizes runtime and theoretical skew resilience. The paper states that it is 1000 times faster than retraining and retains main-task accuracy up to 98% in backdoor scenarios while effectively removing traces of the target client (Huynh et al., 2024). SplitWiper emphasizes communication and system overhead instead: its one-way-one-off scheme is reported to maintain constant overhead and reduce computational and communication costs by 99% (Yu et al., 2023).

IFF-FCU contributes a different evaluation lens centered on the retrained gold standard. Rather than maximizing forget-set error, it measures deviation of the forget-set error from retraining, denoted $$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$4 deviation. On RSNA-ICH, IFF-FCU reports $$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$5 deviation from the retrained gold standard; on ISIC2018, $$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$6 (Shen et al., 26 May 2026). That framing is important because several methods that “forget harder” actually over-forget: MoDe and UPGA show large positive $$w_{t+1} = w_t + \frac{1}{N}\sum_{u_i \in U} v_{t+1}^{(i)}.$$7 deviations together with serious global fidelity loss on ISIC2018 (Shen et al., 26 May 2026).

VerFU shows that cryptographic verifiability need not destroy utility: with 500 devices, 20 participants per round, 100 rounds, and unlearning rates up to 40%, the maximum observed accuracy drop after unlearning is approximately 1.3%, the maximum loss increase is approximately 0.044, and the model typically recovers to pre-unlearning accuracy within 2–4 rounds (Xu et al., 31 Mar 2026).

6. Limitations and unresolved questions

Despite rapid progress, exactness remains the central unresolved issue. Fed-FBD explicitly states that strict exact unlearning is guaranteed only for exclusively owned blocks; co-owned blocks use aggregate replacement that is empirically close to retraining but “not cryptographically exact” (Chen et al., 10 Jun 2026). ConDa, FedOSD, Fast-FedUL, and related update-editing methods provide practical or bounded approximations rather than exact retraining equivalence, and secure aggregation can make their required per-client updates inaccessible in the first place (Chundawat et al., 2024, Pan et al., 2024).

A second recurring issue is the tension between unlearning and observability. Many effective methods need additional state: ConDa stores one average gradient vector per client (Chundawat et al., 2024); Wu et al.’s knowledge-distillation FU stores historical updates for every client and round (Wu et al., 2022); Starfish protects exactly this type of history because plaintext storage is privacy-sensitive (Liu et al., 2024); VFU-KD and VFU-GA require the active party to store embeddings communicated during VFL training (Varshney et al., 23 Jan 2025). This suggests that “easy unlearning later” often means “more state retained now,” which can conflict with privacy-minimization principles.

A third issue is robustness outside the training regime in which a method was designed. Fed-FBD is currently tied to a six-block ResNet-18 design and degrades under severe non-IID skew with small per-client datasets (Chen et al., 10 Jun 2026). SplitWiper’s strongest quantitative claims are given for split learning rather than FL, and its storage of cached activations may itself become a systems bottleneck at scale (Yu et al., 2023). PAGE notes the computational cost of adversarial graph generation and the absence of formal certification (Ai et al., 4 Aug 2025). The certified DFL framework rests on strong-convexity-style assumptions and Fisher approximations that are analytically clean but leave open how far the guarantees transfer to large non-convex models (Wu et al., 10 Jan 2026).

Finally, verification and enforcement are still partial. VerFU assumes honest devices and an untrusted server in a specific LAWN setting (Xu et al., 31 Mar 2026). EFU assumes trusted clients that correctly generate keys and an honest-but-curious server (Mohammadi et al., 11 Aug 2025). Starfish assumes two non-colluding servers (Liu et al., 2024). These are meaningful advances, but they indicate that client unlearning is increasingly a systems-and-cryptography problem as much as an optimization problem.

Taken together, the literature suggests that client unlearning has moved from being a narrow “remove one client’s gradients” procedure to a broader design space spanning architectural isolation, contribution editing, verifiable cryptographic execution, and certified decentralized correction. The main open problem is no longer whether client unlearning is possible, but under which structural, statistical, and trust assumptions it can be made exact, efficient, and auditable at once (Chen et al., 10 Jun 2026, Xu et al., 31 Mar 2026, Wu et al., 10 Jan 2026).