FedUP: One-Shot Federated Unlearning

• FedUP is a one-shot federated unlearning framework that inserts a plug-in filter between a frozen feature extractor and classifier to selectively erase client data influence.
• It leverages centroid-guided training with differentially private summaries, allowing efficient adaptation of the unlearning module while maintaining performance on retained data.
• FedUP dramatically reduces unlearning latency and communication costs compared to retraining, offering reversible functional forgetting in decentralized learning settings.

Searching arXiv for the specified FedUP paper and closely related federated unlearning work to ground the article. FedUP is a one-shot federated unlearning framework for decentralized models trained by federated learning, introduced in “FedUP: One-Shot Federated Unlearning via Centroid-Guided Plug-in Filters” (Nan et al., 23 Jun 2026). It addresses the problem of making a trained global model forget specific clients, samples, or classes while preserving performance on retained data, reducing request latency, and avoiding irreversible modification of the base model. Its defining mechanism is a lightweight plug-in filter placed between a frozen feature extractor and classifier and trained at the server using differentially private class centroid samples uploaded once by clients. In the reported image and text experiments, this design reduces unlearning latency from minutes to seconds, keeps retained accuracy close to retraining, and makes the unlearned state reversible by removing the filter (Nan et al., 23 Jun 2026).

1. Problem formulation and motivation

FedUP is situated in the standard federated learning setting with clients $\mathcal{C}=\{C_1,\dots,C_N\}$, local datasets $\mathcal{D}_n$, and a global model $\mathcal{M}_G$ trained by FedAvg. In this setting, the global model implicitly absorbs information from all clients and their data. Federated unlearning is the problem of modifying the deployed model so that it no longer retains or exploits designated information, typically after deletion requests driven by legal mandates such as GDPR’s “Right to be Forgotten” and CCPA (Nan et al., 23 Jun 2026).

The paper formalizes each client’s data as a retained subset $\mathcal{D}_n^R$ and an unlearning subset $\mathcal{D}_n^U$. The unlearning objective is threefold: preserve performance on $\mathcal{D}^R=\bigcup_n \mathcal{D}_n^R$, degrade performance on $\mathcal{D}^U$, and keep communication and computation cost low. In this framing, federated unlearning is not only a privacy or compliance task; it is also a multi-objective optimization problem balancing retained utility, forgetting efficacy, and systems cost (Nan et al., 23 Jun 2026).

FedUP is motivated by limitations in two established FU paradigms. Server-side approximate methods such as FedEraser operate directly on the global model and avoid client retraining, but they often lose non-target knowledge and have limited control over the exact scope of forgetting. Client-side exact methods such as FUSED and BFU more closely approximate full retraining, but they require multiple communication rounds and local retraining, which yields high latency, high communication cost, and high energy cost. Both paradigms also modify the base model’s parameters, so recovering the original knowledge requires further retraining; in that sense, the unlearning state is effectively irreversible (Nan et al., 23 Jun 2026).

2. Architectural design and one-shot unlearning

FedUP decomposes the trained global model into a feature extractor and classifier,

$$\mathcal{M}_G = \mathcal{M}_E \oplus \mathcal{M}_{cl},$$

and constructs an unlearning-compliant model by inserting a plug-in filter,

$$\mathcal{M}_G' = \mathcal{M}_E \oplus \mathcal{M}_{Fi} \oplus \mathcal{M}_{cl}.$$

The original parameters of $\mathcal{M}_E$ and $\mathcal{D}_n$0 are frozen, and only the filter $\mathcal{D}_n$1 is trained (Nan et al., 23 Jun 2026).

The paper characterizes the filter as a lightweight encoder–decoder-style module, typically implemented as a small bottleneck MLP. Its input dimension matches the feature dimension of $\mathcal{D}_n$2, its output dimension matches the classifier input, and a bottleneck such as a 32-dimensional latent space compresses and reshapes information. Conceptually, the filter acts as a “knowledge funnel”: for retained knowledge it should approximate an identity map, while for forgotten knowledge it should distort the representation so that the fixed classifier performs poorly (Nan et al., 23 Jun 2026).

The term “one-shot” refers to the fact that no multi-round federated retraining is performed. Clients participate only in one short phase in which they compute and upload compact, differentially private centroid samples derived from retained data. The server then trains the filter for a small number of rounds using only these centroids. Because the base model is frozen and the optimization target is only the adapter-like filter, unlearning is substantially cheaper than retraining a deep CNN or Transformer end to end (Nan et al., 23 Jun 2026).

This design changes the semantics of unlearning. In FedUP, forgetting is implemented by interposing a learned transformation between a preserved backbone and a preserved classifier, not by overwriting the backbone itself. The practical consequence is that the original global model remains intact beneath the unlearning layer.

3. Centroid-guided training and differential privacy

FedUP’s training signal is built from class centroids computed in the frozen feature space. After federated training, each client uses the extractor $\mathcal{D}_n$3 to embed its local data by class. When an unlearning request arrives, embeddings corresponding to the unlearning subset are removed, leaving only retained features for each class. These retained features are compressed by KMeans into class centroid samples, with the number of centroids per client and class determined by

$\mathcal{D}_n$4

where $\mathcal{D}_n$5 is a sampling ratio that varies by scenario, with examples including $\mathcal{D}_n$6, $\mathcal{D}_n$7, and $\mathcal{D}_n$8 (Nan et al., 23 Jun 2026).

The server aggregates the uploaded client centroids into global centroid samples for each retained class. These centroids form a compact server-side training set for the filter. The paper reports that training on centroids rather than full features yields comparable performance, which supports the use of centroid compression as a communication-efficient proxy for retained data structure (Nan et al., 23 Jun 2026).

Privacy protection is applied before upload. Each centroid is perturbed with Gaussian noise, and the paper analyzes the mechanism under $\mathcal{D}_n$9-DP using the $\mathcal{M}_G$0 sensitivity of the client-side centroid computation. With reasonable noise levels such as $\mathcal{M}_G$1 to $\mathcal{M}_G$2, the reported average privacy budget is around $\mathcal{M}_G$3, and the ablations show that DP training retains nearly identical retained accuracy while reducing membership inference attack success relative to the non-DP variant (Nan et al., 23 Jun 2026).

The filter is trained with a joint objective combining classification and reconstruction: $\mathcal{M}_G$4 Cross-entropy preserves discriminative power on retained classes, while reconstruction keeps the transformed centroid close to its input and reduces excessive distortion of non-target features. The reported best trade-off is obtained at $\mathcal{M}_G$5; using only cross-entropy or only reconstruction harms either retained accuracy or forgetting efficacy (Nan et al., 23 Jun 2026).

4. Federated protocol, inference behavior, and reversibility

FedUP is a post-hoc FU mechanism layered on top of standard federated training rather than a replacement for FedAvg. The workflow is: train the global model normally; freeze the global model and deploy it to clients; upon an unlearning request, clients compute retained feature centroids, apply DP noise, and upload the centroids; the server trains the filter using only these centroids; then the server deploys the augmented model $\mathcal{M}_G$6 for inference (Nan et al., 23 Jun 2026).

The paper evaluates this protocol in standard cross-device and cross-silo FL with non-IID Dirichlet sampling at $\mathcal{M}_G$7. The underlying global architectures include LeNet-5, ResNet-18, ResNet-34, Transformer, and TinyBERT. Because FedUP only requires that the trained model expose a feature extractor and classifier decomposition, it is intended to sit on top of existing FL training pipelines without changing the original federated optimization algorithm (Nan et al., 23 Jun 2026).

At inference time, an input $\mathcal{M}_G$8 is mapped by the frozen extractor to features $\mathcal{M}_G$9, transformed by the filter to $\mathcal{D}_n^R$0, and classified by the frozen classifier. Since the filter has been trained only on DP-protected centroids from retained data, retained feature patterns are mapped into regions compatible with the fixed classifier, whereas forgotten patterns are not. The reported effect is low “F-A” accuracy on forgotten data and retained performance close to retraining on retained data (Nan et al., 23 Jun 2026).

Reversibility is an explicit architectural property. Before unlearning, the serving model is $\mathcal{D}_n^R$1; after unlearning, it is $\mathcal{D}_n^R$2; restoring the forgotten knowledge is implemented by removing the filter. The paper simultaneously identifies a central caveat: this is architectural reversibility, not parameter-level erasure. The base extractor and classifier still internally encode the original knowledge, so FedUP provides functional forgetting rather than physical deletion of influence from the base model parameters (Nan et al., 23 Jun 2026).

5. Experimental evaluation

FedUP is evaluated on image and text tasks using MNIST, CIFAR-10, CIFAR-100, and AG News, with LeNet-5 for MNIST, ResNet-18 and Transformer for CIFAR-10, ResNet-34 for CIFAR-100, and TinyBERT for AG News. The experiments cover three unlearning scenarios: client unlearning, including Byzantine label-flipping settings; class unlearning, implemented by remapping labels of a target class; and sample unlearning, instantiated as backdoor removal where triggered samples are forced toward class $\mathcal{D}_n^R$3 before unlearning (Nan et al., 23 Jun 2026).

The comparison set includes EraseClient, FedEraser, Exact-Fun, Retrain, and FUSED. The metrics are retained accuracy (R-A), forgotten accuracy (F-A), class-$\mathcal{D}_n^R$4 accuracy (0A), precision for class $\mathcal{D}_n^R$5 (PS), membership inference attack success (MIA), latency in seconds, and communication cost in megabytes. Across datasets and scenarios, the paper reports that FedUP keeps R-A equal or near-best, often close to Retrain, while pushing F-A to near zero. In the reported range, forgotten accuracy after unlearning falls between $\mathcal{D}_n^R$6 and $\mathcal{D}_n^R$7, with especially strong results in class unlearning where F-A is consistently $\mathcal{D}_n^R$8 with high R-A (Nan et al., 23 Jun 2026).

An illustrative retained-accuracy example is CIFAR-10 with ResNet-18 in client unlearning, where Retrain achieves R-A $\mathcal{D}_n^R$9 and FedUP achieves R-A $\mathcal{D}_n^U$0. The paper further states that non-target knowledge loss is almost as small as full retraining, as measured by the retained-accuracy difference before and after unlearning (Nan et al., 23 Jun 2026).

Latency and communication are central empirical claims.

Setting	Method	Time / Comm
CIFAR-10 client unlearning	Retrain	935.54 s / 1538.25 MB
CIFAR-10 client unlearning	FUSED	151.21 s / 31.36 MB
CIFAR-10 client unlearning	FedUP	6.33 s / 11.50 MB
AG News	Retrain	859.28 s / 537.28 MB
AG News	FUSED	88.31 s / 0.55 MB
AG News	FedUP	6.45 s / 6.73 MB

These measurements support the paper’s summary that FedUP reduces FU latency from hundreds of seconds to about $\mathcal{D}_n^U$1 seconds per task, with latency less than $\mathcal{D}_n^U$2 of the second-best method and less than $\mathcal{D}_n^U$3 of Retrain (Nan et al., 23 Jun 2026).

The ablations clarify the design choices. A bottleneck dimension of $\mathcal{D}_n^U$4 gives the best retained accuracy on both image and text tasks; larger bottlenecks do not help much and consume more memory. The joint loss with $\mathcal{D}_n^U$5 gives the best balance between R-A and F-A. DP-protected training preserves retained accuracy while slightly increasing F-A in some cases and significantly lowering MIA. Training on centroids versus raw features yields comparable performance, which validates the centroid-based compression strategy (Nan et al., 23 Jun 2026).

6. Relations, limitations, and open directions

Within the federated unlearning literature, FedUP occupies a specific position. Relative to server-side approximate FU such as FedEraser, it remains server-side but avoids direct modification of the base model and uses filter-only training guided by retained centroids, which the paper associates with better preservation of non-target performance and built-in reversibility. Relative to client-side exact FU such as Retrain, BFU, or FUSED, it is not exact in the formal retraining-equivalence sense, but it attains similar practical forgetting behavior at much lower cost and latency (Nan et al., 23 Jun 2026). A distinct exact-unlearning line is represented by FedUHB, which accelerates retraining on the remaining clients with the Polyak heavy ball method rather than avoiding retraining through adapters (Jiang et al., 2024). A distinct privacy-preserving historical-update line is represented by FedADP, which combines adaptive differential privacy, selective history storage, and gradient calibration (Jiang et al., 2024).

The paper presents four distinctive contributions: one-shot unlearning with a single centroid-upload phase; centroid-guided filters trained from DP-protected retained summaries; a pluggable and reversible architecture; and explicit $\mathcal{D}_n^U$6-DP analysis for the uploaded centroids (Nan et al., 23 Jun 2026). These points define FedUP as an architectural rather than retraining-based approach to FU.

Its limitations are equally explicit. Centroid quality depends on the learned feature extractor, so poor global representations yield poor centroids and weaker unlearning. The framework provides approximate, functional forgetting rather than parameter-level purging, which means strict legal interpretations may still prefer full retraining. The filter can only partially compensate for defects already present in the backbone, such as bias or poisoning (Nan et al., 23 Jun 2026).

The paper identifies several open directions: stronger backbones to improve centroid fidelity, extension to very large models, stronger theoretical guarantees on residual influence, application to graph learning, recommendation, and multimodal FL, and deeper study of how reversible filter-based forgetting aligns with legal definitions of deletion (Nan et al., 23 Jun 2026). It is also useful to distinguish this method from other similarly named works. “FedUP” has also been used for a pruning-based federated unlearning algorithm aimed at removing malicious clients’ influence in model poisoning settings (Romandini et al., 19 Aug 2025), while similarly spelled acronyms such as FedUCA and FedPU refer to rational-participation-aware aggregation (Yashwanth et al., 18 May 2026) and federated learning with positive and unlabeled data (Lin et al., 2021), respectively.