Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning
cs.CR · cs.LG
Quick verdict
Shows additive-summary federated unlearning broadcasts leak deleted data via active probing; rigorous theory and simulations, but evidence is simulator-only.
Summary
This paper presents an active client-side attack on federated unlearning systems that store additive sufficient statistics (a feature Gram matrix and a feature-label moment) for ridge classifiers over frozen feature extractors, and broadcast the full updated head after every accepted change. Because the state-to-head map is many-to-one, passive observation is insufficient; Theorem 1 proves that submitted probes identify the hidden state exactly if and only if the collected perturbations span the feature space, with an optimal construction needing ⌈d/c⌉ logical responses (52 for d=512, c=10). Comparing identified states immediately before and after one isolated deletion recovers the deleted sample, class, or client aggregate and enables replay that reverses the deletion. A more realistic estimator builds additions from the attacker's own examples. On MNIST and CIFAR-10 with frozen ResNet-18 features (plus a DINOv2 check), all 2,220 float64 designed-probe attacks succeed with exact label recovery; attacker-data additions at 104 responses recover 500/500 sample labels. Float32 broadcasts cut sample-label recovery to 49/500 (MNIST) and 183/500 (CIFAR-10) while class aggregates remain relatively accurate. Unrestricted probes are detectable by size, but most individual attacker additions pass a norm detector. Main limitations: the evaluation is entirely simulator-based, rests on quiet intervals, duplicate acceptance, absent ownership checks, fixed gamma, and a known isolated deletion; the attacker-data experiments reuse records already in the ledger, with held-out data left to future work.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A malicious client in additive-summary federated unlearning can exactly identify the hidden server state from full-head broadcasts if and only if its collected probe perturbations span the d-dimensional feature space, requiring at least ⌈d/c⌉ logical responses (52 for d=512, c=10).
- Comparing states identified immediately before and after one isolated deletion recovers the deleted sample, class, or client aggregate exactly, and replaying that aggregate reverses the deletion (e.g., class-deletion replay restores MNIST accuracy from 9.82% to 97.15%).
- With float64 broadcasts every tested sample deletion yields exact label recovery (2,220/2,220 designed-probe attacks; 500/500 with attacker-data additions at 104 responses), while float32 cuts sample-label recovery to 49/500 (MNIST) and 183/500 (CIFAR-10) without equally protecting class aggregates.
- Unrestricted probes are readily detected by message size (2.98x10^5 times the honest 99th percentile at tau=10^4), whereas most individual attacker-data additions pass a calibrated norm detector (median ratios 0.818-0.845).
Strengths
Exact identifiability theory with matching optimal construction
Theorem 1 gives an if-and-only-if condition (rank(Q)=d) with necessity proved by constructing an indistinguishable perturbed state (Eq. 14), and Corollary 1 achieves the ⌈d/c⌉ lower bound (52 responses for d=512, c=10). Table 1 confirms the sharp threshold empirically: random probes fail 0/5 at m=51 (rank 510) and succeed 5/5 at m=52 on both datasets.
Finite-precision analysis validated against data, not just asserted
Propositions 1-3 derive error bounds (Eqs. 17, 24, 43, 52), and Figure 1 checks the deleted-Gram bound run-by-run across 2,200 attacker-data attacks: median measured/bound ratio 0.69, maximum 0.998, zero violations, spanning float64/float32 and sample/class deletions.
Unusual candor in scoping and failure reporting
Architecture-level robustness and defense-relevant measurements
Concrete replay integrity consequences
Weaknesses
Simulation-only evaluation with an assumed quiet interval
The realistic channel still relies on duplicate resubmission
Defense evaluation is narrow relative to the attack analysis
Single operating points for several key parameters
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper attacks a specific but increasingly relevant federated unlearning (FU) design: clients exchange additive sufficient statistics (feature Gram matrix S in R^(dxd), feature-label moment G in R^(dxc)) computed on a frozen encoder, and the server maintains a ledger and broadcasts the full ridge head W = (S+gamma*I)^-1 G after every accepted add/delete (Sec. 2, Eqs. 1-6). The authors claim three results: (1) an active client identifies the hidden state exactly iff probe perturbations span the feature space (Theorem 1, rank(Q)=d), with an optimal ceil(d/c)-response construction (Corollary 1; 52 logical responses for d=512, c=10); (2) differencing states identified immediately before and after one isolated deletion recovers the deleted sample/class/client aggregate and enables replay; (3) a more realistic estimator uses additions from attacker-owned examples (Sec. 5). Claims are carefully scoped: the paper explicitly disclaims sequence-level stealth and notes the necessity proof covers an algebraic state class, not necessarily dataset-realizable states.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What federated unlearning systems does this attack target?
It targets exact federated unlearning designs where clients send additive summaries - a feature Gram matrix and a feature-label matrix computed on a shared frozen encoder - and the server broadcasts the complete updated ridge classifier after every accepted change, matching the exact federated continual unlearning protocol of Quan et al. Systems that verify ownership, reject duplicates, batch broadcasts, or release only partial classifiers fall outside the evaluated attack surface.
Can a deleted training sample's label really be recovered exactly?
In this paper's float64 simulations on MNIST and CIFAR-10 with frozen ResNet-18 features, yes: every tested sample deletion had its label recovered exactly (100/100 per dataset with designed probes; 500/500 with attacker-data additions using 104 responses per state). With float32 broadcasts, recovery drops to 49/500 on MNIST and 183/500 on CIFAR-10, so broadcast precision is decisive for sample-level leakage.
How can servers defend against this probing attack?
The paper points to ownership verification, duplicate rejection, and replay authentication, which would block the evaluated fabricated and duplicate probes, plus releasing fewer or batched broadcasts, partial classifiers, or added noise. Lower float32 precision helps selectively but is not a uniform safeguard: class-level aggregates remain recoverable, and designed probes still recover 92/100 MNIST labels under float32.
Was the attack demonstrated on a real federated system?
No. All experiments use a simulated server that maintains the summary ledger in float64 on MNIST and CIFAR-10. The attack additionally assumes a quiet interval with no concurrent updates, an isolated deletion of known size, and a server that accepts duplicate submissions and does not verify record ownership - conditions the authors state explicitly and leave partially to future work.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are image content not present in the text extraction; the qualitative decoder and latent-diffusion outputs (Figs. 2-3) could only be assessed from their captions and surrounding text.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.