发表机构
University of Warwick（华威大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究揭示联邦遗忘系统的广播可泄露删除的样本信息，提出探测方法并在MNIST、CIFAR-10上验证，明确了相关隐私风险及实际限制。
AI 中文摘要
联邦遗忘旨在从共享模型中移除某客户端的数据，而无需从头开始重新训练。一些高效系统通过存储训练特征的紧凑加法摘要，并在每次接受变更后广播更新后的线性分类器，以实现精确删除。我们表明，这些广播还可能泄露隐藏的摘要：恶意客户端可提交已知变更，利用返回的分类器识别服务器状态，并比较孤立删除前后的状态，这会暴露被删除的样本、类别或客户端摘要，甚至可能实现其重新插入。我们精确刻画了观测值包含足够独立信息的条件，为无限制探测给出了匹配的最优构造，并基于攻击者自身数据形成的加法推导了更现实的估计器。在MNIST和CIFAR-10数据集上，高精度广播允许两种探测类型对所有测试的样本删除实现精确标签恢复；低精度广播会大幅降低细粒度恢复能力，而多样性不足的响应则会完全阻止识别。无限制探测易因规模被检测到，大多数单个攻击者数据的加法与诚实批次相似，但我们不声称完整序列不显眼。研究结果明确了具体的隐私与完整性风险、其代数成因，以及涉及广播精度、更新验证、响应率和并发活动的实际限制。
英文摘要
Federated unlearning aims to remove a client's data from a shared model without retraining from scratch. Some efficient systems make deletion exact by storing compact, additive summaries of the training features and broadcasting an updated linear classifier after every accepted change. We show that these broadcasts can also reveal the hidden summaries. A malicious client can submit known changes, use the returned classifiers to identify the server state, and compare states immediately before and after an isolated deletion. This exposes the deleted sample, class, or client summary and can enable its reinsertion. We characterize exactly when the observations contain enough independent information, give a matching optimal construction for unrestricted probes, and derive a more realistic estimator based on additions formed from the attacker's own data. On MNIST and CIFAR-10, high-precision broadcasts permit exact label recovery for every tested sample deletion with both probe types. Lower-precision broadcasts sharply reduce fine-grained recovery, and insufficiently diverse responses prevent identification altogether. Unrestricted probes are readily detected by their size; most individual attacker-data additions resemble honest batches, although we do not claim that the complete sequence is inconspicuous. The results identify a concrete privacy and integrity risk, its algebraic cause, and practical limits involving broadcast precision, update verification, response rate, and concurrent activity.
