Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated Unlearning Article Swipe
Fuyao Zhang
,
Yuantao Hao
,
Xinyu Yan
,
Yang Cao
,
Wei Yang Bryan Lim
·
YOU?
·
· 2025
· Open Access
·
· DOI: https://doi.org/10.48550/arxiv.2505.11097
YOU?
·
· 2025
· Open Access
·
· DOI: https://doi.org/10.48550/arxiv.2505.11097
Federated Unlearning (FU) has emerged as a critical compliance mechanism for data privacy regulations, requiring unlearned clients to provide verifiable Proof of Federated Unlearning (PoFU) to auditors upon data removal requests. However, we uncover a significant privacy vulnerability: when gradient differences are used as PoFU, honest-but-curious auditors may exploit mathematical correlations between gradient differences and forgotten samples to reconstruct the latter. Such reconstruction, if feasible, would face three key challenges: (i) restricted auditor access to client-side data, (ii) limited samples derivable from individual PoFU, and (iii) high-dimensional redundancy in gradient differences. To overcome these challenges, we propose Inverting Gradient difference to Forgotten data (IGF), a novel learning-based reconstruction attack framework that employs Singular Value Decomposition (SVD) for dimensionality reduction and feature extraction. IGF incorporates a tailored pixel-level inversion model optimized via a composite loss that captures both structural and semantic cues. This enables efficient and high-fidelity reconstruction of large-scale samples, surpassing existing methods. To counter this novel attack, we design an orthogonal obfuscation defense that preserves PoFU verification utility while preventing sensitive forgotten data reconstruction. Experiments across multiple datasets validate the effectiveness of the attack and the robustness of the defense. The code is available at https://anonymous.4open.science/r/IGF.
Related Topics
Concepts
No concepts available.
Metadata
- Type
- preprint
- Language
- en
- Landing Page
- http://arxiv.org/abs/2505.11097
- https://arxiv.org/pdf/2505.11097
- OA Status
- green
- OpenAlex ID
- https://openalex.org/W4417093560
All OpenAlex metadata
Raw OpenAlex JSON
- OpenAlex ID
-
https://openalex.org/W4417093560Canonical identifier for this work in OpenAlex
- DOI
-
https://doi.org/10.48550/arxiv.2505.11097Digital Object Identifier
- Title
-
Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated UnlearningWork title
- Type
-
preprintOpenAlex work type
- Language
-
enPrimary language
- Publication year
-
2025Year of publication
- Publication date
-
2025-05-16Full publication date if available
- Authors
-
Fuyao Zhang, Yuantao Hao, Xinyu Yan, Yang Cao, Wei Yang Bryan LimList of authors in order
- Landing page
-
https://arxiv.org/abs/2505.11097Publisher landing page
- PDF URL
-
https://arxiv.org/pdf/2505.11097Direct link to full text PDF
- Open access
-
YesWhether a free full text is available
- OA status
-
greenOpen access status per OpenAlex
- OA URL
-
https://arxiv.org/pdf/2505.11097Direct OA link when available
- Cited by
-
0Total citation count in OpenAlex
Full payload
| id | https://openalex.org/W4417093560 |
|---|---|
| doi | https://doi.org/10.48550/arxiv.2505.11097 |
| ids.doi | https://doi.org/10.48550/arxiv.2505.11097 |
| ids.openalex | https://openalex.org/W4417093560 |
| fwci | |
| type | preprint |
| title | Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated Unlearning |
| biblio.issue | |
| biblio.volume | |
| biblio.last_page | |
| biblio.first_page | |
| is_xpac | False |
| apc_list | |
| apc_paid | |
| language | en |
| locations[0].id | pmh:oai:arXiv.org:2505.11097 |
| locations[0].is_oa | True |
| locations[0].source.id | https://openalex.org/S4306400194 |
| locations[0].source.issn | |
| locations[0].source.type | repository |
| locations[0].source.is_oa | True |
| locations[0].source.issn_l | |
| locations[0].source.is_core | False |
| locations[0].source.is_in_doaj | False |
| locations[0].source.display_name | arXiv (Cornell University) |
| locations[0].source.host_organization | https://openalex.org/I205783295 |
| locations[0].source.host_organization_name | Cornell University |
| locations[0].source.host_organization_lineage | https://openalex.org/I205783295 |
| locations[0].license | |
| locations[0].pdf_url | https://arxiv.org/pdf/2505.11097 |
| locations[0].version | submittedVersion |
| locations[0].raw_type | text |
| locations[0].license_id | |
| locations[0].is_accepted | False |
| locations[0].is_published | False |
| locations[0].raw_source_name | |
| locations[0].landing_page_url | http://arxiv.org/abs/2505.11097 |
| locations[1].id | doi:10.48550/arxiv.2505.11097 |
| locations[1].is_oa | True |
| locations[1].source.id | https://openalex.org/S4306400194 |
| locations[1].source.issn | |
| locations[1].source.type | repository |
| locations[1].source.is_oa | True |
| locations[1].source.issn_l | |
| locations[1].source.is_core | False |
| locations[1].source.is_in_doaj | False |
| locations[1].source.display_name | arXiv (Cornell University) |
| locations[1].source.host_organization | https://openalex.org/I205783295 |
| locations[1].source.host_organization_name | Cornell University |
| locations[1].source.host_organization_lineage | https://openalex.org/I205783295 |
| locations[1].license | |
| locations[1].pdf_url | |
| locations[1].version | |
| locations[1].raw_type | article |
| locations[1].license_id | |
| locations[1].is_accepted | False |
| locations[1].is_published | |
| locations[1].raw_source_name | |
| locations[1].landing_page_url | https://doi.org/10.48550/arxiv.2505.11097 |
| indexed_in | arxiv, datacite |
| authorships[0].author.id | https://openalex.org/A5017382651 |
| authorships[0].author.orcid | |
| authorships[0].author.display_name | Fuyao Zhang |
| authorships[0].author_position | first |
| authorships[0].raw_author_name | Zhang, Fuyao |
| authorships[0].is_corresponding | False |
| authorships[1].author.id | https://openalex.org/A5068614756 |
| authorships[1].author.orcid | https://orcid.org/0000-0001-8024-5312 |
| authorships[1].author.display_name | Yuantao Hao |
| authorships[1].author_position | middle |
| authorships[1].raw_author_name | Hao, Yurong |
| authorships[1].is_corresponding | False |
| authorships[2].author.id | https://openalex.org/A5101614340 |
| authorships[2].author.orcid | https://orcid.org/0000-0001-7558-0626 |
| authorships[2].author.display_name | Xinyu Yan |
| authorships[2].author_position | middle |
| authorships[2].raw_author_name | Yan, Xinyu |
| authorships[2].is_corresponding | False |
| authorships[3].author.id | https://openalex.org/A5022178399 |
| authorships[3].author.orcid | https://orcid.org/0000-0003-1795-6474 |
| authorships[3].author.display_name | Yang Cao |
| authorships[3].author_position | last |
| authorships[3].raw_author_name | Cao, Yang |
| authorships[3].is_corresponding | False |
| authorships[4].author.id | https://openalex.org/A5027969322 |
| authorships[4].author.orcid | https://orcid.org/0000-0003-2150-5561 |
| authorships[4].author.display_name | Wei Yang Bryan Lim |
| authorships[4].author_position | middle |
| authorships[4].raw_author_name | Lim, Wei Yang Bryan |
| authorships[4].is_corresponding | False |
| has_content.pdf | False |
| has_content.grobid_xml | False |
| is_paratext | False |
| open_access.is_oa | True |
| open_access.oa_url | https://arxiv.org/pdf/2505.11097 |
| open_access.oa_status | green |
| open_access.any_repository_has_fulltext | False |
| created_date | 2025-10-10T00:00:00 |
| display_name | Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated Unlearning |
| has_fulltext | False |
| is_retracted | False |
| updated_date | 2025-12-07T15:56:01.666843 |
| primary_topic | |
| cited_by_count | 0 |
| locations_count | 2 |
| best_oa_location.id | pmh:oai:arXiv.org:2505.11097 |
| best_oa_location.is_oa | True |
| best_oa_location.source.id | https://openalex.org/S4306400194 |
| best_oa_location.source.issn | |
| best_oa_location.source.type | repository |
| best_oa_location.source.is_oa | True |
| best_oa_location.source.issn_l | |
| best_oa_location.source.is_core | False |
| best_oa_location.source.is_in_doaj | False |
| best_oa_location.source.display_name | arXiv (Cornell University) |
| best_oa_location.source.host_organization | https://openalex.org/I205783295 |
| best_oa_location.source.host_organization_name | Cornell University |
| best_oa_location.source.host_organization_lineage | https://openalex.org/I205783295 |
| best_oa_location.license | |
| best_oa_location.pdf_url | https://arxiv.org/pdf/2505.11097 |
| best_oa_location.version | submittedVersion |
| best_oa_location.raw_type | text |
| best_oa_location.license_id | |
| best_oa_location.is_accepted | False |
| best_oa_location.is_published | False |
| best_oa_location.raw_source_name | |
| best_oa_location.landing_page_url | http://arxiv.org/abs/2505.11097 |
| primary_location.id | pmh:oai:arXiv.org:2505.11097 |
| primary_location.is_oa | True |
| primary_location.source.id | https://openalex.org/S4306400194 |
| primary_location.source.issn | |
| primary_location.source.type | repository |
| primary_location.source.is_oa | True |
| primary_location.source.issn_l | |
| primary_location.source.is_core | False |
| primary_location.source.is_in_doaj | False |
| primary_location.source.display_name | arXiv (Cornell University) |
| primary_location.source.host_organization | https://openalex.org/I205783295 |
| primary_location.source.host_organization_name | Cornell University |
| primary_location.source.host_organization_lineage | https://openalex.org/I205783295 |
| primary_location.license | |
| primary_location.pdf_url | https://arxiv.org/pdf/2505.11097 |
| primary_location.version | submittedVersion |
| primary_location.raw_type | text |
| primary_location.license_id | |
| primary_location.is_accepted | False |
| primary_location.is_published | False |
| primary_location.raw_source_name | |
| primary_location.landing_page_url | http://arxiv.org/abs/2505.11097 |
| publication_date | 2025-05-16 |
| publication_year | 2025 |
| referenced_works_count | 0 |
| abstract_inverted_index.a | 6, 34, 104, 124, 131 |
| abstract_inverted_index.To | 91, 153 |
| abstract_inverted_index.an | 160 |
| abstract_inverted_index.as | 5, 43 |
| abstract_inverted_index.at | 195 |
| abstract_inverted_index.if | 63 |
| abstract_inverted_index.in | 88 |
| abstract_inverted_index.is | 193 |
| abstract_inverted_index.of | 21, 147, 182, 188 |
| abstract_inverted_index.to | 17, 25, 57, 74, 100 |
| abstract_inverted_index.we | 32, 95, 158 |
| abstract_inverted_index.(i) | 70 |
| abstract_inverted_index.IGF | 122 |
| abstract_inverted_index.The | 191 |
| abstract_inverted_index.and | 54, 84, 119, 138, 144, 185 |
| abstract_inverted_index.are | 41 |
| abstract_inverted_index.for | 10, 116 |
| abstract_inverted_index.has | 3 |
| abstract_inverted_index.key | 68 |
| abstract_inverted_index.may | 47 |
| abstract_inverted_index.the | 59, 180, 183, 186, 189 |
| abstract_inverted_index.via | 130 |
| abstract_inverted_index.(FU) | 2 |
| abstract_inverted_index.(ii) | 77 |
| abstract_inverted_index.PoFU | 166 |
| abstract_inverted_index.Such | 61 |
| abstract_inverted_index.This | 141 |
| abstract_inverted_index.both | 136 |
| abstract_inverted_index.code | 192 |
| abstract_inverted_index.data | 11, 28, 102, 173 |
| abstract_inverted_index.face | 66 |
| abstract_inverted_index.from | 81 |
| abstract_inverted_index.loss | 133 |
| abstract_inverted_index.that | 110, 134, 164 |
| abstract_inverted_index.this | 155 |
| abstract_inverted_index.upon | 27 |
| abstract_inverted_index.used | 42 |
| abstract_inverted_index.when | 38 |
| abstract_inverted_index.(SVD) | 115 |
| abstract_inverted_index.(iii) | 85 |
| abstract_inverted_index.PoFU, | 44, 83 |
| abstract_inverted_index.Proof | 20 |
| abstract_inverted_index.Value | 113 |
| abstract_inverted_index.cues. | 140 |
| abstract_inverted_index.data, | 76 |
| abstract_inverted_index.model | 128 |
| abstract_inverted_index.novel | 105, 156 |
| abstract_inverted_index.these | 93 |
| abstract_inverted_index.three | 67 |
| abstract_inverted_index.while | 169 |
| abstract_inverted_index.would | 65 |
| abstract_inverted_index.(IGF), | 103 |
| abstract_inverted_index.(PoFU) | 24 |
| abstract_inverted_index.access | 73 |
| abstract_inverted_index.across | 176 |
| abstract_inverted_index.attack | 108, 184 |
| abstract_inverted_index.design | 159 |
| abstract_inverted_index.attack, | 157 |
| abstract_inverted_index.auditor | 72 |
| abstract_inverted_index.between | 51 |
| abstract_inverted_index.clients | 16 |
| abstract_inverted_index.counter | 154 |
| abstract_inverted_index.defense | 163 |
| abstract_inverted_index.emerged | 4 |
| abstract_inverted_index.employs | 111 |
| abstract_inverted_index.enables | 142 |
| abstract_inverted_index.exploit | 48 |
| abstract_inverted_index.feature | 120 |
| abstract_inverted_index.latter. | 60 |
| abstract_inverted_index.limited | 78 |
| abstract_inverted_index.privacy | 12, 36 |
| abstract_inverted_index.propose | 96 |
| abstract_inverted_index.provide | 18 |
| abstract_inverted_index.removal | 29 |
| abstract_inverted_index.samples | 56, 79 |
| abstract_inverted_index.uncover | 33 |
| abstract_inverted_index.utility | 168 |
| abstract_inverted_index.Gradient | 98 |
| abstract_inverted_index.However, | 31 |
| abstract_inverted_index.Singular | 112 |
| abstract_inverted_index.auditors | 26, 46 |
| abstract_inverted_index.captures | 135 |
| abstract_inverted_index.critical | 7 |
| abstract_inverted_index.datasets | 178 |
| abstract_inverted_index.defense. | 190 |
| abstract_inverted_index.existing | 151 |
| abstract_inverted_index.gradient | 39, 52, 89 |
| abstract_inverted_index.methods. | 152 |
| abstract_inverted_index.multiple | 177 |
| abstract_inverted_index.overcome | 92 |
| abstract_inverted_index.samples, | 149 |
| abstract_inverted_index.semantic | 139 |
| abstract_inverted_index.tailored | 125 |
| abstract_inverted_index.validate | 179 |
| abstract_inverted_index.Federated | 0, 22 |
| abstract_inverted_index.Forgotten | 101 |
| abstract_inverted_index.Inverting | 97 |
| abstract_inverted_index.available | 194 |
| abstract_inverted_index.composite | 132 |
| abstract_inverted_index.derivable | 80 |
| abstract_inverted_index.efficient | 143 |
| abstract_inverted_index.feasible, | 64 |
| abstract_inverted_index.forgotten | 55, 172 |
| abstract_inverted_index.framework | 109 |
| abstract_inverted_index.inversion | 127 |
| abstract_inverted_index.mechanism | 9 |
| abstract_inverted_index.optimized | 129 |
| abstract_inverted_index.preserves | 165 |
| abstract_inverted_index.reduction | 118 |
| abstract_inverted_index.requests. | 30 |
| abstract_inverted_index.requiring | 14 |
| abstract_inverted_index.sensitive | 171 |
| abstract_inverted_index.unlearned | 15 |
| abstract_inverted_index.Unlearning | 1, 23 |
| abstract_inverted_index.compliance | 8 |
| abstract_inverted_index.difference | 99 |
| abstract_inverted_index.individual | 82 |
| abstract_inverted_index.orthogonal | 161 |
| abstract_inverted_index.preventing | 170 |
| abstract_inverted_index.redundancy | 87 |
| abstract_inverted_index.restricted | 71 |
| abstract_inverted_index.robustness | 187 |
| abstract_inverted_index.structural | 137 |
| abstract_inverted_index.surpassing | 150 |
| abstract_inverted_index.verifiable | 19 |
| abstract_inverted_index.Experiments | 175 |
| abstract_inverted_index.challenges, | 94 |
| abstract_inverted_index.challenges: | 69 |
| abstract_inverted_index.client-side | 75 |
| abstract_inverted_index.differences | 40, 53 |
| abstract_inverted_index.extraction. | 121 |
| abstract_inverted_index.large-scale | 148 |
| abstract_inverted_index.obfuscation | 162 |
| abstract_inverted_index.pixel-level | 126 |
| abstract_inverted_index.reconstruct | 58 |
| abstract_inverted_index.significant | 35 |
| abstract_inverted_index.correlations | 50 |
| abstract_inverted_index.differences. | 90 |
| abstract_inverted_index.incorporates | 123 |
| abstract_inverted_index.mathematical | 49 |
| abstract_inverted_index.regulations, | 13 |
| abstract_inverted_index.verification | 167 |
| abstract_inverted_index.Decomposition | 114 |
| abstract_inverted_index.effectiveness | 181 |
| abstract_inverted_index.high-fidelity | 145 |
| abstract_inverted_index.dimensionality | 117 |
| abstract_inverted_index.learning-based | 106 |
| abstract_inverted_index.reconstruction | 107, 146 |
| abstract_inverted_index.vulnerability: | 37 |
| abstract_inverted_index.reconstruction, | 62 |
| abstract_inverted_index.reconstruction. | 174 |
| abstract_inverted_index.high-dimensional | 86 |
| abstract_inverted_index.honest-but-curious | 45 |
| abstract_inverted_index.https://anonymous.4open.science/r/IGF. | 196 |
| cited_by_percentile_year | |
| countries_distinct_count | 0 |
| institutions_distinct_count | 5 |
| citation_normalized_percentile |