A few-shot Label Unlearning in Vertical Federated Learning

## Abstract

Abstract This paper addresses the critical challenge of unlearning in Vertical Federated Learning (VFL), an area that has received limited attention compared to horizontal federated learning. We introduce the first approach specifically designed to tackle label unlearning in VFL, focusing on scenarios where the active party aims to mitigate the risk of label leakage. Our method leverages a limited amount of labeled data, utilizing manifold mixup to augment the forward embedding of insufficient data, followed by gradient ascent on the augmented embeddings to erase label information from the models. This combination of augmentation and gradient ascent enables high unlearning effectiveness while maintaining efficiency, completing the unlearning procedure within seconds. Extensive experiments conducted on diverse datasets, including MNIST, CIFAR10, CIFAR100, and ModelNet, validate the efficacy and scalability of our approach. This work represents a significant advancement in federated learning, addressing the unique challenges of unlearning in VFL while preserving both privacy and computational efficiency.

## 1 Introduction

Figure: Figure 1: Illustration of risk of label leakage in vertical federated unlearning.
Refer to caption: x1.png

Vertical Federated Learning (VFL) (Yang et al., ) allows multiple organizations to collaboratively utilize their private datasets in a privacy-preserving manner, even when they share some sample IDs but differ significantly in terms of features. In VFL, there are typically two types of parties: (i) the passive party, which holds the features, and (ii) the active party, which possesses the labels. VFL has seen widespread application, especially in sensitive domains like banking, healthcare, and e-commerce, where organizations benefit from joint modeling without exposing their raw data (Yang et al., ; Li et al., ).

A fundamental requirement in Vertical Federated Learning (VFL) is the necessity for unlearning, which is driven by participants’ ”right to be forgotten” as mandated by regulations such as the General Data Protection Regulation (GDPR)(^1^11[https://gdpr-info.eu/art-17-gdpr/](https://gdpr-info.eu/art-17-gdpr/)) and the California Consumer Privacy Act (CCPA)(^2^22[https://oag.ca.gov/privacy/ccpa](https://oag.ca.gov/privacy/ccpa)). While unlearning has been explored in the context of Horizontal Federated Learning (HFL), there has been limited attention to its application in vertical settings. Existing studies on vertical federated unlearning (Zhang et al., ; Wang et al., ; Deng et al., ) primarily focus on the unlearning process for individual clients, often addressing the removal of all features from the passive party upon their exit. In contrast, this paper emphasizes the unlearning of labels, which is a critical aspect in VFL, particularly in scenarios such as Credit Risk Assessment where the determination of a loan applicant’s likelihood of default is essential. Moreover, the active party aims to eliminate label information not only from the active model but also from the passive models, as the passive models may retain label information (Fu et al., ).

A significant challenge in directly applying traditional machine unlearning methods, such as retraining (Bourtoule et al., ; Foster et al., ) or Boundary unlearning (Chen et al., ), in this context pose a risk of leaking unlearned labels during the unlearning process. Typically, the active party, which retains the labels, must either inform the passive party about the samples that require unlearning or transfer the gradients associated with the unlearned label. This practice may inadvertently expose sensitive label information to the passive party (see Figure 1 and Sect. 3.2).

To address this challenge, we propose a few-shot unlearning method that effectively erases labels from both the active model and passive model in vertical federated learning by leveraging a limited amount of private data (see Sect. 4). Specifically, our method employs manifold mixup (Verma et al., ) to augment the forward embeddings of each passive party. The active party then performs gradient ascent on the mixed embeddings to unlearn the active model and subsequently transfers the inverse gradients to the passive party to facilitate the unlearning of the passive model independently. This approach offers three key advantages: first, it necessitates only labels from a small amount of private data, significantly reducing the risk of label privacy leakage; second, by utilizing the manifold mixup technique, it enhances unlearning effectiveness with minimal data; and third, it is highly efficient, completing the unlearning process within seconds. The primary contributions of this work are as follows:

- 1.
To the best of our knowledge, this is the first work to address the unlearning of labels in vertical federated learning.
- 2.
We systematically elucidate the label privacy leakage that may occur when directly applying traditional machine unlearning methods in Sect. 3.2.
- 3.
We propose a few-shot label unlearning method that effectively erases labels from both the active and passive models in vertical federated learning, utilizing a limited amount of private data. Moreover, this approach leverages only a small number of data to mitigate the risk of label privacy leakage while employing manifold mixup to enhance unlearning effectiveness.
- 4.
We conduct extensive experiments on multiple benchmark datasets, including MNIST, CIFAR-10, CIFAR-100, and ModelNet, demonstrating that our method rapidly and effectively unlearns target labels compared to other machine unlearning methods.

## 2 Related Works

##### Machine Unlearning & Horizontal Federated Unlearning.

Machine unlearning was initially introduced by (Cao & Yang, ) to selectively remove some data from model without retrain the model from scratch (Garg et al., ; Chen et al., ). Machine unlearning can be categorized into exact unlearning and approximate unlearning. Exact unlearning methods such as SISA (Bourtoule et al., ) and ARCANE (Yan et al., ) split data into sections and train sub-models for each data section and merge all sub-models. During unlearning, retrain the affected data section and merge all sub-models again. In approximate unlearning, techniques such as fine tuning(Golatkar et al., ; Jia et al., ) (fine tune with $\mathcal{D}_{r}$), random label(Graves et al., ; Chen et al., ) (fine tune with incorrect random label of $\mathcal{D}_{u}$), noise introducing(Tarun et al., ; Huang et al., ), gradient ascent(Goel et al., ; Choi & Na, ; Abbasi et al., ; Hoang et al., ; Golatkar et al., )(maximise loss associate with $\mathcal{D}_{u}$), knowledge distillation(Chundawat et al., ; Zhang et al., ; Kurmanji et al., ) (train a student model) and weights scrubbing (Golatkar et al., ; ; ; Guo et al., ; Foster et al., ) (discarding heavily influenced weights) are used.

Most of the existing research works in federated unlearning are horizontal federated unlearning (Wu et al., ; Gu et al., ; Zhao et al., ; Romandini et al., ; Liu et al., ; Zhang et al., ; Su & Li, ; Ye et al., ; Gao et al., ; Cao et al., ; Yuan et al., ; Alam et al., ; Li et al., ; Halimi et al., ; Xia et al., ; Wang et al., ; Dhasade et al., ; Liu et al., ; Zhao et al., ; Wang et al., ; Gu et al., ). Only these three research works focus in vertical federated unlearning (Zhang et al., ; Wang et al., ; Deng et al., ). (Zhang et al., ) introduce vertical federated unlearning in gradient boosting tree. (Wang et al., ) introduce passive party unlearning on deep learning model with fast retraining on remaining parties. (Deng et al., ) introduce passive party unlearning on logistic regression model.

Existing literature on VFU primarily focus on passive parties unlearning (Zhang et al., ; Wang et al., ; Deng et al., ). Significant gap arise when active party seek for a collaboration from passive parties for a single class unlearning while all parties remaining engaged in VFL. Unfortunately, current VFU approaches do not address this specific scenario, as they do not explore class unlearning within VFL setting. In contrast to prior works focusing on class unlearning in centralise machine unlearning and horizontal federated unlearning settings, this study uniquely addresses class unlearning of classification model within the VFL paradigm. This distinction arises because traditional class unlearning methods in centralised and HFL setting are impractical for VFL settings, where all parties have different features of data and different computational power.

##### Vertical Federated Learning & Privacy Leakage

Vertical Federated Learning (VFL) is introduced to meet the needs of enterprises looking to utilize features distributed across multiple parties for improved model performance, compared to models trained by a single entity, all while preserving data privacy (Yang et al., ). In VFL, privacy is of utmost importance because the participants are typically companies that handle valuable and sensitive user information. Hence, privacy protection during VFU is also an important criteria. We explain the risk of label leakage during VFU in section 3.2.

## 3 Label Leakage during Vertical Federated Unlearning

This section illustrates the risk of label during the label unlearning process.

### 3.1 General Setup

VFL Training.
We assume that a vertical federated learning setting consists of one active party $P_{0}$ and $K$ passive parties $\{P_{1},\cdots,P_{K}\}$ who collaboratively train a VFL model $\Theta=(\theta,\omega)$ to optimize the following objective:

$$ $\begin{split}\min_{\omega,\theta_{1},\cdots,\theta_{K}}&\frac{1}{n}\sum_{i=1}^ {n}\ell(F_{\omega}\circ(G_{\theta_{1}}(x_{1,i}),G_{\theta_{2}}(x_{2,i}),\\ &\cdots,G_{\theta_{K}}(x_{K,i})),y_{i}),\end{split}$ (1) $$

in which Party $P_{k}$ owns features $\mathbf{x}_{k}=(x_{k,1},\cdots,x_{k,n})$ and the passive model $G_{\theta_{k}}$, the active party owns the labels $\mathbf{y}=\{y_{1},\cdots,y_{m}\}$ and active model $F_{\omega}$. Each passive party $k$ transfers its forward embedding $H_{k}$ to the active party to compute the loss. The active model $F_{\omega}$ and passive models $G_{\theta_{k}},k\in\{1,\dots,K\}$ are trained based on backward gradients. Note that, before training, all parties leverage Private Set Intersection (PSI) protocols to align data records with the same IDs.

Unlearning Label in VFL.
When the active party requests to unlearn some sensitive labels $\mathbf{y}^{u}$, where the corresponding feature is $\{\mathbf{x}^{u}_{k}\}_{k=1}^{K}:=\{\{x_{k,i}^{u}\}_{i=1}^{n_{u}}\}_{k=1}^{K}$. The active party aims to remove the influence of $\mathbf{y}^{u}$ on both the active model $F_{\omega}$ and $K$ passive models $\{G_{\theta_{k}}\}_{k=1}^{K}$.

Threat Model.
We assume all participating parties are semi-honest and do not collude with each other. An adversary (i.e., the passive party) faithfully executes the training protocol but may launch privacy attacks to infer the private labels of the active party.

Assumption.
We assume that the passive party possesses corresponding labels for a limited number of features, defined as $\mathcal{D}^{p}=\{(\mathbf{x}_{k}^{p},\mathbf{y}^{p})\}_{k=1}^{K}=\{\{(x_{k,i}
^{p},y_{i})\}_{i=1}^{n_{p}}\}_{k=1}^{K}$, where $n_{p}<<n_{u}$. This assumption is reasonable, as the active party must convey some label information to the passive party in order to effectively remove that information. Furthermore, this assumption is widely employed in prior works (Fu et al., ; Gu et al., ; Zou et al., ).

Figure: Figure 2: Illustration of label leakage accuracy during Boundary unlearning in VFL in ResNet18 model with different number of classes.
Refer to caption: x2.png

### 3.2 Label leakage during unlearning

To remove the influence of the passive models $\{G_{\theta_{k}}\}_{k=1}^{K}$, there exists a risk of unlearning label leakage ($\mathbf{y}_{u}=\{y_{1}^{u},\ldots,y_{m_{u}}^{u}\}$)
to the passive parties. During the unlearning process, the active party is required to transfer information to the passive party, e.g., gradients $\mathbf{g}_{u}=\{g_{1}^{u},\ldots,g_{n_{u}}^{u}\}$, in order to effectively unlearn the label associated with the passive model. Consequently, the passive party may infer the label based on this information.

In particular, when unlearning a single class $y_{u,1}$, we consider two representative unlearning methods: retraining (Foster et al., ) and Boundary unlearning (Chen et al., ). For retraining methods, the active party must inform the passive party regarding which features do not require training, thus, the label is leaked. In the case of Boundary unlearning, the gradients transferred to the passive party correspond to the features associated with the label $y_{u,1}$ may leak the label.

Furthermore, when multiple labels ($m_{u}$) are targeted for unlearning, we consider the Boundary unlearning as an example. This method illustrates that the passive party can infer label information from the gradients $\mathbf{g}_{u}$ transmitted by the active party during the unlearning process. Specifically, the passive party employs clustering on $\mathbf{g}_{u}$ to derive $m_{u}$ clusters by optimizing the following objective function:

$$ $\min\sum_{g_{i}\in\mathcal{C}_{j}}\sum_{j=1}^{m_{u}}|g_{u,i}-\bar{g}_{u,j}|,$ (2) $$

where $\mathcal{C}_{j}$ denotes the set of points assigned to cluster $j$, and $\bar{g}_{u,j}$ represents the centroid of cluster $j$. Consequently, the passive party can deduce the labels of the features in $\mathcal{X}$. Figure 2 presents the label leakage accuracy during unlearning in vertical federated learning for varying numbers of unlearning classes. For instance, even with four classes from CIFAR-100, the passive party achieves a clustering accuracy of 62.45%.

Figure: Figure 3: Overview of our proposed VFU framework.
Refer to caption: x3.png

## 4 The Proposed few-shot label unlearning methods

This section introduces the proposed methods few-shot label unlearning methods, utilizing a limited amount of labeled data. Figure 3 shows the overview of our proposed solution. The methods comprise two primary steps: first, augmenting the forward embedding through manifold mixup to address the scarcity of labeled data for unlearning, as discussed in Section 4.1. Second, employing gradient ascent on the augmented embedding to influence both the passive and active models, thereby facilitating the removal of the specified class, as elaborated in Section 4.2.

### 4.1 Vertical Manifold Mixup

Due to the label privacy leakage described in Section 3.2, directly applying traditional machine unlearning methods poses challenges. We assume that the active party discloses a limited number of labels to the passive party to facilitate the unlearning of a specific class. However, this small labeled dataset, denoted as $\mathcal{D}_{p}$, is insufficient for effective unlearning (see Appendix). Consequently, this scenario can be framed as a few-shot unlearning problem, wherein a minimal set of labels is employed to unlearn all associated labels.

Figure: Algorithm 1 Our Method

Drawing inspiration from few-shot learning principles, we adopt the manifold mixup mechanism (Verma et al., ) by interpolating hidden embeddings rather than directly mixing the features. We propose a manifold mixup framework for Vertical Federated Learning (VFL) by optimizing the following loss function:

$$ $\begin{split}&\min_{\omega,\theta_{1},\cdots,\theta_{K}}\frac{1}{n_{p}^{2}} \sum_{i,j=1}^{n_{p}}\ell(F_{\omega}\circ(\text{Mix}_{\lambda}(G_{\theta_{1}}(x _{1,i}^{p}),G_{\theta_{1}}(x_{1,j}^{p})),\\ &\quad\cdots,\text{Mix}_{\lambda}(G_{\theta_{K}}(x_{K,i}^{p}),G_{\theta_{K}}(x _{K,j}^{p})),\text{Mix}_{\lambda}(y_{i}^{p},y_{j}^{p})),\end{split}$ $$

where

$$ $\text{Mix}_{\lambda}(a,b)=\lambda\cdot a+(1-\lambda)\cdot b.$ (3) $$

The mixed coefficient $\lambda$ ranges from 0 to 1. The advantage of the manifold mixup approach lies in its ability to flatten the state distributions (Verma et al., ). Specifically, for each passive party $k$, mixup is applied to the forward embeddings $\{{H}^{p}_{k}=G_{\theta}(x_{k,i}^{p})\}$ to generate numerous mixed embeddings $H_{k}^{\prime}$. Subsequently, all passive parties transfer their respective mixed embeddings $H_{k}^{\prime}$ to the active party.

### 4.2 Vertical Label Unlearning via Gradient Ascent

Once the augmented embeddings $\{H_{1}^{\prime},\ldots,H_{K}^{\prime}\}$ for the representative unlearned data $\mathcal{D}_{p}$ (label is known) are generated, a straightforward yet effective strategy is to implement gradient ascent for both the active and passive models using these augmented embeddings. Specifically, the active party concatenates all embeddings $\{H_{k}^{\prime}\}_{k=1}^{K}$ into a single tensor $H^{\prime}=[H_{1}^{\prime},\ldots,H_{K}^{\prime}]$, and optimizes it according to the following formulation:

$$ $\min_{\omega}\ell(F_{\omega}(H^{\prime}),y^{\prime})=\ell(F_{\omega}([H_{1}^{ \prime},\ldots,H_{K}^{\prime}]),y^{\prime}),$ (4) $$

where $y^{\prime}$ represents the mixture of the representative unlearned labels and $\eta$ is the learning rate.

Unlearning for active model $F_{\omega}$. On one hand, the active model undergoes unlearning for active model $F_{\omega}$ via gradient ascent as follows:

$$ $\omega=\omega+\eta\nabla_{\omega}\ell(F_{\omega}(H^{\prime}),y^{\prime}).$ (5) $$

Unlearning for passive model $G_{\omega_{k}}$. Subsequently, the active party computes the gradients $g_{k}^{\prime}=\frac{\partial\ell}{\partial H_{k}^{\prime}}$ in accordance with equation 4 and transmits these gradients to the corresponding passive party $k$. Finally, the passive party $k$ updates the passive model $G_{\theta_{k}}$ using the following expression:

$$ $\theta_{k}=\theta_{k}+\eta\nabla_{H_{k}^{\prime}}\ell(F_{\omega}(H^{\prime}),y ^{\prime})\cdot\nabla_{\theta_{k}}H_{k}^{\prime}.$ (6) $$

It is important to note that gradient ascent may lead to significant degradation in model utility or even result in vanishing gradients if the parameters are not appropriately tuned. Therefore, employing a small learning rate $\eta$ and a limited number of unlearning epochs can mitigate these issues while achieving effective unlearning results (see experimental details in Appendix A).

## 5 Experimental Result

This section presents the empirical analysis of the proposed method in terms of utility, unlearning effectiveness, time efficiency and some ablation studies.

### 5.1 Experiment Setup

##### Unlearning Scenarios

Single-class unlearning: We forget a single class from all datasets. Two-classes unlearning: We forget two classes from CIFAR10 and CIFAR100. Multi-classes unlearning: We forget four classes from CIFAR100.

##### VFL Setting & Datasets & Models

We stimulate a VFL scenario by splitting a neural network into two bottom models and a top model and assigning the two bottom models to each two passive parties and the top model to the active party. We conduct experiments on four datasets: MNIST(Lecun et al., ), CIFAR10, CIFAR100(Krizhevsky et al., ) and ModelNet(Wu et al., ). We adopt Resnet18(He et al., ) on dataset MNIST, CIFAR10, CIFAR100 and ModelNet. We do extend our experiments with Vgg16(Simonyan & Zisserman, ) on dataset CIFAR10 and CIFAR100. Experiments are repeated over five random trials, and results are reported as mean and standard deviation. Further details are in Appendix A.1.

##### Evaluations Metrics

We evaluate the utility of unlearning by measuring accuracy of $\mathcal{D}_{r}$ before and after unlearning. The higher accuracy on $\mathcal{D}_{r}$ indicates stronger utility. To evaluate the unlearning effectiveness, we construct a simple MIA from (Shokri et al., ) to test Attack Success Rate (ASR) and measuring the accuracy of $\mathcal{D}_{u}$ before and after unlearning. MIA seeks to determine if a specific data record was included in the training of a target machine learning model. Time efficiency is evaluated by comparing the runtime of each baseline.

##### Baselines

We compare our method with the following baselines: Retrain, Fine Tuning(Golatkar et al., ; Jia et al., ), Fisher Forgetting(Golatkar et al., ), Amnesiac Unlearning(Graves et al., ), UNSIR(Tarun et al., ) and Boundary Unlearning (Chen et al., ). Additional details are available in Appendix A.1.

### 5.2 Experimental Results

#### 5.2.1 Utility Guarantee

To assess the utility of our proposed unlearning method, we evaluate accuracy on $\mathcal{D}_{r}$ before and after unlearning (Tab 1, 2, 3). An effective unlearning method should retain as much information as possible from $\mathcal{D}_{r}$.

From tab 1, 2, 3, we observe that: 1) Fine-tuning achieve good preservation on $\mathcal{D}_{r}$, but its unlearning effectiveness is low (see Section 5.2.2). 2) Fisher forgetting badly preserve the information of $\mathcal{D}_{r}$, resulting in huge degradation on $\mathcal{D}_{r}$ accuracy. 3) Random incorrect labeling of $\mathcal{D}_{u}$ from Amnesiac Unlearning causes the decision boundaries for $\mathcal{D}_{r}$ to shift unpredictably, resulting in a drop in accuracy on $\mathcal{D}_{r}$. This degradation is more pronounced in datasets with a large number of classes, such as CIFAR100 and ModelNet. 4) The repair step from UNSIR fails to fully retain the information in $\mathcal{D}_{r}$, leading to some performance degradation on $\mathcal{D}_{r}$. 5) Boundary unlearning exhibit inconsistencies across different datasets, models, and scenarios. In some cases, they show huge degradation on $\mathcal{D}_{r}$, while in other instances, they preserve $\mathcal{D}_{r}$ well.

Our solution show good unlearning utility in all experiments.

Table: Table 1: Accuracy of $\mathcal{D}_{r}$ and $\mathcal{D}_{u}$ for each unlearning method across Resnet18 and Vgg16 model in single-class unlearning

Table: Table 2: Accuracy of $\mathcal{D}_{r}$ and $\mathcal{D}_{u}$ for each unlearning method across Resnet18 and Vgg16 model in two-classes unlearning

Table: Table 3: Accuracy of $\mathcal{D}_{r}$ and $\mathcal{D}_{u}$ for each unlearning method across Resnet18 and Vgg16 model in multi-classes unlearning.

#### 5.2.2 Unlearning Effectiveness

For unlearning effectiveness, we run MIA to evaluate if the unlearned model leaks any information about the $\mathcal{D}_{u}$ and measure the accuracy of $\mathcal{D}_{u}$ before and after unlearning. We present the MIA graph of single-class unlearning in Resnet18 (fig 4(a)) and Vgg16 (fig 4(b)). Additional MIA figures are available in figure 11.

From tab 1, 2, 3, we observe that: 1) Fine-tuning show bad unlearning effectiveness on CIFAR10 and CIFAR100 datasets. The unlearning effectiveness of fine tuning is worse on two-classes (Tab 2) and multi-classes unlearning scenarios (Tab 3); 2) Fisher forgetting, Amnesiac Unlearning and UNSIR shows strong unlearning effectiveness, reducing accuracy of $\mathcal{D}_{u}$ to 0.00%; 3) Boundary unlearning exhibit inconsistencies across different datasets, models, and scenarios. In some cases, they show good unlearning effectiveness on $\mathcal{D}_{u}$, while in other instances, they show bad unlearning effectiveness.

Our solution demonstrates strong effectiveness across all models, datasets, and scenarios. It achieving successful unlearning of $\mathcal{D}_{u}$. From fig 4(a), 4(b), we observe that: 1) Fine tuning shows consistent ASR score in experiments. 2) Fisher forgetting show high ASR score in many experiments. 3) Amnesiac unlearning show inconsistencies in ASR score such as very high ASR score and very low ASR score on different experiments. 4) UNSIR show high ASR score on almost all experiments. 5) Boundary unlearning show relatively consistent ASR scores.

Our solution show consistent ASR performance across all datasets, models and scenarios.

Figure: (a) Resnet18
Refer to caption: x4.png

#### 5.2.3 Time Efficiency

Figure: Figure 5: The runtime(s) of each unlearning method.
Refer to caption: x6.png

For computational complexity, we measure the execution time of unlearning methods in seconds. We present an execution time graph of single-class unlearning in the Resnet18 model CIFAR10 dataset in figure 5. Our solution has the lowest execution time on all experiments.

From fig 5, we observe that : 1) The standard gold retrain model takes the highest execution time in all experiments. 2) Unlearning methods that utilise full dataset or $\mathcal{D}_{r}$ such as Fine Tuning, Amnesiac Unlearning and Fisher forgetting have high execution time in all the experiments. 3) Unlearning methods that utilise only $\mathcal{D}_{u}$ such as Boundary Unlearning shows a lower execution time. Our solution has the lowest execution time on all experiments.

### 5.3 Ablation Study

In this section, we conduct an ablation study on the effectiveness of our method for different number of passive parties and different privacy-preserving VFL mechanishm.

#### 5.3.1 Evaluation for different number of passive parties

Table 4 shows the accuracy of $\mathcal{D}_{r}$ and $\mathcal{D}_{u}$ on 1 passive party, 2 passive parties and 4 passive parties. Figure 7 shows the ASR score along different numbers of passive parties. Both two results show that our method can perform well in unlearning effectiveness and utility.

Table: Table 4: Accuracy of $\mathcal{D}_{r}$ and $\mathcal{D}_{u}$ for each unlearning method across Resnet18 model in single-class unlearning on different number of passive parties.

Figure: Figure 6: Comparison of the utility and unlearning effectiveness on different size of $D_{p}$.
Refer to caption: x7.png

#### 5.3.2 Evaluation on different size of D p subscript 𝐷 𝑝 D_{p} italic_D start_POSTSUBSCRIPT italic_p end_POSTSUBSCRIPT

We apply the gradient ascent with different size $D_{p}$ to achieve unlearning in Figure 6, e.g, three methods (GA-s using 40 samples, GA-A using 5000 samples and ours). It shows that 1) 40 samples is not enough to unlearn since the unlearning result on $D_{u}$ is only 40.48% while 5000 samples is 0%; 2) our methods only use 40 samples but achieve the 0% unlearning effectiveness on $D_{u}$.

Figure: Figure 7: Comparison of different unlearning methods evaluated on MIA attacks for different number of passive parties on CIFAR10.
Refer to caption: x8.png

#### 5.3.3 Evaluation for different privacy preserving VFL methods

We evaluate our unlearning methods under two privacy preserving VFL methods, Differential Privacy (Fu et al., ) and Gradient Compression (Fu et al., ).
Figures 8 and 9 show the effectiveness of our solution on the Differential Privacy and Gradient Compression model across different levels of variance Gaussian noise and compression ratio respectively. It shows that even for the large compression ratio and noise level, the proposed method still unlearn effectively while the utility of the vertical training decreases a lot.

Figure: (a)
Refer to caption: x9.png

Figure: (a)
Refer to caption: x11.png

## 6 Conclusions

In conclusion, this paper presents a pioneering approach to label unlearning within Vertical Federated Learning, addressing a critical gap in the existing literature. By introducing a few-shot unlearning method that leverages manifold mixup, we effectively mitigate the risk of label privacy leakage while ensuring efficient unlearning from both active and passive models. Our systematic exploration of potential label privacy risks and extensive experimental validation on benchmark datasets underscores the method’s efficacy and rapid performance. Ultimately, this work not only advances the understanding of unlearning in VFL but also sets the stage for further innovations in privacy-preserving collaborative machine learning practices.

## Appendix A Appendix

This section provides detailed informations on our experimental settings and additional experimental results.

### A.1 Experimental Setup

##### Datasets

MNIST(Lecun et al., ) datasets contain images of handwritten digits. MNIST dataset comprises 60,000 training examples and 10,000 test examples. Each example is represented as a single-channel image with dimensions of 28x28 pixels, categorised into one of 10 classes. CIFAR10 (Krizhevsky et al., ) dataset comprises 60,000 images, each with dimensions of 32x32 pixels and three colour channels, distributed across 10 classes. This dataset includes 6,000 images per class and is partitioned into 50,000 training examples and 10,000 test examples. Within each class, there are 5000 training images and 1000 test images. Similarly, the CIFAR100 (Krizhevsky et al., ) dataset shares the same image dimensions and structure as CIFAR10 but extends to 100 classes, with each class containing 600 images. Within each class, there are 500 training images and 100 test images. ModelNet (Wu et al., ) dataset is a widely-used 3D shape classification and shape retrieval benchmark, which currently contains 127,915 3D CAD models from 662 object categories. We created 2 2D multi-view images per 3D mesh model by placing 2 virtual cameras evenly distributed around the centroid and partitioned the images into 2 parties by their angles, which contains 19662 images to train and 4930 images to test.

##### Baselines

The baseline methods in this study:

Baseline: Original model before unlearning.

Retrain: Retrain the model from scratch with $\mathcal{D}_{r}$ with the same hyper-parameters to baseline.

Fine Tuning(Golatkar et al., ; Jia et al., ): The baseline model is fine-tuned using $\mathcal{D}_{r}$ for 5 epochs with 0.01 learning rate.

Fisher Forgetting(Golatkar et al., ): We use fisher information matrix(FIM) to inject noise into the parameters proportional to their relative importance to the $\mathcal{D}_{f}$ compared to the $\mathcal{D}_{r}$.

Amnesiac(Graves et al., ): We retrain the model for 3 epochs with relabeled $\mathcal{D}_{f}$ with incorrect random label and $\mathcal{D}_{r}$.

Unsir(Tarun et al., ): We introduce noise matrix on $\mathcal{D}_{f}$ to impair the model with noise generated and repair the model with $\mathcal{D}_{r}$.

Boundary Unlearning(Chen et al., ): We create adversarial examples from $\mathcal{D}_{f}$ and assign new nearest incorrect adversarial label to shrink the $\mathcal{D}_{f}$ to nearest incorrect decision boundary.

Gradient Ascent(Golatkar et al., ): We maximise the loss of $\mathcal{D}_{f}$ on the model for small number of epochs.

##### Model Architecture

Table 5 summarise our VFL framework setting.

**Table 5: Models in experiments. FC: Fully-connected layer. Conv: convolutional layer**
| Model name | Model of Passive Party | Model of Active Party |
| --- | --- | --- |
| Resnet18 | 20 Conv | 1 FC |
| Vgg16 | 13 Conv | 3 FC |

##### Implementation Details

Table 6 and 7 summarises the hyper-parameters for our unlearning method.

Table: Table 6: Hyper-parameters use for unlearning in our solution in Single-class unlearning.

Table: Table 7: Hyper-parameters use for unlearning in our solution in two-classes and multi-classes unlearning.

Table 8 summarise the model name and datasets involve in each unlearning scenarios.

**Table 8: Models and datasets involve in each unlearning scenarios.**
| Scenarios | Models | Datasets |
| --- | --- | --- |
| Single-class Unlearning | Resnet18 | MNIST, CIFAR10, CIFAR100, ModelNet |
| Vgg16 | CIFAR10, CIFAR100 |  |
| Two-classes Unlearning | Resnet18 | CIFAR10, CIFAR100 |
| Vgg16 | CIFAR10, CIFAR100 |  |
| Multi-classes Unlearning | Resnet18 | CIFAR100 |
| Vgg16 | CIFAR100 |  |

Figure: Figure 10: PMC resnet18 cifar10 single class
Refer to caption: x13.png

### A.2 Additional Experiments Result

Figure11 shows MIA graphs for various number of passive parties. Moreover, Figure 10 shows the PMC attack (one strongest label privacy attack in (Fu et al., )) before and after unlearning methods. It demonstrates that our methods achieve beyond 40% drops for the model accuracy on $D_{u}$.

Figure: (a)
Refer to caption: x14.png

## Peer Reviews

confidence: 2
contribution: 3
initial_rating: 5
presentation: 3
questions: - Can the proposed method be applied to non-vision datasets or other vision tasks other than classification?
soundness: 3
strengths: - The paper is well structured and generally easy to follow
- The proposed method is intuitive and seems to be technically sound
- Extensive experiments on 4 datasets and 2 model architectures demonstrate the effectiveness of the proposed method
summary: This paper aims to address the label unlearning problem in vertical federated learning (VFL). It demonstrates the lable leakage issue with applying traditional techniques in lable unlearning in VFL and proposes a few shot unlearning method to address mitigate this issue. Extensive experiments on 4 datasets and 2 model architectures show that the proposed method is effective and effcient while preserving good utility.
weaknesses: - As mentioned in the introduction, VFL is mostly used in finance, healthcare, or ecommerce scenarios, but this work mostly validated the proposed method on simple vision datasets.
- The discussion and presentation of experiment results can be improved. e.g., the paper discusses utility in Sec 5.2.1 but also mentioning effectiveness in Figure 4 in Sec 5.2.2. It is not intuitive to compare different methods on these two aspects easily. 
- Figure 1 is not easy to understand and interpret the label leakage risk.
- VFU seems to be used without definition

---

confidence: 4
contribution: 4
initial_rating: 6
presentation: 4
questions: As shown in Figure 4, the ASR of Amnesiac is abnormally high (up to 96.1) on CIFAR-100 with Resnet 18 architecture while ASR of Amnesiac on other datasets or architectures is only up to 3.1. Could the authors provide more explanations?
soundness: 4
strengths: * The discussed topic, unlearning in VFL, is important.
* The writing is clear.
* The proposed mixup augmentation is simple yet effective.
* The empirical results demonstrate the effectiveness of the proposed framework. The model after unlearning demonstrate high accuracy and low attack success rate.
* The ablation is extensive and helpful.
summary: This paper focuses on the unlearning problem in vertical federated learning (VFL). The authors leverage a limited amount of data for unlearning to mitigate the label leakage risk of existing unlearning methods. In particular, the authors propose to mixup feature embeddings during the learning process. Then during the unlearning process, the mixup scheme can be utilized to augment the limited data. The unlearning is finally achieved by gradient ascent on the augmented data. Experiments conducted on diverse datasets validate the performance of the proposed framework.
weaknesses: As shown in Equation (3), the feature size of the active party increases quadratically as the number of clients increases. Therefore, the scalability of the framework is relatively limited.

The effeciency of the proposed method is still doubted.
The authors did not correct their submission.
I will maintain my score.

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 2
questions: See weakness
soundness: 3
strengths: 1. **Introducing the first method for label unlearning in Vertical Federated Learning (VFL)**: This paper pioneers a novel approach specifically tailored for the removal of label information in VFL settings, addressing a critical gap in existing federated learning literature. Unlike prior work focused on feature-based unlearning, this method uniquely targets the secure and efficient unlearning of labels across collaborative models, enhancing data protection compliance in sensitive domains.

2. **Detailing potential privacy leaks in traditional unlearning methods**: The paper systematically examines the vulnerabilities of conventional unlearning techniques when applied to VFL, especially the risk of sensitive label information being inadvertently exposed to other parties during the unlearning process. By identifying specific points of leakage, this study highlights the importance of secure information flow between the active and passive parties in VFL.

3. **Proposing an effective few-shot unlearning approach that uses limited data and enhances unlearning with manifold mixup**: To minimize data exposure, this approach relies on a small subset of private data, significantly reducing privacy risks. Through manifold mixup, the method augments data embeddings, allowing for robust and efficient unlearning with minimal information. This few-shot strategy achieves a balance between privacy preservation and computational efficiency, making it practical for real-world applications.

4. **Demonstrating superior unlearning performance on benchmark datasets like MNIST, CIFAR-10, CIFAR-100, and ModelNet**: Extensive experiments validate the method's effectiveness and speed in removing target labels, outperforming traditional unlearning techniques on widely used datasets. The results illustrate the approach’s scalability and adaptability across diverse data types, affirming its potential for high-performance unlearning in federated settings.
summary: This paper proposes a few-shot label unlearning method specifically designed for Vertical Federated Learning (VFL) to mitigate privacy leakage risks associated with traditional unlearning approaches. In VFL, multiple organizations collaborate on model training by sharing some sample IDs while differing in feature sets, making it particularly suitable for sensitive fields such as banking and healthcare. This method leverages a small amount of private data and manifold mixup to augment embeddings, employing gradient ascent to remove labels from the active party’s model and transferring inverse gradients to the passive party to ensure independent label removal from both models. Experimental results demonstrate that this approach achieves rapid and effective label unlearning across various datasets, significantly reducing privacy leakage risks.
weaknesses: 1. The paper lacks a preliminary section to help readers understand the meaning of each mathematical symbol. Some symbols are not explained, making it difficult for me to follow the methodology. Please clarify the definition of each variable in the paper.

2. While the paper’s motivation is clear and innovative, it lacks explanations regarding specific methods, such as why gradient ascent and inverse gradient can remove label information. Additionally, I am uncertain whether the proposed method guarantees convergence. Please provide an analysis or discussion on the forgetting functionality and convergence of this method.
(1). provide a theoretical justification for why gradient ascent and inverse gradients are effective for label removal
(2). Include a convergence analysis or discussion of the conditions under which convergence is guaranteed
(3). Offer more detailed explanations of the forgetting mechanism and how it ensures complete removal of label information

3. The experimental setup lacks sufficient detail, including which categories were selected for forgetting in each dataset, the number of clients, and how data attributes were assigned. Please add a more detailed description of the experimental setup.
(1). A table or list of the exact categories chosen for forgetting in each dataset
(2). The number of clients/parties involved in each experiment
(3). A description of how data attributes were distributed among the parties This level of detail would allow for better reproducibility and understanding of the experimental conditions.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 3
questions: Please check the weakness part for details.
soundness: 3
strengths: 1. The proposed method is simple and intuitive, approaching the unlearning process from a few-shot perspective and utilizing feature mixup to handle limited sample sizes.
2. The method demonstrates broad applicability.
3. Extensive experimental results indicate that the method not only performs consistently across various datasets and models with different numbers of clients but can also be effectively integrated with differential privacy and gradient compression methods. Furthermore, the proposed method exhibits the lowest unlearning cost compared to its competitors.
summary: This paper explores the unlearning process in vertical federated learning (VFL), a topic that has been relatively underexplored in prior research. The authors highlight the risk of label leakage during the unlearning phase and propose a solution to address this issue. Their method utilizes a small set of labeled data, combined with feature mixup and gradient ascent, to mitigate the leakage of label information from VFL systems.
weaknesses: 1. The label leakage described in Sec. 3.2 would only occur if both active and passive clients share the same label space. However, in most VFL scenarios, clients have distinct label spaces. Therefore, this assumption of label leakage is questionable.
2. In the introduction, the statement that "... the passive party holds the features, ... the active party possesses the labels." is inaccurate. The active party also holds its own features.
3. Some notations are unclear. For instance, in line 152, "{x^u_k}" is used, but the variable "u" is not defined. I assume it refers to samples for unlearning.
4. The figures are difficult to interpret, particularly Fig. 1 and Fig. 6.
5. The mix rate lambda is crucial to the method. However, the authors neither provide a thorough analysis of this hyperparameter nor clarify whether lambda remains consistent across different clients.

Meta-review: This paper received two positive and two negative reviews. Positive reviews highlighted its clear structure and effective mixup augmentation method for unlearning in Vertical Federated Learning (VFL). Empirical results show improved accuracy and reduced attack success rates, with the method being practical for few-shot settings and applicable across datasets and models. It integrates well with techniques like differential privacy and gradient compression, achieving the lowest unlearning cost compared to existing methods. However, the negative reviews raised several concerns. The lack of a section explaining mathematical symbols makes the methodology hard to follow, and definitions for variables are needed. While the use of gradient ascent and inverse gradients is justified, the paper does not explain why these methods are effective for label removal or discuss the convergence conditions. An analysis of the forgetting mechanism would strengthen the paper. The experimental setup lacks detail, such as categories for forgetting, client numbers, and data distribution, which hinders reproducibility. A table summarizing this information is recommended. Furthermore, while VFL is used in fields like finance and healthcare, the experiments focus on simple vision datasets, which may not capture real-world complexities. The presentation of results could be clearer, particularly in comparing utility and effectiveness. The authors have made considerable efforts in their response, the Area Chair (AC) believes that the paper requires significant revisions for ICLR publication, particularly in terms of experimental analysis.

Decision: Reject