Ferrari: Federated Feature Unlearning via Optimizing Feature Sensitivity
Authors: Hanlin Gu
Win Kent Ong
Chee Seng Chan
Lixin Fan
Venue: NeurIPS 2024 poster (2024)
Keywords: Machine Unlearning
Federated Unlearning
Feature Unlearning
Lipschitz Continuity
Primary area: privacy
TL;DR: Previous research on Federated Unlearning lacked focus on feature unlearning. This paper introduces Ferrari, a framework aimed at facilitating Federated Feature Unlearning. Ferrari utilizes Lipschitz Continuity to efficiently unlearn features.

Abstract: The advent of Federated Learning (FL) highlights the practical necessity for the ’right to be forgotten’ for all clients, allowing them to request data deletion from the machine learning model’s service provider. This necessity has spurred a growing demand for Federated Unlearning (FU). Feature unlearning has gained considerable attention due to its applications in unlearning sensitive, backdoor, and biased features. Existing methods employ the influence function to achieve feature unlearning, which is impractical for FL as it necessitates the participation of other clients, if not all, in the unlearning process. Furthermore, current research lacks an evaluation of the effectiveness of feature unlearning. To address these limitations, we define feature sensitivity in evaluating feature unlearning according to Lipschitz continuity. This metric characterizes the model output’s rate of change or sensitivity to perturbations in the input feature. We then propose an effective federated feature unlearning framework called Ferrari, which minimizes feature sensitivity. Extensive experimental results and theoretical analysis demonstrate the effectiveness of Ferrari across various feature unlearning scenarios, including sensitive, backdoor, and biased features. The code is publicly available at https://github.com/OngWinKent/Federated-Feature-Unlearning

Ferrari: Federated Feature Unlearning via Optimizing Feature Sensitivity
Hanlin Gu
Win Kent Ong",
Chee Seng Chan', and
Lixin Fan?
CISiP, Universiti Malaya, Malaysia Al Lab, Webank, PR China
Abstract
The advent of Federated Learning (FL) highlights the practical necessity for the 'right be forgotten' for all clients, allowing them request data deletion from the machine learning model's 's service provider. This necessity has spurred growing demand for Federated Unlearning (FU). Feature unlearning has gained consider- able attention due to its applications in unlearning sensitive, backdoor, and biased features. Existing methods employ the influence function to achieve feature un- learning, which is impractical for FL as it necessitates the participation of other clients, if not all, the unlearning process. Furthermore, current research lacks evaluation of the effectiveness of feature unlearning. To address these limita- tions, we define feature sensitivity in evaluating feature unlearning according to Lipschitz continuity. This metric characterizes the model output's 's rate of change or sensitivity to perturbations in the input feature. We then propose an effective federated feature unlearning framework called Ferrari, which minimizes feature sensitivity. Extensive experimental results and theoretical analysis demonstrate the effectiveness of Ferrari across various feature unlearning scenarios, includ- ing sensitive, backdoor, and biased features. The code is publicly available at http://giiiiilloooooooowwiwiieee
Introduction
Federated Learning (FL) [1:3 allows for model training across decentralized devices servers hold- ing local private data samples, without the need to exchange them directly. An essential requirement explicitly outlined in regulations such as the
within FL is the participants "right to be forgolten", European Union General Data Protection Regulation (GDPR and the California Consumer Privacy Act (CCPA 4 To address this requirement, Federated Unlearning (FU) has been introduced, enabling clients to selectively remove the influence of specific subsets of their data from a trained FL model while preserving the model's accuracy on the remaining data [5].
FL, the feature unlearning 99 holds significant applications across various scenarios. Firstly, in contexts where sentences contain sensitive information such as names and addresses (9] 10 it becomes crucial remove these sensitive components to prevent potential exposure through model inversion attacks 111 Secondly, when datasets contain backdoor triggers that can compromise model integrity [15188, is imperative to eliminate these patterns. Thirdly, unlearning biased features becomes essential in scenarios where data imbalances significantly impact model accuracy due bias 19 22 However,
Different from unlearning at the client, class, or sample level 6
equal contribution; authors listed alphabetically by first name.
ccorresponding author (cs.chan @ um, my)).
https://gdpr-infee info. weteeeeta////// gdggprr/// ca.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

existing works of FÜ focus on client, class, or sample unlearning [68]] but do not address feature unlearning, limiting their ability to unlearn specific features across multiple data points.
There are two challenges in feature unlearning in FL.. Firstly, evaluating the unlearning effectiveness for feature unlearning is difficult. Typically, unlearning effectiveness is assessed by comparing the unlearned model with a retrained model without the feature. However, building data without the feature is challenging; for example, training the data with noise black block on the feature region may cause severe degradation in model accuracy (see Sec. (.2). Secondly, previous work on feature unlearning within centralized machine learning settings 10 not practical for FL due to its
requirement for access to all datasets, necessitating the participation of all clients.
To address the aforementioned limitations, first define the feature sensitivity in Sec. 4.1 to evaluate the feature unlearning inspired by the Lipschitz continuity, which characterizes the rate of change or sensitivity of the model output perturbations in the input feature. Then we propose simple but effective federated feature unlearning method, called Ferrari (Federated Feature Unlearning), by minimizing the feature sensitivity in Sec. 4.2 Our Ferrari framework offers three key advantages: Firstly, Ferrari requires only local datasets from the unlearned clients for feature unlearning, Secondly, Ferrari demonstrates high practicality and efficiency, which support various feature unlearning scenarios, including sensitive, backdoor, and biased features and only consumes a few epochs of optimization. Thirdly, theoretical analysis in Sec. 4.3 elucidates that our proposed Ferrari achieves lower model utility loss compared to the exact feature unlearning.
The key contributions of this work summarized as follows:
We identify two key challenges for feature unlearning in FL. The first is how to successfully unlearn features without requiring the participation of other clients, discussed in Sec. 3.2 The second is how to design an effective evaluation method in federated feature unlearning.
We define the feature sensitivity and introduce this metric in federated feature unlearning in Sec. 4 By minimizing feature sensitivity, we propose an effective federated feature unlearning method, named Ferrari, which enables clients to selectively unlearn specific features from the trained global model without requiring the participation of other clients.
We provide a theoretical proof in Theorem | which dictates that Ferrari achieves better model performances than exact feature unlearning. This analytical result is also echoed in the empirical evidence, highlighting Ferrari's 's effectiveness across various settings, including the unlearning of sensitive, backdoor, and biased features.
2 Related Work
Machine Unlearning Machine Unlcarning (MU), introduced by Cao et al.
23 involves selectively
removing specific training data from a trained model without retraining from scratch [4 25 It categorizes into exact unlearning [7] aiming to completely remove data influence with techniques like SISA (28) and ARCANE (29] though with computational costs, and approximate unlearning which reduces data impact through techniques like data manipulation (fine-tuning with
30 31.
mislabeled data (32]36] introducing noise (37-39]. ), knowledge distillation 40 (training a
student model), gradient ascent 44 (maximizing loss associated with forgotten data), and weight
scrubbing 48-531 (discarding heavily influenced weights).
Federated Unlearning In FI., traditional centralized MU methods are unsuitable due to inherent differences like incremental learning and limited dataset access (54). Research on Federated Unlearn-
ing (FU) mainly focuses on client, class, and sample unlearning (6 Client unlcarning, pioneered
by Liu et al. [53] introducing FedEraser
(55). includes approaches like FRU (56). FedRecover [57] VeriFI [88] HDUS [59]. KNOT (60 FedRecovery [61]. Knowledge Distillation (54). and
Gradient Ascent 64) aiming to remove specific clients or recover poisoned global models. Class unlearning, introduced by Wang et al. [65, involves frameworks like discriminative pruning and Momentum Degradation (66) (MoDE) to remove entire data classes. Sample unlearning, initiated by Liu et al. [67] targets individual sample removal within FL settings, with advancements like the
QuickDrop 688 framework and FedFilter (699 enhancing efficiency and effectiveness. Recent works,
such FedMe by Xia et al. (70), optimize both unlearning facilitation and privacy guarantees.

---

Existing literature on FU primarily focuses on client, class, sample unlearming [68. sigmificant gap arises when client seeks to remove only sensitive features while remaining engaged in FI.. Unfortunately, current FÚ approaches do not address this specific scenario, as they do not explore feature unlearning within FI. settings. In contrast to prior works focusing on feature unlearning in centralized settings of MU, such as classification models ( 10], generative models [71474], and large language models (75777], this study uniquely addresses feature unlearning of classification model within the FL paradigm. This distinction arises because traditional feature unlearning methods in centralized settings of MU are impractical for FL scenarios, where participation from all clients is often infeasible. In such cases, the process fails if even single client opts out of the operation.
However,
Therefore, fill this critical gap, we proposed a novel federated feature unlearning framework, namely Ferrari based on the concept of Lipschitz continuity [78] Our proposed Ferrari requires exclusively from the target client's ' dataset while still preserving the model's 's original performance. Lipschitz continuity, a fundamental mathematical concept that measures function's 's sensitivity to changes in its input variables [81-33 is central to our feature unlearning approach. For detailed exposition of our proposed federated feature unlearning framework utilizing Lipschitz continuity, please refer to Sec. 4 To the best of our knowledge, this is the first work feature unlearning within FL settings that does not necessitate participation from all other clients, showcasing the potential to enhance privacy, practicality and efficiency.
Challenges on Feature Unlearning in FL
3.1 Federated Feature Unlearning
Consider a federated system comprising K clients and one server, collaboratively learning a global model fo as:
K
{(fa(zn.s..
min
711
where é the loss, e-g., the cross-entropy loss, D2 (( e De. M is the dataset with size ng owned by client k. One client (i.e., referred to the unlearn client Cw) requests the removal of feature from the global model such that does not retain any information about J. Specifically, we assume that the data x E Idd and denote the j-th feature of x by x[j]]. The partial element of the data x corresponding the feature I is defined as x xx])) ie..
x|3] = f E 5}
(2)
Therefore, the unlearn client C. aims to remove (2r, [9] called unlearned data D.. Denote D, D DD, to be the remaining data.
3.2 Challenges for Feature Unlearning in FL
Unlike sample or class unlearning 668), evaluating the unlearning effectiveness for feature unlearning is difficult. Typically, unlearning effectiveness assessed by compar- ing the unlearned model with a retrained model trained on remaining data D,. However, building D, for the feature unlearning takes much work. For example, suppose we want to remove the mouth from a face image. that case, one possible solution is to replace the mouth region with Gaussian noise or black block, as illustrated in Fig. [ However, this added Gaussian noise or black block can adversely affect model training and degrade performance, e.g. the degradation of model accuracy is beyond 27%.
Zc 75.51
Zp 68.37%
Ace 95.86%
Figure 1: Sample data x with Gaussian noise (#c) and black pixels (7B) pertur- bations, illustrating feature removal and performance comparison.
Another challenge implementing feature unlearning for C. without the help of other clients. Previ- ous work on feature unlearning [9, 10 typically requires access to the remaining data, necessitating the participation of other clients in the FL process. This requirement is impractical the FL context, as other clients may be unwilling or unable to share data or computational resources. Therefore, finding a method to effectively unlearn features without relying on other clients is crucial to maintain the model accuracy and practicality in the FL settings.
3

---

00
Local Feature Unlearning
Server
slope -L
(x)
Minimiene
Femaze Senetiity
DD
Hlope -L
fe
f'r (Ra)
Local Feature Calcarning
Slopo
slope L
Pj
Figure 2: Overview of our proposed Ferrari framework: Initiated by the feature unlcarning request from the unlearn client C., the server initializes the trained global model 0 to C. for local feature unlearning. Upon completion, C. uploads the unlearned model 8 to the server. Local feature unlearning minimizes the Lipschitz constant L between the original input and its perturbed feature subset, reducing feature sensitivity yet preserving the overall model performance.
4
The Proposed Method
In this section, we introduce feature sensitivity (see Def. Sec. 1.1 feature unlearning. We then propose Ferrari based on this concept in Sec. S.c.4.2). Finally, we demonstrate that Ferrari achieves a lower utility loss compared to exact feature unlearning in Sec. 4.3
evaluate the effectiveness of
4.1 Feature Sensitivity
Inspired by Lipschitz Continuity 77
80
82].
Algorithm 1 Federated Feature Unlearning
which provides an approximate method for re- moving information from images by perturbing the input data and observing the effect on the output, we introduce the concept of feature sen- sitivity s as Def. [ This metric measures the memorization of model for the feature F by considering the local changes the given input rather than the global change defined in the traditional Lipschitz continuity.
Input: Unlearn client Cu. Local dataset D with data size na. Unlearn feature { J.V
Global model parameters 0, Gaussian noise a, Learning rate 1). Sample number N
Output: Unlearned model parameters
1: The unlearn client C. performs:
2:
for (x, F,) (Du, { do
3:
0 =0
Definition 1. The feature sensitivity of the
4:
for i= 1 to N do
model f with respect to the feature F on the data (I, u) is defined as:
5:
Sample d5, according to Eq. (4
Compute L; faw (x) for
6:
05 ll
== [lf(x) f(x 5zz l1
7:
end for
L N. N 1= L 8th - 8t V
1|0g l2
8:
9:
where 8y denote the perturbation on feature F.
end for
11: Upload 0 to the server
Def. chaaracterizess the rate of change or sensi-
12: The server performs:
tivity of the model output to perturbations in the input data. A small feature sensitivity s repre-
13: Replace the global model 0 with the f
14: return 8"
sents the model f doesn't 't memorize the feature F. This definition does not require building the remaining data, it considers the expectation average output change rate over any magnitude the perturbation. Furthermore, we will provide the relationship between Def. aad exact feature unlearning Sec. 4.3
the perturbation dg. Specifically, it represents the
The perturbation dy can be chosen from various distributions, such as the Gaussian distribution, the uniform distribution, and
Remark 1.
4.2 Ferrari
As discussed the feature sensitivity in Sec. 4.1 the core idea of the proposed method Ferrari is to achieve the feature unlearning by minimizing the feature sensitivity. More specifically, it controls the change the model's output relative to changes in the input within the feature region, iee, the slope, to prevent the model from memorizing the feature as illustrated in Fig. 2

---

One unlearning client C. requests to unlearning the feature F. The proposed Ferrari aims to unlearn the global model to 8". The proposed method can be divided into three steps (see details in Alg. [ In order to compute the feature sensitivity, the perturbation dy in terms of the feature F is firstly computed as the following (take the Gaussian distribution as an example):
NO),0²) j E Ff
8g [s]
(4)
0
Otherwise
Secondly, we leverage a finite sample Monte Carlo approximation to the maximization as Def.
as:
E5g fx()
fo(x 6
[l((()) fo( + 8 d0g,)
|60 l2
N
116
where 65 is de sampling as Eq. 4
Finally, for the unlearning client C, who aims to remove the feature F from his/her data D,. the unlearned model 1 is obtained as the following:
N llfo(z) fo(x d
Hu arg min ((,,))
(6)
1109,1112
==1
where Eq. 66 is computed over the dataset Du. Noted that the proposed Ferrari based on Def. doesn't 't need the participation of other clients.
Remark 2. When the unlearning happens during the federated training, the unlearning clients would also optimize the training loss and feature sensitivity simultaneously, i.e., Eaay) (e(fo(z).v)
AEs, (ol())))((+++))l)))
where À is a coefficient.
4.3 Theoretical Analysis of the Utility loss for Ferrari
As illustrated in Sec. 3.2 retraining the model without the feature may affect the model accuracy seriously. Suppose the feature successfully removed when the norm of perturbation larger than C. We firstly define the utility loss E with unlearning feature directly, i..., the exact feature unlearning:
4 = min (ary)e min min (fo(z + 83).
6 I2
And define the maximum utility loss with the norm perturbation lower than C as:
8 max E (may) min (ioe((f(z + 88).
(8)
16 ise
Assumption 1. Assume 82 <6
Assumption elucidates that the utility loss associated with a perturbation norm lower than C' is smaller than the utility loss when the perturbation norm is greater than C. This assumption is logical, as larger perturbations would naturally lead to a greater utility loss.
Assumption 2. Suppose the federated model achieves zero training loss.
We have the following theorem to elucidate the relation between feature sensitivity removing via Alg. [ and exact unlearning (see proof in Appendix A. including the extension for the non-zero training loss assumption).
Theorem 1.
If Assumptions (actinpptions[annn[[]ia hold, the utility loss of unlearned model obtained using Alg. is lower than the utility loss with exact feature unlearning, i.e...
Cu S l,,
where l, En (fo- (x),
Theorem showcases that the proposed method Ferrari, results in a utility loss (f.,) that is lower than the utility loss incurred when the feature is removed, and the model is retrained, i.e., the process of exact feature unlearning.
To further evaluate the effectiveness of feature unlearning based on feature sensitivity, employ model inversion attacks [2] to determine if the feature can be reconstructed and employ attention maps to assess if the model still focuses the unlearned feature, described in Sec. 5.3.1
Remark 3.
5

---

Uniiinal
Original
Oktirtall
Oreaal Eabert
Oriiinal Tabel-47
Target Feature: Digit
T Feature: Gender
Bius Feature: Mouth
Bias Feature: Color Unbiis
Bixx
3
8
Trigpor
Trigper
Trigarn
Blue
Green
Smite Not Semil
9
3
8
Uibbes
Green
Blue
CMNIST
CelebA
CIFAR-100
Figure 3: Pixel-pattern backdoor feature.
Figure 4: Biased datasets distribution.
Experimental Results
This section presents the empirical analysis of the proposed Ferrari framework in terms of effective- ness, utility, and time efficiency in sensitive, backdoor and biased feature unlearning scenarios.
5.1 Experimental Setup
Unlearning Scenarios Sensitive Feature Unlearning: We simulate the removal of sensitive features from the Di to fulfill the request of C. due privacy concern. Specifically, remove 'mouth' from Celeb [84]. 'marital status' from Adult [85]. and "pregnancies number' from Diabetes [86]. Therefore, our proposed Ferrari aims to remove the influence of these requested features.
Backdoor Feature Unlearning: We simulate pixel-pattern backdoor attack by C, based on BadNets [18] within FL framework [15 C₂ injects pixel-pattern backdoor feature and trigger label into its D., during training, as shown in Fig. 3 Consequently, our proposed Ferrari aims to remove the influence of these backdoor features and restore the model's original performance.
Biased Feature Unlearning: We simulate the bias dataset D2 of the C. and the unbias dataset D, with a bias ratio of 0.8, as shown in Fig. 4 This results in a global model biased towards the biased dataset 87 88 patterns instead of digits, and in CelebA [84] it learns mouth features instead of facial features for gender classification. Therefore, our proposed Ferrari aims to mitigate these bias-inducing features and restore model performance.
due to unintended feature memorization 22 In CMNIST 89), the model focuses on color
Hyperparameters & Datasets & Model We simulate HFL with K 10 clients under III) setting, each holding 10% of the datasets, except for the biased feature unlearning experiment with bias ratio of 0.8. For federated feature unlearning experiments,
set hyperparameters: learning rate 77 = 0.0001, sample size N = 20, and random Gaussian noise with standard deviation ranging from 0.05 < < 1.0 (see Sec. 5.5) across iterations of N. Experiments are repeated over five random trials, and results are reported as mean and standard deviation. We employ ResNet18 18 [90] on image datasets: MNIST 89), Colored-MNIST (CMNIST) 89), -MSSIT 191) CIFAR- 10,
CIFAR-20, CIFAR-100 100 [92 and ImageNet [93]. For tabular datasets, such as Adult Census Income (Adult) 85 and Diabetes [66) we used fully-connected neural network linear model. Additionally, we utilize the transformer-
BERT model [94] for the text dataset, specifically the IMDB movie reviews dataset 955] We conduct experiments on single NVIDIA A100 GPU. Further details are in
Appendix A.2
Evaluation Metries We assess effectiveness by measuring feature sensitivity (see Section 4.1 and conducting a model inversion attack (MIA) [TH14] to determine the attack success rate (ASR). The goal is achieve low feature sensitivity and ASR, indicating successful unlearning sensitive features. Backdoor and biased feature unlearning are evaluated by comparing accuracy on the retain dataset D, (Acc,) and the unlearn client dataset (Acc.). Low Acc, indicates high effectiveness for backdoor unlearning, while similar accuracy (Acc, = Acc.,) reflects fairesss and effectiveness in biased feature unlearning. Qualitatively, effectiveness is assessed using MIA-reconstructed images (sensitive) and GradCAM (96) attention maps (backdoor and biased). The utility is measured by test dataset D, accuracy (Acc), with higher values indicating stronger utility. Time efficiency evaluated by comparing the runtime of each baseline.

---

Scenurios
Datasets
Unlearn
Feature
Baseline
Retrain
Fine-tune
Accuracy %
FedCDP
FedReeovers 61
Ferradi (Ours)
CelebA
Mouth
+1
79.46 #2.32
11
29.78
-1.73
Sensitive
Diabetes
Adult
Pregnancies
Mamage
82.11
82.45 +2.59
66.27
64.19
+0.72
+0.58
61.02 +1.05
59.57
=0.68
30.19 1.62
=4.56
21.89
17.56
+3.71
79.53 +00.99
81.02 10.58
IMDB
Names
91.39 +1.57
83.27
+2.05
72.15
+1.92
48.36
-279
37.93
+2 84
89.15 +1.32
MINIST
94.75 14.88
96.23
10.16
96.85
10.91
65.31
24.39
40.52 17.38
95.83 11.14
FMNIST
+2.19
92.98
+0.75
42.24
92.61 +1.57
Backdoor
Backdoor
CIFAR-10
CIFAR-20
Pixel
74.47
87.55 433.1
81.61 +1.75
90.92
1:883
82.52
91.23
+0.69
00.4
54,76
53.98
2:117
23.02
27.16 19.68
78.34 +2.35
89.52 12.18
CIFAR-100
54.13 47.62
73.12 1.344
73.39
1.66
34.30 -042
15.21 +5.83
69.30 4:2.27
ImageNet
+4.14
67
+2007
67.52
11.99
31.17 +3.96
12.75 +:
65.36 +:184
Blased
CMNIST
CelchA
Mouth
87.35 14.07
95.87 11.52
1.46
88.93 1266
16.98 -0.23
1.71
20.19 17.21
94,62 12,49
Table 1: The accuracy of Dr for each unlearning method across different unlearning scenarios.
Secmario
Datasets
Ualearn
Baseline
Reirain
Fenture Senstiviky
Forrari
Mouth
=0000010
0.79
0.5 #287%
091=341110
0.09
Sensitive
Diahetes
Adult
Progaaciis
Marriage
0.02 2
1.52 10.1
0.08
6.47
5.00
0.94
0.96
+1.28x 10
16.8 10
1.23 +388% 10
1.7 17.4xx
0.83 0..3+5500200
1.14 1.14:12.5xxx00
0.7 +1.07% 10
0,0
11.22x
IMDB
Names
0.85 =100x100
0.00 -535x11
0.74
+381x 10
0.1 +3,27%10
0.78=241x10
0J8 +1.32%
Table 2: Feature sensitivity for each unlearning method across sensitive feature unlearning scenario.
Baselines We compare our proposed Ferrari against the models of Baseline, Retrain, Fine-tune, and FedRecovery [61]. Additional details are provided in Appendix A.2 A.2
FedCDP (65
5.2 Utility Guarantee
To evaluate the utility of Ferrari, measure Acc; Dt where higher Ace, indicates greater utility (Tab. D Although the Fine-tune method shows high Ace; in the backdoor feature unlearning scenario with clean dataset, its unlearning effectiveness very low (see Sec. (53.2). This problem worsens with FedCDP [65] and FedRecovery [6]] which suffer significant Acc, declines, reducing model utility and making them unsuitable for feature unlearning. In contrast, Ferrari achieves the highest model utility in sensitive and biased feature unlearning scenarios, with the highest Acc; among baselines, minimal deterioration, and the greatest unlearning effectiveness across all scenarios.
5.3 Effectiveness Guarantee
In this subsection, we analyze the unlearning effectiveness of Ferrari against baselines in sensitive, backdoor, and biased feature unlearning scenarios.
5.3.1 Sensitive Feature Unlearning
To evaluate Ferrari's effectiveness unlearning sensitive features, we measured feature sensitivity (see Sec. 4.1 and conducted model inversion attack (MIA) MH14
Feature Sensitivity Tab. 2 shows the sensitivity of the unlearn feature. The baseline model had high sensitivity this feature. Similar results were observed for the Fine-tune, FedCDP (65. and FedRecovery models [61]. with sensitivities greater than 0.8, indicating ineffective unlearning. In contrast, our proposed Ferrari model exhibits low sensitivity, similar the Retrain model, indicating successful unlearning of the sensitive feature.
ASR of MIA Tab. 3 shows the ASR results. The Baseline model achieved an ASR exceeding 80%. indicating substantial exposure of sensitive features. Similar observations were made for the Fine-tune, FedCDP [65], and FedRecovery [6]] models, with ASR surpassing 70% exhibiting ineffective feature unlearning. Conversely, Ferrari achieved low ASR, suggesting successful feature unlearning with minimal unlearned feature exposure after using Ferrari via MIA.
MIA Reconstruction Fig. 5 shows MiA-reconstruutedd images. The Baseline model achieved complete reconstruction, whereas both Retrain and Ferrari models failed to reconstruct the mouth feature accurately. This underscores Ferrari's effectiveness in unlearning and preserving privacy by preventing precise reconstruction of unlearned features via MIA.
7

---

Unlearn
Attack Success ASR) (%)
Scenurio
Datasets
Feature
Baseline
Retrain
Fine-tune
FedCDP [65]
FedRecovery [6]
Ferrari (Ours)
+3.22
10098
75.36 =9.31
71.52
::2.11
Sensitive
Adult
Marriage
87.54 13.89
49.28
22.13
83.45 48.44
72.83 45.18
80.39 + 10.668
49.58 1.138
Diabetes
Pregnancics
92.31 +7.55
2252
88.46
+8.17
78.27 +2.47
42.61 +1.81
IMDB
Names
90.28 +2.49
40.29
-1.99
86.74 +3.81
83.67 4-4.9
80.95 +3,51
43.75 +.866
Table 3: The ASR of MIA for each unlearning method across sensitive feature unlearning scenario.
Target
Baseline
Retrain
Ferrari (Ours)
Target
Baseline
Retrain
Ferrari (Ours)
Figure 5: MIA reconstruction on CelebA (unlearned mouth)
5.3.2 Backdoor Feature Unlearning
Accuracy Dp and Du represent the clean and backdoor datasets, respectively. Successful unlearning shown by low Acc,, and high Acc,, indicating effective unlearning and preserved model utility. As shown in Tab. 4 the Fine-tune method has higher Ace, and utility than the Retrain method but lower unlearning effectiveness due high Acc,- FedCDP (65 and FedRecovery [6]] show low utility and unlearning effectiveness with low Acc, and Acc., rendering them unsuitable for backdoor feature unlearning. In contrast, Ferrari demonstrates the highest utility and unlearning effectiveness.
Fig. 6a illustraas attention maps analyzing backdoor feature unlearning. Initially, the Baseline model focuses on the 5 square the top-left corner, indicating significant influence on output prediction by the pixel-patter backdoor feature. In contrast, Ferrari unlearned models shift the attention towards recognizable objects like digits and cars, similar the Retrain model. This shift suggests reduced sensitivity to the backdoor feature, indicating successful unlearning. See Appendix A.3.1 for supplementary results.
Attention Map
5.3.3 Biased Feature Unlearning
Accuracy D, and D2 represent the unbias and bias datasets, respectively. Successful unlearning results in similar accuracies across both datasets (Acc, Acc.). ensuring fairness while maintaining high Acc, and Acc, for utility. Tab. 4 shows that the Fine-tune method fails to unlearn bias, as Acc, remains higher than Acc,, despite slightly higher Acc, compared to Retrain. FedCDP (65) and FedRecovery [6]] exhibit catastrophic forgetting, with low Ace, and Acc,, making them unsuitable for biased feature unlearning. In contrast, Ferrari demonstrates effective unlearning with similar Acc, and Acc,, and maintains high overall accuracy, indicating successful biased feature unlcarning.
Attention Map Fig. 6b shows attention maps analyzing biased feature unlearning. The Baseline model predominantly focuses on the biased feature region (mouth) in both bias and unbias datasets, suggesting its significant impact on output prediction. However, Ferrari unlearned models redis- tribute attention across various facial regions in both datasets, similar to the Retrain model. This shift indicates reduced sensitivity the biased feature, demonstrating successful unlearning. See Appendix A.3.2 for supplementary results.
5.4
Computational Complexity
evaluate the runtime performance and FLOPs metrics of each unlearning method to demonstrate the computational complexity. The Retrain method is expected to have the slowest runtime and highest FLOPs, while Fine-tune is fast but still slower than other methods.
In Fig.
Both FedCDP 655 and FedRecovery 61 demonstrate faster runtimes and lower FLOPs than Fine-tune method, but they are still more computationally expensive than Ferrari. This is primarily due to the need to access training datasets from all clients and the computational expense of gradient residual calculations [61].

---

Scenarios
Datasets
Unlearn Feature
Baseline
Retrain
Fine-tune
Accuracy (%)
FedCDP 6S
PedRecovery 61
Perrari(Ouirs)
12.49
96.16
16.5
40.81 14.31
2.
97.43
3.69
0.00 10,00
72.64
10.24
69.37 40.33
53.72 13314
0.11 10.01
FMNIST
54
91.07 00.54
93.85 1:108
94.36 11.98
68.46
4293 12.50
92.83 10.1
0.90 +0.03
Backdoor
R-1R-100
pixel-
Backdoor
9,
87.63
95.05 -2.30
1.16
91.12 01121160
0.00 +0.00
92.02
88.44 +0.92
13.15
62.75 45.07
1691
27.39 2:196
49.26 42225
89.91 20.55
0.29 1:004
CIEAR-20
pillern
2,
0,
75.06
=6.1
81.91 1.468
+0000
82.67 11.32
55.67 16635
49.11
23.76 12.17
78.29 1.3.12
CIFAR-100
54.14 =5.96
13.34
78.66 16.57
54.02 1:224
13.62 17.78
69.37 2331
88.98 66.63
0.00 10.00
65.38 4:1.6
57.29
13.62
46.17 19.25
0.15 10.01
ImageNet
52.35
29.74
D.
83.16 3.74
0.00 10.00
71.48 1.3.69
62.39 1.3.05
54.92 1:5.99
0.09 10.02
CMNIST
Color
61,91 27.8
98.76 13365
67.15
12.60
25.85 11.38
23.92 1:08
84.31 1243
Biased
CelebA
Mouth
2
0.
96.38 3387
79.46 2.09
96.11 +2.17
96.47 16.15
94,23 +0.66
84.45 11.48
21,58 +3348
14.29 10.81
25.72 +8.02
16.34 1:343
94.79 1.488
94.18 1.3008
Table 4: The accuracy of Dr and Di for each unlearning method across different unlearning scenarios.
Input
Baseline
Retrain
Ferrari
MNIST
FMNIST
CIFAR-10
CIFAR-20
CIFAR-100
Bias Datasel
Unbiae Datasel
(a) Backdoor Feature Unlearning
(b) Biased Feature Unlearning
Figure 6: The attention map of each unlearning method across different unlearning scenarios.
In contrast, Ferrari has lowest computational complexity, with the fastest runtime and lowest FLOPs. It only requires access to the local dataset of the unlearn client and achieves feature unlearning by minimizing feature sensitivity within single epoch.
5.5 Ablation Study and Hyper-parameter Analysis
We conduct ablation study to analyze how Non-L-pschinn affects the effectiveness of our proposed Ferrari and hyper-parann prper-parameter analysis of Gaussian noise level (a) and number of D, in Fig
Non-Lipschitz We evaluate the unlearning performance by removing the denominator in Eq.
calling this the Non-Lipschitz method, shown in Fig. 8al The results indicate catastrophic forgetting: D. accuracy drops below 10%, and the unlearned model misclassifies all inputs into a single random class, rendering it useless. This stems from the unbounded loss function the non- Lipschitt method, unlike the bounded Lipschitz constant in Eq. which provides a theoretical guarantee (see Sec. 4.3)
Refer Appendix A.4 for a detailed analysis of Lipschitz and Non-Lipschitz loss functions.
The effectiveness of Ferrari significantly influenced by injected Gaussian noise. Fig. shows the accuracy of D, and Da across different levels. In the 0.05 & 1.0 range, D, accuracy stays high and D,, accuracy remains low, indicating a balance. Thus, we implement o values between 0.05 and 1.0 for balanced accuracy across D, and Dy.
Gaussian Noise
Number of Unlearn Dataset Our analysis illustrated in Fig. 8c demonstrates that Ferrari remains effective with partial D., from C, for feature unlearning (i.e., data lost). Using 70% of D., yields comparable accuracy using the full (i.e., 100%) dataset, highlighting the method's flexibility even with partial data.

---

Retrain
1309.5
Retrain
4.37e+144
Fine-tune
396.6
Finc-tune
1.257e114
Method
Method
FedCDP
156.12
FedCDP
5.58e113
FedRecovery
101 101.21
FedRecovary
19
Ferrai
17.33
Ours
3.03ee112
250 500
750
1000 1250 1500
1
2
3
4
5
FLOPs
Runtime (s)
(a) Runtime(s)
(b) FLOPs
Figure 7: Computational complexity analysis comparing the runtime(s) and FLOPs for each unlearn- ing method.
100
100
100
IMNIST
CHARLI CREABOE
CHEAR 164
62
MENSI PVINEST
JEEST
20
11
0,
Di
Dg
00
1,0
1.5
3.0
3.0
10
60
50
100
Lipschite
Non-LLipschite
Standard Devintiono)
Litleam Clienr Danseet75)
(a) Non-Lipschitz
(b) Gaussian noise level(ar)
(c) Number of Ds
Figure 8: Ablation and hyper-parameter analysis on Ferrari backdoor feature unlearning. Solid line: D, dashed line: D...
Conclusion
This paper introduces Ferrari, federated feature unlearning framework designed to efficiently remove sensitive, backdoor, and biased features without extensive retraining. Leveraging Lipschitz continuity, Ferrari reduces model sensitivity to specific features, ensuring robust and fair models. Uniquely, it requires participation only from the client requesting unlearning, preserving privacy and practicality in FL environments. Experimental results and theoretical analysis demonstrate Ferrari's effectiveness across various data domains, addressing the crucial need for feature-level unlearning in federated learning. This method can serve technical solution to meet regulatory requirements for data deletion while maintaining model performance, offering significant value to clients by securing their "right be forgotten" and preventing potential privacy leakage.
6.1 Limitation and Future Work
The proposed federated feature unlearning method works effectively using only the unlearning client's local data, making it well-suited for real-world scenarios. However, for optimal results, access to the full dataset is required. As demonstrated in Section [.3] using 70% of the data yields comparable performance, but significant data reduction diminishes effectiveness. Future research should focus on developing methods that require only small portion of the client's data and expanding the approach beyond classification models to include for example, generative models. Additionally, enhancements such as advanced perturbation techniques and integration with presecyp methods should be explored.
Acknowledgement
This research supported by the Fundamental Research
Grant (FRGS///2022ICCTO2/UMM)// awarded by the Ministry of Higher Education, Malaysia.
Scheme
10

---

References
[1] J. Konečný, B. McMahan, and D. Ramage, "Federated optimization: Distributed optimization beyond the datacenter." arXiv preprint arXiv:1571.03573 2015.
[2] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Arcas, "Communication-cffce learning of deep networks from decentralized data," " in Artificial Intelligence and Statistics, pp. 1273-1282, PMLR, 2017.
[3] Q. Yang, Y. Liu, T. Chen, and Y. Tong, "Federated machine learning: Concept and applications." ACM Transactions on Intelligent Systems and Technology (TIST), vol. 10, no. 2, pp. 1-19, 2019.
[4] E. L. Harding, J. J. Vanto, R. Clark, L. Hannah Ji, and S. C. Ainsworth, "Understanding the scope and impact of the california consumer privacy act of 2018," Journal of Data Protection & Privacy, vol. 2, no. 3, pp. 234-253, 2019.
[5] T. Che, Y. Zhou, Z. Zhang, L. Lyu. J. Liu, D. Yan, D. Dou, and J. Huan, "Fast federated machine unlearning with nonlinear functional theory," in International conference on machine learning. pp. 4241-4268, PMLR, 2023.
[6] Z. Liu, Y. Jiang. J. Shen, M. Peng, K.-Y. Lam, X. Yuan, and X. Liu, "A survey on federated unlearning: Challenges, methods, and future directions," 2024.
[7] N. Romandini, A. Mora, C. Mazzocca, R. Montanari, and P. Bellavista, "Federated unlearning: A survey on methods, design guidelines, and evaluation metrics," 2024.
[8] J. Yang and Y. Zhao, "A survey of federated unlearning: taxonomy, challenges and future directions," 2023.
[9] A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck, "Machine unlearning of features and labels," in Proc. of the 30th Network and Distributed System Security (NDSS), 2023.
[10] T. Guo, S. Guo, J. Zhang, W. Xu, and J. Wang. "Efficient attribute unlearning: Towards selective removal of input attributes from feature representations," 2022.
[11] M. Fredrikson, Lantz, S. Jha, S. M. Lin, D. Page, and T. Ristenpart, "Privacy in pharmacoge- netics: An end-to-end case study of personalized warfarin dosing." Proceedings of the USENIX Security Symposium. UNIX Security Symposium, vol. 2014, pp. 17-32, 2014.
[12] M. Fredrikson, S. Jha, and T. Ristenpart, "Model inversion attacks that exploit confidence information and basic countermeasures," in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp. 1322-1333, 2015.
[13] Y. Zhang, R. Jia, H. Pei. W. Wang. B. Li, and D. Song. "The secret revealer: Generative model- inversion attacks against deep neural networks." in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 250-258, 2020.
[14] S. Mehnaz, S. V. Dibbo, E. Kabir, N. Li, and E. Bertino, "Are your sensitive attributes private? novel model inversion attribute inference attacks on classification models," in USENIX Security Symposium, 2022.
[15] E. Bagdasaryan, A. Veit, Hua, Estrin, and V. Shmatikov, "How to backdoor federated learning," in Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics (S. Chiappa and R. Calandra, eds.), vol. 108 of Proceedings of Muchine Learning Research, pp. 2038-998,, PMLR, 26-28 Aug 2020.
[16] T. D. Nguyen, T. Nguyen, P. L. Nguyen, H. H. Pham, K. D. Doan, and K.-S. Wong, "Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions." Engineering Applications of Arlificial Intelligence, vol. 127, p. 107166, 2024.
[17] H. Li, C. Wu, S. Zhu, and Z. Zheng, "Learning to backdoor federated learning," in ICLR 2023 Workshop on Backdoor Attacks and Defenses in Machine Learning, 2023.
[18] Gu, K. Liu, B. Dolan-Gavitt, and Garg, "Badnets: Evaluating backdooring attacks on deep neural networks," IEEE Access, vol. 7, pp. 47230-47244, 2019.

---

ACM [19] D. Pessach and E. Shmueli, "A review on fairness in machine learning." ACM Comput. Surv., vol. 55, feb 2022.
[20] N. Mehrabi, F. Morstatter, N. Saxena, K. Lerman, and A. Galstyan, "A survey on bias and fairness in machine learning," ACM Comput. Surv., vol. 54, jul 2021.
[21] S. Sagawa", P. W. Koh*, T. B. Hashimoto, and P. Liang, "Distributionally robust neural networks," in International Conference on Learning Representations, 2020.
[22] S. Seo, J.-Y. Lee, and B. Han, "Unsupervised learning of debiased representations with pscudo- attributes," in 2022 IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 11721-1667666 2022.
[23] Y. Cao and J. Yang. "Towards making systems forget with machine unlearning," in 2015 IEEE symposium on security and privacy, pp. 463 480, IEFE, 2015.
[24] M. Chen, Z. Zhang. T. Wang, M. Backes, M. Humbert, and Y. Zhang, "When machine unlearning jeopardizes privacy," in Proceedings of the 2021 ACM SIGSAC Conference Computer and Communications Security. CCS '21, (New York, NY, USA), p. 896-911, Association for Computing Machinery, 2021.
[25] S. Garg, S. Goldwasser, and P. N. Vasudevan, "Formalizing data deletion in the context of the right to be forgotten," in 39th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10-14, 2020, Proceedings. vol. 12105 of Lecture Notes in Computer Science, Springer, 2020.
[26] A. Thudi, H. Jia, I. Shumailov, and N. Papernot, "On the necessity of auditable algorithmic definitions for machine unlearning." " in USENIX Security Symposium, 2021.
[27] T. T. Nguyen, T. T. Huynh, L. Nguyen, A. W.-. Liew, H. Yin, and Q. V. H. Nguyen, "A survey of machine unlearning." 2022.
(28) I. Bourtoule, V. Chandrasekaran, C. A. Choquette-Choo H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot, "Machine unlcarning," in 2021 IEEE Symposium on Security and Privacy (SP), pp. 141-159, 2021.
[29] H. Yan, X. Li, Z. Guo, H. Li, F. Li, and X. Lin, "Arcane: An efficient architecture for exact machine unlearning," in Proceedings of the Thirty-First International Joint Conference on Arti- ficial Intelligence, IJCAI-22 (L. D. Raedt, ed.), pp.
International Joint Conferences on Artificial Intelligence Organization, 7 2022. Main Track.
[30] J. Xu, Z. Wu, C. Wang, and X. Jia, "Machine unlearning: Solutions and challenges," ArXiv, vol. abs/2308.07000 000611, 2023.
[31] H. Xu, T. Zhu, L. Zhang, W. Zhou, and P. S. Yu, "Machine unlearning: A survey," ACM Comput. Sure, vol. 56, aug 2023.
[32] L. Graves, V. Nagisetty, and Ganesh, "Amnesiac machine learning," in AAAI Conference on Artificial Intelligence, 2020.
[33] J. Kim and S. S. Woo, "Efficient two-stage model retraining for machine unlearning." in 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 4360-4368, 2022.
[34] S. Lee and S. S. Woo, "Undo: Effective and accurate unlearning method for deep neural networks," in Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, pp. 4043 4047, 2023.
[35] M. Chen, W. Gao, G. Liu, K. Peng. and C. Wang. "Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary," in 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7766-7775, 2023.
[36] T. Shibata, G. Trie, D. Ikami, and Y. Mitsuzumi, "Learning with selective forgetting." " in International Joint Conference Artificial Intelligence, 2021.
12

---

[37] H. Huang. X. Ma, S. M. Erfani, J. Bailey, and Y. Wang, "Unlearnable examples: Making personal data unexploitable," in International Conference on Learning Representations, 2021.
[38] J. Z. Di, J. Douglas, J. Acharya, G. Kamath, and A. Sekhari, "Hidden poison: Machine unlearning enables camouflaged poisoning attacks," in Workshop on Trustworthy and Socially Responsible Machine Learning, NeurIPS 2022, 2022.
[39] A. K. Tarun, V. S. Chundawat, M. Mandal, and M. Kankanhalli, "Fast yet effective machine unlearning." " IEEE Trunsactions on Neural Networks and Learning Systems, pp. 1-10, 2023.
[40] V. S. Chundawat, A. K. Tarun, M. Mandal, and M. Kankanhalli, "Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher," Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, pp. 7210-7217, Jun. 2023.
[41] X. Zhang, J. Wang, N. Cheng, Y. Sun, C. Zhang, and J. Xiao, "Machine unlearning methodology based on stochastic teacher network," " in Advanced Data Mining and Applications (X. Yang, H. Suhartanto, G. Wang. B. Wang, J. Jiang, B. Li, H. Zhu, and N. Cui, eds.), (Cham), pp. 250- 261, Springer Nature Switzerland, 2023.
[42] M. Kurmanji, P. Triantafillou. J. Hayes, and E. Triantafillou, "Towards unbounded machine unlearning," in Shirty-seventh Conference on Neural Information Processing Systems, 2023.
[43] Y. Jung, I. Cho, S.-H. Hsu, and J. Hockenmaier, "Attack and reset for unlearning: Exploiting adversarial noise toward machine unlearning through parameter re-initializationn." 2024.
[44] T. Hoang, S. Rana, S. Gupta, and S. Venkatesh, "Learn to unlearn for deep neural networks: Minimizing unlearning interference with gradient projection," in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp.
January 2024.
[45] A. Abbasi, C. Thrash, E. Akbari, D. Zhang, and S. Kolouri, "Covarnav: Machine unlearning via model inversion and covariance navigation," 2023.
[46] D. Choi and D. Na, "Towards machine unlearning benchmarks: Forgetting the personal identities in facial recognition systems," 2023.
[47] S. Goel, A. Prabhu, A. Sanyal, S.-N. Lim, Torr, and Kumaraguru, "Towards adversarial evaluations for inexact machine unlearning," 2023.
[48] A. Golatkar, A. Achille, and S. Soatto, "Eternal sunshine of the spotless net: Selective forgetting in deep networks." in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9301-9309, 2020.
[49] A. Golatkar, A. Achille, and S. Soatto, "Forgetting outside the box: Serubbing deep networks of information accessible from input-output observations." in Computer Vision ECCV 2020 (A. Vedaldi, H. Bischof, T. Brox, and J.-M. Frahm, eds.), (Cham), pp. 383-398, Springer International Publishing, 2020.
[50] A. Golatkar, A. Achille, A. Ravichandran, M. Polito, and S. Soatto, MMixxd--rrvacyy forgetting in deep networks," in 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 792-801, 2021. 2021.
[51] C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, "Certified data removal from machine learning models." " in Proceedings of the 37th International Conference on Machine Learning (H. D. III and A. Singh, eds.), vol. 119 of Proceedings of Machine Learning Research, pp. 3832-3842, PMLR, 13-18 Jul 2020.
[52] J. Foster, S. Schoepf, and A. Brintrup, "Fast machine unlearning without retraining through selective synaptic dampening," 2023.
[53] C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, "Certified data removal from machine learning models," in Proceedings of the 37th International Conference Machine Learning (H. D. III and A. Singh, eds.), vol. 119 of Proceedings of Machine Learning Research, pp. 3842- PMLR, 13-18 Jul 2020.
13

---

[54] C. Wu, S. Zhu, and P. Mitra, "Federated unlearning with knowledge distillation," 2022.
[55] G. Liu, X. Ma, Y. Yang, C. Wang, and J. Liu, "Federaser: Enabling efficient client-level data removal from federated learning models," in 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS), pp. 1-10, 2021.
[56] W. Yuan, H. Yin, F. Wu, S. Zhang. He, and H. Wang, "Federated unlearning for on-device recommendation," in Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining, WSDM '23, (New York, NY, USA), p. 393-401, Association for Computing Machinery, 2023.
[57] X. Cao, J. Jia, Z. Zhang, and N. Z. Gong. "Fedrecover: Recovering from poisoning attacks in federated learning using historical information," in 2023 IEEE Symposium Security and Privacy (SP), pp. 3866-138,, 2023.
[58] X. Gao, X. Ma. J. Wang, Y. Sun, B. Li, S. Ji, P. Cheng, and J. Chen, "Verifi: Towards verifiable federated unlearning." 2022.
[59] G. Ye, T. Chen, Q. V. Hung Nguyen, and H. Yin, "Heterogeneous decentralised machine unlearning with seed model distillation," CAAI Transactions on Intelligence Technology, 2024.
[60] N. Su and B. Li, "Asynchronous federated unlearning," in IEEE INFOCOM 2023 IEEE Conference on Computer Communications, pp. 1-10, 2023.
[61] L. Zhang, T. Zhu, H. Zhang, P. Xiong, and W. Zhou, "Fedrecovery: Differentially private machine unlearning for federated learning frameworks," IEEE Transactions on Information Forensics and Security, vol. 18, pp. 4732-4746, 2023.
[62] A. Halimi, S. Kadhe, A. Rawat, and N. Baracaldo, "Federated unlearning: How to efficiently erase a client in f!?," 2023.
[63] G. Li, L. Shen, Y. Sun, Y. Hu, H. Hu, and D. Tao, "Subspace based federated unlearning." 2023.
[64] M. Alam, H. Lamri, and M. Maniatakos, "Get rid of your trail: Remotely erasing backdoors in federated learning," 2023.
[65] Wang. S. Guo, X. Xie, and H. Qi, "Federated unlearning via class-discriminative pruning," in Proceedings of the ACM Web Conference 2022, WWW '22, (New York, NY, USA), p. 622-632, Association for Computing Machinery, 2022.
[66] Y. Zhao, P. Wang. H. Qi, Huang, Z. Wei, and Q Zhang, "Federated unlcarning with momentum degradation," IEEE Internet of Things Journal, pp. 1-1, 2023.
[67] Y. Liu, L.. Xu, X. Yuan, C. Wang, and B. Li, "The right to forgotten in federated learning: An efficient realization with rapid retraining." in IEEE INFOCOM 2022 IEEE Conference Computer Communications, pp. 1749-1758, 2022.
[68] A. Dhasade, Y. Ding, S. Guo, A. marie Kermarrec, M. D. Vos, and I.. Wu, "Quickdrop: Efficient federated unlearning by integrated dataset distillation." 2023.
[69] P. Wang, Z. Yan, M. S. Obaidat, Z. Yuan, L. Yang. J. Zhang. Z. Wei, and Q. Zhang, "Edge caching with federated unlearning for low-latency v2x communications." IEEE Communications Magazine, pp. 1-7, 2023.
[70] H. Xia, S. Xu, J. Pei, R. Zhang, Z. Yu, W. Zou, L. Wang, and C. Liu, "Fedme2: Memory evaluation & erase promoting federated unlearning in dtmn," IEEE Journal on Selected Areas in Communications, vol. 41, no. 11. pp. 3573-3588, 2023.
[71] S. Moon, S. Cho, and D. Kim. "Feature unlcarning for pre-trained gans and vaes," in AAAI Conference Artificial Intelligence, 2023.
[72] Bae, Kim, Jung, and W. Lim, "Gradient surgery for one-shot unlearning on generative model." 2023.
14

---

[73] Anonymous, "Machine unlearning for image-to-image generative models," in The Twelfth International Conference on Learning Representations, 2024.
[74] W. Wang, H. Bai, J. tse Huang, Y. Wan, Y. Yuan, H. Qiu, N. Peng, and M. R. Lyu, "New job, new gender? measuring the social bias in image generation models," 2024.
[75] Y. Yao, X. Xu, and Y. Liu, "Large language model unlearning." 2023.
[76] C. Yu, S. Jeoung, A. Kasi, P. Yu, and H. Ji, "Unlearning bias in language models by partitioning gradients," in Findings of the Association for Computational Linguistics: ACL 2023 (A. Rogers, J. Boyd-Graber, and N. Okazaki, eds.), (Toronto, Canada), pp. 0032-6048, Association for Computational Linguisties, July 2023.
[77] Chen and D. Yang. "Unlearn what you want to forget: Efficient unlearning for LLMs," in Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (H. Bouamor, J. Pino, and K. Bali, eds.), (Singapore), pp. 12041-12052, Association for Computational Linguisties, Dec. 2023.
[78] Y. Yoshida and T. Miyato, "Spectral norm regularization for improving the generalizability of deep learning," arXiv preprint /70. 2017.
[79] A. M. Oberman and J. Calder, "Lipschitz regularized deep neural networks converge and generalize," " CoRR, vol. abs/1 808.09540, 2018.
[80] G. Khromov and S. P. Singh, "Some fundemental aspects about lipschitz continuity of neural networks," 2023.
[81] M. Usama and D. E. Chang, "Towards robust neural networks with lipschitz continuity," in Digital Forensics and Watermarking (C. D. Yoo, Y.-Q. Shi, H. J. Kim, A. Piva, and G. Kim, eds.), (Cham). pp. 373-389, Springer International Publishing, 2019.
[82] T.W.. Weng, H. Zhang, P.-Y. Chen, J. Yi, D. Su, Y. Gao, C.-J. Hsieh, and L. Daniel, "Evalu- ating the robustness of neural networks: An extreme value theory approach," in International Conference on Learning Representations, 2018.
[83] Y. Yoshida and T. Miyato, "Spectral norm regularization for improving the generalizability of deep learning," " 2017.
[84] Z. Liu, P. Luo, X. Wang, and X. Tang, "Deep learning face attributes in the wild," in 2015 IEEE International Conference Computer Vision (ICCV), pp. 3730-3738, 2015.
[85] Wenruliu, "Adult income dataset." Kaggle, 2024.
[86] M. Akturk, "Diabetes dataset." " Kaggle, 2024.
[87] Y. Djebrouni, N. Benarba, O. Touat, P. De Rosa, S. Bouchenak, A. Bonifati, P. Felber,
V. Marangozova, and V. Schiavoni, "Bias mitigation in federated learning for edge computing," Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., vol. 7, jan 2024.
[88] R. Chen, J. Yang, H. Xiong, J. Bai, T. Hu, J. Hao, Y. FENG, T. model debias with machine unlearning." " in Thirty-seventh Conference on Neural Information Processing Systems, 2023.
T. Zhou, J. Wu, and Z. Liu, "Fast
[89] Y. Lecun, L. Bottou, Y. Bengio, and Haffnnr, "Gradient-based learning applied document recognition," Proceedings of the IEEE, vol. 86, no. 11, pp. 2278-2324, 1998.
[90] K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition." in 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770-778, 2016.
[91] H. Xiao, K. Rasul, and R. Vollgraf, "Fashion-mnist. a novel image dataset for benchmarking machine learning algorithms," arXiv preprint arXiv:1708.0 07747, 2017.
[92] A. Krizhevsky, "Learning multiple layers of features from tiny images," Toronto, ON, Canada, 2009.
15

---

[93] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, "Imagenet: A large- scale hierarchical image database," " in 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248 255, 2009.
[94] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, "Bert: Pre-training of deep bidirectional transformers for language understanding," in North American Chapter of the Association for Computational Linguistics, 2019.
[95] A. L. Maas, R. E. Daly, P. T. Pham, D. Huang, A. Y. Ng, and C. Potts, "Learning word vectors for sentiment analysis." in Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies (D. Lin, Y. Matsumoto, and R. Mihalcea, eds.), (Portland, Oregon, USA), pp. 142-150, Association for Computational Linguistics, June 2011.
[96] R. Selvaraju, M. Cogswell, A. Das, Vedantam, D. Parikh, and D. Batra, "Grad-cam: Visual explanations from deep networks via gradient-based localization," in 2017 IEEE International Conference on Computer Vision (ICCV), pp. 618-626, 2017.
16

---

A Appendix
A.1 Proof of Theorem
As illustrated in Sec. 3.2 it is hard to build the unlearned data x² for the feature unlearning since adding the perturbation may influence the model accuracy seriously. Suppose the feature success- fully removed when the norm of perturbation is larger than C. We define the utility loss & with unlearning feature successfully:
4 min (a min (fo(2 0g). |6 120
(10)
And define the maximum utility loss with the norm perturbation less than C as:
f max (aay)e min (fo( + 85).
(11)
16s ice
8
Assumption 3. Assume l2 < f
Assumption Belucidates that the utility loss associated with perturbation norm less than C' is smaller than the utility loss when the perturbation norm is greater than C. This assumption is logical, as larger perturbations would naturally lead to greater utility loss.
Assumption 4. Suppose the federated model achieves zero training loss.
have the following theorem to elucidate the relation between feature sensitivity removing Alg. D and exact unlearning (see proof in Appendix).
Theorem If Assumption 3 Badd4hold hold, the utility loss of unlearned model obtained by Alg. iis less than the utility loss with unlearning successfully, i.e.,
la $ l
(12)
where l, = EED (e)fo(x)),))
(x),
Proof. When the unlearning happens during the federated training, the unlearning clients would also optimize the training loss and feature sensitivity simultaneously. Specifically, the optimization process could be written as:
[o((x) Solo + 85 12))
0g arg argmin min ((DDED (((fo(z),)) + |
|
where S C is one coefficient. Without loss of generalitty, we assume the {(fe(z). v) (ffoor)-v)ll Denote
θ arg E ((
If Assumption hollss, then for (x) = for any 0" E O³. Therefore, for any À < | < C' Cusch that
(ay)en (e(fo-(x), + AE (z lscc [fo(x) for (x + 85 )l12
180 1|
= =AE E 11 - for (x + 88)1l2
(13)
15
S EE BAsl fo. (x 862
17

---

Therefore, we further obtain:
Lu = min (E) ( (e(fo(z). + A [1f((z)
So(a + dz 1ll
BER"
16 1l2
I min (ay) (((fo()(((( (((fo(z)))) + XE |s [f(())
folx + des d
M00
|00 ll2
min E Ma scc D0
fa- (x 65)112
I E (z.9)
min y fo- (r + 57 lll
(14)
BAgllón
min lyy fo. (x d5 l22
de
S max I (aw)e
min byy fo (x 85)112
BeRd
max E
(nyye
min lyy fo- (x + 83 112
|601|5C
BERd
l2.
According to Assumption 3 have la S 4
A.2 Experimental Setup
Both the MNIST [89] and Feshion--MNIST//MWWSST [91] datasets contain images of handwritten digits and attire, respectively. Each dataset comprises 60,000 training examples and 10,000 test examples. In both datasets, each example is represented as a single-channel image with dimensions 28x28 pixels, categorized into one of 10 classes. Additionally, the Colored- CNNSS(CMNIST) 89) dataset, extension of the original MNIST, introduces color into the digits of each example. Consequently, images in the Colored MNIST dataset are represented in three channels. CIFAR [92 The CIFAR-10 92 dataset comprises 60,000 images, each with dimensions of 32 32 pixels and three color channels, distributed across 10 classes. This dataset includes 6,000 images per class and is partitioned into 50,000 training examples and 10,000 test examples. Similarly, the CIFAR-100 [92] dataset shares the same image dimensions and structure as CIFAR-1O but extends to 100 classes, with each class containing 600 images. Within each class, there are 500 training images and 100 test images. Moreover, CIFAR-IO0 organizes its 100 classes into 20 superclasses, forming the CIFAR-20 20 dataser (92). CelebA 84] A face recognition dataset featuring 40 attributes such as gender and facial characteristics, comprising 162,770 training examples and 19,962 test examples. This study will focus on utilizing the CelebA 84 dataset primarily for gender classification tasks. ImageNet [93] A scale image dataset which contains 1.2 million training samples across 1,000 categories.
Datasets MNIST 89
Adult Census Income (Adult) 885 includes 48, 842 records with 14 attributes such as age, gender, education, marital status, etc. The classification task of this dataset is predict if person earns over $50K a year based on the census attributes. We then consider marital status as the sensitive feature that aim to unlearn in this study. Diabetes (86) includes 768 personal health records of females at least 21 years old with 8 attributes such as blood pressure, insulin level, age and etc. The classification task of this dataset is to predict if person has diabetes. We then consider number of pregnancies as the sensitive feature that aim to unlearn in this study.
The IMDB movie reviews dataset [95] is widely used for binary sentiment analysis, where the task is to determine whether a review expresses a positive or negative sentiment. It comprises 50,000 movie reviews, each labeled as either positive negative. In this study, we focus unlearning the influence of specific sensitive features, particularly the names of celebrities. Each client's local dataset includes names of specific celebrities, which treated as sensitive features for this analysis.
Baselines
The baseline methods in this study:
Baseline: Original model before unlearning.
Retrain: In scenarios involving sensitive feature unlearning, the retrained model was simply trained using dataset where Gaussian noise was applied to the unlearned feature region. This approach
18

---

Label
4
5
7
9
2
CF
5
6
8
Input
Baseline
4
Retrain
Ferrari
Figure 9: MNIST
may lead performance deterioration, as discussed in Sec. 3.2 For backdoor feature unlearning scenarios, the retrained model was trained using the retain dataset D, also referred to as the clean dataset. biased feature unlearning scenarios, the retrained model was trained using a combination of 50% from each of the retain dataset D, (bias dataset) and the unlearn client local dataset Dy (unbias dataset). This ensures fairness the model's performance across both datasets.
Fine-tume: The baseline model is fine-tuned using the retained dataset D, for 5 epochs.
FedCDPP 65 A FU framework that achieves class unlearning by utilizing Term Frequency- Inverse Document Frequency (TF-IDF) guided channel pruning, which selectively removes the most discriminative channels related to the target category and followed by fine-tuning without retraining from scratch.
Clas-Discriminative
FedRecovery [61: A FU framework that achieves client unlearning by removing the influence of client's 's data from the global model using a differentially private machine unlearning algorithm that leverages historical gradient submissions without the need for retraining.
A.3 Attention Map
In this section, we provide additional results from attention map analysis based on GradCAM 96 for backdoor feature unlearning (refer to Sec. 1.c. and biased feature unlearning (refer to Sec. A.3.2
A.3.1 Backdoor Feature Unlearning
Attention map analysis for backdoor samples across model iterations of baseline, retrain, and unlearn model using our proposed Ferrari method on MNIST (Fig. 9). FMNIST (Fig. [0). CIFAR-10 (Fig
CIFAR-20 (Fig. 12 and CIFAR-100 (Fig. B3
datasets.
Label
Trouser
Pullower
Dress
Coat
Sandal
Shirt
Sneaker
Bag
Boot
Input
Baseline
Retrain
Ferrari
Figure 10: FMNIST
19

---

Label
Car
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Input
Baseline
Retrain
Ferrari
Figure 11: CIFAR-10
Label
Fish
Flowers
Cont.
Fruit
Device
Furniture
Insects
Carniv,
Synthetic
Input
Baseline
Retrain
Ferrari Label
Natural
Omniv.
Medium
Inverteh.
People
Reptiles
Small
Trees
Vehicles
Input
Baseline
Retrain
Ferrari
Figure 12: CIFAR-20
20

---

Label
Fish
Baby
Bear
Beaver
Bod
Bee
Beetle
Bicycle
Bottle
Input
Baseline
Retrain
Ferrari Label
Boy
Bridge
Bus
B.fl
Camel
Can
Castle
C.plar
Cartle
Input
Baseline
Retrain
Ferrari Label
Chimpz.
Clock
Cloud
C.krch
Couch
Crab
Croc.
Cup
Dino.
Input
Baseline
Retrain
Ferrari Label
phphant
Fffihh
Forest
Fox
Girl
Hamster
House
K,groa
K.board
Input
Baseline
Retrain
Ferrari Label
Mower
Leopard
Lion
Lizard
Lobster
Man
Mapple
M.cycle
Mountain
Input
Baseline
Retrain
Ferrari
Continued page
21

---

Continued from previous page
Label
Mushe.
Oak
Orange.
Orchid
Otter
Palm
Pear
Pickup
Pine
Input
Baseline
Retrain
Ferrari Label
Plate
Poppy
Porep.
Possum
Rabbit
Race.n
Ray
Road
Rocket
Input
Baseline
Retrain
Ferrari Label
Sea
Seal
Shark
Shrew
Skunk
Skyser
Snail
Snake
Spider
Input
Baseline
Retrain
Ferrari Label
Car
S.flwe
S.pepr
Table
Tank
Phone
TV
Tiger
Tractor
Input
Baseline
Retrain
Ferrari Label
Trout
Tulip
Turtle
W.drobe
Whale
Willow
Woman
Worm
Input
Baseline
Retrain
Ferrari
Figure 13: CIFAR-100
22

---

A.3.2 Biased Feature Unlearning
Label
Female
Male
Target
Baseline
Retrain
Ferrari
(a) Bias Dataset
Label
Female
Male
Target
Baseline
Retrain
Ferrari
(b) Unbias Dataset
Figure 14:
Attention map analysis for bias and unbias samples model iterations of baseline, retrain, and unlearn model using our proposed Ferrari to unlearn 'mouth' on CelebA dataset.
A.4 Lipschitz and Non-L.ppshiizz Loss Analysis
In this section, we evaluate the Lipschitz loss function and its effectiveness in optimizing feature sensitivity, described in Eq. 6 We also examine variant without the denominator, termed the Non-Lipschitz loss, as illustrated in Fig. [5]
The results indicate that models optimized using the Non-Lipschitz loss exhibit fluctuations across batches. This due to the unbounded nature of the optimization process, leading to useless models. Fig. 8a further illustrates this issue, showing instances of catastrophic forgetting.
23

---

MNIST
FMNIST
CIFAR-I0
CIFAR-20
CIFARIO0
Non- Non-Lipscchtz Lipsehitz
Kal
Figure 15: Lipschitz and Non-Lipschitz loss analysis on backdoor feature unlearning.
100
y=1
100
90
93.27
35.03
y-1
y 10
y= 10
80
LD
70
Accurucy(55)
Accuracy
60
00.52
90
99.64
89.1
50
57.19 37.61
40
36.41
30
85
20
10
80
0000
0.11
018 0.2
Hascline
Retrain
Ferrari
Baseline
Retrain
Ferrari
Method
Method
(a) Dr
(b) Dr,
Figure 16: Non-IID analysis on the CIFAR-10 dataset using our proposed Ferrari framework, compared to Baseline and Retrain methods, for retain client dataset D, and unlearn client dataset D accuracy in backdoor feature unlcarning.
Conversely, models optimized with the Lipschitz loss demonstrate a steady reduction in feature sensitivity over batches. This bounded optimization provided by Lipschitz bound helps in effectively unlearning target features while preserving model utility, as theoretically guaranteed (see Section Sec. 4.3
A.5
Non-IID Analysis
This section presents analysis of the impact of Non-lID data the performance of the proposed Ferrari framework compared to the Baseline and Retrain methods on the CIFAR-10 dataset. We focus the accuracy of the retain client dataset (D2,) and the unlearn client dataset (DD,) in backdoor feature unlearning, as illustrated in Fig 16) To measure the extent Non-III,, we used the Dir(t) distribution, where smaller values of y indicate more heterogeneous data.
The results show that the Ferrari framework significantly improves feature unlearning performance, with drop of approximately 0.2% in D. when 7 1 compared to the IID scenario. Furthermore, Ferrari framework maintains successfully the accuracy D, with only a slight decrease of about 2% compared to the Retrain method within the NID-IID scenario.
A.6 Client Numbers Analysis
This section analyzes the impact of large-scale FL environment, characterized by large number of clients, on the performance of the proposed Ferrari framework compared to the Baseline and Retrain methods the CIFAR-10 dataset. We focus on the accuracy of the retained client dataset (D,) and the unlearned client dataset (D..) in backdoor feature unlearning, as illustrated Fig 17 The results indicate that the unlearning performance of our proposed Ferrari framework remains

---

100
100
46
$4,92
91.73
Client
90
Client 10
20
Client
80
Client
Accuract %)
Accuracy(
70
60
59.76 29.58
50
87.63 81.59
40
30
85
20
10
80
0008
0/00
000
022
Baseline
Retrain
Ferrari
Baseline
Retrain
Ferrari
Method
Methed
(a) Dr
(b) D..
Figure 17: Scability analysis of client numbers on the CIFAR-10 dataset on the accuracy of retain client dataset D, and unlearn client dataset D.,
consistent, with no significant changes in the accuracy of both Dr and D. as the number of clients increases. This finding further demonstrates the effectiveness the Ferrari framework large-scale FL environments.
25

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's s contributions and scope?
Answer: [Yes]
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Guidelines:
The answer NA means that the paper does not include theoretical results.
26

---

All the theorems, formulas, and proofs in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proof' provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Guidelines:
The answer NA means that the paper does include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g.. with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [NA]
Guidelines:
The answer NA means that paper does not include experiments requiring code.
27

---

Please see the NeurIPS code and data submission guidelines (https://nips.c for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
guwdes/ www.eeeuuumissioooollooooe
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma еrror bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
28

---

8. Experiments Compute Resourees
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (c.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
29

---

Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, if possible, include URI..
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of in the package should be provided. For popular datasets, papprswii thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. If this information is available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
30

---

Answer: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
31


Reviews:
[{"review_id": "zEKpVSuSD6", "reviewer": "Reviewer_HLpG", "summary": "The paper identifies two main challenges, which is 1) evaluating the unlearning effectiveness without rebuilding the dataset without the unlearned feature, and 2) achieving feature unlearning in Federated Learning without requiring data or computational resources from other clients. The authors define a concept of  ‘feature sensitivity’ based on Lipschitz continuity to evaluate the effectiveness of feature unlearning. This metric measures how sensitive the model output is to perturbations in the input feature. Federated Feature Unlearning (Ferrari), has an objective to minimize ‘feature sensitivity’ to achieve feature unlearning in federated unlearning. It allows clients to unlearn specific features from the global model without needing other clients' participation. The paper provides theoretical proofs and experimental results demonstrating effectiveness in various scenarios (sensitive, backdoor, biased feature unlearning). It shows minimal loss in model utility compared to exact feature unlearning methods.", "questions": "1. Can you provide more insights into the computational overhead and scalability of Ferrari, particularly when dealing with a lot of clients?\n\n2. In the experiments, learning rate and Gaussian noise levels are mensioned as hyperparmeters. How much is the Ferrari sensitive to hyperparameters like these, or other than these?", "limitations": "1. In federated learning, clients may drop out or join during training or unlearning. Or the performance effect of using federated unlearning on long term is unknown. I would like to suggest about considering making the framework robust to these kinds of real world scenarios.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.  Novelty: The presented framework, Ferrairi, appers to be novel, as the focus on minimizing feature sensitivity is a new perspective on ensuring data privacy and integrity in federated unlearning.\n\n2.  Effectiveness: It is a practical and effective solution for federated unlearning, without requiring participation of all clients. It is designed to require only the local datasets from the unlearned clients, thereby reducing the overhead. It also achieves effectiveness by achieving unlearning in a short amount of time.\n\n3. Extensive experiments, and theoretical analysis and proof: The authors provide empirical experimental results through various datasets and scenarios, while showing the effectiveness of their methods. Also, their theoretial analysis shows that ferrari achives less utility loss compared to exact feature unlearning, reinforcing its effectiveness.", "weaknesses": "1. There is no evaulation on the scalability of the proposed framework. While the experiments used various datasets, the scale and dataset sizes seem to be relatively small. (MNIST, CIFAR, CelebA). It would be better to provide results on performance on large scale environments to prove generalization ability.\n\n2. While it is true that the suggested Ferrari has significant reduction in terms of unlearning time, in terms of computational complexity, it would be better to include actual computational cost metrics such as FLOPs. \n\n3.  The theoretical analysis in the paper relies on certain assumptions, such as zero training loss and specific data distribution characteristics, which may not always hold in real-world scenarios. \n\n4. Also there are a few minor mistakes and typos in the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "`` 1. Large-Scale Dataset ``\n\nThank you. As requested, we conducted additional experiments using the ImageNet dataset to assess the generalization ability of our proposed framework. Below are the tables summarizing the results. These results demonstrate that our framework performs well  even in large-scale environments, confirming its robustness and ability to generalize effectively. Specifically, the results show low $D_u$ accuracy while maintaining high test accuracy, indicating high model utility.\n\n> * Model Utility Analysis:\n\n| **Scenarios** | **Datasets** | **Unlearn Feature** | **Baseline**       | **Retrain**        | **Fine-tune**      | **FedCDP**         | **FedRecovery**    | **Ours** |\n|---------------|--------------|---------------------|--------------------|--------------------|--------------------|--------------------|--------------------|------------------------|\n| Backdoor  | ImageNet | Backdoor Pixel Pattern | 52.86 ± 4.14      | 67.18 ± 2.07       | 67.52 ± 1.69| 31.17 ± 3.96       | 12.75 ± 5.27       | 65.36 ± 1.84           |\n\n> * Unlearning Effectiveness Analysis:\n\n| **Scenarios** | **Datasets** | **Unlearn Feature** |       | **Baseline**       | **Retrain**        | **Fine-tune**      | **FedCDP**         | **FedRecovery**    | **Ours**           |\n|---------------|--------------|---------------------|-------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|\n| Backdoor  | ImageNet | Backdoor Pixel Pattern | **$\\mathcal{D}_r$** | 52.35 ± 2.25       | 67.05 ± 1.29       |67.34 ± 2.73| 29.74 ± 4.72       | 13.46 ± 6.53       | 65.74 ± 1.32       |\n|               |              |                     | **$\\mathcal{D}_u$** | 83.16 ± 3.74       | 0.00 ± 0.00        | 71.48 ± 3.69       | 62.39 ± 3.05       | 54.92 ± 5.59       | 0.09 ± 0.02    |\n\n`` 2. Computational Overhead & Scability ``\n\nThank you. As requested, We present the computational complexity of Ferrari using FLOPs metrics, as shown in Fig 5 of the rebuttal PDF. Our Ferrari framework exhibits the lowest FLOPs, achieved by accessing only the local dataset of the unlearned client and minimizing feature sensitivity within a single epoch.\n\nFor scalability, Ferrari remains effective in large-scale FL environments, as shown in the client number analysis in Fig 4 of the rebuttal PDF. It exhibits less than 0.5\\% accuracy deterioration for the retain client dataset $D_r$ and less than 0.1\\% for the unlearn client dataset $D_u$.\n\n`` 3. Theoretical Analysis ``\n\nThank you and we will elaborate more on Assumption 1-2. \n\n- First, Assumption 1 elucidates that the utility loss associated with a perturbation norm less than $C $ is smaller than the utility loss when the perturbation norm is greater than $C$. **This assumption is logical, as larger perturbations would naturally lead to greater utility loss.**\n\n- Second, **we could also extend the Theorem 1 to the case of the non-zero training loss**. This is because\n\n\\begin{equation}\n   \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\left( \\|\\| f\\_{\\theta^*}(x) - y \\|\\| + \\lambda \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\frac{\\|\\|f\\_\\theta(x) - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2}{\\|\\|\\delta\\_{F}\\|\\|_2} \\right) \\\\\n\\end{equation}\n\n\\begin{equation}\n  = \\mathbb{E}_{(x,y)\\in \\mathcal{D}} \\mathcal{l}\\|\\| f\\_{\\theta^*}(x) - y \\|\\| + \\lambda \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\frac{\\|\\|f\\_\\theta(x) - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2}{\\|\\|\\delta\\_{F}\\|\\|_2}\n\\end{equation}\n\n\\begin{equation}\n  \\leq \\mathbb{E}_{(x,y)\\in \\mathcal{D}} \\mathcal{l} \\|\\| f\\_{\\theta^*}(x) - y \\|\\| + \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\|\\|f\\_\\theta(x) - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2\n\\end{equation}\n\n\\begin{equation}\n  \\leq  \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\|\\|y - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2\n\\end{equation}\n\nwhich obtain Eq. (13) in appendix (noted that $\\|\\delta_\\mathcal{F}\\| \\geq \\frac{1}{\\lambda}$ in original appendix should be $\\|\\delta_\\mathcal{F}\\| \\geq {\\lambda}$).\n\n`` 4. LR & Gaussian Noise ``\n\nWe considered the sensitivity of Gaussian noise levels in our proposed framework, as shown in Fig 7(a) (main paper).  Within the range from 0.05 to 1.0, retain client dataset $D_r$ accuracy stays high and unlearn client dataset $D_u$ accuracy remains low, indicating a balance. Thus, we implement noise value within this range in our proposed framework for balanced accuracy across $D_r$ and $D_u$.\n\nIn Fig 2 of the rebuttal PDF, we analyze the learning rate hyper-parameter for Ferrari, ranging from 0.00001 to 0.01. Our findings show that a larger learning rate slightly decreases accuracy on both $D_r$ and $D_u$, while a lower learning rate slightly improves accuracy. A learning rate of 0.0001 provides a satisfactory balance, with less than a 2\\% change in accuracy for $D_r$ and less than a 0.2\\% change for $D_u$. Thus, we selected 0.0001 for all experiments in this study.\n\nTherefore, the unlearning effectiveness of our proposed framework is not sensitive to the learning rate but is sensitive to the level of Gaussian noise.\n\n`` 5. Client Participation Affect ``\n\nThank you for your suggestion. We would like to clarify that our proposed framework remains effective even when clients drop out or join during training or unlearning. This robustness is due to our framework’s reliance solely on the participation of the unlearning client and their local dataset for local feature unlearning. As demonstrated in Fig 2 and Alg 1 of our main paper, our framework minimizes feature sensitivity, ensuring effective unlearning regardless of broader client participation. **This adaptability is a key advantage of our proposal.**\n\n``6. Minor Mistake``\n\nThank you for pointing out the minor mistakes and typos in the paper. We have carefully reviewed the manuscript and corrected these issues.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xW8LkuxCrj", "reviewer": "Reviewer_vD3D", "summary": "The rise of Federated Learning (FL) has led to the importance of the 'right to be forgotten', inspiring a need for Federated Unlearning (FU). Feature unlearning, particularly for removing sensitive, backdoor, and biased features, has attracted significant interest. However, current methods relying on the influence function are not suitable for FL since they require other clients' involvement, and there is a lack of assessment regarding the feature unlearning's effectiveness. To tackle these problems, the paper introduces a novel concept, feature sensitivity, derived from Lipschitz continuity, as a metric to evaluate feature unlearning efficiency, quantifying the impact of changes in input features on the model's output. A new federated feature unlearning framework named Ferrari is then proposed, which aims to minimize feature sensitivity. Thorough experimental evidence and theoretical analysis validate Ferrari's effectiveness in various feature unlearning cases, including those involving sensitive, backdoor, and biased features.", "questions": "- Further clarification is needed on the motivation for feature unlearning in FL. In the case of IID data, where clients share similar features, a single user's request for feature unlearning might face challenges in fully eliminating targeted features from the global model, given that the model has already learned similar patterns from other clients. While data erasure seems to provide a higher level of user safety, it is crucial to understand why users might opt for feature erasure instead.\n\n- In the context of Federated Unlearning (FU), privacy assurance takes precedence over utility loss analysis. Can the authors present a privacy analysis or provide relevant proof demonstrating the privacy guarantees of feature unlearning in the FU setting?\n\n- The paper discusses the utility loss of Ferrari; however, paradoxically, Table 1 reveals that Ferrari's utility is superior to retraining in some instances and even surpasses the baseline in specific cases. It would be beneficial if the authors could offer more insight to further explain this unexpected outcome.\n\n- Given the potential challenges posed by the non-IID data setting, it is essential to investigate Ferrari's performance under such conditions. Can the authors provide an exploration of Ferrari's effectiveness in a non-IID data scenario?\n\n- Concerns exist about Ferrari's privacy performance, as although it outperforms other baselines in defending against MIA, it still presents a relatively high probability of successful MIA attacks. This raises questions about users' willingness to use Ferrari for feature unlearning. Would the authors consider integrating additional techniques to enhance its privacy performance further?\n\n- Based on the observed outcomes from the MIA, doubts arise about the adequacy of the proposed validation metric for evaluating feature unlearning performance. It appears that the metric may not accurately reflect the effectiveness of the feature unlearning process. Therefore, it would be valuable if the authors could delve deeper into analyzing the reasoning behind and the correctness of the designed evaluation metric, to either validate its reliability or suggest improvements for a more accurate assessment of feature unlearning.\n\n- Considering that the selected baselines such as FedCDP and FedRecovery are not tailor-made for feature unlearning, whether it is fair to compare directly with Ferrari needs further clarification.", "limitations": "Please kindly refer to the above comments in the Questions part.", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "+ This work offers a new FU framework that aims to minimize feature sensitivity, thereby achieving efficient unlearning from the perspective of features.\n+ This paper is the first to study challenging feature unlearning in the context of FL.\n+ Comprehensive and thorough evaluation.", "weaknesses": "- Further clarification is needed on the motivation for feature unlearning in FL.\n- The rationality of the designed feature unlearning evaluation metric remains to be discussed.\n- Further evaluation is needed in non-IID data scenarios.\n- The utility loss loss seems inconsistent with the numerical results.\n- The chosen baseline does not seem to be tailor-made for the evaluation task, which may lead to unfair comparisons.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "`` 1. Motivation ``\n\nThank you for raising this important question about the motivation for feature unlearning in Federated Learning (FL). In the case of IID data, where clients may share similar features, it is indeed valuable to consider the need for unlearning specific features. For example, a client may request the removal of the \"marital-status\" feature from their dataset. Even if other clients have the same feature, it remains essential for this client to remove any information related to their marital status. This underscores the significance of offering feature unlearning to address individual privacy concerns.\n\nFurthermore, as demonstrated by the experimental results in Tabs 2 and 3 (main paper), our proposed approach, Ferrari, can successfully remove a specific feature for one client even in an **IID setting**. This capability highlights Ferrari's effectiveness in addressing individual feature unlearning requests without compromising the global model's integrity.\n\nBeyond the IID scenario, we also consider the **Non-IID case**. One such example is addressed in response to your fourth question. Additionally, we explore the unlearning backdoor scenario, where backdoor data from one client has a different distribution compared to normal data. This further illustrates the necessity of feature unlearning to ensure model integrity and security in diverse data distributions.\n\nOverall, while data erasure provides a high level of user safety, feature unlearning offers a tailored approach to meet individual privacy needs, making it a crucial aspect of Federated Learning.\n\n`` 2. Proof ``\n\nAccording to [1], exact feature unlearning can be similarly defined as: $\\theta_u \\sim \\theta_r$, where $\\theta_u$ is the unlearned model and $\\theta_r$ is the retrained model using data $x+\\delta_{\\mathcal{F}}$. The proposed Ferrari framework aims to optimize\n\n\\begin{equation}\n\\min_\\theta \\mathbb{E}_{(x,y) \\in \\mathcal{D}_u} \\frac{1}{N} \\sum\\_{i=1}^N \\frac{\\|\\|f\\_\\theta(x) - f\\_\\theta (x + \\delta\\_{F,i})\\|\\|_2}{\\|\\|\\delta\\_{F,i}\\|\\|_2}\n\\end{equation}\n\nThis objective leads the unlearned model to approach the retrained model. In particular, when this loss approaches zero, the proposed Ferrari framework achieves exact unlearning.\n\n**Ref:**\n\n#### _[1] Bourtoule et. al, “Machine unlearning,” in 2021 IEEE Symposium on Security and Privacy (SP), pp. 141–159, 2021_\n\n`` 3. Utility Loss ``\n\nOur method is expected to outperform the \"naive retrain\" method in sensitive feature unlearning scenario. This is because adding Gaussian noise to the target unlearn feature region during retraining reduces model utility, as shown in Fig 1 (main paper). Equation (9) theoretically proves that our framework results in less utility loss than naive retraining, since larger loss leads to lower model performance. \n\n`` 4. Non-IID ``\n\nOur proposed framework remains effective for feature unlearning in Non-IID scenarios, as illustrated in Fig 3 of the rebuttal PDF. The results show that the Ferrari significantly improves feature unlearning performance, with only a 0.2\\% drop in $D_u$ when $\\gamma = 1$ compared to the IID scenario. Additionally, it maintains $D_r$\naccuracy with only a slight 2\\% decrease compared to the Retrain method in the Non-IID scenario.\n\n`` 5. MIA Privacy ``\n\nFerrari effectively defends against Model Inversion Attacks (MIA) [1, 2, 3] by preventing the reconstruction of the target unlearn features. As shown in Tab 3 (main paper), the attack success rate with our framework is similar to that of the naive retrain method, indicating that unlearned features are protected. In contrast, the baseline model before unlearning has a 90\\% attack success rate, highlighting severe data privacy risks. For other baselines like FedCDP and FedRecovery, the success rate is about 80\\%. Ferrari reduces this rate to around 50\\%, significantly enhancing privacy. Tab 4 (main paper) shows that our framework prevents reconstruction of the target unlearned feature (e.g., the mouth), whereas the baseline model does not.\n\n**Ref:**\n\n##### [1] _M. Fredrikson et al, “Privacy in pharmacoge\u0002netics: An end-to-end case study of personalized warfarin dosing,” Proceedings of the USENIX Security Symposium. UNIX Security Symposium, vol. 2014, pp. 17–32, 2014_\n\n##### [2] _Fredrikson et al, “Model inversion attacks that exploit confidence information and basic countermeasures,” CCS ’15, (New York, NY, USA), p. 1322–1333, Association for Computing Machinery, 2015_\n\n##### [3] _Y. Zhang et al, “The secret revealer: Generative model inversion attacks against deep neural networks,” in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 250–258, 2020_\n\n`` 6. MIA Metrics ``\n\nThank you for your enquiry. First, Model Inversion Attack (MIA) reconstructs the data from the unlearned model. We use the attack success rate of MIA to indicate whether the reconstructed data exposes the feature, as used in [1, 2, 3]. Second, besides MIA evaluation, we also leverage backdoor accuracy, Feature Sensitivity, and visualization tools (GradCAM) to evaluate the unlearning effectiveness of different methods in Section 5.1 (main paper). \n\nThe references are the same as the references in question 5 above.\n\n`` 7. Baselines ``\n\nOur study compares against benchmark baselines in federated unlearning, such as FedCDP for class unlearning and FedRecovery for client unlearning, due to the absence of comparable baselines for feature unlearning in Federated Learning. This highlights the novelty and significance of our work. Our results show that current methods like FedCDP and FedRecovery are ineffective for specific feature unlearning scenarios, emphasizing our study's contribution.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VArp8gljFN", "reviewer": "Reviewer_49hC", "summary": "This paper introduces a novel framework named Ferrari, addressing two challenges for federated feature unlearning. Ferrari leverages Lipschitz continuity to minimize the feature sensitivity directly during the local unlearning process, demonstrating several key advantages, such as eliminating the requirement of other clients' participation, supporting various unlearning scenarios, and achieving less model utility loss. Both the theoretical proof and empirical results demonstrate the effectiveness of Ferrari in a variety of unlearning settings compared with other baselines.", "questions": "1. What does the dotted and solid line in Figure 7 mean? \n2.  How do you get the results of Figure 6? For me, if only retrain or fine-tune one specific client, the runtimes should be similar as Ferrari.", "limitations": "See the second point in weaknesses.", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. The authors propose a novel method for federated feature unlearning, demonstrating several key advantages, such as eliminating the requirement of other clients' participation, supporting various unlearning scenarios, and achieving less model utility loss. This approach somehow addresses two challenges during FL unlearning and makes some contributions to this particular field of research.\n2. The Ferrari method is applicable to a wide range of unlearning tasks and shows potential for integration with other unlearning techniques in the future.\n3. The authors have provided both theoretical proofs and empirical results to demonstrate the soundness and effectiveness of the proposed approach. \n4. The paper is clearly written and well-organized. It is easy to follow the authors' ideas and understand their ideas, including the problem formulation, challenges, and the proposed methods. The authors use clear figure and algorithm, i.e., Figure 2 and Algorithm 1, to show the procedure of their method. The notations and experimental results are clear and easy to read.\n5. The authors have conducted extensive experiments to demonstrate the effectiveness of Ferrari in a variety of unlearning settings and datasets compared with several baselines.", "weaknesses": "1. The authors should have provided more analysis on Non-Lipschitz besides the proofs, especially in the Ablation Studies section. \n2. Ferrari's performance heavily relies on the number of unlearned datasets, as shown in Figure 7 (b). In a real-world scenario, the unlearning client may ask to unlearn all the datasets, not just a small portion. \n3.  Minor issues: Gaussian Noise and the Number of Unlearned Datasets should be hyper-parameter tuning, not ablation studies. All the \nsingle quotes and double quotes in the paper are not in the correct formats.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "`` 1. Non-Lipschitz Analysis ``\n\nWe evaluate the Lipschitz loss function for optimizing feature sensitivity (Equation 6) and compare it with a variant lacking the denominator, termed the Non-Lipschitz loss (see Fig 1 of the rebuttal PDF). Results show that models using the Non-Lipschitz loss exhibit batch fluctuations and ineffective performance due to unbounded optimization, leading to catastrophic forgetting (Fig 7(c) in main paper). In contrast, models optimized with the Lipschitz loss achieve a steady reduction in feature sensitivity, effectively unlearning target features while maintaining model utility, as guaranteed theoretically (Section 4.3 of main paper)\n\n`` 2. Figure 7 Clarification ``\n\nIn Fig 7, the **solid line** represents the retain client dataset $D_r$ while the **dotted line** represents the unlearn client local dataset $D_u$ in Federated Learning scenario.\n\n`` 3. Figure 6 Clarification ``\n\nThe retrain model's runtime was measured by training the global model from scratch for 20-25 epochs until convergence, while the fine-tune model involved 5 epochs of fine-tuning the baseline model. In comparison, the Ferrari framework achieved local feature unlearning in just one epoch, resulting in significantly faster runtime than both the retrain and fine-tune methods.\n\n`` 4. Minor Issue ``\n\nTo address space constraints, we combined the ablation study and hyper-parameter analysis into Section 5.5, renamed \"Ablation and Hyper-parameter Analysis.\" This section separately discusses the Non-Lipschitz component and the Gaussian noise level and number of unlearned datasets. Additionally, we will correct all single and double quotes to the proper format.\n\n`` 5. Figure 7b Clarification ``\n\nSorry for the confusion. Actually, Fig 7(b) intention is to demonstrate that our framework requires only at least 70\\% of the unlearned client's local dataset to achieve optimal performance comparable to using the entire dataset. This highlights the framework's robustness and practicality, as it remains nearly optimal even when only 70\\% of the dataset is available due to data loss.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "K09BqsgmRd", "reviewer": "Reviewer_mo2d", "summary": "This paper studies the feature unlearning problem in the context of federated learning. The key idea is to interpret feature unlearning into model sensitivity at specific features. The proposed method which is called Ferrari is evaluated on different tasks which involves sensitive, backdoor, and biased feature unlearning.", "questions": "Major concerns:\n1. Suppose client i and client j have similar data point x. If client i claims to forget some \"key features\" while client j does not, the global model still has a chance to learn the \"key features\" without breaking the unlearning principle. Thus, using sensitivity reduction on the global model does not make sense. Similar to sample-wise unlearning in classification, you cannot simply interpret this form of unlearning as misclassifying this specific sample. I want to highlight this concern as I understand you are not the only one thinking in this way.\n2. Now that you provide examples of unlearning users' sensitive information like name and address, I would expect you to have experiments on a text dataset as strong evidence, which is so far lacking in the paper.\n\nOther minor questions:\n1. Please check the reference, [10] and [11] are repeated.\n2. After checking the paper [16], where they consider the malicious clients, I begin to understand “datasets contain backdoor triggers” you used. To be clearer, you’d better refer to local clients’ data.\n3. Regarding the third scenario, imbalance is only a possible source of bias in terms of some specific fairness metrics. Please be careful when using these concepts.\n4. The presented first challenge (line 32 on page 1) is interesting, while the second one should exist in client, class, or sample level. If so, you should put some efforts here to explain why this challenge remains by adapting existing strategies.\n5. Following 4, you claimed a different challenge (challenge 2) in the first contribution. \n6. Your method Ferrari is short for Federated Feature Unlearning, which is also the name of the learning problem. You’d better use different names.\n7. Repeated phrases in line 105 on page 3.\n8. Below Eq. 2, the unlearned feature set f is not indexed by sample i but this is true in the algorithm.", "limitations": "As I pointed out in Weaknesses & Questions, the technique may have some flaws in addressing the Federated Feature Unlearning problem. The experiments are primarily conducted on image samples, which cannot confidently prove the idea.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Federated unlearning is not something new in research community but focusing on feature unlearning is interesting. I agree with the authors that evaluating exact re-training for feature unlearning is a challenge to this research topic. The key idea of this paper is also straightforward and well-presented.", "weaknesses": "1. The challenges of this paper are not well presented.\n2. The sensitivity reduction is not a proper solution of federated feature unlearning.\n3. Important experiments are missing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "`` 1. Challenge of paper ``\n\nThank you for your suggestions. We clarify the second challenge from the original manuscript as follows:\n\nFirstly, previous feature unlearning methods [1, 2] in centralized settings are impractical for Federated Learning (FL), as they require access to all datasets and client participation. In FL, retained clients may refuse to participate due to privacy or computational concerns. Therefore, the most practical approach requires only the participation of the unlearn client.\n\nSecondly, existing approaches to Federated Unlearning primarily focus on unlearning at the client, class, or sample level. However, these methods do not address the challenge of feature unlearning in federated settings. They are limited to isolated data points and cannot manage the removal of specific features across multiple data points. Our results highlight that benchmark Federated Unlearning frameworks like FedCDP [3] and FedRecovery [4] struggle with effective feature unlearning in FL environments.\n\n**Ref:** \n\n#### _[1] Warnecke et. al, “Machine unlearning of features and labels,” in Proc. of the 30th Network and Distributed System Security (NDSS), 2023_\n\n#### [2] _Guo et. al, \"Efficient attribute unlearning: Towards selective removal of input attributes from feature representations.\" arXiv preprint arXiv:2202.13295 (2022)._\n\n#### [3] _Wang et. al, “Federated unlearning via class-discriminative pruning,” in Proceedings of the ACM Web Conference 2022, WWW ’22, (New York, NY, USA)_\n\n#### [4] _Zhang et. al, “Fedrecovery: Differentially private machine unlearning for federated learning frameworks,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 4732–4746, 2023_\n\n`` 2. Unlearning Concern ``\n\nThanks for you comments. First, **federated feature unlearning happens at the end of the federated training**. When the federated training ends, unlearned client implements the unlearning operation to obtain the unlearned model $\\theta_u$ finally the server replace the original model with $\\theta_u$. \n\nSecond, in the case of IID data, **it is valuable to unlearn features**. For instance, a client (Alice) may want to remove the \"marital-status\" feature from adult data. Even if other clients have the same feature, Alice still needs to remove this information (marriage status). \n\nThird, the experimental results in Tabs 2 and 3 (main paper) demonstrate that **the proposed Ferrari can successfully remove the feature of one client, even in the IID setting**.\n\nFinally, beyond the IID scenario, our framework remains effective for feature unlearning in Non-IID scenarios, as illustrated in Fig 3 of the rebuttal PDF. The results show that the Ferrari significantly improves feature unlearning performance, with only a 0.2\\% drop in $D_u$ when $\\gamma = 1$ compared to the IID scenario. Furthermore, considering the backdoor unlearning scenario, where backdoor data from one client has a different distribution compared to the normal data.\n\n`` 3. Text Dataset ``\n\nThank you for your suggestion. As suggested, we conducted text classification using the IMDB movie reviews dataset [1] with a BERT model to analyze feature unlearning by removing the influence of sensitive features, specifically celebrity names. Each client’s local dataset includes only a specific name of a celebrity. As to Table below, Ferrari framework proves highly effective, maintaining high model accuracy while achieving the lowest feature sensitivity and MIA attack success rate, thus preventing the reconstruction of sensitive features and enhancing data privacy.\n\n> - Model Utility Analysis:\n\n| **Scenarios**  | **Datasets** | **Unlearn Feature** | **Baseline**       | **Retrain**        | **Fine-tune**      | **FedCDP**         | **FedRecovery**    | **Ours** |\n|----------------|--------------|---------------------|--------------------|--------------------|--------------------|--------------------|--------------------|-----------------------|\n| Sensitive | IMDB     | Names               | 91.39 ± 1.57       | 83.27 ± 2.05       | 72.15 ± 1.92       | 48.36 ± 2.79       | 37.93 ± 2.84       | **89.15 ± 1.32**      |\n\n\n> - Feature Sensitivity Analysis:\n\n| **Scenario**  | **Datasets** | **Unlearn Feature** | **Baseline**          | **Retrain**           | **Fine-tune**         | **FedCDP**            | **FedRecovery**       | **Ours** |\n|---------------|--------------|---------------------|------------------------|------------------------|------------------------|------------------------|------------------------|------------------------|\n| Sensitive | IMDB     | Names               | 0.85 ± 1.07×10⁻²       | 0.07 ± 5.38×10⁻⁴       | 0.74 ± 3.81×10⁻²       | 0.81 ± 3.27×10⁻²       | 0.78 ± 2.41×10⁻²       | **0.08 ± 1.32×10⁻⁴**   |\n\n> - Model Inversion Attack Analysis:\n\n| **Scenario**   | **Datasets** | **Unlearn Feature** | **Baseline**       | **Retrain**        | **Fine-tune**      | **FedCDP**         | **FedRecovery**    | **Ours** |\n|----------------|--------------|---------------------|--------------------|--------------------|--------------------|--------------------|--------------------|-----------------------|\n| Sensitive  | IMDB     | Names               | 90.28 ± 2.49       | 40.29 ± 1.59       | 86.74 ± 3.81       | 83.67 ± 4.59       | 80.95 ± 3.51       | **43.75 ± 1.86**      |\n\n**Ref:** \n\n#### _[1] https://www.kaggle.com/datasets/lakshmi25npathi/imdb-dataset-of-50k-movie-reviews_\n\n`` 5. Minor Issues ``\n\n- The repetitive references have been removed in our manuscript, preventing confusion for the reader.\n\n- Thank you for your suggestion. We will make the necessary changes to enhance the clarity of our work.\n\n- Thank you for your suggestion. We will request permission from TPC to update the short title of this paper. If approve, we will update the title accordingly.\n\n- Repeated phrases in line 105 has been removed to improve the readability.\n\n- We corrected the unlearned feature set $F$ to $F_i$ in Equation 2 (main paper)", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ju7TZnAhWZ", "reviewer": "Reviewer_aV7Y", "summary": "The paper introduces \"Ferrari,\" a framework for federated feature unlearning that optimizes feature sensitivity to address the 'right to be forgotten' in machine learning. It allows clients to remove sensitive or biased features from a model without full retraining or other clients' data. Ferrari is efficient, practical, and theoretically proven to cause less utility loss than exact unlearning, with empirical results validating its effectiveness across various datasets.", "questions": "1. How does Ferrari defend against potential adversarial attacks aimed at reintroducing unlearned features? Is there a plan to evaluate and enhance its robustness in this area?\n2. What is the computational complexity of the Ferrari framework, and how does it compare to existing federated learning methods in terms of efficiency and resource usage?\n3. The paper relies on certain theoretical assumptions for its analysis. How do these assumptions hold in real-world scenarios, and are there plans to validate them empirically?\n4. What open questions or areas for future work do the authors identify based on their research? How do they envision Ferrari evolving to address these challenges?", "limitations": "The authors have commendably addressed the limitations of their work with a clear and honest discussion, enhancing the research's integrity and transparency. To improve further, they should explore how their assumptions might affect real-world applications and suggest ways to handle any negative effects. Also, a deeper look into societal impacts, including unintended consequences, would be beneficial. Addressing these will help provide a fuller understanding of the broader impact of their work.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. Originality: Ferrari is a fresh take on federated learning, focusing on a new angle of data privacy.\n2. Quality: The paper is well organized, with a thorough set of experiments.\n3. Clarity: The presentation is clear. The authors have successfully demarcated the problem, the proposed solution, and the results in a manner that is easy to follow. The use of figures and tables enhances the readability and helps in quickly grasping complex concepts.\n4. Significance: This work is important for machine learning, especially for keeping data private. It helps with rules and doing AI the right way", "weaknesses": "The paper demonstrates a commendable effort in advancing federated learning with a focus on feature unlearning. However, there are a few areas where the work could be further strengthened:\n1. The format of the article needs to be re-checked, for example, there are some formulas after the punctuation is set incorrectly\n2. Since feature unlearning is important, it would be helpful to see how well Ferrari stands up to attacks that try to bring back forgotten features.\n3. More details on using Ferrari in the real world would be useful, considering things like network delays, client availability, and the extra work on client devices.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "`` 1. Defend Adversarial Attack ``\n\nOur framework effectively defends against Model Inversion Attacks (MIA) [1] by preventing the reconstruction of the target unlearn features. As shown in Tab 3 in main paper, the attack success rate with our framework is similar to that of the naive retrain method, indicating that unlearned features are protected. In contrast, the baseline model before unlearning has a 90\\% attack success rate, highlighting severe data privacy risks. For other baselines like FedCDP and FedRecovery, the success rate is about 80\\%. Our Ferrari framework reduces this rate to around 50\\%, significantly enhancing privacy. Tab 4 shows that our framework prevents reconstruction of the target unlearned feature (e.g., the mouth), whereas the baseline model does not.\n\nFerrari effectively defends against MIA [1, 2] by preventing the reconstruction of the target unlearn features. As shown in Tab 3 (main paper), the attack success rate with our framework is similar to that of the naive retrain method, indicating that unlearned features are protected. In contrast, the baseline model before unlearning has a 90\\% attack success rate, highlighting severe data privacy risks. For other baselines like FedCDP and FedRecovery, the success rate is about 80\\%. Ferrari reduces this rate to around 50\\%, significantly enhancing privacy. Tab 4 shows that our framework prevents reconstruction of the target unlearned feature (e.g., the mouth), whereas the baseline model does not.\n\n**Ref:**\n\n#### _[1] Fredrikson et al, “Model inversion attacks that exploit confidence information and basic countermeasures,” CCS ’15, (New York, NY, USA), p. 1322–1333, Association for Computing Machinery, 2015_\n\n#### _[2] Y. Zhang et al, “The secret revealer: Generative model inversion attacks against deep neural networks,” in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 250–258, 2020_\n\n`` 2. Computational Complexity ``\n\nWe discussed time efficiency in Section 5.4 (main paper). Additionally, we present the computational complexity of our proposed Ferrari framework using FLOPs metrics, as shown in Fig 5 of the rebuttal PDF. Our Ferrari framework exhibits the lowest FLOPs, achieved by accessing only the local dataset of the unlearned client and minimizing feature sensitivity within a single epoch.\n\n`` 3. Theoretical Assumption ``\n\nWe explain more on Assumption 1-2. \n\n- First, Assumption 1 elucidates that the utility loss associated with a perturbation norm less than $C $ is smaller than the utility loss when the perturbation norm is greater than $C$. This assumption is logical, as larger perturbations would naturally lead to greater utility loss.\n\n- Second, we can also extend the Theorem 1 to the case of the non-zero training loss. This is because\n\n\\begin{equation}\n   \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\left( \\|\\| f\\_{\\theta^*}(x) - y \\|\\| + \\lambda \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\frac{\\|\\|f\\_\\theta(x) - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2}{\\|\\|\\delta\\_{F}\\|\\|_2} \\right) \\\\\n\\end{equation}\n\n\\begin{equation}\n  = \\mathbb{E}_{(x,y)\\in \\mathcal{D}} \\mathcal{l}\\|\\| f\\_{\\theta^*}(x) - y \\|\\| + \\lambda \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\frac{\\|\\|f\\_\\theta(x) - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2}{\\|\\|\\delta\\_{F}\\|\\|_2}\n\\end{equation}\n\n\\begin{equation}\n  \\leq \\mathbb{E}_{(x,y)\\in \\mathcal{D}} \\mathcal{l} \\|\\| f\\_{\\theta^*}(x) - y \\|\\| + \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\|\\|f\\_\\theta(x) - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2\n\\end{equation}\n\n\\begin{equation}\n  \\leq  \\mathbb{E}\\_{(x,y)\\in \\mathcal{D}} \\mathbb{E}\\_{\\|\\| \\delta_F \\|\\| \\geq \\lambda} \\|\\|y - f\\_{\\theta^*} (x + \\delta\\_{F})\\|\\|_2\n\\end{equation}\n\nwhich obtain Eq. (13) in appendix (noted that $\\|\\delta_\\mathcal{F}\\| \\geq \\frac{1}{\\lambda}$ in original appendix should be $\\|\\delta_\\mathcal{F}\\| \\geq {\\lambda}$).\n\n`` 4. Future Work ``\n\nWe identify key areas for future research on federated feature unlearning with Ferrari:\n\n* **Dataset Access:** Explore methods that require less than 70\\% of the unlearning client's dataset for effectiveness.\n\n* **Model Types:** Investigate the approach's applicability to non-classification models, such as generative models.\n\n* **Advanced Perturbation:** Develop advanced perturbation techniques to improve unlearning effectiveness.\n\n* **Data and Model Diversity:** Support a wider range of data types and models.\n\n* **Privacy Integration:** Integrate federated feature unlearning with other privacy-preserving methods for enhanced data protection.\n\nFuture work should focus on minimizing dataset requirements, broadening model applicability, and improving robustness and privacy guarantees.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear all reviewers,

Thank you for your valuable comments and thoughtful inquiries regarding our work. We appreciate the opportunity to address your concerns and are committed to providing further clarity.

To better illustrate our responses, we have uploaded a PDF document containing new figures in this section. We have also included detailed explanations and clarifications in the respective rebuttal sections for each reviewer.

We hope these responses adequately address your concerns. We are committed to making the necessary improvements to our revised manuscript.

Thank you again for your feedback.

Meta-review: This paper proposes a Lipschitz-based feature unlearning measure and a Lipschitz-based method to perform feature unlearning in the federated setting with only one client's participation.
The paper shows that the loss in utility for feature unlearning is small using their approach and can handle various feature unlearning scenarios such as sensitive, backdoor and biased features.

After some discussion, the reviewers agreed that this approach provides a novel perspective on the problem. The experiments in the original paper and the author response provide the empirical support for the effectiveness of the feature unlearning.

The authors should include additional discussion of their theoretic assumptions. These are critical for understanding the context of the theoretic results. For example, I am not sure that assumption 1 is always reasonable. For example, suppose the perturbation makes all the pixels equal to the mean of the original patch---this is similar to Fig 1(c). This is probably a smaller perturbation than Gaussian noise as in Fig 1(b). Yet, the performance is better with a "larger" perturbation in this case. Thus, I think the "kind" of perturbation matters significantly due to the inductive bias of the NN architecture and basic intuition does not necessarily hold here. Nonetheless, I think it is still a reasonable assumption but should not be taken as obvious in all cases and more nuanced discussion is needed. 

It also should be clarified that Ferrari is better than "naive" retraining without the feature, but may not be better than a non-naive retraining method. Also, the difference between retraining with IID vs non-IID should be discussed; there does seem to be a gap, albeit relatively small at 2% but this should be noted. These should be clarified to avoid overclaiming in the paper.

Overall, the paper presents a novel federated feature unlearning method using Lipschitz continuity metric and regularization to reduce feature sensitivity while retaining accuracy close to naive retraining.
Decision: Accept (poster)