Ferrari: Federated Feature Unlearning via Optimizing Feature Sensitivity

Authors: hanlin  gu
win kent ong
seng  chee
  chan
lixin  fan
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-13 15:12:08

Abstract: The advent of Federated Learning (FL) highlights the practical necessity for the ’right to be forgotten’ for all clients, allowing them to request data deletion from the machine learning model’s service provider. This necessity has spurred a growing demand for Federated Unlearning (FU). Feature unlearning has gained considerable attention due to its applications in unlearning sensitive, backdoor, and biased features. Existing methods employ the influence function to achieve feature unlearning, which is impractical for FL as it necessitates the participation of other clients, if not all, in the unlearning process. Furthermore, current research lacks an evaluation of the effectiveness of feature unlearning. To address these limitations, we define feature sensitivity in evaluating feature unlearning according to Lipschitz continuity. This metric characterizes the model output’s rate of change or sensitivity to perturbations in the input feature. We then propose an effective federated feature unlearning framework called Ferrari, which minimizes feature sensitivity. Extensive experimental results and theoretical analysis demonstrate the effectiveness of Ferrari across various feature unlearning scenarios, including sensitive, backdoor, and biased features. The code is publicly available at https://github.com/OngWinKent/Federated-Feature-Unlearning

Main paper: 
 introduction: 
 Federated Learning (FL) [1] [2] [3] allows for model training across decentralized devices or servers holding local private data samples, without the need to exchange them directly. An essential requirement within FL is the participants "right to be forgotten", as explicitly outlined in regulations such as the European Union General Data Protection Regulation (GDPR) 3 and the California Consumer Privacy Act (CCPA) 4 [4] . To address this requirement, Federated Unlearning (FU) has been introduced, enabling clients to selectively remove the influence of specific subsets of their data from a trained FL model while preserving the model's accuracy on the remaining data [5] .Different from unlearning at the client, class, or sample level [6] [7] [8] in FL, the feature unlearning [9] holds significant applications across various scenarios. Firstly, in contexts where sentences contain sensitive information such as names and addresses [9, 10] , it becomes crucial to remove these sensitive components to prevent potential exposure through model inversion attacks [11] [12] [13] [14] . Secondly, when datasets contain backdoor triggers that can compromise model integrity [15] [16] [17] [18] , it is imperative to eliminate these patterns. Thirdly, unlearning biased features becomes essential in scenarios where data imbalances significantly impact model accuracy due to bias [19] [20] [21] [22] . However, existing works of FU focus on client, class, or sample unlearning [6] [7] [8] but do not address feature unlearning, limiting their ability to unlearn specific features across multiple data points.There are two challenges in feature unlearning in FL. Firstly, evaluating the unlearning effectiveness for feature unlearning is difficult. Typically, unlearning effectiveness is assessed by comparing the unlearned model with a retrained model without the feature. However, building data without the feature is challenging; for example, training the data with noise or a black block on the feature region may cause severe degradation in model accuracy (see Sec. 3.2) . Secondly, previous work on feature unlearning within centralized machine learning settings [9, 10] is not practical for FL due to its requirement for access to all datasets, necessitating the participation of all clients.To address the aforementioned limitations, we first define the feature sensitivity in Sec. 4.1 to evaluate the feature unlearning inspired by the Lipschitz continuity, which characterizes the rate of change or sensitivity of the model output to perturbations in the input feature. Then we propose a simple but effective federated feature unlearning method, called Ferrari (Federated Feature Unlearning), by minimizing the feature sensitivity in Sec. 4.2. Our Ferrari framework offers three key advantages: Firstly, Ferrari requires only local datasets from the unlearned clients for feature unlearning. Secondly, Ferrari demonstrates high practicality and efficiency, which support various feature unlearning scenarios, including sensitive, backdoor, and biased features and only consumes a few epochs of optimization. Thirdly, theoretical analysis in Sec. 4.3 elucidates that our proposed Ferrari achieves lower model utility loss compared to the exact feature unlearning.The key contributions of this work are summarized as follows:• We identify two key challenges for feature unlearning in FL. The first is how to successfully unlearn features without requiring the participation of other clients, as discussed in Sec. 3.2.The second is how to design an effective evaluation method in federated feature unlearning.• We define the feature sensitivity and introduce this metric in federated feature unlearning in Sec. 4 . By minimizing feature sensitivity, we propose an effective federated feature unlearning method, named Ferrari, which enables clients to selectively unlearn specific features from the trained global model without requiring the participation of other clients.• We provide a theoretical proof in Theorem 1, which dictates that Ferrari achieves better model performances than exact feature unlearning. This analytical result is also echoed in the empirical evidence, highlighting Ferrari's effectiveness across various settings, including the unlearning of sensitive, backdoor, and biased features. 
related work: 
 Machine Unlearning Machine Unlearning (MU), introduced by Cao et al. [23] , involves selectively removing specific training data from a trained model without retraining from scratch [24, 25] . It categorizes into exact unlearning [26, 27] , aiming to completely remove data influence with techniques like SISA [28] and ARCANE [29] , though with computational costs, and approximate unlearning [30, 31] , which reduces data impact through techniques like data manipulation (fine-tuning with mislabeled data [32] [33] [34] [35] [36] or introducing noise [37] [38] [39] ), knowledge distillation [40] [41] [42] [43] (training a student model), gradient ascent [44] [45] [46] [47] (maximizing loss associated with forgotten data), and weight scrubbing [48] [49] [50] [51] [52] [53] (discarding heavily influenced weights).Federated Unlearning In FL, traditional centralized MU methods are unsuitable due to inherent differences like incremental learning and limited dataset access [54] . Research on Federated Unlearning (FU) mainly focuses on client, class, and sample unlearning [6] [7] [8] . Client unlearning, pioneered by Liu et al. [55] introducing FedEraser [55] , includes approaches like FRU [56] , FedRecover [57] , VeriFI [58] , HDUS [59] , KNOT [60] , FedRecovery [61] , Knowledge Distillation [54] , and Gradient Ascent [62] [63] [64] , aiming to remove specific clients or recover poisoned global models. Class unlearning, introduced by Wang et al. [65] , involves frameworks like discriminative pruning and Momentum Degradation [66] (MoDE) to remove entire data classes. Sample unlearning, initiated by Liu et al. [67] , targets individual sample removal within FL settings, with advancements like the QuickDrop [68] framework and FedFilter [69] enhancing efficiency and effectiveness. Recent works, such as F edM e 2 by Xia et al. [70] , optimize both unlearning facilitation and privacy guarantees.Existing literature on FU primarily focuses on client, class, or sample unlearning [6] [7] [8] . However, a significant gap arises when a client seeks to remove only sensitive features while remaining engaged in FL. Unfortunately, current FU approaches do not address this specific scenario, as they do not explore feature unlearning within FL settings. In contrast to prior works focusing on feature unlearning in centralized settings of MU, such as classification models [9, 10] , generative models [71] [72] [73] [74] , and large language models [75] [76] [77] , this study uniquely addresses feature unlearning of classification model within the FL paradigm. This distinction arises because traditional feature unlearning methods in centralized settings of MU are impractical for FL scenarios, where participation from all clients is often infeasible. In such cases, the process fails if even a single client opts out of the operation.Therefore, to fill this critical gap, we proposed a novel federated feature unlearning framework, namely Ferrari based on the concept of Lipschitz continuity [78] [79] [80] . Our proposed Ferrari requires exclusively from the target client's dataset while still preserving the model's original performance. Lipschitz continuity, a fundamental mathematical concept that measures a function's sensitivity to changes in its input variables [81] [82] [83] , is central to our feature unlearning approach. For a detailed exposition of our proposed federated feature unlearning framework utilizing Lipschitz continuity, please refer to Sec. 4. To the best of our knowledge, this is the first work in feature unlearning within FL settings that does not necessitate participation from all other clients, showcasing the potential to enhance privacy, practicality and efficiency.3 Challenges on Feature Unlearning in FL EQUATION)where ℓ is the loss, e.g., the cross-entropy loss,D k = {(x k,i , y k,i )} n k i=1is the dataset with size n k owned by client k. One client (i.e., referred to as the unlearn client C u ) requests the removal of a feature F from the global model θ such that θ does not retain any information about F. Specifically, we assume that the data x ∈ R d and denote the j-th feature of x by x[j]. The partial element of the data x corresponding the feature F is defined as x[F], i.e.,:x[F] = {x[j], j ∈ F} (2)Therefore, the unlearn client C u aims to remove {x i,u [F]} nu i=1 , called unlearned data D u . Denote D r = D -D u to be the remaining data. Unlike sample or class unlearning [6] [7] [8] , evaluating the unlearning effectiveness for feature unlearning is difficult. Typically, unlearning effectiveness is assessed by comparing the unlearned model with a retrained model trained on remaining data D r . However, building D r for the feature unlearning takes much work. For example, suppose we want to remove the mouth from a face image. In that case, one possible solution is to replace the mouth region with Gaussian noise or black block, as illustrated in Fig. 1 . However, this added Gaussian noise or black block can adversely affect model training and degrade performance, e.g., the degradation of model accuracy is beyond 27%.Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes]Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
challenges for feature unlearning in fl: 
 Another challenge is implementing feature unlearning for C u without the help of other clients. Previous work on feature unlearning [9, 10] typically requires access to the remaining data, necessitating the participation of other clients in the FL process. This requirement is impractical in the FL context, as other clients may be unwilling or unable to share data or computational resources. Therefore, finding a method to effectively unlearn features without relying on other clients is crucial to maintain the model accuracy and practicality in the FL settings. Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Answer: [Yes] Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems.• The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 
the proposed method: 
 In this section, we introduce feature sensitivity (see Def. 1) in Sec. 4.1 to evaluate the effectiveness of feature unlearning. We then propose Ferrari based on this concept in Sec. 4.2). Finally, we demonstrate that Ferrari achieves a lower utility loss compared to exact feature unlearning in Sec. 4.3). θ u = θ 4:for i = 1 to N do 5:Sample δ Fi according to Eq. (ComputeL i = ∥f θ u (x)-f θ u (x+δ F,i )∥2 ∥δ F,i ∥2 7:end for 8:L = 1 N N i=1 L i 9:θ u ← θ u -η • ∇ θ u (L) 10: end for 11: Upload θ u to the server 12: ▷ The server performs: 13: Replace the global model θ with the θ u 14: return θ u Inspired by Lipschitz Continuity [79, 80, 82] , which provides an approximate method for removing information from images by perturbing the input data and observing the effect on the output, we introduce the concept of feature sensitivity s as Def. 1. This metric measures the memorization of a model f θ for the feature F by considering the local changes in the given input rather than the global change as defined in the traditional Lipschitz continuity. Definition 1. The feature sensitivity s of the model f with respect to the feature F on the data (x, y) is defined as:EQUATIONwhere δ F denote the perturbation on feature F.Def. 1 characterizes the rate of change or sensitivity of the model output to perturbations in the input data. A small feature sensitivity s represents the model f doesn't memorize the feature F. This definition does not require building the remaining data, as it considers the expectation over the perturbation δ F . Specifically, it represents the average output change rate over any magnitude of the perturbation. Furthermore, we will provide the relationship between Def. 1 and exact feature unlearning in Sec. 4.3. Remark 1. The perturbation δ F can be chosen from various distributions, such as the Gaussian distribution, the uniform distribution, and so on.As discussed the feature sensitivity s in Sec. 4.1, the core idea of the proposed method Ferrari is to achieve the feature unlearning by minimizing the feature sensitivity. More specifically, it controls the change in the model's output relative to changes in the input within the feature region, i.e., the slope, to prevent the model from memorizing the feature as illustrated in Fig. 2 .One unlearning client C u requests to unlearning the feature F. The proposed Ferrari aims to unlearn the global model θ to θ u . The proposed method can be divided into three steps (see details in Alg. 1).In order to compute the feature sensitivity, the perturbation δ F in terms of the feature F is firstly computed as the following (take the Gaussian distribution as an example):δ F [j] = ∼ N (0, σ 2 ) j ∈ F 0 Otherwise (4)Secondly, we leverage a finite sample Monte Carlo approximation to the maximization as Def. 1 as:EQUATIONwhere δ F,i is i th sampling as Eq. ( 4).Finally, for the unlearning client C u who aims to remove the feature F from his/her data D u , the unlearned model θ u is obtained as the following:EQUATIONwhere Eq. ( 6) is computed over the dataset D u . Noted that the proposed Ferrari based on Def. 1 doesn't need the participation of other clients. Remark 2. When the unlearning happens during the federated training, the unlearning clients would also optimize the training loss and feature sensitivity simultaneously, i.e.,,E (x,y)∈D ℓ(f θ (x), y) + λE δ F ∥f θ (x)-f θ (x+δ F )∥2 ∥δ F ∥2, where λ is a coefficient.As illustrated in Sec. 3.2, retraining the model without the feature may affect the model accuracy seriously. Suppose the feature is successfully removed when the norm of perturbation is larger than C. We firstly define the utility loss ℓ 1 with unlearning feature directly, i.e.,, the exact feature unlearning:EQUATIONAnd we define the maximum utility loss with the norm perturbation lower than C as:EQUATIONAssumption 1. Assume ℓ 2 ≤ ℓ 1Assumption 1 elucidates that the utility loss associated with a perturbation norm lower than C is smaller than the utility loss when the perturbation norm is greater than C. This assumption is logical, as larger perturbations would naturally lead to a greater utility loss. Assumption 2. Suppose the federated model achieves zero training loss.We have the following theorem to elucidate the relation between feature sensitivity removing via Alg. 1 and exact unlearning (see proof in Appendix A.1, including the extension for the non-zero training loss assumption). Theorem 1. If Assumptions 1 and 2 hold, the utility loss of unlearned model obtained using Alg. 1 is lower than the utility loss with exact feature unlearning, i.e.,,EQUATIONwhereℓ u = E (x,y)∈D ℓ(f θ u (x), y)Theorem 1 showcases that the proposed method Ferrari, results in a utility loss (ℓ u ) that is lower than the utility loss incurred when the feature is removed, and the model is retrained, i.e., the process of exact feature unlearning. Remark 3. To further evaluate the effectiveness of feature unlearning based on feature sensitivity, we employ model inversion attacks [11, 12] to determine if the feature can be reconstructed and employ attention maps to assess if the model still focuses on the unlearned feature, as described in Sec. 5.3.1. Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?Answer: [Yes] Guidelines:• The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example (a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully. (c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 
experimental results: 
 This section presents the empirical analysis of the proposed Ferrari framework in terms of effectiveness, utility, and time efficiency in sensitive, backdoor and biased feature unlearning scenarios.Unlearning Scenarios Sensitive Feature Unlearning: We simulate the removal of sensitive features from the D u to fulfill the request of C u due to privacy concern. Specifically, we remove 'mouth' from CelebA [84] , 'marital status' from Adult [85] , and 'pregnancies number' from Diabetes [86] . Therefore, our proposed Ferrari aims to remove the influence of these requested features.Backdoor Feature Unlearning: We simulate a pixel-pattern backdoor attack by C u based on BadNets [18] within a FL framework [15] [16] [17] . C u injects a pixel-pattern backdoor feature and trigger label into its D u during training, as shown in Fig. 3 . Consequently, our proposed Ferrari aims to remove the influence of these backdoor features and restore the model's original performance.Biased Feature Unlearning: We simulate the bias dataset D u of the C u and the unbias dataset D r with a bias ratio of 0.8, as shown in Fig. 4 . This results in a global model biased towards the biased dataset [87, 88] due to unintended feature memorization [22] . In CMNIST [89] , the model focuses on color patterns instead of digits, and in CelebA [84] , it learns mouth features instead of facial features for gender classification. Therefore, our proposed Ferrari aims to mitigate these bias-inducing features and restore model performance.We simulate HFL with K = 10 clients under an IID setting, each holding 10% of the datasets, except for the biased feature unlearning experiment with a bias ratio of 0.8. For federated feature unlearning experiments, we set hyperparameters: learning rate η = 0.0001, sample size N = 20, and random Gaussian noise with standard deviation ranging from 0.05 ≤ σ ≤ 1.0 (see Sec. 5.5) across iterations of N . Experiments are repeated over five random trials, and results are reported as mean and standard deviation. We employ ResNet18 [90] on image datasets: MNIST [89] , Colored-MNIST (CMNIST) [89] , Fashion-MNIST [91] , CIFAR-10, CIFAR-20, CIFAR-100 [92] and ImageNet [93] . For tabular datasets, such as Adult Census Income (Adult) [85] and Diabetes [86] , we used a fully-connected neural network linear model. Additionally, we utilize the transformer-based BERT model [94] for the text dataset, specifically the IMDB movie reviews dataset [95] . We conduct experiments on a single NVIDIA A100 GPU. Further details are in Appendix A.2.We assess effectiveness by measuring feature sensitivity (see Section 4.1) and conducting a model inversion attack (MIA) [11] [12] [13] [14] to determine the attack success rate (ASR).The goal is to achieve low feature sensitivity and ASR, indicating successful unlearning sensitive features. Backdoor and biased feature unlearning are evaluated by comparing accuracy on the retain dataset D r (Acc r ) and the unlearn client dataset D u (Acc u ). Low Acc u indicates high effectiveness for backdoor unlearning, while similar accuracy (Acc r ≈ Acc u ) reflects fairness and effectiveness in biased feature unlearning. Qualitatively, effectiveness is assessed using MIA-reconstructed images (sensitive) and GradCAM [96] attention maps (backdoor and biased). The utility is measured by test dataset D t accuracy (Acc t ), with higher values indicating stronger utility. Time efficiency is evaluated by comparing the runtime of each baseline. Baselines We compare our proposed Ferrari against the models of Baseline, Retrain, Fine-tune, FedCDP [65] and FedRecovery [61] . Additional details are provided in Appendix A.2.To evaluate the utility of Ferrari, we measure Acc t on D t , where a higher Acc t indicates greater utility (Tab. 1). Although the Fine-tune method shows high Acc t in the backdoor feature unlearning scenario with a clean dataset, its unlearning effectiveness is very low (see Sec. 5.3.2). This problem worsens with FedCDP [65] and FedRecovery [61] , which suffer significant Acc t declines, reducing model utility and making them unsuitable for feature unlearning. In contrast, Ferrari achieves the highest model utility in sensitive and biased feature unlearning scenarios, with the highest Acc t among baselines, minimal deterioration, and the greatest unlearning effectiveness across all scenarios.In this subsection, we analyze the unlearning effectiveness of Ferrari against baselines in sensitive, backdoor, and biased feature unlearning scenarios.To evaluate Ferrari's effectiveness in unlearning sensitive features, we measured feature sensitivity (see Sec. 4.1) and conducted a model inversion attack (MIA) [11] [12] [13] [14] .Feature Sensitivity Tab. 2 shows the sensitivity of the unlearn feature. The baseline model had high sensitivity to this feature. Similar results were observed for the Fine-tune, FedCDP [65] , and FedRecovery models [61] , with sensitivities greater than 0. , the Fine-tune method has higher Acc r and utility than the Retrain method but lower unlearning effectiveness due to high Acc u . FedCDP [65] and FedRecovery [61] show low utility and unlearning effectiveness with low Acc r and Acc u , rendering them unsuitable for backdoor feature unlearning. In contrast, Ferrari demonstrates the highest utility and unlearning effectiveness.Attention Map Fig. 6a illustrates attention maps analyzing backdoor feature unlearning. Initially, the Baseline model focuses on the 5 × 5 square at the top-left corner, indicating a significant influence on output prediction by the pixel-pattern backdoor feature. In contrast, Ferrari unlearned models shift the attention towards recognizable objects like digits and cars, similar to the Retrain model. This shift suggests a reduced sensitivity to the backdoor feature, indicating a successful unlearning. See Appendix A.3.1 for supplementary results.Accuracy D r and D u represent the unbias and bias datasets, respectively. Successful unlearning results in similar accuracies across both datasets (Acc r ≈ Acc u ), ensuring fairness while maintaining high Acc r and Acc u for utility. Tab. 4 shows that the Fine-tune method fails to unlearn bias, as Acc u remains higher than Acc r , despite slightly higher Acc r compared to Retrain. FedCDP [65] and FedRecovery [61] exhibit catastrophic forgetting, with low Acc r and Acc u , making them unsuitable for biased feature unlearning. In contrast, Ferrari demonstrates effective unlearning with similar Acc r and Acc u , and maintains high overall accuracy, indicating a successful biased feature unlearning.Attention Map Fig. 6b shows attention maps analyzing biased feature unlearning. The Baseline model predominantly focuses on the biased feature region (mouth) in both bias and unbias datasets, suggesting its significant impact on output prediction. However, Ferrari unlearned models redistribute attention across various facial regions in both datasets, similar to the Retrain model. This shift indicates reduced sensitivity to the biased feature, demonstrating successful unlearning. See Appendix A.3.2 for supplementary results.In Fig. 7 , we evaluate the runtime performance and FLOPs metrics of each unlearning method to demonstrate the computational complexity. The Retrain method is expected to have the slowest runtime and highest FLOPs, while Fine-tune is fast but still slower than other methods.Both FedCDP [65] and FedRecovery [61] demonstrate faster runtimes and lower FLOPs than the Fine-tune method, but they are still more computationally expensive than Ferrari. This is primarily due to the need to access training datasets from all clients and the computational expense of gradient residual calculations [61] . In contrast, Ferrari has the lowest computational complexity, with the fastest runtime and lowest FLOPs. It only requires access to the local dataset of the unlearn client and achieves feature unlearning by minimizing feature sensitivity within a single epoch.We conduct an ablation study to analyze how Non-Lipschitz affects the effectiveness of our proposed Ferrari and hyper-parameter analysis of Gaussian noise level (σ) and number of D u in Fig. 8 .We evaluate the unlearning performance by removing the denominator in Eq. 6, calling this the Non-Lipschitz method, as shown in Fig. 8a . The results indicate catastrophic forgetting: D r accuracy drops below 10%, and the unlearned model misclassifies all inputs into a single random class, rendering it useless. This stems from the unbounded loss function in the non-Lipschitz method, unlike the bounded Lipschitz constant in Eq. 6, which provides a theoretical guarantee (see Sec. 4.3). Refer to Appendix A.4 for a detailed analysis of Lipschitz and Non-Lipschitz loss functions.The effectiveness of Ferrari is significantly influenced by injected Gaussian noise. Fig. 8b shows the accuracy of D r and D u across different σ levels. In the 0.05 ≤ σ ≤ 1.0 range, D r accuracy stays high and D u accuracy remains low, indicating a balance. Thus, we implement σ values between 0.05 and 1.0 for a balanced accuracy across D r and D u .Our analysis illustrated in Fig. 8c , demonstrates that Ferrari remains effective with partial D u from C u for feature unlearning (i.e., data lost). Using 70% of D u yields comparable accuracy to using the full (i.e., 100%) dataset, highlighting the method's flexibility even with partial data. Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [NA] Guidelines:• The answer NA means that paper does not include experiments requiring code. Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
conclusion: 
 This paper introduces Ferrari, a federated feature unlearning framework designed to efficiently remove sensitive, backdoor, and biased features without extensive retraining. Leveraging Lipschitz continuity, Ferrari reduces model sensitivity to specific features, ensuring robust and fair models. Uniquely, it requires participation only from the client requesting unlearning, preserving privacy and practicality in FL environments. Experimental results and theoretical analysis demonstrate Ferrari's effectiveness across various data domains, addressing the crucial need for feature-level unlearning in federated learning. This method can serve as a technical solution to meet regulatory requirements for data deletion while maintaining model performance, offering significant value to clients by securing their "right to be forgotten" and preventing potential privacy leakage.The proposed federated feature unlearning method works effectively using only the unlearning client's local data, making it well-suited for real-world scenarios. However, for optimal results, access to the full dataset is required. As demonstrated in Section 5.5, using 70% of the data yields comparable performance, but significant data reduction diminishes effectiveness. Future research should focus on developing methods that require only a small portion of the client's data and expanding the approach beyond classification models to include for example, generative models. Additionally, enhancements such as advanced perturbation techniques and integration with privacy-preserving methods should be explored. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [Yes]• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes]Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [NA] Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 
crowdsourcing and research with human subjects: 
 Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?Answer: [NA] Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: A.1 Proof of Theorem 1As illustrated in Sec. 3.2, it is hard to build the unlearned data x u for the feature unlearning since adding the perturbation may influence the model accuracy seriously. Suppose the feature is successfully removed when the norm of perturbation is larger than C. We define the utility loss ℓ 1 with unlearning feature successfully:EQUATIONAnd we define the maximum utility loss with the norm perturbation less than C as:EQUATIONAssumption 3. Assume ℓ 2 ≤ ℓ 1 Assumption 3 elucidates that the utility loss associated with a perturbation norm less than C is smaller than the utility loss when the perturbation norm is greater than C. This assumption is logical, as larger perturbations would naturally lead to greater utility loss.Assumption 4. Suppose the federated model achieves zero training loss.We have the following theorem to elucidate the relation between feature sensitivity removing via Alg. 1 and exact unlearning (see proof in Appendix).Theorem 2. If Assumption 3 and 4 hold, the utility loss of unlearned model obtained by Alg. 1 is less than the utility loss with unlearning successfully, i.e.,,EQUATIONwhere ℓ u = E (x,y)∈D ℓ(f θ u (x), y)Proof. When the unlearning happens during the federated training, the unlearning clients would also optimize the training loss and feature sensitivity simultaneously. Specifically, the optimization process could be written as:θ u = arg min θ E (x,y)∈D ℓ(f θ (x), y) + λE δ F ∥f θ (x) -f θ (x + δ F )∥ 2 ∥δ F ∥ 2 ,where λ ≥ 1 C is one coefficient. Without loss of generality, we assume the ℓ(f θ (x), y) = ∥f θ (x)-y)∥. DenoteΘ * = arg min θ E (x,y)∈D ℓ(f θ (x), y).If Assumption 4 holds, then f θ * (x) = y for any θ * ∈ Θ * . Therefore, for any ∥δ F ∥ ≥ 1 λ such thatEQUATIONExtending Assumption 4 to the case of non-zero training loss and assuming it holds, f θ * (x) = y for any θ * ∈ Θ * . Therefore, for any ∥δ F ∥ ≥ λ, such thatE (x,y)∈D ∥(f θ * (x) -y∥ + λE ∥δ F ∥≥λ ∥f θ (x) -f θ * (x + δ F )∥ 2 ∥δ F ∥ 2 = E (x,y)∈D ℓ∥f θ * (x) -y∥ + λE (x,y)∈D E ∥δ F ∥≥λ ∥f θ (x) -f θ * (x + δ F )∥ 2 ∥δ F ∥ 2 ≤ E (x,y)∈D ℓ∥f θ * (x) -y∥ + E (x,y)∈D E ∥δ F ∥≥λ ∥f θ (x) -f θ * (x + δ F )∥ 2 ≤ E (x,y)∈D E ∥δ F ∥≥λ ∥y -f θ * (x + δ F )∥ 2 (14)Therefore, we further obtain:EQUATION)where the last inequality is due to λ ≥ 1 C . According to Assumption 3, we have ℓ u ≤ ℓ 1Datasets MNIST [89] : Both the MNIST [89] and Fashion-MNIST(FMNIST) [91] datasets contain images of handwritten digits and attire, respectively. Each dataset comprises Adult Census Income (Adult) [85] includes 48, 842 records with 14 attributes such as age, gender, education, marital status, etc. The classification task of this dataset is to predict if a person earns over $50K a year based on the census attributes. We then consider marital status as the sensitive feature that aim to unlearn in this study. Diabetes [86] includes 768 personal health records of females at least 21 years old with 8 attributes such as blood pressure, insulin level, age and etc. The classification task of this dataset is to predict if a person has diabetes. We then consider number of pregnancies as the sensitive feature that aim to unlearn in this study.The IMDB movie reviews dataset [95] is widely used for binary sentiment analysis, where the task is to determine whether a review expresses a positive or negative sentiment. It comprises 50,000 Baselines The baseline methods in this study:Baseline: Original model before unlearning.Retrain: In scenarios involving sensitive feature unlearning, the retrained model was simply trained using a dataset where Gaussian noise was applied to the unlearned feature region. This approach may lead to performance deterioration, as discussed in Sec. 3.2. For backdoor feature unlearning scenarios, the retrained model was trained using the retain dataset D r , also referred to as the clean dataset. In biased feature unlearning scenarios, the retrained model was trained using a combination of 50% from each of the retain dataset D r (bias dataset) and the unlearn client local dataset D u (unbias dataset). This ensures fairness in the model's performance across both datasets.The baseline model is fine-tuned using the retained dataset D r for 5 epochs.Class-Discriminative Pruning(FedCDP) [65] : A FU framework that achieves class unlearning by utilizing Term Frequency-Inverse Document Frequency (TF-IDF) guided channel pruning, which selectively removes the most discriminative channels related to the target category and followed by fine-tuning without retraining from scratch.FedRecovery [61] : A FU framework that achieves client unlearning by removing the influence of a client's data from the global model using a differentially private machine unlearning algorithm that leverages historical gradient submissions without the need for retraining.In this section, we provide additional results from attention map analysis based on GradCAM [96] for backdoor feature unlearning (refer to Sec. A.3.1) and biased feature unlearning (refer to Sec. A.3.2)Attention map analysis for backdoor samples across model iterations of baseline, retrain, and unlearn model using our proposed Ferrari method on MNIST (Fig. 9 ), FMNIST (Fig. 10 ), CIFAR-10 (Fig. 11 ), CIFAR-20 (Fig. 12 ) and CIFAR-100 (Fig. 13 ) datasets. In this section, we evaluate the Lipschitz loss function and its effectiveness in optimizing feature sensitivity, as described in Eq. 6. We also examine a variant without the denominator, termed the Non-Lipschitz loss, as illustrated in Fig. 15 .The results indicate that models optimized using the Non-Lipschitz loss exhibit fluctuations across batches. This is due to the unbounded nature of the optimization process, leading to useless models. Conversely, models optimized with the Lipschitz loss demonstrate a steady reduction in feature sensitivity over batches. This bounded optimization provided by Lipschitz bound helps in effectively unlearning target features while preserving model utility, as theoretically guaranteed (see Section Sec. 4.3).This section presents an analysis of the impact of Non-IID data on the performance of the proposed Ferrari framework compared to the Baseline and Retrain methods on the CIFAR-10 dataset. We focus on the accuracy of the retain client dataset (D r ) and the unlearn client dataset (D u ) in backdoor feature unlearning, as illustrated in Fig. 16 . To measure the extent of Non-IID, we used the Dir(γ) distribution, where smaller values of γ indicate more heterogeneous data.The results show that the Ferrari framework significantly improves feature unlearning performance, with a drop of approximately 0.2% in D u when γ = 1 compared to the IID scenario. Furthermore, the Ferrari framework maintains successfully the accuracy of D r with only a slight decrease of about 2% compared to the Retrain method within the Non-IID scenario.This section analyzes the impact of a large-scale FL environment, characterized by a large number of clients, on the performance of the proposed Ferrari framework compared to the Baseline and Retrain methods on the CIFAR-10 dataset. We focus on the accuracy of the retained client dataset (D r ) and the unlearned client dataset (D u ) in backdoor feature unlearning, as illustrated in Fig. 17 .The results indicate that the unlearning performance of our proposed Ferrari framework remains Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 


Decision: This paper proposes a Lipschitz-based feature unlearning measure and a Lipschitz-based method to perform feature unlearning in the federated setting with only one client's participation.
The paper shows that the loss in utility for feature unlearning is small using their approach and can handle various feature unlearning scenarios such as sensitive, backdoor and biased features.

After some discussion, the reviewers agreed that this approach provides a novel perspective on the problem. The experiments in the original paper and the author response provide the empirical support for the effectiveness of the feature unlearning.

The authors should include additional discussion of their theoretic assumptions. These are critical for understanding the context of the theoretic results. For example, I am not sure that assumption 1 is always reasonable. For example, suppose the perturbation makes all the pixels equal to the mean of the original patch---this is similar to Fig 1(c). This is probably a smaller perturbation than Gaussian noise as in Fig 1(b). Yet, the performance is better with a "larger" perturbation in this case. Thus, I think the "kind" of perturbation matters significantly due to the inductive bias of the NN architecture and basic intuition does not necessarily hold here. Nonetheless, I think it is still a reasonable assumption but should not be taken as obvious in all cases and more nuanced discussion is needed. 

It also should be clarified that Ferrari is better than "naive" retraining without the feature, but may not be better than a non-naive retraining method. Also, the difference between retraining with IID vs non-IID should be discussed; there does seem to be a gap, albeit relatively small at 2% but this should be noted. These should be clarified to avoid overclaiming in the paper.

Overall, the paper presents a novel federated feature unlearning method using Lipschitz continuity metric and regularization to reduce feature sensitivity while retaining accuracy close to naive retraining.

Reviews: review: paper_summary: paper_summary: The paper identifies two main challenges, which is 1) evaluating the unlearning effectiveness without rebuilding the dataset without the unlearned feature, and 2) achieving feature unlearning in Federated Learning without requiring data or computational resources from other clients. The authors define a concept of  ‘feature sensitivity’ based on Lipschitz continuity to evaluate the effectiveness of feature unlearning. This metric measures how sensitive the model output is to perturbations in the input feature. Federated Feature Unlearning (Ferrari), has an objective to minimize ‘feature sensitivity’ to achieve feature unlearning in federated unlearning. It allows clients to unlearn specific features from the global model without needing other clients' participation. The paper provides theoretical proofs and experimental results demonstrating effectiveness in various scenarios (sensitive, backdoor, biased feature unlearning). It shows minimal loss in model utility compared to exact feature unlearning methods.
strength_weakness: strength_weakness: 1. There is no evaulation on the scalability of the proposed framework. While the experiments used various datasets, the scale and dataset sizes seem to be relatively small. (MNIST, CIFAR, CelebA). It would be better to provide results on performance on large scale environments to prove generalization ability.

2. While it is true that the suggested Ferrari has significant reduction in terms of unlearning time, in terms of computational complexity, it would be better to include actual computational cost metrics such as FLOPs. 

3.  The theoretical analysis in the paper relies on certain assumptions, such as zero training loss and specific data distribution characteristics, which may not always hold in real-world scenarios. 

4. Also there are a few minor mistakes and typos in the paper.
questions: questions: 1. Can you provide more insights into the computational overhead and scalability of Ferrari, particularly when dealing with a lot of clients?

2. In the experiments, learning rate and Gaussian noise levels are mensioned as hyperparmeters. How much is the Ferrari sensitive to hyperparameters like these, or other than these?
limitations: limitations: 1. In federated learning, clients may drop out or join during training or unlearning. Or the performance effect of using federated unlearning on long term is unknown. I would like to suggest about considering making the framework robust to these kinds of real world scenarios.
paper_summary: paper_summary: The rise of Federated Learning (FL) has led to the importance of the 'right to be forgotten', inspiring a need for Federated Unlearning (FU). Feature unlearning, particularly for removing sensitive, backdoor, and biased features, has attracted significant interest. However, current methods relying on the influence function are not suitable for FL since they require other clients' involvement, and there is a lack of assessment regarding the feature unlearning's effectiveness. To tackle these problems, the paper introduces a novel concept, feature sensitivity, derived from Lipschitz continuity, as a metric to evaluate feature unlearning efficiency, quantifying the impact of changes in input features on the model's output. A new federated feature unlearning framework named Ferrari is then proposed, which aims to minimize feature sensitivity. Thorough experimental evidence and theoretical analysis validate Ferrari's effectiveness in various feature unlearning cases, including those involving sensitive, backdoor, and biased features.
strength_weakness: strength_weakness: - Further clarification is needed on the motivation for feature unlearning in FL.
- The rationality of the designed feature unlearning evaluation metric remains to be discussed.
- Further evaluation is needed in non-IID data scenarios.
- The utility loss loss seems inconsistent with the numerical results.
- The chosen baseline does not seem to be tailor-made for the evaluation task, which may lead to unfair comparisons.
questions: questions: - Further clarification is needed on the motivation for feature unlearning in FL. In the case of IID data, where clients share similar features, a single user's request for feature unlearning might face challenges in fully eliminating targeted features from the global model, given that the model has already learned similar patterns from other clients. While data erasure seems to provide a higher level of user safety, it is crucial to understand why users might opt for feature erasure instead.

- In the context of Federated Unlearning (FU), privacy assurance takes precedence over utility loss analysis. Can the authors present a privacy analysis or provide relevant proof demonstrating the privacy guarantees of feature unlearning in the FU setting?

- The paper discusses the utility loss of Ferrari; however, paradoxically, Table 1 reveals that Ferrari's utility is superior to retraining in some instances and even surpasses the baseline in specific cases. It would be beneficial if the authors could offer more insight to further explain this unexpected outcome.

- Given the potential challenges posed by the non-IID data setting, it is essential to investigate Ferrari's performance under such conditions. Can the authors provide an exploration of Ferrari's effectiveness in a non-IID data scenario?

- Concerns exist about Ferrari's privacy performance, as although it outperforms other baselines in defending against MIA, it still presents a relatively high probability of successful MIA attacks. This raises questions about users' willingness to use Ferrari for feature unlearning. Would the authors consider integrating additional techniques to enhance its privacy performance further?

- Based on the observed outcomes from the MIA, doubts arise about the adequacy of the proposed validation metric for evaluating feature unlearning performance. It appears that the metric may not accurately reflect the effectiveness of the feature unlearning process. Therefore, it would be valuable if the authors could delve deeper into analyzing the reasoning behind and the correctness of the designed evaluation metric, to either validate its reliability or suggest improvements for a more accurate assessment of feature unlearning.

- Considering that the selected baselines such as FedCDP and FedRecovery are not tailor-made for feature unlearning, whether it is fair to compare directly with Ferrari needs further clarification.
limitations: limitations: Please kindly refer to the above comments in the Questions part.
paper_summary: paper_summary: This paper introduces a novel framework named Ferrari, addressing two challenges for federated feature unlearning. Ferrari leverages Lipschitz continuity to minimize the feature sensitivity directly during the local unlearning process, demonstrating several key advantages, such as eliminating the requirement of other clients' participation, supporting various unlearning scenarios, and achieving less model utility loss. Both the theoretical proof and empirical results demonstrate the effectiveness of Ferrari in a variety of unlearning settings compared with other baselines.
strength_weakness: strength_weakness: 1. The authors should have provided more analysis on Non-Lipschitz besides the proofs, especially in the Ablation Studies section. 
2. Ferrari's performance heavily relies on the number of unlearned datasets, as shown in Figure 7 (b). In a real-world scenario, the unlearning client may ask to unlearn all the datasets, not just a small portion. 
3.  Minor issues: Gaussian Noise and the Number of Unlearned Datasets should be hyper-parameter tuning, not ablation studies. All the 
single quotes and double quotes in the paper are not in the correct formats.
questions: questions: 1. What does the dotted and solid line in Figure 7 mean? 
2.  How do you get the results of Figure 6? For me, if only retrain or fine-tune one specific client, the runtimes should be similar as Ferrari.
limitations: limitations: See the second point in weaknesses.
paper_summary: paper_summary: This paper studies the feature unlearning problem in the context of federated learning. The key idea is to interpret feature unlearning into model sensitivity at specific features. The proposed method which is called Ferrari is evaluated on different tasks which involves sensitive, backdoor, and biased feature unlearning.
strength_weakness: strength_weakness: 1. The challenges of this paper are not well presented.
2. The sensitivity reduction is not a proper solution of federated feature unlearning.
3. Important experiments are missing.
questions: questions: Major concerns:
1. Suppose client i and client j have similar data point x. If client i claims to forget some "key features" while client j does not, the global model still has a chance to learn the "key features" without breaking the unlearning principle. Thus, using sensitivity reduction on the global model does not make sense. Similar to sample-wise unlearning in classification, you cannot simply interpret this form of unlearning as misclassifying this specific sample. I want to highlight this concern as I understand you are not the only one thinking in this way.
2. Now that you provide examples of unlearning users' sensitive information like name and address, I would expect you to have experiments on a text dataset as strong evidence, which is so far lacking in the paper.

Other minor questions:
1. Please check the reference, [10] and [11] are repeated.
2. After checking the paper [16], where they consider the malicious clients, I begin to understand “datasets contain backdoor triggers” you used. To be clearer, you’d better refer to local clients’ data.
3. Regarding the third scenario, imbalance is only a possible source of bias in terms of some specific fairness metrics. Please be careful when using these concepts.
4. The presented first challenge (line 32 on page 1) is interesting, while the second one should exist in client, class, or sample level. If so, you should put some efforts here to explain why this challenge remains by adapting existing strategies.
5. Following 4, you claimed a different challenge (challenge 2) in the first contribution. 
6. Your method Ferrari is short for Federated Feature Unlearning, which is also the name of the learning problem. You’d better use different names.
7. Repeated phrases in line 105 on page 3.
8. Below Eq. 2, the unlearned feature set f is not indexed by sample i but this is true in the algorithm.
limitations: limitations: As I pointed out in Weaknesses & Questions, the technique may have some flaws in addressing the Federated Feature Unlearning problem. The experiments are primarily conducted on image samples, which cannot confidently prove the idea.
paper_summary: paper_summary: The paper introduces "Ferrari," a framework for federated feature unlearning that optimizes feature sensitivity to address the 'right to be forgotten' in machine learning. It allows clients to remove sensitive or biased features from a model without full retraining or other clients' data. Ferrari is efficient, practical, and theoretically proven to cause less utility loss than exact unlearning, with empirical results validating its effectiveness across various datasets.
strength_weakness: strength_weakness: The paper demonstrates a commendable effort in advancing federated learning with a focus on feature unlearning. However, there are a few areas where the work could be further strengthened:
1. The format of the article needs to be re-checked, for example, there are some formulas after the punctuation is set incorrectly
2. Since feature unlearning is important, it would be helpful to see how well Ferrari stands up to attacks that try to bring back forgotten features.
3. More details on using Ferrari in the real world would be useful, considering things like network delays, client availability, and the extra work on client devices.
questions: questions: 1. How does Ferrari defend against potential adversarial attacks aimed at reintroducing unlearned features? Is there a plan to evaluate and enhance its robustness in this area?
2. What is the computational complexity of the Ferrari framework, and how does it compare to existing federated learning methods in terms of efficiency and resource usage?
3. The paper relies on certain theoretical assumptions for its analysis. How do these assumptions hold in real-world scenarios, and are there plans to validate them empirically?
4. What open questions or areas for future work do the authors identify based on their research? How do they envision Ferrari evolving to address these challenges?
limitations: limitations: The authors have commendably addressed the limitations of their work with a clear and honest discussion, enhancing the research's integrity and transparency. To improve further, they should explore how their assumptions might affect real-world applications and suggest ways to handle any negative effects. Also, a deeper look into societal impacts, including unintended consequences, would be beneficial. Addressing these will help provide a fuller understanding of the broader impact of their work.

Comments: title: Thank you for your thoughtful feedback
Thanks for your response
Appreciation for upholding Strong Accept and supporting our work
Thank you for your responses.
Thank You for Rating Upgrade
Thanks for Authors' Rebuttal
comment: Thanks for the rebuttals and providing the responses. They mostly clarified my concerns. So, I will increase my rating.
``1.  Global Model Response``

We sincerely apologize for any confusion in our previous communication. 

In scenarios with IID, unlearning a feature from a target client will inadvertently lead to unlearning similar features in other clients within the global model. For example, we use a face classification task to assess if unlearning _'mouth'_ feature for one client impacts the model's sensitivity to the _'mouth'_ feature in the other nine clients. 

- (i) In Table 1, the feature sensitivity for unlearned client ($D_u$) and retained client ($D_r$) is significantly reduced (e.g., dropping below 0.11), compared to values > 0.95 before unlearning.
   
- (ii) In Table 2, the successful Membership Inference Attack (MIA) rate for features from unlearned client ($D_u$) and retained client ($D_r$) decreases to approx. 50%, whereas it was > 80% before unlearning.

>Table 1: Feature sensitivity analysis in FL including 10 clients under IID, a *small* feature sensitivity indicates good unlearning effect
| **Dataset** | **Unlearn Feature** | **$\mathcal{D}_u$ (Before Unlearning)** | **$\mathcal{D}_r$ (Before Unlearning)** | **$\mathcal{D}_u$ (Retrain)** | **$\mathcal{D}_r$ (Retrain)** | **$\mathcal{D}_u$ (Ours)** | **$\mathcal{D}_r$ (Ours)** |
|-------------|---------------------|-----------------------------------------|-----------------------------------------|-------------------------------|-------------------------------|----------------------------|----------------------------|
| CelebA      | Mouth               | 0.96 ± 1.41×10⁻²                        | 0.95 ± 1.63×10⁻²                        | 0.07 ± 8.06×10⁻⁴               | 0.08 ± 7.51×10⁻⁴               | 0.09 ± 3.04×10⁻⁴            | 0.11 ± 3.62×10⁻⁴            |

>Table 2: Model inversion attack in FL including 10 clients under IID, a *small* MIA indicates good unlearning effect
| **Dataset** | **Unlearn Feature** | **$\mathcal{D}_u$ (Before Unlearning)** | **$\mathcal{D}_r$ (Before Unlearning)** | **$\mathcal{D}_u$ (Retrain)** | **$\mathcal{D}_r$ (Retrain)** | **$\mathcal{D}_u$ (Ours)** | **$\mathcal{D}_r$ (Ours)** |
|-------------|---------------------|-----------------------------------------|-----------------------------------------|-------------------------------|-------------------------------|----------------------------|----------------------------|
| CelebA      | Mouth               | 84.36 ± 3.22                            | 84.17 ± 2.93                            | 47.52 ± 1.04                   | 48.36 ± 1.39                   | 51.28 ± 2.41                | 52.46 ± 2.76                |

``2. Global Sensitivity Reduction ``

Thank you, we appreciate the opportunity to clarify further.

Firstly, under **IID setting** in federated learning (FL), we recognize the concern regarding the removal of sensitive features from the global model, especially when two clients have similar or identical features and only one requests unlearning. However, it is important to note that retaining such a sensitive feature in the global model may lead to potential violations of regulations such as GDPR. Thus, we argue that removing the feature from the global model is a reasonable and necessary step to ensure compliance. Also, as demonstrated in Table 1 (main paper), the removal of sensitive features for unlearned clients **does not significantly diminish the model's utility for the remaining clients**. Thus, under **IID setting**, our unlearning strategy offers a practical and acceptable solution that balances compliance with maintaining the effectiveness of the global model.

Secondly, unlearning in other scenarios within FL, such as **Non-IID**, **backdoor unlearning**, and **bias unlearning**, our proposal holds particular value. In Non-IID and backdoor, individual clients often possess personalized features that are unique to them, unlike the shared features in the IID setting. For bias unlearning, the shared objective across all clients is to remove bias from the global model. As shown in Sections 5.3.2 - 5.3.3 (main paper), *Ferrari* **performs effectively** in unlearning bias and backdoor features; as well as in Non-IID setting (please refer Fig. 3 in the rebuttal PDF).

``3. Unseeing as unlearning``

Thank you. **The feature unlearning herein is equal to "unseeing" it during training instead of unfitting it**. According to [1], exact feature unlearning can be similarly defined as: $\theta_u \sim \theta_r$, where $\theta_u$ is the unlearned model and $\theta_r$ is the retrained model using data $x+\delta_{\mathcal{F}}$. Our proposed aims to optimize:

\begin{equation}
\min_\theta \mathbb{E}_{(x,y) \in \mathcal{D}_u} \frac{1}{N} \sum\_{i=1}^N \frac{\|\|f\_\theta(x) - f\_\theta (x + \delta\_{F,i})\|\|_2}{\|\|\delta\_{F,i}\|\|_2}
\end{equation}

This objective drives the unlearned model to converge toward the retrained model, effectively making the unlearned model **unsee** the feature.

[1] Bourtoule et al., “Machine unlearning,” in 2021 IEEE SP.
Regarding my first concern, I was attempting to question a scenario when two clients (i and j) happen to have a pair of similar data point, e.g, x1 from client i and x2 from j which are very similar on features. In this sense, they may be equally important for model training. But if client i requires to unlearn x1 while client j does not requires to unlearn x2, then how will global model response?

As what I have commented before, using sensitivity reduction on the global model would simply encourage sensitivity reduction on x1, just similar to sample-wise unlearning in classification where you cannot simply interpret this form of unlearning as misclassifying this specific sample. For example, if x1 and x2 are supported vectors of the classifier, unlearning x1 will not necessarily need to change the decision boundary because x2 is still there. 

From my understanding, unlearning a sample equals to unseeing it during training instead of unfitting it. I would like to highlight this case as some machine unlearning players may ignore it.
We sincerely appreciate your thoughtful feedback and for upholding the **8 = Strong Accept** score. Your insightful suggestions have greatly improved the clarity and overall quality of our work. Thank you for your valuable support.
I have read the authors' responses. Most of my concerns have been addressed. I will keep my score as 8 Strong Accept.
Thank you for your thoughtful feedback. We are pleased to hear that our rebuttal has addressed most of your concerns. We are truly grateful for your decision to revise and improve the rating based on our clarifications. Your willingness to acknowledge the revisions means a great deal to us, and we are committed to addressing any further concerns you may have. We are more than happy to engage in any additional dialogue necessary to ensure that our paper meets the highest standards of quality.

Once again, thank you for your invaluable insights and for your thoughtful consideration in upgrading the score.
Thank you to the authors for their detailed response. I have read the authors' rebuttal carefully and it addresses most of my concerns. Therefore, I will revise my rating appropriately. Thank you again to the authors for their response.