Enforce unlearning while keeping the request private
Bind learning and unlearning updates to an agreed aggregate. EFU uses client-side unlearning, weight clustering and functional encryption so both update types follow the same encrypted submission path. The study measures forgetting behavior and retained utility alongside signals that might reveal unlearning.
Client-controlled updates: clients either learn from retained data or compute an update intended to forget selected data.
Function-bound aggregation: encrypted centroids and partial keys restrict which aggregate the server can decrypt.
Forgetting at several levels: evaluate sample, class and task removal with a standalone objective and wrapped client-side unlearning methods.
Federated unlearning (FU) algorithms allow clients in federated settings to exercise their “right to be forgotten” by removing the influence of their data from a collaboratively trained model. Existing FU methods maintain data privacy by performing unlearning locally on the client-side and sending targeted updates to the server without exposing forgotten data; yet they often rely on server-side cooperation, revealing the client's intent and identity without enforcement guarantees - compromising autonomy and unlearning privacy. In this work, we propose EFU (Enforced Federated Unlearning), a cryptographically enforced FU framework that enables clients to initiate unlearning while concealing its occurrence from the server. Specifically, EFU leverages functional encryption to bind encrypted updates to specific aggregation functions, ensuring the server can neither perform unauthorized computations nor detect or skip unlearning requests. To further mask behavioral and parameter shifts in the aggregated model, we incorporate auxiliary unlearning losses based on adversarial examples and parameter importance regularization. Extensive experiments show that EFU achieves near-random accuracy on forgotten data while maintaining performance comparable to full retraining across datasets and neural architectures - all while concealing unlearning intent from the server. Furthermore, we demonstrate that EFU is agnostic to the underlying unlearning algorithm, enabling secure, function-hiding, and verifiable unlearning for any client-side FU mechanism that issues targeted updates.
Abstract and overview follow the public preprint; the citation identifies the published version.
Read more ↗Algorithm 1 branches on the local forget set. A learning client minimizes cross-entropy on retained data; an unlearning client computes a removal update. Both then cluster, encrypt and submit through the same protocol.
Section 4.3 and Algorithm 1, PDF pages 6–7. Matching ciphertext format is one part of concealment, not a complete audit of observable metadata.
The standalone loss combines a negative forget-set cross-entropy term, an auxiliary term for adversarial examples with incorrect labels, and inverted MAS importance weights that constrain parameter drift.
Equation 3, PDF page 6, with terms abbreviated. RMAS = ∑j(1 − Ωj)(θj − θ̃j)2; θ̃ is the model before unlearning. Offline adversarial preparation is excluded from the plotted local runtime.
Encrypt κ centroid values under the current round label, transmit the visible position map, and include a partial functional key. The server expands encrypted centroids to weight positions and recovers a sample-weighted aggregate.
Sections 4.3–4.4 and Algorithm 2, PDF pages 7–8. The experiments use 64 centroids and 256-bit encryption.
The complete-aggregation argument requires at least one client to withhold a share for an altered function or label. Update-type indistinguishability excludes full collusion and is conditioned on indistinguishable function outputs. Visible maps, timing and other observations remain separate questions.
Section 4.5 and Appendix B, PDF pages 8 and 17–18. Trusted clients perform key generation, encryption and unlearning correctly. Authorized decryption does not enforce deployment or deletion of old models.
Compare retained and forgotten accuracy with full retraining. Parameter-change and traffic plots describe observable behavior, but the paper does not train an intent detector or quantify its attack advantage. Low forgotten-class accuracy alone is not proof of complete information removal.
Tables 1–2 and Figures 2–3, PDF pages 9–12; Appendix C, page 18. The evaluated PGD and FedOSD wrappers add MAS, while SGA-EWC retains EWC; their optimization is not uniformly unchanged.
LFW · ViT-B/32 · all 30 clients unlearn · means of 3 runs
CIFAR-10 · ResNet-18 · forget 1 of 10 classes · means of 3 runs
| Method | Retained accuracy (%) | Forgotten accuracy (%) |
|---|---|---|
| Full retrain | 94.82 | 13.72 |
| SGA-EWC | 91.23 | 14.69 |
| PGD | 91.82 | 14.31 |
| FedOSD | 93.06 | 12.77 |
| EFU + SGA-EWC | 90.91 | 14.71 |
| EFU + PGD | 91.61 | 14.29 |
| EFU + FedOSD | 92.73 | 12.54 |
| EFU | 92.43 | 13.06 |
@inproceedings{mohammadi2025efu,
title = {{EFU}: Enforcing Federated Unlearning via Functional Encryption},
author = {Mohammadi, Samaneh and Tsouvalas, Vasileios and Symeonidis, Iraklis and Balador, Ali and Ozcelebi, Tanir and Flammini, Francesco and Meratnia, Nirvana},
booktitle = {Proceedings of the 34th ACM International Conference on Information and Knowledge Management},
year = {2025},
pages = {2148--2158},
publisher = {Association for Computing Machinery},
doi = {10.1145/3746252.3761091},
url = {https://doi.org/10.1145/3746252.3761091}
}