Foundation models are commonly deployed as frozen feature extractors with a small trainable head to adapt to private, user-generated data in federated settings. The ``right to be forgotten'' requires removing the influence of specific samples or users from the trained model on demand. Existing federated unlearning methods target general deep models and rely on approximate reconstruction or selective retraining, making exactness costly or elusive. We study this problem in a practically relevant but under-explored regime: a frozen foundation model with a ridge-regression head. The exact optimum depends on the data only through two additive sufficient statistics, which we turn into a communication protocol supporting an arbitrary stream of add and delete requests via fixed-size messages. The server maintains a head that is, in exact arithmetic, pointwise identical to centralized retraining after every request. We provide deterministic retrain-equivalence guarantees, order and partition invariance, two server-side variants, and a Bayesian certificate of zero KL divergence. Experiments on four benchmarks confirm the guarantees: both variants match centralized ridge retraining to within 10−9 relative Frobenius error and complete each request at orders-of-magnitude lower cost than federated retraining baselines.
Figures & tables
Tt+
=Tt−1−Tt−1Ut+⊤(Ir+Ut+Tt−1Ut+⊤)−1Ut+Tt−1,
Wt+
=(I−Tt+Ut+⊤Ut+)Wt−1+Tt+Gt+,
Algorithm 2 Variant B at round t (SMW updates using client R factors)
Figure 1: Protocol overview (Variant A). Clients compute frozen features locally and transmit only fixed-size sufficient-statistic messages (Sk,t±,Gk,t±) . The server maintains a retained-statistics ledger ( St←St−1+St+−St− , Gt←Gt−1+Gt+−Gt− ) and recovers the exact ridge head by solving (St+γI)Wt=Gt .
Communication per round
Server computation
Variant A
Θ(d2+dc)
O(d3+d2c)
Variant B
Θ(dr+dc)
O(rd2+r3)
Table 1: Per-round cost summary in the typical regime d≫r .
Dataset
Task
Frozen backbone ϕ
Feature dim. d
CIFAR-10
Image Classification
DINOv2
768
CIFAR-100
Image Classification
DINOv2
768
FeMNIST
Character Classification
DINOv2
768
Sentiment140
Sentiment Analysis
RoBERTa
768
Table 2: Experimental setup: datasets, tasks, frozen backbones, and feature dimensions used in all evaluations.
Dataset
Central ridge retrain
FedAvg retrain
FATS
Exact-Fun
Variant A
Variant B
CIFAR-10
0.9802
0.9740
0.9634
0.9664
0.9801
0.9802
CIFAR-100
0.8640
0.8570
0.8623
0.8471
0.8640
0.8640
FeMNIST
0.8084
0.7624
0.7217
0.7562
0.8080
0.8080
Sentiment 140
0.8291
0.8261
0.8264
0.8190
0.8291
0.8291
Table 3: Server model test accuracy on the evaluated datasets and tasks
Variant A
Variant B
K=10
K=50
K=100
K=10
K=50
K=100
fp32
5.55e-3
5.52e-3
5.05e-3
1.27e-4
1.26e-4
1.21e-4
fp64
1.47e-9
1.42e-9
1.42e-9
6.18e-10
1.37e-9
1.42e-9
Table 4: Relative Frobenius deviation ∥Wfed−Wc∥F/∥Wc∥F on FeMNIST for different numbers of clients K and numerical precision used for server-side computation and aggregation of second-order statistics.
Figure 2: Test Accuracy and Cumulative Time for CIFAR-10 Chunked Deletions. Unlearning performance on CIFAR-10 with repeated deletions of 20% of the total data per step. Deleted samples are randomly selected from all clients. Left: test accuracy tracking utility across deletion rounds. Right: cumulative unlearning time demonstrating system efficiency.
Figure 3: Wall time measurement of 200 unlearning requests (single data points) performed by different methods
Deletions only
Delete + add-back
Method
100 steps
200 steps
100 steps
200 steps
Variant A
2.72e-11
3.18e-11
3.14e-11
3.81e-11
Variant B
3.00e-11
3.66e-11
2.82e-11
5.10e-12
Table 5: Relative Frobenius deviation ∥Wfed−Wc∥F/∥Wc∥F from the central ridge solution after 100 and 200 single-point deletions and the corresponding add-back experiment on CIFAR-10.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Method
Dataset
#Rounds
Clients per round
Local data per round
FedAvg retrain
CIFAR-10/100
120
20
full local data
Exact-Fun
CIFAR-10/100
120
20
full local data
FATS
CIFAR-10/100
60
5
64 samples
FedAvg retrain
FeMNIST
120
20
full local data
Exact-Fun
FeMNIST
120
20
full local data
FATS
FeMNIST
120
5
50 samples
Appendix
Table 6: The hyperparameter setting for baselines.
Federated learning (FL) increasingly needs machine unlearning to comply with privacy regulations. However, existing federated unlearning approaches may overlook the overlapping information between the unlearning and remaining data, leading to ineffective unlearning and unfairness between clients. In this work, we revisit federated unlearning through the lens of memorization. We argue that unlearning should mainly remove the unique memorized information attributable to the data to be forgotten, while preserving overlapping patterns that are also supported by the remaining data. Specifically, we propose Grouped Memorization Evaluation, an example-level metric that separates memorized knowledge from overlapping knowledge. Building on this metric, we introduce Federated Memorization Pruning (FedMemPrune), a pruning-based unlearning approach that resets redundant parameters responsible for memorization. Extensive experiments show that FedMemPrune closely matches retraining-based unlearning baselines while more effectively eliminating memorization than existing federated unlearning algorithms, yielding strong unlearning performance without sacrificing the utility of retained knowledge.
Jiaheng Wei, Yanjun Zhang, He Zhang +5
Royal Melbourne Institute of Technology · Griffith University · Swinburne University of Technology
Federated unlearning (FU) is critical for complying with legal mandates like the right to be forgotten in decentralized systems, yet current methods face a persistent dilemma between non-target knowledge loss and high request latency. To resolve these issues, we propose FedUP, a one-shot federated unlearning framework utilizing lightweight pluggable filters that act as a "knowledge funnel" to screen out target data while preserving original model performance. By freezing original model parameters and training filters at the server side using differentially private (DP)-protected class centroid samples, FedUP bypasses the need for multi-round client-server communication and complex retraining, reducing unlearning latency from minutes to mere seconds. Additionally, the framework's pluggable architecture ensures inherent reversibility, enabling the seamless restoration of forgotten knowledge by simply removing the filters. Extensive experiments on diverse image and text tasks demonstrate that FedUP effectively reduces non-target knowledge loss and achieves superior unlearning precision and efficiency across various scenarios. Code is available at: https://github.com/suows/FedUP-code.
Feihong Nan, Zhengyi Zhong, Pan Wang +4
1National Key Laboratory of Big Data and Decision, National University of Defense Technology, China.
Federated learning of foundation models faces a fundamental resource-asymmetry challenge: the institutions holding the most valuable domain-specific data cannot host billion-parameter models. Existing heterogeneous federated approaches attempt to bridge this gap through parameter-efficient tuning, model pruning, or knowledge distillation, yet each trades away a critical property, whether full-model memory reduction, architectural self-containedness, or representational fidelity, leaving the core tension unresolved. We propose FedSLM, a parameter-centric framework for federated fine-tuning with heterogeneous compressed clients. FedSLM uses SVD-based decomposition to produce self-contained client models, whose low-rank subspaces form nested manifolds that are structurally compatible for aggregation. It then applies a two-stage protocol that synchronizes lightweight adapters within compression groups and fuses full-rank reconstructions across groups via structural alignment. Finally, a weak-to-strong elicitation step with auxiliary confidence loss transfers the aggregated knowledge to the full-scale server, while an explicit bias--variance trade-off mitigates compression artifacts. We provide theoretical guarantees for adapter-level aggregation, subspace-alignment bounds for cross-group fusion, and a characterization of how the confidence loss mitigates weak-supervision noise. Experiments on natural language and vision--language benchmarks show that FedSLM outperforms existing federated baselines under both IID and non-IID partitions, while client models operate at roughly 50% of the GPU memory required by the full model.
Shengkun Zhu, Jinshan Zeng, Zhihua Allen-Zhao +5
The Hong Kong Polytechnic University · OceanBase, Ant Group · School of Management, Xi’an Jiaotong University +3