FIRM: Fisher-Informed Retention Merging for Federated LLM Unlearning
Organizations: Indian Institute of Technology Bombay
Abstract
Federated LLM unlearning addresses targeted knowledge removal when forget and retain data remain distributed across private clients and are inaccessible to the server. The resulting locally trained adapters encode conflicting objectives, making their aggregation fundamentally different from conventional federated optimization. A key failure mode is magnitude explosion, whereby unnormalized cross-client aggregation increases the merged update magnitude and degrades retained utility under stronger unlearning. We propose FIRM (Fisher-Informed Retention Merging), a single-round framework for stable and retention-aware server-side aggregation. FIRM uses client-local Fisher statistics as a unified sensitivity signal to construct a Fisher-normalized base merge and impose explicit control over retain-sensitive parameters. Its second-order retention projection admits a unique minimum-distance solution, while the corresponding dual scales with the number of retain clients rather than the model dimension. Experiments across WMDP, TOFU, and MUSE-HP using Zephyr-7B and Llama-3-8B show utility gains at comparable forgetting on WMDP and MUSE-HP, with metric-dependent trade-offs on TOFU. Controlled comparisons support benefits of the combined base merge and additional retention correction at selected operating points.
Figures & tables
| Method | Bio | Cyber | Util | |
|---|---|---|---|---|
| Pretrained | — | 63.08 | 40.11 | 54.46 |
| FULM | 0.05 | 62.37 | 40.01 | 54.35 |
| FULM | 0.10 | 59.15 | 38.95 | 53.84 |
| FULM | 0.15 | 50.27 | 36.03 | 49.52 |
| FULM | 0.17 | 43.13 | 31.76 | 45.88 |
| FULM | 0.20 | 28.20 | 26.17 | 35.73 |
| Method | Setting | Bio | Cyber | Util |
|---|---|---|---|---|
| AVG | scale=1.00 | 24.59 | 25.87 | 24.18 |
| SUM | scale=0.05 | 38.41 | 30.60 | 43.06 |
| TIES | topk=0.50 | 24.74 | 25.11 | 22.80 |
| FULM | 43.13 | 31.76 | 45.88 | |
| FIRM (ours) | 42.42 | 31.91 | 48.29 |
| Method | Fgt | Ret | RA | RW | Util | |
|---|---|---|---|---|---|---|
| Expert baseline | — | 96.74 | 94.64 | 47.15 | 77.78 | 39.49 |
| FULM | 1.0 | 71.85 | 95.51 | 44.65 | 75.93 | 37.35 |
| FULM | 1.5 | 61.68 | 91.51 | 42.45 | 70.80 | 35.94 |
| FULM | 2.0 | 51.84 | 78.16 | 34.03 | 66.97 | 32.60 |
| FULM | 2.5 | 43.71 | 67.84 | 23.20 | 64.34 | 33.78 |
| FIRM | 1.0 | 90.15 | 96.75 | 49.15 | 77.64 | 38.40 |
| Method | HP | Util | |
|---|---|---|---|
| Pretrained | — | 50.57 | 61.12 |
| FULM | 0.10 | 5.52 | 59.59 |
| FULM | 0.20 | 0.00 | 57.52 |
| FULM | 0.30 | 0.00 | 53.95 |
| FULM | 0.50 | 0.00 | 35.67 |
| FULM | 0.70 | 0.00 | 22.95 † |
| Configuration | Bio | Cyber | Util |
|---|---|---|---|
| FIRM-base ( ) | 42.42 | 31.91 | 48.29 |
| A1: No sum-norm | 63.00 | 40.01 | 54.37 |
| A2: Uniform weights | 24.82 | 25.87 | 24.54 † |
| A3: Top-20% ( ) | 34.64 | 29.59 | 42.92 |
| A3: Full Fisher ( ) | 24.82 | 25.87 | 24.54 † |
| Pretrained | 63.08 | 40.11 | 54.46 |
| Method | Bio | Cyber | MMLU | |
|---|---|---|---|---|
| Uniform avg. | 0.30 | 45.80 | 34.78 | 48.58 |
| FIRM-base | 1.00 | 45.56 | 34.88 | 51.33 |
| FULM-MEAN | 0.35 | 58.21 | 38.70 | 53.77 |
| FIRM-base | 0.60 | 58.05 | 38.70 | 54.38 |
| Pair ( ) | Bio gap | Cyber gap | MMLU |
|---|---|---|---|
| Q/F (1.5/1.1) | 0.000 | 0.201 | +0.669 |
| Q/F (2.2/1.5) | 0.393 | 0.302 | +1.723 |
| T/Q (1.1/1.0) | 0.079 | 0.101 | +0.249 |
| T/Q (1.5/1.4) | 0.471 | 0.252 | +0.349 |
| T/Q (2.4/2.3) | 0.393 | 0.302 | +1.453 |
| Active | Time | Bio | Util | |||
|---|---|---|---|---|---|---|
| Before | After | (s) | no-QP/QP | no-QP/QP | ||
| 1 | 1/1 | 0.77 | 42.97/49.73 | 48.16/51.69 | ||
| 2 | 2/2 | 0.99 | 42.81/49.80 | 47.63/51.66 | ||
| 3 | 3/3 | 1.66 | 42.50/50.98 | 47.67/52.12 | ||
| Adapter norm | Utility | |||
|---|---|---|---|---|
| FULM | FIRM | FULM | FIRM | |
| 1 | 0.73 ( ) | 1.65 ( ) | 54.22 | 52.68 |
| 2 | 1.44 ( ) | 2.59 ( ) | 43.31 | 47.44 |
| 3 | 1.86 ( ) | 2.78 ( ) | 24.03 | 39.10 |
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
| Symbol | Meaning |
|---|---|
| Concatenated , with | |
| Initial model and pretrained Fisher reference | |
| Fisher retained fraction and LoRA scaling coefficient | |
| Raw empirical Fisher diagonal for parameter of client | |
| Per-tensor max-normalized, Top- Fisher sensitivity | |
| Forget clients sharing unlearning domain |
| Method | HP | MMLU | |
|---|---|---|---|
| Pretrain | – | 44.07 | 54.46 |
| FULM | 0.005 | 43.43 | 54.29 |
| FULM | 0.010 | 41.85 | 54.19 |
| FULM | 0.020 | 41.01 | 53.88 |
| FULM | 0.030 | 30.25 | 53.51 |
| FULM | 0.050 | 10.23 | 52.21 |
| Method | Bio | Cyber | MMLU | |
|---|---|---|---|---|
| Pretrain | – | 70.93 | 43.53 | 61.12 |
| FULM | 0.05 | 71.41 | 43.63 | 61.10 |
| FULM | 0.10 | 70.78 | 42.68 | 60.82 |
| FULM | 0.15 | 70.31 | 42.07 | 60.30 |
| FULM | 0.20 | 69.21 | 41.67 | 59.36 |
| FULM | 0.30 | 61.82 | 38.45 | 56.62 |
| Component (per client unless stated) | Time / Size |
|---|---|
| Adapter training | 0.63 min |
| bf16 model load for Fisher | 0.11 min |
| Fisher estimation, 20 batches | 15.96 min ∗ |
| Peak GPU memory: training / Fisher | 19.7 / 38.4 ∗ GB |
| Task-vector checkpoint | 336 MiB |
| Dense Fisher on adapter support (derived) | 336 MiB values |
| Pair ( ) | Bio gap | Cyber gap | MMLU |
|---|---|---|---|
| F/U (0.4/0.10) | 0.000 | 0.000 | -0.007 |
| F/U (0.6/0.20) | 0.236 | 0.050 | +0.413 |
| F/U (1.0/0.30) | 0.236 | 0.101 | +2.756 |
| F/U (1.3/0.35) | 0.550 | 0.151 | +2.471 |
| Bio | Cyber | Util | |
|---|---|---|---|
| 42.97 | 31.96 | 48.16 | |
| 49.57 | 36.39 | 51.68 | |
| 50.75 | 37.49 | 52.41 | |
| 52.00 | 37.85 | 52.85 | |
| 54.05 | 38.35 | 53.29 | |
| 55.07 | 38.85 | 53.45 |
| Pair ( ) | Bio gap | Cyber gap | MMLU |
|---|---|---|---|
| Q/F (0.3/0.3) | 0.157 | 0.050 | -0.028 |
| Q/F (0.4/0.4) | 0.393 | 0.252 | -0.036 |
| Q/F (0.5/0.5) | 0.393 | 0.101 | -0.114 |
| Q/F (0.7/0.6) | 0.157 | 0.151 | -0.085 |
| Q/F (1.5/1.1) | 0.000 | 0.201 | +0.669 |
| Q/F (2.2/1.5) | 0.393 | 0.302 | +1.723 |
Federated Unlearning
Federated unlearning removes a client’s or record’s influence from a collaboratively trained model while preserving useful knowledge.
See all 27 papers