VeriFi: Towards Verifiable Federated Unlearning

Abstract

Federated learning (FL) has emerged as a privacyaware collaborative learning paradigm where participants jointly train a powerful model without sharing their private data. One desirable property for FL is the implementation of the right to be forgotten (RTBF), i.e., a leaving participant has the right to request to delete its private data from the global model. Recently, several server-side unlearning methods have been proposed to remove a leaving participant's gradients from the global model. However, unlearning itself may not be enough to implement RTBF unless the unlearning effect can be independently verified, an important aspect that has been overlooked in the current literature. In this paper, we prompt the concept of verifiable federated unlearning, and propose VERIFI, a unified framework integrating federated unlearning and verification that allows systematic analysis of the unlearning and quantification of its effect, with different combinations of multiple unlearning and verification methods. In VERIFI, the leaving participant is granted the right to verify (RTV), that is, the participant notifies the server before leaving, then actively verifies the unlearning effect in the next few communication rounds. The unlearning is done at the server side immediately after receiving the leaving notification, while the verification is done locally by the leaving participant via two steps: marking and checking. The marking step injects carefully-designed markers to fingerprint the leaving participant's data, while the checking step examines the change of the global model's performance on the markers.Based on VERIFI, we conduct the first systematic and largescale study for verifiable federated unlearning, considering 7 unlearning methods and 5 verification methods that cover existing, adapted and newly proposed ones for both unlearning and verification. Particularly, the newly proposed methods include a more efficient and FL-friendly unlearning method u S2U, and two more effective and robust non-invasive-verification methods v FM and v EM (without training controllability or external data, without white-box model access or introducing security hazard). We extensively evaluate VERIFI on 7 datasets, including both (natural/facial/medical) images and audios, and 4 types of deep learning models, including both Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs). Our analysis establishes important empirical understandings and evidence for more trustworthy federated unlearning.

Verifiable and Provably Secure Machine Unlearning

“…Verifying Unlearning. Prior work [26], [61] aims at verifying unlearning by embedding backdoors [36] in models (using data whose unlearning is to be verified) and verifying its removal on unlearning. However, such approaches are probabilistic with no theoretical guarantees of when they work, unlike our rigorous cryptography-informed approach which produces verifiable proofs.…”