Initiating Removal from Operational Symptoms in Federated Vehicular Networks

Initiating Removal from Operational Symptoms in Federated Vehicular Networks Zihao Ding1 , Jun Huang1 , and Qiang Duan2

arXiv:2610.22584v1 [cs.LG] 15 Oct 2026

1

Department of Electrical Engineering and Computer Science, South Dakota State University, Brookings, SD 57007, USA 2 Information Sciences and Technology Department, Pennsylvania State University, Abington, PA 19001, USA Email: zihao.ding@jacks.sdstate.edu, jun.huang@sdstate.edu, qduan@psu.edu

Abstract—Connected vehicles train a driving model through federated learning (FL) and drive with it, so a faulty contribution often surfaces only as a delayed symptom on the road. Federated unlearning (FU) assumes that a removal request names what to forget. A symptom names no vehicle or round, and aggregation has already spread its cause across the fleet. We propose Aggregation-Time Operational-evidence Neutralization of Effects (ATONE), which makes unlearning a term of the FL aggregation rule. ATONE projects everyday driving errors and reported symptoms onto a subspace spanned by recent global increments. It propagates the surviving effect of every contribution with curvature estimated from these increments and scores all contributions in one backward pass. A twotier correction suppresses suspected effects in every round and eliminates confirmed ones after a one-round probe. We prove that backward scoring matches forward scoring and that the elimination is exact when training is flat outside the subspace. On three driving datasets, ATONE leaves 43% to 61% less residual harm than the strongest baseline in eight of nine settings while staying within 0.36 points of full retraining in utility. Index Terms—Federated unlearning, connected and autonomous vehicles, poisoning attacks, vehicular network security.

I. I NTRODUCTION Mobile autonomous systems keep learning after deployment, so the knowledge they hold at the edge changes over their operational lifetime [1]. Connected vehicles follow this pattern by training a shared driving model through federated learning (FL), coordinated by a roadside unit [2]. The same model drives the fleet. A faulty contribution, whether mislabeled in fog or crafted by an attacker [3], therefore reaches every vehicle through aggregation. Vehicles that leave the range of the roadside unit drive with an older copy until they reconnect, so the fault outlives the round that added it. Federated unlearning (FU) removes the effect of an aggregated contribution [4]–[6]. These methods share one assumption. A removal request from a departing client or from a data owner exercising the right to erasure [7] names what to forget, so the procedure starts with a known target. A vehicle fleet receives no such request. Harm surfaces instead as a symptom, such as a near miss, many rounds later at a vehicle that never made the faulty contribution. A symptom says that the fleet has learned something wrong, but not which piece of learning is at fault. By then, aggregation has copied the contribution into every model downloaded since, so removing it at the

source vehicle alone is not enough. A compromised vehicle may fabricate a symptom to frame an honest contributor. Defenses against poisoning do not close this gap. Robust aggregation [8] and anomaly detection [9] inspect updates when they are submitted. A contribution collected in fog, however, looks normal at that moment, and its contributor need not be malicious. Durable backdoors are also built to survive benign training long after the attack stops [10]. Post-hoc tracing [11] names suspected clients, but it needs a labeled misclassified input and stored checkpoints, and it leaves removal to another method. It also scores the influence that a contribution once had, so it flags old effects that training has long since washed out. The FL loop, however, carries the signals needed to infer the removal target. Every vehicle already differentiates its loss, so one more backward pass on recent driving data shows where the deployed model errs without a labeled failure case. The recent global increments also reveal how training shrinks an old effect. Influence functions need Hessian-vector products for this and are fragile in deep networks [12], whereas the increments come free at the coordinator. Together, the two signals measure the harm a contribution still causes, which is what deserves removal. That harm can only persist along flat directions that training does not wash out, where it stays exactly as submitted and can therefore be subtracted at once. Motivated by these insights, we design an in-loop unlearning method for vehicular FL. Aggregation-Time Operationalevidence Neutralization of Effects (ATONE) makes unlearning a term of the FL aggregation rule rather than a procedure run after an incident. ATONE projects everyday driving errors and reported symptoms onto the subspace of recent increments. It propagates the surviving effect of every contribution with curvature estimated from those increments and scores all contributions in one backward pass. A two-tier correction then suppresses suspected effects in every round and eliminates a confirmed one after a one-round probe, which also filters fabricated symptoms. The probe measures the utility loss of each elimination instead of estimating it. The coordinator stores no past model or update, and its only long-term state is one small curvature operator per window, regardless of the fleet size and the number of contributions it has aggregated. Our contributions are summarized as follows: • We formulate FU for a fleet whose removal target is inferred from delayed symptoms, as minimizing residual

Near miss

Aggregation

Which update caused it? Harmful contribution Symptom report

Up

da

te

Gl

ob al

mo

de

RSU

l

(Coordinator) Fake symptom

Out of range

Compromised Delayed update

Fig. 1. The system model of symptom-triggered unlearning.

harm under per-round utility and total cost budgets. We propose ATONE, which aggregates operational evidence, scores residuals in one backward pass, and corrects the model in two tiers inside the aggregation rule at the roadside unit, without storing any past checkpoint. • We prove that the propagation operator is the training curvature inside the evidence subspace, that backward and forward scoring agree, and that the two-part elimination returns the model trained without the removal target. • On three datasets, ATONE leaves 43% to 61% less residual harm than the strongest baseline in eight of nine settings and keeps utility within 0.36 points of retraining. •

II. S YSTEM M ODEL AND P ROBLEM F ORMULATION A. System Model We consider a fleet of N connected vehicles coordinated by a roadside unit, as illustrated in Fig. 1. Each vehicle k maintains aSlocal driving dataset Dk that remains on board, N and D = k=1 Dk denotes the union of all local datasets. The vehicles collaboratively train a shared driving model θ through federated learning (FL), with the global objective min θ

N X

pk E(x,y)∼Dk [ℓ(x, y; θ)] ,

(1)

k=1

where ℓ is the per-sample loss and pk = |Dk |/|D| reflects the relative data volume of vehicle k. At round t, the coordinator distributes θ[t] to the vehicles currently in range. Each participating vehicle performs local stochastic gradient descent on Dk to obtain θ k [t] and returns the update gk [t] = θ k [t] − θ[t]. The coordinator then aggregates the received updates as θ[t + 1] = θ[t] +

N X

pk gk [t].

(2)

k=1

Local epoch counts may vary with on-board computational capacity, while vehicles outside communication range continue operating with older model versions until they reconnect.

The deployed model is also used for driving, allowing operational failures to reveal problems that were not apparent during training. After a near miss, an inconsistent prediction, or a disagreement with another vehicle, a vehicle reports the observed event to the coordinator. We refer to such an observation as a symptom and denote by S[1:t] all symptoms received up to round t. A symptom indicates that some learned behavior may be faulty, but does not directly identify the training contribution responsible for it. We use a contribution u to represent the updates gk [t] submitted by one vehicle over a window of rounds and within a particular scope, such as an object class or road segment, and let U denote all contributions incorporated into the model. Through Eq. (2), the effect of a contribution propagates to vehicles that subsequently download the global model. Its holder set Au ⊆ [N ] can therefore expand across the fleet, making partial removal insufficient to eliminate its effect. We assume that an adversary controls a fraction f of the vehicles. Compromised vehicles may collude, fabricate symptoms, and delay their updates, but cannot impersonate honest vehicles or read their raw data. B. Problem Formulation Conventional federated unlearning (FU) assumes that a removal request specifies what must be forgotten, such as data associated with a departing client or a data owner exercising a deletion right. The unlearning procedure therefore starts with the removal target already known. This assumption does not hold in an autonomous vehicle fleet. A harmful contribution may become visible only after its effect produces an operational symptom, potentially many rounds after Eq. (2) has propagated it through the global model. Moreover, the observed symptom contains no explicit correspondence to the vehicle, update window, or data scope responsible for the behavior. The removal target must therefore be inferred from delayed operational evidence rather than supplied externally, which is the central problem considered in this work. Let ϕu ∈ {0, 1} indicate whether contribution u is faulty, ρu [t] ∈ [0, 1] denote the fraction of its effect that remains in θ[t], and h(u) quantify the harm caused by that effect to the driving task. The residual harm in the fleet at round t is X H[t] = ϕu ρu [t] h(u). (3) u∈U

At round t, the coordinator selects a removal set U[t] ⊆ U whose effects are to be cleared from their holders. Removing these contributions incurs communication and computation cost C(U[t]) and may reduce task utility by ∆(U[t]). The objective is to minimize the average residual harm over T rounds while limiting both removal-induced utility degradation and the total removal cost: T 1X H[t] (P) : min {U [t]} T t=1 s.t. ∆(U[t]) ≤ ϵ, T X t=1

C(U[t]) ≤ B.

(4)

Forward: one chain per contribution

Split at round

Carry to round and eliminate Unmoved

chains

=

−

Same scores

Symptom Driving

Backward: one pass for all contributions

Cleaned

Discounted

Withheld: only

Source

Fig. 2. Forward residual propagation and its backward equivalent.

Fig. 3. Split of a residual into an unmoved and a discounted part.

The first constraint prevents indiscriminate removal that sacrifices the driving task, while the second bounds the total communication and computation devoted to removal. Problem (P) cannot be solved directly because its key quantities are not observable to the coordinator. In particular, ϕu is unknown, directly measuring ρu [t] would require constructing a counterfactual model trained without u, and the coordinator observes only the delayed symptom history S[1:t]. These symptoms provide evidence of harmful behavior but no label linking a failure to the contribution that caused it.

B. Residual Propagation and Scoring The evidence d[t] says how the model errs but not which contribution is responsible. The two are connected by the residual θ[t] − θ −u [t] of contribution u, where θ −u [t] is the model that would have been obtained had u never been aggregated. Reading it off directly requires that counterfactual model, so ATONE propagates it instead, using one linear operator that all contributions share. The propagation operator M[τ ] ∈ Rq×q is computed from increments that the coordinator already holds,

III. ATONE: AGGREGATION -T IME O PERATIONAL -E VIDENCE N EUTRALIZATION OF E FFECTS To solve (P) in Eq. (4), we design Aggregation-Time Operational-evidence Neutralization of Effects (ATONE), an in-loop unlearning method whose three modules are described in Sections III-A, III-B, and III-C. Fig. 2 and Fig. 3 illustrate the two steps that the equations alone leave implicit.

M[τ ] = − V[τ ]⊤ (W[τ + 1] − W[τ ]) W[τ ]† V[τ ],

A. Operational Evidence Aggregation This module turns the symptoms of Section II-A, together with the ordinary experience of driving, into one direction the coordinator can act on. A vehicle running local training already differentiates the loss, so stating where the deployed model is wrong costs one further backward pass and no labeled failure case. Reports must nevertheless be small and comparable, which calls for a common low-dimensional subspace. Let w[τ ] = θ[τ + 1] − θ[τ ] denote the global increment of round τ , which is the aggregated term of Eq. (2). The evidence subspace spans the q most recent increments, V[t] = orth(W[t]) , W[t] = [w[t − 1], . . . , w[t − q]] , (5) where q is the subspace dimension and orth(·) returns an orthonormal basis of the column space. Every vehicle rebuilds V[t] from the consecutive global models it has downloaded, so the subspace is shared without any extra broadcast. Vehicle k evaluates the loss gradient on its recent driving data and uploads the q projected coefficients alongside its update. The coordinator combines them with the weights of Eq. (1) into the fleet evidence d[t]. A symptom in S[1:t] travels through the same channel and enters d[t] with a larger weight, so sparse reported failures and dense everyday error accumulate in one quantity of only q coefficients.

(6)

†

where (·) denotes the pseudo-inverse. Each column of W[τ + 1] − W[τ ] is the difference of two consecutive increments. Since every increment approximates a scaled negative gradient, this difference approximates a curvature product, which Lemma 1 makes exact. No Hessian-vector product is computed on board, and the coordinator keeps one operator per window regardless of the fleet size N and of |U|. Let gu collect the weighted updates pk gk [τ ] of contribution u, and let θ[tu ] be the first global model that contains them. Applying Eq. (6) from tu to the present gives zu [t] =

t−1 Y

(I − M[τ ]) V[tu ]⊤ gu ,

(7)

τ =tu

where I is the identity matrix and the product places later rounds on the left. The surviving fraction in Eq. (3) is ρu [t] = ∥zu [t]∥/∥V[tu ]⊤ gu ∥, and u is scored by ⟨d[t], zu [t]⟩. The score is large when what survives of u points where the fleet errs now, which is residual harm, not its past influence, as Proposition 2 in Section IV shows to first order. Evaluating Eq. (7) for every contribution would scale with |U|. The coordinator instead multiplies d[t] by (I − M[τ ])⊤ from τ = t − 1 down to the oldest tu . The score of u is the inner product of the vector reached at tu with V[tu ]⊤ gu . One backward pass thus serves every contribution, and each score costs one q-dimensional inner product. Fig. 2 contrasts the two directions, which yield the same score by Proposition 1. C. Two-Tier In-Loop Correction This module acts on the model using the scores of Section III-B. It runs in two tiers, because the two parts of a

residual are not recovered at the same cost. The first tier fires in every round and augments Eq. (2) with a suppression term, θ[t + 1] = θ[t] +

N X

pk gk [t] −

k=1

X

λu [t] V[t] zu [t], (8)

u∈U

where the gain λu [t] increases with the score of u and is capped so that the per-round utility loss stays within ϵ. This tier needs no trigger and adds nothing to the uplink, but it reaches only the part of the residual lying inside V[t]. The second tier fires when a score exceeds a threshold κ. The coordinator broadcasts the candidate counterfactual model for one round and collects from a few vehicles whether the reported error is removed and how far clean accuracy moves. The latter measures ∆(U[t]) instead of estimating it, and a candidate derived from a fabricated report improves no genuine behavior and is discarded. On confirmation, the coordinator eliminates u by subtracting from θ[t]
(9) I − V[tu ]V[tu ]⊤ gu + V[t] zu [t], | {z } {z } | unmoved

discounted

whose two terms are shown in Fig. 3. The first is returned once by the source vehicle and subtracted as submitted, because training leaves those directions untouched. The second is discounted so that subtraction does not overshoot. Theorem 1 shows that the two terms together equal the residual of u. If the source withholds its update, only the second term is applied, which still clears the harm counted by H[t]. The source is then suspended for the affected scope in later rounds. Beyond the training of Eqs. (1)–(2), ATONE adds q coefficients per vehicle per round on the uplink, one model-sized exchange whenever the second tier fires, and one q×q operator per window on the coordinator. A smaller κ eliminates sooner, which shortens the interval over which H[t] accumulates and, by Theorem 2, keeps the elimination error small. The cost is more probes and faster consumption of B. IV. T HEORETICAL A NALYSIS This section states when the steps of Section III are exact. PN Assumption 1: Let L(θ) = k=1 pk E(x,y)∼Dk [ℓ(x, y; θ)] denote the objective of Eq. (1). The aggregation of Eq. (2) and the counterfactual training that yields θ −u [τ ] both act as gradient steps w[τ ] = −η∇L(θ[τ ]), and L is quadratic with a fixed Hessian ∇2 L(θ[τ ]) over any q + 1 consecutive rounds. Lemma 1: Under Assumption 1, Eq. (6) gives M[τ ] = η V[τ ]⊤ ∇2 L(θ[τ ]) V[τ ], the curvature of L inside the evidence subspace. Proof: By Assumption 1, the increments satisfy W[τ + 1] − W[τ ] = −η∇2 L(θ[τ ]) W[τ ]. Substituting this into Eq. (6) and using W[τ ]W[τ ]† V[τ ] = V[τ ] proves the claim. Assumption 2: For tu ≤ τ ≤ t, the evidence subspace is fixed, V[τ ] = V[tu ], and ∇2 L(θ[τ ]) maps every direction orthogonal to V[tu ] to zero, so training is flat there.

Lemma 2: Under Assumptions 1 and 2, for tu ≤ τ < t, θ[τ + 1] − θ −u [τ + 1] =

I − V[tu ] M[τ ] V[tu ]⊤

θ[τ ] − θ −u [τ ] .

(10)

Hence the residual part orthogonal to V[tu ] never changes, and its coefficients inside V[tu ] are scaled by I − M[τ ]. Proof: By Assumption 1, the residual is multiplied by I − η∇2 L(θ[τ ]) in each round, and Assumption 2 with Lemma 1 gives η∇2 L(θ[τ ]) = V[tu ]M[τ ]V[tu ]⊤ . According to Lemma 2, an effect that persists long after tu lies mostly outside the subspace, where ATONE subtracts it as submitted. Proposition 1: For every u ∈ U , ⟨d[t], zu [t]⟩ =

D t−1 Y

E ⊤ (I − M[τ ]) d[t], V[tu ]⊤ gu , (11)

τ =tu

where the product now places earlier rounds on the left. Proof: Substitute Eq. (7) and move each factor to the other slot of the inner product as its transpose. According to Proposition 1, the first slot depends on u only through tu , so one backward pass returns the score of every contribution without any assumption. Theorem 1: Under Assumptions 1 and 2, the quantity in Eq. (9) equals θ[t]−θ −u [t], so subtracting it from θ[t] returns exactly θ −u [t]. Theorem 1 follows from Lemma 2. The residual starts from gu at tu by Eq. (2), and Lemma 2 applied from τ = tu to t − 1 keeps its orthogonal part and turns V[tu ]⊤ gu into zu [t]. To relate the score to harm, let ψ be the evidence loss behind d[t], so that d[t] = V[t]⊤ ∇ψ(θ[t]). Proposition 2: If ψ is twice differentiable, then under Assumptions 1 and 2,
ψ(θ[t]) − ψ(θ −u [t]) = ⟨d[t], zu [t]⟩ + O ∥gu ∥2 + (I − V[tu ]V[tu ]⊤ )∇ψ(θ[t]), gu . (12) Proof: Expand ψ to first order around θ[t] and insert the residual of Theorem 1. Its discounted term gives ⟨d[t], zu [t]⟩, and its unmoved term gives the last term. According to Proposition 2, the score is the first-order harm of u inside the evidence subspace. The last term needs gu itself, which is why the second tier probes before it eliminates. Theorem 2: Let Assumption 1 hold and V[τ ] = V[tu ] for tu ≤ τ ≤ t. In place of the flatness in Assumption 2, suppose that 0 ⪯ η∇2 L(θ[τ ]) ⪯ 2I and η∇2 L(θ[τ ]) − V[tu ] M[τ ] V[tu ]⊤

≤ δ

(13)

for tu ≤ τ < t. Then the quantity in Eq. (9) differs from θ[t] − θ −u [t] by at most (t − tu ) δ ∥gu ∥.

Camera

Front

MentorPi 1

Raspberry Pi 5

Ackermann steering

Server

2

TOF lidar

3

2

(a)

(b)

(c)

3

Stop sign Traffic light

⋮

1

LAN

MentorPi Raspberry Pi 5

(d)

(e)

(f)

Fig. 4. (a) Top view of the MentorPi robot car. (b)–(f) Simulated city: overview, vehicle view, residential block, curve, and intersection.

Fig. 5. Hardware testbed. MentorPi robot cars exchange models and updates with a server over a LAN while driving on a physical track.

TABLE I U NLEARNING AND RESIDUAL HARM PER METHOD AND DATASET, AND REMOVAL COST ON THE TESTBED . FmIoU, RmIoU, TmIoU, AND MIA ARE IN %, H̄ IN PERCENTAGE POINTS , AND THE DELAY IN ROUNDS . E ACH VALUE IS THE MEAN OVER FIVE RANDOM SEEDS WITH THE STANDARD DEVIATION IN PARENTHESES . T HE TESTBED COLUMNS COME FROM THE R ASPBERRY P I 5 CARS TRAINED ON F OGGY C ITYSCAPES , WITH THE TIME IN SECONDS AND THE UPLINK IN MB THAT THE REMOVAL ADDS . FmIoU AND MIA ARE BEST WHEN CLOSEST TO R ETRAIN OF THE SAME UNLEARNING TYPE . A CELL MARKS THE BEST VALUE AND A CELL THE SECOND BEST WITHIN EACH UNLEARNING TYPE , EXCLUDING R ETRAIN . Method (a) Client unlearning FedRecover [S&P’23] [4] FedOSD [AAAI’25] [5] FedEditor [TIFS’25] [6] FLForensics [NeurIPS’25] [11] FLTracer [TIFS’24] [9] ATONE Retrain (b) Class unlearning FedRecover [S&P’23] [4] FedOSD [AAAI’25] [5] FedEditor [TIFS’25] [6] FLForensics [NeurIPS’25] [11] FLTracer [TIFS’24] [9] ATONE Retrain (c) Sample unlearning FedRecover [S&P’23] [4] FedOSD [AAAI’25] [5] FedEditor [TIFS’25] [6] FLForensics [NeurIPS’25] [11] FLTracer [TIFS’24] [9] ATONE Retrain

Foggy Cityscapes TmIoU↑ MIA

ACDC TmIoU↑

BDD100K TmIoU↑ MIA

Testbed Time↓

H̄↓

Delay↓

FmIoU

RmIoU↑

MIA

H̄↓

Delay↓

FmIoU

RmIoU↑

H̄↓

Delay↓

FmIoU

0.18(±0.03) 64.80(±0.64) 64.03(±0.57) 0.29(±0.05) 63.47(±0.91) 63.07(±0.77) 0.13(±0.03) 65.21(±0.73) 64.82(±0.83) 0.26(±0.05) 64.31(±0.42) 63.84(±0.35) 0.23(±0.03) 64.59(±0.87) 63.87(±0.42) 0.11(±0.02) 65.85(±0.78) 65.25(±0.40) 0.09(±0.02) 66.21(±0.44) 65.47(±0.74)

56.2(±2.5) 61.3(±3.4) 53.8(±2.5) 59.8(±2.8) 57.3(±3.2) 51.5(±2.6) 50.4(±3.1)

0.46(±0.07) 0.71(±0.12) 0.33(±0.05) 1.05(±0.15) 0.83(±0.15) 0.14(±0.02) 0.00

7.2(±1.1) 11.4(±1.8) 5.6(±1.0) 16.3(±2.3) 13.8(±2.4) 3.1(±0.6) -

0.32(±0.04) 1.12(±0.18) 0.27(±0.06) 0.37(±0.04) 0.40(±0.05) 0.25(±0.05) 0.20(±0.03)

63.98(±0.36) 63.56(±0.37) 64.76(±0.89) 64.28(±0.28) 64.05(±0.80) 65.62(±0.33) 65.82(±0.28)

63.93(±0.58) 62.66(±0.71) 64.75(±0.89) 63.55(±0.55) 63.64(±0.78) 64.94(±0.36) 65.24(±0.94)

56.5(±12.2) 61.2(±14.7) 51.8(±12.0) 61.8(±11.8) 58.2(±10.2) 50.0(±10.5) 49.4(±9.7)

0.58(±0.08) 1.26(±0.20) 0.40(±0.05) 1.44(±0.23) 1.09(±0.19) 0.23(±0.03) 0.00

8.5(±1.5) 17.6(±2.4) 6.2(±0.6) 19.7(±3.5) 15.4(±1.8) 4.3(±0.8) -

0.30(±0.04) 0.41(±0.06) 0.26(±0.04) 0.36(±0.08) 0.35(±0.07) 0.25(±0.06) 0.20(±0.03)

64.38(±0.57) 63.72(±0.93) 65.66(±0.61) 64.60(±0.47) 64.57(±0.83) 66.10(±0.83) 66.32(±0.93)

63.74(±0.59) 63.39(±0.51) 64.85(±0.57) 63.96(±0.73) 64.04(±0.70) 65.57(±0.64) 65.73(±0.74)

57.7(±6.7) 60.0(±6.6) 52.8(±7.2) 60.4(±6.1) 58.6(±7.4) 50.5(±6.5) 49.8(±5.2)

0.38(±0.06) 0.63(±0.11) 0.29(±0.05) 0.93(±0.15) 0.74(±0.11) 0.12(±0.01) 0.00

6.8(±1.1) 10.2(±1.8) 4.9(±0.9) 14.6(±1.8) 12.3(±1.4) 2.7(±0.5) -

0.22(±0.04) 0.34(±0.07) 0.16(±0.03) 0.32(±0.06) 0.29(±0.05) 0.12(±0.02) 0.11(±0.03)

64.36(±0.68) 192.4(±16.7) 307.964(±26.788) 62.87(±0.81) 68.7(±6.4) 83.768(±9.111) 65.12(±0.74) 35.6(±2.8) 27.074(±9.507) 64.07(±0.63) 261.8(±24.6) 353.061(±36.545) 64.48(±0.59) 398.5(±37.2) 409.755(±31.444) 65.76(±0.67) 54.8(±4.2) 99.229(±13.650) 66.09(±0.71) -

45.81(±0.89) 46.33(±0.70) 45.46(±0.61) 46.72(±0.46) 46.17(±0.69) 45.39(±0.63) 45.27(±0.45)

64.01(±0.36) 63.19(±0.87) 65.55(±0.49) 64.50(±0.58) 64.35(±0.61) 65.86(±0.35) 66.17(±0.58)

64.23(±0.91) 63.60(±0.57) 65.71(±0.94) 63.91(±0.80) 63.58(±0.56) 65.52(±0.26) 65.78(±0.74)

56.5(±2.9) 60.7(±3.5) 50.0(±3.0) 58.7(±3.9) 58.6(±4.0) 50.6(±3.5) 49.7(±3.5)

1.13(±0.14) 1.57(±0.28) 0.22(±0.02) 1.82(±0.24) 1.29(±0.27) 0.28(±0.05) 0.00

14.6(±1.8) 19.3(±2.9) 3.7(±0.5) 29.4(±3.2) 22.6(±3.2) 4.8(±0.9) -

22.62(±0.79) 23.20(±0.91) 22.24(±0.69) 23.70(±0.65) 23.08(±0.41) 22.13(±0.67) 22.00(±0.35)

64.20(±0.85) 63.06(±0.84) 64.70(±0.70) 64.10(±0.53) 64.07(±0.93) 65.45(±0.62) 65.68(±0.49)

63.15(±0.67) 62.83(±0.44) 64.52(±0.86) 63.61(±0.42) 63.29(±0.37) 64.86(±0.69) 65.09(±0.37)

58.8(±8.5) 65.4(±8.7) 55.0(±9.6) 62.7(±9.4) 59.2(±9.1) 51.5(±12.2) 50.8(±7.9)

1.65(±0.27) 2.17(±0.53) 0.82(±0.16) 2.66(±0.41) 1.95(±0.23) 0.35(±0.06) 0.00

18.4(±2.7) 25.1(±4.1) 10.3(±1.6) 36.7(±5.5) 28.9(±4.0) 5.7(±1.1) -

38.56(±0.53) 39.07(±0.47) 38.27(±0.41) 39.46(±0.27) 38.96(±0.58) 38.19(±0.52) 38.10(±0.49)

64.68(±0.35) 63.90(±0.67) 65.40(±0.92) 64.71(±0.84) 64.19(±0.35) 65.72(±0.73) 66.08(±0.78)

64.27(±0.39) 63.18(±0.79) 64.83(±0.32) 63.76(±0.32) 63.59(±0.44) 65.33(±0.68) 65.56(±0.81)

56.5(±5.9) 65.7(±6.8) 54.3(±5.5) 59.3(±5.3) 58.5(±5.3) 51.7(±8.3) 51.1(±9.3)

0.97(±0.15) 1.36(±0.16) 0.49(±0.08) 1.64(±0.29) 1.16(±0.20) 0.19(±0.03) 0.00

12.4(±2.4) 17.8(±2.5) 7.6(±1.0) 26.1(±4.8) 20.4(±3.0) 4.1(±0.6) -

45.72(±0.64) 46.58(±0.48) 45.36(±0.46) 46.91(±0.73) 46.24(±0.57) 45.42(±0.55) 45.31(±0.39)

63.96(±0.73) 138.2(±8.6) 63.28(±0.57) 76.3(±6.2) 65.17(±0.68) 42.7(±3.9) 64.08(±0.51) 297.6(±25.8) 64.51(±0.76) 436.8(±41.3) 66.02(±0.81) 69.3(±5.7) 66.23(±0.72) -

222.924(±20.191) 67.017(±13.307) 37.382(±9.507) 247.405(±20.865) 289.925(±39.011) 166.231(±11.282) -

42.28(±0.55) 42.64(±0.73) 41.83(±0.51) 44.93(±0.85) 44.21(±0.63) 41.69(±0.57) 41.57(±0.60)

63.88(±0.68) 63.53(±0.84) 65.11(±0.86) 64.44(±0.84) 64.13(±0.44) 66.04(±0.62) 65.87(±0.77)

63.50(±0.63) 62.51(±0.87) 64.93(±0.66) 63.32(±0.69) 63.69(±0.41) 65.58(±0.50) 65.41(±0.35)

57.7(±5.7) 65.2(±4.6) 54.2(±7.4) 62.3(±5.3) 59.8(±6.2) 52.1(±5.2) 51.1(±7.5)

0.63(±0.07) 0.89(±0.16) 0.44(±0.09) 1.38(±0.25) 1.17(±0.24) 0.17(±0.02) 0.00

9.2(±1.0) 13.6(±2.4) 7.3(±1.1) 24.8(±3.8) 19.1(±3.6) 3.6(±0.7) -

29.99(±0.88) 30.45(±0.27) 29.47(±0.41) 33.08(±0.27) 32.24(±0.74) 29.36(±0.49) 29.20(±0.45)

64.55(±0.80) 63.23(±0.45) 65.83(±0.82) 63.99(±0.67) 63.86(±0.46) 65.65(±0.76) 65.94(±0.34)

63.94(±0.84) 62.42(±0.74) 64.53(±0.65) 63.70(±0.42) 63.13(±0.32) 65.08(±0.40) 65.36(±0.68)

60.0(±21.1) 70.0(±29.2) 56.7(±27.4) 66.7(±15.7) 63.3(±24.6) 53.3(±32.2) 50.0(±23.6)

0.76(±0.09) 1.14(±0.17) 0.55(±0.08) 1.60(±0.21) 1.43(±0.20) 0.25(±0.03) 0.00

10.8(±1.4) 15.7(±1.9) 8.1(±1.4) 27.2(±4.6) 22.5(±2.8) 4.6(±0.7) -

37.39(±0.54) 37.64(±0.38) 36.91(±0.30) 39.75(±0.85) 39.11(±0.77) 36.81(±0.61) 36.70(±0.68)

64.97(±0.54) 63.79(±0.83) 65.81(±0.61) 64.64(±0.40) 65.12(±0.47) 66.56(±0.43) 66.47(±0.85)

64.14(±0.66) 63.03(±0.27) 65.05(±0.63) 64.62(±0.82) 63.92(±0.64) 65.98(±0.79) 65.91(±0.43)

56.0(±22.7) 60.0(±13.3) 52.0(±19.3) 58.0(±17.5) 54.0(±23.2) 50.0(±21.6) 48.0(±16.9)

0.54(±0.06) 0.78(±0.09) 0.37(±0.05) 1.22(±0.19) 0.99(±0.20) 0.16(±0.02) 0.00

8.6(±1.0) 12.7(±1.6) 6.1(±1.0) 21.9(±3.0) 17.3(±2.4) 3.4(±0.7) -

42.41(±0.62) 42.89(±0.47) 41.96(±0.58) 44.52(±0.69) 44.13(±0.61) 41.79(±0.54) 41.62(±0.59)

63.92(±0.79) 104.3(±8.1) 63.18(±0.66) 59.2(±5.4) 65.09(±0.53) 31.4(±2.3) 64.47(±0.72) 128.6(±10.7) 63.94(±0.58) 229.4(±18.6) 65.88(±0.71) 47.1(±3.6) 65.97(±0.83) -

146.903(±16.298) 47.690(±14.940) 29.651(±8.697) 162.365(±13.851) 172.673(±26.615) 67.017(±8.149) -

FmIoU

RmIoU↑

Proof: Let ξ[τ ] be the gap between θ[τ ] − θ −u [τ ] and Eq. (9) at round τ , so ξ[tu ] = 0. Per round, the two are multiplied by the non-expansive I − η∇2 L(θ[τ ]) and by I − V[tu ]M[τ ]V[tu ]⊤ . Their difference, bounded by Eq. (13), acts on Eq. (9), whose norm stays at most ∥gu ∥. Hence ∥ξ[τ + 1]∥ ≤ ∥ξ[τ ]∥ + δ∥gu ∥. According to Theorem 2, the elimination error grows at most linearly with the rounds elapsed since tu , so a smaller κ that eliminates sooner also eliminates more accurately. V. P ERFORMANCE E VALUATION A. Experimental Setup We simulate the fleet in CARLA on a city map built with RoadRunner, shown in Fig. 4(b)–(f). N = 50 vehicles drive in this city at the same time, and a vehicle joins round t only within the range of the RSU, which it reaches over IEEE 802.11. The driving model θ is an LR-ASPP segmentation network with a MobileNetV3-Large backbone. It is trained separately on Foggy Cityscapes [13], ACDC [14], and BDD100K [15], three driving datasets with the same 19 classes that span fog, other adverse weather, and many cities. Each vehicle receives a different share of the training split. The faulty contribution relabels pedestrians as road in the images of one vehicle during one window. The validation split is halved. One half serves as recent driving data, and a symptom is reported when the model labels an annotated pedestrian as

RmIoU↑

Uplink↓

road. The other half is held out for evaluation. On the physical track of Fig. 5, MentorPi robot cars train on Foggy Cityscapes with a Raspberry Pi 5 and exchange models and updates with a server over a local area network (LAN). We adapt the FU metrics to segmentation. Unlearning efficacy is measured by the forget mIoU (FmIoU), the mean intersection over union on the images of the faulty contribution scored against their faulty labels, and by the success rate of a membership inference attack (MIA) against these images. Utility is measured by the retain mIoU (RmIoU) on the training images of the other contributions and the test mIoU (TmIoU) on the held-out half. An unlearned model should match a model retrained without the faulty contribution on all four. For Problem (P), the residual harm H[t] is the rate at which annotated pedestrians in the held-out half are labeled as road, in excess of that of the retrained model, and H̄ is its average over T rounds. The reaction delay counts the rounds from the first symptom until H[t] vanishes. The cost C(U[t]) is the on-board time and uplink volume that the removal adds on the testbed. We compare ATONE with five baselines. FedRecover [4], FedOSD [5], and FedEditor [6] are told the faulty contribution. FLForensics [11] and FLTracer [9] trace it themselves and hand it to FedRecover for removal. B. Experimental Results Table I compares the methods. ATONE stays within 0.36 points of Retrain in FmIoU, RmIoU, and TmIoU, and within

60 40 20

50

70

0

90

Round t

(a) Residual harm over rounds.

Foggy

ACDC

BDD

12

300

9

200

6

100

3

0

Testbed

Client, delay Class, delay Sample, delay

50

60

70

80

5 (percentile)

90

0

(c) Cost and delay versus κ.

(b) Top-1 attribution accuracy.

Client Class Sample

Client, TmIoU Class, TmIoU Sample, TmIoU

Inside Outside

3 65.5

2

65

1 0

TmIoU (%)

80

Client, uplink Class, uplink Sample, uplink

Mean H[t] (pp)

Client, FLForensics Class, FLForensics Sample, FLForensics

Delay (rounds)

Client, ATONE Class, ATONE Sample, ATONE

100

Uplink (MB)

10 8 6 4 2 0 30

FLForensics FLTracer ATONE

Top-1 (%)

H[t] (pp)

No unlearning FedRecover FedOSD FedEditor

64.5 Tier 1

Tier 2

Both

(d) Two-tier ablation.

10 5 10

3

10

1

10 -1

10 4

0

50

100

150

Fleet size N

(a) Fleet size.

10

3

10

2

10 1 200

Client, Top-1 Class, Top-1 Sample, Top-1

100 80 60 40 20 0

Client, uplink Class, uplink Sample, uplink

300 200 100 1

2

4

8

16

Subspace dimension q

Uplink (KB/round)

Time Sto.

Top-1 (%)

ATONE FLForensics FLTracer

Storage (MB)

Time (ms)

Fig. 6. Results of ATONE. (a) Residual harm H[t] under sample unlearning on Foggy Cityscapes. (b) Share of symptoms whose faulty contribution is ranked first under each unlearning type. (c) Uplink cost and reaction delay as κ varies. (d) H̄ inside and outside the subspace and TmIoU with one tier or both.

0 32

(b) Subspace dimension.

Fig. 7. Scalability of ATONE. (a) Coordinator scoring time and storage as N grows. (b) Top-1 attribution accuracy and uplink per vehicle per round as q grows.

3.3 points in MIA. In eight of nine settings, its H̄ is 43% to 61% below that of FedEditor, the strongest baseline, although FedEditor is told the faulty contribution. The two tracing baselines have delays of 12.3 to 36.7 rounds against at most 5.7 for ATONE. On the testbed, they also take 2.7 to 7.3 times its time and 1.5 to 4.1 times its uplink per removal. In Fig. 6a, ATONE brings H[t] below 0.1 points by round 47, four rounds before FedEditor and 25 before FLForensics. In Fig. 6b, its Top-1 accuracy is 11.9 to 17.6 points above that of FLForensics. In Fig. 6c, a larger κ cuts the uplink up to 6.1 times but raises the delay to at most 11.3 rounds. In Fig. 6d, the first tier alone leaves 1.43 to 2.37 points outside the subspace, and the second alone leaves 1.16 to 1.93 points inside it. Both tiers keep each part below 0.22 points. In Fig. 7a, the scoring time of ATONE stays below 6 ms up to N = 200 and its storage at 206 MB, while FLTracer needs 63.5 s and 10.6 GB. In Fig. 7b, the Top-1 accuracy rises little beyond the default q = 8, while the uplink per vehicle keeps growing. VI. C ONCLUSION We studied federated unlearning for a vehicle fleet that learns of a faulty contribution only through delayed symptoms. ATONE infers and removes the contribution inside the aggregation rule without storing past checkpoints. On three driving datasets, it yields the lowest residual harm in eight of nine settings and stays within 0.36 points of Retrain. R EFERENCES [1] Y. Li, H. Wang, W. Xu, T. Xiao, H. Liu, M. Tu, Y. Wang, X. Yang, R. Zhang, S. Yu, S. Guo, and R. Li, “Unleashing the Power of Continual

Learning on Non-Centralized Devices: A Survey,” IEEE Communications Surveys & Tutorials, vol. 28, pp. 1059–1098, 2026. [2] Z. Jin, C. Yang, Y. Ye, L. Zhang, J. Shen, and J. Su, “Mobility-Aware Semi-Asynchronous Federated Learning for Vehicular Networks,” IEEE Transactions on Vehicular Technology, vol. 75, no. 2, pp. 2001–2012, 2026. [3] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How To Backdoor Federated Learning,” in International Conference on Artificial Intelligence and Statistics (AISTATS), ser. Proceedings of Machine Learning Research, vol. 108, 2020, pp. 2938–2948. [4] X. Cao, J. Jia, Z. Zhang, and N. Z. Gong, “FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information,” in 2023 IEEE Symposium on Security and Privacy (SP), 2023, pp. 1366– 1383. [5] Z. Pan, Z. Wang, C. Li, K. Zheng, B. Wang, X. Tang, and J. Zhao, “Federated Unlearning with Gradient Descent and Conflict Mitigation,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 19, pp. 19 804–19 812, 2025. [6] X. Yuan, J. Liu, B. Wang, G. Chen, X. Xu, J. Wang, T. Li, and W. Wang, “FedEditor: Efficient and Effective Federated Unlearning in Cooperative Intelligent Transportation Systems,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 6560–6575, 2025. [7] Z. Ding, B. Wu, and J. Huang, “Scale: Sensitivity-Aware Federated Unlearning with Information Freshness Optimization for Mobile Edge Computing,” in Proceedings of the IEEE 46th International Conference on Distributed Computing Systems (ICDCS), 2026, pp. 1476–1486. [8] X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping,” in Proceedings of the Network and Distributed System Security Symposium (NDSS), 2021. [9] X. Zhang, Q. Liu, Z. Ba, Y. Hong, T. Zheng, F. Lin, L. Lu, and K. Ren, “FLTracer: Accurate Poisoning Attack Provenance in Federated Learning,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 9534–9549, 2024. [10] X. Song, H. Xia, S. Xu, Y. Zhu, and L. Li, “Datura: Durable and Stable Backdoor Attack against Federated Learning,” in IEEE INFOCOM 2026 - IEEE Conference on Computer Communications, 2026, pp. 1–10. [11] Y. Jia, M. Fang, H. Liu, J. Zhang, and N. Z. Gong, “Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 38, 2025, pp. 129 068–129 095. [12] J. Bae, N. Ng, A. Lo, M. Ghassemi, and R. Grosse, “If Influence Functions Are the Answer, Then What is the Question?” in Advances in Neural Information Processing Systems (NeurIPS), vol. 35, 2022, pp. 17 953–17 967. [13] C. Sakaridis, D. Dai, and L. Van Gool, “Semantic Foggy Scene Understanding with Synthetic Data,” International Journal of Computer Vision, vol. 126, no. 9, pp. 973–992, 2018. [14] C. Sakaridis, D. Dai, and L. Van Gool, “ACDC: The Adverse Conditions Dataset with Correspondences for Semantic Driving Scene Understanding,” in 2021 IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 10 745–10 755. [15] F. Yu, H. Chen, X. Wang, W. Xian, Y. Chen, F. Liu, V. Madhavan, and T. Darrell, “BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning,” in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 2633–2642.

Related documents

• Efficient Secure Federated Learning via Information-Theoretically Secure Key Distribution: A Medical Imaging Case Study#1215523
• Efficient Secure Federated Learning via Information-Theoretically Secure Key Distribution: A Medical Imaging Case Study#1194315
• Inside the Width: Trajectory Structure of Nonconservative Erasure#688904
• Toward Realistic Privacy Risk in FL-Enabled OT Intrusion Detection Systems#1341754
• Erased but Exploitable: Black-box Embedding-Aware Prompting Against Unlearned Text-to-Image Diffusion Models#1202074