Split Federated Unlearning

Split Federated Unlearning Jia Chen1,2,* , Yecheng Lv1,* , Xinrong Hu1 , Mingdi Huang1 , Jun Bai3,† 1 School of Computer Science and Artificial Intelligence, Wuhan Textile University, Wuhan, China 2 Engineering Research Center of Hubei Province for Clothing Information, Wuhan Textile University, Wuhan, China 3 Australian Institute for Machine Learning (AIML), Adelaide University, Adelaide, Australia

arXiv:2610.36465v1 [cs.LG] 27 Oct 2026

Abstract

unlearning seeks to remove such influence without full retraining [3, 26]. Existing federated unlearning methods, including FedEraser [19] and FedRecovery [35], address contributions propagated through federated aggregation, while split unlearning considers removal under partitioned model execution [4, 10]. Neither formulation directly captures SFL, where both mechanisms operate together. Combining split execution with dual-side aggregation introduces distinct challenges for unlearning in SFL. Fig. 1(b) illustrates clientwise and class-wise removal, with full retained-data retraining as the ideal counterfactual reference and three model update modes. As highlighted in Fig. 1(c), three challenges arise: cross-partition coupling, as both partitions interact through exchanged activations and gradients; historical influence propagation, as repeated dual-side aggregation propagates contributions across clients and rounds; and mode-dependent feasibility, as restricting updates to one partition may limit attainable forgetting. These intertwined challenges motivate a dedicated formulation of Split Federated Unlearning (SFU). To address these challenges, we formalize SFU for client-wise and class-wise removal, distinguishing forgetting requests from the permitted model updates (Client-only, Server-only, and Joint). Full retained-data retraining serves as the ideal counterfactual reference, while mode-matched retraining captures the effects of restricted updates. We further characterize how forgotten-data influence propagates through coupled dual-side training and analyze mode-dependent unlearning feasibility through local predictiondiscrepancy bounds and excess retained-data risk under a quadratic approximation. These results identify structural limitations imposed by model partitioning, independently of any particular unlearning algorithm. To investigate SFU in practice, we propose SURE, an initial SFU approach combining dual-importance estimation, selective parameter perturbation, and retained-data recovery. SURE identifies targetrelevant parameters while accounting for retained knowledge, applies targeted perturbations within the permitted model partitions, and performs importance-guided recovery through the original SFL training protocol. We systematically evaluate SURE and existing unlearning methods adapted to SFL across different datasets, data distributions, and model update modes. Experiments on MNIST, CIFAR-10, and CIFAR-100 reveal substantial forgetting–utility tradeoffs among adapted baselines, while SURE achieves competitive agreement with mode-matched retraining at modest additional cost. Further analyses examine the effects of split position, component design, and multiple client removals. Our main contributions are threefold: (1) To the best of our knowledge, we provide the first systematic formulation of Split Federated Unlearning (SFU), jointly accounting for cross-partition

Split federated learning (SFL) combines partitioned model execution with federated aggregation to support collaborative learning across distributed Web and edge environments. However, removing learned contributions in SFL is challenging due to cross-partition coupling and historical influence propagation through dual-side aggregation. To the best of our knowledge, we provide the first systematic formulation of Split Federated Unlearning (SFU), encompassing client-wise and class-wise removal, counterfactual retraining, and partition-specific update constraints. We theoretically characterize historical influence propagation and mode-dependent unlearning feasibility, revealing structural limitations of restricted model updates. As an initial solution, we propose SURE, integrating dual-importance estimation, selective parameter perturbation, and importance-guided recovery. Extensive experiments with existing unlearning methods adapted to SFL reveal substantial forgetting– utility trade-offs across model architectures, data distributions, and update modes. SURE achieves competitive agreement with modematched retraining at modest additional cost, while further analyses highlight the impact of split position and update constraints on unlearning behavior. These findings establish SFU as a distinct research problem and provide a foundation for unlearning in partitioned federated systems.

Keywords split federated unlearning, split federated learning, federated unlearning, model partitioning, importance-guided unlearning

1

Introduction

Personalized Web services increasingly rely on user interactions distributed across devices and data owners [25]. Federated learning (FL) enables collaborative training without centralizing raw data [1, 21], but training complete models on resource-constrained clients can be costly [6]. Split federated learning (SFL) addresses this limitation by partitioning model execution between clients and a server while retaining federated aggregation [27]. As illustrated in Fig. 1(a), client-side models and their corresponding server-side replicas are jointly optimized, with each partition aggregated separately. This architecture offers a practical approach to collaborative learning in resource-heterogeneous Web and edge environments. While SFL keeps user data local, it does not address the removal of their learned contributions when users withdraw data or leave a Web service. Deleting local records or ending participation cannot undo their accumulated influence on the trained model. Machine

∗ Jia Chen and Yecheng Lv contributed equally to this work. † Corresponding author: Jun Bai (jun.bai@adelaide.edu.au).

1

(a) SFL Training

(b) SFU Problem Client-wise unlearning

server-side replica g1s

client-side model g1c

Client 1

(c) Why SFU is Nontrivial Class-wise unlearning

remove Client 1

activations

1

Cross-partition coupling client-side

remove class “red”

θc

server-side forward (activations)

θs

gradients trained SFL model

⋮ client-side model gkc

Client k

θ = (θC ,θs)

server-side replica gks

u

mutual dependence

u

θ = (θ c ,θ s)

+

2

counterfactual retraining reference (computationally expensive)

gradients

Dₖ

u

+

activations

backward (gradients)

unlearned model unlearning request

Federated server

Split server

(aggregate client-side models)

(aggregate server-side replicas)

…

…

Server-only

…

3

Joint

update θs only

update (θc ,θs)

unlearning objective (high-level)

global server-side model

θc

θₛ

t+2

Mode-dependent feasibility Client-only

update θc only

global client-side model

t+1

θR=(θRc ,θRs)

model update modes (scope)

Client-only

t

Dꜰ

reference model

retrain on retained data only

After each round: dual-side aggregation

Historical influence propagation

target data

unlearning (larger)

D₁

forget target influence

+

preserve retained utility

+

avoid full retraining

Server-only Joint

client-only server-only joint

retained utility (higher)

Figure 1: Overview of Split Federated Unlearning (SFU). (a) SFL jointly trains client-side models and server-side replicas, with independent aggregation of both partitions. (b) SFU considers client-wise and class-wise removal, using full retained-data retraining as the counterfactual reference under different model update modes. (c) SFU involves cross-partition coupling, historical influence propagation, and mode-dependent unlearning feasibility. coupling, dual-side aggregation, and partition-specific update constraints under client-wise and class-wise removal. (2) We theoretically characterize historical influence propagation and modedependent unlearning feasibility, revealing how accumulated contributions and restricted updates affect attainable forgetting behavior. (3) We propose SURE as an initial importance-guided solution and systematically evaluate adapted unlearning methods in SFL, examining forgetting–utility trade-offs, model partitioning, and system efficiency.

2

and gradient-cache projection with retained-data fine-tuning [4]. Parameter-selective approaches, such as SalUn [5], further demonstrate the role of weight saliency in targeted unlearning. Nevertheless, these methods do not jointly characterize split-model dependencies and repeated federated aggregation. Split Federated Learning. SFL combines partitioned execution with federated aggregation to support resource-constrained clients [27]. Subsequent studies have improved scalability through server-side parallelism [8] and investigated training instability under heterogeneous data [28]. However, such studies primarily address training efficiency and knowledge preservation rather than deliberate removal of historical contributions. Unlearning in SFL must additionally account for cross-partition dependencies, dual-side aggregation, and partition-specific update constraints.

Related Work

Federated Unlearning. Machine unlearning aims to remove learned data contributions without full retraining [3, 15]. In FL [2, 21], unlearning is complicated by historical contributions accumulated through model aggregation. Early approaches explored update calibration and selective retraining [19, 20], alongside privacypreserving model recovery [35]. Subsequent work investigated class-specific pruning, incentive-aware selection, subgraph removal, and privacy-aware recovery [17, 18, 30, 31]. Recent methods further address gradient conflicts, server-side unlearning, and task-vector alignment [16, 22, 24, 33]. However, these approaches do not explicitly account for dependencies between separately aggregated model partitions.

3 Split Federated Unlearning 3.1 System Model We consider an SFL system [27] with 𝐾 clients, a split server, and a federated aggregation server. Client 𝑘 ∈ K = {1, . . . , 𝐾 } holds data D𝑘 and a client-side model 𝑓𝐶 (·; 𝜃𝐶,𝑘 ); the split server maintains a corresponding replica 𝑓𝑆 (·; 𝜃 𝑆,𝑘 ). The predictor is 𝑓𝑘 (𝑥) = 𝑓𝑆 (𝑓𝐶 (𝑥; 𝜃𝐶,𝑘 ); 𝜃 𝑆,𝑘 ). Training exchanges cut-layer activations and gradients, followed by independent aggregation of both partitions each round: ∑︁ 𝑠 𝑡 +1 𝜃 𝑠𝑡 +1 = 𝑤𝑘,𝑡 𝜃 𝑠,𝑘 , 𝑠 ∈ {𝐶, 𝑆 }, (1)

Split Learning and Unlearning. Split learning (SL) partitions model execution between clients and servers through intermediate activations and gradients [29]. Recent split unlearning methods address training dependencies through isolation-based removal [10]

𝑘 ∈ K𝑡 2

𝑠 are where K𝑡 is the participating client set and the weights 𝑤𝑘,𝑡 normalized. Client-side models are aggregated by the federated aggregation server and server-side replicas by the split server; both aggregated partitions initialize the next round. Thus, split computation couples the two partitions, while aggregation propagates client contributions across rounds.

3.2

rounds of coupled SFL training. Let 𝑧𝑡 = (𝜃𝐶𝑡 , 𝜃 𝑆𝑡 , 𝜔 𝑡 ) denote the synchronized training state at round 𝑡, where 𝜔 𝑡 includes auxiliary optimizer states and persistent buffers. Under coupled randomness and a common initialization, the original and retained-only trajectories satisfy 𝑧𝑡 +1 = G𝑡 (𝑧𝑡 ),

Problem Formulation

Theorem 3.1 (Historical Influence Propagation). If G𝑡 is continuously differentiable along the segment from 𝑧𝑅𝑡 to 𝑧𝑡 , define ∫ 1 𝐴𝑡 = 𝐷G𝑡 (𝑧𝑅𝑡 + 𝛼𝛿𝑡 ) 𝑑𝛼, (7) 0 𝑏𝑡 = G𝑡 (𝑧𝑅𝑡 ) − G𝑡𝑅 (𝑧𝑅𝑡 ).

  client-wise, D  Ø𝑓 , (2) {(𝑥, 𝑦) ∈ D𝑘 : 𝑦 = 𝑐 𝑓 }, class-wise.   𝑘 ∈ K The withdrawing client is excluded from subsequent participation; for class-wise removal, clients with retained data may remain. D𝐹 =

Then, with 𝛿 0 = 0,

Counterfactual Reference. Let ASFL denote the original training procedure, including split execution and dual-side aggregation. Define 𝜃 ∗ = ASFL (D; 𝜉), 𝜃 𝑅 = ASFL (D𝑅 ; 𝜉 ′ ), (3) ′ where 𝜃 = (𝜃𝐶 , 𝜃 𝑆 ) and 𝜉, 𝜉 represent training randomness. The ideal reference 𝜃 𝑅 is trained from initialization on retained data using the same SFL procedure, with participation and aggregation weights updated accordingly. Given 𝜃 ∗ , D𝑅 , and admissible request information I𝐹 , an unlearning method outputs 𝜃 𝑈 = U (𝜃 ∗, D𝑅 , I𝐹 ). Exact unlearning requires agreement with the retraining distribution [3]; here we study approximate unlearning without full retraining.

𝛿𝑇 =

(𝐴𝑇 −1 · · · 𝐴𝑡 +1 )𝑏𝑡 ,

where empty products equal the identity. If ∥𝐴𝑡 ∥ 2 ≤ 𝐿𝑡 , then ! −1 𝑇∑︁ −1 𝑇 Ö 𝐿𝑟 ∥𝑏𝑡 ∥ 2 . ∥𝛿𝑇 ∥ 2 ≤ 𝑡 =0

(8)

(9)

𝑟 =𝑡 +1

Theorem 3.1 decomposes historical influence into round-wise discrepancies 𝑏𝑡 and their propagation through subsequent updates (proof in Appendix B.1). Here, 𝑏𝑡 also captures changes in client participation and aggregation weights. For a single local gradient step, the cross-partition Jacobian blocks satisfy ∑︁ 𝐶 𝑡 𝐽𝐶𝑆 = −𝜂𝐶 𝑤𝑘,𝑡 ∇𝜃2𝐶 𝜃𝑆 ℓ𝑘,𝑡 , 𝑘 ∈ K𝑡

∑︁

𝑡 𝐽𝑆𝐶 = −𝜂𝑆

(10) 𝑆 𝑤𝑘,𝑡 ∇𝜃2𝑆 𝜃𝐶 ℓ𝑘,𝑡 ,

𝑘 ∈ K𝑡

where ℓ𝑘,𝑡 is the local split-model loss. Nonzero mixed derivatives couple the partition dynamics despite separate aggregation. Consequently, removing only a client’s final-round update does not generally reproduce the retained-only training trajectory.

(4)

Frozen partitions still participate in split computation but are not updated. Unlearning Objectives. SFU seeks to approximate full retraining while preserving retained-data utility and limiting computation and communication. We measure predictive discrepancy by   Δ𝐹 (𝜃 𝑈 , 𝜃 𝑅 ) = E𝑥∼Q 𝑑 (𝑓 (𝑥; 𝜃 𝑈 ), 𝑓 (𝑥; 𝜃 𝑅 )) , (5)

Mode-Dependent Unlearning Feasibility. We characterize attainable prediction changes through local model linearization, a perspective also used to analyze neural-network training dynamics [14]. Let 𝐹 (𝜃 ) = 𝑓 (·; 𝜃 ) belong to H = 𝐿 2 (Q; R𝑚 ), with retraining shift 𝑟 = 𝐹 (𝜃 𝑅 ) − 𝐹 (𝜃 ∗ ). For mode M, let Θ M = {Δ𝜃 : Δ𝜃 𝑠 = 0 ∀𝑠 ∉ M} and VM = range(𝐷𝐹 (𝜃 ∗ )| ΘM ). The best achievable discrepancy within radius 𝜌 is

where Q is an evaluation distribution and 𝑑 a prediction discrepancy. The remaining objectives are retained-data risk L𝑅 (𝜃 𝑈 ) and unlearning cost C(U), subject to M. For evaluation, mode-matched Retrain reinitializes and retrains only the permitted partition on D𝑅 , freezing the other at 𝜃 ∗ . It isolates update-mode restrictions but does not replace full retraining as the ideal reference; neither reference is assumed available to U.

3.3

𝑇∑︁ −1 𝑡 =0

Model Update Modes. We distinguish M ∈ {{𝐶}, {𝑆 }, {𝐶, 𝑆 }}, denoting Client-only, Server-only, and Joint updates, independently of the forgetting request. Any frozen partition, including its clientspecific replicas and persistent buffers 𝑏𝑠 , remains at the original checkpoint: 𝑠 ∉ M, ∀𝑡 .

(6)

where each round mapping includes split updates and dual-side aggregation. Set 𝛿𝑡 = 𝑧𝑡 − 𝑧𝑅𝑡 .

Ð Unlearning Requests. Let D = 𝑘 ∈ K D𝑘 and D𝑅 = D \ D𝐹 . We consider client-wise removal of client 𝑓 and class-wise removal of class 𝑐 𝑓 :

(𝜃 𝑠(𝑡 ) , 𝑏𝑠(𝑡 ) ) = (𝜃 𝑠∗, 𝑏𝑠∗ ),

𝑧𝑅𝑡 +1 = G𝑡𝑅 (𝑧𝑅𝑡 ),

E M (𝜌) =

inf

Δ𝜃 ∈ΘM ∥Δ𝜃 ∥ 2 ≤𝜌

∥𝐹 (𝜃 ∗ + Δ𝜃 ) − 𝐹 (𝜃 𝑅 )∥ H .

(11)

Theorem 3.2 (Local Unlearning Feasibility Bound). Suppose 𝐹 is continuously differentiable near 𝜃 ∗ with an 𝐿-Lipschitz derivative on 𝐵(𝜃 ∗, 𝜌). Let 𝑃 M project orthogonally onto VM and 𝑑 M = ∥ (𝐼 − 𝑃 M )𝑟 ∥ H . Then   𝐿𝜌 2 E M (𝜌) ≥ 𝑑 M − . (12) 2 +

Theoretical Characterization

Historical Influence Propagation. Training-data influence has been studied through algorithmic stability and influence functions [7, 12]. We examine how such influence propagates through successive 3

Algorithm 1 SURE for Split Federated Unlearning

The residual 𝑑 M measures the retraining shift inaccessible to first-order updates within the permitted partitions. If 𝑑 M > 𝐿𝜌 2 /2, exact predictive agreement is impossible within the update ball (proof in Appendix B.2).

Require: 𝜃 ∗ , D𝐹 , {D𝑘,𝑅 }, M, 𝑇𝑈 , validation set V, forgetting constraint C𝐹 Ensure: Unlearned model 𝜃 𝑈 1: Initialize replicas from 𝜃 ∗ ; compute 𝑅𝐹 via Eqs. (17)–(19) 2: Compute 𝑅𝑘,𝑅 for each retained client and 𝑅𝑅 via Eq. (21) 3: Select ℓ ∗ using Eq. (22) 4: Compute 𝐷𝑢 and 𝜃 𝑃 using Eqs. (23)–(24) 5: 𝜃 0 ← 𝜃 𝑃 6: for 𝑟 = 0, . . . ,𝑇𝑈 − 1 do 7: Initialize retained-client replicas from 𝜃 𝑟 8: Perform retained-only split training; modulate trainable gradients via Eq. (25) 9: Aggregate only partitions in M using Eq. (28); preserve frozen states 10: end for 𝑇 11: Select 𝜃 𝑈 ∈ {𝜃 𝑟 }𝑟 𝑈 =0 using V and C𝐹 (Appendix C.1) 12: return 𝜃 𝑈

Corollary 3.3 (Unlearning Mode Hierarchy). Joint updates include both single-partition feasible sets. Hence, for the same 𝜌, 𝑑 {𝐶,𝑆 } ≤ min{𝑑 {𝐶 } , 𝑑 {𝑆 } }, E {𝐶,𝑆 } (𝜌) ≤ min{E {𝐶 } (𝜌), E {𝑆 } (𝜌)}.

(13)

These bounds concern attainable rather than algorithm-specific performance (proof in Appendix B.3). Excess Risk under Single-Partition Updates. To examine the effect of freezing one model partition, we consider a local positive-definite quadratic surrogate around the retrained solution, following standard second-order optimization analysis [23], defined as: 𝑄 𝑅 (𝜃 ) = L𝑅 (𝜃 𝑅 ) + 21 (𝜃 − 𝜃 𝑅 ) ⊤ 𝐻𝑅 (𝜃 − 𝜃 𝑅 ),  𝐻𝐶𝑆  where 𝐻𝑅 = 𝐻𝐻𝐶𝐶 ≻ 0. 𝑆𝐶 𝐻𝑆𝑆

(14)

Proposition 3.4 (Single-Partition Excess-Risk Gap). Let 𝑒𝐶 = 𝜃𝐶∗ − 𝜃𝐶𝑅 and 𝑒𝑆 = 𝜃 𝑆∗ − 𝜃 𝑆𝑅 . Under this surrogate, the minimum excess retained-data risks for Client-only and Server-only updates are, respectively, −1 R𝐶 = 12 𝑒𝑆⊤ (𝐻𝑆𝑆 − 𝐻𝑆𝐶 𝐻𝐶𝐶 𝐻𝐶𝑆 )𝑒𝑆 ,

(15)

−1 R𝑆 = 12 𝑒𝐶⊤ (𝐻𝐶𝐶 − 𝐻𝐶𝑆 𝐻𝑆𝑆 𝐻𝑆𝐶 )𝑒𝐶 .

(16)

weight sensitivity by parameter magnitude: 𝐼 A,𝑢 = (𝜃𝑢∗ ) 2 𝐹bA,𝑢 . The forgotten-data map is 𝑅𝐹,𝑢 = N (𝐼 D𝐹 ,𝑢 ),

The Schur-complement terms [34] quantify the residual risk after the updatable partition optimally compensates for the frozen one. Thus, cross-partition adaptation can reduce, but not necessarily eliminate, the excess retained-data risk under the quadratic surrogate (proof in Appendix B.4).

𝑘 ∈ K𝑅

√︄ ∑︁ 𝜎𝑢 = 𝑛𝑅−1 (𝑅𝑘,𝑅,𝑢 − 𝜇𝑢 ) 2 .

(20)

𝑘 ∈ K𝑅

The common retained-data importance is     𝜎𝑢 , 0, 1 , 𝑅𝑅,𝑢 = clip 𝜇𝑢 1 − 𝜇𝑢 + 𝜖

SURE: An Initial Solution

SURE provides an importance-guided approximation to SFU without reconstructing the original training trajectory. Starting from the synchronized checkpoint 𝜃 ∗ = (𝜃𝐶∗ , 𝜃 𝑆∗ ), it estimates forgottenand retained-data importance, selectively perturbs a target-relevant layer, and recovers retained utility through constrained split-federated training. The three stages are illustrated in Fig. 2(a)–(c), with the complete procedure summarized in Algorithm 1. Throughout, only partitions permitted by update mode M may change.

4.1

(19)

where N is a fixed normalization to [0, 1]. This applies to either client-wise or class-wise forget sets. For each retained client 𝑘 ∈ K𝑅 , we likewise compute 𝑅𝑘,𝑅,𝑢 = N (𝐼 D𝑘,𝑅 ,𝑢 ). With 𝑛𝑅 = |K𝑅 |, define ∑︁ 𝜇𝑢 = 𝑛𝑅−1 𝑅𝑘,𝑅,𝑢 ,

Both are nonnegative, and strictly positive for nonzero displacement in the respective frozen partition.

4

(18)

(21)

where 𝜖 > 0 ensures numerical stability. The variance discount favors parameters consistently important across retained clients.

4.2

Selective Parameter Perturbation

Fig. 2(b) illustrates mode-aware perturbation. Among layers L M in the updatable partitions, SURE selects a single layer with the highest mean forgotten-data importance: 1 ∑︁ ℓ ∗ = arg max 𝑅𝐹,𝑢 . (22) ℓ ∈ LM |ℓ | 𝑢 ∈ℓ

Dual-Importance Estimation

As shown in Fig. 2(a), SURE scans forgotten and retained data through the original split computation path, with all replicas initialized from 𝜃 ∗ , without parameter updates or aggregation. For dataset A and parameter 𝑢 in either partition, we use a mini-batch gradient-squared proxy for diagonal Fisher information:  2 ∑︁ 1 𝜕L𝐵 (𝜃 ∗ ) 𝐹bA,𝑢 = |𝐵| , (17) |A| 𝜕𝜃𝑢

Thus, Joint mode considers both partitions but still perturbs only one layer. Within ℓ ∗ , the discrimination score is
𝐷𝑢 = clip 𝑅𝐹,𝑢 (1 − 𝛾𝑅𝑅,𝑢 ), 0, 1 , (23) where 𝛾 ≥ 0 discounts parameters important to retained data; clipping also permits 𝛾 > 1. SURE then scales the selected parameters: ( [1 − 𝐷𝑢 (1 + 𝑅𝐹,𝑢 )]𝜃𝑢∗ , 𝑢 ∈ ℓ ∗, 𝑃 𝜃𝑢 = ∗ (24) 𝜃𝑢 , 𝑢 ∉ ℓ∗.

𝐵∈B(A)

where B (A) contains mini-batches and L𝐵 is the average batch loss. To account for the subsequent multiplicative perturbation, we 4

(a) Dual-Importance Estimation Trained split federated model (synchronized checkpoint)

θ*c

DF

(c) Retained-Data Recovery

1

1

Update mode ℳ Client-only (ℳ = C)

Server-side model

Client-side model

Forget set

(b) Selective Parameter Perturbation

θ*s

Server-only (ℳ = S)

Client 1

Client 2

activations

Retained clients DR

gradients

2

Select layer to perturb (from trainable partitions) Rank layers by average RF

(retain-only scan)

Client-side layers

Estimate parameter importance on both partitions (no parameter updates) Forgotten-data importance Rꜰ

Layer 1

Rꜰ = N(Iᴅꜰ)

Layer 2 Layer 3

Client-side layers

2

Client-side layers

RR=clip⁡(μ(1-σ/(μ+ε)),0,1)

2

F̂A,u

(A∈{DF ,DR})

gradients

DR,K

Importance-guided gradient modulation (trainable params only) RF,u : forgotten importance gu : original gradient ĝᵤ : modulated gradient

Select layer l*

Server-side layers

Discrimination score and parameter perturbation

3

Dual-side aggregation

(retained clients only)

Upload client-side models

Upload server-side replicas

θPᵤ⁡=⁡[1⁡− Dᵤ(1+Rꜰ,u)]θ*u

Federated server

Split server

u ∈ l* (only selected layer perturbed)

(aggregate client-side)

(aggregate server-side)

...

...

Perturb selected layer l*

Dᵤ⁡=⁡clip(Rꜰ,ᵤ(1⁡− γRR,ᵤ),⁡0,⁡1)

4

Parameter-wise importance (both partitions)

gradients

DR,2

RR,u : retained importance

Server-side layers

Layer 1 Layer 2 Layer 3

gradients

DR,1

ĝᵤ⁡=⁡(1⁡+⁡βRRR,ᵤ)(1⁡− βꜰRꜰ,ᵤ)gᵤ

Layer 3

3

activations

...

Layer 2

Discrimination score

Retained-data importance RR

Client K

activations

Server-side layers

Layer 1

IA,u = (θ*u)

θᴾ⁡=⁡(θᴾc, θᴾₛ)

activations

(target-data scan)

Initialize client models from perturbed model

Joint (ℳ = J)

Unlearned model

Perturbation result Original synchronized model

Perturbed model

θ*⁡=⁡(θ*c ,θ*ₛ)

θᴾ⁡=⁡(θᴾc ,θᴾₛ)

Broadcast aggregated models

Frozen partitions unchanged

u: parameter index

Server-only: client fixed

Client-only: server fixed

A: data set (forget/retain)

θu =⁡(θuC ,θuₛ)

(according to ℳ) Joint: no frozen partition

Recovered unlearned model Original checkpoint Perturbed model Figure 2: Overview of identifies parameters relevant to forgotten and retained data 1 SURE. (a) Dual-importance estimation 2 3 State transition θ*⁡=⁡(θ* ,θ*ₛ) θᴾ⁡=⁡(θᴾ ,θᴾₛ) θ =⁡(θ ,θ ₛ) across both model partitions. (b) Mode-aware perturbation targets one layer within the permitted partitions. (c) Retained-data recovery employs importance-guided gradient modulation and dual-side aggregation while preserving frozen partitions. c

5

Retained-Data Recovery

5.1

(25)

u

Experimental Evaluation

Experimental Setup

Datasets and configurations. We consider two unlearning scenarios: client-wise unlearning, which removes the contributions of a designated client, and class-wise unlearning, which removes a target class across clients. Experiments cover three datasets and four dataset–model configurations: MNIST/LeNet, CIFAR-10/CNN, CIFAR-10/ResNet-18, and CIFAR-100/ResNet-18. For client-wise unlearning, we consider ten clients with one removal request under Independent and Identically Distributed (IID) and extreme non-IID data partitions, the latter assigning disjoint label subsets to clients. For class-wise unlearning, we remove a designated class across clients under Dirichlet-based non-IID partitions (𝛼 = 0.1) [9]. Both scenarios are examined under Client-only, Server-only, and Joint update modes. ResNet-18 is partitioned after its first residual block, with additional cut positions examined separately. Further details on data partitioning, model architectures, and training configurations are provided in Appendix C.1.

where 𝛽𝑅 ≥ 0 and 𝛽 𝐹 ∈ [0, 1] respectively reinforce retainedrelevant updates and attenuate forgotten-relevant ones. Optionally, importance-weighted stability penalties constrain drift from 𝜃 ∗ : ∑︁ Ω𝐴 (𝜃, 𝜃 ∗ ) = 12 𝑅𝐴,𝑢 (𝜃𝑢 − 𝜃𝑢∗ ) 2, 𝐴 ∈ {𝐹, 𝑅}, (26) 𝑢 ∈ PM

where PM is the set of trainable parameters. The recovery loss is Lrec = L𝑅 (𝜃 ) + 𝜆𝑅 Ω𝑅 (𝜃, 𝜃 ∗ ) + 𝜆𝐹 Ω𝐹 (𝜃, 𝜃 ∗ ).

c

We systematically evaluate SURE and adapted unlearning methods under SFU, examining forgetting–utility trade-offs, model partitioning, and system efficiency.

Recovery trains exclusively on D𝑅 using the original SFL protocol (Fig. 2(c)). To restore retained utility while limiting reversal of the intervention, gradients 𝑔𝑢 are modulated as 𝑔e𝑢 = (1 + 𝛽𝑅 𝑅𝑅,𝑢 )(1 − 𝛽 𝐹 𝑅𝐹,𝑢 )𝑔𝑢 ,

u

split computation. The final checkpoint 𝜃 𝑈 is selected using validation data and the applicable forgetting constraint (Appendix C.1). SURE targets approximate, not certified, unlearning.

Larger target-specific scores induce stronger changes, potentially including sign reversal. Other layers and frozen partitions remain unchanged. The resulting 𝜃 𝑃 initializes recovery; perturbation alone does not establish unlearning.

4.3

u

c

(27)

Each recovery round initializes client-specific replicas from the current synchronized state, performs split training on retained clients, and aggregates the two permitted partitions separately: ∑︁  𝑠,𝑅 𝑟 +1  𝑤𝑘,𝑟 𝜃 𝑠,𝑘 , 𝑠 ∈ M,    𝑟 +1 𝑟 𝜃 𝑠 = 𝑘 ∈ K𝑅 (28)  𝜃 ∗ ,  𝑠 ∉ M, 𝑠 

Baselines and retraining references. We compare SURE with retaineddata fine-tuning (Fine-tune) and eight unlearning methods adapted to SFL: FedEraser [19], FedRecovery [35], SalUn [5], MoDe [36], FedOSD [24], NoT [11], FedCARE [16], and FedMemPrune [32]. All

𝑠,𝑅 where K𝑅𝑟 and 𝑤𝑘,𝑟 denote participating retained clients and normalized aggregation weights. Frozen parameters, replicas, and persistent buffers remain fixed, although frozen partitions still support 5

Table 1: Client-wise unlearning under extreme non-IID partitions (mean ± SD, %). AG (Avg. Gap)↓ is the mean absolute distance of Ret., For., Test, and MIA from mode-matched Retrain (percentage points), computed from reported means. Ret./Test↑: higher is better. Bold marks the best non-reference Ret./Test or AG within each dataset–model and update mode. Server-only Joint For. Test↑ MIA AG↓ Ret.↑ For. Test↑ MIA AG↓ MNIST / LeNet Retrain 88.24±1.48 96.97±0.35 89.36±0.37 44.26±0.68 0.00 88.35±2.24 0.00±0.00 80.17±0.47 53.75±0.92 0.00 89.71±2.41 0.00±0.00 81.07±0.74 52.33±0.98 0.00 Fine-tune 88.03±1.26 96.97±4.96 89.62±2.18 46.70±2.98 0.73 92.04±1.63 4.74±2.32 83.42±1.25 52.93±3.92 3.13 93.87±1.52 17.03±14.96 86.17±1.62 53.40±1.98 6.84 FedEraser 86.86±2.58 96.54±3.65 87.86±2.75 44.07±3.27 0.88 81.95±2.72 0.00±0.00 73.72±1.35 49.74±3.62 4.22 81.12±1.21 0.00±0.00 73.02±1.65 47.83±2.25 5.29 FedRecovery 86.00±0.86 96.54±0.43 87.14±0.94 50.59±5.77 2.81 86.06±1.23 95.67±0.21 87.14±1.62 46.70±5.26 28.00 86.29±1.23 95.24±0.43 86.60±0.34 48.18±4.62 27.09 SalUn 82.74±0.63 93.07±1.63 84.10±0.71 45.39±1.73 3.95 11.02±1.63 0.00±0.00 9.96±3.82 51.83±1.41 37.37 15.02±2.36 0.00±0.00 21.96±3.26 51.53±1.24 33.65 MoDe 87.26±1.28 97.40±0.42 88.63±1.28 52.52±2.95 2.60 87.08±1.78 0.00±0.00 78.42±2.32 51.48±2.35 1.32 85.63±0.24 0.00±0.00 76.94±2.32 52.23±4.22 2.08 FedOSD 85.97±2.51 95.67±0.98 87.05±1.57 51.51±2.26 3.28 86.76±2.31 0.00±0.00 78.89±1.62 51.58±1.22 1.26 88.71±2.21 0.00±0.00 80.61±1.27 52.54±2.52 0.42 NoT 86.83±2.03 95.67±4.64 88.29±2.44 44.59±1.13 1.03 92.26±2.82 0.00±0.00 83.08±2.12 47.60±1.62 3.24 88.25±3.52 0.00±0.00 80.96±3.42 52.54±2.23 0.45 FedCARE 88.12±1.45 96.54±3.55 89.36±1.54 42.93±1.77 0.47 89.89±1.52 0.00±0.00 81.71±1.72 50.72±1.13 1.53 91.65±1.63 7.94±10.55 83.30±2.55 51.01±1.27 3.36 FedMemPrune 87.22±3.35 96.10±1.70 88.16±2.25 44.75±1.45 0.90 69.80±2.23 0.00±0.00 62.65±1.85 45.54±1.61 11.07 72.64±2.35 0.00±0.00 65.44±1.25 50.46±1.22 8.64 SURE (Ours) 87.81±4.45 96.97±1.77 89.36±4.07 44.66±1.35 0.21 80.88±2.05 0.00±0.00 72.91±2.36 55.77±1.64 4.19 89.92±3.21 0.00±0.00 80.75±3.27 52.95±2.26 0.29 CIFAR-10 / CNN Retrain 45.65±2.19 0.00±0.00 40.90±1.39 46.98±1.97 0.00 45.16±1.32 0.00±0.00 40.07±0.59 46.31±0.46 0.00 39.78±3.24 0.00±0.00 35.80±1.09 47.97±1.52 0.00 Fine-tune 34.10±2.81 1.90±0.12 30.84±1.72 52.74±3.62 7.32 42.37±1.62 12.47±3.82 37.49±1.24 47.49±2.32 4.76 30.99±1.52 8.82±1.73 27.54±1.62 52.41±2.26 7.58 FedEraser 33.00±2.09 2.30±0.09 30.15±1.28 49.73±3.75 7.11 21.65±2.25 0.00±0.00 19.25±1.62 49.04±2.62 11.77 14.89±2.26 0.00±0.00 14.03±1.72 50.53±3.62 12.31 FedRecovery 36.47±2.69 54.50±12.15 38.24±0.89 53.77±1.62 18.28 36.94±1.19 51.00±8.32 38.28±0.23 53.75±1.24 17.11 37.11±2.99 50.20±8.55 38.27±1.82 52.71±1.62 15.02 SalUn 27.33±4.63 0.00±0.00 24.87±0.85 46.36±0.48 8.74 11.11±2.32 0.00±0.00 10.00±3.53 49.00±0.63 16.70 14.25±1.52 0.00±0.00 18.54±0.62 52.11±0.63 11.73 MoDe 21.46±3.06 0.00±0.00 19.37±1.93 48.96±1.42 11.93 17.41±3.62 0.00±0.00 15.06±3.31 51.76±0.73 14.55 18.28±1.38 0.00±0.00 17.50±1.23 49.50±0.73 10.33 FedOSD 37.53±3.40 25.00±4.06 36.20±2.15 52.93±1.92 10.94 41.47±3.26 0.00±0.00 34.71±2.62 49.28±1.45 3.01 43.58±2.30 0.00±0.00 38.44±1.93 50.78±1.31 2.31 NoT 32.22±1.79 0.00±0.00 29.30±1.58 54.44±2.41 8.12 23.09±1.61 0.00±0.00 20.49±2.23 53.93±1.73 12.32 27.21±1.72 0.00±0.00 24.21±1.28 51.99±2.62 7.05 FedCARE 40.81±2.86 20.10±7.64 38.32±2.34 48.35±1.14 7.22 39.72±1.89 0.00±0.00 33.93±3.62 49.60±1.24 3.72 34.58±2.26 0.00±0.00 31.12±1.62 50.15±1.36 3.02 FedMemPrune 14.15±0.97 0.00±0.00 12.75±0.37 49.58±2.75 15.56 21.80±0.62 0.00±0.00 18.79±0.72 51.51±2.85 12.46 12.79±1.62 0.00±0.00 11.59±0.32 50.74±2.73 13.49 SURE (Ours) 37.14±1.23 3.70±0.64 34.15±1.02 51.74±3.38 5.93 42.94±1.57 0.00±0.00 37.25±1.62 51.48±2.37 2.55 44.22±0.91 0.00±0.00 39.47±0.82 47.77±2.31 2.08 CIFAR-10 / ResNet-18 Retrain 62.59±1.12 5.60±0.36 56.36±1.26 50.94±0.75 0.00 65.31±1.12 0.00±0.00 58.90±0.72 50.85±1.21 0.00 63.54±1.93 0.00±0.00 56.19±1.62 50.82±0.62 0.00 Fine-tune 55.32±1.24 31.90±1.63 51.40±2.42 44.84±2.42 11.16 51.16±1.62 8.10±2.21 45.77±2.51 48.70±2.32 9.38 63.12±1.82 15.25±4.72 56.12±3.36 50.64±1.26 3.98 FedEraser 49.04±2.02 37.00±1.98 47.51±1.72 51.36±1.26 13.56 17.63±1.69 0.00±0.00 15.87±2.31 47.04±3.32 23.63 16.95±2.24 0.00±0.00 14.64±1.32 50.59±2.73 22.09 FedRecovery 59.21±1.24 71.80±7.53 60.97±0.57 48.47±2.53 19.17 59.48±2.32 68.70±13.25 60.92±1.25 46.56±1.34 20.21 62.55±3.36 57.67±6.59 60.94±1.63 47.28±1.24 16.74 SalUn 48.96±2.21 16.60±0.61 45.58±1.24 50.91±0.27 8.86 11.86±3.23 0.00±0.00 13.86±1.63 51.93±0.68 24.89 15.14±2.62 0.00±0.00 19.48±3.23 51.24±0.82 21.38 MoDe 47.68±0.93 0.90±0.30 43.20±1.73 45.16±3.62 9.64 18.15±3.61 0.00±0.00 21.58±1.25 50.00±0.62 21.33 25.14±2.22 0.00±0.00 27.32±1.83 52.35±1.62 17.20 FedOSD 59.14±2.30 51.60±1.83 58.05±2.35 43.84±1.28 14.56 60.22±2.43 0.00±0.00 54.79±2.92 48.70±1.32 2.84 64.43±3.63 0.03±0.05 56.88±1.73 47.09±1.73 1.34 NoT 50.79±1.25 21.50±4.66 44.96±1.32 48.14±1.21 10.48 52.69±1.36 0.00±0.00 46.75±1.02 47.27±2.21 7.09 47.07±1.62 0.00±0.00 42.03±1.83 47.65±1.52 8.45 FedCARE 59.51±1.89 65.70±1.27 60.12±1.32 48.57±1.84 17.33 61.53±1.24 0.70±0.64 54.74±2.25 49.12±1.63 2.59 63.90±1.32 0.37±0.24 56.53±1.84 47.78±1.16 1.03 FedMemPrune 26.52±1.17 3.30±0.21 24.24±0.73 49.32±2.32 18.03 32.32±0.62 0.00±0.00 28.62±0.62 53.75±2.21 16.54 23.12±1.94 0.00±0.00 21.49±0.45 50.02±2.23 18.98 SURE (Ours) 52.94±1.97 27.80±1.68 49.32±1.26 48.64±2.02 10.30 62.40±1.23 0.40±0.35 56.30±0.32 49.71±2.15 1.76 58.21±1.62 0.47±0.43 51.72±0.84 47.96±2.51 3.28 CIFAR-100 / ResNet-18 Retrain 67.63±0.35 48.67±0.78 44.85±0.47 63.30±0.53 0.00 72.54±0.96 0.00±0.00 42.54±0.20 52.34±0.25 0.00 69.73±0.24 0.00±0.00 40.36±0.67 55.46±0.68 0.00 Fine-tune 68.02±0.72 54.89±1.42 45.04±0.24 66.11±0.77 2.40 56.30±0.67 11.11±0.81 36.48±0.62 60.30±0.50 10.34 57.06±0.84 11.11±0.32 38.02±0.89 59.47±0.39 7.53 FedEraser 43.43±0.24 29.33±0.90 32.14±0.57 58.94±0.84 15.15 22.64±1.03 0.00±0.00 19.41±0.72 49.38±0.47 19.00 10.84±0.22 0.00±0.00 8.93±0.95 47.11±0.39 24.67 FedRecovery 66.62±0.82 58.44±1.29 44.04±0.46 65.64±1.15 3.48 66.86±0.53 55.56±5.18 43.99±0.68 65.22±0.28 18.89 66.81±0.69 55.33±1.35 43.96±0.23 65.60±0.92 18.00 SalUn 61.78±0.95 45.56±1.14 41.76±0.25 61.49±0.62 3.47 12.91±0.36 0.00±0.00 10.64±0.39 47.81±0.83 24.02 3.41±0.43 0.00±0.00 3.13±0.74 46.93±1.31 28.02 MoDe 52.69±0.84 35.78±2.32 37.51±0.34 59.91±0.51 9.64 23.48±0.27 0.00±0.00 19.63±0.65 53.61±0.74 18.31 15.63±0.22 0.00±0.00 13.08±0.31 52.30±0.75 21.14 FedOSD 66.99±0.29 56.22±1.34 43.90±0.83 65.11±0.72 2.74 70.57±0.50 3.56±0.54 42.19±0.59 56.70±0.32 2.56 70.57±0.41 4.22±1.33 42.16±0.75 57.54±0.30 2.24 NoT 57.23±0.31 42.00±0.38 40.80±0.56 60.70±0.94 5.93 56.64±0.76 6.22±0.45 37.00±0.31 58.62±0.80 8.49 56.02±0.62 4.67±1.18 39.48±0.79 58.83±0.95 5.66 FedCARE 67.31±0.55 56.89±1.75 44.44±0.19 65.79±1.52 2.86 69.14±0.42 4.22±0.72 42.13±0.74 54.32±0.68 2.50 68.96±0.95 4.22±1.45 42.26±0.83 54.26±0.81 2.02 FedMemPrune 41.83±0.24 29.33±3.42 32.28±1.25 55.76±0.30 16.31 45.43±0.78 0.00±0.00 35.33±0.23 48.52±0.51 9.54 36.54±0.97 0.00±0.00 28.45±0.89 47.53±0.57 13.26 SURE (Ours) 68.07±0.63 52.89±1.33 45.09±0.78 65.16±0.85 1.69 70.54±0.64 4.89±0.43 38.69±0.39 59.51±1.07 4.48 60.02±1.15 4.89±1.07 35.82±0.72 56.56±0.53 5.06 Method

Ret.↑

For.

Client-only Test↑

MIA

AG↓

Ret.↑

1 Í 𝑈 𝑅 4 𝑞 ∈ J |𝑞(𝜃 ) − 𝑞(𝜃 M )|, where J = {Retain, Forget, Test, MIA} and 𝜃 𝑅M is the mode-matched retraining reference. Lower gaps in-

methods follow the same SFL architecture and model update constraints, with adaptations detailed in Appendix C.2. We use modematched Retrain as the evaluation reference. For Client-only and Server-only, the updatable partition is reinitialized and retrained on retained data, while the other partition remains fixed at its trained state. Joint Retrain reinitializes and retrains both partitions on retained data, corresponding to the SFL retraining reference defined in Section 3.2. Further details are provided in Appendix C.1 and C.2.

dicate closer agreement, measured in percentage points. We also report communication (bytes) and computation (FLOPs). Results are averaged over three runs with standard deviations, using at most 40 recovery rounds for SURE. Further evaluation details appear in Appendices C.3 and C.4.

5.2

Evaluation Protocol. We report retained-training accuracy (Retain), forgetting-target accuracy (Forget), global test accuracy (Test), and membership-inference ROC-AUC (MIA). Forget is evaluated on the removed client’s training samples for client-wise unlearning and target-class test samples for class-wise unlearning. Agreement with mode-matched Retrain is measured by Avg. Gap =

Unlearning Performance Comparison

Client-Wise Unlearning. Under extreme non-IID partitions, adapted methods exhibit substantial forgetting–utility trade-offs (Table 1). On CIFAR-10/ResNet-18 with Server-only updates, FedRecovery retains 68.70% Forget accuracy, while SalUn and MoDe reduce Test accuracy to 13.86% and 21.58%, respectively. SURE achieves 0.40% 6

Table 2: Class-wise unlearning under Dirichlet non-IID partitions (𝛼 = 0.1). Ret., For., Test, and MIA are mean ± SD (%). AG (Avg. Gap)↓ is the mean absolute difference from mode-matched Retrain (pp), computed from reported metric means. Ret./Test↑: higher is better; bold highlights the best non-reference Ret./Test means and lowest AG. Server-only Joint For. Test↑ MIA AG↓ Ret.↑ For. Test↑ MIA AG↓ MNIST / LeNet Retrain 99.23±0.02 99.43±0.25 98.74±0.21 49.46±4.13 0.00 99.11±0.10 0.00±0.00 88.96±0.35 50.33±1.44 0.00 99.12±0.14 0.00±0.00 89.01±0.31 49.34±3.14 0.00 Fine-tune 99.19±0.06 99.43±0.25 97.81±0.23 48.99±0.77 0.36 99.52±0.10 92.67±1.14 98.34±0.23 46.79±3.92 26.50 99.55±0.06 93.10±1.55 98.37±0.22 48.57±2.26 25.92 SalUn 97.92±0.30 86.93±2.49 96.32±0.33 47.09±5.48 4.65 98.37±0.94 7.47±2.17 88.91±0.47 50.47±0.21 2.10 99.38±0.26 7.04±2.17 89.61±0.54 50.24±0.21 2.20 MoDe 99.18±0.10 99.57±0.43 98.71±0.27 47.75±1.84 0.48 96.46±0.44 0.00±0.00 86.93±0.88 48.75±2.36 1.57 96.70±0.46 0.00±0.00 87.01±0.97 47.68±1.66 1.52 FedOSD 99.09±0.07 99.57±0.43 98.83±0.32 47.25±3.82 0.65 99.14±0.06 99.28±0.50 98.83±0.28 50.70±3.59 27.39 99.14±0.06 99.28±0.50 98.78±0.29 50.11±4.06 27.46 NoT 97.88±0.41 96.26±3.03 97.30±1.13 47.54±4.20 1.97 98.68±0.18 0.00±0.00 88.68±0.33 51.77±2.59 0.54 98.86±0.30 1.87±2.21 88.98±0.50 49.48±4.11 0.58 FedCARE 99.22±0.01 99.43±0.25 98.80±0.17 48.45±3.92 0.27 99.52±0.21 87.81±2.02 93.83±0.26 48.04±4.51 23.85 99.34±0.34 91.81±3.42 98.23±0.22 48.00±4.47 25.65 FedMemPrune 99.18±0.05 99.28±0.25 98.20±0.24 49.27±3.44 0.23 99.13±0.15 1.29±1.88 89.08±0.20 48.31±0.81 0.86 99.11±0.09 0.86±1.14 88.99±0.27 52.32±2.01 0.97 SURE (Ours) 99.20±0.03 99.43±0.25 98.77±0.27 48.79±1.30 0.18 99.06±0.15 0.00±0.00 88.96±0.28 50.53±1.19 0.06 99.10±0.11 0.00±0.00 88.98±0.29 50.14±1.75 0.21 CIFAR-10 / ResNet-18 Retrain 81.14±1.99 33.67±7.25 72.96±1.55 50.77±1.16 0.00 81.29±2.50 0.00±0.00 69.45±1.45 51.10±0.70 0.00 81.18±2.80 0.00±0.00 69.55±2.11 51.82±3.85 0.00 Fine-tune 80.49±2.05 41.90±3.36 70.84±1.92 53.70±0.44 3.48 81.42±2.74 0.00±0.00 69.44±1.67 49.82±1.34 0.36 83.13±1.85 0.00±0.00 71.12±1.16 51.43±2.72 0.98 SalUn 71.50±7.87 25.70±9.05 64.92±5.06 51.65±2.79 6.63 55.39±8.54 0.00±0.00 48.56±6.92 50.26±2.86 11.91 31.24±11.74 0.00±0.00 28.00±10.32 50.78±1.68 23.13 MoDe 71.90±2.25 28.77±0.76 65.54±1.23 51.22±1.05 5.50 47.19±3.57 0.00±0.00 41.14±2.68 53.33±1.13 16.16 29.51±3.93 0.00±0.00 26.59±3.71 51.21±1.38 23.81 FedOSD 78.56±2.95 41.63±5.88 70.38±1.07 53.82±1.68 4.04 82.03±1.69 0.00±0.00 70.34±1.36 51.31±3.70 0.46 82.40±1.87 0.00±0.00 70.64±1.54 51.69±4.10 0.61 NoT 73.89±3.06 35.03±3.56 68.40±1.74 50.21±1.54 3.43 77.82±1.11 0.00±0.00 65.76±0.77 50.97±0.24 1.82 83.59±1.09 0.00±0.00 72.79±0.48 52.24±2.27 1.52 FedCARE 80.79±2.19 78.90±2.99 77.17±1.86 51.16±3.54 12.55 82.11±1.76 15.30±16.47 71.96±2.89 52.71±2.42 5.06 82.13±1.79 15.50±16.44 71.99±2.87 52.82±2.69 4.97 FedMemPrune 77.56±3.15 43.33±10.66 71.38±1.77 52.88±3.13 4.23 77.66±4.88 0.00±0.00 66.54±3.53 50.79±1.65 1.71 75.46±4.27 0.00±0.00 64.96±3.82 52.35±0.27 2.71 SURE (Ours) 81.74±1.83 41.60±5.24 73.99±1.84 53.74±1.27 3.13 83.87±1.85 0.23±0.40 71.24±1.07 52.73±1.71 1.56 83.72±1.44 0.10±0.17 71.33±1.08 51.66±0.33 1.15 Method

Ret.↑

For.

Client-only Test↑

MIA

AG↓

Ret.↑

Figure 3: Impact of split position on client-wise unlearning with SURE on CIFAR-10/ResNet-18. Panels show (a) Test, (b) Forget, and (c) Retain accuracy across nine split positions. Colored curves represent Client-only, Server-only, and Joint updates, while dashed lines indicate mode-matched Retrain references.

Figure 4: Layer-wise CKA across nine split positions for client-wise unlearning on CIFAR-10/ResNet-18. The three panels correspond to Client-only, Server-only, and Joint updates. Colored curves represent different split positions, while the red dashed curve denotes Retrain. All CKA values are computed relative to Original. Forget, 56.30% Test, and an Avg. Gap of 1.76 percentage points (pp) relative to Retrain. Under Joint updates on CIFAR-10/CNN, SURE attains the highest non-reference Retain (44.22%) and Test (39.47%) accuracy, with 0.00% Forget and the lowest Avg. Gap (2.08 pp). Results on CIFAR-100/ResNet-18 reveal remaining performance gaps, underscoring the influence of model architecture and update mode. Additional IID and multiple-client removal results are provided in Appendices A.1 (Table 5) and A.3 (Table 6), respectively. Class-Wise Unlearning. Class-wise removal similarly exposes challenges in balancing forgetting and retained utility (Table 2). On

MNIST/LeNet with Server-only updates, Fine-tune and FedOSD retain high target-class accuracy (92.67% and 99.28%), whereas SURE matches Retrain’s 0.00% Forget and 88.96% Test accuracy, achieving the lowest Avg. Gap (0.06 pp). On CIFAR-10/ResNet-18, SURE achieves the highest Retain accuracy across all three modes. Under Joint updates, it maintains 83.72% Retain and 71.33% Test accuracy with 0.10% Forget and an Avg. Gap of 1.15 pp, although FedOSD achieves a smaller gap (0.61 pp). These findings demonstrate competitive retraining agreement while highlighting the mode-dependent limitations of unlearning in SFL. 7

Table 3: SURE ablation on CIFAR-10/ResNet-18 for client-wise unlearning (Dirichlet 𝛼 = 0.1, split 2). A0 denotes full SURE; A1–A7 are described in Section 5.4. Results are mean ± SD (%). Ret. and Test (↑) denote predictive utility, while For. and MIA are interpreted relative to mode-matched Retrain. AG (Avg. Gap) (↓, pp) is the mean absolute difference from Retrain across the four metrics. Bold marks the highest non-Retrain utility or lowest gap. Client-only Server-only Joint Method Ret.↑ For. Test↑ MIA AG↓ Ret.↑ For. Test↑ MIA AG↓ Ret.↑ For. Test↑ MIA AG↓ Retrain 80.67±1.96 68.14±1.08 76.38±1.67 50.60±2.01 0.00 79.67±1.48 65.37±3.33 75.11±0.82 49.67±1.24 0.00 79.46±2.47 64.13±2.32 75.77±1.86 51.12±0.23 0.00 A1 80.99±2.46 66.00±4.95 76.53±1.84 51.13±1.35 0.79 81.38±1.20 71.80±4.75 77.00±1.34 50.51±4.29 2.72 80.06±5.67 69.74±1.42 75.86±3.97 49.22±3.29 2.05 A2 81.23±2.50 67.83±3.74 76.89±2.09 50.87±2.15 0.41 81.03±2.31 70.93±1.17 76.12±1.59 49.54±1.05 2.02 82.20±2.46 70.59±2.44 77.35±1.36 52.12±1.86 2.95 A3 79.40±1.48 65.24±3.92 75.77±1.72 50.24±2.92 1.29 79.62±5.68 70.61±3.16 74.70±4.84 51.28±2.75 1.83 79.81±3.19 70.60±2.71 75.87±2.44 49.71±2.95 2.08 A4 78.75±1.55 64.91±4.49 75.20±2.00 51.05±2.10 1.70 81.68±2.62 73.00±3.31 76.77±1.49 50.47±1.20 3.03 82.13±1.54 71.21±3.82 77.37±1.18 49.74±3.21 3.18 A5 80.87±2.66 66.25±2.29 76.16±1.99 51.22±2.11 0.73 81.98±2.05 71.03±1.82 77.03±1.48 49.45±2.77 2.53 81.40±2.37 66.85±2.12 76.99±2.14 48.75±2.96 2.06 A6 80.97±2.72 66.43±3.39 76.36±2.20 50.21±1.67 0.61 82.04±2.23 71.20±5.40 76.78±0.84 51.21±1.94 2.85 76.77±5.58 65.41±1.47 72.42±3.77 49.29±1.84 2.29 A7 80.42±2.08 67.03±3.83 76.36±2.00 52.96±0.09 0.94 78.31±4.46 70.27±4.50 73.75±2.96 50.98±0.47 2.23 82.20±1.63 70.11±2.01 77.40±1.02 51.80±1.11 2.76 A0 (SURE) 81.23±2.50 67.83±3.74 76.89±2.09 50.87±2.15 0.41 81.16±1.99 67.43±4.39 76.54±4.38 51.22±1.33 1.63 81.76±2.17 65.34±4.93 77.36±1.22 48.61±1.94 1.90

Table 4: Communication and computation costs for clientwise unlearning under extreme non-IID partitions. Communication is in GB (109 bytes) and computation in TFLOPs (1012 operations); lower is better.

5.4

We evaluate seven ablation variants (Table 3): A1 removes magnitude weighting; A2 fixes the first trainable layer; A3 disables retained-importance protection (𝛾 = 0); A4 applies hard layer negation; A5 uses standard retained-data FedAvg recovery; and A6/A7 retain only forgotten-importance suppression or retained-importance amplification, respectively. Full SURE achieves the lowest Avg. Gap under Server-only (1.63 pp) and Joint (1.90 pp) updates, tying with A2 under Client-only (0.41 pp). A1 and A4 consistently increase the gap, while recovery variants reveal distinct forgetting–utility trade-offs. Under Joint updates, A6 reduces Test accuracy to 72.42%, whereas A7 increases Forget accuracy to 70.11%. In contrast, SURE achieves 77.36% Test and 65.34% Forget accuracy, approaching Retrain’s 64.13% Forget accuracy. These results highlight the complementary roles of importance estimation, selective perturbation, and guided recovery. Hyperparameter sensitivity is further examined in Appendix A.4 (Figure 7).

Client-only Server-only Joint Comm.↓ FLOPs↓ Comm.↓ FLOPs↓ Comm.↓ FLOPs↓ CIFAR-10 / CNN Fine-tune 53.3 333 26.5 218 53.3 379 FedEraser 53.5 333 26.5 218 53.5 379 FedRecovery 0.189 0.00707 0.161 0.00707 0.189 0.00707 SalUn 59.1 371 29.6 244 59.1 422 MoDe 112 703 56.0 461 112 800 FedOSD 53.3 333 26.5 218 53.3 379 NoT 53.3 333 26.5 218 53.3 379 FedCARE 53.4 335 26.6 220 53.4 381 FedMemPrune 159 999 79.6 655 159 1,140 SURE (Ours) 54.7 344 28.0 229 54.7 390 CIFAR-10 / ResNet-18 Fine-tune 213 980 106 1,233 213 1,370 FedEraser 213 980 106 1,233 213 1,370 FedRecovery 0.218 0.274 0.183 0.274 0.218 0.274 SalUn 237 1,093 119 1,373 237 1,525 MoDe 449 2,070 224 2,603 449 2,890 FedOSD 213 980 106 1,233 213 1,370 NoT 213 980 106 1,233 213 1,370 FedCARE 213 986 106 1,240 213 1,375 FedMemPrune 637 2,941 319 3,699 637 4,106 SURE (Ours) 218 1,020 112 1,270 218 1,370 Method

5.3

Ablation Study

5.5

Efficiency Analysis

We compare communication and computation costs across three update modes (Table 4). SURE incurs modest overhead over Finetune while remaining substantially more efficient than MoDe and FedMemPrune. On CIFAR-10/ResNet-18 under Joint updates, SURE requires 218 GB and 1,370 TFLOPs, compared with 213 GB and 1,370 TFLOPs for Fine-tune and 449 GB and 2,890 TFLOPs for MoDe. FedRecovery achieves substantially lower costs through training-free correction using stored historical updates, although historical storage costs are excluded [35]. However, lower costs do not necessarily imply closer agreement with Retrain.

Impact of Split Position on Unlearning

Split position determines the trainable model partitions under different update modes, thereby influencing unlearning behavior. We evaluate SURE across nine ResNet-18 split positions (Fig. 3). As the split deepens, Client-only updates exhibit declining Test and Retain accuracy, whereas Server-only updates show the opposite trend. Joint updates exhibit non-monotonic behavior, while Forget accuracy varies across modes. To examine the representation changes, Fig. 4 reports layer-wise Centered Kernel Alignment (CKA) [13] relative to Original. Final-stage CKA decreases from 0.980 to 0.908 between splits 1 and 8 under Client-only updates, but increases from 0.954 to 0.980 under Server-only updates. Additional t-SNE visualizations in Appendix A.2 (Fig. 5 and Fig. 6) illustrate representation differences across split positions and model partitions. These results highlight the interplay between split placement and update constraints, although representation changes alone do not establish forgetting effectiveness.

6

Limitations

SURE provides an initial approach to SFU, with effectiveness varying across model update modes, split positions, and forgetting scenarios. Its recovery stage requires retained data, and formal forgetting guarantees remain unexplored. Moreover, agreement with mode-matched retraining under restricted updates does not necessarily imply equivalence to full retraining. Future work will explore more scalable unlearning methods, broader SFL architectures, and stronger forgetting guarantees. 8

7

Conclusion

[16] Yue Li, Mingmin Chu, Xilei Yang, Da Xiao, Ziqi Xu, Wei Shao, Qipeng Song, and Hui Li. 2026. FedCARE: Federated Unlearning with Conflict-Aware Projection and Relearning-Resistant Recovery. In Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence, IJCAI-26, Diego Calvanese (Ed.). International Joint Conferences on Artificial Intelligence Organization, 5576–5584. Main Track. doi:10.24963/ijcai.2026/621 [17] Yijing Lin, Zhipeng Gao, Hongyang Du, Dusit Niyato, Jiawen Kang, and Xiaoyuan Liu. 2024. Incentive and dynamic client selection for federated unlearning. In Proceedings of the ACM web conference 2024. 2936–2944. [18] Fan Liu and Hao Liu. 2025. Subgraph federated unlearning. In Proceedings of the ACM on Web Conference 2025. 1205–1215. [19] Gaoyang Liu, Xiaoqiang Ma, Yang Yang, Chen Wang, and Jiangchuan Liu. 2021. Federaser: Enabling efficient client-level data removal from federated learning models. In 2021 IEEE/ACM 29th international symposium on quality of service (IWQOS). IEEE, 1–10. [20] Yi Liu, Lei Xu, Xingliang Yuan, Cong Wang, and Bo Li. 2022. The right to be forgotten in federated learning: An efficient realization with rapid retraining. In IEEE INFOCOM 2022-IEEE conference on computer communications. IEEE, 1749– 1758. [21] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics. Pmlr, 1273–1282. [22] Minh-Duong Nguyen, Senura Wanasekara, Le-Tuan Nguyen, Quoc-Viet Pham, Ken-Tye Yong, Nguyen H Tran, and Dung D Le. 2026. Computation and communication efficient federated unlearning via on-server gradient conflict mitigation and expression. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 3347–3357. [23] Jorge Nocedal and Stephen J Wright. 1999. Numerical optimization. Springer. [24] Zibin Pan, Zhichao Wang, Chi Li, Kaiyan Zheng, Boqi Wang, Xiaoying Tang, and Junhua Zhao. 2025. Federated unlearning with gradient descent and conflict mitigation. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 19804–19812. [25] Liang Qu, Wei Yuan, Ruiqi Zheng, Lizhen Cui, Yuhui Shi, and Hongzhi Yin. 2024. Towards personalized privacy: User-governed data contribution for federated recommendation. In Proceedings of the ACM Web Conference 2024. 3910–3918. [26] Nicolò Romandini, Alessio Mora, Carlo Mazzocca, Rebecca Montanari, and Paolo Bellavista. 2024. Federated unlearning: A survey on methods, design guidelines, and evaluation metrics. IEEE Transactions on Neural Networks and Learning Systems 36, 7 (2024), 11697–11717. [27] Chandra Thapa, Pathum Chamikara Mahawaga Arachchige, Seyit Camtepe, and Lichao Sun. 2022. Splitfed: When federated learning meets split learning. In Proceedings of the AAAI conference on artificial intelligence, Vol. 36. 8485–8493. [28] Joana Tirana, Dimitra Tsigkari, David Solans Noguero, and Nicolas Kourtellis. 2026. Data heterogeneity and forgotten labels in split federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40. 25940–25948. [29] Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar. 2018. Split learning for health: Distributed deep learning without sharing raw patient data. arXiv preprint arXiv:1812.00564 (2018). [30] Hengzhi Wang, Lu Dai, Xianliang Zhang, Haoran Chen, Juncheng Hu, and Kun Yang. 2026. DIARY: Differentially Private Recovery with Adaptive Privacy Budgets in Federated Unlearning. In Proceedings of the ACM Web Conference 2026. 3042–3053. [31] Junxiao Wang, Song Guo, Xin Xie, and Heng Qi. 2022. Federated unlearning via class-discriminative pruning. In Proceedings of the ACM web conference 2022. 622–632. [32] Jiaheng Wei, Yanjun Zhang, He Zhang, Leo Yu Zhang, Chao Chen, Kok-Leong Ong, Jun Zhang, and Yang Xiang. 2026. Rethinking Federated Unlearning via the Lens of Memorization. In Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2. Association for Computing Machinery, 23 pages. doi:10.1145/3770855.3817785 [33] Xiuting Weng, Ruizhi Pu, Yuanhang Yao, Kun Yue, Zhiwen Tang, and Lixing Yu. 2026. GDFA: Geometry-Driven Federated Unlearning with Directional Task Vector Alignment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 10346–10356. [34] Fuzhen Zhang. 2006. The Schur complement and its applications. Springer Science & Business Media. [35] Lefeng Zhang, Tianqing Zhu, Haibin Zhang, Ping Xiong, and Wanlei Zhou. 2023. Fedrecovery: Differentially private machine unlearning for federated learning frameworks. IEEE Transactions on Information Forensics and Security 18 (2023), 4732–4746. [36] Yian Zhao, Pengfei Wang, Heng Qi, Jianguo Huang, Zongzheng Wei, and Qiang Zhang. 2024. Federated Unlearning With Momentum Degradation. IEEE Internet of Things Journal 11, 5 (2024), 8860–8870. doi:10.1109/JIOT.2023.3321594

We establish Split Federated Unlearning (SFU) as a distinct research problem, providing a unified formulation and theoretical characterization of historical influence propagation and mode-dependent unlearning feasibility. As an initial solution, SURE integrates dualimportance estimation, selective perturbation, and guided recovery. Extensive experiments across diverse model architectures, data distributions, and update modes reveal the forgetting–utility challenges of existing methods adapted to SFL, while SURE achieves competitive agreement with mode-matched retraining at modest overhead, laying a foundation for principled unlearning in split federated systems.

References [1] Jun Bai, Yiliao Song, Di Wu, Atul Sajjanhar, Yong Xiang, Wei Zhou, Xiaohui Tao, Yan Li, and Yue Li. 2025. A unified solution to diverse heterogeneities in one-shot federated learning. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2. 71–82. [2] Jun Bai, Di Wu, Shan Zeng, Yao Zhao, Youyang Qu, and Shui Yu. 2025. Non-IID free federated learning with fuzzy optimization for consumer electronics systems. IEEE Transactions on Consumer Electronics 71, 2 (2025), 7032–7044. [3] Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Machine unlearning. In 2021 IEEE symposium on security and privacy (SP). IEEE, 141–159. [4] Ashley Etheridge, Michelle Zhu, Xin Liu, and Chao Huang. 2025. Tackling Sequential Entanglement in Split Unlearning. In 2025 IEEE 8th International Conference on Multimedia Information Processing and Retrieval (MIPR). IEEE, 290–296. [5] Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. 2024. SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation. In The Twelfth International Conference on Learning Representations. https://openreview.net/forum?id= gn0mIhQGNM [6] Yansong Gao, Minki Kim, Chandra Thapa, Alsharif Abuadbba, Zhi Zhang, Seyit Camtepe, Hyoungshick Kim, and Surya Nepal. 2021. Evaluation and optimization of distributed machine learning techniques for internet of things. IEEE Trans. Comput. 71, 10 (2021), 2538–2552. [7] Moritz Hardt, Ben Recht, and Yoram Singer. 2016. Train faster, generalize better: Stability of stochastic gradient descent. In International conference on machine learning. PMLR, 1225–1234. [8] Qiang He, Kaibin Wang, Zeqian Dong, Liang Yuan, Feifei Chen, Hai Jin, and Yun Yang. 2025. Hourglass: Enabling efficient split federated learning with data parallelism. In Proceedings of the Twentieth European Conference on Computer Systems. 1317–1333. [9] Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. 2019. Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classification. arXiv preprint arXiv:1909.06335 (2019). https://arxiv.org/abs/1909.06335 [10] Yanna Jiang, Guangsheng Yu, Qin Wang, Xu Wang, Baihe Ma, Caijun Sun, Wei Ni, and Ren Ping Liu. 2025. Split unlearning. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security. 948–962. [11] Yasser H. Khalil, Leo Brunswic, Soufiane Lamghari, Xu Li, Mahdi Beitollahi, and Xi Chen. 2025. NoT: Federated Unlearning via Weight Negation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 25759– 25769. https://openaccess.thecvf.com/content/CVPR2025/html/Khalil_NoT_ Federated_Unlearning_via_Weight_Negation_CVPR_2025_paper.html [12] Pang Wei Koh and Percy Liang. 2017. Understanding black-box predictions via influence functions. In International conference on machine learning. Pmlr, 1885–1894. [13] Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. 2019. Similarity of Neural Network Representations Revisited. In Proceedings of the 36th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 97). PMLR, 3519–3529. https://proceedings.mlr.press/v97/ kornblith19a.html [14] Jaehoon Lee, Lechao Xiao, Samuel Schoenholz, Yasaman Bahri, Roman Novak, Jascha Sohl-Dickstein, and Jeffrey Pennington. 2019. Wide neural networks of any depth evolve as linear models under gradient descent. Advances in neural information processing systems 32 (2019). [15] Kunhao Li, Wenhao Li, Di Wu, Lei Yang, Jun Bai, Ju Jia, and Jason Xue. 2026. Cross-modal unlearning via influential neuron path editing in multimodal large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40. 35589–35597. 9

A Additional Experimental Results A.1 Client-Wise Unlearning under IID Partitions

modes: the minimum Avg. Gap is obtained at 𝛾 = 1.25 for Clientonly, 𝛾 = 1.0 for Server-only, and 𝛾 = 0.75 for Joint updates. Fig. 7(b) shows a similar mode dependence for the recovery coefficients. The best setting is (𝛽𝑅 , 𝛽 𝐹 ) = (0.25, 0.50) for Client-only, (0.25, 0.75) for Server-only, and (0.99, 0.75) for Joint updates. Since no single configuration is uniformly optimal across all modes, we use the shared default (𝛾, 𝛽𝑅 , 𝛽 𝐹 ) = (1, 0.25, 0.75) in the main experiments as a practical compromise.

Under IID partitions, retained clients share the same label space, so forgotten-sample accuracy may remain high even after retraining. As shown in Table 5, SURE preserves competitive utility across architectures and update modes. On CIFAR-10/ResNet-18 under Joint updates, SURE achieves 88.01% Test accuracy, close to Retrain (87.60%), whereas FedEraser and MoDe drop to 57.83% and 46.78%. Nevertheless, deviations in Forget accuracy and MIA, particularly on CIFAR-100, highlight the distinction between utility preservation and retraining agreement.

A.2

B Proofs of Theoretical Results B.1 Proof of Theorem 3.1 Proof. Add and subtract G𝑡 (𝑧𝑅𝑡 ) in the trajectory difference. By the fundamental theorem of calculus and the definitions of 𝐴𝑡 and 𝑏𝑡 , 𝛿𝑡 +1 = G𝑡 (𝑧𝑡 ) − G𝑡 (𝑧𝑅𝑡 ) + 𝑏𝑡 = 𝐴𝑡 𝛿𝑡 + 𝑏𝑡 . (29) Iterating from the shared initialization 𝛿 0 = 0 gives Eq. (8). The triangle inequality and submultiplicativity yield ! −1 𝑇∑︁ −1 𝑇 Ö ∥𝛿𝑇 ∥ 2 ≤ ∥𝐴𝑟 ∥ 2 ∥𝑏𝑡 ∥ 2, (30)

Additional Representation Analysis

Client-Wise Representation Responses. To complement the splitposition analysis, we visualize forgotten-sample representations at shallow (split 1) and deep (split 8) cuts on CIFAR-10/ResNet18. As shown in Fig. 5, forgotten samples remain largely intermixed with other samples under Client-only updates at split 1, whereas Server-only and Joint updates produce more distinct postunlearning neighborhoods. At split 8, Client-only updates also yield a more concentrated target-sample distribution. These observations illustrate how cut placement and update permissions affect representation responses, although t-SNE separation alone does not establish forgetting effectiveness. Class-Wise Representation Responses. We further examine client cut-layer and server pre-classifier representations under Joint updates on CIFAR-10/ResNet-18. Fig. 6 shows relatively mixed class distributions at the client partition, whereas the server partition exhibits more structured class neighborhoods. SURE and Retrain display different target-sample arrangements, suggesting that similar prediction-level forgetting behavior does not necessarily imply identical learned representations. These qualitative observations complement the performance results without establishing representation-level equivalence.

A.3

𝑡 =0

B.2

□

Proof of Theorem 3.2

Proof. For any Δ𝜃 ∈ Θ M with ∥Δ𝜃 ∥ 2 ≤ 𝜌, write 𝐹 (𝜃 ∗ + Δ𝜃 ) = 𝐹 (𝜃 ∗ ) + 𝐷𝐹 (𝜃 ∗ ) [Δ𝜃 ] + 𝑅Δ . The 𝐿-Lipschitz derivative assumption gives ∫ 1 𝐿𝜌 2 ∥𝑅Δ ∥ H ≤ 𝐿𝛼 ∥Δ𝜃 ∥ 22 𝑑𝛼 ≤ . 2 0

(31)

(32)

Since 𝐷𝐹 (𝜃 ∗ ) [Δ𝜃 ] ∈ VM , orthogonal projection yields ∥𝐹 (𝜃 ∗ + Δ𝜃 ) − 𝐹 (𝜃 𝑅 )∥ H ≥ ∥𝐷𝐹 (𝜃 ∗ ) [Δ𝜃 ] − 𝑟 ∥ H − ∥𝑅Δ ∥ H

(33) 𝐿𝜌 2 ≥ 𝑑M − . 2 Taking the nonnegative part and infimum over admissible updates proves Eq. (12). □

Multiple Forgetting Clients

We evaluate SURE with multiple client removals on CIFAR-10/ResNet18 under Dirichlet non-IID partitions (𝛼 = 0.1), where 𝑇 –𝐹 denotes 𝑇 total clients and 𝐹 forgetting clients. Each setting uses its corresponding mode-matched Retrain reference. As shown in Table 6, increasing the forgetting fraction from 10% (10–1) to 50% (10–5) reduces Test accuracy and increases Avg. Gap across all update modes. The effect is particularly pronounced under Joint updates, where Test accuracy drops from 77.36% to 56.42% and Avg. Gap rises from 1.90 to 4.36 pp. Comparisons among 10–1, 20–2, and 50–5 further reveal mode-dependent behavior at a fixed forgetting ratio. These results demonstrate the challenges of maintaining utility and retraining consistency under larger removal requests.

A.4

𝑟 =𝑡 +1

which implies Eq. (9) using ∥𝐴𝑟 ∥ 2 ≤ 𝐿𝑟 .

B.3

Proof of Corollary 3.3

Proof. The inclusions Θ {𝐶 } , Θ {𝑆 } ⊆ Θ {𝐶,𝑆 } imply the same inclusions for their images under 𝐷𝐹 (𝜃 ∗ ). Thus, the projection residual cannot increase under Joint updates. The corresponding nonlinear feasible sets are also nested for a common 𝜌; taking infima establishes the feasibility-error hierarchy in Eq. (13). □

B.4

Proof of Proposition 3.4

Proof. For Client-only updates, set 𝑢𝐶 = 𝜃𝐶 −𝜃𝐶𝑅 and 𝑒𝑆 = 𝜃 𝑆∗ −𝜃 𝑆𝑅 . The quadratic excess risk is 𝑄 𝑅 − L𝑅 (𝜃 𝑅 ) = 12 𝑢𝐶⊤ 𝐻𝐶𝐶 𝑢𝐶 + 𝑢𝐶⊤ 𝐻𝐶𝑆 𝑒𝑆 (34)

+ 21 𝑒𝑆⊤ 𝐻𝑆𝑆 𝑒𝑆 .

Hyperparameter Sensitivity

−1 𝐻 𝑒 . Since 𝐻𝐶𝐶 ≻ 0, its unique minimizer satisfies 𝑢𝐶 = −𝐻𝐶𝐶 𝐶𝑆 𝑆 Substitution gives Eq. (15). Exchanging 𝐶 and 𝑆 yields Eq. (16). Both Schur complements are positive definite because 𝐻𝑅 ≻ 0, proving opt

We evaluate the sensitivity of SURE to the perturbation protection coefficient 𝛾 and the recovery coefficients (𝛽𝑅 , 𝛽 𝐹 ) on CIFAR10/ResNet-18. Fig. 7(a) shows that the best 𝛾 differs across update 10

Table 5: Client-wise unlearning under IID partitions (mean ± SD, %). AG (Avg. Gap)↓ is the mean absolute distance of Ret., For., Test, and MIA from mode-matched Retrain (percentage points), computed from reported means. Ret./Test↑: higher is better. Bold marks the best non-reference Ret./Test or AG within each dataset–model and update mode. Server-only Joint For. Test↑ MIA AG↓ Ret.↑ For. Test↑ MIA AG↓ CIFAR-10 / CNN Retrain 84.62±0.18 81.72±0.80 81.09±0.23 49.53±1.50 0.00 85.32±0.38 81.50±0.82 81.74±0.24 50.42±0.52 0.00 84.88±0.72 81.28±0.82 81.54±0.63 49.80±1.24 0.00 Fine-tune 85.23±1.10 84.14±1.56 82.01±0.60 50.79±1.00 1.30 86.06±1.32 83.48±1.24 81.85±0.92 51.73±1.16 1.04 87.23±0.24 85.46±1.36 81.98±0.37 48.82±1.52 1.99 FedEraser 82.00±2.00 82.38±0.43 79.87±1.47 50.48±1.52 1.36 82.76±1.30 80.40±0.48 79.91±1.42 50.42±1.32 1.37 75.12±2.42 71.59±0.33 72.65±2.35 51.37±1.36 7.48 FedRecovery 84.84±0.36 85.02±0.72 81.55±0.27 50.49±0.84 1.24 84.84±1.25 85.02±0.42 81.56±1.12 50.43±0.94 1.05 84.84±0.36 85.02±0.53 81.56±0.73 50.49±0.35 1.12 SalUn 81.88±2.62 82.60±1.75 79.78±1.73 50.56±3.13 1.49 83.35±1.22 82.72±0.55 79.64±1.03 49.16±4.12 1.64 86.45±1.62 85.80±1.35 82.88±1.35 48.95±2.35 2.07 MoDe 71.97±6.38 71.37±6.11 70.86±6.18 49.57±0.52 8.32 78.05±3.71 77.31±2.51 75.74±2.08 50.71±0.92 4.44 47.55±3.52 51.98±2.25 48.44±1.25 49.03±0.35 25.13 FedOSD 84.69±0.49 85.24±1.11 81.58±0.14 51.11±1.86 1.42 84.71±0.69 84.80±1.41 81.51±0.44 51.19±1.06 1.23 84.74±0.29 85.02±1.26 81.44±0.35 51.19±1.25 1.34 NoT 83.54±0.37 85.40±1.45 82.15±0.19 51.19±2.24 1.87 82.71±0.92 80.28±1.72 79.56±1.18 49.29±1.04 1.79 85.18±0.36 84.04±0.26 81.74±0.24 50.01±1.94 0.87 FedCARE 84.71±0.35 83.48±0.68 81.51±0.30 51.03±1.04 0.94 83.66±0.65 84.48±1.48 80.56±0.33 51.75±1.08 1.79 84.79±0.72 83.48±0.48 81.51±0.54 50.57±0.54 0.77 FedMemPrune 75.63±0.74 75.77±0.29 73.67±0.53 49.52±1.31 5.59 83.42±1.79 81.50±0.33 80.01±0.43 50.23±0.84 0.96 72.75±0.32 73.35±0.59 71.21±0.67 49.80±1.21 7.60 SURE (Ours) 85.40±0.50 85.46±0.90 82.05±0.23 51.38±1.83 1.83 86.15±1.25 82.60±0.80 82.16±0.33 51.38±1.29 0.83 87.40±0.66 86.56±0.47 83.18±0.57 50.69±1.56 2.58 CIFAR-10 / ResNet-18 Retrain 96.26±0.38 95.37±0.23 87.48±0.36 54.05±1.47 0.00 95.92±0.47 89.43±0.92 86.79±0.43 48.32±0.93 0.00 96.85±0.35 88.25±0.93 87.60±0.45 49.03±1.26 0.00 Fine-tune 96.36±0.14 97.04±0.96 87.57±0.64 53.69±1.27 0.56 96.24±1.19 93.29±1.90 87.85±1.21 52.39±1.43 2.33 94.97±0.97 93.07±1.24 88.78±0.26 53.70±1.36 3.14 FedEraser 93.72±1.45 94.71±1.23 85.35±2.98 52.83±1.25 1.64 77.75±1.20 76.65±0.92 76.96±1.52 48.31±1.02 10.20 58.13±1.88 56.97±0.36 57.83±1.84 50.63±1.21 25.34 FedRecovery 96.43±1.32 97.14±0.80 87.81±1.22 54.48±0.67 0.68 96.43±1.06 97.14±1.02 87.81±0.22 54.41±0.94 3.83 96.21±0.46 96.84±0.36 87.83±0.24 55.10±0.62 3.88 SalUn 93.41±1.32 92.95±1.99 85.15±0.56 53.38±2.11 2.07 91.55±2.12 88.55±1.28 84.68±1.25 50.40±2.36 2.36 91.92±2.26 85.44±0.35 84.34±1.62 52.12±2.24 3.52 MoDe 89.33±0.77 88.11±2.37 82.41±2.46 53.00±1.13 5.08 63.88±4.92 67.18±3.21 64.66±3.32 49.59±0.74 19.42 46.56±2.98 48.16±2.36 46.78±1.89 49.80±0.72 32.99 FedOSD 96.36±0.28 96.92±0.51 87.81±0.44 53.85±0.89 0.55 96.56±1.43 96.26±1.91 87.71±0.25 54.37±0.83 3.61 96.15±0.35 96.25±1.23 87.62±0.32 55.16±0.96 3.71 NoT 93.70±0.49 93.39±1.18 85.87±0.53 53.72±2.37 1.62 95.80±0.38 93.51±0.91 87.50±0.63 51.41±2.74 2.00 92.75±0.64 92.31±0.25 89.53±0.16 54.69±1.78 3.94 FedCARE 96.36±0.72 97.14±1.48 87.83±1.32 54.35±0.14 0.63 96.46±0.94 96.92±0.28 87.77±0.60 54.05±1.72 3.69 96.19±0.63 96.77±0.36 87.80±0.23 55.04±1.06 3.85 FedMemPrune 91.79±0.37 92.95±1.22 84.97±0.55 51.68±1.52 2.94 92.16±0.24 88.33±0.93 84.80±0.32 50.40±1.21 2.23 87.36±0.46 83.85±0.36 81.44±0.55 50.36±1.24 5.35 SURE (Ours) 96.09±0.21 96.48±0.39 87.34±0.42 53.69±1.09 0.45 96.17±0.73 92.73±1.80 87.57±0.63 51.72±1.73 1.93 97.17±0.72 94.13±0.57 88.01±0.22 53.77±1.52 2.84 CIFAR-100 / ResNet-18 Retrain 98.24±1.17 97.98±0.54 57.25±0.64 79.08±1.15 0.00 99.05±1.13 54.55±1.35 56.94±0.24 51.40±0.79 0.00 98.81±0.99 54.34±1.38 55.65±0.41 49.81±0.62 0.00 Fine-tune 98.08±0.52 98.79±0.64 57.28±0.47 78.01±0.56 0.52 98.83±0.87 84.44±1.32 57.32±0.22 66.19±0.77 11.32 99.30±1.12 82.83±1.32 57.72±0.44 64.90±0.46 11.54 FedEraser 96.93±0.41 97.78±0.68 56.05±0.72 78.16±1.17 0.91 49.62±1.02 44.65±0.47 45.16±0.74 49.50±0.66 18.25 7.80±0.87 9.09±1.50 7.33±0.36 50.29±0.27 46.27 FedRecovery 98.06±0.37 98.99±0.92 57.34±0.82 79.07±1.08 0.32 98.06±0.76 98.99±1.37 57.33±0.51 79.05±0.94 18.37 98.06±0.85 98.99±1.06 57.33±0.24 79.08±0.61 19.09 SalUn 95.94±0.78 95.15±1.18 55.26±0.68 76.47±0.29 2.43 96.01±0.82 62.02±0.79 56.48±0.75 46.54±0.40 3.96 75.96±1.16 81.41±1.11 55.78±0.65 47.38±0.91 13.12 MoDe 93.51±0.68 94.75±1.23 54.04±0.85 76.00±0.94 3.56 27.59±1.08 30.10±0.81 26.72±0.70 50.99±0.82 31.64 22.16±0.82 23.84±0.51 21.12±0.78 51.25±0.73 35.78 FedOSD 98.13±0.73 98.99±0.62 57.17±0.70 79.34±0.78 0.37 98.06±0.52 97.37±0.27 57.21±0.60 77.90±0.45 17.65 98.13±1.12 97.37±0.74 57.28±0.49 77.71±1.22 18.31 NoT 95.40±1.15 94.75±1.01 55.45±0.85 76.66±0.27 2.57 98.87±0.71 81.82±0.82 56.20±0.79 64.61±1.03 10.35 88.56±0.24 79.58±0.30 56.40±0.41 63.51±0.88 12.49 FedCARE 98.11±0.34 98.99±0.94 57.25±0.49 79.11±0.29 0.29 98.13±0.75 98.79±1.43 57.29±0.43 79.13±0.73 18.31 98.13±0.88 98.79±0.85 57.28±0.94 79.13±0.46 19.02 FedMemPrune 94.05±0.40 93.94±0.67 54.03±0.65 76.04±0.20 3.62 83.75±0.36 63.23±1.53 52.70±0.85 56.03±0.47 8.21 75.05±1.11 51.52±0.50 44.81±0.80 52.90±1.21 10.13 SURE (Ours) 98.22±0.59 98.79±0.49 57.48±0.63 79.04±1.12 0.28 98.96±0.40 87.27±0.80 57.29±0.89 67.46±0.36 12.31 98.94±0.48 84.24±1.51 57.25±0.79 66.90±0.38 12.18 Method

Ret.↑

Client-only For. Test↑

MIA

AG↓

Ret.↑

Figure 5: t-SNE visualization of client-wise unlearning on CIFAR-10/ResNet-18 at split 1 (left) and split 8 (right). Each row compares Client-only, Server-only, and Joint updates. Blue and green denote retained-training and non-member samples, respectively, while pink and yellow indicate forgotten samples before and after SURE. nonnegativity and strict positivity for nonzero frozen-partition displacement. □

client on CIFAR-100. Class-wise, ablation, sensitivity, and multiclient experiments use Dirichlet 𝛼 = 0.1. Client partitions contain the first convolution-pooling block of LeNet, the first two convolutional blocks of CNN, or the ResNet-18 stem and first residual block (split 2). Nine ResNet-18 cut positions are examined separately. Training Configurations. Original and Retrain share identical round budgets: 50 for MNIST, 100/500 for CIFAR-10/CNN, and 200/1000 for ResNet-18 under IID/extreme non-IID partitions,

C Additional Experimental Details C.1 Experimental Settings Data and Model Splits. Extreme non-IID partitions assign one exclusive class per client on MNIST/CIFAR-10 and ten classes per 11

Figure 6: t-SNE visualization of class-wise unlearning on CIFAR-10/ResNet-18 under Joint updates. Panels (a) and (b) show client cut-layer and server pre-classifier representations, respectively, each comparing Original, Retrain, and SURE. Colors denote classes, and black triangles mark forgotten class-0 samples.

Figure 7: Sensitivity of SURE to perturbation protection and recovery coefficients on CIFAR-10/ResNet-18 under Dirichlet 𝛼 = 0.1. (a) Avg. Gap as the perturbation protection coefficient 𝛾 varies under Client-only, Server-only, and Joint updates. (b) Avg. Gap over recovery coefficients (𝛽𝑅 , 𝛽 𝐹 ) for the three update modes. Lower is better. Circles and red boxes mark the best setting within each mode. Table 6: SURE with multiple forgetting clients on CIFAR10/ResNet-18 under Dirichlet 𝛼 = 0.1. A configuration 𝑇 –𝐹 denotes 𝑇 total clients and 𝐹 forgetting clients. Avg. Gap (pp) is computed against the corresponding Retrain reference. Mode Client-only

Server-only

Joint

minimum of 0.0002. MNIST uses normalization only; CIFAR additionally applies random cropping and horizontal flipping. Retraining and Checkpoint Selection. Let 𝜃 init and 𝜃 ∗ denote the original initialization and trained checkpoint. Client-only, Server-only, and Joint Retrain initialize from (𝜃𝐶init, 𝜃 𝑆∗ ), (𝜃𝐶∗ , 𝜃 𝑆init ), and 𝜃 init , respectively, using retained data while preserving frozen parameters and buffers. Main experiments use seeds 41–43; sensitivity and representation analyses use seed 42. Original and Retrain select checkpoints by validation accuracy, breaking ties by earlier rounds. Unlearning selects the highest-validation-accuracy checkpoint satisfying the forgetting constraint; otherwise, the checkpoint with the lowest target validation accuracy is reported as failing the constraint. Test data are excluded from selection.

Metric 10–1 10–2 10–5 20–2 50–5 Retain (%) 81.23±2.50 81.78±0.51 72.37±0.83 72.42±0.83 61.19±0.76 Forget (%) 67.83±3.74 69.05±1.22 70.98±1.28 74.67±0.66 51.69±0.36 Test (%) 76.89±2.09 76.87±0.77 72.21±0.44 71.41±0.71 58.33±0.59 MIA (%) 50.87±2.15 51.62±0.55 51.80±0.47 51.19±0.79 50.25±0.94 Avg. Gap ↓ 0.41 0.91 1.96 0.82 0.81 Retain (%) 81.16±1.99 82.36±0.52 75.18±0.37 75.22±0.71 57.63±0.35 Forget (%) 67.43±4.39 70.38±1.04 51.75±0.36 76.17±0.62 52.33±0.71 Test (%) 76.54±4.38 75.99±0.30 57.70±0.23 72.56±0.62 55.15±0.25 MIA (%) 51.22±1.33 50.98±0.82 51.06±0.16 50.64±0.32 49.40±0.87 Avg. Gap ↓ 1.63 2.12 2.93 1.16 4.34 Retain (%) 81.76±2.17 81.65±0.48 67.88±0.99 74.94±0.86 63.50±0.52 Forget (%) 65.34±4.93 72.19±1.27 52.44±0.96 75.17±1.30 51.85±0.62 Test (%) 77.36±1.22 74.97±0.64 56.42±0.78 72.26±0.51 60.39±0.54 MIA (%) 48.61±1.94 50.55±0.25 51.15±0.26 50.36±0.23 48.83±0.37 Avg. Gap ↓ 1.90 2.00 4.36 3.63 3.78

C.2 respectively. Class-wise experiments use 50 (MNIST) or 200 (CIFAR10) rounds. Each client performs one local epoch using SGD (momentum 0.9), with batch sizes 32 (MNIST) or 128 (CIFAR). SURE uses batch size 32, at most 40 recovery rounds, and (𝛾, 𝛽𝑅 , 𝛽 𝐹 ) = (1, 0.25, 0.75). MNIST uses learning rate 0.005 and weight decay 10−4 . IID CIFAR uses 0.05 and 5 × 10−4 , with cosine decay to 0.001 after 80% of training. Extreme non-IID CIFAR uses 0.005 and 10−4 , with exponential decay (0.998 for CNN; 0.999 for ResNet-18) to a

Baseline Adaptation to SFL

All baselines share SURE’s data partitions, model architectures, and unlearning requests, with their operations adapted to split computation and dual-side aggregation. Parameter modifications are restricted to the permitted update modes, while frozen partitions retain their parameters and persistent states. Recovery-based methods follow the original SFL aggregation protocol, and historydependent methods use records from the training runs. FedEraser and FedRecovery are evaluated only for client-wise unlearning. 12

C.3

Membership Inference Attack

ROC-AUC measures membership distinguishability, with 50% indicating chance-level discrimination rather than certified forgetting.

We use a gradient-boosting attacker with label-aware prediction features (probabilities, entropy, and margins). Forgotten training samples serve as members and class-matched unseen samples as non-members. Balanced attack data are split into disjoint training, calibration, and evaluation sets. The attacker is fitted and calibrated on Original, then held fixed across Retrain and unlearning methods.

C.4

Metric and Cost Accounting

For class-wise unlearning, Forget measures class-0 test accuracy, while Test includes all classes. Communication includes model transfers, cut-layer activations, and gradients, while computation is estimated in FLOPs. Client-wise and ablation costs reflect executed procedures, whereas class-wise costs use a fixed 40-round budget.

13

Related documents

• Split Federated Unlearning#1467789
• Communication-efficient federated learning with data and client heterogeneity#1251625
• Reviving Stale Updates: Data-Free Knowledge Distillation for Asynchronous Federated Learning#1325050
• Could Model Partitioning Make Federated Learning More Sustainable?#458254
• $f$-FUM: Federated Unlearning via min--max and $f$-divergence#1116203