FedUP: One-Shot Federated Unlearning via Centroid-Guided Plug-in Filters
arXiv:2606.24113v1 [cs.LG] 23 Jun 2026
Feihong Nan1 , Zhengyi Zhong1 , Pan Wang1 , Weidong Bao1 , Xiongtao Zhang1 , Quan Wen1 and Ji Wang1∗ 1 National Key Laboratory of Big Data and Decision, National University of Defense Technology, China. [email protected], {zhongzhengyi20, wangpan19, wdbao, zhangxiongtao14, wangji}@nudt.edu.cn, [email protected] Abstract Federated unlearning (FU) is critical for complying with legal mandates like the right to be forgotten in decentralized systems, yet current methods face a persistent dilemma between non-target knowledge loss and high request latency. To resolve these issues, we propose FedUP, a one-shot federated unlearning framework utilizing lightweight pluggable filters that act as a “knowledge funnel” to screen out target data while preserving original model performance. By freezing original model parameters and training filters at the server side using differentially private (DP)-protected class centroid samples, FedUP bypasses the need for multiround client-server communication and complex retraining, reducing unlearning latency from minutes to mere seconds. Additionally, the framework’s pluggable architecture ensures inherent reversibility, enabling the seamless restoration of forgotten knowledge by simply removing the filters. Extensive experiments on diverse image and text tasks demonstrate that FedUP effectively reduces non-target knowledge loss and achieves superior unlearning precision and efficiency across various scenarios. Code is available at: https://github.com/ suows/FedUP-code.
1
Introduction
Background. As a distributed machine learning paradigm, federated learning (FL) [McMahan et al., 2016; Truong et al., 2021; Zhong et al., 2022; Qi et al., 2024; Zhong et al., 2025a; Fu et al., 2025b; Jiang et al., 2026] has gained significant attention in privacy-sensitive scenarios recently because it eliminates the need for centralizing raw data during training. However, during the training process, the global model internalizes client information into its parameters through multiple rounds of parameter aggregation, which exposes novel privacy risks when the model is confronted with legal mandates such as the right to be forgotten under GDPR [de la Torre, 2018]. To address this, researchers have focused on Federated Unlearning (FU), aiming to remove specific knowledge ∗
Corresponding Author
Time/s Acc Pre-unlearning 320 0.8 Unlearning 240 0.6 160 0.4 80 0.2 0 T s 0 0.0 T s -T 0 -T 0 0 MNIASG NeCwIFACRIF1ARC1I0FAR10 MNIASG NCeIFwAR1C0IFACRI1FAR10 (a) Non-target knowledge loss of (b) Unlearning request latency of server-side FU method. client-side FU method. Figure 1: FedEraser, a representative server-side method, shows noticeable non-target knowledge loss after unlearning across multiple tasks. Client-side methods like FUSED experience significantly longer convergence times as task difficulty increases, with responses up to 5 minutes indicating severe unlearning request latency.
without retraining the global model from scratch. Existing FU methods generally follow two main technical paradigms: server-side FU methods [Wu et al., 2022; Huynh et al., 2025; Pan et al., 2025], which implement approximate unlearning [Yang et al., 2025] on the global model at the server side; and client-side FU methods [Wang et al., 2023b; Liu et al., 2022; Zhu et al., 2023; Zhong et al., 2025b], which achieve exact unlearning [Kuo et al., 2025] through iterative client-side model retraining procedures. Existing Challenges. While current Federated Unlearning (FU) methods facilitate knowledge removal to various extents, challenges regarding non-target knowledge loss and unlearning request latency still remain. As depicted in Figure 1, server-side FU methods lack precise control over the unlearning scope, frequently incurring non-target knowledge loss, where the model performance unrelated to the unlearning request is inevitably impaired during knowledge removal. Conversely, although client-side FU methods achieve exact unlearning via retraining-based approaches, they are heavily constrained by multi-round training and communication, leading to high request latency. To date, it is hard to find a solution that simultaneously ensures rapid response and prevents non-target knowledge loss. Moreover, both server-side and client-side FU paradigms typically rely on direct modification of original model parameters, which leads to the irreversibility of unlearning. Once the unlearning process is
finalized, restoring previously removed knowledge necessitates further parameter tuning or retraining, thereby imposing complexity and additional overhead on practical deployment. Proposed Solution. To this end, we propose FedUP, a oneshot federated unlearning framework based on lightweight pluggable filters. In terms of mitigating non-target knowledge loss, the framework avoids performing direct, large-scale parameter updates on the global model; instead, it implements unlearning by introducing independent pluggable filters while keeping original model parameters frozen (shown in Figure 2). These filters serve as a “knowledge funnel” that screens out target knowledge and permits only non-target knowledge to pass, thereby reducing the interference of unlearning on non-target knowledge. To lower unlearning request latency, FedUP only needs to perform a few rounds of fine-tuning on the lightweight filters at the server side using differential privacy (DP)-protected class centroid samples to complete the unlearning task. This bypasses multi-round retraining and frequent communication with clients, significantly accelerating the response speed. Moreover, since the filters are pluggable, the framework inherently supports reversibility. As depicted in Figure 2, when restoration of forgotten knowledge is required, it can be achieved simply by removing the filters. Overall, FedUP provides a solution that balances precision, efficiency, and recoverability.
Figure 2: Lightweight plug-in filters.
Contributions. The main contributions are as follows: • We design FedUP, a one-shot FU framework utilizing DP-protected class centroids, mitigating non-target knowledge loss and reducing unlearning request latency from minutes to seconds. • We propose a reversible unlearning mechanism via lightweight pluggable filters without altering original model parameters while ensuring rapid transitions between unlearned and pre-unlearning states. • We conduct differential privacy analysis showing that appropriate noise protects class centroid samples while minimally impacting data utility. Extensive experiments on image and text tasks confirm FedUP’s effectiveness across various scenarios.
2
Related Work
Machine Unlearning. Simply removing training data from storage fails to purge its influence on deployed models. Machine Unlearning (MU) [Ma et al., 2022] is thus introduced to erase such learned knowledge. Existing methods are categorized as either exact [Cao et al., 2018] or approximate unlearning [Golatkar et al., 2020]. Exact unlearning mandates that the post-forgetting model be statistically indistinguishable from one retrained from scratch without the deleted data. It retains the guarantees of complete retraining but lowers its cost via algorithmic shortcuts. For classical models, the training process can be expressed in an invertible additive form, enabling point removal by subtracting its closed-form term [Cao et al., 2018]. For complex architectures, exact unlearning employs data sharding [Bourtoule et al., 2021], localized retraining [Chen et al., 2022], or intermediate checkpointing [Wang et al., 2023a] to reduce computation while preserving retraining-level guarantees. Approximate unlearning, in contrast, substitutes full retraining with lightweight fine-tuning, permitting a bounded, residual influence from the deleted data. Related work is typically grouped into data-driven and model-driven approaches [Nguyen et al., 2025]. Data-driven methods involve relabeling retained samples [Graves et al., 2021] or partitioning data shards [Gupta et al., 2021] before fine-tuning. Model-driven approaches adjust parameters directly via influence functions [Guo et al., 2019], fisher-based regularization [Golatkar et al., 2020], or knowledge distillation [Kurmanji et al., 2023], countering the gradient contributions of the data to be erased. Federated Unlearning. Though federated learning maintains client privacy through local retention, knowledge from distributed datasets persists in the aggregated global model. This requires integrating MU techniques into FL, named federated unlearning (FU) [Wang et al., 2022]. Based on the execution location, FU methods can be categorized into serverside and client-side methods [Liu et al., 2024; Li et al., 2025]. Server-side methods are intrinsically based on approximate unlearning to expunge client contributions without client involvement. FedEraser [Liu et al., 2021] calibrates update trajectories but still requires auxiliary retraining. Conversely, Wu et al. [Wu et al., 2022] bypass client-side computation by subtracting historical updates and employing knowledge distillation. To optimize efficiency, Huynh et al. [Huynh et al., 2025] utilize selective retention of influential updates to reduce memory overhead, while Pan et al. [Pan et al., 2025] resolve parameter conflicts via Orthogonal Steepest Descent to accelerate the unlearning process. Client-side FU methods perform unlearning locally, striving to achieve exact unlearning while balancing computational efficiency with global model utility. Mora et al. [Mora et al., 2024] propose FedUNRAN, utilizing local random label perturbations to disperse target gradients and attenuate their influence without server-side intervention. Wang et al. [Wang et al., 2023b] employ variational Bayesian inference for parameter selfsharing to erase target data while preserving performance. To accelerate unlearning, Liu et al. [Liu et al., 2022] approximate the Hessian via a diagonal empirical Fisher Information Matrix for quasi-Newton optimization, while Zhu et al. [Zhu
et al., 2023] combine inverse perturbation with passive decay, propagating updates via knowledge distillation. Furthermore, Deng et al. [Deng et al., 2024] introduce model contrastive unlearning (MCU) to regularize the feature space. Zhong et al. [Zhong et al., 2025b] implement reversible unlearning through local fine-tuning. In summary, existing unlearning approaches typically involve trade-offs between unlearning precision and computational efficiency, and often suffer from limited generalization. Moreover, reversibility is rarely considered in current studies. Achieving a unified balance among unlearning precision, efficiency, and reversibility therefore remains an open challenge.
3
Methodology
3.1
Problem Description
In the FL framework, a set of clients denoted as C = {C1 , C2 , . . . , CN } collaboratively train a global model MG without sharing local data. Each client Cn trains a local model Mn using its local dataset Dn and uploads the model parameters to a server. The server aggregates these local models via weighted averaging based on dataset sizes to obtain a global model MG . This process iterates over W global rounds, where each global round comprises e local training epochs on the clients with a local learning rate lc . MG is structurally decomposed into a feature extractor ME and a classifier Mcl . After aggregation, MG is distributed back to all clients, where the feature extractor ME is leveraged to extract features from local data. Additionally, a pluggable filter MF i is constructed to implement the filtering of knowledge that needs to be forgotten. The overall dataset is denoted as D = {Dn }N n=1 , where Dn represents the local dataset of client CnP . The total data volume across the federation is N ∥D∥ = n=1 ∥Dn ∥. To facilitate data management, particularly for future unlearning operations, each local dataset Dn is partitioned into two disjoint subsets: a retained subset DnR for model training, and an unlearning subset DnU designated to be removed in compliance with privacy or regulatory constraints. Let k ∈ {1, 2, . . . , K} index the data categories, where K is the total number of classes. In the FL phase, the training objective is defined as: min F (θMG ) =
θMG
N X |Dn | n=1
|D|
X
L f (xki ; θMG ), yik ,
k (xk i ,yi )∈Dn
(1) where L denotes the loss function. During the FU phase, the objective is to maximize the loss on the unlearning set, minimize the loss on the retained set, and keep the training cost low, described as: R
min F (θM′G ) =
θM′
G
N X |DR | n=1
n |DR |
X
k
L f (xki ; θM′G ), yi
,
k R (xk i ,yi )∈Dn
(2) max F U (θM′G ) = θM′
G
N X |DU | n=1
n |DU |
X
T
min F (θ
M′G
)=
(3)
Comm(w) (MG , C ,
(4)
w=1
where Comm represents the communication resource between the server and the clients C during each round.
3.2
Method Overview
As shown in Figure 3, our method comprises four phases: federated learning, generation of class centroid samples, oneshot federated unlearning, and inference, with each stage’s main procedures and key formulas shown in the diagram.
Figure 3: FedUP follows a structured workflow: it begins with federated learning to obtain a global model. Upon request, clients produce differentially-private class centroid samples from retained data and upload them for server aggregation. The server then fine-tunes a pluggable filter, blocking forgotten knowledge without modifying the base model.
Feature Extraction Each client Cn performs e rounds of training on its local dataset Dn , resulting in an updated local model Mw,e n . The local training process can be expressed as: w,e w,e−1 θM = θM − lc · ∇θ L(Mw,e−1 , Dn ), n n n
(5)
where L represents the local loss function and ∇θ L denotes its gradient with respect to the model parameters.Subsequently, the server collects the local models Mw,e n from selected clients Cn and updates the global model through a weighted average:
L f (xki ; θM′G ), yik ,
k U (xk i ,yi )∈Dn
W X
w+1 θM = G
N X |Dn | w,e θ . |D| Mn n=1
(6)
The trained global model MG is regarded as a combination of a feature extractor ME and a classifier Mcl . After freezing this composite model, it is deployed to the clients. The features of all data Dn from each client Cn are extracted by the feature extractor ME , which can be represented as follows: Vnk = ME (xki ) | xki ∈ Dnk , (7) where Vnk denotes the feature embedding of the data belonging to class k on client Cn . Generation of Class Centroid Samples Upon receiving an unlearning request, client Cn removes the features associated with the unlearning data. The remaining feature embeddings belonging to class k are denoted as: VnR,k = Vnk \ ME (xi ) | xi ∈ DnU,k . (8) To reduce communication cost, the retained features are compressed via KMeans clustering with Kn,k = ⌈ρ |VnR,k |⌉,
(9)
the number of clusters is set proportionally according to the scenario by ρ, yielding a compact set of centroids: µR,k = KMeans(VnR,k , Kn,k ). n
(10)
For privacy preservation, add noise to each centroid: 2 (11) µ̃R,k = µ + z µ ∈ µR,k n , z ∼ N (0, σ I) . n Here, N (0, σ 2 I) represents a multivariate Gaussian distribudoes tion. These mechanisms ensure that the release of µ̃R,k n not reveal excessive information about any individual data point. Client Cn then uploads all perturbed class centroids µ̃R,k to the server. Using the local class centroids µ̃R,k n n , the server aggregates them to generate the global class centroids µ̃R,k G . The global class centroid is denoted as: h i R,k R,k R,k µ̃R,k = µ̃ ; µ̃ ; . . . ; µ̃ . (12) 1 2 G N One-shot Federated Unlearning The objective of the FU phase is to train the filter MF i such that it effectively blocks the flow of unlearning knowledge while allowing the retained learning knowledge to pass. The specific steps and formulas are as follows. A filter MF i is inserted into the global model MG = ME ⊕ Mcl , yielding a new model structure: M′G = ME ⊕ MF i ⊕ Mcl .
(13)
Subsequently, the parameters of the global model MG including both ME and Mcl are frozen: ∗ θMG = θM . G
(14)
The filter MF i is trained using the global class centroids R,k µ̃G . The filtered class centroid prediction is defined as: {yˆk } = {Mcl (MFi (µ̃)) | µ̃ ∈ µ̃R,k G , k ∈ KR }.
(15)
We propose a composite loss function for the filter consisting of cross-entropy and reconstruction losses. It preserves
discriminative capability on non-target knowledge while enforcing structural consistency in the feature space, thereby improving the stability of the unlearning process without compromising knowledge selectivity. The cross-entropy loss, measuring the difference between predicted class probabilities and true labels, is defined as: X LCE = − yk log(ŷk ), (16) k
where yk represents the true label while ŷk denotes the corresponding predicted probability for class k. The reconstruction loss, which measures how well the filter reconstructs its input, is defined as: d
LRE =
1X |µ̃ − MF i (µ̃)|2 , d i=1
(17)
where d is the input and output dimensionality of the filter. The total loss function used to train the filter MF i is a weighted sum of these two losses: Ltotal = αLCE + (1 − α)LRE ,
(18)
where α is a weighting factor that balances the importance of the cross-entropy loss and the reconstruction loss. Train the filter for Wa rounds with a learning rate la . The update process is as follows: R,k w−1 w−1 w θM = θM −l ·∇ L θ ; µ̃ w = 1, . . . , Wa . a θ total M G Fi Fi Fi (19) When a client requests the restoration of forgotten knowledge, the filter MF i can be removed, thereby reverting to the original global model MG : MG = ME ⊕ Mcl .
(20)
Differential Privacy Guarantee Our framework injects Gaussian noise for privacy guarantee during client-side centroid uploads, satisfying (ε, δ)-DP. The key is to calibrate the noise scale σ according to the desired privacy budget and the ℓ2 -sensitivity, which is bounded by: (i)
∆2 fi = max p,q
Noise Dataset MNIST CIFAR-10 AG News CIFAR-100
0.001 11.09 16.73 12.27 141.40
(i)
∥dp − dq ∥2 . ni
0.005 2.22 3.35 2.45 28.28
σ 0.01 1.11 1.67 1.23 14.14
(21)
0.05 0.22 0.33 0.25 2.83
0.1 0.11 0.17 0.12 1.41
Table 1: Average privacy budget for different datasets.
√ 2 ln(1.25/δi )·∆2 fi We set σ ≥ with δi = 1/ni . Empirical εi εi values (Table 1) confirm moderate privacy budgets ε ≈ 10 [Wei et al., 2020] for all datasets under specified σ. We calculate our differentially private guarantee as:
Algorithm 1: FedUP Input: Number of global rounds W , local rounds e, local learning rate lc , adapter learning rate la , clients C = {C1 , C2 , . . . , CN }, dataset D = {Dn }N n=1 Output: Filter MF i / * Feature extraction * / MG = ME ⊕ Mcl for global round w = 1 to W do Server sends Mw G to all clients Cn for each client Cn do Cn performs e local training rounds: w,e w θM = θM − lc · ∇θ L(Mn , Dnk ) n n P N w+1 n | w,e θM = n=1 |D |D| θMn G / * Generation of class centroid samples * / for each client Cn do Vnk = ME (xki ), xki ∈ Dn k V ′ n = Vnk \ {ME (xki )|xki ∈ DnU } R,k µn = KMeans(VnR,k , Kn,k ) Generate µ̃R,k via Eq. (11) n / * One-shot federated unlearning * / M′G = ME ⊕ MF i ⊕ Mcl ∗ Freeze parameters of MG : θMG = θM G R,k Train filter MF i using µ̃G via Eq. (18) and Eq. (19) / * Restoration * / Remove filter: MF i : MG = ME ⊕ Mcl
4
Experiment
4.1
Experimental Setup
We conducted experiments on diverse datasets, including MNIST[LeCun et al., 2002], CIFAR-10, CIFAR-100 [Krizhevsky et al., 2009], and AG News[Zhang et al., 2015]. We partitioned the dataset using the Dirichlet distribution [Li et al., 2022] with a concentration parameter of 0.5. These experiments use various network architectures, including LeNet-5, ResNet-18 [He et al., 2016], ResNet-34, Transformer [Vaswani et al., 2017] and TinyBert[Jiao et al., 2020], covering three unlearning scenarios: client unlearning, class unlearning and sample unlearning. We evaluated five baselines: EraseClient [Halimi et al., 2022], Federaser [Liu et al., 2021], Exact-Fun [Xiong et al., 2023], Retrain and FUSED [Zhong et al., 2025b]. The experimental framework is implemented using PyTorch 2.3.1 and CUDA 12.1. For hardware acceleration, an NVIDIA RTX 3080 Ti GPU is utilized. We employ SGD and Adam optimizers. The balancing factor α for the loss of filters is set to 0.5. During the generation of sample centroids via clustering, we set different sampling ratios ρ to accommodate various scenarios. In the client, class, and sample scenarios, the sampling ratios are 0.8, 0.1, and 0.5, respectively. Metric R-A(%)↑ F-A(%)↓ 0A(%)↑ PS(%)↑
p
2 ln(1.25ni ) · ∆2 fi . (22) σ The final choice of the optimal σ is determined via σ = q · s, with the corresponding values of q and s established accordingly. Detailed analysis and supporting experiments are relegated to Section 2.1 and 2.2 of the supplementary material.
MIA(%)↓
εi =
3.3
Algorithm
The algorithm, as illustrated in Algorithm 1, consists of three stages: feature extraction, generation of class centroid samples µR,k and one-shot federated unlearning. Upon receivn ing an unlearning request, each client first removes the corresponding data points from its local feature set and computes class centroid samples using the retained data. These centroids are then protected by a differential privacy mechanism and uploaded to the server. The server aggregates the uploaded centroids from all clients to obtain global retained class centroids as µ̃R,k G . Then the server freezes the parameters of the original global model MG and randomly initializes a lightweight, pluggable filter MF i , which is trained solely using the global differentially private centroids. By jointly optimizing a cross-entropy loss and a reconstruction loss Ltotal , the filter blocks the propagation of forgotten knowledge while preserving the discriminative capability of retained knowledge. Finally, when restoration of forgotten knowledge is required, the filter can be removed to revert to the original global model structure, enabling efficient and reversible federated unlearning.
Time(s)↓ Comm(MB)↓
Description Accuracy of retained knowledge. Accuracy of unlearning knowledge. Accuracy of class 0. Prediction precision of class 0. Post-unlearning privacy risk quantified via membership inference attacks. Time required to achieve the desired effect. Communication resource consumption between client and server.
Table 2: Evaluation metrics of FU.
Evaluation Metrics. As shown in Table 2, we evaluate our proposed method and the baselines using multiple metrics.
4.2
Experimental Results
Main Results. In the client unlearning setting, Byzantine attacks are introduced, where label flipping is applied to construct inverse feature prototypes [Fu et al., 2025a; Qi et al., 2023]. Class unlearning randomly remaps the feature labels of the target class to several classes. Sample unlearning is implemented via backdoor attacks: fixed triggers are injected into the bottom-right pixels of images or appended as specific trigger tokens to the end of text sequences. During the unlearning process, all triggered samples are consistently predicted as class 0, thereby yielding accuracy of class 0 (0A) on the forgotten samples. As shown in Table 3, our method achieves superior performance across a wide range of datasets, model architectures, and unlearning scenarios. Among them, CIFAR-100 is the most challenging benchmark, while MNIST is the least. Benefiting from the pluggable filters, FedUP reduces the accuracy on the unlearning knowledge to a minimal level (F-A) while
Scenarios Dataset MNISTLeNet5 CIFAR10ResNet18 CIFAR10Transformer AG NewsTinyBert CIFAR100ResNet34
R-A F-A MIA R-A F-A MIA R-A F-A MIA R-A F-A MIA R-A F-A MIA
E-C 0.99 0.00 0.80 0.57 0.04 0.67 0.48 0.05 0.54 0.89 0.03 0.63 0.13 0.01 0.32
Federaser 0.97 0.00 0.60 0.46 0.08 0.70 0.51 0.05 0.35 0.88 0.05 0.63 0.15 0.01 0.49
Client Unlearning E-F FUSED Retrain 0.97 0.99 0.99 0.00 0.00 0.00 0.76 0.69 0.67 0.56 0.56 0.58 0.04 0.05 0.03 0.62 0.68 0.57 0.50 0.49 0.52 0.05 0.05 0.04 0.59 0.56 0.64 0.88 0.89 0.89 0.04 0.04 0.03 0.79 0.68 0.68 0.27 0.26 0.27 0.01 0.01 0.01 0.43 0.40 0.26
FedUP 0.99 0.00 0.70 0.57 0.03 0.63 0.52 0.04 0.52 0.89 0.05 0.77 0.26 0.02 0.69
Class Unlearning FUSED Retrain FedUP 0.97 0.99 1.00 0.00 0.00 0.00 0.99 0.97 0.99 0.71 0.72 0.71 0.00 0.00 0.00 0.81 0.63 0.78 0.59 0.60 0.59 0.00 0.00 0.00 0.81 0.78 0.90 0.89 0.93 0.93 0.00 0.00 0.00 0.44 0.63 0.50 0.36 0.37 0.37 0.00 0.00 0.00 0.91 0.38 0.67
0A PS MIA 0A PS MIA 0A PS MIA 0A PS MIA 0A PS MIA
Sample Unlearning FUSED Retrain FedUP 0.95 1.00 0.95 1.00 1.00 1.00 0.96 0.68 0.97 0.60 0.73 0.70 0.52 0.60 0.53 0.95 0.98 0.96 0.35 0.64 0.57 0.50 0.63 0.52 0.96 0.91 0.76 0.92 0.93 0.93 0.87 0.89 0.88 0.77 0.54 0.70 0.50 0.57 0.55 0.55 0.56 0.54 0.98 0.98 0.99
Table 3: Main results. Our method achieves the best or near-best R-A in most settings while maintaining low F-A, and it performs particularly well in the class unlearning scenario, indicating that it maximizes model utility while ensuring effective unlearning.
maintaining high accuracy on the retained data (R-A). Owing to its centroid-based unlearning mechanism, FedUP exhibits particularly strong performance in class unlearning scenarios. Overall, the proposed method supports single-round communication and reversible unlearning, achieving the desirable triad of high retention accuracy, low forgetting accuracy, and privacy guarantees across all evaluated datasets. Analysis of Non-target Knowledge Loss. To validate the effectiveness of our method in mitigating non-target knowledge loss, we compare the accuracy on retained knowledge before and after executing the unlearning operation. As shown in Figure 4, FedUP achieves an effect comparable to the Retrain method, characterized by minimal non-target knowledge loss and stable model performance before and after the unlearning operation.
Pre-unlearning Unlearning
Acc 0.6 0.5
the wireless resources consumed for transmitting model parameters or gradients between local clients and the central server. As shown in Table 4, although the centroid uploading phase introduces additional communication overhead, FedUP requires only a single communication round, meaning its communication cost does not accumulate with rounds. In contrast, model transmission methods gradually converge as rounds increase, causing the communication overhead to escalate to the order of 103 . Specifically, the lightweight filter incurs an overhead of merely 11.50MB for image unlearning, approximately one-third of that of the second-best method and 6.73MB for text unlearning, which is second only to the FUSED method. Methods Dataset E-C Federaser E-F FUSED Retrain FedUP
CIFAR10 Time Comm 1627.76 1110.98 1586.59 2820.18 898.70 1452.82 151.21 31.36 935.54 1538.25 6.33 11.50
AG News Time Comm 567.56 268.64 634.67 738.76 629.83 369.38 88.31 0.55 859.28 537.28 6.45 6.73
Table 4: Comparing time and communication costs.
0.4
E-C
Federaser
E-F
Retrain
FUSED
FedUP
Figure 4: Non-target knowledge loss of methods.
Unlearning Response Time. As shown in Table 4, when achieving the desired forgetting effect, our method requires only 6.33 seconds for image unlearning and 6.45 seconds for text unlearning, which is less than 10% of the latency of the second-best method and less than 1% of that of the Retrain approach. It can promptly respond to diverse unlearning requests across different modalities while maintaining consistently low latency, effectively minimizing processing delays. Communication Cost. Communication cost is defined as
4.3
Analysis of Hyper-parameters
Bottleneck Dimension. In this section, we analyse the dimension of the filter. The pluggable filter adopts a straightforward encoder-decoder architecture. Its input dimension is configured to match the output dimension of the feature extractor. Our empirical investigation focuses on determining the optimal bottleneck dimension within this encoderdecoder structure. As shown in Table 5, the remember accuracy consistently reaches its optimum across both image and text datasets when the bottleneck dimension is set to 32. Sensitivity Analysis of the Loss Function. The filter is
Ours (R-A) RE (R-A) CE (R-A) Ours (F-A) RE (F-A) CE (F-A) Acc Acc Acc Acc Acc 0.8 0.8 0.8 0.6 0.6 0.4 0.6 0.6 0.4 0.4 0.4 0.4 --MNIST---AG News-- 0.2 --CIFAR10-- 0.2 --CIFAR10-T-- 0.2 --CIFAR100-0.2 0.2 0.0 0.0 0.0 0.0 0.0 0 10 20 30 40Epoch 0 10 20 30 40Epoch 0 10 20 30 40Epoch 0 10 20 30 40Epoch 0 10 20 30 40Epoch Figure 5: Ablation of loss functions. Dimension 4 8 16 32 64 Dataset R-A M R-A M R-A M R-A M R-A M MNIST CIFAR10 CIFAR10-T AG News CIFAR100
0.98 0.55 0.43 0.89 0.06
16 16 16 4 16
0.99 0.58 0.47 0.90 0.18
32 32 32 8 32
0.99 0.58 0.46 0.90 0.24
64 64 64 16 64
0.99 128 0.60 128 0.51 128 0.91 32 0.25 128
Dataset Metrics R-A F-A MIA
0.99 256 0.59 256 0.46 256 0.90 64 0.23 256
α-CE metric MNIST CIFAR10 CIFAR10-T AG News CIFAR100
0.10 R-A F-A 0.99 0.67 0.70 0.00 0.51 0.22 0.92 0.00 0.35 0.11
0.30 R-A F-A 1.00 0.00 0.68 0.00 0.56 0.00 0.93 0.00 0.37 0.00
0.50 R-A F-A 0.99 0.00 0.71 0.00 0.59 0.00 0.93 0.00 0.37 0.00
0.70 R-A F-A 0.99 0.00 0.68 0.00 0.51 0.00 0.92 0.00 0.31 0.00
0.90 R-A F-A 0.99 0.00 0.64 0.00 0.45 0.00 0.87 0.00 0.30 0.00
Table 6: Impact of α-CE on R-A and F-A. The filter shows optimal and well-balenced performance at α = 0.5.
4.4
Ablation Study
Analysis of Differential Privacy Effects. To ensure privacy preservation, Gaussian noise is injected into the generated class centroids. We conducted ablation studies to evaluate its impact, as shown in Table 7. The results demonstrate that an appropriately calibrated noise scale does not significantly impede the model’s performance on non-target knowledge. Instead, it enhances model robustness, achieving a synergistic improvement in both privacy protection and model utility. Effectiveness of Class Centroid Samples. Class centroids are obtained by clustering original features and privately aggregated on the server side. To validate the effectiveness of class centroid samples, we additionally conduct experiments in which the filter is trained using only the original features. As illustrated in Table 8, the model trained on class centroid samples achieves comparable performance on the accuracy of
AG News DP w/o DP 0.9132 0.9114 0.0490 0.0303 0.5654 0.6196
Table 7: Differential privacy effects.
Table 5: Exploration of filter. “M” stands for memory (KB).
trained with joint reconstruction and cross-entropy losses. We performed a sensitivity analysis on α of Ltotal to determine its optimal value. As shown in Figure 5, using either loss alone hinders convergence and degrades the accuracy of retained knowledge, whereas their combination maximizes the reduction of non-target knowledge loss. This is further illustrated in Table 6, which shows that increasing the weight of the cross-entropy loss lowers the recognition accuracy on retained data, while assigning a higher weight to the reconstruction loss deteriorates the unlearning effectiveness.
CIFAR10 DP w/o DP 0.5814 0.5833 0.0438 0.0460 0.5239 0.6373
Acc Dataset MNIST CIFAR10 CIFAR10-T AG News CIFAR100
Feature 0.9900 0.6011 0.5264 0.9153 0.2537
R-A Centroid 0.9921 0.6020 0.5671 0.9118 0.2508
Feature 0.0001 0.0498 0.0632 0.0331 0.0076
F-A Centroid 0.0005 0.0331 0.0490 0.0482 0.0172
Table 8: Ablation of class centroid samples.
retained and unlearning knowledge to that trained on the original features, demonstrating that class centroid samples are as effective as the original features.
5
Conclusion and Discussion
Conclusion. In the field of FU, server-side methods face non-target knowledge loss, whereas client-side methods incur high request latency. Both are limited by the irreversibility of the unlearning operation. To address these issues, this paper proposes a one-shot federated unlearning framework. By employing differentially private class centroid samples on the server, our approach achieves approximate unlearning that surpasses exact unlearning in effect, reducing non-target knowledge loss and high resource overhead. Through finetuning a lightweight plug-in filter in a single round, the desired unlearning effect is achieved, significantly reducing the latency of unlearning responses. Removing the filter allows the model to revert to its pre-unlearning state, thus realizing the reversibility of unlearning. Extensive experiments across diverse datasets, scenarios, and models demonstrate that FedUP demonstrates excellent performance. Discussion. While FedUP advances unlearning efficiency, reversibility, and responsiveness, two fundamental limitations still persist: Class centroid fidelity depends on federated feature extraction. Low-quality global models propagate bias into aggregated class centroids. It is expected that these limitations can be effectively addressed by utilizing more powerful pre-trained backbones for local feature extraction to ensure reliable class centroids.
Contribution Statement Feihong Nan and Zhengyi Zhong contributed equally.
References [Bourtoule et al., 2021] Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE symposium on security and privacy (SP), pages 141–159. IEEE, 2021. [Cao et al., 2018] Yinzhi Cao, Alexander Fangxiao Yu, Andrew Aday, Eric Stahl, Jon Merwine, and Junfeng Yang. Efficient repair of polluted machine learning systems via causal unlearning. In ASIACCS ’18: Proceedings of the 2018 on Asia Conference on Computer and Communications Security, 2018. [Chen et al., 2022] Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. Graph unlearning. In Proceedings of the 2022 ACM SIGSAC conference on computer and communications security, pages 499–513, 2022. [de la Torre, 2018] Lydia de la Torre. A guide to the california consumer privacy act of 2018. SSRN Electronic Journal, Dec 2018. [Deng et al., 2024] Zhipeng Deng, Luyang Luo, and Hao Chen. Enable the right to be forgotten with federated client unlearning in medical imaging. In International Conference on Medical Image Computing and ComputerAssisted Intervention, pages 240–250. Springer, 2024. [Fu et al., 2025a] Lele Fu, Sheng Huang, Yanyi Lai, Chuanfu Zhang, Hong-Ning Dai, Zibin Zheng, and Chuan Chen. Federated domain-independent prototype learning with alignments of representation and parameter spaces for feature shift. IEEE Transactions on Mobile Computing, 2025. [Fu et al., 2025b] Lele Fu, Sheng Huang, Yuecheng Li, Chuan Chen, Chuanfu Zhang, and Zibin Zheng. Learn the global prompt in the low-rank tensor space for heterogeneous federated learning. Neural Networks, 187:107319, 2025. [Golatkar et al., 2020] Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9304–9312, 2020. [Graves et al., 2021] Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 11516–11524, 2021. [Guo et al., 2019] Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. arXiv preprint arXiv:1911.03030, 2019. [Gupta et al., 2021] Varun Gupta, Christopher Jung, Seth Neel, Aaron Roth, Saeed Sharifi-Malvajerdi, and Chris Waites. Adaptive machine unlearning. Advances in Neural Information Processing Systems, 34:16319–16330, 2021.
[Halimi et al., 2022] Anisa Halimi, Swanand Kadhe, Ambrish Rawat, and Nathalie Baracaldo. Federated unlearning: How to efficiently erase a client in fl? Jul 2022. [He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. [Huynh et al., 2025] Thanh Trung Huynh, Trong Bang Nguyen, Thanh Toan Nguyen, Phi Le Nguyen, Hongzhi Yin, Quoc Viet Hung Nguyen, and Thanh Tam Nguyen. Certified unlearning for federated recommendation. ACM Transactions on Information Systems, 43(2):1–29, 2025. [Jiang et al., 2026] Wenzheng Jiang, Ke Liang, Wenke Huang, Xiongtao Zhang, Zhenxing Xu, Guancheng Wan, Cheston Tan, Flint Xiaofeng Fan, and Ji Wang. Unveiling and mitigating untargeted poisoning attacks on federated knowledge graph embedding. In Proceedings of the ACM Web Conference 2026, pages 2569–2580, 2026. [Jiao et al., 2020] Xiaoqi Jiao, Yichun Yin, Lifeng Shang, Xin Jiang, Xiao Chen, Linlin Li, Fang Wang, and Qun Liu. Tinybert: Distilling bert for natural language understanding. In Findings of the association for computational linguistics: EMNLP 2020, pages 4163–4174, 2020. [Krizhevsky et al., 2009] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. [Kuo et al., 2025] Kevin Kuo, Amrith Setlur, Kartik Srinivas, Aditi Raghunathan, and Virginia Smith. Exact unlearning of finetuning data via model merging at scale. arXiv preprint arXiv:2504.04626, 2025. [Kurmanji et al., 2023] Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. Advances in neural information processing systems, 36:1957–1987, 2023. [LeCun et al., 2002] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 2002. [Li et al., 2022] Qinbin Li, Yiqun Diao, Quan Chen, and Bingsheng He. Federated learning on non-iid data silos: An experimental study. In 2022 IEEE 38th international conference on data engineering (ICDE), pages 965–978. IEEE, 2022. [Li et al., 2025] Na Li, Chunyi Zhou, Yansong Gao, Hui Chen, Zhi Zhang, Boyu Kuang, and Anmin Fu. Machine unlearning: Taxonomy, metrics, applications, challenges, and prospects. IEEE Transactions on Neural Networks and Learning Systems, 2025. [Liu et al., 2021] Gaoyang Liu, Xiaoqiang Ma, Yang Yang, Chen Wang, and Jiangchuan Liu. Federaser: Enabling efficient client-level data removal from federated learning models. In 2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS), pages 1–10. IEEE, 2021.
[Liu et al., 2022] Yi Liu, Lei Xu, Xingliang Yuan, Cong Wang, and Bo Li. The right to be forgotten in federated learning: An efficient realization with rapid retraining. In IEEE INFOCOM 2022-IEEE conference on computer communications, pages 1749–1758. IEEE, 2022. [Liu et al., 2024] Ziyao Liu, Yu Jiang, Jiyuan Shen, Minyi Peng, Kwok-Yan Lam, Xingliang Yuan, and Xiaoning Liu. A survey on federated unlearning: Challenges, methods, and future directions. ACM Computing Surveys, 57(1):1– 38, 2024. [Ma et al., 2022] Zhuo Ma, Yang Liu, Ximeng Liu, Jian Liu, Jianfeng Ma, and Kui Ren. Learn to forget: Machine unlearning via neuron masking. IEEE Transactions on Dependable and Secure Computing, 20(4):3194–3207, 2022. [McMahan et al., 2016] H.Brendan McMahan, EiderB Moore, Daniel Ramage, Seth Hampson, and BlaiseAgüeray Arcas. Communication-efficient learning of deep networks from decentralized data. arXiv: Learning,arXiv: Learning, Feb 2016. [Mora et al., 2024] Alessio Mora, Luca Dominici, and Paolo Bellavista. Fedunran: On-device federated unlearning via random labels. In 2024 IEEE International Conference on Big Data (BigData), pages 7955–7960. IEEE, 2024. [Nguyen et al., 2025] Thanh Tam Nguyen, Thanh Trung Huynh, Zhao Ren, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. A survey of machine unlearning. ACM Transactions on Intelligent Systems and Technology, 16(5):1–46, 2025. [Pan et al., 2025] Zibin Pan, Zhichao Wang, Chi Li, Kaiyan Zheng, Boqi Wang, Xiaoying Tang, and Junhua Zhao. Federated unlearning with gradient descent and conflict mitigation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 19804–19812, 2025. [Qi et al., 2023] Zhuang Qi, Lei Meng, Zitan Chen, Han Hu, Hui Lin, and Xiangxu Meng. Cross-silo prototypical calibration for federated learning with non-iid data. In Proceedings of the 31st ACM international conference on multimedia, pages 3099–3107, 2023. [Qi et al., 2024] Zhuang Qi, Lei Meng, Weihao He, Ruohan Zhang, Yu Wang, Xin Qi, and Xiangxu Meng. Crosstraining with multi-view knowledge fusion for heterogenous federated learning. arXiv e-prints, pages arXiv–2405, 2024. [Truong et al., 2021] Nguyen Truong, Kai Sun, Siyao Wang, Florian Guitton, and YiKe Guo. Privacy preservation in federated learning: An insightful survey from the gdpr perspective. Computers & Security, 110:102402, 2021. [Vaswani et al., 2017] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017. [Wang et al., 2022] Junxiao Wang, Song Guo, Xin Xie, and Heng Qi. Federated unlearning via class-discriminative pruning. In Proceedings of the ACM web conference 2022, pages 622–632, 2022.
[Wang et al., 2023a] Cheng-Long Wang, Mengdi Huai, and Di Wang. Inductive graph unlearning. In 32nd USENIX Security Symposium (USENIX Security 23), pages 3205– 3222, 2023. [Wang et al., 2023b] Weiqi Wang, Zhiyi Tian, Chenhan Zhang, An Liu, and Shui Yu. Bfu: Bayesian federated unlearning with parameter self-sharing. In Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security, pages 567–578, 2023. [Wei et al., 2020] Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. Federated learning with differential privacy: Algorithms and performance analysis. IEEE transactions on information forensics and security, 15:3454–3469, 2020. [Wu et al., 2022] Chen Wu, Sencun Zhu, and Prasenjit Mitra. Federated unlearning with knowledge distillation. arXiv preprint arXiv:2201.09441, 2022. [Xiong et al., 2023] Zuobin Xiong, Wei Li, Yingshu Li, and Zhipeng Cai. Exact-fun: an exact and efficient federated unlearning approach. In 2023 IEEE International Conference on Data Mining (ICDM), pages 1439–1444. IEEE, 2023. [Yang et al., 2025] Zhe-Rui Yang, Jindong Han, ChangDong Wang, and Hao Liu. Erase then rectify: A trainingfree parameter editing approach for cost-effective graph unlearning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 13044–13051, 2025. [Zhang et al., 2015] Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28, 2015. [Zhong et al., 2022] Zhengyi Zhong, Weidong Bao, Ji Wang, Xiaomin Zhu, and Xiongtao Zhang. Flee: A hierarchical federated learning framework for distributed deep neural network over cloud, edge, and end device. ACM Transactions on Intelligent Systems and Technology (TIST), 13(5):1–24, 2022. [Zhong et al., 2025a] Zhengyi Zhong, Weidong Bao, Ji Wang, Jianguo Chen, Lingjuan Lyu, and Wei Yang Bryan Lim. Sacfl: Self-adaptive federated continual learning for resource-constrained end devices. IEEE Transactions on Neural Networks and Learning Systems, 2025. [Zhong et al., 2025b] Zhengyi Zhong, Weidong Bao, Ji Wang, Shuai Zhang, Jingxuan Zhou, Lingjuan Lyu, and Wei Yang Bryan Lim. Unlearning through knowledge overwriting: Reversible federated unlearning via selective sparse adapter. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 30661–30670, 2025. [Zhu et al., 2023] Xiangrong Zhu, Guangyao Li, and Wei Hu. Heterogeneous federated knowledge graph embedding learning and unlearning. In Proceedings of the ACM web conference 2023, pages 2444–2454, 2023.