mlsanityData to 14 Oct 2026

Model Inversion Attack against Federated Unlearning

arXiv 2502.14558 ↗First posted 20 Feb 2025cs.CR cs.AIcited by 2

On the map: LLM safety and security → Federated unlearning and poisoning

Abstract (arXiv)

With the introduction of regulations related to the ``right to be forgotten", federated learning (FL) is facing new privacy compliance challenges. To address these challenges, researchers have proposed federated unlearning (FU). However, existing FU research has primarily focused on improving the efficiency of unlearning, with less attention paid to the potential privacy vulnerabilities inherent in these methods. To address this gap, we draw inspiration from gradient inversion attacks in FL and propose the federated unlearning inversion attack (FUIA). The FUIA is specifically designed for the three types of FU (sample unlearning, client unlearning, and class unlearning), aiming to provide a comprehensive analysis of the privacy leakage risks associated with FU. In FUIA, the server acts as an honest-but-curious attacker, recording and exploiting the model differences before and after unlearning to expose the features and labels of forgotten data. FUIA significantly leaks the privacy of forgotten data and can target all types of FU. This attack contradicts the goal of FU to eliminate specific data influence, instead exploiting its vulnerabilities to recover forgotten data and expose its privacy flaws. Extensive experimental results show that FUIA can effectively reveal the private information of forgotten data. To mitigate this privacy leakage, we also explore two potential defense methods, although these come at the cost of reduced unlearning effectiveness and the usability of the unlearned model.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 29 of its 57 references that are in the map. First posted on arXiv 20 Feb 2025.

Builds on

29 of 57 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025FedMUA: Exploring the Vulnerabilities of Federated Learning to Malicious Unlearning Attacks21 Jan
  2. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directions31 Oct
  3. 2023FRAMU: Attention-based Machine Unlearning using Federated Reinforcement Learning19 Sep
  4. 2022The Right to be Forgotten in Federated Learning: An Efficient Realization with Rapid Retraining14 Mar
  5. 2021Federated Unlearning via Class-Discriminative Pruning22 Oct

Other references · 24

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  4. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  5. 2016Deep Learning with Differential Privacycited by 2,728
  6. 2019Deep Leakage from Gradientscited by 1,021
  7. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  8. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  9. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 326
  10. 2021Unrolling SGD: Understanding Factors Influencing Machine Unlearningcited by 279
  11. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  12. 2022Federated Learning from Pre-Trained Models: A Contrastive Learning Approachcited by 142
12 more
  1. 2020R-GAP: Recursive Gradient Attack on Privacycited by 97
  2. 2019Are All Layers Created Equal?cited by 94
  3. 2020Provable Defense against Privacy Leakage in Federated Learning from Representation Perspectivecited by 94
  4. 2022Where to Begin? On the Impact of Pre-Training and Initialization in Federated Learningcited by 71
  5. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 58
  6. 2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearningcited by 48
  7. 2022Federated Unlearning for On-Device Recommendationcited by 43
  8. 2021Gradient-Leakage Resilient Federated Learningcited by 40
  9. 2022Gradient Obfuscation Gives a False Sense of Security in Federated Learningcited by 39
  10. 2024Machine Unlearning: Taxonomy, Metrics, Applications, Challenges, and Prospectscited by 32
  11. 2021Understanding Training-Data Leakage from Gradients in Neural Networks for Image Classificationcited by 16
  12. 2022FedDef: Defense Against Gradient Leakage in Federated Learning-based Network Intrusion Detection Systemscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Steering the Flow: Inverting Face Recognition Models via Gradient-Guided Flow Matchingcited by 0
  2. 2026Client-Side Probing of Deleted Ridge Statistics in Federated Unlearningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Federated Unlearning: A Survey on Methods, Design Guidelines, and Evaluation Metrics
  2. 2024Privacy-Preserving Federated Unlearning with Certified Client Removal
  3. 2024Efficient Federated Unlearning with Adaptive Differential Privacy Preservation
  4. 2025Label Inference Attacks against Federated Unlearning
  5. 2024Streamlined Federated Unlearning: Unite as One to Be Highly Efficient
  6. 2024Guaranteeing Data Privacy in Federated Unlearning with Dynamic User Participation
  7. 2025Towards Verifiable Federated Unlearning: Framework, Challenges, and The Road Ahead
  8. 2025EFU: Enforcing Federated Unlearning via Functional Encryption