Unlearning Clients, Features and Samples in Vertical Federated Learning

TL;DR

This paper introduces novel unlearning methods for vertical federated learning, enabling removal of clients, features, or samples without retraining, using knowledge distillation and gradient ascent, with verified effectiveness through membership inference attacks.

Contribution

The paper proposes VFU-KD and VFU-GA methods for unlearning in VFL, addressing client, feature, and sample removal with no inter-party communication during unlearning.

Findings

VFU-KD and VFU-GA achieve comparable or better performance than retraining.

Unlearning methods require no communication between parties during unlearning.

Experiments show modest utility loss of 1-5% in most cases.

Abstract

Federated Learning (FL) has emerged as a prominent distributed learning paradigm. Within the scope of privacy preservation, information privacy regulations such as GDPR entitle users to request the removal (or unlearning) of their contribution from a service that is hosting the model. For this purpose, a server hosting an ML model must be able to unlearn certain information in cases such as copyright infringement or security issues that can make the model vulnerable or impact the performance of a service based on that model. While most unlearning approaches in FL focus on Horizontal FL (HFL), where clients share the feature space and the global model, Vertical FL (VFL) has received less attention from the research community. VFL involves clients (passive parties) sharing the sample space among them while not having access to the labels. In this paper, we explore unlearning in VFL from three perspectives: unlearning clients, unlearning features, and unlearning samples. To unlearn clients and features we introduce VFU-KD which is based on knowledge distillation (KD) while to unlearn samples, VFU-GA is introduced which is based on gradient ascent. To provide evidence of approximate unlearning, we utilize Membership Inference Attack (MIA) to audit the effectiveness of our unlearning approach. Our experiments across six tabular datasets and two image datasets demonstrate that VFU-KD and VFU-GA achieve performance comparable to or better than both retraining from scratch and the benchmark R2S method in many cases, with improvements of $(0-2\%)$. In the remaining cases, utility scores remain comparable, with a modest utility loss ranging from $1-5\%$. Unlike existing methods, VFU-KD and VFU-GA require no communication between active and passive parties during unlearning. However, they do require the active party to store the previously communicated embeddings.