Verifiably Forgotten? Gradient Differences Still Enable Data Reconstruction in Federated Unlearning

TL;DR

This paper reveals a privacy vulnerability in federated unlearning where gradient differences can be exploited to reconstruct forgotten data, and proposes an attack method (IGF) along with a defense mechanism to mitigate this risk.

Contribution

The paper introduces a novel learning-based attack framework (IGF) that effectively reconstructs forgotten data from gradient differences and proposes an orthogonal obfuscation defense to prevent such reconstruction.

Findings

IGF surpasses existing methods in reconstruction fidelity.

The orthogonal obfuscation defense effectively prevents data reconstruction.

Experiments validate the attack's success and the defense's robustness.

Abstract

Federated Unlearning (FU) has emerged as a critical compliance mechanism for data privacy regulations, requiring unlearned clients to provide verifiable Proof of Federated Unlearning (PoFU) to auditors upon data removal requests. However, we uncover a significant privacy vulnerability: when gradient differences are used as PoFU, honest-but-curious auditors may exploit mathematical correlations between gradient differences and forgotten samples to reconstruct the latter. Such reconstruction, if feasible, would face three key challenges: (i) restricted auditor access to client-side data, (ii) limited samples derivable from individual PoFU, and (iii) high-dimensional redundancy in gradient differences. To overcome these challenges, we propose Inverting Gradient difference to Forgotten data (IGF), a novel learning-based reconstruction attack framework that employs Singular Value Decomposition (SVD) for dimensionality reduction and feature extraction. IGF incorporates a tailored pixel-level inversion model optimized via a composite loss that captures both structural and semantic cues. This enables efficient and high-fidelity reconstruction of large-scale samples, surpassing existing methods. To counter this novel attack, we design an orthogonal obfuscation defense that preserves PoFU verification utility while preventing sensitive forgotten data reconstruction. Experiments across multiple datasets validate the effectiveness of the attack and the robustness of the defense. The code is available at https://anonymous.4open.science/r/IGF.