Adversarial Update-Based Federated Unlearning for Poisoned Model Recovery

TL;DR

This paper introduces FAUN, a lightweight federated unlearning framework that efficiently removes malicious client updates using adversarial optimization, achieving near retraining-level recovery and significantly reducing attack success.

Contribution

FAUN is a novel, efficient federated unlearning method employing adversarial optimization on a proxy dataset to eliminate malicious updates.

Findings

FAUN achieves recovery comparable to retraining with fewer rounds.

FAUN reduces attack success rates to near zero.

FAUN effectively eliminates malicious client contributions.

Abstract

Federated learning (FL) is vulnerable to poisoning attacks, where malicious clients upload manipulated updates to degrade the performance of the global model. Although detection methods can identify and remove malicious clients, the model remains affected. Retraining from scratch is effective but costly, and existing unlearning methods remain unsatisfactory in both effectiveness and efficiency. We propose Federated Adversarial Unlearning (FAUN), a lightweight framework that retains only a short window of malicious clients' updates and employs adversarial optimization on a proxy dataset to derive updates that eliminate malicious directions. Applying these updates for a few unlearning rounds, followed by benign fine-tuning, enables fast removal of malicious effects and stable recovery. Experiments on three canonical datasets show that FAUN achieves recovery comparable to retraining while requiring far fewer rounds and reduces attack success rates to near zero, confirming FAUN successfully eliminates the contributions of unlearned clients.