ToFU: Transforming How Federated Learning Systems Forget User Data

Abstract

Neural networks unintentionally memorize training data, creating privacy risks in federated learning (FL) systems, such as inference and reconstruction attacks on sensitive data. To mitigate these risks and to comply with privacy regulations, Federated Unlearning (FU) has been introduced to enable participants in FL systems to remove their data's influence from the global model. However, current FU methods primarily act post-hoc, struggling to efficiently erase information deeply memorized by neural networks.

We argue that effective unlearning necessitates a paradigm shift: designing FL systems inherently amenable to forgetting. To this end, we propose ToFU (Transformation-guided Federated Unlearning), a learning-to-unlearn framework that incorporates transformations during the learning process to reduce memorization of specific instances. Our theoretical analysis reveals how transformation composition provably bounds instance-specific information, directly simplifying subsequent unlearning. Crucially, ToFU can work as a plug-and-play framework that improves the performance of existing FU methods.

Motivation

With regulations like GDPR and CCPA mandating the "right to be forgotten," FL systems must incorporate mechanisms for removing a participant's data influence from the global model. However, current approaches face fundamental challenges:

Theoretical Foundation

Unlearning as Mutual Information Minimization

We formulate the unlearning challenge as an optimization problem: given a trained model $\theta$ and a forget set $D_{forget}$, find $\theta'$ such that mutual information $I(\theta, \theta'; D_{forget})$ is minimized while $I(\theta, \theta'; D_{retain})$ is maximized.

Transformation Composition Theorem

We prove that composing multiple transformations progressively reduces the mutual information between the model and forgetting samples. For any two transformations $\mathcal{T}_1$ and $\mathcal{T}_2$:

$$I(\theta, \mathcal{T}_1 \circ \mathcal{T}_2; D_{forget}) \leq I(\theta, \mathcal{T}_1; D_{forget})$$

This extends to any number of transformations: increasing the intensity level of transformation monotonically improves unlearning performance with respect to the forget set.

ToFU Framework

ToFU integrates three key components into the federated learning process:

Loss Function

The training loss combines a task loss with the transformation-invariant regularizer:

$$\ell(\theta; x, y) = \underbrace{-y\log(p_\theta(x^*))}_{\text{Task loss}} + \gamma \underbrace{D_{KL}(f_\theta(x^*) \parallel f_\theta(x))}_{\text{Transformation-invariant reg.}}$$

where $x^* = \mathcal{T}(x)$ is the transformed sample and $\gamma = 0.01$ controls the regularization strength.

Main Results

Comparison with Federated Unlearning Baselines

Key Advantages

Citation

If you find this work useful in your research, please consider citing:

@inproceedings{tran2025tofu,
  title     = {ToFU: Transforming How Federated Learning
               Systems Forget User Data},
  author    = {Tran, Van-Tuan and Nguyen-Le, Hong-Hanh
               and Pham, Quoc-Viet},
  booktitle = {28th European Conference on Artificial
               Intelligence (ECAI-25)},
  year      = {2025}
}

Acknowledgments

This publication has emanated from research conducted with the financial support of Science Foundation Ireland under Grant number 18/CRT/6183.