[论文解读] VeriFi: Towards Verifiable Federated Unlearning

Xiangshan Gao, Xingjun Ma+6 more|arXiv (Cornell University)|May 25, 2022

Privacy-Preserving Technologies in Data被引用 15

一句话总结

VeriFi 提出了一种统一的可验证联邦遗忘框架，使参与者能够验证其数据是否已从全局模型中有效删除。该框架结合了服务器端遗忘与基于注入标记的客户端验证，证明 uS2U（高效遗忘）与 vEM（非侵入式验证）的结合可在不损害安全性或模型性能的前提下实现强可信遗忘。

ABSTRACT

Federated learning (FL) is a collaborative learning paradigm where participants jointly train a powerful model without sharing their private data. One desirable property for FL is the implementation of the right to be forgotten (RTBF), i.e., a leaving participant has the right to request to delete its private data from the global model. However, unlearning itself may not be enough to implement RTBF unless the unlearning effect can be independently verified, an important aspect that has been overlooked in the current literature. In this paper, we prompt the concept of verifiable federated unlearning, and propose VeriFi, a unified framework integrating federated unlearning and verification that allows systematic analysis of the unlearning and quantification of its effect, with different combinations of multiple unlearning and verification methods. In VeriFi, the leaving participant is granted the right to verify (RTV), that is, the participant notifies the server before leaving, then actively verifies the unlearning effect in the next few communication rounds. The unlearning is done at the server side immediately after receiving the leaving notification, while the verification is done locally by the leaving participant via two steps: marking (injecting carefully-designed markers to fingerprint the leaver) and checking (examining the change of the global model's performance on the markers). Based on VeriFi, we conduct the first systematic and large-scale study for verifiable federated unlearning, considering 7 unlearning methods and 5 verification methods. Particularly, we propose a more efficient and FL-friendly unlearning method, and two more effective and robust non-invasive-verification methods. We extensively evaluate VeriFi on 7 datasets and 4 types of deep learning models. Our analysis establishes important empirical understandings for more trustworthy federated unlearning.

研究动机与目标

• 为解决联邦学习中验证遗忘效果的关键缺口，现有方法缺乏可信度与可审计性。
• 设计一个统一框架，将联邦遗忘与系统性验证相结合，使离开的参与者能够独立验证。
• 开发高效、安全且非侵入式的验证机制，无需白盒访问且不引入安全风险。
• 开展首次在多样化数据集与模型上针对可验证联邦遗忘的大规模实证研究。
• 评估并基准化多种遗忘与验证方法，包括 uS2U 和 vEM 等新方法。

提出的方法

• 该框架引入了‘验证权’（Right to Verify, RTV）机制，离开的参与者向服务器通知后，在后续轮次中本地验证遗忘效果。
• 标记阶段将精心设计的、不可察觉的标记（如后门触发器）注入离开参与者的数据中，以指纹化其贡献。
• 检查阶段通过监控遗忘后模型在这些标记上的性能变化来量化遗忘效果。
• 遗忘在服务器端通过 uS2U 等方法执行，可高效移除参与者的影响而无需从头开始重新训练。
• 验证采用 vFM 和 vEM 等非侵入式技术，无需外部数据或模型访问，确保安全性和实用性。
• 该框架支持多种遗忘与验证方法的模块化集成，支持系统性比较与基准测试。

Figure 1: Overview of the proposed VeriFi framework and its three key modules: 1) unlearning module; 2) verification module; and 3) unlearning-verification mechanism. The standard “Federated Learning” procedure is further illustrated in Fig. 2 .

实验结果

研究问题

• RQ1 能否以无信任、去中心化的方式，由离开的参与者有效验证联邦遗忘？
• RQ2 不同遗忘方法（如 uS2U、uRT）在移除参与者数据方面的效率与效果如何比较？
• RQ3 标记设计（大小、透明度）对验证可靠性与模型性能有何影响？
• RQ4 联邦学习中活跃参与者的数量如何影响基于标记的验证对遗忘的可检测性？
• RQ5 在非独立同分布（non-i.i.i.d.）数据分布下，验证的鲁棒性如何，尤其是在真实的联邦学习场景中？

主要发现

• uS2U 遗忘方法在时间与存储开销极低的情况下实现高效的数据删除，优于传统的重新训练与基于梯度的方法。
• vEM 验证方法提供了强大且非侵入式的遗忘效果检测，无需白盒访问或外部数据，显著提升了安全性。
• 标记的透明度与大小显著影响验证的可信度；适中参数可在可检测性与不可察觉性之间取得最佳平衡。
• 随着联邦学习中参与者的增加，个体贡献的稀释导致遗忘效果更难检测，验证灵敏度下降。
• 在严格的非独立同分布数据分布下，遗忘验证仍具挑战性，仅 uRT 与 uDP 在离开数据上表现出一致的性能变化。
• uS2U 与 vEM 的结合在可验证联邦遗忘中展现出最令人期待的结果，兼具高效率、高功效与高安全性。

Figure 2: Collaboration and learning in federated learning.