并非所有保留客户端都同等重要：联邦遗忘中的客户端选择

# Not All Retained Clients Are Equal: Client Selection for Federated Unlearning
Source: [https://arxiv.org/html/2610.31786](https://arxiv.org/html/2610.31786)
Quoc\-Viet PhamAffiliation:School of Computer Science and Statistics, Trinity College Dublin, IrelandEmail:[\{tnguyen3,viet\.pham\}@tcd\.ie](mailto:)

###### Abstract

Federated unlearning \(FU\) aims to remove a designated target client’s influence from a trained model without the prohibitive cost of retraining from scratch\. Existing methods largely treat unlearning as a post\-hoc, stateless operation, overlooking that client influence is path\-dependent: contributions made during training, particularly during critical learning periods \(CLPs\), can have disproportionate and persistent effects\. Moreover, knowledge overlap and intermittent client availability make relying on all retained clients inefficient and impractical\. We introducePDF, a path\-dependent client\-selection framework based on the insight that retained clients are not equally valuable for unlearning\. During training,PDFmaintains lightweight, target\-agnostic,CLP\-weighted histories summarizing each client’s accumulated update direction and global\-model alignment\. Upon an unlearning request, these histories identify and rank retained clients that are globally informative yet weakly coupled to the target, enabling retraining\-based unlearning with only the top\-kkclients over a small number of rounds\. Experiments on FMNIST, CIFAR\-10, and CIFAR\-100 under IID and non\-IID settings show thatPDFachieves effective forgetting and strong retained utility with substantially fewer retained clients\. In particular,PDFachieves0%0\\%forgetting accuracy with retraining\-like MIA AUC on non\-IID CIFAR\-10, improves retained accuracy by up to6\.916\.91percentage points over the strongest competing FU baseline on CIFAR\-100, and reduces communication by approximately69%69\\%and computation by5757–61%61\\%relative to Retrain\.

## 1Introduction

As federated learning \(FL\) gains traction in privacy\-sensitive and highly regulated domains \(e\.g\., healthcare\[[29](https://arxiv.org/html/2610.31786#bib.bib38),[11](https://arxiv.org/html/2610.31786#bib.bib37)\]\), deployed systems must accommodate not only privacy\-preserving model training but also the post\-training removal of client data influence–whether to comply with legal obligations, such as the right to be forgotten under the GDPR\[[26](https://arxiv.org/html/2610.31786#bib.bib33)\], or to mitigate impacts of contributions from corrupted, low\-quality, or malicious clients\. These operational and regulatory demands have given rise to*federated unlearning*\(FU\), which aims to eliminate the influence of designated target clients from a trained global model while preserving the knowledge contributed by the remaining clients\.

Existing FU methods, including retraining\-based approaches\[[19](https://arxiv.org/html/2610.31786#bib.bib14),[39](https://arxiv.org/html/2610.31786#bib.bib23),[35](https://arxiv.org/html/2610.31786#bib.bib15)\]and model\-manipulation approaches\[[32](https://arxiv.org/html/2610.31786#bib.bib26),[16](https://arxiv.org/html/2610.31786#bib.bib24),[40](https://arxiv.org/html/2610.31786#bib.bib1),[9](https://arxiv.org/html/2610.31786#bib.bib25),[22](https://arxiv.org/html/2610.31786#bib.bib28),[33](https://arxiv.org/html/2610.31786#bib.bib36)\], face three major limitations in addressing client\-level unlearning\. First, they overlook how client influence develops throughout the training stage\. In FL, client participation and update directions vary across rounds; therefore, a client’s influence on the final model depends not only onwhetherit participates, but also onwhenit participates\. This temporal structure is particularly important during critical learning periods \(CLPs\), in which client updates can have disproportionately persistent effects on the learned representations, optimization trajectory, and final model performance\[[1](https://arxiv.org/html/2610.31786#bib.bib29),[17](https://arxiv.org/html/2610.31786#bib.bib30),[37](https://arxiv.org/html/2610.31786#bib.bib5),[36](https://arxiv.org/html/2610.31786#bib.bib31)\]\. Moreover, under heterogeneous data, changing participation, or adaptive optimization, critical phases may emerge beyond a fixed early\-training window\[[13](https://arxiv.org/html/2610.31786#bib.bib6),[30](https://arxiv.org/html/2610.31786#bib.bib32)\]\. Second, retraining\-based methods incur substantial computation, communication, and storage overhead because they reconstruct or recalibrate the model using all retained clients\. Their effectiveness therefore depends on continuous availability of clients after training, an assumption that may not hold in practical FL systems with intermittent or voluntary participation\. Third, efficient model\-manipulation methods often face a pronounced trade\-off between target forgetting efficacy and retained\-model utility\[[9](https://arxiv.org/html/2610.31786#bib.bib25),[6](https://arxiv.org/html/2610.31786#bib.bib7),[33](https://arxiv.org/html/2610.31786#bib.bib36)\]\. Achieving stronger forgetting may excessively perturb knowledge shared with retained clients, whereas preserving utility may leave residual target influence\. They may also rely on expensive server\-side operations or require future unlearning targets to be anticipated during the original training stage\[[6](https://arxiv.org/html/2610.31786#bib.bib7),[9](https://arxiv.org/html/2610.31786#bib.bib25),[40](https://arxiv.org/html/2610.31786#bib.bib1),[32](https://arxiv.org/html/2610.31786#bib.bib26),[22](https://arxiv.org/html/2610.31786#bib.bib28)\]\.

We argue that these limitations share a common cause: existing FU methods are largely model layer\-, parameter\-, or protocol\-centric and treat unlearning as a stateless operation, overlooking the impacts of heterogeneous influence that clients accumulate over training\. We instead formulate client\-level unlearning as an inherently*path\-dependent*client\-selection problem\. Inspired by path dependence in economics\[[3](https://arxiv.org/html/2610.31786#bib.bib34)\], we posit that a client’s influence is shaped not only by its final contribution, but also by when that influence emerged, particularly duringCLPs, and by how strongly it became coupled with other clients\. Thus, effective unlearning should select retained clients according to their historical alignment with the global model and their dependence on the target clients, rather than uniformly or solely by availability\. Building on this insight, we ask the following question:How can the path\-dependent influence during the learning stage be exploited to improve the forgetting efficacy, retained utility, and efficiency of client\-level FU?

Therefore, we propose aPath\-Dependent client selection framework forFU, namedPDF\. During training,PDFmaintains lightweight, target\-agnostic histories that capture each client’s alignment with the global optimization trajectory, its historical update direction with other clients, and its participation duringCLPs\. Upon an unlearning request, these histories are used to estimate each retained client’s coherence with the target set, and the resulting signals are combined into a unified ranking\. The ranking reflects our central hypothesis:*retained clients are not equally useful for unlearning*\.Clients whose updates consistently supported the global model, particularly during critical rounds, are valuable for preserving retained knowledge, whereas clients strongly coupled with the targets may carry overlapping information that hinders selective forgetting\.PDFtherefore performs retraining\-based unlearning using only the top\-kkclients that are globally informative yet weakly coupled with the target set, reducing participation, communication, and computation while balancing target forgetting and retained\-data generalization\. Our contributions are summarized as follows:

- •We introduce a*path\-dependent perspective*on client\-level FU, showing that retained clients can differ in their value for unlearning because their influence depends on when and how they contributed during training and on their historical dependence on the target clients\.
- •We proposePDF, aCLP\-aware client\-selection framework that maintains lightweight, target\-agnostic training histories and request\-conditioned target coherence to rank retained clients, enabling retraining\-based unlearning with only the top\-kkclients\.
- •Experiments on FMNIST, CIFAR\-10, and CIFAR\-100 across IID and non\-IID settings show thatPDFachieves effective forgetting and strong retained utility while substantially reducing client participation, communication, and computation\. Ablations further validate the proposed ranking andCLP\-aware design\.

## 2Related work

Machine and Federated Unlearning\.Machine unlearning aims to remove the influence of designated training data without full retraining\[[5](https://arxiv.org/html/2610.31786#bib.bib16)\]\. Existing methods modify either the training process or the learned model through data partitioning, parameter transformation, pruning, or cached training states\[[8](https://arxiv.org/html/2610.31786#bib.bib18),[15](https://arxiv.org/html/2610.31786#bib.bib17),[4](https://arxiv.org/html/2610.31786#bib.bib19)\]\. Such methods generally assume access to raw data, intermediate training states, or sufficient retraining budget—assumptions that fail in FL, where the server cannot access local datasets and clients may be intermittently available\[[21](https://arxiv.org/html/2610.31786#bib.bib21)\]\. FU extends this objective to client\-, sample\-, or class\-level removal\[[27](https://arxiv.org/html/2610.31786#bib.bib20),[14](https://arxiv.org/html/2610.31786#bib.bib22)\]\. Client\-level FU removes the entire contribution of designated clients, encompassing potentially many samples and classes whose influence has accumulated across multiple training rounds\. Its methods either approximate retraining from historical updates cached during training\[[19](https://arxiv.org/html/2610.31786#bib.bib14),[39](https://arxiv.org/html/2610.31786#bib.bib23),[35](https://arxiv.org/html/2610.31786#bib.bib15)\], or suppress target influence through parameter, layer, gradient, or representation manipulation\[[6](https://arxiv.org/html/2610.31786#bib.bib7),[16](https://arxiv.org/html/2610.31786#bib.bib24),[9](https://arxiv.org/html/2610.31786#bib.bib25),[22](https://arxiv.org/html/2610.31786#bib.bib28),[25](https://arxiv.org/html/2610.31786#bib.bib27),[33](https://arxiv.org/html/2610.31786#bib.bib36)\]\.

Critical Learning Periods\.CLPsare training intervals during which updates exert disproportionately persistent effects on learned representations and final performance\[[1](https://arxiv.org/html/2610.31786#bib.bib29),[17](https://arxiv.org/html/2610.31786#bib.bib30)\]\. In FL, analogous critical rounds emerge, reflecting the temporally non\-uniform nature of client influence\[[36](https://arxiv.org/html/2610.31786#bib.bib31),[37](https://arxiv.org/html/2610.31786#bib.bib5)\]\. ExistingCLP\-aware methods leverage these dynamics to enhance client participation, improve aggregation strategies, or boost training efficiency\[[37](https://arxiv.org/html/2610.31786#bib.bib5),[13](https://arxiv.org/html/2610.31786#bib.bib6),[30](https://arxiv.org/html/2610.31786#bib.bib32)\]\.

Discussion\.Existing FU methods utilize training artifacts for post\-hoc correction, yet they treat all training rounds and retained clients as equally relevant, overlooking the temporally non\-uniform influence\. Concurrently,CLP\-aware FL methods explicitly model these temporal dynamics, but their focus remains strictly on improving model training, leaving their implications for subsequent influence removal unaddressed\. This raises an underexplored question: can the temporal patterns captured in the training stage serve as a useful signal for identifying which retained clients are most valuable for unlearning?PDFinvestigates this question by incorporatingCLP\-weighted signals into client\-level FU, exploring whether such temporal histories can effectively guide client selection\.

## 3Methodology

### 3\.1System Model

#### Federated setting\.

We consider an FL system comprising a central server andNNclients indexed byℐ=\{1,…,N\}\\mathcal\{I\}=\\\{1,\\ldots,N\\\}\. Eachi∈ℐi\\in\\mathcal\{I\}holds a private dataset𝒟i=\{\(xj\(i\),yj\(i\)\)\}j=1ni\\mathcal\{D\}\_\{i\}=\\\{\(x\_\{j\}^\{\(i\)\},y\_\{j\}^\{\(i\)\}\)\\\}\_\{j=1\}^\{n\_\{i\}\}ofni=\|𝒟i\|n\_\{i\}=\|\\mathcal\{D\}\_\{i\}\|samples, where\(xj\(i\),yj\(i\)\)∈𝒳×𝒴\(x\_\{j\}^\{\(i\)\},y\_\{j\}^\{\(i\)\}\)\\in\\mathcal\{X\}\\times\\mathcal\{Y\}\. Client datasets are record\-disjoint and containn=∑i∈ℐnin=\\sum\_\{i\\in\\mathcal\{I\}\}n\_\{i\}samples in total\. All clients share a common model architecture parameterized by𝒘∈ℝd\\bm\{w\}\\in\\mathbb\{R\}^\{d\}, whereddis the model dimension\. Letℓ⁡\(𝒘,x,y\)∈ℝ≥0\\ell\(\\bm\{w\};x,y\)\\in\\mathbb\{R\}\_\{\\geq 0\}be the sample\-wise loss\. The local empirical objective of clientiiis

Fi​\(𝒘\)=1ni​∑j=1niℓ⁡\(𝒘,xj\(i\),yj\(i\)\)\.F\_\{i\}\(\\bm\{w\}\)=\\frac\{1\}\{n\_\{i\}\}\\sum\_\{j=1\}^\{n\_\{i\}\}\\ell\\\!\\left\(\\bm\{w\};x\_\{j\}^\{\(i\)\},y\_\{j\}^\{\(i\)\}\\right\)\.\(1\)Withπi=ni/n,∑i∈ℐπi=1\\pi\_\{i\}=n\_\{i\}/n,\\sum\_\{i\\in\\mathcal\{I\}\}\\pi\_\{i\}=1, the global empirical objective isF⁡\(𝒘\)=∑i∈ℐπi​Fi​\(𝒘\)F\(\\bm\{w\}\)=\\sum\_\{i\\in\\mathcal\{I\}\}\\pi\_\{i\}F\_\{i\}\(\\bm\{w\}\)\.

#### Federated training\.

Training proceeds forTlearnT\_\{\\mathrm\{learn\}\}communication rounds using FedAvg\[[21](https://arxiv.org/html/2610.31786#bib.bib21)\]\. At roundtt, the server samples a participating subset𝒮\(t\)⊆ℐ\\mathcal\{S\}^\{\(t\)\}\\subseteq\\mathcal\{I\}with\|𝒮\(t\)\|=M≤N\|\\mathcal\{S\}^\{\(t\)\}\|=M\\leq Nuniformly at random without replacement, and broadcasts𝒘\(t−1\)\\bm\{w\}^\{\(t\-1\)\}to𝒮\(t\)\\mathcal\{S\}^\{\(t\)\}\. Participation is recorded byai\(t\)=𝟏\{i∈𝒮\(t\)\}∈\{0,1\}a^\{\(t\)\}\_\{i\}=\\mathbf\{1\}\\\{i\\in\\mathcal\{S\}^\{\(t\)\}\\\}\\in\\\{0,1\\\}\. Eachi∈𝒮\(t\)i\\in\\mathcal\{S\}^\{\(t\)\}performsEElocal gradient steps with local learning rateηℓ,t\>0\\eta\_\{\\ell,t\}\>0:

𝒘i\(t,0\)\\displaystyle\\bm\{w\}\_\{i\}^\{\(t,0\)\}=𝒘\(t−1\),\\displaystyle=\\bm\{w\}^\{\(t\-1\)\},𝒘i\(t,e\)\\displaystyle\\bm\{w\}\_\{i\}^\{\(t,e\)\}=𝒘i\(t,e−1\)−ηℓ,t∇Fi\(𝒘i\(t,e−1\)\),e=1,…,E\.\\displaystyle=\\bm\{w\}\_\{i\}^\{\(t,e\-1\)\}\-\\eta\_\{\\ell,t\}\\nabla F\_\{i\}\\\!\\left\(\\bm\{w\}\_\{i\}^\{\(t,e\-1\)\}\\right\),\\quad e=1,\\ldots,E\.\(2\)
We denote the resulting local\-update map byhi\(t\)​\(𝒘\(t−1\)\)=𝒘i\(t,E\)h\_\{i\}^\{\(t\)\}\(\\bm\{w\}^\{\(t\-1\)\}\)=\\bm\{w\}\_\{i\}^\{\(t,E\)\}\. With data\-proportional weightpi\(t\)=ni/∑m∈𝒮\(t\)nmp^\{\(t\)\}\_\{i\}=n\_\{i\}/\\sum\_\{m\\in\\mathcal\{S\}^\{\(t\)\}\}n\_\{m\}, satisfying∑i∈𝒮\(t\)pi\(t\)=1\\sum\_\{i\\in\\mathcal\{S\}^\{\(t\)\}\}p^\{\(t\)\}\_\{i\}=1, the server updates

𝒘\(t\)=\(1−γt\)​𝒘\(t−1\)\+γt​∑i∈𝒮\(t\)pi\(t\)​hi\(t\)​\(𝒘\(t−1\)\),\\bm\{w\}^\{\(t\)\}=\(1\-\\gamma\_\{t\}\)\\bm\{w\}^\{\(t\-1\)\}\+\\gamma\_\{t\}\\sum\_\{i\\in\\mathcal\{S\}^\{\(t\)\}\}p^\{\(t\)\}\_\{i\}h\_\{i\}^\{\(t\)\}\(\\bm\{w\}^\{\(t\-1\)\}\),\(3\)whereγt∈\(0,1\]\\gamma\_\{t\}\\in\(0,1\]is the server mixing rate and standard FedAvg usesγt=1\\gamma\_\{t\}=1\. We write𝒈i\(t\)=∇Fi​\(𝒘\(t−1\)\)\\bm\{g\}\_\{i\}^\{\(t\)\}=\\nabla F\_\{i\}\(\\bm\{w\}^\{\(t\-1\)\}\)for clientii’s gradient\. AfterTlearnT\_\{\\mathrm\{learn\}\}rounds the server obtains the trained global model𝒘\(Tlearn\)\\bm\{w\}^\{\(T\_\{\\mathrm\{learn\}\}\)\}, together with the training history which is recorded during training and is target\-agnostic: it depends on neitherℐtar\\mathcal\{I\}\_\{\\mathrm\{tar\}\}nor any subsequent unlearning request \(see details in Sec\.[4](https://arxiv.org/html/2610.31786#S4)\)\.

### 3\.2Problem Definition

We study client\-level FU as a two\-stage process: a learning stage that produces a trained global model, followed by an unlearning stage that removes the influence of a designated target\-client set\.

#### Unlearning request\.

After training, a nonempty target\-client setℐtar⊊ℐ\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\\subsetneq\\mathcal\{I\}is designated for removal, and the retained set isℐret=ℐ∖ℐtar\\mathcal\{I\}\_\{\\mathrm\{ret\}\}=\\mathcal\{I\}\\setminus\\mathcal\{I\}\_\{\\mathrm\{tar\}\}, with\|ℐret\|\+\|ℐtar\|=N\|\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\|\+\|\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\|=N\. Letnret=∑i∈ℐretnin\_\{\\mathrm\{ret\}\}=\\sum\_\{i\\in\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\}n\_\{i\}andntar=∑o∈ℐtarnon\_\{\\mathrm\{tar\}\}=\\sum\_\{o\\in\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\}n\_\{o\}\.The retained\-client and target\-client objectives are as follows:

Fret​\(𝒘\)\\displaystyle F\_\{\\mathrm\{ret\}\}\(\\bm\{w\}\)=∑i∈ℐretninret​Fi​\(𝒘\),\\displaystyle=\\sum\_\{i\\in\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\}\\frac\{n\_\{i\}\}\{n\_\{\\mathrm\{ret\}\}\}F\_\{i\}\(\\bm\{w\}\),Ftar​\(𝒘\)\\displaystyle F\_\{\\mathrm\{tar\}\}\(\\bm\{w\}\)=∑o∈ℐtarnontar​Fo​\(𝒘\)\.\\displaystyle=\\sum\_\{o\\in\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\}\\frac\{n\_\{o\}\}\{n\_\{\\mathrm\{tar\}\}\}F\_\{o\}\(\\bm\{w\}\)\.\(4\)

#### Retraining reference and unlearning objective\.

Let𝒜\\mathcal\{A\}denote the original FL training algorithm, including its initialization, client sampling, and optimization randomnessξ\\xi\. The retraining reference is𝒘retrain⋆=𝒜⁡\(\{𝒟i\}i∈ℐret,ξ\)\\bm\{w\}^\{\\star\}\_\{\\mathrm\{retrain\}\}=\\mathcal\{A\}\(\\\{\\mathcal\{D\}\_\{i\}\\\}\_\{i\\in\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\};\\xi\), obtained by rerunning the training procedure from scratch using only retained clients\. Given𝒘\(Tlearn\)\\bm\{w\}^\{\(T\_\{\\mathrm\{learn\}\}\)\},ℐtar\\mathcal\{I\}\_\{\\mathrm\{tar\}\}, training history, an unlearning algorithm returns𝒘unlearn\\bm\{w\}\_\{\\mathrm\{unlearn\}\}\. We seek retraining\-like retained and target behavior:

Fret​\(𝒘unlearn\)−Fret​\(𝒘retrain⋆\)≤δ,\|Ftar​\(𝒘unlearn\)−Ftar​\(𝒘retrain⋆\)\|≤εf,F\_\{\\mathrm\{ret\}\}\(\\bm\{w\}\_\{\\mathrm\{unlearn\}\}\)\-F\_\{\\mathrm\{ret\}\}\(\\bm\{w\}^\{\\star\}\_\{\\mathrm\{retrain\}\}\)\\leq\\delta,\\qquad\\left\|F\_\{\\mathrm\{tar\}\}\(\\bm\{w\}\_\{\\mathrm\{unlearn\}\}\)\-F\_\{\\mathrm\{tar\}\}\(\\bm\{w\}^\{\\star\}\_\{\\mathrm\{retrain\}\}\)\\right\|\\leq\\varepsilon\_\{f\},\(5\)whereδ,εf≥0\\delta,\\varepsilon\_\{f\}\\geq 0denote the retained\-utility and forgetting tolerances, respectively\.

![Refer to caption](https://arxiv.org/html/2610.31786v1/framework.png)Figure 1:PDFframework with workflow\.

## 4Path\-Dependent Client Selection for Unlearning

PDFoperates in two stages as shown in Fig\.[1](https://arxiv.org/html/2610.31786#S3.F1)\. During federated training, the server detectsCLPsand maintains target\-agnostic,CLP\-weighted histories of each client’s update direction and global alignment\. Once an unlearning request reveals the target setℐtar\\mathcal\{I\}\_\{\\mathrm\{tar\}\}, these histories are used to measure each retained client’s coherence with the target clients and rank its suitability for unlearning\. This design neither requires the target set to be known during training nor stores per\-round model snapshots\. To reduce storage and computation, all statistics are computed on the classification layer, which is sensitive to client\-specific and non\-IID variation\[[31](https://arxiv.org/html/2610.31786#bib.bib9),[18](https://arxiv.org/html/2610.31786#bib.bib12),[24](https://arxiv.org/html/2610.31786#bib.bib10),[38](https://arxiv.org/html/2610.31786#bib.bib11),[20](https://arxiv.org/html/2610.31786#bib.bib13)\]\.

### 4\.1Learning stage

![Refer to caption](https://arxiv.org/html/2610.31786v1/clp.png)Figure 2:Illustration ofCLPdetection using the FGN proxy on FMNIST\[[34](https://arxiv.org/html/2610.31786#bib.bib35)\], where the green double\-headed arrows and triangles indicate the detectedCLPs\.#### Critical learning period detection\.

The onset and duration ofCLPsvary across training trajectories and are not confined to a fixed early interval \(see Fig\.[2](https://arxiv.org/html/2610.31786#S4.F2)\)\[[13](https://arxiv.org/html/2610.31786#bib.bib6)\]\. Let𝒯CLP=⋃q=1Q𝒯CLP\(q\)⊆\{1,…,Tlearn\}\\mathcal\{T\}\_\{\\mathrm\{CLP\}\}=\\bigcup\\nolimits\_\{q=1\}^\{Q\}\\mathcal\{T\}\_\{\\mathrm\{CLP\}\}^\{\(q\)\}\\subseteq\\\{1,\\dots,T\_\{\\mathrm\{learn\}\}\\\}denote the set of detected critical rounds, whereQQis the number of identified critical periods\. To detectCLPsonline, the server employs the federated gradient norm \(FGN\) proxy\[[37](https://arxiv.org/html/2610.31786#bib.bib5)\]\. Given the round\-ttlocal gradient𝒈i\(t\)\\bm\{g\}\_\{i\}^\{\(t\)\}, one local training step produces the first\-order loss change:Δ​Fi\(t\)=Fi​\(𝒘\(t−1\)−ηℓ,t​𝒈i\(t\)\)−Fi​\(𝒘\(t−1\)\)≈−ηℓ,t​‖𝒈i\(t\)‖22\\Delta F\_\{i\}^\{\(t\)\}=F\_\{i\}\\\!\\big\(\\bm\{w\}^\{\(t\-1\)\}\-\\eta\_\{\\ell,t\}\\,\\bm\{g\}\_\{i\}^\{\(t\)\}\\big\)\-F\_\{i\}\\\!\\big\(\\bm\{w\}^\{\(t\-1\)\}\\big\)\\approx\-\\,\\eta\_\{\\ell,t\}\\big\\\|\\bm\{g\}\_\{i\}^\{\(t\)\}\\big\\\|\_\{2\}^\{2\}\. Accordingly, the round\-level loss\-decrease proxy is defined asFGN\(t\)≜ηℓ,t​∑i∈𝒮\(t\)pi\(t\)​‖𝒈i\(t\)‖22\\mathrm\{FGN\}^\{\(t\)\}\\triangleq\\,\\eta\_\{\\ell,t\}\\\!\\\!\\sum\_\{i\\in\\mathcal\{S\}^\{\(t\)\}\}\\\!p^\{\(t\)\}\_\{i\}\\big\\\|\\bm\{g\}\_\{i\}^\{\(t\)\}\\big\\\|\_\{2\}^\{2\}\. A roundttis flagged as critical \(i\.e\.t∈𝒯CLPt\\in\\mathcal\{T\}\_\{\\mathrm\{CLP\}\}\), whenFGN\(t\)−FGN\(t−1\)FGN\(t−1\)≥τCLP,\\frac\{\\mathrm\{FGN\}^\{\(t\)\}\-\\mathrm\{FGN\}^\{\(t\-1\)\}\}\{\\mathrm\{FGN\}^\{\(t\-1\)\}\}\\;\\geq\\;\\tau\_\{\\mathrm\{CLP\}\},whereτCLP\>0\\tau\_\{\\mathrm\{CLP\}\}\>0is an empirically selected sensitivity threshold\[[37](https://arxiv.org/html/2610.31786#bib.bib5),[13](https://arxiv.org/html/2610.31786#bib.bib6)\]\. Evaluating this criterion throughout training enables the detection of both early and late critical periods \(see Fig\.[2](https://arxiv.org/html/2610.31786#S4.F2)\)\.

Throughout,𝜽icls,\(t\)∈ℝdcls\\bm\{\\theta\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\}\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{cls\}\}\}denotes the vectorized classification\-layer parameters of clientiiafter local training at roundtt, and𝜽cls,\(t\)∈ℝdcls\\bm\{\\theta\}^\{\\mathrm\{cls\},\(t\)\}\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{cls\}\}\}denotes the corresponding aggregated global parameters, wheredclsd\_\{\\mathrm\{cls\}\}is the classification\-layer dimension\.

###### Definition 1\(Server Alignment\)

For eachi∈𝒮\(t\)i\\in\\mathcal\{S\}^\{\(t\)\}, we define client and global classification\-layer updates as:𝛅icls,\(t\)=𝛉icls,\(t\)−𝛉cls,\(t−1\),𝛅gcls,\(t\)=𝛉cls,\(t\)−𝛉cls,\(t−1\)\\bm\{\\delta\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\}=\\bm\{\\theta\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\}\-\\bm\{\\theta\}^\{\\mathrm\{cls\},\(t\-1\)\},\\quad\\bm\{\\delta\}^\{\\mathrm\{cls\},\(t\)\}\_\{g\}=\\bm\{\\theta\}^\{\\mathrm\{cls\},\(t\)\}\-\\bm\{\\theta\}^\{\\mathrm\{cls\},\(t\-1\)\}, respectively\. Therefore, the round\-level server alignment of clientiiis

si\(t\)=cos^​\(𝜹icls,\(t\),𝜹gcls,\(t\)\),s^\{\(t\)\}\_\{i\}=\\widehat\{\\cos\}\\\!\\left\(\\bm\{\\delta\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\},\\bm\{\\delta\}^\{\\mathrm\{cls\},\(t\)\}\_\{g\}\\right\),\(6\)wherecos^​\(𝐚,𝐛\)=12​\(1\+⟨𝐚,𝐛⟩\(‖𝐚‖2\+ε0\)​\(‖𝐛‖2\+ε0\)\)\\widehat\{\\cos\}\(\\bm\{a\},\\bm\{b\}\)=\\frac\{1\}\{2\}\\\!\\left\(1\+\\frac\{\\langle\\bm\{a\},\\bm\{b\}\\rangle\}\{\(\\\|\\bm\{a\}\\\|\_\{2\}\+\\varepsilon\_\{0\}\)\(\\\|\\bm\{b\}\\\|\_\{2\}\+\\varepsilon\_\{0\}\)\}\\right\)is the normalized cosine similarity andε0\>0\\varepsilon\_\{0\}\>0ensures numerical stability\. A largersi\(t\)s^\{\(t\)\}\_\{i\}indicates stronger consistency between clientii’s local update and the realized global update at roundtt\.

###### Definition 2\(CLP\-Aware Historical Accumulation\)

To emphasize contributions made during critical rounds, we assign roundttthe temporal weight:ϕ\(t\)=\{1\+λ,t∈𝒯CLP,1,otherwise,\\phi^\{\(t\)\}=\\begin\{cases\}1\+\\lambda,&t\\in\\mathcal\{T\}\_\{\\mathrm\{CLP\}\},\\\\\[2\.0pt\] 1,&\\text\{otherwise,\}\\end\{cases\}whereλ≥0\\lambda\\geq 0controls the additional weight assigned toCLPcontributions\. For each participating client, let

𝜹^icls,\(t\)=𝜹icls,\(t\)‖𝜹icls,\(t\)‖2\+ε0\\widehat\{\\bm\{\\delta\}\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\}=\\frac\{\\bm\{\\delta\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\}\}\{\\\|\\bm\{\\delta\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\}\\\|\_\{2\}\+\\varepsilon\_\{0\}\}\(7\)denote its normalized update direction\. The server initializes𝐙i\(0\)=𝟎\\bm\{Z\}^\{\(0\)\}\_\{i\}=\\bm\{0\},Hi\(0\)=0H^\{\(0\)\}\_\{i\}=0, andWi\(0\)=0W^\{\(0\)\}\_\{i\}=0, and recursively updates

𝒁i\(t\)=𝒁i\(t−1\)\+ϕ\(t\)​ai\(t\)​𝜹^icls,\(t\),Hi\(t\)=Hi\(t−1\)\+ϕ\(t\)​ai\(t\)​si\(t\),Wi\(t\)=Wi\(t−1\)\+ϕ\(t\)​ai\(t\)\.\\displaystyle\\bm\{Z\}^\{\(t\)\}\_\{i\}=\\bm\{Z\}^\{\(t\-1\)\}\_\{i\}\+\\phi^\{\(t\)\}a^\{\(t\)\}\_\{i\}\\widehat\{\\bm\{\\delta\}\}^\{\\mathrm\{cls\},\(t\)\}\_\{i\},\\;H^\{\(t\)\}\_\{i\}=H^\{\(t\-1\)\}\_\{i\}\+\\phi^\{\(t\)\}a^\{\(t\)\}\_\{i\}s^\{\(t\)\}\_\{i\},\\;W^\{\(t\)\}\_\{i\}=W^\{\(t\-1\)\}\_\{i\}\+\\phi^\{\(t\)\}a^\{\(t\)\}\_\{i\}\.\(8\)AtTlearnT\_\{\\mathrm\{learn\}\}, the accumulated update direction and historical server alignment of clientiiare as follows:

𝒛i=𝒁i\(Tlearn\)Wi\(Tlearn\)\+ε0,𝒛¯i=𝒛i‖𝒛i‖2\+ε0,s¯i=Hi\(Tlearn\)Wi\(Tlearn\)\+ε0\.\\displaystyle\\bm\{z\}\_\{i\}=\\frac\{\\bm\{Z\}^\{\(T\_\{\\mathrm\{learn\}\}\)\}\_\{i\}\}\{W^\{\(T\_\{\\mathrm\{learn\}\}\)\}\_\{i\}\+\\varepsilon\_\{0\}\},\\quad\\bar\{\\bm\{z\}\}\_\{i\}=\\frac\{\\bm\{z\}\_\{i\}\}\{\\\|\\bm\{z\}\_\{i\}\\\|\_\{2\}\+\\varepsilon\_\{0\}\},\\quad\\bar\{s\}\_\{i\}=\\frac\{H^\{\(T\_\{\\mathrm\{learn\}\}\)\}\_\{i\}\}\{W^\{\(T\_\{\\mathrm\{learn\}\}\)\}\_\{i\}\+\\varepsilon\_\{0\}\}\.\(9\)Here,𝐳¯i\\bar\{\\bm\{z\}\}\_\{i\}summarizes the dominant direction of clientii’s historical updates, emphasizing contributions made duringCLPs, whiles¯i\\bar\{s\}\_\{i\}measures its average historical alignment with the global trajectory\. These target\-agnostic statistics require onedclsd\_\{\\mathrm\{cls\}\}\-dimensional vector and two scalars per client\.

### 4\.2Unlearning stage

Once an unlearning request reveals the target\-client setℐtar\\mathcal\{I\}\_\{\\mathrm\{tar\}\}, the server uses the cached learning\-stage histories to quantify each retained client’s dependence on the target set\.

###### Definition 3\(Target Coherence\)

The aggregate historical direction of the target clients is𝐳¯tar=∑o∈ℐtar𝐳¯o‖∑o∈ℐtar𝐳¯o‖2\+ε0\.\\bar\{\\bm\{z\}\}\_\{\\mathrm\{tar\}\}=\\frac\{\\sum\_\{o\\in\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\}\\bar\{\\bm\{z\}\}\_\{o\}\}\{\\left\\\|\\sum\_\{o\\in\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\}\\bar\{\\bm\{z\}\}\_\{o\}\\right\\\|\_\{2\}\+\\varepsilon\_\{0\}\}\.For each retained clienti∈ℐreti\\in\\mathcal\{I\}\_\{\\mathrm\{ret\}\}, its target coherence is defined by:

ci​\(ℐtar\)=cos^​\(𝒛¯i,𝒛¯tar\)\.c\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\)=\\widehat\{\\cos\}\\\!\\left\(\\bar\{\\bm\{z\}\}\_\{i\},\\bar\{\\bm\{z\}\}\_\{\\mathrm\{tar\}\}\\right\)\.\(10\)A largerci​\(ℐtar\)c\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\)indicates stronger alignment between the historical update directions of clientiiand the target set, whereas1−ci​\(ℐtar\)1\-c\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\)measures historical target decoupling\.Selecting clients with larger decoupling reduces the tendency of retained\-client updates to restore target\-related knowledge during the subsequent unlearning process\(see Tab\.[4](https://arxiv.org/html/2610.31786#S5.T4)\)\.

###### Definition 4\(Path\-Dependence Unlearning Score\)

For each retained clienti∈ℐreti\\in\\mathcal\{I\}\_\{\\mathrm\{ret\}\}, we define the path\-dependence score as

𝑝𝑑i​\(ℐtar\)=β​s¯i\+\(1−β\)​\[1−ci​\(ℐtar\)\]\.\\mathit\{pd\}\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\)=\\beta\\bar\{s\}\_\{i\}\+\(1\-\\beta\)\\bigl\[1\-c\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\)\\bigr\]\.\(11\)The parameterβ∈\[0,1\]\\beta\\in\[0,1\]balances historical global alignment and target decoupling: larger values emphasize clients whose updates consistently followed the global learning trajectory, thereby favoring retained\-model utility preservation, whereas smaller values emphasize clients whose historical directions are weakly coupled with those of the target clients, thereby favoring target forgetting\.

A larger𝑝𝑑i​\(ℐtar\)\\mathit\{pd\}\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\)therefore favors retained clients that are both globally aligned and historically decoupled from the target set, with contributions during detectedCLPsemphasized throughϕ\(t\)\\phi^\{\(t\)\}\. The server selects thekkhighest\-scoring retained clients:

𝒦=Topk​\(\{𝑝𝑑i​\(ℐtar\):i∈ℐret\}\),with​k≤\|ℐret\|\.\\displaystyle\\mathcal\{K\}=\\mathrm\{Top\}\_\{k\}\\left\(\\left\\\{\\mathit\{pd\}\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\):i\\in\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\\right\\\}\\right\),\\text\{ with \}k\\leq\|\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\|\.\(12\)Only clients in𝒦\\mathcal\{K\}participate in the subsequentTunlearnT\_\{\\mathrm\{unlearn\}\}unlearning rounds\. The persistent learning\-stage cache therefore requires𝒪⁡\(N​dcls\)\\mathcal\{O\}\(Nd\_\{\\mathrm\{cls\}\}\)space, while unlearning\-stage communication and computation scale withkkselected clients rather than all\|ℐret\|\|\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\|retained clients\.

## 5Experimental evaluation

### 5\.1Experiment setup

Unlearning scenario\.We simulate Byzantine attacks via label flipping, where a single client’s training labels are maliciously manipulated, triggering an unlearning request for that client\[[40](https://arxiv.org/html/2610.31786#bib.bib1)\]\.

Hyperparameter, dataset, and model\.We simulate an FL system using FedAvg\[[21](https://arxiv.org/html/2610.31786#bib.bib21)\]for global model training withN=64N=64clients\. Unless otherwise stated,M=16M=16clients are sampled per training round, withηl,t=0\.01\\eta\_\{l,t\}=0\.01, batch size3232,CLPdetection thresholdτCLP=0\.01\\tau\_\{\{\\text\{CLP\}\}\}=0\.01\. We consider both IID and Dirichlet\-based non\-IID data partitions withα∈\{1,0\.1\}\\alpha\\in\\\{1,0\.1\\\}, where a smallerα\\alphaindicates stronger data heterogeneity\. For FU, we setβ∈\{0\.1,0\.5,0\.9\}\\beta\\in\\\{0\.1,0\.5,0\.9\\\}to control the trade\-off between retained knowledge preservation and the removal of target\-client influence, with smallerβ\\betayielding stronger forgetting;λ=0\.7\\lambda=0\.7, which adds weights to participation duringCLPs; andTunlearn=20T\_\{\\mathrm\{unlearn\}\}=20\. We evaluate on FMNIST\[[34](https://arxiv.org/html/2610.31786#bib.bib35)\], CIFAR\-10, and CIFAR\-100\[[2](https://arxiv.org/html/2610.31786#bib.bib39)\]\. A CNN architecture is used for FMNIST \(see Appendix[A\.1](https://arxiv.org/html/2610.31786#A1.SS1)\), while ResNet\-18\[[12](https://arxiv.org/html/2610.31786#bib.bib40)\]is adopted for CIFAR\-10 and CIFAR\-100\.

Baselines\.We comparePDFwith Retrain, CONDA\[[6](https://arxiv.org/html/2610.31786#bib.bib7),[7](https://arxiv.org/html/2610.31786#bib.bib8)\], FedRecovery\[[39](https://arxiv.org/html/2610.31786#bib.bib23)\], FOUL\[[22](https://arxiv.org/html/2610.31786#bib.bib28)\], FedEraser\[[19](https://arxiv.org/html/2610.31786#bib.bib14)\], Exact\-Fun \(E\-F\)\[[35](https://arxiv.org/html/2610.31786#bib.bib15)\], FUSED\[[40](https://arxiv.org/html/2610.31786#bib.bib1)\], and GDFA\[[33](https://arxiv.org/html/2610.31786#bib.bib36)\]\(see details in Appendix[A\.2](https://arxiv.org/html/2610.31786#A1.SS2)\)\.

Evaluation metric\.We evaluate unlearning efficacy, efficiency, and fidelity, using the following active testing metrics\[[23](https://arxiv.org/html/2610.31786#bib.bib2),[22](https://arxiv.org/html/2610.31786#bib.bib28),[40](https://arxiv.org/html/2610.31786#bib.bib1),[10](https://arxiv.org/html/2610.31786#bib.bib3),[6](https://arxiv.org/html/2610.31786#bib.bib7),[33](https://arxiv.org/html/2610.31786#bib.bib36)\]:

- •FA & RA\(%\): Forgetting accuracy \(FA\) measures predictive accuracy on the target\-client data, where lower FA indicates stronger removal of target\-client influence\. Retained accuracy \(RA\) measures accuracy on the retained data, where higher RA indicates better preservation of retained knowledge\.
- •MIA AUC\(%\): We assess residual privacy leakage using membership inference attacks \(MIA\)\[[28](https://arxiv.org/html/2610.31786#bib.bib4)\]\. AUC measures member–non\-member distinguishability across decision thresholds, with50%50\\%corresponding to random discrimination\. We use Retrain as the reference and report the MIA\-AUC gap to Retrain, where a smaller gap indicates more retraining\-like privacy behavior\.
- •Comm\(GB\) &Comp\(PFLOPs\): Total data transmitted and total floating\-point operations \(FLOPs\), respectively, each aggregated over training and unlearning\. We include training because several learning\-to\-unlearn baselines modify the training protocol, so measuring the unlearning stage alone would understate their cost\.
- •Space Complexity: We measure the system\-wide memory required to store model checkpoints, historical statistics, and intermediate model updates during training and unlearning\.

Table 1:Performance comparison betweenPDFand other FU methods on three datasets underα∈\{0\.1,1\.0\}\\alpha\\in\\\{0\.1,1\.0\\\}\. Subscripts onPDFdenoteβ∈\{0\.1,0\.5,0\.9\}\\beta\\in\\\{0\.1,0\.5,0\.9\\\}, which controls the forgetting–utility trade\-off:0\.10\.1is forgetting\-oriented,0\.50\.5balances forgetting and utility preservation, and0\.90\.9is utility\-preservation\-oriented\. All variants usek=25k=25selected unlearning clients\. Values in parentheses are deltas relative to Retrain\. For FA, RA, and MIA AUC,redmarks the best andgreenthe second\-best method across all unlearning methods \(Retrain is the reference and is excluded\), ranked by FA \(↓\\downarrow\), RA \(↑\\uparrow\), and\|Δ​MIA\|\|\\Delta\\mathrm\{MIA\}\|\(↓\\downarrow\)\.Metricα\\alphaRetrainFUSEDCONDAE\-FFedEraserFOULFedRecoveryGDFAPDF0\.1PDF0\.5PDF0\.9FMNIST\-CNNFA0\.10\.440\.44 \(\+\+0\.00\)0\.70 \(\+\+0\.26\)0\.56 \(\+\+0\.12\)1\.11 \(\+\+0\.67\)0\.75 \(\+\+0\.31\)0\.60 \(\+\+0\.16\)0\.28 \(−\-0\.16\)0\.00 \(−\-0\.44\)0\.72 \(\+\+0\.28\)0\.44 \(\+\+0\.00\)1\.00\.920\.82 \(−\-0\.10\)0\.94 \(\+\+0\.02\)0\.45 \(−\-0\.47\)0\.53 \(−\-0\.39\)0\.77 \(−\-0\.15\)0\.87 \(−\-0\.06\)0\.14 \(−\-0\.78\)0\.28 \(−\-0\.64\)0\.28 \(−\-0\.64\)0\.92 \(\+\+0\.00\)RA0\.188\.2087\.14 \(−\-1\.06\)85\.17 \(−\-3\.02\)81\.89 \(−\-6\.31\)61\.04 \(−\-27\.16\)85\.60 \(−\-2\.60\)85\.22 \(−\-2\.98\)81\.83 \(−\-6\.37\)82\.60 \(−\-5\.60\)85\.97 \(−\-2\.23\)86\.89 \(−\-1\.31\)1\.090\.4589\.60 \(−\-0\.85\)89\.40 \(−\-1\.05\)85\.94 \(−\-4\.50\)76\.42 \(−\-14\.03\)89\.64 \(−\-0\.81\)89\.64 \(−\-0\.81\)88\.25 \(−\-2\.20\)89\.34 \(−\-1\.11\)89\.35 \(−\-1\.10\)89\.55 \(−\-0\.90\)MIAAUC0\.150\.3250\.05 \(−\-0\.27\)50\.11 \(−\-0\.20\)49\.84 \(−\-0\.48\)49\.92 \(−\-0\.40\)49\.71 \(−\-0\.61\)50\.01 \(−\-0\.31\)50\.00 \(−\-0\.32\)50\.01 \(−\-0\.31\)50\.00 \(−\-0\.32\)49\.91 \(−\-0\.41\)1\.050\.2349\.79 \(−\-0\.44\)50\.09 \(−\-0\.15\)50\.25 \(\+\+0\.02\)50\.08 \(−\-0\.15\)49\.82 \(−\-0\.41\)50\.16 \(−\-0\.07\)50\.17 \(−\-0\.06\)50\.13 \(−\-0\.10\)50\.25 \(\+\+0\.02\)50\.19 \(−\-0\.04\)Comm0\.1/1\.015\.624\.113\.977\.824\.366\.083\.973\.984\.794\.794\.79Comp0\.12\.091\.01 \(−\-1\.09\)0\.71 \(−\-1\.39\)1\.22 \(−\-0\.87\)0\.72 \(−\-1\.37\)1\.71 \(−\-0\.38\)0\.71 \(−\-1\.39\)0\.71 \(−\-1\.38\)0\.83 \(−\-1\.26\)0\.88 \(−\-1\.22\)0\.89 \(−\-1\.21\)1\.02\.101\.01 \(−\-1\.09\)0\.71 \(−\-1\.39\)1\.23 \(−\-0\.87\)0\.73 \(−\-1\.37\)1\.72 \(−\-0\.38\)0\.71 \(−\-1\.39\)0\.71 \(−\-1\.39\)0\.83 \(−\-1\.27\)0\.83 \(−\-1\.27\)0\.84 \(−\-1\.26\)CIFAR\-10\-ResNetFA0\.16\.936\.14 \(−\-0\.79\)7\.52 \(\+\+0\.59\)2\.21 \(−\-4\.72\)4\.17 \(−\-2\.76\)1\.86 \(−\-5\.07\)0\.77 \(−\-6\.16\)4\.45 \(−\-2\.48\)0\.42 \(−\-6\.51\)0\.00 \(−\-6\.93\)0\.39 \(−\-6\.54\)1\.00\.721\.38 \(\+\+0\.66\)11\.18 \(\+\+10\.46\)3\.93 \(\+\+3\.20\)7\.97 \(\+\+7\.25\)1\.96 \(\+\+1\.24\)5\.87 \(\+\+5\.15\)0\.33 \(−\-0\.39\)0\.89 \(\+\+0\.17\)1\.09 \(\+\+0\.37\)0\.94 \(\+\+0\.22\)RA0\.155\.2849\.85 \(−\-5\.43\)14\.68 \(−\-40\.60\)23\.10 \(−\-32\.18\)9\.68 \(−\-45\.60\)52\.10 \(−\-3\.18\)37\.12 \(−\-18\.16\)38\.61 \(−\-16\.67\)45\.22 \(−\-10\.06\)54\.48 \(−\-0\.80\)57\.10 \(\+\+1\.82\)1\.086\.9383\.56 \(−\-3\.38\)9\.01 \(−\-77\.93\)52\.40 \(−\-34\.53\)24\.67 \(−\-62\.26\)82\.65 \(−\-4\.28\)46\.83 \(−\-40\.10\)69\.34 \(−\-17\.59\)82\.28 \(−\-4\.65\)82\.84 \(−\-4\.09\)84\.08 \(−\-2\.85\)MIAAUC0\.155\.6461\.43 \(\+\+5\.79\)62\.98 \(\+\+7\.34\)50\.13 \(−\-5\.51\)49\.87 \(−\-5\.78\)60\.73 \(\+\+5\.09\)55\.16 \(−\-0\.49\)57\.53 \(\+\+1\.89\)54\.62 \(−\-1\.02\)54\.76 \(−\-0\.88\)56\.69 \(\+\+1\.05\)1\.052\.1854\.30 \(\+\+2\.12\)53\.38 \(\+\+1\.20\)49\.33 \(−\-2\.85\)50\.54 \(−\-1\.65\)53\.11 \(\+\+0\.93\)51\.21 \(−\-0\.98\)51\.82 \(−\-0\.36\)51\.74 \(−\-0\.44\)51\.78 \(−\-0\.40\)51\.58 \(−\-0\.60\)Comm0\.1/1\.0845\.48217\.29214\.73423\.39235\.88329\.25214\.73215\.35259\.46259\.46259\.46Comp0\.147\.4522\.38 \(−\-25\.07\)16\.01 \(−\-31\.45\)27\.69 \(−\-19\.76\)16\.42 \(−\-31\.03\)38\.45 \(−\-9\.00\)16\.01 \(−\-31\.45\)16\.02 \(−\-31\.43\)18\.73 \(−\-28\.72\)19\.30 \(−\-28\.15\)20\.02 \(−\-27\.43\)1\.047\.6322\.50 \(−\-25\.14\)16\.10 \(−\-31\.53\)27\.84 \(−\-19\.79\)16\.49 \(−\-31\.14\)38\.66 \(−\-8\.97\)16\.10 \(−\-31\.53\)16\.11 \(−\-31\.52\)18\.70 \(−\-28\.93\)18\.76 \(−\-28\.87\)18\.88 \(−\-28\.75\)CIFAR\-100\-ResNetFA0\.10\.271\.26 \(\+\+0\.99\)0\.86 \(\+\+0\.59\)1\.46 \(\+\+1\.19\)0\.84 \(\+\+0\.56\)1\.50 \(\+\+1\.23\)0\.86 \(\+\+0\.59\)0\.86 \(\+\+0\.59\)0\.00 \(−\-0\.27\)0\.86 \(\+\+0\.59\)0\.52 \(\+\+0\.25\)1\.00\.600\.91 \(\+\+0\.30\)0\.54 \(−\-0\.07\)0\.40 \(−\-0\.21\)1\.25 \(\+\+0\.64\)1\.00 \(\+\+0\.40\)1\.44 \(\+\+0\.83\)0\.08 \(−\-0\.52\)0\.44 \(−\-0\.16\)0\.91 \(\+\+0\.31\)0\.52 \(−\-0\.08\)RA0\.155\.1736\.34 \(−\-18\.83\)4\.35 \(−\-50\.82\)16\.98 \(−\-38\.20\)3\.98 \(−\-51\.19\)42\.22 \(−\-12\.95\)1\.03 \(−\-54\.14\)42\.15 \(−\-13\.02\)48\.63 \(−\-6\.54\)48\.43 \(−\-6\.74\)49\.13 \(−\-6\.04\)1\.058\.9231\.83 \(−\-27\.09\)2\.12 \(−\-56\.80\)23\.80 \(−\-35\.12\)9\.10 \(−\-49\.82\)39\.81 \(−\-19\.11\)14\.46 \(−\-44\.46\)47\.50 \(−\-11\.42\)54\.38 \(−\-4\.54\)54\.24 \(−\-4\.68\)54\.21 \(−\-4\.71\)MIAAUC0\.151\.4454\.02 \(\+\+2\.59\)55\.48 \(\+\+4\.04\)55\.21 \(\+\+3\.77\)50\.71 \(−\-0\.73\)53\.09 \(\+\+1\.65\)49\.96 \(−\-1\.48\)52\.42 \(\+\+0\.98\)52\.13 \(\+\+0\.69\)52\.57 \(\+\+1\.13\)52\.43 \(\+\+0\.99\)1\.062\.1553\.91 \(−\-8\.24\)50\.20 \(−\-11\.95\)54\.90 \(−\-7\.25\)51\.36 \(−\-10\.79\)50\.49 \(−\-11\.66\)50\.45 \(−\-11\.70\)49\.73 \(−\-12\.42\)53\.03 \(−\-9\.12\)52\.39 \(−\-9\.76\)52\.98 \(−\-9\.17\)Comm0\.1/1\.0848\.97218\.19215\.61425\.14236\.86330\.60215\.61216\.24260\.53260\.53260\.53Comp0\.147\.7522\.63 \(−\-25\.11\)16\.22 \(−\-31\.53\)28\.02 \(−\-19\.72\)16\.62 \(−\-31\.13\)38\.93 \(−\-8\.82\)16\.22 \(−\-31\.53\)16\.23 \(−\-31\.52\)18\.83 \(−\-28\.92\)18\.87 \(−\-28\.88\)18\.96 \(−\-28\.78\)1\.047\.7722\.59 \(−\-25\.18\)16\.17 \(−\-31\.60\)27\.96 \(−\-19\.81\)16\.57 \(−\-31\.20\)38\.82 \(−\-8\.95\)16\.17 \(−\-31\.60\)16\.18 \(−\-31\.59\)18\.72 \(−\-29\.05\)18\.73 \(−\-29\.04\)18\.75 \(−\-29\.02\)

### 5\.2Main result

As shown in Tab\.[1](https://arxiv.org/html/2610.31786#S5.T1),PDFachieves effective forgetting while preserving retained knowledge using only2525clients for unlearning\. On FMNIST,PDFremains competitive with the strongest baselines, reaching86\.89%86\.89\\%RA underα=0\.1\\alpha=0\.1while the forgetting\-oriented variant achieves0%0\\%FA\. Its advantage becomes clearer on the more challenging CIFAR tasks\. Under heterogeneous CIFAR\-10 \(i\.e\.,α=0\.1\\alpha=0\.1\),PDF0\.9achieves57\.10%57\.10\\%RA, exceeding both Retrain \(55\.28%55\.28\\%\) and FOUL \(52\.10%52\.10\\%\), whilePDF0\.5combines54\.48%54\.48\\%RA with0%0\\%FA\. On CIFAR\-100, all three variants consistently outperform the strongest competing baseline in RA under both data distributions, reaching up to49\.13%49\.13\\%versus42\.22%42\.22\\%underα=0\.1\\alpha=0\.1and54\.38%54\.38\\%versus47\.50%47\.50\\%underα=1\.0\\alpha=1\.0\.These results support our central hypothesis that retained clients differ in their value for unlearning, and that exploiting their path\-dependent training histories enables better preservation of retained knowledge\. The variants further demonstrate the intended role ofβ\\betain controlling the forgetting–utility trade\-off\. Increasingβ\\betaemphasizes historical global alignment and generally favors utility preservation, whereas smallerβ\\betaemphasizes target decoupling and stronger forgetting\. For example, underα=0\.1\\alpha=0\.1, RA increases from82\.60%82\.60\\%to86\.89%86\.89\\%on FMNIST and from45\.22%45\.22\\%to57\.10%57\.10\\%on CIFAR\-10 asβ\\betaincreases from0\.10\.1to0\.90\.9\. The weaker variation acrossβ\\betaon CIFAR\-100 suggests thatPDFis less sensitive to the trade\-off parameter in this setting\. Finally,PDFreduces communication by approximately69%69\\%and computation by5757–61%61\\%relative to Retrain, demonstrating a favorable trade\-off among forgetting, retained utility, and unlearning efficiency\.

Table 2:Space complexity analysis\.- ∗\*P=\|𝐰\|P=\|\\mathbf\{w\}\|is the number of full\-model parameters\.
- †\\daggerAAis the number of LoRA unlearning parameters,A≪PA\\ll P\.
- †⁣†\\dagger\\daggerdcls≪Pd\_\{\\mathrm\{cls\}\}\\ll P\.
- ‡\\ddaggerHHis the number of FedEraser checkpoints,H<TlearnH<T\_\{\\mathrm\{learn\}\}\.
- ∙\\bulletKperK\_\{\\text\{per\}\}is the number of GDFA perturbed models\.
- ⋄\\diamondkkis the number of retained clients selected byPDF,k<\|ℐret\|k<\|\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\|\.

As shown in Tab\.[2](https://arxiv.org/html/2610.31786#S5.T2),PDFis space\-efficient because its learning\-stage cache stores only one accumulated classification\-layer update direction and two scalar statistics per client, yielding𝒪⁡\(N​dcls\)\\mathcal\{O\}\(Nd\_\{\\mathrm\{cls\}\}\)storage independent of the number of learning rounds, wheredcls≪Pd\_\{\\mathrm\{cls\}\}\\ll P\. During unlearning,PDFoperates on only the selectedkkretained clients, so the model and update tensors instantiated during computation scale with𝒪⁡\(k​P\)\\mathcal\{O\}\(kP\)rather than all retained clients, wherek<\|ℐret\|k<\|\\mathcal\{I\}\_\{\\mathrm\{ret\}\}\|\. In comparison, Retrain and FUSED involve all retained clients, although FUSED reduces per\-client storage and computation through lightweight LoRA parameters\. CONDA and FOUL maintain client\-wise full\-model information, while GDFA constructs and fine\-tunes multiple perturbed full\-model instances\. FedEraser additionally stores checkpointed model histories, whereas E\-F and FedRecovery retain full\-model information across learning rounds\.

### 5\.3Ablation study

As shown in Tab\.[3](https://arxiv.org/html/2610.31786#S5.T3), increasingkkgenerally improves retained utility, but the gains diminish as more clients participate\. Atβ=0\.5\\beta\{=\}0\.5, for example, RA rises from79\.26%79\.26\\%atk=10k\{=\}10to85\.97%85\.97\\%atk=25k\{=\}25, but increases only marginally to86\.40%86\.40\\%atk=30k\{=\}30\. A similar saturation occurs forβ=0\.9\\beta\{=\}0\.9, where increasingkkfrom2020to2525improves RA by0\.90\.9percentage points, compared with only0\.10\.1percentage points from2525to3030\. In contrast, communication and computation increase steadily withkk, revealing a clear utility–efficiency trade\-off\. MIA AUC remains within0\.410\.41percentage points of Retrain throughout the sweep, indicating that this trade\-off does not alter retraining\-like privacy behavior\. The observed variation acrossβ\\betais consistent with the forgetting–utility behavior discussed in Tab\.[1](https://arxiv.org/html/2610.31786#S5.T1)\. We therefore adoptk=25k\{=\}25as the default\.

Table 3:Ablation study on the number of selected unlearning clientskkand knowledge retention–forgetting tradeoffβ\\betaon FMNIST underα=0\.1\\alpha=0\.1withℐtar=0\\mathcal\{I\}\_\{\\mathrm\{tar\}\}=\{0\}\. MIA AUC values in parentheses denote differences from Retrain \(50\.3250\.32\)\. The shaded column denotes the defaultk=25k=25in Tab\.[1](https://arxiv.org/html/2610.31786#S5.T1)\.Table 4:Ablation ofPDFagainst its selection variants, withβ=0\.5\\beta=0\.5,λ=0\.7\\lambda=0\.7, andk=25k=25clients selected for unlearning\.Δ\\DeltaMIA is the signed deviation of MIA AUC from the retrained reference\.Variants ofPDF\.Table[4](https://arxiv.org/html/2610.31786#S5.T4)evaluates the contribution of the proposed client\-selection rule while keeping the unlearning procedure and number of selected clients fixed\. Under highly heterogeneous data \(α=0\.1\\alpha=0\.1\),PDFconsistently achieves higher RA thanRev,high\-Coh, andnon\-CLP\. Compared withRev, which also use𝑝𝑑i​\(ℐtar\)\\mathit\{pd\}\_\{i\}\(\\mathcal\{I\}\_\{\\mathrm\{tar\}\}\)for client selection but in a reverse order, it improves RA by3\.693\.69percentage points on FMNIST and13\.3913\.39points on CIFAR\-10, while reducing FA by0\.640\.64and4\.444\.44points, respectively\. Selecting highly target\-coherent clients \(high\-Coh\) further degrades both FA and RA, particularly on CIFAR\-10, where FA increases from0%0\\%to7\.65%7\.65\\%and RA decreases from54\.48%54\.48\\%to37\.65%37\.65\\%\. RemovingCLPweighting \(non\-CLP\) also reduces RA, by0\.620\.62points on FMNIST and4\.884\.88points on CIFAR\-10, showing that emphasizing critical rounds improves client selection\. Underα=1\.0\\alpha=1\.0, the differences are smaller, althoughPDFretains the highest RA on both datasets\. Across all variants,\|Δ​MIA\|\|\\Delta\\mathrm\{MIA\}\|remains at most1\.281\.28percentage points from Retrain\.These results show that the proposed ranking direction andCLP\-aware history contribute to selecting retained clients that preserve utility while maintaining effective forgetting, supporting our central hypothesis\.

## 6Conclusion

We revisit client\-level FU from a path\-dependent perspective, motivated by the insight that retained clients are not equally valuable for unlearning: their usefulness depends on when and how their influence was accumulated during training and how strongly it is coupled with the target clients\. Based on this insight,PDFcombinesCLP\-weighted historical global\-model alignment and client\-target coherence to rank retained clients, and performs retraining\-based unlearning using only a selected top\-kksubset\. Experiment results demonstrate thatPDFachieves effective forgetting and strong retained utility while substantially reducing client participation, communication, and computation, and can be adapted to different application requirements by adjusting the forgetting–utility trade\-off\.

## Acknowledgments and Disclosure of Funding

This publication has emanated from research conducted with the financial support of Research Ireland under Grant number 18/CRT/6222; School of Computer Science and Statistics, Trinity College Dublin\. The work of Quoc\-Viet Pham is supported in part by Research Ireland under the European Innovation Council CHIST\-ERA SHIELD project \(Project No\. 216449, Award No\. 19226\)\. For the purpose of Open Access, the author has applied a CC BY public copyright licence to any Author Accepted Manuscript version arising from this submission\.

## References

- \[1\]A\. Achille, M\. Rovere, and S\. Soatto\(2018\)Critical learning periods in deep networks\.InInternational Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p2.1)\.
- \[2\]Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton\(2009\)The cifar\-10 and cifar\-100 datasets\.Note:[https://cave\.cs\.toronto\.edu/kriz/cifar\.html](https://cave.cs.toronto.edu/kriz/cifar.html)Accessed: 2026\-06\-18Cited by:[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p2.1)\.
- \[3\]C\. Antonelli\(1997\)The economics of path\-dependence in industrial organization\.International Journal of Industrial Organization15\(6\),pp\. 643–675\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p3.1)\.
- \[4\]J\. Brophy and D\. Lowd\(2021\)Machine unlearning for random forests\.InInternational Conference on Machine Learning,pp\. 1092–1104\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[5\]Y\. Cao and J\. Yang\(2015\)Towards making systems forget with machine unlearning\.In2015 IEEE Symposium on Security and Privacy,pp\. 463–480\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[6\]V\. S\. Chundawat, P\. Niroula, P\. Dhungana, S\. Schoepf, M\. Mandal, and A\. Brintrup\(2024\)Conda: fast federated unlearning with contribution dampening\.arXiv preprint arXiv:2410\.04144\.Cited by:[4th item](https://arxiv.org/html/2610.31786#A1.I1.i4.p1.1),[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p4.1)\.
- \[7\]J\. Foster, S\. Schoepf, and A\. Brintrup\(2024\)Fast machine unlearning without retraining through selective synaptic dampening\.InProceedings of the AAAI conference on artificial intelligence,Vol\.38,pp\. 12043–12051\.Cited by:[4th item](https://arxiv.org/html/2610.31786#A1.I1.i4.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1)\.
- \[8\]A\. Golatkar, A\. Achille, and S\. Soatto\(2020\)Eternal sunshine of the spotless net: selective forgetting in deep networks\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 9304–9312\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[9\]Q\. Gong, X\. Yang, X\. Chen, J\. Lai, H\. Meng, and X\. Tang\(2026\)FedOrtho: efficient federated unlearning via orthogonal convolution and adaptive soft pruning\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 8009–8018\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[10\]H\. Gu, W\. K\. Ong, C\. S\. Chan, and L\. Fan\(2024\)Ferrari: federated feature unlearning via optimizing feature sensitivity\.Advances in Neural Information Processing Systems37,pp\. 24150–24180\.Cited by:[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p4.1)\.
- \[11\]T\. Hanser, E\. Ahlberg, A\. Amberg, L\. T\. Anger, C\. Barber, R\. J\. Brennan, A\. Brigo, A\. Delaunois, S\. Glowienke, N\. Greene,et al\.\(2025\)Data\-driven federated learning in drug discovery with knowledge distillation\.Nature Machine Intelligence7\(3\),pp\. 423–436\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p1.1)\.
- \[12\]K\. He, X\. Zhang, S\. Ren, and J\. Sun\(2016\)Deep residual learning for image recognition\.InProceedings of the IEEE conference on computer vision and pattern recognition,pp\. 770–778\.Cited by:[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p2.1)\.
- \[13\]C\. Huang and B\. Liu\(2025\)Pa3fed: period\-aware adaptive aggregation for improved federated learning\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.39,pp\. 17395–17403\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p2.1),[§4\.1](https://arxiv.org/html/2610.31786#S4.SS1.SSS0.Px1.p1.1)\.
- \[14\]H\. Jeong, S\. Ma, and A\. Houmansadr\(2026\)Survey on federated unlearning: challenges and opportunities\.IEEE Transactions on Big Data12\(3\),pp\. 702–720\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[15\]J\. Jia, J\. Liu, P\. Ram, Y\. Yao, G\. Liu, Y\. Liu, P\. Sharma, and S\. Liu\(2023\)Model sparsity can simplify machine unlearning\.Advances in Neural Information Processing Systems36,pp\. 51584–51605\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[16\]Y\. H\. Khalil, L\. Brunswic, S\. Lamghari, X\. Li, M\. Beitollahi, and X\. Chen\(2025\)Not: federated unlearning via weight negation\.InProceedings of the Computer Vision and Pattern Recognition Conference,pp\. 25759–25769\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[17\]M\. Kleinman, A\. Achille, and S\. Soatto\(2024\)Critical learning periods emerge even in deep linear networks\.InInternational Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p2.1)\.
- \[18\]Z\. Li, X\. Shang, R\. He, T\. Lin, and C\. Wu\(2023\)No fear of classifier biases: neural collapse inspired federated learning with synthetic and fixed classifier\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 5319–5329\.Cited by:[§4](https://arxiv.org/html/2610.31786#S4.p1.1)\.
- \[19\]G\. Liu, X\. Ma, Y\. Yang, C\. Wang, and J\. Liu\(2021\)Federaser: enabling efficient client\-level data removal from federated learning models\.In2021 IEEE/ACM 29th international symposium on quality of service \(IWQOS\),pp\. 1–10\.Cited by:[2nd item](https://arxiv.org/html/2610.31786#A1.I1.i2.p1.1),[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1)\.
- \[20\]M\. Luo, F\. Chen, D\. Hu, Y\. Zhang, J\. Liang, and J\. Feng\(2021\)No Fear of Heterogeneity: classifier calibration for federated learning with non\-iid data\.Advances in Neural Information Processing Systems34,pp\. 5972–5984\.Cited by:[§4](https://arxiv.org/html/2610.31786#S4.p1.1)\.
- \[21\]B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InArtificial Intelligence and Statistics,pp\. 1273–1282\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1),[§3\.1](https://arxiv.org/html/2610.31786#S3.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p2.1)\.
- \[22\]M\. Nguyen, S\. Wanasekara, L\. Nguyen, Q\. Pham, K\. Yong, N\. H\. Tran, and D\. D\. Le\(2026\)Computation and communication efficient federated unlearning via on\-server gradient conflict mitigation and expression\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 3347–3357\.Cited by:[7th item](https://arxiv.org/html/2610.31786#A1.I1.i7.p1.1),[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p4.1)\.
- \[23\]T\. L\. Nguyen, M\. T\. D\. Oliveira, A\. Braeken, A\. Y\. Ding, and Q\. Pham\(2026\)Toward Verifiable Federated Unlearning: Framework, Challenges, and the Road Ahead\.IEEE Internet Computing30\(01\),pp\. 59–70\.Cited by:[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p4.1)\.
- \[24\]J\. Oh, S\. Kim, and S\. Yun\(2022\)FedBABU: toward enhanced representation for federated image classification\.InInternational Conference on Learning Representations,Cited by:[§4](https://arxiv.org/html/2610.31786#S4.p1.1)\.
- \[25\]Z\. Pan, Z\. Wang, C\. Li, K\. Zheng, B\. Wang, X\. Tang, and J\. Zhao\(2025\)Federated unlearning with gradient descent and conflict mitigation\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.39,pp\. 19804–19812\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[26\]E\. Parliament and C\. of the European Union\(2016\)General Data Protection Regulation\.Note:\[Online\]\. Available: "[https://gdpr\-info\.eu/](https://gdpr-info.eu/)"\(Accessed Jun\. 07, 2026\)Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p1.1)\.
- \[27\]N\. Romandini, A\. Mora, C\. Mazzocca, R\. Montanari, and P\. Bellavista\(2024\)Federated unlearning: a survey on methods, design guidelines, and evaluation metrics\.IEEE Transactions on Neural Networks and Learning Systems36\(7\),pp\. 11697–11717\.Cited by:[§2](https://arxiv.org/html/2610.31786#S2.p1.1)\.
- \[28\]R\. Shokri, M\. Stronati, C\. Song, and V\. Shmatikov\(2017\)Membership inference attacks against machine learning models\.InIEEE Symposium on Security and Privacy,pp\. 3–18\.Cited by:[2nd item](https://arxiv.org/html/2610.31786#S5.I1.i2.p1.1)\.
- \[29\]S\. Theophanous, P\. Lønne, A\. Choudhury, M\. Berbee, C\. Deijen, A\. Dekker, M\. Field, M\. A\. Gambacorta, A\. Gilbert, M\. Grønlie Guren,et al\.\(2026\)An international multi\-centre study to develop and validate federated learning\-based prognostic models for anal cancer\.Nature Communications17\(1\),pp\. 3956\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p1.1)\.
- \[30\]G\. Wang and C\. Chen\(2026\)GR\-Gauge: cost\-efficient training configuration by gauging the gradient redundancy\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 12934–12943\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p2.1)\.
- \[31\]P\. Wang, S\. Lu, H\. Yin, B\. Yang, T\. Zhu, and C\. Dai\(2025\)FedCM: client clustering and migration in federated learning via gradient path similarity and update direction deviation\.InProceedings of the Thirty\-Fourth International Joint Conference on Artificial Intelligence,pp\. 6343–6351\.Cited by:[§4](https://arxiv.org/html/2610.31786#S4.p1.1)\.
- \[32\]W\. Wang, C\. Zhang, Z\. Tian, and S\. Yu\(2025\)FedU: federated unlearning via user\-side influence approximation forgetting\.IEEE Transactions on Dependable and Secure Computing22\(3\),pp\. 2550–2562\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1)\.
- \[33\]X\. Weng, R\. Pu, Y\. Yao, K\. Yue, Z\. Tang, and L\. Yu\(2026\)GDFA: geometry\-driven federated unlearning with directional task vector alignment\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 10346–10356\.Cited by:[8th item](https://arxiv.org/html/2610.31786#A1.I1.i8.p1.1),[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p4.1)\.
- \[34\]H\. Xiao, K\. Rasul, and R\. Vollgraf\(2017\)Fashion\-MNIST: a novel image dataset for benchmarking machine learning algorithms\.arXiv:1708\.07747\.Cited by:[Figure 2](https://arxiv.org/html/2610.31786#S4.F2),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p2.1)\.
- \[35\]Z\. Xiong, W\. Li, Y\. Li, and Z\. Cai\(2023\)Exact\-Fun: an exact and efficient federated unlearning approach\.In2023 IEEE International Conference on Data Mining \(ICDM\),pp\. 1439–1444\.Cited by:[3rd item](https://arxiv.org/html/2610.31786#A1.I1.i3.p1.1),[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1)\.
- \[36\]G\. Yan, H\. Wang, and J\. Li\(2022\)Seizing critical learning periods in federated learning\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.36,pp\. 8788–8796\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p2.1)\.
- \[37\]G\. Yan, H\. Wang, X\. Yuan, and J\. Li\(2023\)Criticalfl: a critical learning periods augmented client selection framework for efficient federated learning\.InProceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining,pp\. 2898–2907\.Cited by:[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p2.1),[§4\.1](https://arxiv.org/html/2610.31786#S4.SS1.SSS0.Px1.p1.1)\.
- \[38\]L\. Yi, H\. Yu, Z\. Shi, G\. Wang, X\. Liu, L\. Cui, and X\. Li\(2024\)FedSSA: semantic similarity\-based aggregation for efficient model\-heterogeneous personalized federated learning\.InProceedings of the Thirty\-Third International Joint Conference on Artificial Intelligence,pp\. 5371–5379\.Cited by:[§4](https://arxiv.org/html/2610.31786#S4.p1.1)\.
- \[39\]L\. Zhang, T\. Zhu, H\. Zhang, P\. Xiong, and W\. Zhou\(2023\)FedRecovery: differentially private machine unlearning for federated learning frameworks\.IEEE Transactions on Information Forensics and Security18,pp\. 4732–4746\.Cited by:[5th item](https://arxiv.org/html/2610.31786#A1.I1.i5.p1.1),[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§2](https://arxiv.org/html/2610.31786#S2.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1)\.
- \[40\]Z\. Zhong, W\. Bao, J\. Wang, S\. Zhang, J\. Zhou, L\. Lyu, and W\. Y\. B\. Lim\(2025\)Unlearning through knowledge overwriting: reversible federated unlearning via selective sparse adapter\.InProceedings of the Computer Vision and Pattern Recognition Conference,pp\. 30661–30670\.Cited by:[6th item](https://arxiv.org/html/2610.31786#A1.I1.i6.p1.1),[§1](https://arxiv.org/html/2610.31786#S1.p2.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p1.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p3.1),[§5\.1](https://arxiv.org/html/2610.31786#S5.SS1.p4.1)\.

## Appendix ADetails of Experimental Evaluation

### A\.1CNN Architecture for FMNIST

The CNN architecture used for FMNIST consists of two modules: a feature extractor and a classifier\. The feature extractor comprises three convolutional blocks\. The first block applies aConv2dlayer with 1 input channel and 32 output channels \(kernel size 3\), followed by Batch Normalization, ReLU activation, and aDropout2dlayer \(rate 0\.3\)\. The second block applies aConv2dlayer with 32 input channels and 64 output channels \(kernel size 3, stride 1\), followed by Batch Normalization, ReLU activation, and a2×22\\times 2max\-pooling layer\. The third block applies aConv2dlayer with 64 input and output channels \(kernel size 3\), followed by Batch Normalization, ReLU activation, a4×44\\times 4max\-pooling layer, and aDropout2dlayer \(rate 0\.2\)\. The resulting feature map of size64×3×364\\times 3\\times 3is flattened into a 576\-dimensional vector\. The classifier consists of a fully connected layer \(576→256576\\rightarrow 256\) with ReLU activation and Dropout \(rate 0\.1\), followed by a final linear layer \(256→10256\\rightarrow 10\)\. All convolutional and linear layers are initialized with Kaiming uniform initialization with zero biases\.

### A\.2Federated Unlearning Baselines

Below are details of state\-of\-the\-art FU approaches which are used to evaluate the efficacy and effectiveness ofPDF\.

- •Retrain\. As the gold\-standard unlearning baseline, Retrain removes the target clients entirely and trains from scratch on the remaining clients\. While this guarantees exact unlearning, it is prohibitively expensive in practice due to substantial computational overhead and reliance on the participation availability of all remaining clients\.
- •FedEraser\[[19](https://arxiv.org/html/2610.31786#bib.bib14)\]\. FedEraser approximates the retrained model without incurring its full cost by replaying periodic historical parameter updates cached from remaining clients through a calibrated aggregation procedure, achieving significant reductions in both time and storage overhead relative to full retraining\.
- •Exact\-Fun\(E\-F\)\[[35](https://arxiv.org/html/2610.31786#bib.bib15)\]\. Exact\-Fun \(E\-F\) leverages quantized FL to stabilize the global model, enabling exact unlearning with high efficiency\. Upon a deletion request, only the affected client retrains locally\. Retraining of the global model is triggered solely when the quantized model state changes, allowing many requests to be resolved with minimal overhead\.
- •CONDA\[[6](https://arxiv.org/html/2610.31786#bib.bib7),[7](https://arxiv.org/html/2610.31786#bib.bib8)\]\. CONDA is a server\-side unlearning method that eliminates a target client’s influence without client participation\. It tracks per\-client parameter contributions throughout training, estimates the forgotten client’s relative influence across model parameters, and applies a targeted dampening factor to parameters most strongly associated with the forgotten client\.
- •FedRecovery\[[39](https://arxiv.org/html/2610.31786#bib.bib23)\]\. FedRecovery is a server\-side unlearning method that does not require retraining\-based calibration and fine\-tuning\. It removes the target client’s accumulated gradient residuals from the trained global model cached from the learning phase\. It also injects calibrated Gaussian noise to mask the remaining distance between the recovered model and the ideal retrained model, thereby making the two models statistically indistinguishable\.
- •FUSED\[[40](https://arxiv.org/html/2610.31786#bib.bib1)\]\. FUSED confines unlearning to the most task\-critical layers identified during training, attaching lightweight sparse adapters exclusively to these layers and fine\-tuning them on remaining clients to overwrite the forgotten knowledge\. This design substantially reduces unlearning cost while preserving reversibility\.
- •FOUL\[[22](https://arxiv.org/html/2610.31786#bib.bib28)\]\. FOUL is an on\-server unlearning method that first disentangles the model into causal and non\-causal components during the learning\-to\-unlearn stage, and then performs unlearning on the domain\-specific non\-causal component\. In the unlearning stage, FOUL constructs an aggregated unlearning gradient by optimizing learnable coefficients over client gradients, encouraging alignment with retain\-client gradients while reducing alignment with target\-client gradients\. This design preserves retain\-client knowledge while removing forget\-client\-specific influence without requiring the server to access client data\.
- •GDFA\[[33](https://arxiv.org/html/2610.31786#bib.bib36)\]\. GDFA is a model\-manipulation\-based federated unlearning method that exploits loss\-landscape geometry and task\-vector alignment to improve unlearning under data heterogeneity\. Upon an unlearning request, GDFA constructs multiple perturbed models around the trained global model and fine\-tunes them on the forgetting data to derive task vectors representing the target knowledge; directionally consistent components are then merged through sign consensus and negated from the global model\. By operating around flatter loss regions, GDFA aims to improve robustness to parameter modification and preserve retained knowledge, but requires request\-time access to the forgetting data and incurs additional computation from generating and fine\-tuning multiple perturbed models\.