💻 computer science

An Empirical Study of Stability and Fairness Side-Effects of Federated Unlearning for Departed Clients under Non-IID Data

This paper empirically demonstrates that while federated unlearning methods are computationally efficient, they often induce significant stability and fairness side-effects for remaining clients under non-IID data, revealing a critical trade-off between cost, forgetting completeness, and equitable model performance that aggregate metrics fail to capture.

Original authors: Md. Sihabul Islam Islam, Abdullah Al Mamun, Muhammad Imran Khan, Md. Alamgir Hossain

Published 2026-08-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Md. Sihabul Islam Islam, Abdullah Al Mamun, Muhammad Imran Khan, Md. Alamgir Hossain

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your smartphone, your local hospital, and your bank all want to build a super-smart AI to help them, but none of them are allowed to share their private data. They can't send their medical records or bank statements to a central server because of privacy laws. Instead, they use a clever trick called Federated Learning. Think of it like a group of chefs in different kitchens trying to perfect a single secret recipe. Instead of sending their ingredients to a central pot, they each cook a small batch, taste it, and send only the instructions on how to improve the recipe to a head chef. The head chef mixes all the instructions together to make a better global recipe, then sends the new instructions back to everyone. Everyone gets smarter without ever revealing their secret ingredients.

But here's the twist: what if one of those chefs decides to quit the club? In the real world, privacy laws (like the "Right to Be Forgotten") say that if someone leaves, the system must not just delete their contact info; it must erase their influence on the recipe entirely. It's as if the head chef has to magically un-mix the instructions that specific chef contributed, without having to throw away the whole pot and start cooking from scratch again. This process is called Federated Unlearning. The big question is: when you magically erase one chef's contribution, does the recipe stay delicious for everyone else? Or does it suddenly taste weird, or worse, does it start favoring one type of dish over another, making some customers unhappy?

This paper is a massive, controlled experiment to find the answer. The researchers didn't invent a new way to erase data; instead, they acted like forensic scientists, testing several existing "unlearning" methods to see what happens to the remaining group when a client leaves. They set up a digital simulation with 10 different "clients" (like the chefs) and gave them data that wasn't perfectly mixed (some had mostly spicy food, others mostly sweet). They then kicked one client out and tried to unlearn their influence using four different techniques: a method called FedEraser, Projected Gradient Ascent (PGA), Fine-tuning (just keeping the training going), and Continue-to-Train (training a bit longer).

The results were surprising and revealed a hidden danger. The study found that some methods that look very cheap and fast—like just continuing to train or fine-tuning—actually do not remove the client's influence at all. They appear to have erased the client because the recipe didn't change much, but in reality, the influence remains. It's like trying to un-mix a cake by just stirring it faster; the ingredients are still there. The methods that actually removed the influence (FedEraser and PGA) did change the recipe, and that change came with a cost.

The biggest discovery was about fairness. The researchers found that while the average taste of the recipe stayed almost the same, the experience for specific groups of people changed wildly. When the data was very uneven (some clients had very different tastes than others), removing one client caused the recipe to become much worse for a few specific remaining clients, even though the overall score looked fine. It's like if removing one chef's instructions made the soup perfect for 9 people but completely inedible for the 10th. Furthermore, if the chef who left was holding a rare or unique type of data (like a specific rare spice), removing them caused the recipe to become significantly unfair to certain demographic groups, shifting the balance in unpredictable ways.

The study also measured how "hard" it was to unlearn based on when the client left. If a client left early in the process, it was cheap to remove them. But if they stayed until the recipe was almost perfect, removing them became seven times more expensive and disruptive. Interestingly, the researchers found that using a more sophisticated mixing protocol (FedProx) didn't fix these fairness problems; the issues were baked into the nature of the unlearning itself, not just the mixing method.

In short, the paper warns us that "unlearning" isn't free or invisible. If you use a method that doesn't truly erase the data, you aren't protecting privacy. But if you use a method that does truly erase the data, you might accidentally hurt the remaining users, especially if the data is messy or if the person leaving was unique. The authors conclude that we need to stop just looking at the "average" score of the AI and start checking if the unlearning process is making things unfair for specific groups, ensuring that honoring a "Right to Be Forgotten" doesn't silently punish the people who stay.

Technical Summary: An Empirical Study of Stability and Fairness Side-Effects of Federated Unlearning for Departed Clients under Non-IID Data

1. Problem Statement

Federated Learning (FL) enables collaborative model training without centralizing raw data, but privacy regulations (e.g., GDPR, HIPAA) mandate the "Right to Be Forgotten" (RTBF). This requires Federated Unlearning (FU): the removal of a departing client's influence from a global model. While existing research focuses on optimizing the efficiency and completeness of unlearning, it largely overlooks the collateral effects on the remaining clients.

Specifically, when a client is unlearned, the resulting perturbation to the global model may not be distributed evenly. Under Non-IID data (where client data distributions differ significantly), this perturbation could:

Degrade overall model quality (Stability Cost).
Disproportionately harm specific remaining clients or demographic groups (Fairness Cost), potentially amplifying bias against under-represented groups.

Current literature lacks an empirical understanding of who bears these costs and how they scale with data heterogeneity, client profiles, and unlearning methods. This paper addresses this gap through a controlled measurement study rather than proposing a new unlearning algorithm.

2. Methodology

Study Design

The authors conducted a factorial measurement study sweeping across:

Datasets: Two tabular datasets with sensitive attributes (Adult, COMPAS) and two image datasets (MNIST, CIFAR-10).
Heterogeneity: Controlled via Dirichlet label-distribution skew ( $\alpha \in \{10, 1, 0.5, 0.1, 0.05\}$ ), ranging from near-IID to extreme skew.
Departed Client Profiles: Typical, Rare-Pattern (holding under-represented intersections), Large (high data volume), and Small.
Unlearning Methods: FedEraser, Projected Gradient Ascent (PGA), Fine-tuning, Continue-to-train, and a Retrain-from-scratch reference (the gold standard).
Aggregation Protocols: FedAvg and FedProx.
Departure Timing: Early departure vs. Near-convergence departure.

Evaluation Framework

The study compares three models for every configuration:

$M_{orig}$ : The base model trained with all clients.
$M_{unl}$ : The model produced by the unlearning operator.
$M_{ret}$ : The Retrain Reference, trained from scratch on the remaining clients only. This serves as the counterfactual anchor.

Key Metric Categories:

Forgetting Verification (Precondition): Before interpreting costs, the study verifies that unlearning actually occurred. It uses a Backdoor Attack Success Rate (ASR) probe (implanted in the departed client) and Membership Inference Attacks (MIA). A method is only considered valid if it reduces the ASR to the level of the retrain reference ( $M_{ret}$ ).
Stability: Measured by output divergence (KL divergence) between $M_{unl}$ and $M_{ret}$ , accuracy gaps, and calibration error.
Performance Fairness: Measured by the dispersion ( $\sigma_{cl}$ ), worst-case accuracy ( $a_{min}$ ), and range ( $\Gamma$ ) of per-client accuracies among remaining clients.
Group Fairness: Measured by shifts in Demographic Parity (DP) and Equalized Odds (EO) gaps relative to $M_{ret}$ .

3. Key Contributions

Unified Measurement Protocol: The paper establishes a reproducible benchmark for FU side-effects, anchored to a from-scratch retrain reference and integrating forgetting verification with stability and fairness metrics.
Empirical Characterization: It provides a broad characterization of how unlearning costs vary across methods, datasets, and controlled non-IID conditions, specifically isolating the impact of client profiles and heterogeneity.
Identification of Hidden Trade-offs:
- Stability–Fairness–Forgetting Trade-off: The study reveals that aggregate metrics (like global accuracy) mask concentrated harm. A model can appear stable globally while severely degrading performance for specific clients or groups.
- Efficiency vs. Forgetting: The paper demonstrates that "cheap" methods (Fine-tuning, Continue-to-train) often appear efficient only because they fail to unlearn. Conversely, methods that truly remove influence (FedEraser, PGA) incur higher stability costs.
Practical Guidance: The authors distill evidence-based guidelines for selecting FU methods based on heterogeneity levels and fairness requirements, releasing code and configurations to support fairness-aware FU research.

4. Key Results

Forgetting Verification

FedEraser and PGA successfully removed planted backdoor influences, reducing ASR to the retrain reference level.
Fine-tuning and Continue-to-train failed to remove the influence; their low ASR reduction indicated they merely continued training on remaining data without erasing the departed client's specific contribution.
Conclusion: Cost metrics are meaningless without a verified forgetting gate.

Stability and Heterogeneity (RQ1 & RQ4)

Heterogeneity Impact: Stability costs (measured by KL divergence) grow monotonically with data skew. At extreme skew ( $\alpha=0.05$ ), the cost is roughly 100x higher than in near-IID settings.
Client Profile Impact: Removing a Large or Rare-Pattern client is significantly more expensive (up to 56x drift) than removing a typical or small client.
Timing: Departures occurring near convergence are ~7x more expensive than early departures due to the dilution of influence over time.

Aggregate vs. Distributed Harm (RQ2)

Aggregate Stability Masks Concentrated Harm: Global accuracy often remains nearly preserved (e.g., $\Delta Acc \approx 0.018$ ), but the per-client accuracy dispersion ( $\sigma_{cl}$ ) can be massive (e.g., 0.428).
Implication: Operators monitoring only global accuracy will miss severe degradation affecting a minority of remaining clients.

Group Fairness (RQ3)

Rare-Pattern Departures: Unlearning a client holding a rare pattern (e.g., minority sensitive group intersection) causes large, unpredictable shifts in group fairness gaps (DP and EO).
Directionality: The direction of the shift (widening or narrowing bias) is dataset-dependent and cannot be predicted by stability metrics.
Independence: Group fairness harm does not necessarily co-occur with stability harm; a system can be stable globally but unfair to specific groups.

Aggregation Protocol

FedProx vs. FedAvg: The measured side-effects persisted unchanged under FedProx. This indicates the costs are inherent to unlearning under heterogeneity, not artifacts of the FedAvg aggregation mechanism.

5. Significance and Claims

The paper claims to expose a stability–fairness–forgetting trade-off that is hidden by aggregate metrics. Its primary significance lies in:

Correcting Misconceptions: It challenges the assumption that low-cost unlearning methods are efficient. It argues that low cost often signifies non-removal, while effective removal incurs real stability costs.
Operational Risk: It highlights that honoring RTBF requests can silently degrade service for specific remaining institutions or amplify bias against protected groups, risks that are invisible to standard monitoring.
Foundation for Future Work: By providing an open evidence base, the paper argues that designing "fairness-aware unlearning" methods requires first understanding these collateral costs. It posits that future methods must not only pass a forgetting gate but also redistribute residual errors to prevent concentrated harm.

The authors remain modest about the scope, noting that their findings are based on small, interpretable models and cross-silo settings with full participation. However, they assert that the qualitative structure of the findings (the trade-offs and the masking of concentrated harm) is robust across datasets and aggregation protocols.