FedUP: One-Shot Federated Unlearning via Centroid-Guided Plug-in Filters

1 Introduction

Background. As a distributed machine learning paradigm, federated learning (FL) [McMahan et al., 2016; Truong et al., 2021; Zhong et al., 2022; Qi et al., 2024; Zhong et al., 2025a; Fu et al., 2025b; Jiang et al., 2026] has gained significant attention in privacy-sensitive scenarios recently because it eliminates the need for centralizing raw data during training. However, during the training process, the global model internalizes client information into its parameters through multiple rounds of parameter aggregation, which exposes novel privacy risks when the model is confronted with legal mandates such as the right to be forgotten under GDPR [de la Torre, 2018]. To address this, researchers have focused on Federated Unlearning (FU), aiming to remove specific knowledge Figure 1: FedEraser, a representative server-side method, shows noticeable non-target knowledge loss after unlearning across multiple tasks. Client-side methods like FUSED experience significantly longer convergence times as task difficulty increases, with responses up to 5 minutes indicating severe unlearning request latency.

∗Corresponding Author

without retraining the global model from scratch. Existing FU methods generally follow two main technical paradigms: server-side FU methods [Wu et al., 2022; Huynh et al., 2025; Pan et al., 2025], which implement approximate unlearning [Yang et al., 2025] on the global model at the server side; and client-side FU methods [Wang et al., 2023b; Liu et al., 2022; Zhu et al., 2023; Zhong et al., 2025b], which achieve exact unlearning [Kuo et al., 2025] through iterative client-side model retraining procedures.

Existing Challenges. While current Federated Unlearning (FU) methods facilitate knowledge removal to various extents, challenges regarding non-target knowledge loss and unlearning request latency still remain. As depicted in Figure 1, server-side FU methods lack precise control over the unlearning scope, frequently incurring non-target knowledge loss, where the model performance unrelated to the unlearning request is inevitably impaired during knowledge removal. Conversely, although client-side FU methods achieve exact unlearning via retraining-based approaches, they are heavily constrained by multi-round training and communication, leading to high request latency. To date, it is hard to find a solution that simultaneously ensures rapid response and prevents non-target knowledge loss. Moreover, both server-side and client-side FU paradigms typically rely on direct modification of original model parameters, which leads to the irreversibility of unlearning. Once the unlearning process is finalized, restoring previously removed knowledge necessitates further parameter tuning or retraining, thereby imposing complexity and additional overhead on practical deployment.

Proposed Solution. To this end, we propose FedUP, a oneshot federated unlearning framework based on lightweight pluggable filters. In terms of mitigating non-target knowledge loss, the framework avoids performing direct, large-scale parameter updates on the global model; instead, it implements unlearning by introducing independent pluggable filters while keeping original model parameters frozen (shown in Figure 2). These filters serve as a "knowledge funnel" that screens out target knowledge and permits only non-target knowledge to pass, thereby reducing the interference of unlearning on non-target knowledge. To lower unlearning request latency, FedUP only needs to perform a few rounds of fine-tuning on the lightweight filters at the server side using differential privacy (DP)-protected class centroid samples to complete the unlearning task. This bypasses multi-round retraining and frequent communication with clients, significantly accelerating the response speed. Moreover, since the filters are pluggable, the framework inherently supports reversibility. As depicted in Figure 2, when restoration of forgotten knowledge is required, it can be achieved simply by removing the filters. Overall, FedUP provides a solution that balances precision, efficiency, and recoverability.

Contributions. The main contributions are as follows:

• We design FedUP, a one-shot FU framework utilizing DP-protected class centroids, mitigating non-target knowledge loss and reducing unlearning request latency fromminutes to seconds.
• We propose a reversible unlearning mechanism via lightweight pluggable filters without altering original model parameters while ensuring rapid transitions between unlearned and pre-unlearning states.
• We conduct differential privacy analysis showing that appropriate noise protects class centroid samples while minimally impacting data utility. Extensive experiments on image and text tasks confirm FedUP's effectiveness across various scenarios.

2 RelatedWork

Machine Unlearning. Simply removing training data from storage fails to purge its influence on deployed models. Machine Unlearning (MU) [Ma et al., 2022] is thus introduced to erase such learned knowledge. Existing methods are categorized as either exact [Cao et al., 2018] or approximate unlearning [Golatkar et al., 2020]. Exact unlearning mandates that the post-forgetting model be statistically indistinguishable from one retrained from scratch without the deleted data. It retains the guarantees of complete retraining but lowers its cost via algorithmic shortcuts. For classical models, the training process can be expressed in an invertible additive form, enabling point removal by subtracting its closed-form term [Cao et al., 2018]. For complex architectures, exact unlearning employs data sharding [Bourtoule et al., 2021], localized retraining [Chen et al., 2022], or intermediate checkpointing [Wang et al., 2023a] to reduce computation while preserving retraining-level guarantees. Approximate unlearning, in contrast, substitutes full retraining with lightweight fine-tuning, permitting a bounded, residual influence from the deleted data. Related work is typically grouped into data-driven and model-driven approaches [Nguyen et al., 2025]. Data-driven methods involve relabeling retained samples [Graves et al., 2021] or partitioning data shards [Gupta et al., 2021] before fine-tuning. Model-driven approaches adjust parameters directly via influence functions [Guo et al., 2019], fisher-based regularization [Golatkar et al., 2020], or knowledge distillation [Kurmanji et al., 2023], countering the gradient contributions of the data to be erased.

Federated Unlearning. Though federated learning maintains client privacy through local retention, knowledge from distributed datasets persists in the aggregated global model. This requires integrating MU techniques into FL, named federated unlearning (FU) [Wang et al., 2022]. Based on the execution location, FU methods can be categorized into serverside and client-side methods [Liu et al., 2024; Li et al., 2025]. Server-side methods are intrinsically based on approximate unlearning to expunge client contributions without client involvement. FedEraser [Liu et al., 2021] calibrates update trajectories but still requires auxiliary retraining. Conversely, Wu et al. [Wu et al., 2022] bypass client-side computation by subtracting historical updates and employing knowledge distillation. To optimize efficiency, Huynh et al. [Huynh et al., 2025] utilize selective retention of influential updates to reduce memory overhead, while Pan et al. [Pan et al., 2025] resolve parameter conflicts via Orthogonal Steepest Descent to accelerate the unlearning process. Client-side FU methods perform unlearning locally, striving to achieve exact unlearning while balancing computational efficiency with global model utility. Mora et al. [Mora et al., 2024] propose FedUNRAN, utilizing local random label perturbations to disperse target gradients and attenuate their influence without server-side intervention. Wang et al. [Wang et al., 2023b] employ variational Bayesian inference for parameter selfsharing to erase target data while preserving performance. To accelerate unlearning, Liu et al. [Liu et al., 2022] approximate the Hessian via a diagonal empirical Fisher Information Matrix for quasi-Newton optimization, while Zhu et al. [Zhu et al., 2023] combine inverse perturbation with passive decay, propagating updates via knowledge distillation. Furthermore, Deng et al. [Deng et al., 2024] introduce model contrastive unlearning (MCU) to regularize the feature space. Zhong et al. [Zhong et al., 2025b] implement reversible unlearning through local fine-tuning.

In summary, existing unlearning approaches typically involve trade-offs between unlearning precision and computational efficiency, and often suffer from limited generalization. Moreover, reversibility is rarely considered in current studies. Achieving a unified balance among unlearning precision, efficiency, and reversibility therefore remains an open challenge.

3 Methodology

3.1 ProblemDescription

In the FL framework, a set of clients denoted as C = {C1, C2, . . . , CN} collaboratively train a global model MG without sharing local data. Each client Cn trains a local model Mn using its local dataset Dn and uploads the model parameters to a server. The server aggregates these local models via weighted averaging based on dataset sizes to obtain a global model MG. This process iterates over W global rounds, where each global round comprises e local training epochs on the clients with a local learning rate lc. MG is structurally decomposed into a feature extractor ME and a classifier Mcl. After aggregation, MG is distributed back to all clients, where the feature extractor ME is leveraged to extract features from local data. Additionally, a pluggable filterMFi is constructed to implement the filtering of knowledge that needs to be forgotten. The overall dataset is denoted as D = {Dn}Nn=1 , where Dn represents the local dataset of client Cn. The total data volume across the federation is ∥D∥ = ∑Nn=1 ∥Dn∥. To facilitate data management, particularly for future unlearning operations, each local dataset Dn is partitioned into two disjoint subsets: a retained subset DR n for model training, and an unlearning subset DU n designated to be removed in compliance with privacy or regulatory constraints. Let k ∈ {1, 2, . . . ,K} index the data categories, where K is the total number of classes.

In the FL phase, the training objective is defined as:

where L denotes the loss function. During the FU phase, the objective is to maximize the loss on the unlearning set, minimize the loss on the retained set, and keep the training cost low, described as:

where Comm represents the communication resource between the server and the clients C during each round.

3.2 Method Overview

As shown in Figure 3, our method comprises four phases: federated learning, generation of class centroid samples, oneshot federated unlearning, and inference, with each stage's main procedures and key formulas shown in the diagram.

Feature Extraction

Each client Cn performs e rounds of training on its local dataset Dn, resulting in an updated local model Mw,e n . The local training process can be expressed as:

where L represents the local loss function and ∇θL denotes its gradient with respect to the model parameters.Subsequently, the server collects the local modelsMw,e n from selected clients Cn and updates the global model through a weighted average:

The trained global model MG is regarded as a combination of a feature extractor ME and a classifier Mcl. After freezing this composite model, it is deployed to the clients. The features of all data Dn from each client Cn are extracted by the feature extractor ME, which can be represented as follows:

where V k n denotes the feature embedding of the data belonging to class k on client Cn.

Generation of Class Centroid Samples

Upon receiving an unlearning request, client Cn removes the features associated with the unlearning data. The remaining feature embeddings belonging to class k are denoted as:

To reduce communication cost, the retained features are compressed via KMeans clustering with

the number of clusters is set proportionally according to the scenario by ρ, yielding a compact set of centroids:

For privacy preservation, add noise to each centroid:

Here, N(0, σ2 I) represents a multivariate Gaussian distribution. These mechanisms ensure that the release of ˜µR,k n does not reveal excessive information about any individual data point. Client Cn then uploads all perturbed class centroids ˜µR,k n to the server. Using the local class centroids ˜µR,k n , the server aggregates them to generate the global class centroids ˜µR,k G . The global class centroid is denoted as:

One-shot Federated Unlearning

The objective of the FU phase is to train the filter MFi such that it effectively blocks the flow of unlearning knowledge while allowing the retained learning knowledge to pass. The specific steps and formulas are as follows.

A filter MFi is inserted into the global model MG = ME ⊕Mcl, yielding a new model structure:

Subsequently, the parameters of the global model MG including bothME andMcl are frozen:

The filter MFi is trained using the global class centroids ˜µR,k G . The filtered class centroid prediction is defined as:

We propose a composite loss function for the filter consisting of cross-entropy and reconstruction losses. It preserves discriminative capability on non-target knowledge while enforcing structural consistency in the feature space, thereby improving the stability of the unlearning process without compromising knowledge selectivity. The cross-entropy loss, measuring the difference between predicted class probabilities and true labels, is defined as:

where yk represents the true label while ˆ yk denotes the corresponding predicted probability for class k. The reconstruction loss, which measures how well the filter reconstructs its input, is defined as:

where d is the input and output dimensionality of the filter. The total loss function used to train the filter MFi is a weighted sum of these two losses:

where α is a weighting factor that balances the importance of the cross-entropy loss and the reconstruction loss. Train the filter for Wa rounds with a learning rate la. The update process is as follows:

When a client requests the restoration of forgotten knowledge, the filterMFi can be removed, thereby reverting to the original global model MG:

Differential Privacy Guarantee

Our framework injects Gaussian noise for privacy guarantee during client-side centroid uploads, satisfying (ε, δ)-DP. The key is to calibrate the noise scale σ according to the desired privacy budget and the ℓ2-sensitivity, which is bounded by:

We set σ ≥ √2 ln(1.25/δi)·∆2fi εi with δi = 1/ni. Empirical εi values (Table 1) confirm moderate privacy budgets ε ≈ 10 [Wei et al., 2020] for all datasets under specified σ. We calculate our differentially private guarantee as:

Algorithm 1: FedUP

Input: Number of global rounds W, local rounds e, local learning rate lc, adapter learning rate la, clients C = {C1, C2, . . . , CN}, dataset D = {Dn}Nn=1 Output: FilterMFi / * Feature extraction * / MG = ME ⊕ Mcl for global round w = 1 to W do Server sends MwG to all clients Cn for each client Cn do Cn performs e local training rounds: θw,e Mn = θwMn - lc · ∇θL(Mn, Dkn ) θw+1 MG = ∑Nn=1 |Dn| |D| θw,e Mn / * Generation of class centroid samples * / for each client Cn do V k n =ME(xki ), xki ∈ Dn V ′kn = V k n \ {ME(xki )|xki ∈ DU n } µR,k n = KMeans(V R,k n ,Kn,k) Generate ˜µR,k n via Eq. (11) / * One-shot federated unlearning * / M′G = ME ⊕MF i ⊕Mcl Freeze parameters of MG: θMG = θ∗MG Train filterMFi using ˜µR,k G via Eq. (18) and Eq. (19) / * Restoration * / Remove filter: MF i: MG = ME ⊕ Mcl

The final choice of the optimal σ is determined via σ = q · s, with the corresponding values of q and s established accordingly. Detailed analysis and supporting experiments are relegated to Section 2.1 and 2.2 of the supplementary material.

3.3 Algorithm

The algorithm, as illustrated in Algorithm 1, consists of three stages: feature extraction, generation of class centroid samples µR,k n and one-shot federated unlearning. Upon receiving an unlearning request, each client first removes the corresponding data points from its local feature set and computes class centroid samples using the retained data. These centroids are then protected by a differential privacy mechanism and uploaded to the server. The server aggregates the uploaded centroids from all clients to obtain global retained class centroids as ˜µR,k G . Then the server freezes the parameters of the original global model MG and randomly initializes a lightweight, pluggable filter MFi, which is trained solely using the global differentially private centroids. By jointly optimizing a cross-entropy loss and a reconstruction loss Ltotal, the filter blocks the propagation of forgotten knowledge while preserving the discriminative capability of retained knowledge. Finally, when restoration of forgotten knowledge is required, the filter can be removed to revert to the original global model structure, enabling efficient and reversible federated unlearning.

4 Experiment

4.1 Experimental Setup

We conducted experiments on diverse datasets, including MNIST[LeCun et al., 2002], CIFAR-10, CIFAR-100 [Krizhevsky et al., 2009], and AG News[Zhang et al., 2015]. We partitioned the dataset using the Dirichlet distribution [Li et al., 2022] with a concentration parameter of 0.5. These experiments use various network architectures, including LeNet-5, ResNet-18 [He et al., 2016], ResNet-34, Transformer [Vaswani et al., 2017] and TinyBert[Jiao et al., 2020], covering three unlearning scenarios: client unlearning, class unlearning and sample unlearning. We evaluated five baselines: EraseClient [Halimi et al., 2022], Federaser [Liu et al., 2021], Exact-Fun [Xiong et al., 2023], Retrain and FUSED [Zhong et al., 2025b]. The experimental framework is implemented using PyTorch 2.3.1 and CUDA 12.1. For hardware acceleration, an NVIDIA RTX 3080 Ti GPU is utilized. We employ SGD and Adam optimizers. The balancing factor α for the loss of filters is set to 0.5. During the generation of sample centroids via clustering, we set different sampling ratios ρ to accommodate various scenarios. In the client, class, and sample scenarios, the sampling ratios are 0.8, 0.1, and 0.5, respectively.

Evaluation Metrics. As shown in Table 2, we evaluate our proposed method and the baselines using multiple metrics.

4.2 Experimental Results

Main Results. In the client unlearning setting, Byzantine attacks are introduced, where label flipping is applied to construct inverse feature prototypes [Fu et al., 2025a; Qi et al., 2023]. Class unlearning randomly remaps the feature labels of the target class to several classes. Sample unlearning is implemented via backdoor attacks: fixed triggers are injected into the bottom-right pixels of images or appended as specific trigger tokens to the end of text sequences. During the unlearning process, all triggered samples are consistently predicted as class 0, thereby yielding accuracy of class 0 (0A) on the forgotten samples.

As shown in Table 3, our method achieves superior performance across a wide range of datasets, model architectures, and unlearning scenarios. Among them, CIFAR-100 is the most challenging benchmark, while MNIST is the least. Benefiting from the pluggable filters, FedUP reduces the accuracy on the unlearning knowledge to a minimal level (F-A) while maintaining high accuracy on the retained data (R-A). Owing to its centroid-based unlearning mechanism, FedUP exhibits particularly strong performance in class unlearning scenarios. Overall, the proposed method supports single-round communication and reversible unlearning, achieving the desirable triad of high retention accuracy, low forgetting accuracy, and privacy guarantees across all evaluated datasets.

Analysis of Non-target Knowledge Loss. To validate the effectiveness of our method in mitigating non-target knowledge loss, we compare the accuracy on retained knowledge before and after executing the unlearning operation. As shown in Figure 4, FedUP achieves an effect comparable to the Retrain method, characterized by minimal non-target knowledge loss and stable model performance before and after the unlearning operation.

Unlearning Response Time. As shown in Table 4, when achieving the desired forgetting effect, our method requires only 6.33 seconds for image unlearning and 6.45 seconds for text unlearning, which is less than 10% of the latency of the second-best method and less than 1% of that of the Retrain approach. It can promptly respond to diverse unlearning requests across different modalities while maintaining consistently low latency, effectively minimizing processing delays.

Communication Cost. Communication cost is defined as the wireless resources consumed for transmitting model parameters or gradients between local clients and the central server. As shown in Table 4, although the centroid uploading phase introduces additional communication overhead, FedUP requires only a single communication round, meaning its communication cost does not accumulate with rounds. In contrast, model transmission methods gradually converge as rounds increase, causing the communication overhead to escalate to the order of 103 . Specifically, the lightweight filter incurs an overhead of merely 11.50MB for image unlearning, approximately one-third of that of the second-best method and 6.73MB for text unlearning, which is second only to the FUSED method.

4.3 Analysis of Hyper-parameters

Bottleneck Dimension. In this section, we analyse the dimension of the filter. The pluggable filter adopts a straightforward encoder-decoder architecture. Its input dimension is configured to match the output dimension of the feature extractor. Our empirical investigation focuses on determining the optimal bottleneck dimension within this encoderdecoder structure. As shown in Table 5, the remember accuracy consistently reaches its optimum across both image and text datasets when the bottleneck dimension is set to 32.

Sensitivity Analysis of the Loss Function. The filter is trained with joint reconstruction and cross-entropy losses. We performed a sensitivity analysis on α of Ltotal to determine its optimal value. As shown in Figure 5, using either loss alone hinders convergence and degrades the accuracy of retained knowledge, whereas their combination maximizes the reduction of non-target knowledge loss. This is further illustrated in Table 6, which shows that increasing the weight of the cross-entropy loss lowers the recognition accuracy on retained data, while assigning a higher weight to the reconstruction loss deteriorates the unlearning effectiveness.

4.4 Ablation Study

Analysis of Differential Privacy Effects. To ensure privacy preservation, Gaussian noise is injected into the generated class centroids. We conducted ablation studies to evaluate its impact, as shown in Table 7. The results demonstrate that an appropriately calibrated noise scale does not significantly impede the model's performance on non-target knowledge. Instead, it enhances model robustness, achieving a synergistic improvement in both privacy protection and model utility.

Effectiveness of Class Centroid Samples. Class centroids are obtained by clustering original features and privately aggregated on the server side. To validate the effectiveness of class centroid samples, we additionally conduct experiments in which the filter is trained using only the original features. As illustrated in Table 8, the model trained on class centroid samples achieves comparable performance on the accuracy of retained and unlearning knowledge to that trained on the original features, demonstrating that class centroid samples are as effective as the original features.

5 Conclusion and Discussion

Conclusion. In the field of FU, server-side methods face non-target knowledge loss, whereas client-side methods incur high request latency. Both are limited by the irreversibility of the unlearning operation. To address these issues, this paper proposes a one-shot federated unlearning framework. By employing differentially private class centroid samples on the server, our approach achieves approximate unlearning that surpasses exact unlearning in effect, reducing non-target knowledge loss and high resource overhead. Through finetuning a lightweight plug-in filter in a single round, the desired unlearning effect is achieved, significantly reducing the latency of unlearning responses. Removing the filter allows the model to revert to its pre-unlearning state, thus realizing the reversibility of unlearning. Extensive experiments across diverse datasets, scenarios, and models demonstrate that FedUP demonstrates excellent performance.

Discussion. While FedUP advances unlearning efficiency, reversibility, and responsiveness, two fundamental limitations still persist: Class centroid fidelity depends on federated feature extraction. Low-quality global models propagate bias into aggregated class centroids. It is expected that these limitations can be effectively addressed by utilizing more powerful pre-trained backbones for local feature extraction to ensure reliable class centroids.

Contribution Statement

Feihong Nan and Zhengyi Zhong contributed equally.