Continuous verification method for forgotten right of federal restoration learning client

Abstract

The invention discloses a continuous verification method for the forgotten right of a federal reduction learning client, and the method comprises the steps: embedding an EndoraMark mark in the data of a forgotten client, tracking the performance of a global model in a plurality of training rounds, and guaranteeing that whether the data of the federal reduction learning client is successfully forgotten or not can be accurately verified. According to the method, the forgetting effect is evaluated by adopting the backdoor attack, and the potential privacy leakage problem is avoided. According to the method, an improved scaling strategy and an imprint enhancement data enhancement method are introduced, the durability of the private imprint in the federated learning model is enhanced, the influence of model benign updating on imprint dilution is reduced, and verification of the forgetting right of the client side still has high effectiveness in long-term model training.

Description

Technical Field

[0001] The present invention relates to federated learning technology, and in particular to a method for continuously verifying the right to be forgotten of a federated restoration learning client. Background Art

[0002] Federated learning is a distributed machine learning method designed to protect data privacy. It allows multiple participants to jointly train models without sharing original data. Although federated learning can theoretically reduce the risk of data leakage, with the increase in data privacy requirements, how to effectively delete specific data from the trained global model has become a new challenge. Federated reduction learning came into being to provide privacy protection for data subjects and ensure that their data can be completely removed from the model when requested to be deleted. In order to meet the compliance requirements of the "right to be forgotten", the goal of federated reduction learning is to ensure that the impact of the specified customer's data on the model is completely eliminated while maintaining the model performance. This can be done by completely reinitializing the model and retraining it with the remaining customers' data, or by adjusting the model parameters and decision boundaries to minimize the residual impact of the deleted data on the model.

[0003] Existing federated reduction learning methods mainly focus on evaluation from the perspective of the global model, while ignoring the needs of clients that have exited the federated learning process. These methods usually quantify the forgetting effect by calculating the "forgetting rate" (Rate of Unlearning, ROU), but cannot provide a means for the exiting clients to independently verify whether their data has been effectively removed. In addition, among the existing reduction learning evaluation indicators, one possible evaluation method is to implement it through membership inference attack (MIA). MIA is mainly used to determine whether a data sample exists in the training data set of the model, and usually uses indicators such as accuracy, recall, and precision to quantify the degree of forgetting of the model. However, under the federated learning framework, since different clients may have similar data distributions, MIA is difficult to accurately identify which specific client the forgotten data comes from. In addition, MIA may also lead to privacy leakage of training data.

[0004] To address these issues, another approach is to use a backdoor attack. Unlike MIA, a backdoor attack implants specific "triggers" in part of the training data so that the model can exhibit specific, controllable behaviors when encountering these triggers. In federated reduction learning, a backdoor attack generates unique triggers for clients that make forget requests, trains them together with the training data, and then aggregates the client parameters and submits them to the central server. The degree of "forgetting" of the data is evaluated by observing the model's response to the trigger before and after forgetting learning, that is, the accuracy on the backdoor task.

[0005] However, in the framework of federated learning, there are many challenges in verifying the forgetting effect of federated reduction learning based on backdoor attack methods. Each aggregation and update of federated learning will cause the parameters of the global model to change, which may cause catastrophic forgetting of triggers and lead to inaccurate data forgetting verification indicators. Summary of the invention

[0006] Purpose of the invention: The purpose of the present invention is to address the deficiencies in the prior art and to provide a method for continuous verification of the right to be forgotten of a federated restoration learning client.

[0007] Technical solution: The method for continuous verification of the right to be forgotten of the federated restoration learning client of the present invention involves two types of entities: a central server and several clients, and includes the following steps:

[0008] Step 1: Inject permanent marks;

[0009] For the data to be sent to the central server by the client participating in the restoration learning, the global imprint of the data is first generated into different local imprints using the extended local imprint combination method, and then the different local imprints are combined and extended using the local trigger generation strategy, and then the combined and extended permanent private imprint is injected into the data. In the central server aggregation stage, the client updates containing private imprints are scaled and adjusted;

[0010] Step 2: Train federated restoration learning on each forgotten client;

[0011] The central server selects N client sets C = {C1, C2, ..., Ci..., Cn} to participate in the federated learning training. Each client saves a different local data set D = {D1, D2, ..., Di..., Dn}, i∈{1, 2, ..., n}. In each round of federated learning training, a certain proportion of misclassified samples are added for training. The samples contain the private imprint obtained in step 1, and then the imprint is injected into the local model.

[0012] Here, the client that makes a data deletion request is called a forgotten client. Assume that the forgotten client Cn initiates a deletion request. For federated restoration learning, the global model G is deleted. t The influence of all updates of client Cn in the model is eliminated, thereby eliminating the influence of client Cn’s local data Dn on the final global model and outputting a final model F u , as if the client Cn has never participated in the federated learning training process;

[0013] Step 3: Verify the forgotten client;

[0014] By determining whether data with private imprints can be activated, it helps the forgetting client verify whether the detection center server complies with the data deletion request, such as Figure 1 As shown in the figure, after the model is trained with the imprinted client, the imprint features exist in the model. Therefore, we can use it to detect whether the request of the forgotten client is followed.

[0015] In order to effectively verify the execution of the forgotten client's deletion request, the present invention injects a private imprint into the data of each forgotten client before the client sends the data to the central server, and changes the source label of the data to the target label. In order to enhance the persistence of the private imprint, a set of extended local imprint combinations is constructed to ensure that the global model can learn a more complete backdoor pattern, so that even after multiple rounds of model iteration and update, a high attack success rate can be maintained. On the basis of the private imprint optimization, a scaling strategy is also introduced in the central server aggregation stage to appropriately scale and adjust the client updates containing the private imprint, thereby improving the stability and persistence of the private imprint and keeping it valid for a longer time in the model.

[0016] Furthermore, the specific process of injecting the permanent mark in step 1 is:

[0017] Step 1.1, generate imprint;

[0018] Divide the global imprint into multiple local imprints, and use the combination method to permute and combine all local imprints to generate different local imprints, and distribute them to each forget client for training according to the distributed attack setting;

[0019] Step 1.2: local trigger generation strategy, i.e. generating diversified imprint combinations by combining different triggers;

[0020] For a total of M forgotten clients, the total number of local triggers corresponding to them is LT. It is necessary to infer m combinations of imprints and obtain better partitioning of triggers by optimizing the combination algorithm: while ensuring the validity of private imprints, minimize the trigger partition granularity m and the combination size k. Solve:

[0021]

[0022] In the above formula, M represents the number of clients that need to be forgotten, m represents the granularity of the global trigger partition, that is, it is divided into m basic units, and k represents the combination size of the local trigger, that is, k units are selected from m units for combination;

[0023] First, find the minimum value of m such that any selection from the m parts can generate enough unique combinations to distribute to all M forgotten clients;

[0024] Then calculate the combination of triggers: divide the global trigger into m different units, and generate local triggers with different units in different combinations. The expression is as follows:

[0025]

[0026] Step 1.3, inject the imprint;

[0027] In the tth round of communication, the central server sends the current shared model G t Sent to N selected participants, the selected participant i will use the optimization algorithm to perform local training locally to obtain a new local model The local parties will then update the model;

[0028] After receiving the model update, the central server uses its own learning rate to average all updates to generate a new global model G t+1 , as shown below:

[0029]

[0030] The injected private imprint uses the coefficient η to amplify the weight of the backdoor model to ensure the effectiveness of the private imprint when it is triggered. The global model at this time is expressed as:

[0031]

[0032] Furthermore, in order to ensure the security of personal data of users during the federated learning training process, the present invention allows the deletion of data contributions of specific clients from the global model during federated learning, and grants the client the right to be forgotten. The goal is to forget the impact of certain client data on the global model as much as possible while still maintaining the overall performance of the model, so as to ensure that even if some client data is deleted, the global model can still maintain a high performance, thereby effectively protecting the user's data privacy; the updated model expression in step 2 is as follows:

[0033]

[0034] Where p represents the number of remaining clients (excluding forgotten clients), t represents the current tth round of communication, Represents the local model of client i in the tth round of communication.

[0035] Furthermore, when verifying the forgotten client in step 3, the definition of the forgotten degree of the forgotten client is as follows:

[0036] The forgetting rate after the i-th round of forgetting is expressed as:

[0037]

[0038] Among them, assuming A 0 is the backdoor success rate measured under the best performance of the model when the imprint is just injected, A fu It indicates the success rate of the backdoor attack on the model after forgetting. It is quantified by measuring the performance difference of the model on the backdoor task (i.e., the sensitivity of the imprint trigger) before and after forgetting. When the model is no longer sensitive to the imprint, the success rate of the backdoor task will decrease. The present invention does not require all clients to participate in the verification, but only needs to forget the client. The backdoor success rate is as follows:

[0039]

[0040] in, represents the test set of forgotten client i, which contains the private imprint embedded by client i, x represents a sample in the test set, yj represents its true label, and yt represents the target label. represents the global model obtained after the rth round of federated reduction learning, θ r represents the parameters of the model in the rth round, represents the size of the test set (total number of samples) of the forgotten client i, φ represents the number of samples of the condition, and II(·) represents the indicator function, which takes the value of 1 when the condition is true and 0 otherwise.

[0041] Beneficial effects: By embedding persistent imprints, the present invention can effectively evaluate the forgetting effect of forgotten data in the federated learning process. Compared with traditional methods, the method of the present invention has significant advantages in many aspects:

[0042] (1) Improve verification accuracy: This invention embeds EnduraMark in the data of the forgetting client and tracks the performance of the global model in multiple training rounds to ensure that it can accurately verify whether the data is successfully forgotten. Experimental results show that even after multiple model iterations, the triggering effect of the mark remains good, thereby improving the reliability of verification.

[0043] (2) Protecting client privacy: Different from the traditional membership inference attack method, this paper adopts backdoor attack to evaluate the forgetting effect, avoiding the potential privacy leakage problem. The behavior triggered by the imprint is specific and controllable, which further enhances the security of forgetting effect verification.

[0044] (3) Protecting the validity of client verification: This paper introduces an improved scaling strategy and imprint enhancement data enhancement method, which enhances the persistence of private imprints in the federated learning model and reduces the impact of benign model updates on imprint dilution, so that the client still has high validity in long-term model training.

[0045] (4) Small impact on the main task of the model: While maintaining the accuracy of the main task of the model, the method of the present invention can effectively embed and maintain private imprints. Experiments show that the accuracy of the model using the EnduraMark of the present invention on the main task is almost the same as that of the model without imprints, indicating that the solution of the present invention does not significantly reduce the model performance while verifying the forgetting effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the system structure of the present invention;

[0047] Figure 2 This is a schematic diagram of the injection mark in the embodiment;

[0048] Figure 3 This is a comparison chart of the attack success rate experiment of the embodiment on the MNIST data set;

[0049] Figure 4 This is a comparison chart of the attack success rate experiment of the embodiment on the Fashion-MNIST dataset;

[0050] Figure 5 This is a comparison chart of the attack success rate experiment of the embodiment on the CIFAR-10 dataset;

[0051] Figure 6 This is a comparison chart of the accuracy of the embodiment on the MNIST dataset;

[0052] Figure 7 This is a comparison chart of the accuracy of the embodiment in Fashion-MNIST experiment;

[0053] Figure 8 The following is a comparison chart of the accuracy of the examples on the CIFAR-10 dataset. DETAILED DESCRIPTION

[0054] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0055] In order to reduce the negative impact of triggers on the model while maintaining the accuracy of the main task of the global model, the present invention proposes a method for continuous verification of the right to be forgotten of the federated restoration learning client. The entire technical solution encounters two key challenges. First, due to the online learning characteristics of federated learning, model training is a dynamic and continuous process; once the trigger stops being injected, subsequent normal updates may quickly dilute the backdoor effect in the global model, causing the effectiveness of the backdoor attack to decrease with the increase in the number of iterations; therefore, designing a method that can improve the persistence of triggers as a verification indicator for federated restoration learning has become a challenge. Secondly, since the client holding the trigger participates in the aggregation of the global model through distributed training, the existence of the trigger may cause the model to behave incorrectly on the main task.

[0056] like Figure 1 As shown, in order to solve the above problems, the method for continuous verification of the right to be forgotten of the federated restoration learning client of the present invention involves two types of entities: a central server and several clients, and includes the following steps:

[0057] Step 1: Inject permanent marks;

[0058] For the data to be sent to the central server by the client participating in the restoration learning, the global imprint of the data is first generated into different local imprints using the extended local imprint combination method, and then the different local imprints are combined and extended using the local trigger generation strategy, and then the combined and extended permanent private imprint is injected into the data. In the central server aggregation stage, the client updates containing private imprints are scaled and adjusted;

[0059] Step 2: Train federated restoration learning on each forgotten client;

[0060] The central server selects N client sets C = {C1, C2, ..., Ci..., Cn} to participate in the federated learning training. Each client saves a different local data set D = {D1, D2, ..., Di..., Dn}, i∈{1, 2, ..., n}. In each round of federated learning training, a certain proportion of misclassified samples are added for training. The samples contain the private imprint obtained in step 1, and then the imprint is injected into the local model.

[0061] Here, the client that makes a data deletion request is called a forgotten client. Assume that the forgotten client Cn initiates a deletion request. For federated restoration learning, the global model G is deleted. t The influence of all updates of client Cn in the model is eliminated, thereby eliminating the influence of client Cn’s local data Dn on the final global model and outputting a final model F u ;

[0062] Step 3: Verify the forgotten client;

[0063] By determining whether data with private imprints can be activated, it helps the forgetting client verify whether the detection center server complies with the data deletion request.

[0064] The specific process of injecting the permanent mark in step 1 of this embodiment is:

[0065] Step 1.1, generate imprint;

[0066] Divide the global imprint into multiple local imprints, and use the combination method to permute and combine all local imprints to generate different local imprints, and distribute them to each forget client for training according to the distributed attack setting;

[0067] Step 1.2: local trigger generation strategy, i.e. generating diversified imprint combinations by combining different triggers;

[0068] For a total of M forgotten clients, the total number of local triggers corresponding to them is LT. It is necessary to infer m combinations of imprints and obtain better partitioning of triggers by optimizing the combination algorithm: while ensuring the validity of private imprints, minimize the trigger partition granularity m and the combination size k. Solve:

[0069]

[0070] In the above formula, M represents the number of clients that need to be forgotten, m represents the granularity of the global trigger partition, that is, it is divided into m basic units, and k represents the combination size of the local trigger, that is, k units are selected from m units for combination;

[0071] First, find the minimum value of m such that any selection from the m parts can generate enough unique combinations to distribute to all M forgotten clients;

[0072] Then calculate the combination of triggers: divide the global trigger into m different units, and generate local triggers with different units in different combinations. The expression is as follows:

[0073]

[0074] For example, suppose Represents a global trigger, used to control the style of the global trigger Represents the local trigger of the forgotten client C(i). For image data, it can be decomposed into trigger size TS, trigger position TL and trigger gap TG And other factors.

[0075] For ease of description, it is assumed here that three clients make forget requests. The global trigger is transformed and combined to generate three unique trigger pattern combinations, which are embedded into the datasets of the corresponding clients.

[0076] The purpose of the experiment is to assign a predetermined target label to the data containing the backdoor trigger, denoted as Yt, while the clean data retains its original label, denoted as Yj. The main purpose of the present invention is to train the model to generate a special response mark (EnduraMark) without affecting its ability to accurately identify and classify unmodified data, so as to induce the model to control the response, so as to facilitate the study of the model's ability to selectively forget the data associated with the embedded trigger under the constraint of maintaining overall performance;

[0077] Step 1.3, inject the imprint;

[0078] In the tth round of communication, the central server sends the current shared model G t Sent to N selected participants, the selected participant i will use the optimization algorithm to perform local training locally to obtain a new local model The local parties will then update the model;

[0079] After receiving the model update, the central server uses its own learning rate to average all updates to generate a new global model G t+1 , as shown below:

[0080]

[0081] The injected private imprint uses the coefficient η to amplify the weight of the backdoor model to ensure the effectiveness of the private imprint when it is triggered. The global model at this time is expressed as:

[0082]

[0083] The updated model expression in step 2 of this embodiment is as follows:

[0084]

[0085] Where p represents the number of remaining clients (excluding forgotten clients), t represents the current tth round of communication, Represents the local model of client i in the tth round of communication.

[0086] When verifying the forgotten client in step 3 of this embodiment, the definition of the forgotten degree of the forgotten client is as follows:

[0087] The forgetting rate after the i-th round of forgetting is expressed as:

[0088]

[0089] Among them, assuming A 0 is the backdoor success rate measured under the best performance of the model when the imprint is just injected, A fu It indicates the success rate of backdoor attack on the model after forgetting ends; the backdoor success rate is defined as follows:

[0090]

[0091] represents the test set of forgotten client i, which contains the private imprint embedded by client i, and x represents a sample y in the test set. j represents its true label, y t represents the target label, and represents the global model obtained after the rth round of federated reduction learning, θ r represents the parameters of the model in the rth round, where represents the size of the test set (total number of samples) of the forgotten client i, φ represents the number of samples of the condition, and II(·) represents the indicator function, which takes the value of 1 when the condition is true and 0 otherwise.

[0092] Example 1

[0093] In order to maintain fairness, this embodiment completes the backdoor injection in the same round of the technical solution of the present invention and the traditional backdoor attack method, and uses a consistent global trigger for evaluation, and starts the attack after the same round of forgetting learning is completed. This embodiment focuses on the persistence of the backdoor attack, and calculates the backdoor success rate from 0 to 100 rounds after the injection of the imprint. The attack persistence can be explained based on the curve trend of the attack success rate.

[0094] In order to prove that the problem of imprint timeliness exists in the process of model training, this embodiment conducts experiments on MNIST, Fashion-MNIST and CIFAR-10 datasets. Among them, the client of the pre-forgetting data is set to have 50% clean samples and 50% samples with imprints to study the impact of benign model updates.

[0095] Figures 3 to 5The experimental results of this embodiment are shown. At the 50th round, the timeliness of the two methods remains consistent. After 50 rounds of imprint training, the number of training rounds is increased. Although benign updates will dilute the attack success rate, the decay rate trend of the Enduramark of the present invention is slower than that of the traditional backdoor (BadNet) method. After 100 rounds of training, the results of the Enduramark of the present invention on MNIST, Fashion-MNIST and CIFAR-10 are 86.27%, 89.27% ​​and 52.79% respectively, while the attack success rates of the traditional BadNet method are 68.77%, 78.15% and 16.85% respectively. In comparison, the triggering effect of the Enduramark method is still excellent.

[0096] Example 2

[0097] This embodiment experiments on the accuracy of the technical solution. The accuracy of the main task before and after federated forgetting learning is calculated and the impact of the EnduraMark of the present invention on the model is calculated based on their difference. The reason for this setting is that the forgetting algorithm may also cause the accuracy of the model on the main task. The accuracy is used to measure the predictive ability of the classifier generated by training in the test set, that is, how many samples are correctly predicted by the classifier, and the accuracy difference is expressed as:

[0098] Accd=Acc-Acc unlearning

[0099] Normal federated training and federated training with a single user imprint added are performed until global convergence, and the changes in accuracy differences during training are compared, such as Figure 6 As shown. The accuracy of the two training methods increased rapidly in the first few rounds, especially after the first 10 rounds, the accuracy growth began to stabilize and eventually stabilized. Throughout the training cycle, the accuracy of the model using the imprint technology was very close to that of the conventional training model, which shows that the imprint generation method EnduraMark of the present invention performs well in maintaining model performance and has little impact on model accuracy.

[0100] Example 3

[0101] For the verification of federated reduction learning, this embodiment injects an enduramark into the data of the forgotten client so that the central server can subsequently verify whether it complies with the data deletion request. Specifically, an enduramark is injected into the user's private data, and then the source label of the data is changed to the target label. In each round, 10 clients are selected to submit local update aggregation. The target label is set to "3" for the MNIST dataset, "Sandal" in the FashionMNIST dataset, and "Bird" in the CIFAR-10 dataset. Excluding the key factor analysis, the trigger factor of MNIST is set to The trigger factors for CIFAR-10 are set to {6, 3, 0} and the global learning rate lr is set to 0.005 for all datasets.

[0102] This embodiment tests the success rate of imprint triggering in two stages, before and after forgetting, and then calculates the accurate forgetting rate through formula (10); the federated restoration learning forgetting rate is measured on PGA, FedEraser and FedAccum respectively, and the results are as follows: Figure 7 , Figure 8 And as shown in Table 1.

[0103] Table 1

[0104]

[0105] In summary, the present invention embeds persistent tags to enable the client that exits FL cooperation to continuously verify the execution effect of FU for a long time. The verification method of the present invention uses backdoor enhancement technology to generate multiple local tags in combination with the original global trigger (global tag), and injects them into the data set for backdoor training, thereby enhancing the model's response to these specific tags.

Claims

1. A method for continuous verification of the right to be forgotten of a federated restoration learning client, characterized in that: Involving two types of entities: a central server and several clients, the following steps are included: Step 1: Inject permanent marks; For the data to be sent to the central server by the client participating in the restoration learning, the global imprint of the data is first generated into different local imprints using the extended local imprint combination method, and then the different local imprints are combined and extended using the local trigger generation strategy, and then the combined and extended permanent private imprint is injected into the data. In the central server aggregation stage, the client updates containing private imprints are scaled and adjusted; Step 2: Train federated restoration learning on each forgotten client; The central server selects N client sets C = {C1, C2, ..., Ci..., Cn} to participate in the federated learning training. Each client saves a different local data set D = {D1, D2, ..., Di..., Dn}, i∈{1, 2, ..., n}. In each round of federated learning training, a certain proportion of misclassified samples are added for training. The samples contain the private imprint obtained in step 1, and then the imprint is injected into the local model. Here, the client that makes a data deletion request is called a forgotten client. Assume that the forgotten client Cn initiates a deletion request. For federated restoration learning, the global model G is deleted. t The influence of all updates of client Cn in the model is eliminated, thereby eliminating the influence of client Cn’s local data Dn on the final global model and outputting a final model F u ; Step 3: Verify the forgotten client; By determining whether data with private imprints can be activated, it helps the forgetting client verify whether the detection center server complies with the data deletion request.

2. The method for continuous verification of the right to be forgotten of the federated restoration learning client according to claim 1 is characterized in that: The specific process of injecting the permanent mark in step 1 is: Step 1.1, generate imprint; Divide the global imprint into multiple local imprints, and use the combination method to permute and combine all local imprints to generate different local imprints, and distribute them to each forget client for training according to the distributed attack setting; Step 1.2: local trigger generation strategy, i.e. generating diversified imprint combinations by combining different triggers; For a total of M forgotten clients, the total number of local triggers corresponding to them is LT. It is necessary to infer m combinations of imprints and obtain better partitioning of triggers by optimizing the combination algorithm: while ensuring the validity of private imprints, minimize the trigger partition granularity m and the combination size k. Solve: In the above formula, M represents the number of clients that need to be forgotten, m represents the granularity of the global trigger partition, that is, it is divided into m basic units, and k represents the combination size of the local trigger, that is, k units are selected from m units for combination; First, find the minimum value of m such that any selection from the m parts can generate enough unique combinations to distribute to all M forgotten clients; Then calculate the combination of triggers: divide the global trigger into m different units, and generate local triggers with different units in different combinations. The expression is as follows: Step 1.3, inject the imprint; In the tth round of communication, the central server sends the current shared model G t Sent to N selected participants, the selected participant i will use the optimization algorithm to perform local training locally to obtain a new local model The local parties will then update the model; After receiving the model update, the central server uses its own learning rate to average all updates to generate a new global model G t+1 , as shown below: The injected private imprint uses the coefficient η to amplify the weight of the backdoor model to ensure the effectiveness of the private imprint when it is triggered. The global model at this time is expressed as:

3. The method for continuous verification of the right to be forgotten of the federated restoration learning client according to claim 1 is characterized in that: The updated model expression in step 2 is as follows: Where p represents the number of remaining clients, t represents the current tth round of communication, Represents the local model of client i in the tth round of communication.

4. The method for continuous verification of the right to be forgotten of a federated restoration learning client according to claim 1 is characterized in that: When verifying the forgotten client in step 3, the definition of the forgotten degree of the forgotten client is as follows: The forgetting rate after the i-th round of forgetting is expressed as: Assume that A0 is the backdoor success rate measured under the best performance of the model when the imprint is just injected, and A fu It indicates the success rate of the backdoor attack on the model after the forgetting ends. The backdoor success rate is defined as follows: represents the test set of forgotten client i, which contains the private imprint embedded by client i, and x represents a sample y in the test set. j represents its true label, y t represents the target label, and represents the global model obtained after the rth round of federated reduction learning, θ r represents the parameters of the model in the rth round, where represents the size of the test set of the forgotten client i, φ represents the number of samples of the condition, and II(·) represents the indicator function, which takes the value of 1 when the condition is true and 0 otherwise.

Images