Zero-shot Federated Unlearning via Transforming from Data-Dependent to Personalized Model-Centric

1 Introduction

Privacy regulations such as GDPR [Voigt and Von dem Bussche, 2017] and CCPA [Illman and Temple, 2019] grant clients in federated learning (FL) [McMahan et al., 2017] the right to withdraw their data contributions. While the most straightforward solution is to retrain the model from scratch on the retained clients, it is costly and computationally intensive. Federated Unlearning (FU) [Wu et al., 2022; Liu et al., 2021] has thus emerged as a critical solution, aiming to more efficiently "forget" the impact of specific data by fine-tuning the trained model or accelerating retraining. According to the target of unlearning, current FUs focus on classes, clients, or samples, aiming to eliminate the impact of data from specific classes, clients, or samples, respectively. FU in this paper refers to federated client-level unlearning.

* Corresponding Authors.

Existing FUs are data-dependent, which make an assumption that systems can re-access training data or model updates while unlearning. They require clients to have access to client-local data for model fine-tuning [Liu et al., 2022; Wang et al., 2022] or reuse stored historical parameter updates during training to accelerate retraining [Zhang et al., 2023c; Liu et al., 2021; Lin et al., 2024]. However, such an assumption cannot always hold in practice. First, for the client requesting unlearning, any access to its data during the unlearning phase should be strictly prohibited, e.g. if a user of a shopping app discovers that its private data has been used to train an FL model, they are likely to immediately revoke access and request the deletion of the data's impact. Second, for retained clients who do not request unlearning, their training data or historical updates are often inaccessible after training, e.g. in the field of medical records, where privacy regulations like HIPAA [Cohen and Mello, 2018] and user consent withdrawal require that such records be permanently deleted after training. Additionally, storing historical updates on the server or client increases storage overhead and poses privacy risks, making it infeasible for large-scale federated deployment. Such situations necessitate zero-shot federated unlearning, i.e. forgetting the contributions of a specific client without visiting the original data or stored updates.

The core challenge of zero-shot FU lies in how to distinguish the impact of the target client from non-target clients on the model and remove the impact. Existing data-dependent FUs typically achieve contribution differentiation through client data distributions or gradient update differences during training, but such information is unavailable in zero-shot scenarios with no client-specific knowledge available. One potential idea is to be model-centric, i.e. embedding the clientspecific knowledge into the model. The key is to embed personalized client features during training to enable modelbased unlearning rather than relying on the data itself, which means transforming the FU from data-dependent to a personalized model-centric approach. The personalized features of the model can be used to distinguish the contributions of target clients for effective unlearning.

Motivated by the above ideas, we propose ZeroFU, a novel FU framework designed for zero-shot scenarios which is personalized model-centric. ZeroFU innovatively addresses the absence of data or updates after training based on the personalized client information embedded during training. Specifically, during the FL phase, we design a conditional computation mechanism to dynamically identify and utilize the unique contributions of each client within the model. Then during the FU phase, we propose a GAN-based distillation framework. The adversarial structure of the GAN is responsible for generating pseudo data for model distillation. The goal of distillation is to eliminate the influence of the target client while preserving the overall model performance. This approach ensures the contributions of target clients are effectively removed while minimizing catastrophic forgetting [Bourtoule et al., 2021; Liu et al., 2024] of other clients' performance. ZeroFU remains effective and reliable in zero-shot scenarios where existing methods fail to work. Extensive experimental results demonstrate that ZeroFU performs well on both target and retained clients. The main contributions are as follows:

• We propose a novel zero-shot federated unlearning framework, designed to handle scenarios where neither training data nor historical updates are accessible. This aligns closely with real-world data deletion requests.
• We propose utilizing personalized client information embedded in the model during training to effectively achieve unlearning by extracting and obfuscating clientspecific features, thereby transitioning FU from datadependent to personalized model-centric.
• We deploy and evaluate ZeroFU on real-world datasets, achieving an accuracy improvement of up to 26.2% compared to existing zero-shot machine unlearning methods extended to federated scenarios.

2 RelatedWork

FederatedUnlearning. Federated unlearning (FU) extends machine unlearning (MU) to federated scenarios, aiming to remove specific information from trained models for privacy compliance. In addition to the class-level and sample-level forgetting dimensions in MU, FU introduces client-level as an additional dimension. Precise MU methods like SISA [Bourtoule et al., 2021] retrain data partitions, while approximate methods [Lee and Woo, 2023; Tarun et al., 2023] leverage statistical properties. Existing FU methods often require historical parameters or original data. For instance, class-level methods [Wang et al., 2022] prune sensitive channels for specific classes, while client-level methods like FedEraser [Liu et al., 2021] and others [Wu et al., 2022; Liu et al., 2022; Su and Li, 2023] use historical updates, knowledge distillation, or retraining techniques to accelerate unlearning. These methods depend on client access to data post-training, which is often infeasible in practice. Despite these limitations, client unlearning in zero-shot scenarios remains unexplored.

In client-level FU, given a training dataset D = {Di}Ki=1 from clients C1,C2, . . . ,CK, let Cr represent the retained client with data Dr, and Cf the forgotten (or target) client with data Df . A retrained model, trained from scratch on D \ Df , is typically used as a benchmark for unlearning performance [Bourtoule et al., 2021; Liu et al., 2021]. The FL process, denoted as FL : D → ω, maps the client data D to the global model parameters ω. The FU process is defined as FU : FL(D) ⊗D⊗Df → ω′ , where the goal is to produce an unlearned model ω′ similar to the retrained model:

where Φ[·] denotes the probability distribution of the output. Zero-shot Federated Unlearning. Existing FU methods require access to Dr and Df , which is often impractical due to privacy constraints. In contrast, a zero-shot client unlearning approach (FU ′ ) eliminates dependence on Dr and Df , relying instead on model queries as follows:

where FU ′ : FL(D) ⊗Mr ⊗Mf → ω′ queries the personalized models Mr andMf of the retained and forgotten clients, respectively. This method only requires access to the model parameters ω, which are typically available.

Model Personalization. Existing FL methods like FedAvg [McMahan et al., 2017] train a single global model in a privacy-preserving manner. However, data heterogeneity in real-world scenarios limits the performance of such global aggregation [Wang et al., 2020; Xu et al., 2024]. Model personalization addresses this issue by tailoring the global model for each client. Approaches such as GPFL [Zhang et al., 2023a] and FedCP [Zhang et al., 2023b] improve local accuracy by separating personalized and global information, while others like DPMN [Ma et al., 2022], Peaches [Yan et al., 2024], and TopFL [Chen et al., 2024] utilize personalized model topologies. In this paper, we find that model personalization not only enhances model performance in non-IID scenarios but also facilitates client FU in zero-shot scenarios.

3 Design of ZeroFU

3.1 Overall Architecture

The overall process involves first collaboratively training the FL model, and then during unlearning, the forgotten client sends an unlearning request to the retained clients, followed by executing unlearning to remove its specific contributions.

ZeroFULearning Framework. As shown in Figure. 1, the components of learning include a Feature Extraction module (θ), a Model Head (φ), a Class Embedding Generator (eGen) and a Condition Module (CM). ZeroFU employs a personalized approach that extracts both global and clientspecific features. Following the principles of FedRep [Collins et al., 2021], the backbone model, such as ResNet [He et al., 2016], is divided into θ and φ during training. The φ corresponds to the last fully connected (FC) layer of the backbone model, while the θ comprises the remaining layers. Global Embedding gEm and Personal Embedding pEmi are calculated based on the class embedding (cEm) from eGen and the label distribution (LDi) of client Ci using a look up method. The gEm and pEmi are then fed into CM. The CM processes the extracting features fi from θ and generating both global features f g i and client-specific features f p i , which are then combined to produce the final classification result through φ. θ, φ, CM, and eGen share parameters among clients and are trained in an end-to-end manner. The trainable parameters include ωi = {ωθ , ωφ, ωCM , ωeGen }.

ZeroFU Zero-shot Unlearning Framework. As shown in Figure. 2, the components of unlearning include the personalized model on retained client Cr and forgotten client Cf , a student model and a Generator G. ZeroFU uses Knowledge Distillation (KD) and Generative Adversarial Networks (GAN) to adjust model parameters and obscure the personalized information of Cf . The unlearning process is conducted on the client side for privacy reasons, with the teacher model being the model of Cr. The student model has the same model structure as the model on Cr. We use G to create data points aimed at maximizing the difference FLoss between personalized features f p s on student and f p f on Cf , while the client local distillation minimizes FLoss to achieve the forgetting of personalized feature information. Intuitively, the personalized information of the client Cf are overshadowed by that of the retained client Cr. Through knowledge distillation, zero-shot unlearning is realized. Knowledge transfer is achieved by minimizing the divergence KLoss and distance measures Aloss between the teacher and student model. CM and eGen remain unchanged to maintain class consistency.

3.2 Learning PersonalizedModels on ZeroFU

ZeroFU's learning phase aims to train personalized models for each client, extracting client-specific features for unlearning. It involves collaboration between θ, φ, eGen, and CM.

Feature Extractor. θ extracts features fi from the input xi on client Ci. θ is a backbone network module excluding the model head φ, mapping θ : Rdim(x) → Rdim(fi) , where typically data dimension dim(fi) ≪ dim(x). For client i,

Generating Class Embedding. We design the embedding generator eGen. eGen generates global class embedding vectors (cEm) to compute Global Embedding (gEm) and Personal Embedding (pEmi) as the condition for the condition module CM. For an image classification task with U

classes, eGen takes a class index input cin ∈ {0, 1, . . . , U - 1} and outputs the embedding cEm. The output of eGen is:

where cEmy ∈ Rdim(fi) is the embedding vector for class y. The global class embedding matrix is cEm = [cEm0, cEm1, . . . , cEmU-1], where cEm ∈ RU×dim(fi) .

Generating Global and Personal Embeddings. Based on cEm, we generate gEm and pEmi for each client Ci. The gEm captures the global information of all classes and is shared across all clients. It is calculated as:

Let the label distribution vector of client Ci be LDi = [LD0i , LD1i , . . . , LDU-1 i ], where:

where I is an indicator function. The personalized embedding pEmi is calculated based on the LDi as:

The pEmi reflects the specific label distribution information of Ci, providing conditions for non-IID data in FL settings.

Generating Personalized and Global Features. Inspired by conditional computation techniques [Guo et al., 2019; Zhang et al., 2023a], the function of CM is to utilize the conditions from gEm and pEmi to generate personalized feature representations fi p and global feature representations fi g from the input feature fi, respectively. This enables personalized model adjustments for each client. The CM includes a Conditional Bias module CMB and a Conditional Weight module CMW. For the global feature extraction, the output weight vector W and bias vector b are:

For the personal feature extraction, the output vectors are:

We compute f g i and f p i by performing affine transformations [Zhang et al., 2023b; Zhang et al., 2023a] as follows:

where ⊙ denotes Hadamard product, 1 is an all-ones matrix.

Model HeadOutput. We concatenate f p i and f g i , and then the model head φ converts the concatenated feature vector into the final prediction result yˆi:

Training Loss Function. ZeroFU's loss function combines multiple terms. The primary loss for classification tasks is the cross-entropy (CE) loss [Mannor et al., 2005]:

where yˆi is calculated according to Eq. (11). Additionally, inspired by the class embedding loss functions [Pu et al., 2024], we incorporate an extra loss term for cEm to adjust the update direction of cGen. We aim to minimize the similarity between the feature vector and its corresponding class embedding while maximizing its distance from other class embeddings, thereby preserving the specificity of different class embeddings. We calculate the cosine similarity between f g i and its corresponding class embedding as follows:

where the cosine similarity is calculated as the formula cos sim(f, emb) = f·embT ∥f∥·∥emb∥ . Combining the loss functions above, the overall loss function for client Ci is:

where we add L2 regularization terms to the cGen and CM, with λ1, λ2 as hyperparameters. We minimize the loss function using SGD and aggregate the updates. The entire learning process is outlined in Algorithm 1.

3.3 Zero-shot Unlearning Process on ZeroFU

ZeroFU aims to efficiently remove the influence of a forgotten client Cr on a retained client Cr by forgetting personalized features in a zero-shot setting based on KD and GAN.

Data Generator. We use a generator G(z, ωG) to generate data points from a random noise vector z ∈ Rzdim , sampled from N(0, 1). The generator first maps z to a higher dimensional space using a series of layers, including Linear, View, Batch Normalization, and Upsampling. It then processes the feature maps with convolution, batch normalization, and Leaky RELU activation to generate pseudo-samples for knowledge distillation training, denoted as x = G(z; ωG). These pseudo-samples are then used as inputs for the teacher model, student model, and the model to be forgotten on Cf .

Zero-shot Knowledge Distillation. ZeroFU uses the retained model R(x; ωr) on Cr as the teacher and a randomly initialized model S(x; ωs) as the student. The model to be forgotten on Cf is F(x; ωf). To maintain training accuracy, CM and cGen parameters are kept unchanged, ωCM s = ωCM r , ωcGen s = ωcGen r . The objective is to maintain performance on Cr while unlearning Cf 's information. Inspired by [Chen et al., 2023; Lee and Woo, 2023], we aim to alter the decision space on Cf by mapping its personalized information decision space to the Cr's personalized information

Algorithm 1: Model Personalization Based Training

Input: Client Ci training data Di; Learning rate η; Hyperparameters λ1, λ2; Total communication rounds T ; Local training rounds Tl; Ratio of joining clients per round α. Output: Updated global model parameters ωT for K clients. 1 Initialize global parameters shared among clients with: ω0 ← {ωθ,0 , ωφ,0 , ωCM,0 , ωeGen,0 }. 2 for each communication round t from 1 to T do 3 Randomly select a fraction α of clients to form set Ot . 4 Server sends ωt-1 to client ∀Ci ∈ Ot , set ωt i ← ωt-1 . 5 for each selected client Ci ∈ Ot in parallel do 6 for each local training round tl from 1 to Tl do 7 Extract features fi from θ using Eq. (3). 8 Generate gEm, pEm using Eq. (5),(7). 9 Compute f g i and f p i fromCM using Eq. (10). 10 Compute prediction yˆi from φ using Eq. (11). 11 Compute loss function Li(ωi) using Eq. (14). 12 Update local parameters using gradient descent: ωt i ← ωt i - η∇Li(ωi). 13 Share updated parameters ωt i with the server. 14 Aggregate global parameters on the server: ωt ← 1 ∑︁i∈Ot |Di| ∑︁i∈Ot |Di |ωt i .

15 return Updated global model ωT .

decision space, achieving approximate unlearning. Specifically, we aim to make the personalized feature information f p f extracted from client Cf close to the f p s of the student. We obtain f p s and f p f from S(x; ωs) and F(x; ωf) using Eq. (9) and (10), respectively. We have set pEms = pEmr, using the personal embedding of the client Cr on the student model. The similarity between f p s and f p f is as follows:

where a smaller FLoss indicates a higher cosine similarity, achieving "masking" of Cf 's personalized information without affecting the decision space of the Cr. Similarly, we can compute f p r (the personalized information feature on Cr) by using pEmr. The f g s and f g r (global feature information of student and teacher models) can be calculated by replacing pEm with gEm. Let yr ˆ and ys ˆ be the predictions of the teacher and student models on x respectively. To enable the knowledge transfer from teacher to student, KLoss maximizes the Kullback-Leibler divergences [Kullback and Leibler, 1951] DKL(R(x)∥S(x)) between the outputs:

where τ is a temperature parameter, σ represents the softmax function. Additionally, inspired by [Micaelli and Storkey, 2019], we incorporate attention loss with L2 normalization:

Algorithm 2: ZeroFU Zero-shot Unlearning Process

where A(r) l and A(s) l denote the outputs of the teacher and student models at layer l, respectively, and NL represents the subset of layers used for calculating the attention loss, specifically the activation layers of θ. Al outputs contain nl channels. The function f(Al) = 1 nl ∑︁c a2l,c , where al,c denotes the c-th channel of the activation block Al.

GAN Training Process. The generator G is optimized to maximize the difference between the personalized information features of the model F (x; ωf ) on the Cf and the student model R(x; ωr). Here, the personalized feature information acts as the discriminator in the GAN. The goal of G is:

During knowledge distillation, the student model updates its weights with an adversarial goal of forgetting specific personalized information on Cf , i.e., minimizing FLoss. With the hyperparameters β and γ, the total loss for the student is:

(19)

The entire unlearning process is outlined in Algorithm 2.

4 Evaluation

4.1 Methodology

Testbed. We deployed ZeroFU on NVIDIA A100 40GB Tensor Core GPUs using PyTorch 2.3.1 and Python 3.8.

Datasets and Backbone Models. Datasets include: MNIST [LeCun et al., 1998], SVHN [Netzer et al., 2011], Fashion-MNIST [Xiao et al., 2017], and CIFAR10 [Krizhevsky and Hinton, 2009]. The backbone model includes two conv layers (32 and 64 5 × 5 filters with ReLU and 2 × 2 max-pooling) followed by a linear output layer.

Baselines. Given the lack of zero-shot unlearning in federated environments, we adapted zero-shot methods from MU for federated unlearning and compared them under ZeroFU's learning configuration in a non-IID setting: i). FedMM: Employs the Error Minimization-Maximization Noise method [Tarun et al., 2023; Chundawat et al., 2023b], learning noise matrices to minimize FLoss for retained clients' personalized features while maximizing it for forgotten clients' features. ii). FedGKT: Extends Gated Knowledge Transfer [Chundawat et al., 2023b] to FL. It filters out forgotten client information via a band-pass filter between personalized features f p r and f p f . iii). FedBadT: Utilizes both competent and incompetent teacher models [Chundawat et al., 2023a], retaining the zero-shot data generator. The retained client model acts as the competent teacher, while the forgotten client outputs random noise as the incompetent teacher. We also compared with non-zero-shot FUs in §4.3.

Evaluation Metrics. The evaluation metrics are: i). Accuracy: The accuracy of Df and Dr for Cf and Cr should be closer to that of the retrained model, as the expected behavior of the unlearned model should resemble the retrained model. ii). Weight Distance: We measure model similarity using L2 Norm Distance [Thudi et al., 2022], with smaller differences indicating higher similarity. iii). Membership Inference Attack (MIA): MIA, framed as a binary classification task using a logistic regressor [Yan et al., 2022], determines if a data point in Df was used in training [Chen et al., 2023; Liu et al., 2021]. The threat model, trained on f p i extracted by unlearned model on Dr with the labels indicating whether this data was used during training, aims to match retrained model performance, indicating reduced attack capability. Metrics include attack precision and recall.

Settings and Hyperparameters. We used 10 clients with α = 1 per round. To simulate the FL environment, we applied label shift heterogeneity under two settings: iii). Pathological label skew: Data with different labels and sizes were sampled for each client [McMahan et al., 2017]. ii). Practical label skew: A Dirichlet distribution (Dir(ζ), with the concentration parameter ζ = 0.01/0.1) was used [Lin et al., 2020]. The learning rate was η = 0.005 with Tl = 3, and regularization parameters λ1 = λ2 = 0.1. During FU, τ = 2, Tk = 9, and the loss hyperparameters were β = 5.0, γ = 2.0.

4.2 Overall Performance

Performance on Retained and Forgotten Data. Table 1 compares ZeroFU's accuracy with baseline methods on retained data Dr and forgotten data Df . Under ζ = 0.01 (highly imbalanced data, simulating class unlearning [Zhang et al., 2023c]), ZeroFU achieves an average difference of 0.87% on Dr and 0.44% on Df , outperforming FedMM (11.34%, 2.46%), FedGKT (8.43%, 2.44%), and FedBadT (2.59%, 47.15%). For ζ = 0.10 (overlapping label distributions), ZeroFU maintains differences of 3.21% on Dr and 0.44% on Df , while baselines exceed 20%. FedBadT struggles on FMNIST and CIFAR10 due to unbalanced KL divergence between two teachers. FedGKT suffers catastrophic forgetting under ζ = 0.10 due to its gating mechanism blocking same-label propagation, while FedMM's noise method re- L2 Norm

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0.0

FedZPU

FedMM

FedGKT

FedBadT

0

5

10

15

20

Layer Index

(a) MNIST (ζ = 0.01)

FedZPU

FedMM

FedGKT

FedBadT

0

5

10

15

20

Layer Index

(b) MNIST (ζ = 0.10)

FedZPU

FedMM

FedGKT

FedBadT

0

5

10

15

20

Layer Index

(d) SVHN (ζ = 0.10)

• (a) Attack Precision (ζ = 0.01)
• (b) Attack Recall (ζ = 0.01)
• (c) Attack Precision (ζ = 0.10)

Figure 4: Performance of Membership Inference Attacks (MIAs).

duces accuracy and amplifies forgetting. ZeroFU effectively balances forgetting and retention by disrupting Df 's decision boundary without impacting other clients' boundaries.

Weight Deviation of UnlearnedModels. The comparisons between the weights of unlearned and retrained models are shown in Figure. 3. The weights of the unlearned models created using ZeroFU are generally closer to the retrained models, demonstrating better performance. The parameter deviation decreases when approaching the model head.

Privacy Leakage of Forgotten Data. We conductedMIAs on Df in non-IID scenarios. As shown in Figure 4, ZeroFU achieves MIA accuracy and recall closer to retrained models, demonstrating better privacy protection. Unlearned models generally leak more privacy due to reliance on original models than retrained models. At ζ = 0.01, FedMM, FedGKT, and FedBadT averaged 4.15%, 3.39%, and 6.60% higher accuracy, and 10.65%, 11.58%, and 4.55% higher recall than ZeroFU. At ζ = 0.10, their attack accuracy averaged 0.90%, 5.04%, and 2.54% higher, with recall 9.89%, 6.63%, and 10.77% higher. This is because ZeroFU more effectively conceals the impact of the forgotten information.

Visualization. We conducted visualization on MNIST and CIFAR10 with ζ = 0.10, using t-SNE [Van der Maaten and Hinton, 2008] to map personalized feature f p i of retrained and unlearned models. As shown in Figure 5, unlearned models closely resemble retrained models in feature space distribution, appearing isomorphic but not isometric. Furthermore, we observed that the ZeroFU model has the capability to map the same label data from different clients to distinct feature spaces. This prevents catastrophic forgetting of the same label in other clients when a specific label from one client is forgotten. The differentiation in feature spaces across clients also highlights the capacity for learning in non-IID scenarios.

4.3 Comparison with the SOTA FUMethods

We summarize FU method attributes. FedEraser [Liu et al., 2021] uses historical gradients to accelerate retraining, FedRecovery [Zhang et al., 2023c] relies on historical parameters for differential privacy forgetting, and Knot [Su and

• (d) Attack Recall (ζ = 0.10)

L2 Norm

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0.0

L2 Norm

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0.0

(a) IID Scenario

(b) non-IID Scenario (ζ = 0.10)

Table 2: Performance Comparison of ZeroFU with State-of-the-Art Client Unlearning Methods: Considering It Cannot Access the Training Dataset, ZeroFU Performs Quite Well. The Red Numbers Represent the Optimal Values, While the Blue Ones Indicate the Second-best.

Li, 2023] employs sub-cluster retraining in asynchronous FL. ZeroFU is unique in not requiring access to training data or historical updates. Performance comparisons (Table 2) show ZeroFU achieves similar unlearning results under IID scenarios. For MNIST, ZeroFU's deviation from the retrained model onDr andDf is 3.73% and 2.76%, respectively, compared to Knot's 1.39% and 1.36%. In non-IID scenarios, ZeroFU delivers higher training accuracy, outperforming others by 30% on FMNIST. This is because personalization is conducive to the adaptation of non-IID data. ZeroFU's unlearning effectiveness surpasses FedEraser and FedRecovery and is comparable to Knot. When training data and historical updates are unavailable, ZeroFU remains effective, while others cannot work due to the lack of client-specific information.

4.4 Ablation and Scalability Study

We first conducted ablation experiments using two variants: (a) w/o LCE i , removing the class embedding loss, and (b) w/o FLoss. Results on CIFAR10 are shown in Figure 6a: (a) Removing LCE i reduced learning accuracy by 6.89% due to the loss of global guidance, though unlearning remained effective due to feature remapping by the conditional model CM. (b) Without FLoss, unlearning effectiveness dropped, with Df accuracy 20.32% higher than the retrained model, showing FLoss is critical for disrupting Df 's decision boundaries. For scalability, we tested ZeroFU with 5/10/15/20/50 clients in non-IID settings (Figure 6). In the highly imbalanced ζ = 0.01 scenario, learning and unlearning performed well. Under ζ = 0.10, learning accuracy was stable for 520 clients but dropped 12.54% with 50 clients compared to 10. For unlearning, Dr accuracy remained strong as client numbers increased, but Df accuracy showed a 19.16% gap from the retrained model with 50 clients. This is because as the number of clients increases, overlapping data distributions may retain contributions from clients similar to the target.

5 Conclusion

This paper addressed the pressing need for zero-shot FU, a critical capability in FL systems to comply with privacy regulations and client data withdrawal requests. Unlike existing data-dependent FUs that rely on access to training data or stored updates, ZeroFU pioneers a personalized modelcentric approach, embedding client-specific contributions directly into the model to empower unlearning. This study provides a new perspective to advance FU research.

Acknowledgments

This work is supported by the National Key Research and Development Program of China (2023YFE0205700), National Natural Science Foundation of China (62341410,62302348), the Macao Science and Technology Development Fund (File no. 0078/2023/AMJ), UMprojects (SKL-IOTSC-2024-2026, CPG2025-00029-IOTSC), General Program of Hubei Provincial Natural Science Foundation of China (2023AFB831), the Fundamental Research Funds for the Central Universities (2042025kf0040), Wuhan Knowledge Innovation Special Project (2023020201020250), Shanghai University of Finance and Economics Key Laboratory of Interdisciplinary Research of Computation and Economics, Ministry of Education and Hubei Key Laboratory of Transportation Internet of Things.