FedCARE: Federated Unlearning with Conflict-Aware Projection and Relearning-Resistant Recovery

1 Introduction

Background. Federated Learning (FL) enables collaborative model training without centralizing raw data by aggregating locally computed updates from distributed clients [McMahan et al., 2017]. In practice, an FL system must not only continuously improve the model as new data arrive, but also be able to eliminate the influence of previously used training data upon request in order to comply with privacy regulations. For instance, the European Union's General Data Protection Regulation (GDPR) [Voigt and Von dem Bussche, 2017] establishes the right to erasure, often referred to as the "right to be forgotten" (RTBF). A straightforward way to comply with RTBF is to remove the target data and retrain the federated model from scratch; however, this approach is often prohibitively expensive in terms of computational resources. Inspired by machine unlearning in centralized settings [Bourtoule et al., 2021], Federated Unlearning (FU) [Liu et al., 2021] has emerged as a promising alternative, aiming to remove a target client's (or a data subset's) contribution from a federated global model without retraining from scratch.

∗Corresponding authors.

Challenges. Despite encouraging progress (refer to Sec. 2 for more details), practical FU still faces the following challenges: (1) Low-cost and unified unlearning. A deployable FU framework should complete as quickly as possible upon an unlearning request, while incurring only a small incremental resource cost and minimally affecting non-target clients. Moreover, real unlearning requests arise at different granularities (client-, sample-, and class-level), which calls for a unified design that can cover diverse unlearning paradigms. (2) Utility degradation due to knowledge entanglement.Unlearning updates are often computed from a limited view of the data (e.g., only the requesting client), while the global model encodes entangled client-specific and global shared knowledge. As a result, removing a specific contribution can inadvertently damage shared knowledge, leading to noticeable utility drops on retained data, especially under non-IID client distributions.(3) Relearning during post-unlearning recovery. To recover model utility, FL commonly continues training on remaining clients after unlearning. Yet this recovery phase can drift the model back toward its pre-unlearning state, implicitly restoring removed knowledge and weakening the unlearning effect.

Method. To address the above challenges, we propose FedCARE, a novel FU framework that achieves Conflict-Aware unlearning and RElearning-resistant recovery to retain model utility. The design of FedCARE is motivated by two key observations: (1) when the data to be forgotten are available at the target client, gradient ascent provides a simple and lowcost unlearning primitive, provided that its collateral damage to the remaining knowledge can be effectively constrained; and (2) data-free synthesis via model inversion can recover informative class-level signals from a trained model, which can serve as a proxy for shared knowledge and help constrain utility degradation during unlearning without requiring access to real reference data.

Concretely, FedCARE follows a three-stage procedure. First, the server trains a lightweight class-conditional pseudosample generator once in a data-free manner and makes it available for future unlearning requests. Second, taking client-level unlearning as an example, the target client uses the generator to synthesize pseudo-samples, computes a reference gradient and performs conflict-aware projected gradient ascent to achieve utility-preserving unlearning. Third, during recovery, the remaining clients freeze their local backbone (feature extractor) and update only the classifier head, while the server filters aggregated updates along a relearning direction to suppress rollback toward the pre-unlearning model. Finally, FedCARE also supports instance- and classlevel unlearning by adjusting the target dataset and the corresponding reference gradient, enabling unified unlearning with low overhead.

Contributions. Our contributions are as follows:

• We propose FedCARE, a low-overhead FU framework that supports client-, instance-, and class-level unlearning while reducing resource overhead and minimizing impact on nontarget clients.
• We introduce a conflict-aware projected forgetting mechanism that constrains forgetting updates with a utility-related protection reference to mitigate utility degradation.
• We design a relearning-resistant recovery strategy that suppresses rollback during post-unlearning recovery via clientspecific backbone freezing and server-side update filtering.
• Extensive experiments on multiple datasets and architectures under both IID and non-IID settings show that FedCARE achieves effective forgetting, improved utility retention, and reduced relearning risk with modest additional overhead compared to state-of-the-art FU baselines.

2 RelatedWork

Federated Unlearning (FU) integrates federated learning with machine unlearning, aiming to enable privacy-preserving data removal in distributed environments. Traditional centralized unlearning methods are unsuitable for such settings due to their reliance on global access to training data. In FU, client data remains local and is never shared with other clients or the central server; instead, only locally computed model updates are transmitted for aggregation into a global model.

Directly deleting target data is infeasible due to the memorization of sensitive information in trained models [Nasr et al., 2019; Melis et al., 2019; Song et al., 2020; Song et al., 2026]. Existing federated unlearning approaches can be broadly categorized into storage-based and storage-free methods, both of which face critical limitations in practice. Storage-based methods [Liu et al., 2021; Lin et al., 2024] accelerate retraining by retaining historical model updates, but incur substantial storage overhead that scales with training duration and client participation, limiting their deployment in long-running or resource-constrained systems. Storagefree methods avoid historical state retention but often sacrifice efficiency or robustness: MoDe [Zhao et al., 2024] relies on knowledge distillation from randomly degraded models, introducing optimization stochasticity and high communication cost; NoT [Khalil et al., 2025] employs heuristic weight negation that severely disrupts learned representations and requires extensive fine-tuning to recover utility; and FedOSD [Pan et al., 2025] mitigates interference via orthogonal projection but depends on continuous client participation for complex gradient computations, exacerbating computational overhead. Collectively, these limitations reveal the lack of a unified federated unlearning framework that can achieve effective forgetting with low overhead, preserve model utility, and remain robust to unintended relearning during recovery.

3 Methodology

In this section, we introduce FedCARE, which consists of three main stages: training a data-free pseudo-sample generator, performing conflict-aware projection unlearning, and executing relearning-resistant model recovery. The overall architecture is illustrated in Figure 1.

3.1 Data-Free Pseudo-Sample Generator

FedCARE requires a lightweight, data-free utility reference to support constrained unlearning. Since the server cannot access any real retained data, we construct a proxy reference set Dref by synthesizing class-conditional pseudo-samples from the trained global model θ. Importantly, this generator is trained once at the server and can be reused for future unlearning requests.

We implement G as a lightweight decoder-style network that maps a latent code and a class label to the input space. Given the noise z ∼ N(0, I) and a label y, we first obtain an initial low-resolution feature map h0 = Proj(z, y) through a learnable projection layer. The features are then progressively refined and upsampled via a cascade of K decoder blocks:

where ϕ(·) denotes an output activation function (e.g., tanh or sigmoid) to ensure that the generated samples lie within the valid input range. Each decoder block Bi(·) increases the spatial resolution while refining semantic structure, thereby producing class-consistent pseudo-samples.

Prior data-free synthesis methods, such as DeepInversion [Yin et al., 2020], typically rely on Batch Normalization (BN) to regularize the generation process by matching stored feature statistics. However, in non-IID federated settings, the BN statistics aggregated at the server often suffer from severe distribution shifts and fail to accurately reflect the true global data distribution [Hsieh et al., 2020]. Relying on such corrupted statistics can lead to the generation of semantic artifacts rather than valid, generic features. To address this issue, we replace BN with Group Normalization (GN) [Wu and He, 2018] in our generator blocks:

where Up(·) denotes nearest-neighbor upsampling and σ(·) is the activation function. Since GN normalizes features independently of batch statistics, it decouples the generation process from unreliable global distributions, ensuring that the synthesized samples are guided solely by the semantic constraints imposed by the model inversion objective.

To ensure that the constructed feature subspace effectively approximates the generic features of globally shared knowledge, we formulate a unified optimization objective for datafree synthesis as follow:

where each term plays a distinct role in shaping the synthesized pseudo-samples. We next describe the design and motivation of these components in detail.

To anchor the pseudo-sample ˜x within the correct decision boundary, we adopt the standard cross-entropy loss with respect to the target class y. To mitigate high-frequency artifacts inherent to data-free synthesis [Odena et al., 2016], we further incorporate an anisotropic total variation regularizer,

which imposes a smoothness prior on the generated samples.

Moreover, to prevent mode collapse and encourage diverse generations, we introduce a diversity regularization term Ldiv, defined as the inverse of the feature distance ratio:

This term enforces a sensitivity constraint on the generator, ensuring that distinct latent codes produce sufficiently different feature realizations and thereby promoting adequate coverage of the latent subspace.

To mitigate gradient domination caused by scale disparity between loss terms (i.e., Ltv ≫ L), we adopt a hybrid loss balancing strategy with adaptive initialization of the smoothness weight λtv. At the start of training (t = 0), λtv is set as λtv = γ · (L(0) /L(0) tv ), where γ ∈ [10-3 , 10-1 ] is an empirical attenuation factor inversely related to the dataset's textural complexity. This normalization aligns the gradient magnitudes of the smoothness and semantic objectives, preventing early stage optimization bias. In contrast, we assign a fixed constant weight to the diversity term, setting λdiv to a small value (e.g., 0.5) to maintain a stable repulsive force for feature space exploration.

3.2 Conflict-Aware Projection Unlearning

For clarity, we take client-level unlearning as an illustrative example. At the onset of unlearning, the server shares the trained pseudo-sample generator G with the target client u. Let θ denote the current global model parameters and Du the private dataset to be forgotten.

A simple and low-cost primitive for client unlearning is gradient ascent on Du, which maximizes the empirical loss to erase the client-specific contribution. However, directly maximizing Lu(θ) ≜ L(θ; Du) can severely degrade model utility, as client-specific and globally shared representations are entangled in θ. To address this issue, we formulate unlearning as a constrained optimization problem:

where Lref (θ) denotes a reference loss that serves as a proxy for retained utility. In practice, Lref cannot be evaluated on real retained data due to data isolation and privacy constraints. FedCARE overcomes this limitation by constructing a proxy reference dataset Dref using the generator G (for class-level unlearning, Dref excludes the forgotten class), and defining the reference loss as Lref (θ) ≜ L(θ; Dref ).

Directly solving Eq. (6) is intractable for deep neural networks. We therefore enforce the utility constraint locally using a first-order approximation. Let d denote the ascent direction and consider an update of the form ∆θ = ηd with a small step size η. Applying a first-order Taylor expansion to the reference loss yields:

Thus, a sufficient condition to prevent an increase in the reference loss at first order is:

Meanwhile, the unconstrained ascent direction for forgetting is given by:

Given the unconstrained ascent direction gtar and the firstorder utility constraint in Eq. (8), the problem reduces to finding a feasible update direction that remains as close as possible to gtar while preserving the reference loss.

In practice, computing gref using the entire proxy dataset Dref at every iteration is computationally unnecessary. Moreover, the local constraint in Eq. (8) is defined with respect to the current parameters θ(t) , and the associated gradient field evolves as the model is updated. To account for this dynamics while maintaining efficiency, we estimate the reference gradient online using a mini-batch B(t) ref ⊂ Dref at each step t:

which serves as a lightweight and step-adaptive proxy for retained utility. Similarly, the forgetting gradient is computed on a mini-batch B(t) u ⊂ Du:

At each step t, we obtain the closest feasible ascent direction to g(t) tar by solving the following constrained optimization problem:

which projects g(t) tar onto the half-space defined by the local utility constraint. This problem admits a closed-form solution given by:

where ϵ is a small constant introduced for numerical stability. Intuitively, when ⟨g(t) tar , g(t) ref ⟩ ≤ 0, the unconstrained ascent direction already satisfies the utility constraint and remains unchanged. Otherwise, the minimal conflicting component along g(t) ref is removed so that the corrected direction lies exactly on the constraint boundary.

Finally, the target client updates the model parameters via projected gradient ascent for T steps:

where ηul denotes the unlearning learning rate.

3.3 Relearning-resistant Model Recovery

Although the projection mechanism in Sec. 3.2 constrains utility degradation during the erasure process, the performance on retained tasks may still degrade in practice. Consequently, FU methods commonly adopt a post unlearning recovery stage, such as standard FedAvg fine tuning, by continuing federated training over the remaining clients' local datasets, denoted by Drem. However, such recovery procedures can inadvertently reintroduce partially removed knowledge, thereby weakening the effectiveness of unlearning [Chen et al., 2021; Pan et al., 2025].

Following [Ilharco et al., 2023], we adopt task vectors to represent weight space directions that encode task specific changes. Specifically, the knowledge removed during unlearning can be characterized as:

where θ denotes the global model parameters immediately before unlearning and θ∗ denotes the unlearned model.

Similarly, the knowledge acquired during the recovery stage is given by:

where θ∗,r denotes the recovered model. Relearning, also referred to as rollback, becomes prominent when recovery updates move the model back toward θ, that is, when ∆θrec contains a positive component along the rollback direction θ - θ∗ = -∆θul:

Accordingly, a recovery strategy should explicitly suppress update components that align with the rollback direction.

FedCARE mitigates this effect through a dual client and server design. At the client side, we decompose the original and unlearned models as θ = (ϕ,w) and θ∗ = (ϕ∗ ,w∗ ), where ϕ and w denote the backbone feature extractor and classifier head, respectively. During recovery, each remaining client freezes the backbone at ϕ∗ and updates only the classifier head for a small number of rounds. This restricts recovery to adjusting decision boundaries within the post unlearning representation space, reducing the risk of reconstructing previously removed features.

At the server side, with the backbone fixed, recovery updates are confined to the classifier head subspace. Suppressing rollback in the full parameter space therefore reduces to preventing head updates from moving toward the original head w. Nevertheless, due to client data heterogeneity and optimization noise, the aggregated head update may still contain a non negligible rollback component. To address this, we further filter the aggregated head update along a fixed rollback direction in the head subspace.

Following the server side filtering strategy described above, we explicitly characterize the rollback direction in the classifier head subspace. We define the normalized rollback direction as:

where w denotes the original classifier head and w∗ denotes the head after unlearning. Let ∆wagg be the standard aggregated head update from the remaining clients in a recovery round. Analogous to the conflict aware projection in Sec. 3.2, FedCARE computes the closest corrected update that does not move toward w along vrb, which admits the following closed form projection:

This filtering guarantees that ⟨∆wsafe, vrb⟩ ≤ 0, which eliminates first order rollback along the defined direction while still allowing effective utility recovery within the constrained parameter space.

3.4 Instance- and Class-level Unlearning Support

FedCARE supports different unlearning granularities with minimal modifications to the pipeline described in Secs. 3.23.3. When only a subset of samples on the target client needs to be removed, we define the forget set as Df ⊂ Du and compute the forgetting update using Df , that is, by replacing Du with Df in the forget loss and gradient in Sec. 3.2. The utility reference construction via the pseudo-sample generator G, the conflict-aware projection, and the subsequent recovery procedure remain unchanged.

For class-level unlearning of a class c, we apply two coordinated modifications. During unlearning, the forgetting update is computed using only local samples labeled c on the target client (e.g., the client with the largest amount of class c data). When constructing the utility reference, G synthesizes pseudo-samples only from the remaining label set excluding c, ensuring that the projection constraint does not preserve the removed class. Meanwhile, all remaining clients remove class c samples from their local datasets and follow the same recovery protocol described in Sec. 3.3.

4 Experiments

4.1 Experimental Setup

Datasets, Models, and Experimental Settings. We evaluate FedCARE on four standard datasets: MNIST [LeCun et al., 1998], SVHN [Netzer et al., 2011], and CIFAR10/100 [Alex, 2009]. For MNIST, we adopt a simple CNN consisting of two convolutional layers followed by two fully connected layers. For SVHN, CIFAR-10, and CIFAR-100, we use ResNet-18 [He et al., 2016] as the backbone model. In federated learning, we employ the standard FedAvg algorithm for training with 10 clients under both IID and non-IID settings. For the non-IID case, data are partitioned according to a Dirichlet distribution Dir(α) with concentration parameter α = 0.1 [Yurochkin et al., 2019].

Baselines. We compare FedCARE with six baselines, including Retraining and five state-of-the-art FU methods: FedEraser [Liu et al., 2021], FedSE [Lin et al., 2024], MoDe [Zhao et al., 2024], FedOSD [Pan et al., 2025], and NoT [Khalil et al., 2025]. Note that FedEraser and FedSE are limited to client-level unlearning.

Evaluation Metrics. We evaluate the effectiveness and efficiency of FedCARE using the following metrics: (1) Accuracy Metrics: We use R-Acc to denote the classification accuracy on classes excluding the unlearning target, measuring the retention of non-target knowledge. U-Acc represents the accuracy on classes containing the forgotten data for assessing forgetting effectiveness, while Test denotes the overall accuracy of the global model on the complete test set. For U-Acc, R-Acc and Test, the ideal objective is to closely match the performance of the Retraining baseline. (2) Membership Inference Attack (MIA) [Yeom et al., 2018]: This metric quantifies privacy leakage by measuring the extent to which the forgotten dataset Du can still be inferred as part of the training data. (3) Attack Success Rate (ASR): We employ ASR to assess whether implanted backdoor triggers have been fully removed from the model by injecting triggers into the target client's data and flipping the corresponding labels following [Halimi et al., 2022; Gu et al., 2017]. (4) Communication and Computation Costs: To evaluate system efficiency, we report the total time overhead incurred during the unlearning and recovery phases as the communication cost, along with the FLOPs [Kaplan et al., 2020] consumed by the remaining clients as the computation cost.

4.2 Main Results

Unlearning Effectiveness and Utility Maintenance We evaluate utility maintenance across three granularities: client, instance, and class levels. For client-level unlearning, Table 1 shows that FedCARE achieves a U-Acc of 78.52% on CIFAR-10, closely matching the Retraining baseline (78.63%), indicating effective disentanglement of clientspecific and shared knowledge. In contrast, partition-based and distillation-based methods, such as FedEraser and MoDe, suffer concurrent drops in both U-Acc and R-Acc, reflecting limited generalization. For instance-level unlearning (Table 3), FedCARE maintains an R-Acc of 82.21% on CIFAR10, comparable to Retraining (82.52%), demonstrating minimal collateral impact on global decision boundaries. For class-level unlearning, Table 2 shows that FedCARE uniquely achieves complete erasure, driving U-Acc to 0% under both IID and non-IID settings while preserving R-Acc close to Retraining. By contrast, FedOSD retains residual U-Acc under both IID and non-IID settings (3.54% and 2.76%), and NoT preserves substantial accuracy (54.10%), indicating ineffective removal of the target concept. Figures 2 and 3 further confirm that FedCARE incurs minimal utility degradation on retained classes during both unlearning and recovery. Since FedOSD approximates class-level unlearning via client-level unlearning, it exhibits similar performance trends across Figures 2a and 3a under identical data partitions.

Efficiency and Scalability Analysis FedCARE demonstrates strong efficiency in both execution time and computational overhead (Figure 4). As shown in Table 1, FedCARE

completes CIFAR-10 unlearning in 125.39s, yielding a 63× speedup over Retrain and a 32× speedup over NoT (4078s), which incurs high latency due to iterative fine-tuning for repairing disruptive weight negation. Beyond wall-clock time, the frozen-backbone recovery strategy significantly reduces computation, limiting FLOPs to 1.49×1014 . This is substantially lower than the compute-intensive FedOSD (8.65×1014 ) and an order of magnitude more efficient than storage-heavy methods such as FedSE, highlighting FedCARE's suitability for resource-constrained edge environments.

Privacy and Security Verification We evaluate data privacy using MIA and model security using backdoor defense. As shown in Table 3 (and Table 1 for client-level unlearning), FedCARE achieves an instance-level MIA score of 50.38% on CIFAR-10, which is close to random guessing, indicating that membership information of forgotten samples is effectively removed. In contrast, NoT and FedEraser exhibit higher MIA scores (> 57%), suggesting that identifiable traces remain in the model. For backdoor defense (Table 4), FedCARE reduces the ASR to 0% while maintaining high utility (79.42%). Although FedOSD also eliminates the backdoor, it incurs substantially higher computational cost, whereas MoDe and NoT fail to fully remove embedded triggers, with ASR exceeding 25%, which poses serious security risks and limits their applicability in safety-critical scenarios.

4.3 Ablation Experiments

To rigorously assess the contribution of each component in FedCARE, we conduct ablation studies on the non-IID CIFAR-10 dataset using ResNet-18. Specifically, we consider five variants: (M1) replacing Group Normalization in the generator with Batch Normalization to examine the effect of normalization under heterogeneous data distributions; (M2) performing unlearning via raw gradient ascent on private data without the projection constraint or protective gradient to evaluate the necessity of conflict-aware projection; (M3) applying standard FedAvg for post-unlearning recovery without any anti-relearning mechanism to expose rollback risks; (M4) disabling backbone freezing during recovery while retaining server-side projection to test whether global calibration alone can prevent feature reconstruction; and (M5) removing server-side vector filtering while keeping local backbone freezing to examine whether local constraints alone suffice to suppress directional rollback of the classifier head.

As shown in Table 5, the ablation results validate the necessity of each component in FedCARE. During unlearning, removing the projection constraint (M2) yields the lowest RAcc (77.20%), confirming that unconstrained gradient ascent severely degrades model utility, while replacing Group Normalization with Batch Normalization in the generator (M1) harms both utility and security, leading to a high ASR of 33.50% and highlighting the importance of constructing a reliable generic knowledge subspace under non-IID settings. During recovery, the FedAvg baseline (M3) exhibits severe relearning with an ASR of 45.77%, and disabling local backbone freezing (M4) causes a substantial ASR rebound to 36.60%, indicating that the backbone is a primary carrier of backdoor features and that server-side projection alone is insufficient to prevent reconstruction. Although retaining backbone freezing but removing global vector filtering (M5) reduces ASR to 20.71%, residual directional drift remains. In contrast, FedCARE combines backbone freezing with vector filtering to achieve complete backdoor removal (0% ASR) while maintaining strong utility (81.30% R-Acc), demonstrating the effectiveness of the proposed dual-constraint recovery mechanism.

5 Conclusion

This paper presents FedCARE, a unified and low-overhead federated unlearning framework that addresses key challenges in FU, including high unlearning cost, utility degradation, and unintended relearning during recovery. By combining conflict-aware projected unlearning with a relearningresistant recovery mechanism, FedCARE enables effective removal of client-, instance-, and class-level information without retraining from scratch. Extensive experiments across multiple datasets and model architectures under both IID and non-IID settings demonstrate that FedCARE achieves reliable forgetting, strong utility retention, and improved robustness compared to state-of-the-art FU methods. These results indicate that FedCARE provides a practical solution for privacy-compliant federated learning systems.

Acknowledgments

This research is supported by the National Natural Science Foundation of China (Grant no. U24A20240, no. 62441226).