List of Papers Browse by Subject Areas Author List
Abstract
Federated Learning (FL) enables decentralized model training while preserving patient privacy, making it essential for medical AI applications. However, regulatory frameworks such as GDPR, CCPA, and LGPD mandate “right to be forgotten”, requiring patient data removal from trained models upon request. This has driven growing interest in Federated Unlearning (FU), but existing methods require the collaborative participation of all clients, which is often impractical and raises privacy concerns. This paper proposes Maverick, a novel collaboration-free FU framework that enables localized unlearning at the target client by minimizing model sensitivity, without requiring global collaboration from all clients to unlearn a target client. Theoretical analysis and extensive experiments on three medical imaging datasets, Colorectal Cancer Histology, Pigmented Skin Lesions, and Blood Cells, demonstrate Maverick’s effectiveness in sample, class, and client unlearning scenarios. Maverick offers a robust solution for trustworthy FL in healthcare, meeting regulatory requirements. The code is publicly available at https://github.com/OngWinKent/Maverick
Links to Paper and Supplementary Materials
Main Paper (Open Access Version): https://papers.miccai.org/miccai-2025/paper/0430_paper.pdf
SharedIt Link: Not yet available
SpringerLink (DOI): Not yet available
Supplementary Material: Not Submitted
Link to the Code Repository
https://github.com/OngWinKent/Maverick
Link to the Dataset(s)
BibTex
@InProceedings{OngWin_Maverick_MICCAI2025,
author = { Ong, Win Kent AND Chan, Chee Seng},
title = { { Maverick: Collaboration-free Federated Unlearning for Medical Privacy } },
booktitle = {proceedings of Medical Image Computing and Computer Assisted Intervention -- MICCAI 2025},
year = {2025},
publisher = {Springer Nature Switzerland},
volume = {LNCS 15973},
month = {September},
page = {358 -- 368}
}
Reviews
Review #1
- Please describe the contribution of the paper
This paper proposes Maverick, a collaboration-free FU framework designed for medical applications. Maverick allows individual clients to perform unlearning locally without requiring participation from others through minimizing model sensitivity.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
- Important Practical Problem The work targets a critical regulatory and practical challenge: the “right to be forgotten” in FL, especially within the privacy-sensitive medical domain. It will be nice if the author can further illustrate why the proposed FU algorithm especially fits well in the medical image domain compared to others.
- Collaboration-Free Framework The paper breaks away from the assumption that unlearning must be globally coordinated. This represents a meaningful contribution and offers real-world utility.
- Strong Results Maverick achieves strong unlearning results in three medmnist classification tasks.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
- Leak of motivation of proposing the Maverick for this paper: There are already collaboration free FU algorithms in the general FL (simple SGA and its variant like elastic weight consolidation SGA, flipping-based forgetting and its variant, e.t.c), while this paper has not provided a literature review nor a motivation of why the proposed Maverick will fit well (the uniqueness about Maverick), especially for the medical image analysis domain. Those baselines are not included.
- The paper claim that a theoretical bound is derived as a contribution, but there is no rigid proof. In theorem 1, what is the bound B_L and B_U is not clear. It seems that the model derives a unclear bound directly after stating their problem, which hurts the rigidity of the paper.
- Empirical Evaluation Problem: First, reporting the running time is not standarized for measuring computational cost as we don’t know if the running environment will affect the metrics. For example, if there are other processes running at each measurement. People usually use FLOPS (there are also similar standarized metrics for other computaional dimension) for measuring the computational cost. Second, as mentioned above, the similar collobration-free FU baselinses are not mentioned in the paper.
- Security concern of the proposed pipeline: local model may upload a poisoned or unsecure model back to the server, which may further influence the overall security of the FL system.
- Limited Model Variety: Only ResNet18 is used. Although sufficient for baseline comparisons, applying Maverick to more complex architectures (e.g., transformers or 3D models for medical imaging) would boost generality claims.
Minor Suggestions
- Include a brief of hor Maverick benefit to the community of medical image analysis will be help, e.g., what’s the motivation people in MIA will choose Maverick rather than the broad FU algorithms.
- Clarify whether Maverick modifies the global model post-unlearning or whether a separate global model is maintained.
- Improve clarity in a few places (e.g., Eq. 5 optimization target is slightly ambiguous—minimizing over θo seems odd; likely should be over θ).
- Please rate the clarity and organization of this paper
Satisfactory
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The authors claimed to release the source code and/or dataset upon acceptance of the submission.
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2025/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(2) Reject — should be rejected, independent of rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
First, there is a leak in both the thoeritical analysis (leak of rigid proof and clear bound) and the empirical validation (computational time is measured inaccurately). Thus, the claim of this paper cannot be well supported. Second, the motivation of proposing Maverick is unclear given there are already collaboration free FU algorithms in general FL, while the paper has not provide the review for them nor include the baseline for them. Last, the proposed FU works involves local unlearning, which may lead to security leakage (e.g., untrusted client poison the model in this process). Thus, there seems to be major flow in this paper.
- Reviewer confidence
Confident but not absolutely certain (3)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Accept
- [Post rebuttal] Please justify your final decision from above.
Although the paper misses the proof for theorem and has some flow in computational cost measurement, the author indicates that this is due to space issue and will fix them.
Review #2
- Please describe the contribution of the paper
This paper proposes a technique for federated unlearning, which removes the influence of specific data from the training data used by each client in a federated learning scenario, by simply unlearning only the clients that contain the data to be removed from the entire federated learning model. This paper proposes a mechanism of Federated Unlearning that removes the influence of the data to be erased from the entire federated learning model by only unlearning the clients that contain the data to be erased.
This is the first time that a federated unlearning method that does not require unlearning of the entire client model has been proposed, and it is the first time that a federated unlearning method that only requires unlearning of a specific client model is used to achieve federated unlearning of the entire model.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
The strong points of this paper are: (1) this paper pointed out that existing coalitional unlearning requires all clients to cooperate in unlearning, which is practically inefficient, and then devised a new method to achieve overall unlearning by only processing unlearning of specific clients. (2) Furthermore, this paper has experimentally shown that the proposed method is more effective in eliminating data, which is its objective, than other methods of coalition de-learning in this setting, even though it is a simple IID setting.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
The weak point is that the evaluation experiment was conducted only at IID setting. Since actual coalition learning is expected to be Non-IID, it is desirable to show that even in this case, the entire unlearning can be achieved with only the unlearning of a specific client. However, this paper describes that this is the first attempt to realize the whole unlearning only by non-learning of such a specific client, and if this is true, the fact that the evaluation experiments were not conducted in the Non-IID setting is not a particularly big problem.
- Please rate the clarity and organization of this paper
Good
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The authors claimed to release the source code and/or dataset upon acceptance of the submission.
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2025/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(4) Weak Accept — could be accepted, dependent on rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
The fact that this is the first proposal of an attempt to achieve total unlearning in coalition learning by only processing unlearning of specific clients and that the proposed method is experimentally shown to be more efficient in unlearning than other coalition unlearning methods are considered to be sufficient contributions to MICCAI. In particular, privacy protection is an important issue when applying federated learning to medical data, and the regulatory framework requires that the data must be removed from the learning model at the request of the data provider. In order to efficiently achieve federated de-learning, a method such as the one proposed in this paper, which can achieve overall federated de-learning by only de-learning the specific client whose data is to be deleted, is considered to be of high importance. In this sense, this paper is the first paper that attempts to realize such coalitional unlearning, and is worthy of being adopted by MICCAI.
- Reviewer confidence
Confident but not absolutely certain (3)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Accept
- [Post rebuttal] Please justify your final decision from above.
I read the review results of the other reviewers and feedback from the authors, and decided that there were no problems that warranted Reject.
Review #3
- Please describe the contribution of the paper
This paper proposes a federated unlearn method to complain with the right-to-be-forgotten regulation. The main innovation of the proposed method is that it does not require all sites to participate in the unlearning process, just the site that want to unlearn a sample, class, or the site itself needs to optimize the model. Another important contribution of the paper is that the proposed method works without modifications for different unlearning scenarios (i.e., sample, class, or site).
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
First of all, I would like to congratulate the authors for this paper.
- The paper is well written, easy to follow, contains nice visualizations, provide the necessary background to understand the problem and related work, and describe the proposed method and experiments in details, all in a very concise and clear manner.
- The description of the method and experiments are detailed, providing justifications for their design choices. It also includes mathematical formulation that helps to understand how memorization is being minimized during the unlearn process for the data that needs to be erased and how the model is retaining the necessary knowledge for the data that should not be forgotten.
- This paper provides a very strong evaluation which includes: a) three scenarios to unlearn (samples, class, and site), b) three databases (histology, derma, and blood), c) five baselines (model before unlearn, retrain, fine tuning, fedCDP (method designed to unlearn class), and fedRecovery (method designed to unlearn sample or site)), d) four quantitative metrics ( accuracy of the model on the retaining data, accuracy of the model on the unlearned data, privacy based on the membership inference, running time) and one qualitative metric (attention maps), and e) an ablation study to determine the standard deviation of the noise to be sampled to perturb the data samples during the unlearn process.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
The paper can be stronger if the authors provide more details on how they simulated the FL. When they list their hyperparameters, it is not clear if sample size N = 10 means that each of the k clients had 10 samples for training or if they are referring to batch size. I would recommend the authors to clarify this aspect. I believe they are referring to batch size, and it this is the case, it would be nice to include details about the quantity of local dataset at each of the k clients.
- Please rate the clarity and organization of this paper
Good
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The authors claimed to release the source code and/or dataset upon acceptance of the submission.
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2025/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(6) Strong Accept — must be accepted due to excellence
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
It is hard to include extremely detailed evaluation in 8 pages. The authors of the this paper mastered the communication when reporting their results and providing background information. This paper contains more details than many journal papers and is written very well. One of the best conference papers I have every read.
- Reviewer confidence
Very confident (4)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Accept
- [Post rebuttal] Please justify your final decision from above.
I am impressed that the authors were able to run additional experiments in a short period of time to reply every single point mentioned by the three reviewers. I still belive this work has a great quality, extensive experiments, and is nicely written. Therefore, I believe this paper should be accepted.
Author Feedback
We sincerely thank all reviewers for their constructive and encouraging feedback. We appreciate the recognition of our novel methodological contributions (R1, R2, R3), importance of the problem addressed (R1, R2, R3), the strength of our empirical results (R1, R2), and the clarity of our presentation (R1, R2). Below, we provide detailed responses to each point raised.
R1: We appreciate the positive assessment of our work. Due to the page limit, some experimental details were omitted in the initial submission. We apologize for the confusion regarding the reported sample size N = 10, which refers to the perturbation sample size used in the Monte Carlo approximation for sensitivity estimation in Eq. (4). Additional clarifications, including training configurations, dataset splits, and federated settings, will be incorporated in the revision, shall permitted.
R2: To our knowledge, Maverick is the first collaboration-free federated unlearning (FU) framework specifically designed to reduce privacy leakage in the medical domain. As suggested, we evaluated its performance under non-IID data distributions using the Blood Cells dataset with Dirichlet-based partitioning. The empirical results demonstrate that Maverick continues to maintain high utility while preserving effective forgetting. Also, Maverick performs comparably to retrain baselines, confirming its robustness in realistic heterogeneous settings.
R3: For missing existing collaboration free FU work, as no specific citations were provided by reviewer, we inferred that the intended refs. are likely [1–3]. These methods, while relevant, require server-side Fisher information sharing, exposing side channels and communication overhead. In contrast, Maverick performs a single step, noise hardened update on the unlearning client’s data alone, eliminating external regularization and cross-party communication. This improves both computational efficiency and privacy guarantees. On theoretical rigor, due to space limits, only a summary of the Lipschitz-based bound was provided. We apologize and we will expand this in the final version for better clarity, if permit. We deem this is a minor, easily fixable issue. On efficiency concern, we conducted new experiments to measure FLOPs, as suggested. The results reaffirm that Maverick still achieves the lowest FLOPs compared to all baselines. Regarding security concerns, we respectfully disagree as model poisoning is orthogonal to our current work. Our contribution is focused on privacy-preserving unlearning, while secure unlearning under adversarial settings is a different, promising future research direction. For model variety, ResNet-18 was selected for consistency with prior FU. As suggested, we further evaluated Maverick on AlexNet and Inception-v3, and observed consistent performance across all metrics, confirming its architecture agnostic effectiveness. Complex models like 3D architectures are beyond scope as our datasets are 2D only. For deployment, the updated model replaces the global one directly, simplifying rollout and minimizing system complexity. For community benefit, Maverick requires only the target client’s participation, reducing burdens on retained clients. This is an important consideration in privacy sensitive and resource constrained environments like healthcare.
As summary, we value all reviewers’ feedback and view the concerns are minor, easily fixable and do not affect the paper’s core contributions. We are committed to revise and improve all in final version. We hope this rebuttal fully addresses every point and encourages reviewers to raise the scores in support of acceptance. Thank you
Refs: [1] Wu et al. (2022) Federated Unlearning: Guarantee the Right of Clients to Forget, IEEE Network, 36(5), 129-135. [2] Li et al., Anti-Backdoor Learning: Training Clean Models on Poisoned Data, NeurIPS 2021. [3] Zhang et al., FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning, ICLR 2023.
Meta-Review
Meta-review #1
- Your recommendation
Invite for Rebuttal
- If your recommendation is “Provisional Reject”, then summarize the factors that went into this decision. In case you deviate from the reviewers’ recommendations, explain in detail the reasons why. You do not need to provide a justification for a recommendation of “Provisional Accept” or “Invite for Rebuttal”.
N/A
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation. You may optionally write justifications for ‘accepts’, but are expected to write a justification for ‘rejects’
N/A
Meta-review #2
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation. You may optionally write justifications for ‘accepts’, but are expected to write a justification for ‘rejects’
N/A
Meta-review #3
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation. You may optionally write justifications for ‘accepts’, but are expected to write a justification for ‘rejects’
N/A