Machine Unlearning

A user exercises their right to erasure. Their records are deleted from every database. The model trained on them still exists, and whatever influence those records had on its parameters is still there. Whether that influence must be removed, and how it could be, is one of the genuinely unresolved questions where privacy regulation meets machine learning practice.

The exact answer and why it is impractical

Retraining from scratch on the dataset without the record produces a model that provably never saw it. It is exact, and for a large model it costs the entire training budget per request, which does not scale to a stream of erasure requests.

SISA training makes exact unlearning tractable by construction (Bourtoule et al., 2021, IEEE S&P). Shard the data, train an independent model per shard, and ensemble their outputs. Unlearning a record requires retraining only its shard, and slicing within shards with checkpoints reduces it further to retraining from the checkpoint before that slice. The cost is accuracy, since each constituent model sees a fraction of the data, and the ensemble does not fully recover what a single model trained on everything would achieve.

Approximate unlearning

Approximate methods attempt to remove influence without full retraining, targeting a model statistically indistinguishable from the retrained one rather than identical to it.

Influence-function approaches estimate a record's effect on the parameters using a second-order approximation and apply the reverse update. The approximation degrades for deep non-convex models and for removing more than a small number of records.

Gradient-ascent approaches take steps to increase loss on the forget set while constraining the model to keep performing on the retain set. Cheap, and prone to catastrophic damage if over-applied, since ascending loss without constraint destroys general capability.

For language models, targeted editing methods that locate and modify the specific parameters associated with a fact are effective at suppressing that fact's expression and are not the same as removing it, since the information frequently remains recoverable through paraphrase or indirect probing.

The verification problem

The hard part is not unlearning; it is proving it happened. There is no efficient way to certify that a model's parameters are consistent with never having seen a record, short of retraining and comparing, which defeats the purpose.

Empirical verification uses membership inference against the forgotten records: if the attack cannot distinguish them from data never seen, the unlearning is at least not detectably incomplete. That is a necessary condition rather than a sufficient one, and it is what current practice relies on.

When it breaks

Suppression is not removal. A model edited to refuse a fact may still encode it, recoverable by rephrasing, by probing internal representations, or by fine-tuning that undoes the edit. The distinction matters legally as well as technically, since a model that can be trivially made to reveal the information has not removed it.

Sequential unlearning degrades the model. Each approximate operation introduces error, and hundreds of requests accumulate into measurable damage. Systems handling erasure at volume need periodic retraining regardless, which makes the approximate methods a way to defer cost rather than avoid it.

Deployed copies are outside the mechanism. A model checkpoint that has been distributed, distilled into a student, or served from a cached deployment is not affected by unlearning applied to the source. The lineage graph defines the true scope of the operation.

The regulatory requirement is unsettled. Whether erasure obligations extend to model parameters, and what would satisfy them, is being worked out in guidance and litigation rather than settled. Most organisations currently exclude erased individuals from future training runs and do not modify deployed models, which is a defensible position and not obviously a durable one.