Machine Unlearning

The gold standard of unlearning involves partitioning the training data into isolated shards and retraining only the affected sub-models. When a deletion request arrives, the system discards the shard containing that data point and retrains incrementally.

• SISA Framework: Sharded, Isolated, Sliced, Aggregated training
• Retraining cost is proportional to shard size, not full dataset
• Provides mathematical guarantee of complete removal
• Trade-off: Increased storage overhead for maintaining multiple model checkpoints

Instead of retraining from scratch, approximate methods apply parameter perturbations to degrade the model's memory of specific data points. Techniques include gradient ascent on the target data to reverse the original learning signal.

• Newton Step Removal: Uses Hessian matrix approximation to scrub influence
• Fisher Forgetting: Applies Fisher information matrix to identify and nullify parameter contributions
• Faster than retraining but provides probabilistic guarantees only
• Risk of over-forgetting adjacent, non-targeted data points

Certified unlearning provides cryptographic or statistical proofs that a data point's influence has been bounded. These methods quantify the maximum information an adversary could extract about deleted records.

• Differential Privacy Integration: Bounds the divergence between model trained with and without target data
• Verifiable Proofs: Cryptographic commitments to model state before and after unlearning
• Enables auditable compliance for regulated industries
• Current research frontier: bridging theoretical bounds with practical compute costs

A core challenge in unlearning is preventing the model from degrading performance on retained data while forgetting targeted samples. This mirrors the catastrophic forgetting problem in continual learning.

• Elastic Weight Consolidation: Identifies and protects parameters critical for retained knowledge
• Knowledge Distillation: Uses original model as teacher to preserve general capabilities during scrubbing
• Replay Buffers: Maintain small coresets of representative retained data for regularization
• Balancing the privacy-utility trade-off is the central optimization problem

Robust unlearning requires empirical validation that deleted data no longer influences predictions. Auditing frameworks test the model with membership inference attacks and backdoor triggers.

• Membership Inference Testing: Adversarially probes whether deleted samples appear 'familiar' to the model
• Backdoor Canaries: Intentionally planted data points with known signatures to verify removal
• Output Distribution Comparison: Measures KL divergence between scrubbed model and a retrained-from-scratch baseline
• Essential for demonstrating compliance to regulators and auditors

The gold standard of machine unlearning where the scrubbed model's parameter distribution is mathematically identical to a model trained from scratch without the target data.

• Achieved via sharded training where data points are isolated to specific model components
• Retraining is limited to the affected shard, not the full architecture
• Guarantees complete removal of influence with formal proofs
• Computationally expensive but provides auditable deletion guarantees

A practical alternative that scrubs data influence to within a statistically negligible bound, trading mathematical perfection for computational efficiency.

• Uses influence functions to estimate and reverse a data point's impact on model weights
• Applies Newton step removal to update parameters without full retraining
• Common in large-scale systems where exact unlearning is infeasible
• Verified through membership inference attack resistance testing

Sharded, Isolated, Sliced, and Aggregated training architecture that enables rapid exact unlearning by constraining each data point's influence to a single model shard.

• Training data is partitioned into disjoint shards
• Each shard trains an independent sub-model
• Deletion requires retraining only the affected shard
• Final prediction aggregates outputs from all shards
• Reduces unlearning cost from O(full retrain) to O(shard retrain)

A mathematical technique from robust statistics that quantifies how much a single training point affects a model's learned parameters and predictions.

• Computes the gradient of the loss with respect to upweighting a specific data point
• Enables counterfactual estimation: what would the model look like without this data?
• Used in approximate unlearning to reverse parameter updates
• Scales poorly to deep networks; requires Hessian-vector products and conjugate gradient approximations

Formal verification mechanisms that provide cryptographic or statistical guarantees that a data point's influence has been eliminated from a model.

• Differential privacy bounds: unlearning is verified when the model's output distribution is indistinguishable from a retrained model
• Proof-of-deletion protocols using Merkle trees for audit trails
• Enables compliance with GDPR Article 17 (Right to Erasure) and CCPA deletion requests
• Critical for regulated industries where deletion claims must withstand legal scrutiny

The unintended degradation of model performance on retained knowledge when specific data points are forcibly removed during unlearning.

• Occurs when interleaved representations in neural networks couple unrelated data points
• Mitigated through elastic weight consolidation that protects critical parameters
• Requires validation on holdout sets post-unlearning to ensure retained accuracy
• The central tension in unlearning: removing influence without destroying correlated, legitimate knowledge