Right to Erasure

Unlike deleting a database row, removing a patient's data from a trained neural network requires selectively reversing the contribution of that data to the model's learned parameters. In federated settings, this is compounded by the fact that the global model is an aggregate of updates from multiple institutions.

• Exact unlearning requires retraining from scratch without the deleted data—computationally prohibitive for large models
• Approximate unlearning uses techniques like influence functions to estimate and subtract the data's impact
• Sharded, isolated training allows deletion by discarding only the affected sub-model

In healthcare, the challenge is acute: a single patient's MRI may have subtly shaped feature detectors across dozens of convolutional layers.

Regulators require demonstrable proof that erasure has been executed, not merely a promise. Zero-knowledge proofs (ZKPs) enable a node to cryptographically attest that it has removed specific data and recomputed its model contributions—without revealing the data itself.

• Succinct non-interactive arguments (SNARKs) can prove correct retraining was performed
• Merkle tree commitments to training data allow proving a specific record is no longer in the set
• Verifiable computation ensures the unlearning algorithm was executed faithfully

This creates a tamper-evident audit trail where a regulator can verify deletion without accessing any protected health information.

Effective erasure requires knowing exactly which model updates were influenced by a specific patient's data. This demands rigorous provenance tracking across the federated lifecycle.

• Immutable lineage graphs record which local datasets contributed to each training round
• Cryptographic hashing of training data enables later verification of inclusion or exclusion
• Versioned model checkpoints allow rollback to states before the deleted data was introduced

Without this infrastructure, an institution cannot confidently assert that a patient's data has been fully excised from the global model. Blockchain audit trails are often deployed to maintain this lineage in a tamper-evident manner.

The Right to Erasure is not a one-time technical fix—it requires an automated, ongoing workflow that spans legal, administrative, and technical domains.

• Dynamic consent dashboards allow patients to revoke permissions in real time
• Event-driven triggers propagate deletion requests to all federated nodes within mandated timeframes (typically 30 days under GDPR)
• Partial erasure support: Patients may withdraw consent for specific use cases while permitting others
• Conflict resolution: When one institution's deletion request conflicts with another's legal obligation to retain data

This orchestration layer must integrate with existing FHIR-based consent resources and institutional identity management systems.

When exact unlearning is infeasible, differential privacy (DP) provides a statistical guarantee that the model's outputs are nearly indistinguishable from one trained without the deleted data.

• By training with a sufficiently small privacy budget (ε), the influence of any single record is mathematically bounded
• Deletion can be approximated by continuing to decay the privacy guarantee until the record's influence is negligible
• This approach satisfies the spirit of erasure when combined with data minimization protocols that limit how much individual information enters the model

DP-based unlearning is particularly relevant for cross-silo federated learning where full retraining would disrupt ongoing clinical operations.