Machine unlearning is the attempt to remove the influence of specific training data from a trained model without retraining it. The methods are plausible; the problem is that nobody has a reliable way to tell whether one worked, and a model that no longer emits a fact under one probe may still contain it.
What is being asked for
Three distinct demands travel under one word, and they have different success conditions.
- Legal deletion. A data subject exercises a right to erasure and their data must be removed from processing. Whether that extends to model weights is contested and unsettled; regulators have not converged, and the practical question of what erasure means once the data has been trained on is live.
- Capability removal. Remove a hazardous ability rather than a specific document. This is a safety goal and is arguably harder, because the capability is distributed across a large amount of related training data rather than concentrated in one place.
- Correction. Remove a wrong or harmful association. This overlaps with model editing and is the most tractable of the three, because success is defined behaviourally.
A method evaluated against the third and marketed against the first is the recurring pattern in this area.
Exact unlearning, and why it is rare
Exact unlearning means producing the model you would have got had the data never been included. There is one honest way to do it — retrain without the data — and one clever way to make that affordable, which is to plan for it in advance.
SISA (Bourtoule and colleagues, 2021) is the canonical construction: shard the training data, train a separate model per shard, and aggregate their predictions. To unlearn an example you retrain only the shard containing it, and checkpointing within shards reduces the cost further. The guarantee is real and the trade-offs are what keep it out of frontier training: sharding hurts quality because each submodel sees less data, aggregation adds serving cost, and the scheme must be adopted before training rather than applied afterwards.
For a model that already exists and cost millions to train, exact unlearning is retraining, which is why everything below is approximate.
The approximate methods
| Approach | Description |
|---|---|
| gradient ascent | Run gradient ascent on the loss for the forget set — deliberately making the model worse at predicting it. Simple and unstable: push too far and the model degrades broadly, too little and nothing changes. Usually paired with continued training on a retain set to anchor general capability. |
| preference-style objectives | Train the model to prefer a refusal or a neutral response over the target content, using the same machinery as alignment tuning. Behaviourally effective, and by construction it teaches a response rather than removing knowledge. |
| representation-level intervention | Identify directions or components associated with the target knowledge and damage them — projecting them out, or perturbing the weights that write them. Closer to removal in spirit; depends entirely on the identification being right. |
| targeted weight editing | Apply editing-style updates to overwrite specific associations. Inherits every specificity and ripple problem from the editing literature. |
| guardrails | Filter the target content at input or output. Not unlearning at all, and worth naming because it is sometimes described as if it were. The knowledge is untouched. |
The evaluation problem
This is the heart of it. Suppose you unlearn a fact and the model no longer states it when asked directly. What have you shown?
You have shown that one query, decoded one way, no longer produces it. The information could still be present and reachable by a differently phrased question, in another language, under a role-play framing, as a multiple-choice selection rather than free generation, or in the model’s log-probabilities even where the top token has changed. Each of those is a documented failure mode of unlearning evaluations.
The asymmetry is fundamental, and it is the same one that appears in extraction studies. Demonstrating presence takes one successful probe. Demonstrating absence requires ruling out every probe, and the space of probes is unbounded. There is no experiment that establishes a model does not contain something. The best available evidence is failure across a diverse, adversarial battery — which is ultimately a statement about your battery.
The attacks that expose it
- Paraphrase and translation. Ask in five phrasings and three languages. Methods that suppress a surface form fail here immediately, and this is the cheapest test that discriminates between methods.
- Change the output format. If free generation refuses, try multiple choice, try fill-in-the-blank, try asking the model to rank candidates. Knowledge that cannot be spoken can often still be selected.
- Read the probabilities. The correct answer may still be ranked second. A model whose top token changed but whose distribution barely moved has not forgotten anything, and log-probabilities make that visible in one call.
- Relearning. The strongest test. Fine-tune the unlearned model on a small amount of related but different data and see whether the target capability returns. If a handful of examples restores it, the knowledge was suppressed rather than removed, and this test has repeatedly separated methods that looked equally good under direct probing.
- Probe the internals. Train a probe on hidden states to recover the supposedly removed property. Decodability after unlearning is direct evidence that the representation survived.
What the benchmarks measure
Two are worth knowing. TOFU (Maini and colleagues, 2024) uses synthetic author biographies specifically so that the forget set is known to be entirely within the fine-tuned model and absent from pretraining — which removes the confound that ruins most unlearning evaluations, namely that you cannot tell whether the model knew the fact from the target document or from a hundred others. The WMDP benchmark, published in 2024, approaches capability removal by measuring hazardous-knowledge proxies alongside general capability, so that a method which unlearns by breaking the model scores badly.
Both report on two axes at once, and that pairing is the design lesson. Forget-set performance alone is trivially optimisable by damaging the model. Any unlearning result without a retain-set and general-capability number beside it is not a result.
What this means for a deletion request
If you operate a system and receive a request to delete personal data, the defensible position today is layered, and it does not rest on unlearning working.
- Delete from the primary store, the logs, the backups on their schedule, and any retrieval index. This is genuine deletion, and it is where the data actually is for most systems.
- Exclude it from future training runs, and record that exclusion in a form you can show.
- Apply output-side filtering for the specific content, understanding and documenting that it is mitigation rather than removal.
- Where the data was in a fine-tune you control, retrain that fine-tune without it. Usually affordable, unlike retraining a base model, and it is real removal for that stage.
- Do not represent approximate unlearning as deletion. If the base model saw the data, say what you did and what it does and does not guarantee. Documenting the limit is a defensible position; overstating it is not.
The research is worth following and the direction is right. It is not yet at the point where a claim of removal can be verified, and any product that says otherwise is describing an aspiration.
Top comments (0)