Deleting a record from storage is a solved engineering problem. Deleting its influence from a set of trained weights is not, and the gap between those two operations is where a growing amount of privacy law is now pointing.
Training does not copy data into a model. It uses each example to nudge millions of parameters, and the nudge stays after the example is gone. Most of the time that residue is diffuse and no individual example is recoverable. Sometimes it is not diffuse at all. Researchers extracting training data from a language model have recovered verbatim sequences from the corpus, including names, phone numbers and addresses that appeared only a handful of times. The same has been demonstrated against image generators, which can reproduce near-copies of specific training images.
The expensive answer that definitely works
Retrain from scratch on the corpus with the record removed. The resulting model is exactly the model you would have had if the data had never arrived, which is the strongest definition of forgetting available.
It is also unusable at scale. A large model costs a great deal of compute and days or weeks of wall-clock time per training run. Deletion requests arrive continuously. Nobody is retraining a frontier model per request, and any policy written on the assumption that they will is a policy that describes nothing.
Sharding, so that retraining costs less
The best known structural answer is SISA, introduced by Bourtoule and colleagues in 2021. The training set is split into shards, each shard trains its own constituent model, and predictions come from aggregating those models. Within each shard the data is further split into slices, with checkpoints saved as slices are added.
When a deletion request lands, only the shard holding that record needs attention, and only from the checkpoint before the affected slice. One request costs a fraction of a full retrain rather than all of it.
The trade-offs are real. Each constituent model sees less data, so accuracy drops, and the drop is worse when the data is not independently and identically distributed. Storing checkpoints costs disk. The architecture has to be chosen up front, because you cannot shard a model retroactively. This is the recurring pattern in the field: exact unlearning is achievable if you design for it before training, and close to impossible if you did not.
Exact unlearning produces a model identical to one trained without the data. Approximate unlearning produces a model that is statistically hard to distinguish from that one. The second is what almost every practical proposal delivers, and the strength of the guarantee depends entirely on the definition of "hard to distinguish."
Approximate unlearning and the word "certified"
The approximate approaches modify the existing weights rather than rebuilding them: apply gradient ascent on the data to be removed, use influence functions to estimate and subtract its contribution, or fine-tune against a scrubbing objective.
Some of this work carries formal guarantees. Certified removal, proposed by Guo and colleagues in 2020, borrows the framing of differential privacy: after the removal procedure, the updated model is within a bounded statistical distance of the retrained one. The bound is provable for convex problems such as linear and logistic regression. Extending it to deep networks, where the loss surface is non-convex and training is path-dependent, is where the proofs stop.
So a vendor saying "we support certified unlearning" is making a claim whose meaning depends on the model class. For a linear model over structured features it can be precise. For a transformer it is usually an aspiration with an empirical evaluation attached.
Nobody can easily check the work
Verification is the part of this field that is genuinely open. Given a model and a claim that a record was unlearned, how does a regulator, an auditor, or the person who filed the request confirm it?
The usual instrument is a membership inference attack: probe the model and try to determine whether a given example was in its training set. If the attack can no longer distinguish the removed record from data the model never saw, that is evidence of forgetting. It is not proof. It shows that one attack failed, and the next attack may be stronger. The NeurIPS 2023 unlearning competition made this concrete, and the evaluation methodology was as contested as the submissions.
| Approach | Guarantee | Practical cost |
|---|---|---|
| Full retrain | Exact. The record was never seen. | The entire training budget, per request or per batch of requests. |
| Sharded training (SISA) | Exact, within the shard architecture. | Accuracy loss, checkpoint storage, must be designed in before training. |
| Certified removal | Provable statistical bound, for convex models. | Low, but the proof does not carry over to deep networks. |
| Gradient-based scrubbing | Empirical. Measured by attacks that failed. | Low, with a risk of degrading unrelated model behaviour. |
| Output filtering | None. The model still knows, it declines to say. | Trivial, which is why it is common. |
What regulators have required so far
The legal position is unsettled and moving in an interesting direction. Article 17 of the GDPR gives a right to erasure, and whether that reaches the weights of a trained model is disputed. A 2024 discussion paper from the Hamburg data protection authority argued that a large language model does not itself store personal data in the legal sense, which would put the model outside the scope of an erasure request while leaving the training corpus and the outputs inside it. The European Data Protection Board's opinion on AI models, published in December 2024, declined to treat models as automatically anonymous and directed supervisory authorities to assess case by case.
Meanwhile the US Federal Trade Commission has not waited for that argument to settle. In several orders it has required companies to delete not only unlawfully collected data but the models and algorithms derived from it. The 2021 order against the photo app Everalbum required deletion of face-recognition models built from user photos. A 2022 order concerning a children's weight-loss app required deletion of the data and of any algorithms derived from it. The remedy is often described as algorithmic disgorgement, and it establishes something useful: a model trained on data you should not have had is itself a thing you can be ordered to destroy.
Questions worth asking a service
When a company says it honours deletion, the following distinctions separate a real answer from a comfortable one.
- Does deletion cover future training runs only? This is the most common actual behaviour and it is defensible, but it means the deployed model keeps what it learned until the next full retrain.
- What is the retrain cadence? "Removed at the next training cycle" means something different at monthly and at annual frequency.
- Are derived artefacts covered? Embeddings, feature stores, cached inferences and fine-tuning checkpoints all outlive the source record unless someone enumerated them.
- Is filtering being described as deletion? A model that refuses to output your address still contains whatever made that output possible.
- Was the alternative to collect less? Data minimisation remains the only approach where the unlearning problem does not arise, and federated and differentially private training reduce how much any single record can be recovered in the first place.
The pattern is familiar from search delisting, where removing a result never removed the page. Machine unlearning is the same structure one layer deeper. The record can be gone from every database the company runs while the thing built from it continues to operate, and the difficult part is not the removal. It is proving that anything was removed at all.