A delete button is easy to draw. The promise behind it is not.

The hard part is deciding what it means.

If a user asks a system to delete one training example, the database can remove a row. The object store can drop a file. The feature pipeline can stop seeing that record tomorrow.

But a trained model is not a table. It is a compressed consequence of a training run. The deleted example may have moved a boundary, influenced a feature selection step, changed a cluster center, tuned a hyperparameter, or affected a checkpoint that later became the starting point for another model.

So the clean target is counterfactual:

return the model we would have had
if this example had never been in the training set

That is why machine unlearning is more subtle than deletion. It is not a storage operation. It is a claim about the lineage of a computation.

Cao and Yang’s 2015 paper made this systems framing explicit: a forgetting system should remove not only data, but the data’s derived lineage, and they introduced “machine unlearning” for the learning-system part of that problem.1 Ginart, Guan, Valiant, and Zou later framed data deletion in ML as the problem of efficiently deleting individual data points from trained models when full retraining is too expensive.2

The exact counterfactual is simple to say and expensive to earn:

\[\theta_{-i} = \arg\min_\theta \frac{1}{n-1} \sum_{j \ne i} \ell(z_j, \theta) + \frac{\lambda}{2}\|\theta\|_2^2.\]

Train without example \(i\). Compare the result to the deployed model. That is the gold standard in the small convex lab below.

Real unlearning work asks when we can avoid paying for that full retrain without silently changing the promise.

A Tiny Counterfactual You Can See

The lab uses two-dimensional logistic regression because the exact counterfactual can be computed. One red point is marked for deletion. The gray boundary is the full model trained with that point. The green boundary is the exact retrain after removing it. The orange boundary is a first-order influence approximation. The purple boundary is a few Newton-style repair steps on the retained data, starting from the full model.

Class 0 retained Class 1 retained Deleted point Full model Exact retrain Influence Repair

Deterministic convex experiment. The exact retrain on retained data is the target. The influence and repair models are approximations measured against that target, not certified removals.

With the default settings, exact deletion moves the logistic model by about 0.102 in parameter space. The influence approximation lands close, but leaves a 0.010 parameter gap from the exact retrain. Two repair steps on the retained data reduce that gap to about 0.000002.

The important thing is not that purple wins in a toy problem. The important thing is that the scoreboard has a target. The target is not “the deleted row is gone from storage.” The target is “how close are we to the model trained on the retained data?”

Set Repair steps to 0. The purple model is just the old full model. Its gap from the exact retrain is the whole deletion effect. Set it to 1. In this convex problem, one second-order repair step usually gets most of the way there. Set it to 2 or more, and the repair model nearly coincides with exact retraining.

Now increase Deleted leverage. The deleted point moves from an ordinary class-1 region into a high-leverage, mislabeled-looking location among class-0 points. Exact deletion moves the boundary more. The influence approximation also gets less exact, because a first-order approximation is being asked to explain a larger counterfactual.

Finally lower Regularization. The model becomes more sensitive. The lab prevents the regularization from going all the way to zero because a nearly separable logistic regression can make the exact target ill-conditioned. That is not a UI detail; it is part of the unlearning problem. If the training objective does not define a stable model, the deletion counterfactual is itself unstable.

Influence Is a Guess, Not a Receipt

Influence functions are useful because they answer a nearby question:

if I upweight this example a tiny bit,
how would the optimum move?

For a regularized empirical-risk minimizer with Hessian \(H\) at the full-data optimum, the first-order deletion approximation is roughly

\[\theta_{-i} \approx \theta + \frac{1}{n} H^{-1} \nabla_\theta \ell(z_i,\theta).\]

Koh and Liang revived influence functions for modern ML interpretability, using them to trace a model’s prediction back to training examples and to approximate the effect of training points without retraining.3 The same local sensitivity idea is tempting for unlearning: compute a correction, apply it, and declare the point forgotten.

The lab shows both why that is attractive and why it is not enough.

When the deleted point is ordinary, the influence boundary is close to exact retraining. When the point is high-leverage, the approximation error grows. When the model is nonconvex, nonsmooth, under-regularized, or trained through a messy pipeline, the gap can be harder to reason about.

Influence is evidence about a deletion.

It is not the deletion guarantee.

What Kind of Forgetting Are We Promising?

There are several levels of ambition.

The weakest is operational: after a deletion request, stop using the raw data in future training. That is necessary, but it says little about the already-trained model.

The clean deterministic target is exact retraining: produce the same model the training algorithm would have produced on the retained data. In the lab, this is the green boundary.

Then there are efficient exact or structured approaches. Cao and Yang’s summation-form approach asks the learning system to be designed so that removing one example updates stored aggregates rather than retraining from scratch.1 Ginart et al. study deletion-efficient algorithms in specific model families, including k-means.2

SISA training takes a different systems route: shard the data, isolate the influence of examples, slice training into checkpoints, and aggregate models. If one example must be removed, only part of the training computation has to be replayed.4 This does not make deletion free. It makes the blast radius of a future deletion smaller by construction.

Certified removal raises the bar further. Guo, Goldstein, Hannun, and van der Maaten define a guarantee in which a model after removal is statistically indistinguishable from a model that never saw the removed data, and they develop a mechanism for regularized linear classifiers.5 Notice the shape: certification needs both an update rule and a way to bound the residual information left behind.

So the useful question is not “can we delete data?”

It is:

which unlearning contract are we satisfying,
and what evidence proves it?

The Receipt I Would Ask For

For a real unlearning system, I would want deletion requests to produce a small technical receipt.

Not a legal receipt. A model receipt.

It would include:

  1. the training artifacts affected by the example;
  2. whether the removal used exact retraining, cached sufficient statistics, sharded replay, an approximate update, or a certified mechanism;
  3. the model version before and after removal;
  4. retained-data quality metrics before and after removal;
  5. a bound or measurement of distance from exact retraining;
  6. whether downstream models, indexes, embeddings, caches, or eval reports were also derived from the deleted example.

That last item is where many unlearning stories get thin. A model is often not the only artifact. The training data may have affected a tokenizer, feature normalizer, hard-negative mining pool, data deduplication table, synthetic data generator, benchmark split, or retrieval index.

The delete button is asking the system to reason about lineage.

Forgetting Has to Be Designed In

The comforting fantasy is that unlearning can be bolted on after training, like a new endpoint.

Sometimes it can, for simple models and narrow contracts.

But the general lesson is less comfortable: if deletion will matter later, the training system has to be designed for deletion now. Store the right statistics. Shard the right way. Preserve checkpoints. Track lineage. Keep enough metadata to know which artifacts are downstream of which examples.

Machine unlearning is therefore not the opposite of machine learning.

It is learning with a counterfactual exit plan.

The lab is small because the counterfactual is visible. The same principle scales into the hard cases: language models, recommender systems, embedding indexes, medical models, fraud systems, and human-feedback pipelines. The question is always the same:

after deletion,
what model are you claiming this is?

If the answer is “the model that would have existed without that data,” then the delete button has become a scientific claim, not just a product control.

It deserves a measurement.

  1. Yinzhi Cao and Junfeng Yang, “Towards Making Systems Forget with Machine Unlearning”, IEEE Symposium on Security and Privacy 2015. ↩ ↩2

  2. Antonio Ginart, Melody Guan, Gregory Valiant, and James Zou, “Making AI Forget You: Data Deletion in Machine Learning”, NeurIPS 2019. ↩ ↩2

  3. Pang Wei Koh and Percy Liang, “Understanding Black-box Predictions via Influence Functions”, ICML 2017. ↩

  4. Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot, “Machine Unlearning”, IEEE Symposium on Security and Privacy 2021. ↩

  5. Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens van der Maaten, “Certified Data Removal from Machine Learning Models”, ICML 2020. ↩