safety security
Deleting Later May Require Remembering Everything Now
Lower bounds show that forget-only unlearning can need information ordinary training was designed to discard.
Summary
Lower bounds show that forget-only unlearning can need information ordinary training was designed to discard.
Forget-only unlearning gives a deletion algorithm the trained model and examples to remove, but no retained data or training trace. The paper shows why that setup cannot always reproduce retraining: different datasets can produce the same model yet require different outputs after the same deletion. It derives accuracy lower bounds for several standard learners and then asks how much training information successful deletion must preserve. For simple threshold learners, arbitrary deletion requests can require memory as large as the full dataset even though ordinary training keeps only a boundary point. The result is theoretical, not a measurement of current large-model unlearning, but it exposes a design conflict: minimal sufficient state for prediction may be insufficient state for future erasure.
Why it matters
Lower bounds show that forget-only unlearning can need information ordinary training was designed to discard.
Limits and context
- Forget-only unlearning gives a deletion algorithm the trained model and examples to remove, but no retained data or training trace.
- The paper shows why that setup cannot always reproduce retraining: different datasets can produce the same model yet require different outputs after the same deletion.
- For simple threshold learners, arbitrary deletion requests can require memory as large as the full dataset even though ordinary training keeps only a boundary point.
Key claims
Lower bounds show that forget-only unlearning can need information ordinary training was designed to discard.
Qualification: Forget-only unlearning gives a deletion algorithm the trained model and examples to remove, but no retained data or training trace.
Evidence: source-2026-10-08-010
Sources
- arXiv preprint 2610.10519arXiv · primary research
Corrections
No corrections have been recorded for this story.