Machine Unlearning

Machine unlearning is the process of removing the influence of specific training data from a trained machine learning model, so that the model behaves as if it had never seen those examples. The goal is to match a model retrained from scratch without the data while spending far less compute than full retraining. Requests to forget come from data privacy law, such as the right to erasure in Article 17 of the GDPR, from copyright claims, from data later found to be mislabeled or poisoned, and from efforts to strip hazardous knowledge out of large language models (LLMs).

Why Deleting the Data Is Not Enough#

Gradient descent spreads what a model learns from each example across its model weights, so deleting the original images or documents from storage leaves that learning in place. Models can also retain recoverable traces of individual examples: membership inference attacks test whether a specific record was in the training set, and large language models can reproduce memorized passages verbatim. Regulators treat the model itself as a product of the data. In a 2021 settlement, the US Federal Trade Commission required the photo app maker Everalbum to delete facial recognition models and algorithms it had built with users' photos without proper consent, a remedy now called algorithmic disgorgement.

Exact and Approximate Unlearning#

Exact unlearning produces a model drawn from the same distribution as one retrained without the forgotten data. Retraining from scratch is the baseline, and the SISA framework from Bourtoule et al. makes it cheaper by Sharding the training set, training an Isolated model on each shard, Slicing each shard into checkpointed stages, and Aggregating the shard models' predictions. A deletion request then retrains only the shard that held the example:

import numpy as np
from sklearn.datasets import load_digits
from sklearn.linear_model import LogisticRegression
from sklearn.model_selection import train_test_split

X, y = load_digits(return_X_y=True)
X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.3, random_state=0)

# SISA: split the training set into isolated shards and train one model per shard
shards = np.array_split(np.arange(len(X_train)), 5)
models = [LogisticRegression(max_iter=5000).fit(X_train[s], y_train[s]) for s in shards]

# Honor a deletion request for training sample 123 by retraining only the shard that held it
k = next(i for i, s in enumerate(shards) if 123 in s)
shards[k] = shards[k][shards[k] != 123]
models[k] = LogisticRegression(max_iter=5000).fit(X_train[shards[k]], y_train[shards[k]])

# Aggregate the shard models by majority vote
votes = np.stack([m.predict(X_test) for m in models])
pred = np.array([np.bincount(v).argmax() for v in votes.T])
print(f"Retrained {len(shards[k])} of {len(X_train)} samples, test accuracy {(pred == y_test).mean():.3f}")

The script prints Retrained 251 of 1257 samples, test accuracy 0.957: the forgotten digit never touched the retrained shard model, and the deletion cost a fifth of a full retraining. The price is paid up front, because each shard model sees less data: on ImageNet classification, the paper measured a 1.36x retraining speedup with a small loss in accuracy, against 4.63x on the simpler Purchase dataset.

Approximate unlearning edits an existing model instead and accepts that the result only resembles the retrained one. Common methods include gradient ascent on the forget set to raise its loss, fine-tuning on the retained data to repair collateral damage, and influence-based updates that estimate how each example moved the weights. For LLMs, Microsoft researchers erased Harry Potter knowledge from Llama 2 7B in about one GPU hour of fine-tuning while scores on common benchmarks stayed almost unchanged.

Testing Whether a Model Has Forgotten#

A convincing evaluation compares the unlearned model with one retrained without the data. Accuracy on the forget set should fall to the retrained model's level rather than to zero, because a model that fails conspicuously on exactly the deleted examples reveals which examples were deleted. Accuracy on the retained and test data should hold, and a membership inference attack on the forgotten examples should do no better than chance. Benchmarks such as TOFU, built on fictitious author biographies, and WMDP, which measures hazardous biology, chemistry, and cyber knowledge, apply these tests to LLMs.

Approximate methods often hide knowledge rather than remove it. An adversarial study found that fine-tuning on just 10 unrelated examples restored most of the hazardous capabilities that RMU, a leading LLM unlearning method, had suppressed. Only exact methods guarantee removal by construction.

Machine Unlearning vs. Related Terms#

• Catastrophic forgetting: Unintended loss of earlier knowledge when a model trains on new data. Unlearning removes chosen knowledge on purpose.
• Continual learning: Adding new knowledge over time without losing the old. Unlearning runs in the opposite direction.
• Model editing: Changing specific facts or behaviors, such as updating who holds an office. Unlearning targets the influence of particular training examples, and its success is judged against a retrained model.
• Differential privacy: A training-time guarantee that bounds how much any single example can affect the model, which limits what an attacker could learn about a record that later needs to be forgotten.

Unlearning in Practice#

Every deletion starts by finding which models were trained on the data:

For computer vision models fine-tuned from pretrained weights that never saw the deleted data, full retraining is often affordable, a far smaller job than pretraining an LLM. In Ultralytics Platform, each dataset's Models tab lists every model trained on it, with the immutable dataset version for runs that saved one, so a deletion request can be traced to the YOLO26 models that saw an image, which are then retrained on a new version without it. The same trace-and-retrain steps cover a patient who withdraws consent for scans used in medical image analysis and faces or license plates captured by security cameras that a model owner agrees to delete.