Core ML

Machine Unlearning

Machine unlearning is the mathematical process of forcing a model to 'forget' a specific piece of training data without having to retrain the entire model from scratch.

When a user requests data deletion, the system calculates the exact gradient updates that user's data caused during training, and subtracts them from the model's weights, making the model 'forget' the user.

Why Does This Exist?

Under modern privacy laws like the GDPR (Europe) and CCPA (California), users have the "Right to be Forgotten." If you ask a company to delete your data, they must delete it from their databases.

But what if your data was used to train a machine learning model? Because neural networks can memorize their training data (Memorization and Extraction), simply deleting the record from the SQL database isn't enough; the model's weights still contain traces of your information.

Historically, the only way to guarantee a model had forgotten someone was to delete their data from the training set and retrain the entire model from scratch. For large foundation models, retraining costs millions of dollars and takes months. Machine Unlearning is the emerging field of computer science dedicated to mathematically scrubbing a specific data point out of a trained model's weights efficiently, without starting over.

Think of It Like This

Removing an ingredient from a baked cake

If you accidentally drop a bad egg into a bowl of flour, you can just scoop it out. That is like deleting a row from a database.

But if you bake the cake, the egg's chemical structure is distributed throughout the entire pastry. You cannot simply scoop it out. If someone says, "I am allergic to eggs, take it out," your only option is usually to throw the cake in the trash and bake a new one from scratch (retraining).

Machine unlearning is like inventing a chemical process that allows you to inject a precise neutralizing agent into the baked cake that perfectly extracts the egg molecules while leaving the rest of the cake perfectly intact.

How It Actually Works

Machine Unlearning is notoriously difficult because a neural network's weights are heavily entangled. Changing one weight to "forget" a data point affects the model's accuracy on thousands of other data points.

Researchers use two main approaches to solve this:

1. Exact Unlearning (SISA)

Exact unlearning provides a mathematical guarantee that the model is identical to one that never saw the data. The most famous architecture for this is SISA (Sharded, Isolated, Sliced, and Aggregated).

Instead of training one giant model on all the data, you split the data into 10 isolated "shards" and train 10 separate sub-models.
When a user asks to be deleted, you find the 1 shard their data was in, delete their data, and retrain only that 1 sub-model.
You save 90% of the retraining cost. However, this architecture only works well for specific types of ensemble models, not massive single-LLMs.

2. Approximate Unlearning (Gradient Ascent)

For massive models, exact unlearning is impossible. Instead, we use approximate unlearning.

During training, the model learned the data by moving its weights in the direction of the negative gradient (Gradient Descent).
To unlearn the data, we calculate the gradient of the loss on the data to be forgotten, and move the weights in the opposite direction (Gradient Ascent).
We intentionally make the model perform terribly on the forgotten data. To ensure the model doesn't get ruined entirely, this process is usually balanced with a small amount of standard training on the "retain" set (the data we want to keep).

Show Me the Code

1import torch2
3def approximate_unlearn(model, forget_data, retain_data, lr=0.001, epochs=5):4    optimizer = torch.optim.Adam(model.parameters(), lr=lr)5    6    for epoch in range(epochs):7        # 1. Gradient Ascent on the Forget Set (Make it forget)8        forget_predictions = model(forget_data)9        forget_loss = -1.0 * compute_loss(forget_predictions) # Negative loss!10        11        # 2. Gradient Descent on the Retain Set (Keep it smart)12        retain_predictions = model(retain_data)13        retain_loss = compute_loss(retain_predictions)14        15        # 3. Combine and update16        total_loss = forget_loss + retain_loss17        18        optimizer.zero_grad()19        total_loss.backward()20        optimizer.step()21        22    return model

Watch Out For

The Streisand Effect of Unlearning

If you use approximate unlearning (Gradient Ascent) too aggressively, the model doesn't just return to a baseline state of ignorance; it actively becomes unnaturally bad at predicting the forgotten data. An attacker can probe the model, find the exact data points it performs unnaturally terribly on, and confidently infer that those specific data points were recently requested for deletion.

Regulatory uncertainty

The legal definition of "deletion" in AI is still unsettled. Some regulators insist on Exact Unlearning (retraining from scratch), arguing that Approximate Unlearning still leaves mathematical traces of the data in the weights. Until case law catches up with the math, deploying Approximate Unlearning carries legal risk.

The Quick Version

Machine Unlearning is the process of removing the influence of specific training data from a trained model without retraining from scratch.
It is driven by privacy regulations like the "Right to be Forgotten."
Exact unlearning (like SISA) divides data into isolated shards so only a fraction of the model needs retraining.
Approximate unlearning uses gradient ascent to actively "damage" the model's knowledge of the forgotten data, balanced by training on the remaining data.
The field is highly experimental, and preventing the model from forgetting too much (catastrophic forgetting) is the main challenge.