The cost designed
into forgetting.

A request to remove training data arrives after the system has learned from it. The work needed to honour that request can depend on decisions made before training began.

Consider a hypothetical organisation choosing between two learning pipelines. Both meet its initial performance requirement. One trains a single model over the whole collection. The other keeps parts of the training process sufficiently separate that a later change can be confined to a smaller part of the system. The initial training bill does not settle which arrangement is cheaper over the service’s life.

My article, Training on the tightrope: AI copyright and data privacy as colliding regulatory regimes, examines conflicts between the rights attached to training material and the remedies applied to AI systems. That institutional question motivates a more specific engineering question here: how much of the cost of responding to a removal request has already been fixed by the architecture?

Limit the work that has to be repeated

In Machine Unlearning, Lucas Bourtoule and colleagues organise training through SISA: sharded, isolated, sliced and aggregated. Data is partitioned into disjoint shards, with a separate model trained on each. A point’s training influence is confined to its constituent model. Predictions are combined.

When a point is removed, the affected model is retrained without it. Slicing adds saved intermediate states, allowing retraining to begin before the slice containing that point. It also creates trade-offs: checkpoints require storage, while smaller training partitions can reduce predictive accuracy.

These classification experiments do not establish a universal speed-up for current foundation models.

Specify the comparison behind “forgotten”

The SISA paper frames unlearning through a counterfactual comparison: the distribution of models after removal should match the distribution obtained by training without the removed point. That is a claim about a specified training procedure, rather than a promise that every fact associated with a person will disappear from every possible answer.

A hypothetical example makes the distinction useful. Two independently supplied records describe the same public event. Removing one record leaves the other available. An evaluation that simply asks whether the model can still name the event mixes up removing one contribution with suppressing a fact. The target and the comparison need to be written down before the test result can be interpreted.

The next request may depend on the last answer

Deletion requests need not arrive independently of a deployed model. A person may inspect an answer and then ask for a record to be removed. Later requests may respond to the updated system.

Varun Gupta and colleagues examine this issue in Adaptive Machine Unlearning, published at NeurIPS 2021. They show why guarantees for deletion sequences chosen independently of published models need not extend to adaptive sequences. Their work includes attacks on SISA in specified image-classification settings and a reduction using differential privacy to support adaptive-deletion guarantees.

This is a qualification to carry into procurement. A guarantee needs to say which requests it covers and what information can influence them. A successful isolated removal test cannot establish the behaviour of an entire interactive sequence.

Buy the response capability before it is needed

My proposed evaluation would compare complete service arrangements over a common horizon: initial training, saved-state storage, expected removal work, validation and the loss of useful performance. The request pattern would be varied explicitly, including requests that respond to model outputs. This is a proposed comparison, not an experiment reported here.

The relevant procurement question is therefore concrete. What evidence identifies the affected records? Which saved state remains suitable? What must be retrained, which outputs are tested, and who accepts the resulting assurance? Each answer assigns work and responsibility that an initial accuracy score leaves outside the frame.

The connection to training-data governance is practical. Institutions choose remedies, while engineering determines the operations available to carry them out. Designing a cheaper response does not settle the applicable legal obligation. It can, however, make the cost and limits of that response visible before the organisation commits itself to a system that is expensive to change.