PaperWorkshop paperRead first
Shulin Lu · November 2026 · Accepted to the NeurIPS 2026 workshop Privacy in the Era of Large Opaque Models (December 2026); OpenReview
- What it is
- Argues that deletion audits check the wrong property, a snapshot right after the request, when erasure is a property over time; separates residue (what remains) from resurrection (the routes that bring a fact back).
- Contribution, as we read it
- In a pilot with dependency-aware deletion, immediate residue was 7%, but 93% of facts became recoverable within five ordinary sessions: checkpoint restores (92%), tool-written artifacts (77%), peer-agent copies (71%), consolidation write-back (12%); revocation without deletion retained 99%. Recommends trajectory audits, scope-aware deletion APIs with receipts, and revocation as a deletion trigger.
- Limits and open questions
- A pilot study presented at a workshop; the agent population and sessions are the author's setup.
ObligationsForgetProve· Termsresurrectionerasuredeletion receiptChecked 07 November 2026
PaperPreprintRead first
Chao Yao, Yangbo Wei, Zhen Huang, Junhong Qian, Chenle Chen, Shaoqiang Lu, Chen Wu, Lei He · Arizona State University; Eastern Institute of Technology, Ningbo · 4 September 2026 · arXiv:2609.04875
- What it is
- Defines execution-state unlearning: after a forget request the agent must behave as if it never saw the item, which means removing it from summaries, plans and the KV cache, not only the store; Provenance-Guided Selective Replay crops back to the last clean checkpoint and replays sanitized steps.
- Contribution, as we read it
- Memory deletion left leakage unchanged; instruction-based forgetting still yielded the target; source redaction still acted on a revoked preference in 80% of episodes; selective replay matched a full reset with up to nine times fewer recomputed tokens. Proves exact unlearning needs at least T−τ+1 recomputed transitions.
- Limits and open questions
- Assumes deterministic decoding or a fixed randomness source, no committed external effects after the injection point, and conservative taint tracking.
ObligationsForgetProve· Termsderived memoryerasureprovenanceChecked 07 November 2026
PaperPreprintRead first
Yang Zhao, Chengxiao Dai, Mengying Kou, Yue Xiu · 8 May 2026 · arXiv:2605.07242
- What it is
- When a source memory is deleted, corrected or migrated, the summaries, cached tool outputs and skills built from it are withdrawn first, then rebuilt from retained valid support and republished only if they pass validation.
- Contribution, as we read it
- Baselines left 69.8–94.3% of the affected cascade exposed; the method reached 0% exposure under complete influence provenance. Dropping 1% of dependency edges produced 17.7% leakage, which is the quantitative case that erasure is bounded by provenance.
- Limits and open questions
- Depends on complete provenance; validation covers only the checks implemented; for neural skills it inherits the limits of the chosen unlearning method and does not claim exact parameter erasure.
ObligationsForgetProve· Termscascade repairderived memorylineageChecked 07 November 2026
PaperPreprintRead first
Chandranil Chakraborttii, Jackeline García Alvarado, Sitora Abdulofizova, Shivanshu Dwivedi · Trinity College · 16 June 2026 · arXiv:2606.18497
- What it is
- In ChromaDB, FAISS and Weaviate, deletion flags a vector and leaves it on disk; the flagged vectors can be read from storage files and inverted back to text with Vec2Text.
- Contribution, as we read it
- Recovered about a quarter of names and nearly half of locations from biographies, full age and sex from a synthetic clinical set, and 99% identity on facial embeddings; proposes per-epoch key rotation that destroys the key on deletion, with a signed deletion proof, bringing recovery to 0% in their tests.
- Limits and open questions
- Three systems and an unfine-tuned inversion model; the defense adds a key-management layer every deployment would have to run.
ObligationsForgetProve· Termsghost vectorscryptographic erasuredeletion receiptChecked 07 November 2026
PaperPreprint
Vishwajith Ramesh · Vy Labs · July 2026 · arXiv:2607.27539
- What it is
- Tags each stored memory row with the exchange that produced it, gates a frozen model's attention on those rows, and deletes an exchange by excluding its rows and recomputing the gate; the edit is checked against an independent refit.
- Contribution, as we read it
- An edited model disclosed a deleted answer on 3 of 18 field queries against 18 of 18 for a prompt-only instruction to forget, at 1.9% perplexity cost.
- Limits and open questions
- A membership attack still found residual signal (median AUC 0.70); the incremental update mostly fell back to a full refit; admission dropped at other model sizes; no speed advantage.
- Disclosure
- The author's company builds assistant software.
ObligationsForgetProve· Termserasuremachine unlearningChecked 07 November 2026
PaperPreprint
Bin Wang, Pingping Wang, Jinyu Cong, Fan Wang, Yang Yu, Yilong Yin, Zhongyi Han, Benzheng Wei · Shandong University of Traditional Chinese Medicine; Shandong University · 6 February 2026 · arXiv:2602.17692
- What it is
- Removing an item from the weights alone, or from the memory store alone, lets it resurface from the other; Synchronized Backflow Unlearning prunes the store and adjusts the model together.
- Contribution, as we read it
- An early statement that unlearning for agents is a two-store problem, tested on medical question answering.
- Limits and open questions
- Dependency tracking may not capture information flow across agents that share a knowledge graph, by the authors' account.
ObligationsForget· Termsmachine unlearningerasureChecked 07 November 2026
Position paperPeer-reviewedRead first
Sangyeon Yoon, Yeachan Jun, Albert No · Yonsei University · 8 May 2026 · arXiv:2606.27379; ICML 2026
- What it is
- Reserves “unlearning” for dataset-defined deletion, where a forget set's training influence is removed so the model is approximately indistinguishable from one retrained without it, and names what else gets called unlearning: output suppression, internal obfuscation, knowledge editing, behavioral refusal, inference-time control.
- Contribution, as we read it
- The vocabulary this site uses for rung 9 of the erasure ladder, and the warning that low forget-query accuracy rewards hiding information at the output while influence and derived capabilities remain.
- Limits and open questions
- A position paper; it recommends evaluation practices rather than reporting new results.
ObligationsForgetProve· Termsmachine unlearningerasure ladderChecked 07 November 2026
Position paperPreprint
A. Feder Cooper, Christopher A. Choquette-Choo, Miranda Bogen and others · 9 December 2024 · arXiv:2412.06966
- What it is
- A policy-facing analysis of what unlearning can and cannot deliver for generative models, separating removal of training data influence from suppression of outputs.
- Contribution, as we read it
- The source most often cited for why “delete it from the model” is not a coherent demand on its own, and why law should name the outcome it wants.
- Limits and open questions
- Analytic; it frames the problem rather than measuring a method.
ObligationsForget· Termsmachine unlearningright to erasureChecked 07 November 2026
PaperPeer-reviewed
Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo and others · University of Toronto; Vector Institute; University of Wisconsin-Madison · May 2021 · arXiv:1912.03817; IEEE Symposium on Security and Privacy 2021
- What it is
- Sharded, Isolated, Sliced, Aggregated training: a model trained in shards so that forgetting a point means retraining only the shard that held it.
- Contribution, as we read it
- The reference for exact unlearning, and for why exact unlearning of a large model trained end to end means retraining.
- Limits and open questions
- Exactness comes from the training layout; it does not apply to a model that was not trained this way.
ObligationsForget· Termsmachine unlearningChecked 07 November 2026
BenchmarkPeer-reviewed
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C. Lipton, J. Zico Kolter · Carnegie Mellon University · 11 January 2024 · arXiv:2401.06121; COLM 2024
- What it is
- Fictitious author profiles fine-tuned into a model so that a forget set has a known ground truth and a retrained reference exists.
- Contribution, as we read it
- The standard unlearning benchmark, and the base AUBench extends to agents with memory and tools.
- Limits and open questions
- Fictitious, fine-tuned facts; a 2024 position paper (Thaker et al.) argues such benchmarks are weak measures of progress.
ObligationsForget· Termsmachine unlearningChecked 07 November 2026
BenchmarkPeer-reviewed
Weijia Shi, Jaechan Lee, Yangsibo Huang and others · 8 July 2024 · arXiv:2407.06460; ICLR 2025
- What it is
- Six criteria an unlearned model should meet: no verbatim memorization, no knowledge memorization, no privacy leakage, utility preserved, scalable to large forget sets, sustainable over sequential requests.
- Contribution, as we read it
- Shows that most methods fail several of the six at once, especially under sequential deletion requests.
- Limits and open questions
- Two corpora (news and books); the privacy criterion is membership inference, a statistical probe.
ObligationsForget· Termsmachine unlearningChecked 07 November 2026
Position paperPreprint
Pratiksha Thaker, Shengyuan Hu, Neil Kale, Yash Maurya, Zhiwei Steven Wu, Virginia Smith · Carnegie Mellon University · 3 October 2024 · arXiv:2410.02879
- What it is
- Shows that simple changes to a benchmark's queries, or the overlap between forget and retain data, reverse the apparent ranking of unlearning methods.
- Contribution, as we read it
- Why a single benchmark score for unlearning should be read as weak evidence.
- Limits and open questions
- A position paper with supporting experiments on existing benchmarks.
ObligationsForgetProve· Termsmachine unlearningChecked 07 November 2026
Technical reportPreprint
Eleni Triantafillou, Peter Kairouz, Fabian Pedregosa and others · 13 June 2024 · arXiv:2406.09073
- What it is
- The organizers' analysis of the NeurIPS 2023 unlearning challenge, which scored submissions against a retrained reference with a privacy-style forgetting quality metric.
- Contribution, as we read it
- The first large-scale evidence of what approximate unlearning achieves in practice, and a rigorous evaluation design others reuse.
- Limits and open questions
- Image classifiers, not language models; the metric is a proxy for indistinguishability.
ObligationsForgetProve· Termsmachine unlearningChecked 07 November 2026
SurveyPreprint
Lulu Xue, Shengshan Hu, Wei Lu, Yan Shen and six others · 18 June 2025 · arXiv:2506.15115 (v3, 7 April 2026)
- What it is
- A survey of how an unlearning claim can be checked: retrain comparison, membership inference, influence functions, backdoor-based verification, and cryptographic or auditable approaches.
- Contribution, as we read it
- Maps the verification side of forgetting, which is where guarantees actually come from.
- Limits and open questions
- Verification methods are mostly statistical; exact verification for large models remains open.
ObligationsForgetProve· Termsmachine unlearningdeletion receiptChecked 07 November 2026