Forgetting on Request

A deletion request is easy to honor in a database. Find the record, remove it, and look again to confirm it is gone. The same request aimed at a trained language model has nothing comparable to find. Whatever the model absorbed during training is spread across billions of weights, the numerical values it adjusted while learning, and blended with everything else it read.

A library card catalog is a closer picture of the problem. Pulling a card from the drawer makes a book hard to find, but the book is still on the shelf, and anyone who walks the stacks can come across it. Research from the past two years suggests that the methods built to make models forget mostly pull the card. The model stops giving the answer when asked, while the knowledge behind that answer stays in the weights. Telling those two outcomes apart has turned out to be harder than producing a model that stays quiet.

Machine unlearning is the name for methods that try to remove the influence of particular training data from a model after training has finished. Interest has grown with the European right to be forgotten, with copyright disputes over training data, and with worries about models that know too much about weapons ^[1]. The cleanest answer is to retrain from scratch without the offending data, and for the largest models that is usually far too expensive. An early design called SISA planned for deletion in advance, splitting the training data into separate shards that each feed a smaller model, so a request only forces a retrain of the shard that held the record ^[2]. That works when it is chosen before training. For a language model already trained on a large slice of the web, it is too late, which is why cheaper after-the-fact methods exist at all.

Two Goals Sharing One Word

A position paper presented at NeurIPS 2025 argues that the word unlearning now covers two different aims ^[1]. Removal means taking a specific piece of training data out of the model's weights, which in library terms means taking the book off the shelf. Suppression means stopping a kind of content from appearing in the model's answers, which is closer to pulling the card.

The two come apart in both directions. Removal works on discrete items, a particular article or photograph, so it cannot target a skill the model pieced together from many sources, such as a general recipe for a toxic compound. Succeeding at removal also does not settle what the model can produce. The authors point out that a model trained without a single copyrighted image of a comic book character can still draw something that looks like that character, because generalizing beyond its examples is what the model was built to do.

Seen this way, a method that makes a model go quiet is doing suppression, whatever its paper calls it. That raises a practical question about how well the quiet holds once someone goes looking.

Walking the Stacks

A team from Carnegie Mellon University tested exactly that by fine-tuning unlearned models afterward, giving them a short round of extra training on ordinary public text that never contained the forgotten material ^[3]. A model made to forget the Harry Potter novels was trained on general facts about the characters, written by another model and containing no passages from the books, and it began reproducing text from the novels word for word. Public medical articles brought back hazardous knowledge about bioweapons in the same way. Training on gibberish brought back nothing, which suggests the related text was jogging something still stored rather than teaching it fresh. Stronger unlearning made recovery harder, so the effect is a matter of degree, but the authors' own reading is that current methods hide answers rather than remove knowledge.

A second test makes the same point more directly ^[4]. An attacker is handed some of the facts a model was supposed to forget and fine-tunes on them, then checks whether other facts from the same set come back, ones that could not be guessed from the facts provided. On knowledge the model picked up in its original training, this recovered 88 percent of the accuracy the model had before unlearning. That work is a preprint and has not been peer reviewed, though it lines up closely with the Carnegie Mellon result. In library terms, a visitor who knows roughly which aisle to search finds most of the books whose cards were pulled.

Checking the Shelves, Not the Catalog

If a quiet model can still hold the answer, then asking the model and reading its reply is a weak test. A model that says it does not know might have forgotten, or might simply be declining.

One way around this is to invent the data, so the true answer is known in advance. TOFU, introduced at the Conference on Language Modeling in 2024, generated 200 profiles of authors who do not exist, trained a model on them, and asked unlearning methods to make it forget some ^[5]. Anything the model knows about those authors came from a known source, so an unlearned model can be compared with one that never saw them. None of the methods tested matched that standard. The adversarial study above adds a caution, that facts added in a late round of training, as these fictitious authors are, may be easier to forget than knowledge absorbed from the start, so tests like this one may flatter the methods ^[4].

A NeurIPS 2025 benchmark turned the same idea on the measuring tools themselves ^[6]. Its authors released several hundred models whose true knowledge is known by construction, then asked whether each of a dozen common scores could tell a model that holds a fact from one that does not, and whether that verdict survived routine changes such as compressing the model or briefly exposing it to related text. No score did well on both counts. A widely used score based on word overlap separated knowing from not knowing reasonably well, yet came close to a coin flip once related text was used to jog the model. A score that weakens under exactly the conditions an attacker would create is a shaky basis for claiming that data was deleted.

When the Same Fact Sits in Several Books

The Same Story, Filed Five Ways

Pull one paper out of the stack and the earthquake it reported is still in the four below it, told in different words. Benchmarks have generally treated the data to forget and the data to keep as separate piles, which is not how real collections of text are assembled ^[7]. A news article covered by a deletion request may state a fact that an encyclopedia entry the model is allowed to keep also states. A model retrained without the article would still learn that fact from the encyclopedia, so an honest unlearning method should leave the fact alone and remove only what was unique to the article.

The DUSK benchmark, published in the Findings of ACL 2026, builds that situation on purpose ^[7]. Its authors wrote profiles of 120 fictitious professors into five documents in five different styles, with half the profiles appearing in all five documents and the rest in only one, then asked recent unlearning methods to remove a single document.

The methods tended to miss in both directions at once. The wording of the deleted document usually disappeared, yet facts unique to it often survived, while shared facts that should have been kept were damaged. Giving more weight to protecting the kept documents helped at first and then stopped helping. Removing a document and removing the facts it contains are different operations, and current methods have trouble aiming at one without hitting the other.

Pulling the Card Without Reading It Aloud

Standard methods also have an awkward habit. To teach a model not to give an answer, they put that answer into the training data and push its likelihood down, so the sensitive text gets handled again in order to be forgotten ^[8].

Researchers at the Technical University of Munich and Mila, the Quebec AI institute, avoid using the target answer at all. Their method has the model write several of its own responses to a question it should forget, keeps the one a scoring rule judges furthest from the original answer, and trains on that. Repeating the loop deliberately sets off the kind of collapse people worry about when models train on their own output, a gradual loss of the original information, but aimed only at the material to be forgotten. The reported result is that the quiet holds up better against two attacks that break other methods, asking the same question many times and forcing the model to continue from the opening words of an answer.

The authors also found that target-based methods leave a fingerprint. They push correct answers so far down that an attacker can find a forgotten fact by looking for the option the model rates least likely, a little like an empty slot in the catalog drawer showing exactly where a card used to be. The work appeared at ICLR 2026, and its claims concern what the model says rather than what its weights hold. It makes the quiet harder to break, which is useful, while leaving open whether the book has left the shelf.

What a Deletion Claim Can Honestly Say

The evidence points toward a narrower kind of claim. From a systems perspective, an unlearning method is best treated as an output control, a filter on what the model says, together with a stated list of the attacks it was tested against. A method that holds under direct questioning may fail under relearning or repeated sampling, so a claim that names only the easy test says little. Evaluations whose own scores have been stress tested deserve more weight than ones that simply ask the model. Where genuine removal is required, the options are still the expensive ones, filtering data before training or retraining without it, and that cost is a reason to decide carefully what enters a training set in the first place. Related questions about what a system keeps come up in earlier Thinkata pieces on isolation between customers and on agents that rewrite their own memory.

The open question is the one the benchmarks keep circling. What evidence would show that a fact is gone from the weights rather than merely hard to reach? Relearning attacks are the closest thing to such a test, and they only set a floor, since a stronger attacker might recover more. Legal practitioners would know better than a systems reading can whether an assurance that depends on which attacks were tried could ever satisfy a deletion obligation.

Until that kind of evidence exists, the catalog picture is probably the fairest description of what unlearning delivers today. The card has been pulled, and newer methods are getting better at keeping it pulled when someone asks directly or tries a few tricks. Whether the book has left the shelf is a separate question, and a deletion record that keeps the two apart would tell both the person who asked for the deletion and the engineers who maintain the model what was actually done.