# Machine unlearning: erasing data from network weights

[Skip to content](#lm-inhoud)Network/[NL](/en/machine-unlearning-data-wissen-uit-getrainde-netwerkgewichten)EN[Hubhub.llmnet.nlCompare models on task, language, cost and license.](https://hub.llmnet.nl/en/)[Communitycommunity.llmnet.nlPrompt techniques, patterns and system prompts.](https://community.llmnet.nl/en/)[APIapi.llmnet.nlLLMs in production: rate limits, routing, structured output.](https://api.llmnet.nl/en/)[Consultancyconsultancy.llmnet.nlRolling out AI in an organization, pilot to production.](https://consultancy.llmnet.nl/en/)[Newsnieuws.llmnet.nlAI developments, explained for the Netherlands.](https://nieuws.llmnet.nl/en/)[Benchmarkbenchmark.llmnet.nlMeasure AI quality yourself, on your own tasks.](https://benchmark.llmnet.nl/en/)[Careersvacatures.llmnet.nlAI roles, salaries and career paths in the Netherlands.](https://vacatures.llmnet.nl/en/)[Learnleren.llmnet.nlAI concepts in plain language, beginner to builder.](https://leren.llmnet.nl/en/)[Guidegids.llmnet.nlRun AI privately on your own Mac, PC, NAS or home server.](https://gids.llmnet.nl/en/)[Directorydirectory.llmnet.nlMapping the AI ecosystem: tools, models, companies.](https://directory.llmnet.nl/en/)[Radarradar.llmnet.nlSignals from X, research and communities for indie developers.](https://radar.llmnet.nl/en/)[Appsapps.llmnet.nlReviews of AI apps and open-source repos, with tips for builders.](https://apps.llmnet.nl/en/)[llmnet.nl — main site](https://llmnet.nl/en/)[](https://x.com/intent/post?url=https%3A%2F%2Fleren.llmnet.nl%2Fen%2Fmachine-unlearning-data-wissen-uit-getrainde-netwerkgewichten&text=Machine%20unlearning%3A%20erasing%20data%20from%20network%20weights)[](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fleren.llmnet.nl%2Fen%2Fmachine-unlearning-data-wissen-uit-getrainde-netwerkgewichten)[](https://www.reddit.com/submit?url=https%3A%2F%2Fleren.llmnet.nl%2Fen%2Fmachine-unlearning-data-wissen-uit-getrainde-netwerkgewichten&title=Machine%20unlearning%3A%20erasing%20data%20from%20network%20weights)[](#)[](https://x.com/intent/post?url=https%3A%2F%2Fleren.llmnet.nl%2Fen%2Fmachine-unlearning-data-wissen-uit-getrainde-netwerkgewichten&text=Machine%20unlearning%3A%20erasing%20data%20from%20network%20weights)[](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fleren.llmnet.nl%2Fen%2Fmachine-unlearning-data-wissen-uit-getrainde-netwerkgewichten)[](https://www.reddit.com/submit?url=https%3A%2F%2Fleren.llmnet.nl%2Fen%2Fmachine-unlearning-data-wissen-uit-getrainde-netwerkgewichten&title=Machine%20unlearning%3A%20erasing%20data%20from%20network%20weights)[](#)

 
# Machine unlearning: erasing data from trained network weights

 By Ivo Donker — compiled with AI assistance (Claude & Gemini) · August 20, 2026

 
 
### What you need to know beforehand

 This article falls within Module 4 — Training & fine-tuning of the curriculum. To understand the mathematical operations on weight matrices, a solid foundational knowledge of model architectures helps. First read the explanation of [parameters and weights in AI models](https://leren.llmnet.nl/en/parameters-en-gewichten) to see how numerical representations are stored. In addition, insight into [catastrophic forgetting when fine-tuning LLMs](https://leren.llmnet.nl/en/catastrofisch-vergeten-voorkomen) is essential, because unlearning is essentially a controlled, selective form of forgetting.

 

 Once a neural network has been trained on billions of tokens, facts, names, code, and text fragments sit diffusely spread across billions of floating-point numbers. If it later turns out that a training corpus contained personal data, included copyrighted works, or described dangerous synthesis steps for chemical substances, a complex problem arises. The traditional answer of database administrators — a simple DELETEinstruction — does not exist within a neural network. After all, a language model does not store data in rows and columns, but encodes correlations in the non-linear interaction between model parameters.

 Retraining from scratch is the only method that offers absolute mathematical guarantees that data has disappeared, but for models with tens or hundreds of billions of parameters, a full training cycle costs millions of euros in compute and weeks of runtime. Machine unlearning is the field that develops algorithms to surgically remove specific concepts, training examples, or domains from the network weights, without collapsing the model's general language ability, logical coherence, and other knowledge.

 
## The fundamental problem: distributed representations

 In a relational database, data is localized. Delete row 402 from table gebruikers, and the corresponding bytes are physically overwritten or unlinked from the index. In a transformer model, however, data is stored via distributed representations. A single training fact — for example, the date of birth and medical history of a specific patient from a medical record — influences tens of thousands of weight matrices simultaneously during the backpropagation step.

 At the same time, those same weights are responsible for general syntax, grammatical conjugations, and factual knowledge about related medical concepts. If we simply switch off the neurons that fire upon seeing this patient's name, structural collateral damage occurs to the surrounding representation space. The goal of machine unlearning is to find a weight vector $\theta_{\text{unlearn}}$ that is statistically indistinguishable from a weight vector $\theta_{\text{retrain}}$, where $\theta_{\text{retrain}}$ would have been obtained by fully retraining the model on the dataset without the subset to be forgotten.

 
## Formulating the unlearning task

 Let's formally define the mathematical task. We have a full training dataset $\mathcal{D}$, which we split into two disjoint sets: $$\mathcal{D} = \mathcal{D}_{\text{retain}} \cup \mathcal{D}_{\text{forget}}$$ Here, $\mathcal{D}_{\text{forget}}$ is the data that must be erased (the forget set) and $\mathcal{D}_{\text{retain}}$ is the data the model must retain without error (the retain set).

 Let $\mathcal{M}(\theta)$ be the model trained on $\mathcal{D}$. We seek an update algorithm $\mathcal{U}$ that operates on $\theta$, $\mathcal{D}_{\text{forget}}$, and optionally a fraction of $\mathcal{D}_{\text{retain}}$, such that for every test function or attack method $A$: $$P(A(\mathcal{U}(\theta, \mathcal{D}_{\text{forget}}, \mathcal{D}_{\text{retain}})) = 1) \approx P(A(\mathcal{M}(\theta_{\text{retrain}})) = 1)$$ In practice, we distinguish between two main categories: exact unlearning (with hard theoretical guarantees) and approximate unlearning (heuristics optimized for deep learning scale).

 
## Exact unlearning via data partitioning: SISA

 The most intuitive method for offering exact guarantees without full retraining is the SISA framework (Sharded, Isolated, Sliced, Aggregated). Instead of training one large model on the full dataset $\mathcal{D}$, SISA splits the data into $S$ disjoint shards: $\mathcal{D}_1, \mathcal{D}_2, \dots, \mathcal{D}_S$.

 Each shard trains a separate submodel. Within each shard, the data is further divided into sequential slices. During training, the system saves a checkpoint of the model parameters after each slice. If a request comes in to remove a data point from $\mathcal{D}_{\text{forget}}$, only the specific submodel containing that data point needs to be retrained, starting from the checkpoint of the slice right before the erased data point was presented.

 
 
 
 
 Property | 
 SISA (Exact) | 
 Gradient Ascent (Approximate) | 
 Weight Localization & Editing | 
 

 
 
 
 Guarantee | 
 Exactly mathematical (100% provable) | 
 Empirical / Statistical | 
 Locally specific (no formal guarantee) | 
 

 
 Computational complexity | 
 High with frequent unlearning | 
 Low (a few optimization steps) | 
 Very low (direct matrix inversion) | 
 

 
 Scalability to LLMs | 
 Very poor (requires dozens of sub-LLMs) | 
 Excellent (works directly on existing weights) | 
 Good for facts, poor for style/concepts | 
 

 
 Storage requirement | 
 Enormous (multiple parameter checkpoints) | 
 Minimal (no extra storage) | 
 Minimal | 
 

 
 
 

 Although SISA works excellently for traditional machine learning and small-scale neural networks, the method breaks down for modern language models. Training 20 separate 70B-parameter LLMs on data shards and combining their logits via ensembling results in unworkable latency and unaffordable infrastructure costs during inference.

 
## Approximate unlearning: Gradient Ascent and Regularization

 For large-scale transformer models, researchers focus on approximate optimization methods. The most direct route is Gradient Ascent on the forget set. Where standard training minimizes the loss (the cross-entropy loss), gradient ascent maximizes the loss on the data that must be forgotten:

 $$\theta_{t+1} = \theta_t + \eta \nabla_\theta \mathcal{L}(\theta_t; \mathcal{D}_{\text{forget}})$$

 Applying pure gradient ascent, however, leads within a few optimization steps to a phenomenon comparable to a lobotomy: the weight vectors become so disrupted that the model starts generating complete gibberish and collapses on basic skills. To prevent this, gradient ascent is combined with a retention term on the retain set and a divergence penalty relative to the original model $\theta_0$:

 # Pseudocode: Gecombineerde Unlearning Loss-functie
import torch
import torch.nn.functional as F

def compute_unlearning_loss(model, ref_model, batch_forget, batch_retain, alpha=1.0, beta=0.5):
 # 1. Maximaliseer verlies op de data die vergeten moet worden
 outputs_forget = model(batch_forget['input_ids'], labels=batch_forget['labels'])
 loss_forget = -outputs_forget.loss # Gradiëntstijging via negatie
 
 # 2. Behoud prestaties op de retain set (reguliere cross-entropy)
 outputs_retain = model(batch_retain['input_ids'], labels=batch_retain['labels'])
 loss_retain = outputs_retain.loss
 
 # 3. KL-divergentie om representatiedrift t.o.v. het basismodel te beperken
 with torch.no_grad():
 ref_logits = ref_model(batch_retain['input_ids']).logits
 current_logits = outputs_retain.logits
 
 kl_loss = F.kl_div(
 F.log_softmax(current_logits, dim=-1),
 F.softmax(ref_logits, dim=-1),
 reduction='batchmean'
 )
 
 # Totale gewogen doelfunctie
 total_loss = alpha * loss_forget + loss_retain + beta * kl_loss
 return total_loss

 Instead of brute gradient ascent, parameters can also be efficiently adjusted using low-rank adapters. To see how such adapters isolate specific weight updates with minimal compute, you can consult the explanation of [LoRA and adapters in LLM training](https://leren.llmnet.nl/en/lora-en-adapters-uitgelegd) to understand how matrices are manipulated layer by layer without overwriting the base model wholesale.

 
## Mathematical localization via the Fisher information matrix

 A more elegant approach uses second-order derivatives to precisely identify which individual weights are crucial for the retain dataset and which primarily encode the forget dataset. This is done via the Fisher Information Matrix (FIM).

 The FIM measures how much information an arbitrary parameter $\theta_i$ provides about the model's output distribution:

 $$F = \mathbb{E}_{x \sim \mathcal{D}} \left[ \nabla_\theta \log p(x|\theta) \nabla_\theta \log p(x|\theta)^T \right]$$

 By computing the diagonal approximation of the Fisher matrix over both $\mathcal{D}_{\text{retain}}$ ($F_{\text{retain}}$) and $\mathcal{D}_{\text{forget}}$ ($F_{\text{forget}}$), we can add a targeted perturbation to parameters that have a high value in $F_{\text{forget}}$ but a negligible value in $F_{\text{retain}}$. This selectively resets the target weights to a random state or shifts them along the gradient with minimal influence on the remaining knowledge.

 
## Direct model editing: ROME and MEMIT

 When the unlearning task consists of erasing specific factual statements (for example: "Person X lives at Address Y"), model editing offers an alternative to optimization loops. Techniques such as ROME (Rank-One Model Editing) and MEMIT (Mass-Editing Memory in a Transformer) treat the Feed-Forward Networks (FFN) within transformer layers as explicit key-value stores.

 In an FFN layer, the first linear projection $W_{\text{in}}$ acts as a key detector (recognizing the subject, e.g., "Ivo Donker"), while the second projection $W_{\text{out}}$ retrieves the corresponding value vector (the property or attribute). ROME first localizes via causal mediation analysis which specific layers are responsible for storing the fact. The algorithm then computes a direct correction to $W_{\text{out}}$ via a rank-1 update:

 $$\hat{W} = W + \Lambda (C^{-1} k)^T$$
 Here, $k$ is the key vector of the concept to be erased, $C$ is the covariance matrix of prior activations, and $\Lambda$ is a correction vector that ensures the projection of $k$ results in a neutral vector or a uniform output distribution. The advantage is that this matrix operation can be performed in a fraction of a second without training loops.

 
## How do you measure whether a network has truly forgotten something?

 The biggest pitfall in machine unlearning is apparent success: the model no longer generates the answer to be erased for a direct question, but the information is still encoded in the weights and can be extracted via alternative routes. A rigorous evaluation requires four complementary measurement methods:

 
### 1. Membership Inference Attacks (MIA)

 MIA tests whether an attacker can statistically determine whether a specific record was part of the training set. A trained model typically shows a significantly lower loss and lower entropy on training data than on unseen data. After a successful unlearning operation, the loss distribution of the records from $\mathcal{D}_{\text{forget}}$ must exactly coincide with the loss distribution of records the model has genuinely never seen (the test set).

 
### 2. Extraction and jailbreak resistance

 If a model responds to the direct prompt Wie is burger X? with "I don't know that," the data can still often be extracted via prefix probing or adversarial jailbreaks (such as base64 encoding or role-play) despite that. Unlearning has only succeeded if advanced prompt optimization techniques (such as GCG — Greedy Coordinate Gradients) fail to reconstruct the target text.

 
### 3. Model utility and retain accuracy

 Erasing data must not degrade the model's general performance. This is measured on standard benchmarks for logical reasoning (such as MMLU, GSM8K) and linguistic perplexity on $\mathcal{D}_{\text{retain}}$. A drop of more than a few tenths of a percentage point indicates unwanted collateral damage to surrounding weight structures.

 
### 4. Re-learning speed

 If we fine-tune the unlearned model again on a fraction of $\mathcal{D}_{\text{forget}}$, how quickly does it relearn the information? If the model recovers the forgotten fact with high confidence within a single gradient step, the information was not erased but merely suppressed (the 'dormant neuron' effect). A truly unlearned model shows a learning curve identical to a model starting from scratch.

 
## Practical challenges and compliance in 2026

 Despite significant academic progress, machine unlearning in production environments faces hard limitations that developers and data engineers must factor in:

 First, with repeated unlearning sessions (for example, daily GDPR deletion requests), cumulative weight degradation occurs. Each intervention via gradient ascent or model editing introduces a small deviation in the network's orthogonal subspaces. After hundreds of successive interventions, the model becomes unstable and hallucinations progressively increase.

 Second, responsible data processing requires being able to demonstrably show, at the operational and infrastructural level too, that personal data does not keep circulating in runtime environments. Those responsible for API integrations and data processing agreements would do well to implement the guidelines for [aligning log retention with zero data retention](https://api.llmnet.nl/en/logbewaring-afstemmen-op-zero-data-retention) so that interaction data related to deletion requests does not remain reproducible via proxy logs or audit trails.

 
 
### Continue reading with

 Now that it's clear how training data can be selectively removed from weights, you can study the broader impact of data hygiene. Read on about the influence of data collection in [training data and bias in language models](https://leren.llmnet.nl/en/trainingsdata-en-bias) to see how skew arises in the initial training phase, or dive deeper into [mechanistic interpretability](https://leren.llmnet.nl/en/mechanistisch-interpreteren-uitgelegd) to understand how circuits and neurons are made visually traceable.