Attribute-to-Delete: Machine Unlearning via Datamodel Matching
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
Machine unlearning -- efficiently removing the effect of a small "forget set" of training data on a pre-trained machine learning model -- has recently attracted significant research interest. Despite this interest, however, recent work shows that existing machine unlearning techniques do not hold up to thorough evaluation in non-convex settings. In this work, we introduce a new machine unlearning technique that exhibits strong empirical performance even in such challenging settings. Our starting point is the perspective that the goal of unlearning is to produce a model whose outputs are statistically indistinguishable from those of a model re-trained on all but the forget set. This perspective naturally suggests a reduction from the unlearning problem to that of data attribution, where the goal is to predict the effect of changing the training set on a model's outputs. Thus motivated, we propose the following meta-algorithm, which we call Datamodel Matching (DMM): given a trained model, we (a) use data attribution to predict the output of the model if it were re-trained on all but the forget set points; then (b) fine-tune the pre-trained model to match these predicted outputs. In a simple convex setting, we show how this approach provably outperforms a variety of iterative unlearning algorithms. Empirically, we use a combination of existing evaluations and a new metric based on the KL-divergence to show that even in non-convex settings, DMM achieves strong unlearning performance relative to existing algorithms. An added benefit of DMM is that it is a meta-algorithm, in the sense that future advances in data attribution translate directly into better unlearning algorithms, pointing to a clear direction for future progress in unlearning.
Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 41 of its 55 references that are in the map. First posted on arXiv 30 Oct 2024.
Builds on
41 of 55 references.
Closest ancestors · 15
Same direction, newest first
- 2024Machine Unlearning Fails to Remove Data Poisoning Attacks25 Jun
- 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
- 2024Corrective Machine Unlearning21 Feb
- 2023Fast-NTK: Parameter-Efficient Unlearning for Large-Scale Models22 Dec
- 2023Large Language Model Unlearning14 Oct
- 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
- 2023Who's Harry Potter? Approximate Unlearning in LLMs3 Oct
- 2023Model Sparsity Can Simplify Machine Unlearning11 Apr
- 2023Towards Unbounded Machine Unlearning20 Feb
- 2022Algorithms that Approximate Data Removal: New Results and Limitations25 Sep
- 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan
- 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning22 Oct
3 more
- 2021Machine Unlearning of Features and Labels26 Aug
- 2021Certifiable Machine Unlearning for Linear Models29 Jun
- 2021Adaptive Machine Unlearning8 Jun
Other references · 26
- 2015Distilling the Knowledge in a Neural Networkcited by 10,076
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
- 2021Membership Inference Attacks From First Principlescited by 839
- 2017Renyi Differential Privacycited by 643
- 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 599
- 2019Certified Data Removal from Machine Learning Modelscited by 512
- 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 488
- 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
- 2019Making AI Forget You: Data Deletion in Machine Learningcited by 447
- 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
- 2023Ablating Concepts in Text-to-Image Diffusion Modelscited by 312
- 2023Studying Large Language Model Generalization with Influence Functionscited by 311
14 more
- 2020Amnesiac Machine Learningcited by 305
- 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 303
- 2023MQuAKE: Assessing Knowledge Editing in Language Models via Multi-Hop Questionscited by 292
- 2023TRAK: Attributing Model Behavior at Scalecited by 273
- 2020Approximate Data Deletion from Machine Learning Modelscited by 250
- 2022Datamodels: Predicting Predictions from Training Datacited by 186
- 2023Handbook of Convergence Theorems for (Stochastic) Gradient Methodscited by 158
- 2020BREEDS: Benchmarks for Subpopulation Shiftcited by 155
- 2020DeltaGrad: Rapid retraining of machine learning modelscited by 143
- 2022Training Data Influence Analysis and Estimation: A Surveycited by 134
- 2024DsDm: Model-Aware Dataset Selection with Datamodelscited by 103
- 2022Linear Adversarial Concept Erasurecited by 98
- 2024What is Your Data Worth to GPT? LLM-Scale Data Valuation with Influence Functionscited by 88
- 2024Training Data Attribution via Approximate Unrolled Differentiationcited by 33
Built on by
Citing papers per year: 2025: 9; 2026: 9.
18 papers.
Sort:
By area:
- 2025CUPID: Curating Data your Robot Loves with Influence Functionscited by 21
- 2025MAGIC: Near-Optimal Data Attribution for Deep Learningcited by 20
- 2025Ascent Fails to Forgetcited by 12
- 2025When to Forget? Complexity Trade-offs in Machine Unlearningcited by 9
- 2025Exploring Nonlinear Pathway in Parameter Space for Machine Unlearningcited by 4
- 2025Scalable Valuation of Human Feedback through Provably Robust Model Alignmentcited by 4
- 2026Gauss-Newton Unlearning for the LLM Eracited by 4
- 2025Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Designcited by 1
- 2025Efficiently Verifiable Proofs of Data Attributioncited by 1
- 2025WARP: Weight Teleportation for Attack-Resilient Unlearning Protocolscited by 1
- 2026Reference-Guided Machine Unlearningcited by 1
- 2026f-FUM: Federated Unlearning via min--max and f-divergencecited by 0
6 more
- 2026Certified Per-Instance Unlearning Using Individual Sensitivity Boundscited by 0
- 2026SoK: Unlearnability and Unlearning for Model Dememorizationcited by 0
- 2026De-attribute to Forget for LLM Unlearningcited by 0
- 2026How Hard Can It Be? Hardness-Aware Multi-Objective Unlearningcited by 0
- 2026Auditing Machine Unlearning: A Systematic Research on Whether Models Truly Forgetcited by 0
- 2026What to Forget in Unlearning? Forget Set Curation for Language Modelscited by 0
- 2026What to Forget in Unlearning? Forget Set Curation for Language Models14 Aug 2026
- 2026Auditing Machine Unlearning: A Systematic Research on Whether Models Truly Forget15 Jun 2026
- 2026How Hard Can It Be? Hardness-Aware Multi-Objective Unlearning1 Jun 2026
- 2026De-attribute to Forget for LLM Unlearning29 May 2026
- 2026SoK: Unlearnability and Unlearning for Model Dememorization12 May 2026
- 2026Reference-Guided Machine Unlearning11 Mar 2026
- 2026Certified Per-Instance Unlearning Using Individual Sensitivity Bounds17 Feb 2026
- 2026Gauss-Newton Unlearning for the LLM Era11 Feb 2026
- 2026f-FUM: Federated Unlearning via min--max and f-divergence5 Feb 2026
- 2025WARP: Weight Teleportation for Attack-Resilient Unlearning Protocols29 Nov 2025
- 2025Ascent Fails to Forget30 Sep 2025
- 2025Efficiently Verifiable Proofs of Data Attribution14 Aug 2025
6 more
- 2025Invisible Watermarks, Visible Gains: Steering Machine Unlearning with Bi-Level Watermarking Design13 Aug 2025
- 2025CUPID: Curating Data your Robot Loves with Influence Functions23 Jun 2025
- 2025Scalable Valuation of Human Feedback through Provably Robust Model Alignment23 May 2025
- 2025Exploring Nonlinear Pathway in Parameter Space for Machine Unlearning16 May 2025
- 2025MAGIC: Near-Optimal Data Attribution for Deep Learning23 Apr 2025
- 2025When to Forget? Complexity Trade-offs in Machine Unlearning24 Feb 2025
- 2025Ascent Fails to Forgetcited by 12
- 2025When to Forget? Complexity Trade-offs in Machine Unlearningcited by 9
- 2025Exploring Nonlinear Pathway in Parameter Space for Machine Unlearningcited by 4
- 2026Gauss-Newton Unlearning for the LLM Eracited by 4
- 2025WARP: Weight Teleportation for Attack-Resilient Unlearning Protocolscited by 1
- 2026Reference-Guided Machine Unlearningcited by 1
- 2026f-FUM: Federated Unlearning via min--max and f-divergencecited by 0
- 2026Certified Per-Instance Unlearning Using Individual Sensitivity Boundscited by 0
- 2026SoK: Unlearnability and Unlearning for Model Dememorizationcited by 0
- 2026De-attribute to Forget for LLM Unlearningcited by 0
- 2026How Hard Can It Be? Hardness-Aware Multi-Objective Unlearningcited by 0
- 2026Auditing Machine Unlearning: A Systematic Research on Whether Models Truly Forgetcited by 0
12 most cited of 13 All 13 (JSON)
- 2026What to Forget in Unlearning? Forget Set Curation for Language Models14 Aug 2026
- 2026Auditing Machine Unlearning: A Systematic Research on Whether Models Truly Forget15 Jun 2026
- 2026How Hard Can It Be? Hardness-Aware Multi-Objective Unlearning1 Jun 2026
- 2026De-attribute to Forget for LLM Unlearning29 May 2026
- 2026SoK: Unlearnability and Unlearning for Model Dememorization12 May 2026
- 2026Reference-Guided Machine Unlearning11 Mar 2026
- 2026Certified Per-Instance Unlearning Using Individual Sensitivity Bounds17 Feb 2026
- 2026Gauss-Newton Unlearning for the LLM Era11 Feb 2026
- 2026f-FUM: Federated Unlearning via min--max and f-divergence5 Feb 2026
- 2025WARP: Weight Teleportation for Attack-Resilient Unlearning Protocols29 Nov 2025
- 2025Ascent Fails to Forget30 Sep 2025
- 2025Exploring Nonlinear Pathway in Parameter Space for Machine Unlearning16 May 2025
12 newest of 13 All 13 (JSON)