AI glossary · Advanced · AI security · Safety & alignment
Machine unlearning
Machine unlearning is a technique that tries to remove the influence of specific data (personal information, copyrighted works, dangerous knowledge, etc.) from an AI model that has already been trained, so that the model behaves as if it had been trained without that data from the start.
About this term
- Level
- Advanced · Specialist terms that need the inner workings
- Category
- Security & safety
- Fields
- AI security, Safety & alignment
- Added
- 2026-10-09
How it works
The most reliable method is to retrain the model from scratch on the remaining data without the data to be removed, but for huge models this costs too much money and time. One design approach is to split the training data into several shards, train a model on each shard, and retrain only the relevant shard when a deletion request comes in. For LLMs that are already trained, approximate methods are mainly used. For example, the model is trained slightly in the opposite direction so that it gets the data to be forgotten wrong, while being fine-tuned at the same time to keep its performance on the data to be retained. Methods that find specific Representations inside the model and modify them directly are also being researched.
Certainty and cost of unlearning methods
- Full retraining
- Shard-based retraining design
- Opposite-direction fine-tuning
- Direct Representation editing
Why it matters
Privacy regulations include a right to request that one's own data be deleted, but even if the data is deleted from a database, traces may remain in models trained on it. Unlearning is also needed when the influence of a specific work must be removed in a copyright dispute, or when trying to strip dangerous knowledge (such as how to make weapons) out of a model. It can also be a way to fix contaminated or mislabeled data, once discovered, without retraining everything.
Things to know
With approximate methods, it is hard to verify whether the data was "really erased." There have been reported cases where removed knowledge came back after a question was slightly rephrased or after just a little fine-tuning. A common side effect is that unrelated capabilities also degrade during the removal process. Evaluation looks at things such as how similar the result is to a retrained model and whether traces of the data remain under membership inference attacks. For these reasons, filtering out sensitive data from the start is still the baseline, rather than relying on unlearning alone.
Example
Suppose a company fine-tuned an internal chatbot model on customer service records, and one customer requested that their information be deleted. The company deletes those records from the original data, applies unlearning to the model, and checks that the model cannot answer when asked about that customer's name or conversation details. At the same time, it uses an evaluation set to check that general customer service quality has not dropped.