# Machine Unlearning

Multimodal large reasoning models can pull sensitive information back through cross-modal associations inside intermediate reasoning, so suppressing the final answer is not enough. VKCR reframes the forget target as one designated image-to-knowledge association: it localizes the edit in a compact association-conditioned low-rank parameter subspace, then counterfactually rebinds the affected reasoning branch, weakening target-bearing or unsupported continuations while favoring evidence-grounded non-sensitive alternatives. On CLEAR-R and MLLMU-R it reduces both image-conditioned target leakage and hallucinated reassociation while preserving non-sensitive visual reasoning and permitted text-only access to the same knowledge.

Multimodal large reasoning models can pull sensitive information back through cross-modal associations inside intermediate reasoning, so suppressing the final answer is not enough. VKCR reframes the forget target as one designated image-to-knowledge association: it localizes the edit in a compact association-conditioned low-rank parameter subspace, then counterfactually rebinds the affected reasoning branch, weakening target-bearing or unsupported continuations while favoring evidence-grounded non-sensitive alternatives. On CLEAR-R and MLLMU-R it reduces both image-conditioned target leakage and hallucinated reassociation while preserving non-sensitive visual reasoning and permitted text-only access to the same knowledge.

Once an open-weight model is released, an attacker can fine-tune it on target-domain data and quickly undo post-training unlearning. DETER interleaves suppression updates with ordinary pretraining: a document classifier first removes medical documents from FineWeb-Edu, then gradient ascent on a subset of the removed documents actively lowers the model's probability for that text. With medicine as a proxy target domain across four models from 113M to 1030M parameters, reaching the unfiltered model's PubMed loss takes more than twice the fine-tuning tokens of filtering alone; at 1030M, DETER needs 2.09M PubMed tokens versus 0.10M for filtering alone.

Once an open-weight model is released, an attacker can fine-tune it on target-domain data and quickly undo post-training unlearning. DETER interleaves suppression updates with ordinary pretraining: a document classifier first removes medical documents from FineWeb-Edu, then gradient ascent on a subset of the removed documents actively lowers the model's probability for that text. With medicine as a proxy target domain across four models from 113M to 1030M parameters, reaching the unfiltered model's PubMed loss takes more than twice the fine-tuning tokens of filtering alone; at 1030M, DETER needs 2.09M PubMed tokens versus 0.10M for filtering alone.

For machine unlearning under privacy rules, IDSISA adds influence-guided shard assignment and cross-shard distillation to SISA's shard-retraining framework. Influence scores are computed once before training and co-locate samples likely to be deleted together, so a deletion request touches fewer shards than under random partitioning; retrained shards also learn from unaffected shards' soft outputs to recover utility lost to isolation. On ResNet-18/CIFAR-10, BiLSTM/IMDB, TCN/IMDB and a fully connected Fashion-MNIST network, the deletion guarantee still comes from retraining itself, and distillation is only a separately quantified utility-recovery step.

For machine unlearning under privacy rules, IDSISA adds influence-guided shard assignment and cross-shard distillation to SISA's shard-retraining framework. Influence scores are computed once before training and co-locate samples likely to be deleted together, so a deletion request touches fewer shards than under random partitioning; retrained shards also learn from unaffected shards' soft outputs to recover utility lost to isolation. On ResNet-18/CIFAR-10, BiLSTM/IMDB, TCN/IMDB and a fully connected Fashion-MNIST network, the deletion guarantee still comes from retraining itself, and distillation is only a separately quantified utility-recovery step.

For identity-level unlearning when the full original forget set is unavailable at request time, MCU aggregates each training identity's features into prototypes held in an external memory, deletes the target prototype, and readapts on limited support information, trading off utility, membership distinguishability, and request-time compute on the 1-SHUI identity partitioning and one-shot support construction.

For identity-level unlearning when the full original forget set is unavailable at request time, MCU aggregates each training identity's features into prototypes held in an external memory, deletes the target prototype, and readapts on limited support information, trading off utility, membership distinguishability, and request-time compute on the 1-SHUI identity partitioning and one-shot support construction.

The work proposes FADE, a multi-concept unlearning framework for text-to-video diffusion transformers that first applies a joint closed-form key/value edit suppressing all target concepts, then trains per-concept frame-aware low-rank adapters gated by the frame index and denoising timestep to remove residual per-frame leakage, and combines adapters by a similarity-based soft router; erasing 16 concepts (objects, artistic styles, and nudity) from a single Wan2.1-T2V-1.3B backbone, FADE reduces residual object-benchmark accuracy to 4.9% against 15.5% for the strongest of eight baselines, keeps the VBench average within 0.9% of the unedited model, and the ranking holds under a VLM judge and a blinded human study.

The work proposes FADE, a multi-concept unlearning framework for text-to-video diffusion transformers that first applies a joint closed-form key/value edit suppressing all target concepts, then trains per-concept frame-aware low-rank adapters gated by the frame index and denoising timestep to remove residual per-frame leakage, and combines adapters by a similarity-based soft router; erasing 16 concepts (objects, artistic styles, and nudity) from a single Wan2.1-T2V-1.3B backbone, FADE reduces residual object-benchmark accuracy to 4.9% against 15.5% for the strongest of eight baselines, keeps the VBench average within 0.9% of the unedited model, and the ranking holds under a VLM judge and a blinded human study.

The work presents RDTU, a Residual Diffusion framework for time-series unlearning: it first uses a retained-set neural tangent kernel predictor to obtain a deletion-compatible base forecast, then quantifies the global and local structural support of each affected window via the volume contribution of the retained-reference data, and finally has a diffusion model generate a residual correction that estimates the counterfactual forecast, yielding a pseudo-label field that guides a lightweight model update; experiments show RDTU consistently produces unlearned models that most closely match exact retraining.

The work presents RDTU, a Residual Diffusion framework for time-series unlearning: it first uses a retained-set neural tangent kernel predictor to obtain a deletion-compatible base forecast, then quantifies the global and local structural support of each affected window via the volume contribution of the retained-reference data, and finally has a diffusion model generate a residual correction that estimates the counterfactual forecast, yielding a pseudo-label field that guides a lightweight model update; experiments show RDTU consistently produces unlearned models that most closely match exact retraining.

This Perspective addresses LLM agents that accumulate state across sessions, tools, users, and changing environments, and proposes a framework of controlled knowledge updating: treating an update as a decision to select the least invasive substrate sufficient for the claim's scope—among context, external memory, model parameters, activation states, and tool or workflow definitions—including the option not to write persistent state, organized by three principles (substrate proportionality, temporal defeasibility, auditable continuity) and motivating evaluation criteria covering update selection, temporal consistency, interference, reversibility, efficiency, and robustness, together with a four-phase minimal benchmark unit.

This Perspective addresses LLM agents that accumulate state across sessions, tools, users, and changing environments, and proposes a framework of controlled knowledge updating: treating an update as a decision to select the least invasive substrate sufficient for the claim's scope—among context, external memory, model parameters, activation states, and tool or workflow definitions—including the option not to write persistent state, organized by three principles (substrate proportionality, temporal defeasibility, auditable continuity) and motivating evaluation criteria covering update selection, temporal consistency, interference, reversibility, efficiency, and robustness, together with a four-phase minimal benchmark unit.