Unlearning Verification

If you want a model to forget data a user asked to remove — their photo, their chat history, their financial record — you need to *prove* it's really gone, not just hope so. This concept gives you the audit toolkit: how to check a model has forgotten, and why 'it doesn't answer the question anymore' is not the same as 'it has forgotten'. This unlocks the rest of Model Evaluation, then LLM Evaluation, Model Monitoring, and Online Experimentation. Without verification, every unlearning claim is just a guess.

Imagine a student has been taught a fact in class. The teacher tells them to forget it. The student says 'okay'. How do you know they actually did? They might be hiding it, or they might have genuinely forgotten. You can ask them the fact directly — but if they refuse to answer, that doesn't prove they don't know it; maybe they just don't want to say. You can give them a test that indirectly reveals whether they know it, without asking directly. That's what verification does for AI models. When a model is trained on your data, it might memorize pieces of it. Unlearning is the process of removing that memory. Verification is the process of checking that the removal actually happened — and it's surprisingly hard. The model doesn't talk, so you can't ask 'did you forget?'. Instead, you use clever tricks to sniff out whether the memory is still there, hidden inside the model's billions of numbers. The intuition: *forgetting is invisible; you have to design a test to catch it*.

Think of a witness who has seen a criminal's face. The defence wants them to 'forget' it before testifying. You can't just ask 'do you remember the face?' because they could lie. You could show them a line-up of photos — if they flinch at one, you know they remember. But the witness could also be a skilled liar and control their flinch. So you make the test subtler: you measure their heart rate, their pupil dilation, their reaction time. Those are harder to fake. This is exactly what membership inference attacks do to models. They probe the model with carefully chosen inputs and measure its *confidence* — a model that remembers a piece of data tends to be overconfident about things related to it. If you can show that the model's confidence about the forgotten data is the same as it would be for data it has never seen, you have evidence it has forgotten. The analogy breaks down here: a witness has a single memory, but a model has billions. Also, a witness can choose to forget, but a model can't — it either has the memory baked into its weights or it doesn't. There's no 'intention'.

Unlearning verification is the process of testing a machine learning model to demonstrate — with evidence — that it has genuinely lost the influence of specific training data, rather than merely behaving as if it has.

This concept sits inside Model Evaluation — the discipline of measuring whether a model works. Unlearning verification is a *special kind of evaluation*: instead of measuring accuracy on new data, we measure absence of memory on old data. It connects directly to Risk Tiers in your library: if a use case is high-risk (e.g., medical records), the verification evidence required must be much stronger than for a low-risk one. It also builds on the neighbouring ideas of Membership Inference (the attack used as the audit tool) and Right to Be Forgotten (the legal driver). You have notes on SISA Sharded Training and Exact/Approximate Unlearning — verification is the test that tells you whether those methods actually worked.