数据整理后的精确机器遗忘

# Exact Unlearning After Data Curation
Source: [https://arxiv.org/html/2610.33426](https://arxiv.org/html/2610.33426)
## Exact Unlearning After Data CurationThanks:OpenAI Codex assisted with prose writing\.

Devanshu SahooUday MittlaAffiliation:Birla Institute of Technology and Science, PilaniAffiliation:Pilani, Rajasthan, India

###### Abstract

Training pipelines often remove similar examples before fitting a model\. Deleting a raw record can change that selection and admit an example that was excluded before\. What must a service retain to reproduce training after such requests? We answer this question for a fixed rule in which earlier similar records block later ones\. A limit on the total number of future deletions identifies exactly which records can still enter training\. We use this boundary to build a summary of training statistics that can be repaired exactly after repeated deletions\. The repaired summary is the same as rebuilding it on the surviving data with the remaining budget\. We also construct finite\-precision features for ridge regression, a linear learner with a penalty on coefficient size\. With exact rational outputs, allowing one more deletion changes the required private information\. It rises from zero to every private feature sign in the excluded candidates\. An encoding attains this conditional private\-information minimum on the constructed family throughout a sequence of requests\. On 1,001 AskUbuntu development records, deleting an initially excluded record admits another record at 13 of 51 fixed similarity cutoffs\. Exact membership repair passes 13,056 deletion\-step checks\. Two model\-based semantic calibrations fail their fixed criteria, so the downstream task study is not run\. The central result is a retention contract: the future deletions a service promises to support determine which excluded data can still be needed\.

## 1Introduction

Training begins before a model is fitted\. A pipeline may first remove near\-duplicate documents, choose representative examples, or filter a collection for quality\. These decisions depend on relationships among records\. When a record is later withdrawn, applying the same selection rule to the surviving collection can change which examples enter training\. A deletion service that updates only the old training set can therefore reproduce the wrong model\.

Semantic deduplication makes this issue concrete\. It compares document representations and removes examples that are too similar to earlier ones\\citepsemdedup\. Consider the three\-record illustration in Figure[1](https://arxiv.org/html/2610.33426#S1.F1)\. Recordaaprecedesbb, which precedescc\. Under the rule studied here, every earlier raw neighbor blocks a record, even when that neighbor is itself excluded\. The illustration shows why this makes an excluded record relevant to a later model fit\.

Before deletionPriority:a≺b≺ca\\prec b\\prec caabbccblocksblocksselectedexcludedexcludedTraining set:\{a\}\\\{a\\\}DeletebbIt never enteredthe original fit\.Select again from survivorsaabbccselecteddeletednewly selectedTraining set:\{a,c\}\\\{a,c\\\}Updating only the old training set would keep\{a\}\\\{a\\\}and misscc\.Figure 1:An excluded record can still control selection\. Arrows show blocking by earlier raw neighbors, including excluded neighbors\. There is noa,ca,cedge\. Deletingbbchanges the training set and can change the fitted model\.Let𝒟\\mathcal\{D\}be the raw collection,FFthe records deleted so far,𝒞\\mathcal\{C\}the selection rule, andAAthe learner\. We study the target

A⁡\(𝒞⁡\(𝒟∖F\)\)\.A\\bigl\(\\mathcal\{C\}\(\\mathcal\{D\}\\setminus F\)\\bigr\)\.\(1\)It means selecting from the surviving raw records and then training again\. Updating the original selected set instead givesA⁡\(𝒞⁡\(𝒟\)∖F\)A\(\\mathcal\{C\}\(\\mathcal\{D\}\)\\setminus F\)\. These expressions place deletion on different sides of selection, so they define different retention targets\.

#### The practical question: what must remain recoverable?

Keeping the entire raw collection allows fresh reconstruction after every request\. A service may instead keep summaries and discard raw payloads, such as feature rows and labels\. It then needs to know which excluded records can affect a future target\. We make the permitted future requests explicit through a cumulative deletion budget: the maximum number of records that may be deleted over the life of the retained state\.

For the rule above, an excluded record becomes selected only after all its earlier blockers are deleted\. If it has more surviving blockers than remaining deletions, it cannot enter training within the contract\. Its payload can be discarded for this target\. If the budget is large enough to remove those blockers, the record remains potentially relevant\. The budget thus connects an operational promise to a concrete retention decision\. It decreases with every newly deleted record\. A fresh allowance after each request would be a different promise\.

#### Two connected results\.

First, we derive an exact summary of additive training statistics for this selection rule\. Its update removes deleted contributions and adds newly selected ones\. More strongly, the updated summary equals fresh construction on the surviving records at the remaining budget\. This permits repeated requests without accumulating a different logical state\.

Second, we show that the budget can determine necessary information, not just sufficient storage\. We construct features that are exactly stored in single precision \(FP32\) and used by both selection and ridge regression\. Under one budget, every model is zero\. Increasing the budget by one makes every private feature sign in the excluded candidates necessary for exact model recovery across the allowed requests\. A sequential encoding retains exactly the signs that can still matter\. The current model alone cannot describe this future information requirement\.

The natural\-data study examines the same selection and repair mechanism on fixed AskUbuntu score graphs\. It checks exact membership and continuing state across all original cutoffs\. Its separate semantic calibration uses two local language models and zero human pair review\. Both calibration versions fail their fixed selection criteria; the threshold\-qualified utility and cost study therefore remains unexecuted\. Section[6](https://arxiv.org/html/2610.33426#S6)presents the completed evidence and its empirical scope together\.

#### Position of the contribution\.

Summaries for preprocessing\-aware unlearning\\citepcao, incremental view maintenance\\citepivmunlearning, and state that supports later deletions\\citepginart,cohencontrol provide the starting point\. We specialize signed provenance\\citepgreen,aggregate to a fixed ordered selection rule and prove its remaining\-budget state identity\. The information result joins finite stored features, stable similarity decisions, exact learner outputs, and a matching sequential state in one construction\. The resulting design question is precise: which future requests can this retained state still answer? Section[7](https://arxiv.org/html/2610.33426#S7)compares the relevant contracts\.

## 2From a deletion promise to a retention rule

We first define the selection rule and the service contract\. The key objects are the blockers of each record and the deletions still allowed\. No model\-specific algebra is needed to determine future eligibility\.

### 2\.1A fixed ordered selection rule

Each raw recordv∈𝒟v\\in\\mathcal\{D\}has a stable identifier, a fixed feature vectorzvz\_\{v\}, and, when needed, a labelyvy\_\{v\}\. A graph connects pairs that qualify as similar\. A fixed total order≺\\precgives one record priority over another\. An edge can require both membership in the same fixed partition and cosine similarity strictly above a thresholdτ\\tau\. Define the*blocker set*ofvvas its earlier raw neighbors:

B\(v\)=\{u:u≺v,\{u,v\}is an edge\}\.B\(v\)=\\\{u:u\\prec v,\\ \\\{u,v\\\}\\text\{ is an edge\}\\\}\.After a cumulative deletion setFF, selection returns

SF=𝒞⁡\(𝒟∖F\)=\{v∉F:B⁡\(v\)⊆F\}\.S\_\{F\}=\\mathcal\{C\}\(\\mathcal\{D\}\\setminus F\)=\\\{v\\notin F:B\(v\)\\subseteq F\\\}\.\(2\)A record must survive, and every one of its blockers must be gone\. In Figure[1](https://arxiv.org/html/2610.33426#S1.F1), the blocker sets areB⁡\(a\)=∅B\(a\)=\\varnothing,B⁡\(b\)=\{a\}B\(b\)=\\\{a\\\}, andB⁡\(c\)=\{b\}B\(c\)=\\\{b\\\}\.

This is*raw\-neighbor suppression*\. Greedy selection against only previously retained neighbors is a different rule: it would select bothaaandccin the initial chain\. For nonnegative thresholds, the upper\-triangle column\-maximum test in the released SemDeDup code has our suppression form\\citepsemcode\. We fix this operator’s graph and order, including any pair\-eligibility partition\.

#### What stays fixed under deletion\.

Features, pair eligibility, relative priority, and threshold remain unchanged on surviving records\. We call this*restriction consistency*\. It makes the retained graph the original graph restricted to surviving vertices\. Ordering records by a hash of each stable ID, with an ID tie break, preserves their relative priority\. Repeating a corpus\-dependent shuffle with the same seed need not\. Similarly, refitting clusters or a text encoder can change surviving edges and defines a different target\. Here the pretrained representation is held fixed throughout repair\.

### 2\.2Which records can still enter training?

LetKKbe the original cumulative record\-deletion budget\. After deletingFF, the remaining budget ish=K−\|F\|h=K\-\|F\|\. We say a surviving record is*eligible*if some continuation using at mosthhfurther deletions can select it\. The eligible set is exactly

E⁡\(F,h\)=\{v∉F:\|B⁡\(v\)∖F\|≤h\}\.E\(F,h\)=\\\{v\\notin F:\|B\(v\)\\setminus F\|\\leq h\\\}\.\(3\)To selectvv, a request must remove all its surviving blockers\. This is possible precisely when their number fits in the remaining budget\. Eligibility includes currently selected records, whose remaining blocker count is zero, as well as some currently excluded records\.

The rule supports permanent discard within the contract\. Suppose a record hasr\>hr\>hremaining blockers\. After a furtherℓ\\elldeletions, it has at leastr−ℓr\-\\ellblockers and the budget becomesh−ℓh\-\\ell\. It still has more blockers than the budget allows\. Thus eligibility can only shrink along a valid sequence\. The same argument shows that a currently selected record remains selected until it is itself deleted\.

For example, consider a surviving record with four blockers and a budget of three further deletions\. Removing two of its blockers leaves two blockers and one deletion available\. Removing an unrelated record instead leaves all four blockers and a budget of two\. Neither action can make the record reachable\. This simple count is the basis for safe payload discard; it does not require anticipating the order of later requests\.

### 2\.3What the service returns and what it may read

Three recovery targets are useful\.*Corpus recovery*returns the selected identifiersSFS\_\{F\}\.*Model recovery*returns the specified learner fitted on those records\.*State recovery*returns a designated summary that supports the remaining requests\. We compare that summary with a fresh construction on the survivors using the same remaining budget\. Two states can give the same current model while supporting different future requests, as Section[4](https://arxiv.org/html/2610.33426#S4)will demonstrate\.

For the storage question, all usable private\-data\-dependent information is charged to the retained state\. This includes models, caches, tickets, remote stores, retained random seeds, and earlier outputs that repair can read\. There is no free reread of surviving candidate features\. Public metadata is fixed independently of the private payload, but its physical storage still counts in a complete implementation\. These conventions separate a private\-information bound from a total\-byte comparison\.

The state identity proved next concerns a logical coefficient map\. It is an exact specification for continuing computation\. Physical erasure, previous releases, and external privacy obligations are discussed in Appendix[G](https://arxiv.org/html/2610.33426#A7)\.

## 3Building an exact repair summary

Many learners can be fitted from additive statistics\. Rather than store one selected total, we represent how that total changes when blockers are deleted\. The representation records the conditions under which each row contributes, including the condition that the row itself survives\.

### 3\.1From one record to a signed coefficient map

Lett⁡\(v\)∈ℝst\(v\)\\in\\mathbb\{R\}^\{s\}be a fixed statistic of recordvv, withsscoordinates\. It is record\-local: it does not change when other records are deleted\. For each recorduu, introduce a deletion indicatorxux\_\{u\}, equal to one whenuuis deleted and zero otherwise\. For an identifier setJJ, writexJ=∏u∈Jxux\_\{J\}=\\prod\_\{u\\in J\}x\_\{u\}, withx∅=1x\_\{\\varnothing\}=1\.

The statistic ofvvshould contribute exactly when all its blockers are deleted andvvsurvives\. Its contribution is thereforet⁡\(v\)​\(1−xv\)​xB⁡\(v\)t\(v\)\(1\-x\_\{v\}\)x\_\{B\(v\)\}\. Summing over records gives

T⁡\(x\)\\displaystyle T\(x\)=∑vt⁡\(v\)​\(1−xv\)​xB⁡\(v\)=∑JαJ​xJ,\\displaystyle=\\sum\_\{v\}t\(v\)\(1\-x\_\{v\}\)x\_\{B\(v\)\}=\\sum\_\{J\}\\alpha\_\{J\}x\_\{J\},\(4\)αJ\\displaystyle\\alpha\_\{J\}=∑v:B⁡\(v\)=Jt\(v\)−∑v:B⁡\(v\)∪\{v\}=Jt\(v\)\.\\displaystyle=\\sum\_\{v:B\(v\)=J\}t\(v\)\-\\sum\_\{v:B\(v\)\\cup\\\{v\\\}=J\}t\(v\)\.\(5\)A keyJJnames a set of deletions, and its signed valueαJ\\alpha\_\{J\}is added when every deletion in that key has occurred\. Each record contributes to at most two keys: a positive term for removing its blockers and a negative term for also removing the record\. Combining equal keys can cancel contributions\. This is a signed Boolean specialization of provenance for data and aggregates\\citepgreen,aggregate\.

#### Worked example: deletion requires addition and cancellation\.

For the three\-record chain, abbreviate the statistics asA0=t⁡\(a\)A\_\{0\}=t\(a\),B0=t⁡\(b\)B\_\{0\}=t\(b\), andC0=t⁡\(c\)C\_\{0\}=t\(c\)\. Then

T⁡\(x\)\\displaystyle T\(x\)=A0​\(1−xa\)\+B0​\(1−xb\)​xa\+C0​\(1−xc\)​xb\\displaystyle=A\_\{0\}\(1\-x\_\{a\}\)\+B\_\{0\}\(1\-x\_\{b\}\)x\_\{a\}\+C\_\{0\}\(1\-x\_\{c\}\)x\_\{b\}=A0\+\(B0−A0\)​xa\+C0​xb−B0​xa​xb−C0​xb​xc\.\\displaystyle=A\_\{0\}\+\(B\_\{0\}\-A\_\{0\}\)x\_\{a\}\+C\_\{0\}x\_\{b\}\-B\_\{0\}x\_\{a\}x\_\{b\}\-C\_\{0\}x\_\{b\}x\_\{c\}\.With an original budgetK=2K=2, every displayed key is retained\. Deletingbbsetsxb=1x\_\{b\}=1and leaves a budget of one:

Tretained​\(xa,xc\)=\(A0\+C0\)−A0​xa−C0​xc\.T\_\{\\rm retained\}\(x\_\{a\},x\_\{c\}\)=\(A\_\{0\}\+C\_\{0\}\)\-A\_\{0\}x\_\{a\}\-C\_\{0\}x\_\{c\}\.TheB0B\_\{0\}terms cancel, whileC0C\_\{0\}enters the current total\. This is exactly the expression built from the two unconnected survivorsa,ca,c\. Deleting a previously excluded record thus needs more than subtracting its old training contribution, which was zero\.

### 3\.2Truncate once, then reduce the budget

The degree of a key is its number of identifiers\. A key with more thanKKidentifiers can never be activated by at mostKKdeletions\. We can therefore omit coefficients of degree aboveKKat construction\. The important question is whether an omitted term could become needed after some of its identifiers are deleted\. It cannot when the remaining budget falls by the same amount\.

###### Theorem 1\(Finite\-horizon state repair\)\.

Keep only coefficients with\|J\|≤K\|J\|\\leq K\. For every\|F\|≤K\|F\|\\leq K,

∑v∈SFt⁡\(v\)=∑J⊆FαJ\.\\sum\_\{v\\in S\_\{F\}\}t\(v\)=\\sum\_\{J\\subseteq F\}\\alpha\_\{J\}\.After an allowed cumulative deletionFF, form

βL=∑J:J∖F=LαJ,\|L\|≤K−\|F\|\.\\beta\_\{L\}=\\sum\_\{J:J\\setminus F=L\}\\alpha\_\{J\},\\qquad\|L\|\\leq K\-\|F\|\.\(6\)In exact arithmetic, this is the same coefficient map as fresh construction on𝒟∖F\\mathcal\{D\}\\setminus Fwith horizonK−\|F\|K\-\|F\|\. Repeated requests compose independently of their batching and order for the same final deleted set\.

###### Proof\.

A monomial equals one precisely when its key is contained inFF\. Keys of degree aboveKKtherefore contribute zero to the current total\. Substitutingxu=1x\_\{u\}=1for everyu∈Fu\\in Fremoves deleted records through their\(1−xu\)\(1\-x\_\{u\}\)factor\. For each surviving record it replacesB⁡\(v\)B\(v\)byB⁡\(v\)∖FB\(v\)\\setminus F\. Collecting the resulting keys gives Equation \([6](https://arxiv.org/html/2610.33426#S3.E6)\)\. Any term discarded at construction had degree at leastK\+1K\+1\. Deleting\|F\|\|F\|identifiers reduces its degree by at most\|F\|\|F\|, leaving degree at leastK\+1−\|F\|K\+1\-\|F\|, above the new cutoff\. It cannot affect the fresh remaining\-budget map\. Substitutions commute, and the same argument applies at each intermediate horizon\. ∎

The empty key is the currently selected statistic\. Other keys describe possible future changes\. The theorem preserves both parts, so a request can be answered now without losing the state needed by the next request\. It also supplies a direct oracle: reconstruct the same map from retained records and compare it with the updated map\.

The decreasing budget is essential\. In the chain withK=1K=1, only the constant and degree\-one terms are stored\. Deletingbbstill gives the correct current statisticA0\+C0A\_\{0\}\+C\_\{0\}, but the remaining budget is zero\. If one incorrectly kept the old degree\-one allowance and then deletedaa, that truncated expression would giveB0\+C0B\_\{0\}\+C\_\{0\}instead ofC0C\_\{0\}\. The second request exceeds the original contract\. Renewing a deletion budget requires a state prepared for the larger promise\.

### 3\.3Indexed updates and their cost

An indexed implementation, called P\-I in the supplement, stores three objects: the nonzero coefficient map, an inverse index from each identifier to keys containing it, and buckets grouping keys by degree\. A singleton deletion follows a short sequence:

1. 1\.Find the keys containing the deleted identifier through the inverse index\.
2. 2\.Remove that identifier from each key and combine values whose reduced keys coincide\.
3. 3\.Remove zero coefficients and their index entries\.
4. 4\.Decrease the remaining budget and discard the newly excessive degree bucket\.

A coefficient can move without changing its value\. Vector addition is needed only when keys merge\. For example, deletingbbin the chain merges the old constant with key\{b\}\\\{b\\\}and merges\{a\}\\\{a\\\}with\{a,b\}\\\{a,b\\\}\. Their values becomeA0\+C0A\_\{0\}\+C\_\{0\}and−A0\-A\_\{0\}, respectively\. The scanning implementation P\-S applies the same substitution by visiting all keys\. The inverse index avoids scanning unaffected entries\.

LetM0M\_\{0\}be the initial number of keys andL0L\_\{0\}their total length\. LetQQcount supplied integer request identifiers across the sequence\. For statistic dimensionss, define the initial potentialΦ0=∑J\|J\|​\(\|J\|\+1\)/2\\Phi\_\{0\}=\\sum\_\{J\}\|J\|\(\|J\|\+1\)/2\. The indexed substitution core has sequence\-wide cost

O⁡\(Q\+Φ0\+s​M0\)⊆O⁡\(Q\+K​L0\+s​M0\),O\(Q\+\\Phi\_\{0\}\+sM\_\{0\}\)\\subseteq O\(Q\+KL\_\{0\}\+sM\_\{0\}\),\(7\)under expected constant\-time dictionary operations apart from tuple work\. Shrinking a length\-jjkey costsO⁡\(j\)O\(j\)and decreases its potential byjj\. Each merge removes an entry, so at mostM0M\_\{0\}vector merges occur\. Initial incidences are only removed, giving at mostL0L\_\{0\}inverse\-incidence removals\. This amortized argument allows an individual request to touch all keys\.

The coefficient map and indices useO⁡\(s​M0\+M0\+L0\)O\(sM\_\{0\}\+M\_\{0\}\+L\_\{0\}\)words, plus membership storage\. Construction, learner solves, rational bit lengths, and serialization are separate costs\. The frozen Python service also performs request validation, a full public\-ID lookup, sorting, and per\-call work\. Appendix[A](https://arxiv.org/html/2610.33426#A1)gives these costs and retry behavior\. Equation \([7](https://arxiv.org/html/2610.33426#S3.E7)\) describes the substitution core rather than the complete service\.

### 3\.4Ridge regression and contributor withdrawal

For ridge regression, letzv∈ℝdz\_\{v\}\\in\\mathbb\{R\}^\{d\}be a stored feature column andyv∈ℝqy\_\{v\}\\in\\mathbb\{R\}^\{q\}its response column\. A matrixW∈ℝd×qW\\in\\mathbb\{R\}^\{d\\times q\}predictsW⊤​zvW^\{\\top\}z\_\{v\}\. Use the record statistic

t⁡\(v\)=\(zv​zv⊤,zv​yv⊤,1\)\.t\(v\)=\(z\_\{v\}z\_\{v\}^\{\\top\},z\_\{v\}y\_\{v\}^\{\\top\},1\)\.Its selected sum is\(G,H,n\)\(G,H,n\): a feature cross\-product matrix, a feature\-response matrix, and the selected count\. Average\-loss ridge with fixedλ\>0\\lambda\>0solves

\(G\+λ​n​I\)​W=H\.\(G\+\\lambda nI\)W=H\.\(8\)There is no intercept, all coordinates are penalized, and the empty selected set returns zero\. The factornnfollows from using average loss; repairing moments while retaining the old count would change this learner\. Cosine\-normalized scoring rows also do not replace the stored raw rows in its objective\.

This specialization makes corpus and model repair distinct operations\. The coefficient update supplies exact moments and count\. A subsequent solve produces the head\. Dense statistics haveO⁡\(d2\+d​q\)O\(d^\{2\}\+dq\)coordinates, and a dense solve costsO⁡\(d3\+d2​q\)O\(d^\{3\}\+d^\{2\}q\)\. Whether maintaining these moments is preferable to retaining compact eligible rows depends on the complete costs considered in Section[5](https://arxiv.org/html/2610.33426#S5)\.

The same algebra supports withdrawal of all records belonging to one source\. Assume sources partition the records, and writeg⁡\(v\)g\(v\)for the source ofvv\. Define the distinct blocking sourcesU⁡\(v\)=\{g⁡\(u\):u∈B⁡\(v\)\}U\(v\)=\\\{g\(u\):u\\in B\(v\)\\\}\. With one deletion indicator per source, the contribution becomes

t⁡\(v\)​\(1−xg⁡\(v\)\)​xU⁡\(v\)\.t\(v\)\(1\-x\_\{g\(v\)\}\)x\_\{U\(v\)\}\.Repeated occurrences of one source collapse because a Boolean indicator satisfiesx2=xx^\{2\}=x\. Ifg⁡\(v\)∈U⁡\(v\)g\(v\)\\in U\(v\), this expression is zero: removing that blocking source would also removevv\. Otherwise the previous construction and proof apply with a source\-count budget\. Several blocking records from one source cost only one withdrawal request\. The ownership partition must therefore be part of the target, alongside the graph\.

## 4Why the future budget can require excluded data

The summary above is sufficient for exact repair\. We now ask how much information any exact model\-recovery service can require\. The example uses a collection of excluded candidates\. Each has a private word of feature signs, a shared group of blockers, and one individual blocker\. Removing its blockers exposes that candidate to the learner\.

The construction connects graph selection to model information\. Public feature coordinates determine which deletions expose each candidate\. Private coordinates determine the resulting ridge head without changing the graph\. The same stored rows serve both purposes\. We first describe the feature family, then derive its current and future state requirements\.

### 4\.1A graph that exposes one private word at a time

Fixb≥1b\\geq 1,m≥2m\\geq 2, and powers of fourk,Dk,Dwithd=2\+k\+D≤220d=2\+k\+D\\leq 2^\{20\}\. Public signaturesui∈\{±1/k\}ku\_\{i\}\\in\\\{\\pm 1/\\sqrt\{k\}\\\}^\{k\}satisfy\|ui⊤​uj\|≤1/6\|u\_\{i\}^\{\\top\}u\_\{j\}\|\\leq 1/6fori≠ji\\neq j; orthogonal Hadamard rows suffice whenm≤km\\leq k\. Sort fixed public IDs by their actual priority and assign roles: an anchoraa,bbcommon blockersS0S\_\{0\},mmindividual blockerspip\_\{i\}, andmmcandidateswiw\_\{i\}, in that order\. Use orthogonal coordinate blockse0,e1,U,He\_\{0\},e\_\{1\},U,Hof dimensions1,1,k,D1,1,k,D, and setα=1/128\\alpha=1/128\. The publicUUblock identifies a candidate throughuiu\_\{i\}\. TheHHblock carries its private wordzi∈\{±1/D\}Dz\_\{i\}\\in\\\{\\pm 1/\\sqrt\{D\}\\\}^\{D\}\. The words vary independently across candidates; only their signs are private\. The raw rows are

a\\displaystyle a=e0,\\displaystyle=e\_\{0\},\(9\)sj\\displaystyle s\_\{j\}=12​e0\+78​e1,\\displaystyle=\\tfrac\{1\}\{2\}e\_\{0\}\+\\tfrac\{7\}\{8\}e\_\{1\},pi\\displaystyle p\_\{i\}=12​e0\+78​ui,\\displaystyle=\\tfrac\{1\}\{2\}e\_\{0\}\+\\tfrac\{7\}\{8\}u\_\{i\},wi\\displaystyle w\_\{i\}=12​e1\+78​ui\+α​zi\.\\displaystyle=\\tfrac\{1\}\{2\}e\_\{1\}\+\\tfrac\{7\}\{8\}u\_\{i\}\+\\alpha z\_\{i\}\.Candidate labels are one; every other label is zero\. All nonzero entries are exactly stored normal FP32 values in the stated dimension range\. Candidate labels, graph, signatures, roles, and blocker payloads are public\. The entire public contract is fixed independently of the private signs\.

At the stored binary64 thresholdτ=float64⁡\(0\.4\)\\tau=\\operatorname\{float64\}\(0\.4\), the frozen ordered double\-precision \(FP64\) normalization and dot product give

B⁡\(wi\)=S0∪\{pi\}B\(w\_\{i\}\)=S\_\{0\}\\cup\\\{p\_\{i\}\\\}uniformly over all private signs\. Ideal required edges exceed\.43\.43; required nonedges are below\.372\.372\. The scorer error is below2−322^\{\-32\}under the explicit arithmetic assumptions in Appendix[B](https://arxiv.org/html/2610.33426#A2)\. The operation order and arithmetic assumptions are part of the scorer contract; Appendix[B](https://arxiv.org/html/2610.33426#A2)gives the full margin proof\.

### 4\.2From an exposed candidate to an information bound

Initially only the zero\-label anchor is selected\. At budgetbb, no candidate can lose itsb\+1b\+1blockers, and every target head is zero\. At budgetK=b\+1K=b\+1, the requestFi=S0∪\{pi\}F\_\{i\}=S\_\{0\}\\cup\\\{p\_\{i\}\\\}selectsa,wia,w\_\{i\}\. Each candidate has exactlyKKblockers, so any allowed request selecting it must equalFiF\_\{i\}; no allowed request selects two candidates\. For exact rational ridge with rationalλ\>0\\lambda\>0, define

κ=16641/16384\+2​λ\.\\kappa=16641/16384\+2\\lambda\.Sincea⟂wia\\perp w\_\{i\}, the resulting head is

θi=wiκ=12​e1\+78​uiκ\+ακ​zi\.\\theta\_\{i\}=\\frac\{w\_\{i\}\}\{\\kappa\}=\\frac\{\\tfrac\{1\}\{2\}e\_\{1\}\+\\tfrac\{7\}\{8\}u\_\{i\}\}\{\\kappa\}\+\\frac\{\\alpha\}\{\\kappa\}z\_\{i\}\.\(10\)ItsHHcoordinates reveal allDDprivate signs of candidateii\.

###### Theorem 2\(Sharp private\-information transition\)\.

On this fixed public family, the minimum deterministic exact model\-query state is zero private bits at horizonbbandm​DmDprivate bits at horizonb\+1b\+1\. The initial state of an exact sequential service has the same lower bound\. It also holds for randomized services exactly correct almost surely for every fixed input and query\.

###### Proof\.

There are2m​D2^\{mD\}independent sign assignments\. Any two differ on some candidateiiand produce different heads on its public requestFiF\_\{i\}\. Their states must therefore differ\. Conversely, storing all signs allows reconstruction of the indicated head onFiF\_\{i\}and zero on all other allowed queries\. At horizonbb, always returning zero suffices\. There are finitely many inputs and requests, so a randomized zero\-error service has a common probability\-one set of coins on which the deterministic distinguishability argument applies\. ∎

Here a𝖡\\mathsf\{B\}\-bit state has at most2𝖡2^\{\\mathsf\{B\}\}distinguishable values conditional on public information and independent public coins\. Usable length or framing choices are charged as well\. Each isolating requestFiF\_\{i\}exposes one candidate, but the initial state must support every candidate’s request\. That is why the lower bound sums allm​DmDsigns rather than theDDsigns revealed by a single answer\. The requests delete only public blocker payloads, so receiving those deleted payloads supplies none of the missing private information\. Public metadata, padding, and workspace consume additional physical storage under the contract of Section[2](https://arxiv.org/html/2610.33426#S2)\.

### 4\.3The minimum information after earlier deletions

For cumulative deletionFFunder the originalK=b\+1K=b\+1, define

I⁡\(F\)\\displaystyle I\(F\)=\{i:wi∉F,\|B\(wi\)∖F\|≤K−\|F\|\}\\displaystyle=\\\{i:w\_\{i\}\\notin F,\\ \|B\(w\_\{i\}\)\\setminus F\|\\leq K\-\|F\|\\\}=\{i:F⊆S0∪\{pi\}\},e⁡\(F\)=\|I⁡\(F\)\|\.\\displaystyle=\\\{i:F\\subseteq S\_\{0\}\\cup\\\{p\_\{i\}\\\}\\\},\\qquad e\(F\)=\|I\(F\)\|\.\(11\)The equality uses the specific construction, not arbitrary graphs\.

###### Corollary 3\(Conditional retained state\)\.

For a fixed admissibleFF, correctness for every private assignment and every allowed continuation requires and is achievable with exactlye⁡\(F\)​De\(F\)Dprivate bits\.

###### Proof\.

Eachi∈I⁡\(F\)i\\in I\(F\)can still be isolated by deleting its remaining blockers, so its signs must be distinguishable\. Storing just those words suffices\. Under further deletionF′⊇FF^\{\\prime\}\\supseteq F,I⁡\(F′\)⊆I⁡\(F\)I\(F^\{\\prime\}\)\\subseteq I\(F\), so a discarded word never becomes relevant again within this horizon\. ∎

A small instance illustrates why current output and future state differ\. Take one common blocker \(b=1b=1\), two candidates \(m=2m=2\), and four private signs per candidate \(D=4D=4\)\. Usek=4k=4with public signatures\(1,1,1,1\)/2\(1,1,1,1\)/2and\(1,1,−1,−1\)/2\(1,1,\-1,\-1\)/2, so the full feature dimension is ten\. The original budget isK=2K=2\. Figure[2](https://arxiv.org/html/2610.33426#S4.F2)compares three alternative first requests and the private words they leave reachable\.

One starting state\. Three alternative first deletions\.Each leaves the current model at zero and one deletion still available\.Deletess8private bitsCandidate 1Candidate 2Deletep1p\_\{1\}4private bitsCandidate 1Candidate 2Deleteaa0private bitsCandidate 1Candidate 2Both words remain reachableOnly word 1 remains reachableNeither word remains reachableFigure 2:Identical current models, different retention needs\. In this constructedK=2K=2instance, each candidate has four private sign bits, shown as filled squares\. Crossed words cannot affect any permitted continuation\. Counts give the conditional minimum private information and exclude public metadata and physical overhead\.The shared blockerssand individual blockerp1p\_\{1\}open different continuations\. Deleting the anchoraauses budget without removing either candidate’s blockers\. If the complete request is\{s,p1\}\\\{s,p\_\{1\}\\\}, candidate 1 is already selected\. Its four signs remain necessary even at remaining budget zero, because the current head must still be recoverable\.

The finite\-family codec stores eligible sign words in candidate order\. A transition copies only words that remain eligible, using immutable canonical exports\. The export has a 48\-byte header, a charged public deletion ledger, and⌈e⁡\(F\)​D/8⌉\\lceil e\(F\)D/8\\rceilprivate payload bytes\. Fresh retained\-data initialization and sequential export yield identical bytes under the same public universe and remaining budget\. The conditional bound fixesFF; Appendix[G](https://arxiv.org/html/2610.33426#A7)discusses request policies that reveal information through their own adaptive choices\.

### 4\.4Approximate heads and finite output precision

With expected squared parameter error at mostε\\varepsilonon each fixed input and hard probe, the same private words yield a quantitative bound\. Writeh2h\_\{2\}for binary entropy in bits and define the squared\-error information function

Rsq​\(v\)=\{1−h2​\(\(1−1−4​v\)/2\),0≤v≤1/4,0,v\>1/4\.R\_\{\\rm sq\}\(v\)=\\begin\{cases\}1\-h\_\{2\}\(\(1\-\\sqrt\{1\-4v\}\)/2\),&0\\leq v\\leq 1/4,\\\\ 0,&v\>1/4\.\\end\{cases\}A standard information\-distortion argument\\citepshannon gives

𝖡≥m​D​Rsq​\(κ2​ε4​α2\),\\mathsf\{B\}\\geq mDR\_\{\\rm sq\}\\\!\\left\(\\frac\{\\kappa^\{2\}\\varepsilon\}\{4\\alpha^\{2\}\}\\right\),\(12\)The normalization relates head error to uncertainty about a private sign\. For a hidden sign encoded as a bitYi​j∈\{0,1\}Y\_\{ij\}\\in\\\{0,1\\\}, the corresponding exact head coordinate isα⁡\(2​Yi​j−1\)/\(κ​D\)\\alpha\(2Y\_\{ij\}\-1\)/\(\\kappa\\sqrt\{D\}\)\. Rescaling an estimated coordinate to the bit interval multiplies its squared error byκ2​D/\(4​α2\)\\kappa^\{2\}D/\(4\\alpha^\{2\}\)\. The entropy bound then charges the uncertainty removed across allm​DmDbits\. Appendix[C](https://arxiv.org/html/2610.33426#A3)gives the posterior\-variance argument and its concavity step\.

At zero error, Equation \([12](https://arxiv.org/html/2610.33426#S4.E12)\) recovers the exactm​DmDlower bound\. Returning only the public part of Equation \([10](https://arxiv.org/html/2610.33426#S4.E10)\) uses no private signs and attains squared errorα2/κ2\\alpha^\{2\}/\\kappa^\{2\}\. At that error the lower bound becomes zero\. Thus the parameter\-error allowance controls how much of the private word must be retained\. The criterion applies to every fixed input and isolating request; averaging over all deletion sets would dilute the difficult cases among requests whose answer is zero\.

The exact head is rational even though the input features are stored in FP32\. In the ten\-dimensional example withλ=1\\lambda=1, a hidden feature coordinate is±1/256\\pm 1/256and the corresponding head coordinate is±64/49409\\pm 64/49409, which has no finite binary expansion\. A floating release therefore needs a stated approximation contract\. An actual certified parameter radius belowα/\(κ​D\)\\alpha/\(\\kappa\\sqrt\{D\}\)preserves every sign\. Appendix[D](https://arxiv.org/html/2610.33426#A4)gives a sufficient finite\-output radius and explains the distinction between parameter error and prediction risk\.

## 5What the contract means for a training service

The service must choose what it can reconstruct, then how to store it\.

### 5\.1Retain payloads and dependencies for different purposes

Deleting an excluded record involves both payloads and dependencies\. Its own training contribution may be zero, but its identifier can still appear in conditions controlling other records\. Payload discard and dependency discard serve different purposes\. A correct implementation must remove the record’s selection influence as well as its own contribution\. In the coefficient representation, the substitution does both operations and allows their effects to cancel where appropriate\.

### 5\.2Compare with the strongest simple storage alternative

A natural baseline stores compact feature and label rows only for records that remain eligible\. It also retains their blocker incidences and degree buckets\. After a request, it identifies selected\-set changes and updates moments in a batch\. The supplement calls this baseline B\-E\. It uses the same eligibility boundary as the coefficient method, but delays expanding a feature row into an outer product\.

This is a consequential choice for high\-dimensional features\. A row usesO⁡\(d\+q\)O\(d\+q\)values, while its dense ridge statistic usesO⁡\(d2\+d​q\)O\(d^\{2\}\+dq\)\. Combining many rows into a shared coefficient can amortize the larger statistic\. If few records share a key, compact rows can be preferable\. The earlier lexical development comparison favored the compact eligible\-row baseline in total bytes\. A bound on necessary private information does not rank these general implementations by physical memory\.

A useful evaluation therefore compares full lifecycles under identical requests\. It includes initialization, graph and index storage, payloads, moments, temporary gathered rows, solves, and serialization\. Incremental update time and total service time answer different questions\. Fresh reconstruction remains the correctness oracle; an optimized eligible\-row baseline is the practical cost comparator\. Appendix[F](https://arxiv.org/html/2610.33426#A6)retains the prepared evaluation design and all unexecuted comparisons\.

## 6Evidence on natural score graphs

We examine two questions: does the fixed selection rule admit records after deletion on natural features, and does a chosen similarity threshold support the intended semantic application? These questions use different oracles\. Exact membership checks test the selection and repair algebra\. Model agreement tests the frozen semantic qualification criterion\.

### 6\.1Data, representations, and study populations

The prepared AskUbuntu population contains 140,250 questions from the corrected April 2024 export\\citepaskubuntu\. Calibration uses 20,996 questions\. Development is reserved by whole contributor source before any effect measurement\. The structural and repair diagnostics use the original pre\-guard prefix of 1,001 development\-training records\. They were separately fixed after the failed calibration and retain all 51 original cutoffs:\.50,\.51,…,\.99,\.995\.50,\.51,\\ldots,\.99,\.995\. No operating cutoff is chosen from these diagnostics\.

The representation is the pinned multilingual E5 base encoder\\citepe5, with 768 stored FP32 coordinates per question\. We encode complete documents in successive 256\-content\-token chunks\. Each chunk receives aquery:prefix and an attended\-token mean, which is normalized\. A content\-length\-weighted average of the chunk vectors is normalized again to produce the stored row\. The scorer normalizes stored rows in FP64 before cosine comparison\. This fixed full\-document recipe determines the score distribution; Appendix[E](https://arxiv.org/html/2610.33426#A5.SS0.SSS0.Px1)specifies its precision and operation order\.

Native accounts supply contributor proxies\. Unknown and community owners remain explicit singletons and are excluded from genuine source\-withdrawal requests\. The complete split, ownership counts, source reservation, and prepared tag\-prediction task appear in Appendix[I](https://arxiv.org/html/2610.33426#A9)\. Neither diagnostic reads task labels, held\-out feature rows, or model judgments\. Both reuse the same feature cache, priority order, and strict comparisonscore\>τ\\mathrm\{score\}\>\\tau\.

### 6\.2Where deletion changes the selected set

The grid contains markedly different graph regimes \(Table[1](https://arxiv.org/html/2610.33426#S6.T1)\)\. The first 25 cutoffs,\.50\.50through\.74\.74, produce complete graphs\. At\.995\.995the graph is empty\. Between these extremes, deleting an initially excluded record admits another record at 13 cutoffs,\.84\.84through\.96\.96\.

Table 1:Illustrative points from the full 51\-cut grid on 1,001 development records\. The last column counts initially excluded records whose singleton deletion admits at least one other record\. These are fixed score graphs, not selected or semantically qualified operating thresholds\.The intermediate graphs expose the distinction in Figure[1](https://arxiv.org/html/2610.33426#S1.F1)\. At the illustrative\.90\.90cutoff, 50 of the 497 excluded records each have a deletion that admits another record\. In a complete graph, every later record has all earlier records as blockers\. Deleting one excluded record cannot remove that entire earlier set\. In an empty graph, all records are already selected\. Graph density alone therefore does not predict the excluded\-blocker effect; the arrangement of blockers matters\.

For uniform deletion of 128 records, the exact expected number of admissions ranges from zero to 12\.51 across the full grid\. These expectations concern the fixed panel and sampling rule\. The execution reproduced every graph with two tile sizes\. A separate aggregate audit checked all 204 exact expectations for budgets1,8,32,1281,8,32,128\.

### 6\.3Exact repair throughout deletion sequences

We apply the unchanged indexed algorithm to integer membership coordinates: each record contributes its own coordinate when selected\. This makes the sum an exact indicator vector of the selected set and exercises the coefficient mechanism without fitting a task learner\.

One fixed record\-deletion stream and one fixed contributor\-proxy source stream are reused at every cutoff\. Each has an original horizon of 128 requests\. The record stream removes 128 records; the source stream removes 261\. The streams check both request units, rather than comparing their effect sizes at matched removed\-record volume\.

Table 2:Exact integer repair checks over all 51 cutoffs\. Counts come from the same two fixed trajectories, not independent statistical replicates\. State equality compares logical coefficient maps and indices at the remaining budget\.Every singleton update matches a direct raw\-blocker membership oracle \(Table[2](https://arxiv.org/html/2610.33426#S6.T2)\)\. After1,8,32,1281,8,32,128requests in each trajectory, we also compare sequential, batched, and reverse\-order processing\. Recomputing the retained\-data graph and constructing the summary at the remaining horizon gives the same logical state at all 408 checkpoints\. These comparisons test the stronger conclusion of Theorem[1](https://arxiv.org/html/2610.33426#Thmtheorem1), not just equality of the current selected count\. Private\-state comparisons were executed in the cluster run; an independent aggregate audit checked the bound receipts and reported counts\.

### 6\.4Semantic qualification: two failed calibrations

The intended semantic application requires a qualified similarity cutoff\. Annotation uses pinned Qwen2\.5\-7B\-Instruct\\citepqwen and Mistral\-Nemo\-Instruct\-2407\\citepmistral, with no human pair review\. Both receive the complete pair texts under a fixed rubric, without IDs, scores, tags, or each other’s answers\. A pair is positive only when both valid outputs call it an exact copy or substantially the same meaning\. Disagreements, other labels, uncertainty, and invalid or unavailable outputs contribute zero positive mass and remain in the denominator\. The target is this joint model\-label function\. Model agreement and order sensitivity are assessed as such\\citepjudge\.

Version 3 completed 90 canonical pairs and nine swapped diagnostics per model\. It produced zero joint positives and no qualifying cutoff\. Version 4 is a separately versioned follow\-up, with the earlier negative result preserved\. It enumerates all 220,405,510 unordered calibration pairs and samples up to 30 pairs without replacement from each of 13 score strata\. The realized sample has 360 canonical pairs and 36 swapped diagnostics per model\. Inverse\-inclusion weights estimate the joint\-positive proportion above each original cutoff\.

The frozen selection rule requires a weighted proportion of at least 95% with nonzero support, choosing the least strict qualifying cutoff\. Only a selected cutoff proceeds to fresh validation, whose one\-sided 95% finite\-population lower bound must reach 90%\. Neither version selected a cutoff, so fresh validation was not run\. In version 4, the largest weighted proportion is 40%, reached at\.99\.99and\.995\.995\(Table[3](https://arxiv.org/html/2610.33426#S6.T3)\)\. All 51 negative decisions were independently recomputed\. Appendix[I](https://arxiv.org/html/2610.33426#A9)gives invalid\-response counts, order diagnostics, sensitivity analysis, and the full decision protocol\.

Table 3:Version 4 semantic selection at representative frozen cutoffs\. Pairs are sampled canonical pairs with score strictly above the cutoff\. Joint proportions use inclusion weights; the selection requirement is 95%\.The completed natural\-data evidence establishes structural admissions and exact membership repair on these development graphs\. Both semantic calibrations failed, leaving the threshold\-qualified task, comparative cost, and held\-out effect study unexecuted\. This failure concerns the fixed representation, rater pair, and rubric; it does not establish the absence of semantic duplicates in AskUbuntu\. The original evaluation reservation and unmet human\-validation gates remain preserved\.

## 7Related work

#### Curation and complete\-pipeline targets\.

\\citet

cao use summation\-form learning to update feature selection and models after deletion\.\\citetivmunlearning casts unlearning as view maintenance, including preprocessing in the maintained dataflow\. Dominici’s thesis concerns data preparation pipelines and feature stores\\citepdominici; its metadata and research description were available for comparison, while its full text was not\. Our result fixes record\-level suppression and characterizes its exact statistic map under a decreasing deletion budget\.

SemDeDup studies embedding\-space redundancy\\citepsemdedup; its released suppression computation motivates our operator\\citepsemcode\. ARCANE combines representative selection with an exact\-unlearning architecture\\citeparcane\. Its Section 3\.2 assigns no retraining cost to deletions outside the selected subset\. Our example shows why that property depends on the selection contract\. GRACE selects forget and retain coresets for behavioral language\-model unlearning\\citepgrace, a different target from reconstructing a fixed curator and learner\.

#### Provenance and additive repair\.

Polynomial provenance\\citepgreen, provenance for aggregation and difference\\citepaggregate, DBSP’s incremental query framework\\citepdbsp, and provenance\-based regression updates\\citeppriu provide the algebraic foundations\. Our signed expansion couples substitution with a decreasing degree cutoff\. It preserves the fresh coefficient map, including coefficients for future requests\.

#### Continuing state and storage\.

\\citet

ginart include metadata for subsequent deletions in the object compared with retraining\.\\citetcohencontrol relate unlearning to adaptive history independence and distinguish current outputs from internal state and later behavior\. Learning\-unlearning space complexity studies budget\-dependent storage\\citepspace\. Ticketed unlearning separately charges central information and per\-record tickets\\citepticketed, including a multi\-request threshold construction\. Our bound charges all private information accessible to repair, including tickets, under a fixed public contract\. Its matching codec concerns the constructed feature family at each remaining horizon\.

#### Information for counterfactual queries\.

\\citet

counterfactual,counterfactualcode study query\-sufficient summaries of binary histories\. Their count\-threshold example separates the state needed for prediction from that needed for counterfactual answers\. Our construction ties the queries to deletion of public blockers and the answers to exact ridge heads on the same finite features used by curation\. The approximate extension uses classical information\-distortion tools\\citepshannon for expected squared head error on each fixed input and probe\. This criterion differs from the joint answer\-tuple success event in the counterfactual counting proof\. Appendix[H](https://arxiv.org/html/2610.33426#A8)records the precise comparison of these guarantees\.

## 8Conclusion

For exact repair after curation, the cumulative deletion budget determines which excluded records can still matter\. We turn this retention contract into a repairable statistic summary\. The finite\-feature family shows that it can require information absent from the current model\. A service should specify its curation target, cumulative horizon, and retained\-data access before discarding payloads\.

## References

- \[Abbas et al\.\(2023\)\]A\. Abbas, K\. Tirumala, D\. Simig, S\. Ganguli, and A\. S\. Morcos\. 2023\. SemDeDup: Data\-efficient learning at web\-scale through semantic deduplication\.[arXiv:2303\.09540](https://arxiv.org/abs/2303.09540)\.
- \[Amsterdamer et al\.\(2011\)\]Y\. Amsterdamer, D\. Deutch, and V\. Tannen\. 2011\. Provenance for aggregate queries\. PODS, 153–164\.[doi:10\.1145/1989284\.1989302](https://doi.org/10.1145/1989284.1989302)\.
- \[Budiu et al\.\(2023\)\]M\. Budiu, T\. Chajed, F\. McSherry, L\. Ryzhyk, and V\. Tannen\. 2023\. DBSP: Automatic incremental view maintenance for rich query languages\. PVLDB, 16\(7\):1601–1614\.[https://www\.vldb\.org/pvldb/vol16/p1601\-budiu\.pdf](https://www.vldb.org/pvldb/vol16/p1601-budiu.pdf)\.
- \[Bushipaka et al\.\(2026\)\]P\. Bushipaka, A\. D’Angelo, L\. Passaro, and T\. Cucinotta\. 2026\. GRACE: Gradient\-guided coreset selection for LLM unlearning\.[arXiv:2608\.28361v1](https://arxiv.org/abs/2608.28361v1)\.
- \[Cao and Yang\(2015\)\]Y\. Cao and J\. Yang\. 2015\. Towards making systems forget with machine unlearning\. IEEE Symposium on Security and Privacy, 463–480\.[doi:10\.1109/SP\.2015\.35](https://doi.org/10.1109/SP.2015.35)\.
- \[Cherapanamjeri et al\.\(2025\)\]Y\. Cherapanamjeri, S\. Garg, N\. Rajaraman, A\. Sekhari, and A\. Shetty\. 2025\. The space complexity of learning\-unlearning algorithms \(extended abstract\)\. COLT, PMLR 291:1185–1193\.[https://proceedings\.mlr\.press/v291/cherapanamjeri25b\.html](https://proceedings.mlr.press/v291/cherapanamjeri25b.html)\. Full version:[arXiv:2506\.13048v1](https://arxiv.org/abs/2506.13048v1)\.
- \[Cohen et al\.\(2023\)\]A\. Cohen, A\. Smith, M\. Swanberg, and P\. N\. Vasudevan\. 2023\. Control, confidentiality, and the right to be forgotten\. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 3358–3372\.[doi:10\.1145/3576915\.3616585](https://doi.org/10.1145/3576915.3616585)\.
- \[Dominici\(2025\)\]L\. Dominici\. 2025\. End\-to\-end machine unlearning through data preparation pipelines and feature stores\. Master’s thesis, University of Amsterdam and Vrije Universiteit Amsterdam\. Bibliographic identification from the author’s page and DEEM thesis list; full text not inspected\.[https://leodom01\.github\.io/](https://leodom01.github.io/);[https://deem\.berlin/](https://deem.berlin/)\.
- \[Facebook Research\(2023\)\]Facebook Research\. 2023\. SemDeDup official implementation,semdedup\.py\. Commit[6b4194511202](https://github.com/facebookresearch/SemDeDup/blob/6b4194511202c29b0e1ac8c730996777449ea2a4/semdedup.py)\. Inspected 22 October 2026\.
- \[Ghazi et al\.\(2023\)\]B\. Ghazi, P\. Kamath, R\. Kumar, P\. Manurangsi, A\. Sekhari, and C\. Zhang\. 2023\. Ticketed learning–unlearning schemes\. COLT, PMLR 195:5110–5139\.[https://proceedings\.mlr\.press/v195/ghazi23a\.html](https://proceedings.mlr.press/v195/ghazi23a.html)\.
- \[Ginart et al\.\(2019\)\]A\. A\. Ginart, M\. Y\. Guan, G\. Valiant, and J\. Zou\. 2019\. Making AI forget you: Data deletion in machine learning\. Advances in Neural Information Processing Systems, 32:3518–3531\.[https://proceedings\.neurips\.cc/paper/2019/hash/cb79f8fa58b91d3af6c9c991f63962d3\-Abstract\.html](https://proceedings.neurips.cc/paper/2019/hash/cb79f8fa58b91d3af6c9c991f63962d3-Abstract.html)\.
- \[Green et al\.\(2007\)\]T\. J\. Green, G\. Karvounarakis, and V\. Tannen\. 2007\. Provenance semirings\. PODS, 31–40\.[doi:10\.1145/1265530\.1265535](https://doi.org/10.1145/1265530.1265535)\.
- \[Mistral AI\(2024\)\]Mistral AI\. 2024\. Mistral NeMo\. Model release, 18 July 2024\.[https://mistral\.ai/news/mistral\-nemo/](https://mistral.ai/news/mistral-nemo/)\.
- \[Qwen Team\(2024\)\]Qwen Team\. 2024\. Qwen2\.5: A party of foundation models\. Model release, 19 September 2024\.[https://qwenlm\.github\.io/blog/qwen2\.5/](https://qwenlm.github.io/blog/qwen2.5/)\.
- \[Schelter\(2021\)\]S\. Schelter\. 2021\. Towards efficient machine unlearning via incremental view maintenance\. Workshop on Challenges in Deploying and Monitoring ML Systems at ICML\.[https://ssc\.io/pdf/ivm\-unlearning\.pdf](https://ssc.io/pdf/ivm-unlearning.pdf)\.
- \[Shannon\(1959\)\]C\. E\. Shannon\. 1959\. Coding theorems for a discrete source with a fidelity criterion\. IRE International Convention Record, 7\(4\): 142–163\.[Reprinted text](https://gwern.net/doc/cs/algorithm/information/1959-shannon.pdf)\.
- \[Stack Exchange\(2024\)\]Stack Exchange\. 2024\. Stack Exchange Data Dump, corrected April 2024 release, Ask Ubuntu component\.[Community mirror](https://archive.org/details/stackexchange_20240402_bis)\. Release identified by the[release index](https://meta.stackexchange.com/questions/224873/all-stack-exchange-data-dump-releases)and[staff correction announcement](https://meta.stackexchange.com/a/398606)\.
- \[Tadakamalla et al\.\(2026a\)\]Sai Pranay Tadakamalla, Surisetty Maruthi Ram Prakash, and Syed Mohammed Asad\. 2026a\. Predictive state is not explanatory state: An exponential memory separation between forecasting and counterfactual auditing\. SSRN manuscript\.[https://doi\.org/10\.2139/ssrn\.7520178](https://doi.org/10.2139/ssrn.7520178)\.
- \[Tadakamalla et al\.\(2026b\)\]Sai Pranay Tadakamalla, Surisetty Maruthi Ram Prakash, and Syed Mohammed Asad\. 2026b\. Predictive state is not explanatory state\. Reference implementation, version 1\.0\.0\. Inspectedqueries\.py,decoder\.py, and associated verification sources at commit[4143f4088433](https://github.com/PranayTadakamalla/predictive-state-not-explanatory-state/tree/4143f408843394e21a0622c9eb5d5de10a687a8c)\.
- \[Wang et al\.\(2024\)\]L\. Wang, N\. Yang, X\. Huang, L\. Yang, R\. Majumder, and F\. Wei\. 2024\. Multilingual E5 text embeddings: A technical report\.[arXiv:2402\.05672](https://arxiv.org/abs/2402.05672)\.
- \[Wu et al\.\(2020\)\]Y\. Wu, V\. Tannen, and S\. B\. Davidson\. 2020\. PrIU: A provenance\-based approach for incrementally updating regression models\. SIGMOD, 447–462\.[doi:10\.1145/3318464\.3380571](https://doi.org/10.1145/3318464.3380571)\.
- \[Yan et al\.\(2022\)\]H\. Yan, X\. Li, Z\. Guo, H\. Li, F\. Li, and X\. Lin\. 2022\. ARCANE: An efficient architecture for exact machine unlearning\. IJCAI, 4006–4013\.[doi:10\.24963/ijcai\.2022/556](https://doi.org/10.24963/ijcai.2022/556)\.
- \[Zheng et al\.\(2023\)\]L\. Zheng, W\.\-L\. Chiang, Y\. Sheng, S\. Zhuang, Z\. Wu, Y\. Zhuang, Z\. Lin, Z\. Li, D\. Li, E\. P\. Xing, H\. Zhang, J\. E\. Gonzalez, and I\. Stoica\. 2023\. Judging LLM\-as\-a\-judge with MT\-Bench and Chatbot Arena\. Advances in Neural Information Processing Systems, 36\.[Datasets and Benchmarks Track](https://proceedings.nips.cc/paper_files/paper/2023/hash/91f18a1287b398d378ef22505bf41832-Abstract-Datasets_and_Benchmarks.html)\.

## Appendix AUpdate accounting and state boundaries

The low\-level integer\-ID kernel rejects repeated, already deleted, invalid, and over\-budget IDs before mutation\. The empirical service first deduplicates IDs and removes already deleted IDs, so retries are no\-ops, including after budget exhaustion\. It rejects invalid IDs and requests with too many fresh IDs\. The mathematical reference also treats retries as no\-ops\. These interfaces apply the same substitution to valid fresh deletions\.

For singleton deletion ofuu, first obtain the inverse\-incidence handles of keys containinguu\. For each entry, remove its incidence atuu, its old dictionary key, and its degree\-bucket membership\. Removeuufrom the key\. If the reduced key is absent, move the same entry handle to it; all surviving inverse references remain attached to that handle and are not rebuilt\. If the key already exists, merge the values and remove all remaining incidences of the retired source entry\. A zero result also retires the destination and its incidences\. Moving a value transfers its reference; only merges perform vector arithmetic and a zero test\. After reducing the horizon by one, remove the now\-excessive degree bucket\. No key gains an element, and the number of live keys never increases\.

Give each initial incidence a token\. A shrink removes a token; a merge or prune removes its source tokens\. None are created\. Thus at mostL0L\_\{0\}inverse\-incidence removals occur over the whole sequence\. Each merge decreases key count, giving at mostM0M\_\{0\}vector additions\. A tuple shrink from sizejjcostsO⁡\(j\)O\(j\), and decreases its potentialj⁡\(j\+1\)/2j\(j\+1\)/2byjj\. This charges tuple copying, hashing, and comparisons under the stated dictionary model\. Streaming word\-sized input IDs costsO⁡\(Q\)O\(Q\), including retries, for the abstract reference algorithm, which does not sort requests\. Per\-call overhead addsO⁡\(B\)O\(B\)forBBcalls; this is absorbed intoO⁡\(Q\)O\(Q\)only for nonempty calls\. The resulting core bound is Equation \([7](https://arxiv.org/html/2610.33426#S3.E7)\)\.

The frozen empirical service has additional work\. LetNNbe its fixed public unit\-ID count, and let callbbsupplyqbq\_\{b\}IDs withfbf\_\{b\}fresh unique IDs, soQ=∑bqbQ=\\sum\_\{b\}q\_\{b\}\. It reconstructs theNN\-entry lookup on every call and sorts the fresh IDs before invoking the kernel\. Under unit\-cost identifiers and expected constant\-time hashing, its update cost is

O⁡\(B⁡\(N\+1\)\+Q\+∑bfb​log⁡\(fb\+1\)\+Φ0\+s​M0\)\.O\\\!\\left\(B\(N\+1\)\+Q\+\\sum\_\{b\}f\_\{b\}\\log\(f\_\{b\}\+1\)\+\\Phi\_\{0\}\+sM\_\{0\}\\right\)\.Direct low\-level calls on arbitrary unsorted lists instead have the bound

O⁡\(B\+Q\+∑bqb​log⁡\(qb\+1\)\+Φ0\+s​M0\)\.O\\\!\\left\(B\+Q\+\\sum\_\{b\}q\_\{b\}\\log\(q\_\{b\}\+1\)\+\\Phi\_\{0\}\+sM\_\{0\}\\right\)\.The service supplies a sorted list to the kernel, so a second arbitrary\-order sort is not charged\. Its temporary lookup requiresO⁡\(N\)O\(N\)words in addition to request containers and the core state\. String decoding, hashing and comparison costs require separate byte accounting\. Empty calls still cost work\. These API costs must be included in complete lifecycle measurements\.

The coefficient values and incidence metadata occupyO⁡\(s​M0\+M0\+L0\)O\(sM\_\{0\}\+M\_\{0\}\+L\_\{0\}\)words, plus membership storage\. Rational arithmetic requires additional bit\-length accounting\. A canonical export removes zero keys and orders keys and values, with at least linear output cost\. The fast in\-memory structure is canonical only as a logical map modulo handles, not as allocator memory\. A final exact map can be equal to a fresh construction while both a floating\-point accumulation order and its serialized bytes differ\. Numerical checks against a fresh oracle must therefore state their contract rather than borrow exact equality\.

## Appendix BFinite\-family graph and scorer proof

All statements in this appendix concern the mathematical rows of Equation \([9](https://arxiv.org/html/2610.33426#S4.E9)\), not natural encoder outputs\. Powers\-of\-fourk,Dk,Dmake1/k1/\\sqrt\{k\}and1/D1/\\sqrt\{D\}dyadic\. The dimension cap keeps every nonzero stored value in the ordinary normal range; the range argument below also excludes nonzero subnormal intermediates in scoring\. The norms, independent of private signs, are

‖a‖2=1,‖sj‖2=‖pi‖2=65/64,‖wi‖2=16641/16384=\(129/128\)2\.\\left\\lVert a\\right\\rVert^\{2\}=1,\\quad\\left\\lVert s\_\{j\}\\right\\rVert^\{2\}=\\left\\lVert p\_\{i\}\\right\\rVert^\{2\}=65/64,\\quad\\left\\lVert w\_\{i\}\\right\\rVert^\{2\}=16641/16384=\(129/128\)^\{2\}\.The anchor blocks everysjs\_\{j\}andpip\_\{i\}since its cosine with them is4/65\>\.494/\\sqrt\{65\}\>\.49\. It has zero dot product with every candidate\. Common\-blocker/candidate cosine is448/\(129​65\)\>\.43448/\(129\\sqrt\{65\}\)\>\.43; individual\-blocker/own\-candidate cosine is784/\(129​65\)\>\.75784/\(129\\sqrt\{65\}\)\>\.75\. Fori≠ji\\neq j, the individual\-blocker/candidate cosine is at most784/\(6⋅129​65\)<\.126784/\(6\\cdot 129\\sqrt\{65\}\)<\.126\. Candidate\-candidate cosine is at most

1/4\+49/\(64⋅6\)\+1/1638416641/16384=1856349923<\.372\.\\frac\{1/4\+49/\(64\\cdot 6\)\+1/16384\}\{16641/16384\}=\\frac\{18563\}\{49923\}<\.372\.These inequalities cover every earlier candidate blocker decision\. Additional edges among the public blockers do not affect the proof, since the anchor initially suppresses them and they have zero labels\.

The exact stored threshold is

τ=3602879701896397253=25\+15 253\.\\tau=\\frac\{3602879701896397\}\{2^\{53\}\}=\\frac\{2\}\{5\}\+\\frac\{1\}\{5\\,2^\{53\}\}\.For this family, raw squared coordinates and partial norm\-square sums are exact in binary64: they are multiples of2−342^\{\-34\}and have magnitude below two\. Assume round\-to\-nearest ties\-to\-even, correctly rounded square root and division, and the specified coordinate order, without arithmetic\-changing reassociation or clipping\. Withu=2−53u=2^\{\-53\}, set

ρ=2​u1−u,γ=\(d\+1\)​u1−\(d\+1\)​u\.\\rho=\\frac\{2u\}\{1\-u\},\\qquad\\gamma=\\frac\{\(d\+1\)u\}\{1\-\(d\+1\)u\}\.The normalized coordinate relative error is at mostρ\\rho\. Products therefore contribute at most2​ρ\+ρ22\\rho\+\\rho^\{2\}in absolute cosine error, using Cauchy–Schwarz\. Ordered dot\-product rounding contributes at mostγ​\(1\+ρ\)2\\gamma\(1\+\\rho\)^\{2\}\. Hence

Ed=2​ρ\+ρ2\+γ​\(1\+ρ\)2<2−32\(d≤220\)\.E\_\{d\}=2\\rho\+\\rho^\{2\}\+\\gamma\(1\+\\rho\)^\{2\}<2^\{\-32\}\\qquad\(d\\leq 2^\{20\}\)\.To justify the relative\-rounding model even under cancellation, nonzero computed normalized coordinates have magnitudes between2−182^\{\-18\}and two\. Rounded nonzero products are at least2−372^\{\-37\}and are multiples of2−892^\{\-89\}\. Ordered sums remain on that grid: rounding either preserves the value or moves to a coarser subgrid\. A sum is therefore zero or has magnitude at least2−892^\{\-89\}, above the subnormal range\. The crude bound4​d≤2224d\\leq 2^\{22\}excludes overflow\. These facts cover the norm, division, product, and accumulation range assumptions used above\. This cannot cross the edge/nonedge margins\. It proves the uniform graph under the stated scorer, independently of them​DmDprivate signs\. Native runtime admission and implementation replay remain separate checks\.

Public signature existence is also qualified\. Hadamard rows give the stated orthogonal case\. Alternatively, independent normalized signs have pairwise tail probability at most2e−k/722e^\{\-k/72\}\. A union bound gives a code whenk≥⌈72​log⁡\(2​m​\(m−1\)\)⌉k\\geq\\lceil 72\\log\(2m\(m\-1\)\)\\rceil, choosing an admitted power of four that still obeys the dimension cap\. This does not permit arbitrarily many signatures at fixed dimension\.

## Appendix CSquared\-error information bound

LetYi​jY\_\{ij\}be independent uniform bits and express the hidden signs as2​Yi​j−12Y\_\{ij\}\-1\. There aren=m​Dn=mDbits\. Given a stateMMand independent public coinsRR, rescale an approximate hard\-probe head by

Y^i​j=12​\(1\+κ​Dα​θ^i​\[Hj\]\)\.\\widehat\{Y\}\_\{ij\}=\\frac\{1\}\{2\}\\left\(1\+\\frac\{\\kappa\\sqrt\{D\}\}\{\\alpha\}\\widehat\{\\theta\}\_\{i\}\[H\_\{j\}\]\\right\)\.Clipping to\[0,1\]\[0,1\]cannot increase squared error, and

1D​∑j\(Y^i​j−Yi​j\)2≤κ24​α2​‖θ^i−θi‖2\.\\frac\{1\}\{D\}\\sum\_\{j\}\(\\widehat\{Y\}\_\{ij\}\-Y\_\{ij\}\)^\{2\}\\leq\\frac\{\\kappa^\{2\}\}\{4\\alpha^\{2\}\}\\left\\lVert\\widehat\{\\theta\}\_\{i\}\-\\theta\_\{i\}\\right\\rVert^\{2\}\.Posterior meanspl=Pr⁡\(Yl=1∣M,R\)p\_\{l\}=\\Pr\(Y\_\{l\}=1\\mid M,R\)minimize conditional squared error, even if a decoder uses fresh randomness\. Thus average posterior variance is at mostv=κ2​ε/\(4​α2\)v=\\kappa^\{2\}\\varepsilon/\(4\\alpha^\{2\}\)\. For0≤s≤1/40\\leq s\\leq 1/4, the function

g​\(s\)=h2​\(1−1−4​s2\)g\(s\)=h\_\{2\}\\\!\\left\(\\frac\{1\-\\sqrt\{1\-4s\}\}\{2\}\\right\)is increasing and concave\. One derivative check substitutess=q⁡\(1−q\)s=q\(1\-q\); the needed sign follows fromr−1/r−2​log⁡r≥0r\-1/r\-2\\log r\\geq 0forr≥1r\\geq 1, whose derivative is\(r−1\)2/r2≥0\(r\-1\)^\{2\}/r^\{2\}\\geq 0and value at one is zero\. Sinceh2​\(p\)=g⁡\(p⁡\(1−p\)\)h\_\{2\}\(p\)=g\(p\(1\-p\)\), conditional subadditivity and Jensen give

H⁡\(Y∣M,R\)≤∑l𝔼​h2​\(pl\)≤n​g​\(v\)\.H\(Y\\mid M,R\)\\leq\\sum\_\{l\}\\mathbb\{E\}h\_\{2\}\(p\_\{l\}\)\\leq ng\(v\)\.The state alphabet contract impliesH⁡\(M∣R\)≤𝖡H\(M\\mid R\)\\leq\\mathsf\{B\}, so𝖡≥I⁡\(Y;M∣R\)≥n⁡\[1−g⁡\(v\)\]\\mathsf\{B\}\\geq I\(Y;M\\mid R\)\\geq n\[1\-g\(v\)\], proving Equation \([12](https://arxiv.org/html/2610.33426#S4.E12)\)\. Forv≥1/4v\\geq 1/4the zero bound applies\. Correctness averaged over uniform signs and a uniform hard\-probe index already suffices\. Averaging over all valid deletion sets is weaker because many produce a zero head and can dilute the error\.

The zero\-information threshold is attained by returning just the public component of the hard\-probe head\. Its squared error isα2/κ2\\alpha^\{2\}/\\kappa^\{2\}for every sign assignment\. The repository also gives a finite covering code upper bound for a query summary\. It can require an enormous public codebook and does not give an efficient sequentially erasable lossy codec; we make no such implementation claim here\.

## Appendix DFinite\-output and utility limits

The hidden coordinate magnitude in a hard\-probe exact head isaH=α/\(κ​D\)a\_\{H\}=\\alpha/\(\\kappa\\sqrt\{D\}\)\. A deterministic certified parameter radius strictly belowaHa\_\{H\}identifies every hidden sign and transfers the exactm​DmDprivate\-bit bound\. If0<λ≤10<\\lambda\\leq 1, thenκ<4\\kappa<4andD≤210\\sqrt\{D\}\\leq 2^\{10\}, givingaH\>2−19a\_\{H\}\>2^\{\-19\}\. An actual radius at most2−202^\{\-20\}is therefore sufficient\. A configured tolerance is not a certificate: the radius must cover moment accumulation, solving, and release rounding relative to the prescribed exact target\. We have not established such a certificate for the ongoing natural\-text learner\.

For a public test distribution uniformly sampling anHH\-basis vector, prediction discrepancy is‖PH​e‖2/D\\left\\lVert P\_\{H\}e\\right\\rVert^\{2\}/Dfor head erroree\. Uniform sampling of all coordinate basis vectors instead yields‖e‖2/d\\left\\lVert e\\right\\rVert^\{2\}/d\. Consequently a constant parameter\-error obstruction does not establish constant task risk\. Native tag prediction, natural source requests, and matched\-cost baselines are needed to assess practical value\.

## Appendix EReproducibility, compute, and assistance disclosure

This standalone source embeds the unmodified official TMLR style and its bibliography\. The anonymous supplement contains an explicit subset of source code, exact annotation prompts and schemas, and aggregate evidence\. The code includes data adapters, embedding and task configuration, development selection, pair sampling, and the production\-reused rendering and inference kernels\. Its source map distinguishes unchanged research modules from a small extracted support helper\. Deployment wrappers and private activation locks are excluded; the package documents these remaining inputs\. A top\-levelREADME\.txtmaps claims to files, andpython3 \-B check\_all\.pyruns the public checks with Python 3\.10 or later, without model downloads or private data\. The full development archive retains historical proofs, reviews, code, negative results, and frozen protocols\. It is separate from the anonymous submission materials; identifying infrastructure receipts and private observations are not included in the supplement\.

The active representation isintfloat/multilingual\-e5\-base\. The pinned model revisions are: E5:d128750597153bb5987e10b1c3493a34e5a4502a\. Qwen:a09a35458c702b33eeacc393d103063234e8bc28\. Mistral:04d8a90549d23fc6bd7f642064003592df51e9b3\. Protocol manifests bind tokenizer files, templates, prompt/schema, runtime, and sampling seeds\. Source/cache/task intake and independent arithmetic reviews bind private outputs by exact bytes and hashes\. Checksums support identity; they do not establish semantic correctness or source rights\.

#### Full\-document embedding recipe\.

Content is tokenized once without special tokens or truncation and split into consecutive blocks of at most 256 content tokens\. Separately tokenizedquery:IDs are prepended to each block before the tokenizer adds special tokens; content is never decoded and retokenized\. For the pinned E5 tokenizer, chunks are padded to 261 tokens\. Batches contain chunks of one document only\. The encoder runs in evaluation mode on CPU in FP32, with eager attention and deterministic algorithms enabled\. Pooling masks padding and averages all attended tokens, including prefix and special tokens\. Each FP32 mean is normalized using coordinate\-ordered FP64 norm accumulation\. In document order, normalized chunk vectors are weighted by their content\-token counts and accumulated in FP64\. Their weighted mean is normalized again and cast to the stored FP32 row\. Cosine scoring renormalizes those stored rows in FP64\. The supplement provides the exact embedding and scoring source; the model card alone does not specify this full\-document procedure\. Absolute scores and the failed calibration are conditional on this fixed recipe, not a conclusion about every use of E5\.

#### Asset attribution and replay limits\.

The pinned publisher cards declare MIT for[multilingual E5](https://huggingface.co/intfloat/multilingual-e5-base/blob/d128750597153bb5987e10b1c3493a34e5a4502a/README.md)and Apache 2\.0 for[Qwen2\.5\-7B\-Instruct](https://huggingface.co/Qwen/Qwen2.5-7B-Instruct/blob/a09a35458c702b33eeacc393d103063234e8bc28/README.md)and[Mistral\-Nemo\-Instruct\-2407](https://huggingface.co/mistralai/Mistral-Nemo-Instruct-2407/blob/04d8a90549d23fc6bd7f642064003592df51e9b3/README.md)\. We distribute no model weights\. Stack Exchange’s[licensing guidance](https://stackoverflow.com/help/licensing)associates contributions from 2 May 2018 UTC onward with CC BY\-SA 4\.0 and identifies per\-revision licenses through post timelines\. Our adapter retains supplied post attributes, including license and edit metadata when present\. This is not a complete author\-history audit; owner accounts remain contributor proxies\. The public package excludes corpus text, per\-record identities and per\-pair model observations\.

The anonymous supplement checks its file hashes and the supplied aggregate calibration and compute arithmetic\. This verifies an extract of the evidence, not the authenticity of the private observations\. Recomputing the selection from individual observations requires the private sample and audited model outputs; repeating inference also requires the pinned source, assets and runtime\. These are separate verification levels\. Fixed revisions and seeds alone do not establish bitwise inference portability\. The attribution ledger records documentary sources and remaining gaps without changing the original acceptance gates\.

#### Protocol and implementation history\.

The fully LLM branch does not relabel model judgments as human evidence or inherit acceptance of the original human\-gated study\. The documentary source chain is not publisher cryptographic attestation, and development source acceptance is separate from earlier source gates\. Separate exact\-byte audits verified prompt, token, and grammar identities without repeating model calls\. The prior Qwen audit’s newline\-normalization failure and all original outputs remain preserved\. The algebraic, scorer, and codec artifacts retain their internal reviews; these are implementation/reasoning checks, not external peer review\.

#### Completed development preparation\.

Actual source/cache/task bindings and the source\-disjoint development allocation passed a separate implementation review\. A resource pilot scanned 262,144 real\-cache cross\-pairs and matched the original guard’s canonical first witness, score, and keep decision at\.50,\.99,\.995\.50,\.99,\.995\. The scan kernel took 0\.7783 seconds in that pilot\. This does not establish full\-scale runtime, full\-guard completion, or empirical effect size\. The first stable\-ID witness is not the maximum\-scoring witness\.

#### Observed compute scope\.

The two completed v4 inference jobs each allocated one A100 80GB GPU\. Their scheduler elapsed times were 11,836 seconds for Qwen and 7,209 for Mistral, totaling 19,045 GPU\-allocation seconds \(5\.29 hours\)\. This includes job overhead and model loading, excludes queue time, and is not measured GPU utilization, energy, or end\-to\-end project time\. The corrected Qwen and Mistral CPU audits took 755 and 130 seconds; the retained failed Qwen audit took 583 seconds, and selection statistics took one second\. These four CPU\-job durations sum to 1,469 seconds, not CPU\-core time\.

A broader historical ledger covers 72 saved jobs, including those six\. Adding the two successful engineering pilots and the two v3 selection jobs gives six model jobs totaling 25,759 A100\-allocation seconds \(7\.16 hours\)\. The 32 E5 tasks, each encoding and then replaying its shard, sum to 479,503 task\-elapsed seconds \(133\.20 hours\)\. Each requested two CPUs, giving 266\.39 requested\-CPU hours when multiplied by elapsed time; this is not measured CPU utilization or verified billed core time\. The remaining 34 stages sum to 8,396 job\-elapsed seconds and include preparation, acquisition, audits and a hardware probe\. Four failed jobs remain in the ledger\. Parent jobs and array tasks are each counted once; batch steps and raw/display aliases are not added again\. Concurrent task times overlap, so these sums are not project wall\-clock duration\. Earlier setup, transfers and failed annotation attempts outside the saved subset, local work, queue waits and energy remain unaccounted\. A complete project compute budget remains unavailable\.

The subsequent structural diagnostic is separate from that historical ledger\. Its 51 graph constructions, alternate\-tiling replays and checks took 248\.513 seconds in the child process, with a reported peak resident set of 260,792,320 bytes\. It requested two CPUs, used one numeric thread, and allocated no GPU\. These measurements reuse the existing feature cache; they are neither full\-pipeline cost nor a comparative efficiency result\.

The separate repair diagnostic completed in 1,193\.413 seconds, with 281,616,384 bytes of process peak RSS, reusing the existing embedding cache\. It requested two CPUs and no GPU, with one numerical thread\. These figures cover this diagnostic and its checks; they are not a comparative service benchmark or the cost of the complete pipeline\.

Literature coverage is also bounded\. Primary publication pages and official code were refreshed for the citations used here\. The full ARCANE selection description and the central, ticketed, and bounded\-deletion contracts in\\citepticketed,space were checked against their primary PDFs\. This is a contract comparison, not an independent audit of those proofs\. The full six\-page counterfactual\-auditing manuscript\\citepcounterfactual was inspected, including its sufficiency framework, Theorem 8 and proof, validation scope, and limitations\. Its approximation comparison above uses the joint answer\-tuple event required by that proof; the previously inspected implementation remains separately cited\\citepcounterfactualcode\. Dominici’s thesis\\citepdominici remains unavailable in full text\. The author and laboratory pages establish its pipeline\-unlearning scope, but do not establish its operator\-level guarantees or experimental results\. That comparison remains incomplete; absence of the text does not establish absence of a corresponding result\.

#### AI assistance\.

AI tools assisted manuscript drafting, code and figure preparation, source checking, and internal review\. Those internal checks are not external peer review, formal verification, or authentication of private observations\. The two annotation models and their distinct empirical role are specified in Section[6\.4](https://arxiv.org/html/2610.33426#S6.SS4)\. No AI system is listed as an author\.

## Appendix FPreserved downstream design: not executed

Neither calibration failure was retuned away\. The failed selection blocks the full leakage guard, post\-guard panels, threshold\-qualified development runs, and dependent held\-out evaluation\. The prepared guard package was not launched\. The original 21,332 prospective jobs are a design inventory, not executed evidence\. The original 100,000\- and 200,000\-row panels are infeasible on this preparation; unavailable cells remain unfilled and are not supplemented from held\-out data\. The original evaluation reservation and unmet human\-validation requirements remain unchanged\.

The full development guard is conditional on passed fresh model validation\. It compares every reserved training row against all original calibration and test rows, removing training leakage using the locked threshold and the original scorer\. This uses features and IDs, not later evaluation labels\. The intended scope is10,314×42,063=433,837,78210\{,\}314\\times 42\{,\}063=433\{,\}837\{,\}782pairs\. The 18,929 evaluation\-test labels stay uninspected during development\. Development utility may use only the 2,138 reserved test rows\.

The planned requests include uniform record deletion, uniform genuine source withdrawal, deletion among initially excluded records, and a label\-blind graph search for high\-amplification stress requests\. Uniform record controls match source requests by removed\-record volume\. Stress search does not estimate ordinary user behavior and is not an optimal adversarial audit\. Request streams, feasible panels, and resource bounds must be sealed before their effect outcomes; the historical registry is not authorization to mark every planned family as executed\.

O\-G recomputes the fixed curator and learner from surviving input; O\-T uses correct selected IDs but rebuilds moments\. P\-I uses indexed coefficient repair, P\-S scans coefficients, and P\-R uses rank\-coordinate summaries with its reconstruction work charged\. The essential B\-E baseline retains compact eligible feature/label rows, blocker incidences, and buckets, then makes batched signed moment updates\. It is not forced to store an outer product for every row\. B\-A retains all payloads\. B\-F deletes from the initial selected set and is a target\-mismatch diagnostic, not a correctness oracle\. The smallest natural pilot must compare at least P\-I, O\-G, and optimized B\-E under identical requests\.

Primary task quality is native multilabel mean squared error, with micro/macro F1 and mean average precision secondary\. Report selected\-set admissions, parameter and prediction deviations from the fresh oracle, and the quality difference of the frozen\-selection target\. A large admission count alone does not establish useful model change\. Costs include feature/cache access, graph/index state, moments, gathered rows, peak workspace, serialization, initialization, updates, and solves\. Incremental timing and complete lifecycle timing are separate\. A speedup over fresh graph reconstruction alone is insufficient evidence of an advantage over a strong incremental baseline\.

## Appendix GLimitations and broader impact

The theory assumes restriction consistency, fixed features, and a fixed cumulative budget\. It does not cover arbitrary reclustering, encoder refitting, overlapping ownership, or nonconvex language\-model fine\-tuning\. The pinned E5 model card lists Stack Exchange among its pretraining sources; overlap with the present corpus is unknown\. Our target holds that encoder fixed and does not remove influence from encoder pretraining\. The conditional retained\-state bound fixes the deleted setFF\. An adaptive request policy can reveal private information through the requests themselves\. The finite\-family lower bound measures private information and exact rational heads\. It neither proves total\-byte optimality nor shows that natural text embeddings contain the constructed private sign patterns\. A floating solver needs an actual error certificate before an exact\-head lower bound transfers to its releases \(Appendix[D](https://arxiv.org/html/2610.33426#A4)\)\.

The LLM\-only study can establish properties of its model\-defined labels\. Shared training data and correlated biases can make both judges wrong; agreement is not human validation\. Invalid responses remain part of the criterion, and order sensitivity is reported separately\. Existing native tags are dataset labels, not newly obtained human annotations\. No human pair review was used, and no human\-ground\-truth claim is available\. This annotation boundary is separate from the authors’ responsibility for the paper and its conclusions\.

The study uses an existing public forum export and recruits no new participants\. Native account identifiers are contributor proxies\. Export filters and unknown ownership limit the scope of source withdrawal\. Source text may contain personal information, so bodies and account\-level manifests stay private\. Redistribution and attribution requirements must be resolved before any raw\-data release\. Canonical state equality does not imply physical erasure, privacy of prior answers, or compliance with every possible deletion obligation\. A useful application is making deletion\-service contracts explicit\. A corresponding risk is retaining excluded personal data in the name of future repair or mistaking model agreement for permission to remove legitimate content\. Data minimization, access controls, and a clearly limited deletion horizon remain necessary operational safeguards\.

The natural\-text effect study was not executed\. Accordingly, this paper makes no claim of natural semantic value or competitive efficiency\. Both failed calibrations and the earlier unfavorable memory comparison remain part of the evidence\. The theoretical results identify an exact target and its information requirements; they do not validate a deployment\.

## Appendix HDetailed comparison of information contracts

Learning\-unlearning space complexity\\citepspace gives budget\-dependent upper and lower bounds for realizability testing in Theorems 5\.4 and 6\.3 of the full version\. Appendix G connects that task to empirical risk minimization\. Ticketed schemes\\citepticketed separate central auxiliary information from tickets provided with forgotten records\. Their main Definitions 1–2 and Remark 3 specify exact predictor recovery after one request; the threshold construction in Appendix B\.1 supports multiple requests\. Our private\-information accounting includes all such usable side information\.

For binary histories of lengtht≥3t\\geq 3, Theorem 8\(i–ii\) of\\citetcounterfactual requirest\+1t\+1states for all count\-threshold predictions and2t2^\{t\}states for all single\-bit\-flip threshold queries\. The exact reconstruction argument and released implementation\\citepcounterfactualcode concern query\-sufficient history summaries\. Theorem 8\(iii\)’s counting proof requires at least\(1−δ\)​2t\(1\-\\delta\)2^\{t\}states when the entire answer tuple is correct with probability at least1−δ1\-\\deltaunder uniform histories\. This is a joint success event, not a separate marginal success guarantee for each query\. Our approximate criterion bounds expected squared ridge\-head error for each fixed input and designated deletion probe\. These numerical bounds have different error contracts and are not interchangeable\.

## Appendix ICalibration protocol and prepared task

### I\.1Population, sources, and reserved task configuration

The 140,250 prepared questions split into 98,187 training, 20,996 calibration, and 21,067 test rows\. The source grouping contains 88,344 units, including 1,522 unknown units\. Missing and community owners are explicit unknown singletons\. Source completeness concerns retained records after the fixed export and filters, not every historical or private contribution\. Acquisition is checksummed and the export provenance is recorded\. Bodies and account\-level records remain private\.

A deterministic one\-tenth whole\-source reservation allocated 10,314 training and 2,138 test rows to development\. Evaluation retains 87,873 training and 18,929 test rows; calibration is unchanged\. Every reserved source stays outside later evaluation, even when a pilot uses only part of the allocation\. Planned development targets of 1,000, 2,500, and 5,000 training rows include the entire boundary source and use frozen priority after the guard\. These are upper bounds before leakage filtering\. The executed 1,001\-row diagnostic uses the original pre\-guard prefix, as stated in Section[6\.1](https://arxiv.org/html/2610.33426#S6.SS1)\.

The prepared prediction task uses 20 native tags and retains all\-zero target vectors\. Five source\-grouped calibration folds selectedλ=10−5\\lambda=10^\{\-5\}from10−6,10−5,…,10−110^\{\-6\},10^\{\-5\},\\ldots,10^\{\-1\}, with largerλ\\lambdaon exact ties\. Out\-of\-fold predictions fix one F1 threshold per tag, choosing the stricter threshold on ties and a never\-positive rule when no calibration positive exists\. Test labels and deletion outcomes are not used for configuration\. Different representations need separate task settings\. These preparatory choices are not a completed downstream deletion experiment\.

### I\.2Inference, sampling, and validation rules

The models run offline on admitted A100 GPUs with BF16, batch size one, greedy constrained decoding, forced Flash attention, a 512\-token output budget, and a 32,768\-token total budget\. Truncation, summarization, format repairs, semantic retries, and fallback attention are disallowed\. Pair texts are untrusted inputs; judges have no tools or retrieval\. The supplement supplies the exact instructions, schemas, renderer, and constrained\-inference kernels\. No independence between the two raters is assumed\.

Version 4 includes same\-source pairs in its calibration\-pair population\. Its 13 right\-closed score strata use cuts\.50,\.90,\.91,…,\.99,\.995\.50,\.90,\.91,\\ldots,\.99,\.995\. Each nonempty stratum contributes a simple random sample without replacement of up to 30 pairs\. The 360 canonical pairs support the weighted selection calculation; the 36 swapped pairs are diagnostics and supply no extra votes\.

A selected cutoff would proceed to a fresh simple random sample of up to 200 pairs from all above\-threshold calibration pairs\. Its exact one\-sided 95% finite\-population lower bound must reach\.90\.90\. Any change in a model’s availability/status or valid category on canonical overlap between selection and validation makes validation unavailable\. This bound concerns the fixed/potential model\-label function under the sampling model\. There is no retuning after failure and no fresh\-validation result for either completed selection version\.

### I\.3Response and sensitivity diagnostics

Version 3 attempted all 198 model calls\. One canonical Mistral output was invalid JSON and remained in the denominator without retry\. All 51 cuts were recomputed independently\. Version 4 completed 396 calls per model\. Qwen returned 391 valid outputs and five invalid JSON outputs; Mistral returned 396 valid outputs\.

The version 4 stratified sample contains 27 joint positives among 360 canonical pairs\. This unweighted ratio is not a population prevalence estimate\. Qwen marks 32 pairs positive and Mistral 151\. Their six\-way categories differ on 308 of the 355 pairs with two valid outputs\. Swapping pair order changes status or category in three Qwen and 14 Mistral cases; the binary\-positive decisions change in one and six cases, respectively\. These characterize the raters, not accuracy against human judgments\.

The frozen favorable\-imputation sensitivity treats invalid or uncertain judgments as potentially positive while preserving substantive negatives\. At cuts\.90,\.95,\.98,\.99,\.995\.90,\.95,\.98,\.99,\.995, the weighted values are respectively1\.72%,5\.64%,10\.08%,44\.68%,53\.33%1\.72\\%,5\.64\\%,10\.08\\%,44\.68\\%,53\.33\\%\. The maximum over all cuts is8/158/15, still below the selection requirement\. These are sensitivity values, not confidence limits\. The all\-cut ledger preserves exact rational arithmetic and the original negative decisions\.