New Method for Erasing Data from AI Memory

Scientists at the University of California, Riverside (UC Riverside) have developed a new method that enables artificial intelligence (AI) to forget private or copyrighted data without requiring access to the original training data. This approach, presented in July at the International Conference on Machine Learning in Vancouver, Canada, addresses growing concerns about the permanent storage of sensitive information in AI models. According to the study, published on the arXiv server under number 2506.06486, the method ensures that selected data is genuinely erased while the model remains functional for the remaining data.

The Problem with Data in AI

AI models learn from vast amounts of text collected from the internet, causing them to memorize word patterns and sometimes reproduce nearly verbatim copies of training texts. This allows users to bypass payments for copyrighted content. For example, The New York Times is suing OpenAI and Microsoft for using its copyrighted articles to train GPT models. New laws, such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA), require companies to be able to remove such data from models. The UC Riverside team, including doctoral student Ümit Yiğit Başaran, Professor Amit Roy-Chowdhury, and Assistant Professor Başak Güler, designed a solution that works even without the original data, which is often unavailable in practice due to privacy concerns or costs.

How This Unlearning Method Works

The method, called "certified source data-free unlearning," uses a surrogate dataset that statistically mimics the original data. This surrogate dataset is selected based on the concentration of parameters, such as a Dirichlet distribution with parameter ξ, where lower ξ values lead to greater differences between datasets. The model is adjusted by adding carefully calibrated random noise, whose magnitude depends on the statistical distance between the original and surrogate data, measured, for example, using Kullback-Leibler divergence (KL divergence). This noise ensures that the target data cannot be reconstructed while the model maintains comparable accuracy. For example, in experiments on the CIFAR10, StanfordDogs, and Caltech256 datasets, the method achieved test-data accuracy of approximately 76–77% for CIFAR10 at various ξ values, which is close to the results of retraining from scratch.

Experiments on Synthetic and Real-World Data

In synthetic experiments, the team generated a source dataset with 15,000 samples from a 50-dimensional standard Gaussian distribution and a surrogate dataset with off-diagonal covariance elements controlled by the parameter ζ ranging from 0.01 to 0.1. The results showed that the required noise variance increases with increasing KL divergence, but accuracy on the forgotten data remains comparable to other methods, with membership inference attack (MIA) scores of approximately 48–49%. On real-world data such as MNIST and USPS, the method achieved 94.1% training-data accuracy for the transition from MNIST to USPS, with a relearn time (RT) of 13, indicating effective forgetting. Further tests on architectures such as a single-layer linear model (L) or two convolutional layers with a linear layer (2C+L) confirmed that the method maintains MIA scores close to 50%, meaning that membership inference attacks cannot distinguish forgotten data from test data.

Applications of the Method

This innovation, developed in collaboration with Sk Miraj Ahmed of Brookhaven National Laboratory, has potential applications in media, healthcare, and other fields involving sensitive data. The team plans to extend the method to more complex models such as ChatGPT. The code is available on GitHub in the certified-unlearning-surr-data and mixed-privacy-forgetting repositories. According to Başak Güler, people have the right to have their data genuinely erased from AI systems, and this method makes that possible with provable guarantees.