Machine Unlearning, Derived-Data Correction, and the Right to Change

Full report

On this page

Introduction to the Privacy and Algorithmic Imperative

The intersection of global privacy legislation and machine learning architecture has generated a fundamental friction between algorithmic permanence and individual data rights. Modern artificial intelligence systems are predicated on the continuous ingestion and vast memorization of data to optimize complex, non-convex mathematical representations. Historically, once data entered the training pipeline, its influence was permanently woven into the resulting models. However, the convergence of robust data protection frameworks—such as the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA) in the United States, and India’s Digital Personal Data Protection (DPDP) Act—mandates that individuals possess the legal prerogative to demand the correction or total erasure of their personal information1. Executing a successful correction or deletion request in the era of artificial intelligence involves significantly more than executing a simple query in a relational database. When a data subject invokes their rights, the residual influence of their data persists across distributed file systems, immutable event logs, stateful streaming aggregators, centralized feature stores, geometric embedding vectors, and most critically, the parameter weights of deep neural networks3. Retaining this statistical influence can yield biased, discriminatory, or unlawful algorithmic outcomes long after the original source records have been expunged, thereby violating the core normative goals of privacy law regarding data minimization and purpose limitation3. Adding to this complexity is the jurisprudential distinction between factual data and algorithmic predictions. Under emerging frameworks like the Colorado AI Act (Senate Bill 26-189), which governs the use of automated decision-making technology (ADMT), the right to correction extends to the factually incorrect source data fed into a system, but it explicitly does not extend to the opinions, predictions, scores, or protected evaluations generated by the ADMT5. Algorithmic predictions are probabilistic inferences, making them epistemologically difficult to classify as strictly accurate or inaccurate at the time they are generated6. Nevertheless, the mandate to remove the influence of revoked or deleted source data from the underlying mathematical model remains an absolute compliance necessity3. Consequently, the discipline of "machine unlearning" has rapidly transitioned from theoretical computer science to a mandatory infrastructure requirement3. Machine unlearning shifts the paradigm from simple "data deletion" to "influence deletion," demanding that systems verifiably remove the contribution of specified samples from a trained model without necessitating a computationally prohibitive retraining of the model from scratch1. This exhaustive report traces the lifecycle of information through the modern AI ecosystem following a deletion or correction request, categorizes the mechanisms utilized to eradicate versus merely conceal data, and provides a nuanced comparative analysis of system architectures under the pressure of dynamic unlearning requirements.

Eradication versus Concealment: A Lexicon of Information Modification

Distinguishing between methods that merely conceal data from the user interface and those that mathematically eradicate its influence from the system is paramount for both regulatory compliance and threat modeling. Privacy frameworks require interventions that prevent residual patterns, correlations, or representational artifacts from continuing to shape a model's outputs or enabling the reidentification of affected individuals4.

The Taxonomy of Deletion and Suppression

The landscape of algorithmic data removal relies on a highly specific lexicon of techniques, each operating at a different layer of the technology stack and providing varying degrees of true unlearning.

Concealment techniques operate at the retrieval or inference layer, leaving the underlying data structure, mathematical geometry, and model weights perfectly intact. While techniques like output-layer blocking and tombstoning provide rapid, computationally inexpensive responses to deletion requests, they are legally insufficient under stringent frameworks like the GDPR4. True compliance requires eradication mechanisms—such as exact retraining, representation misdirection, or cryptographic shredding—which ensure the information can no longer influence system behavior or be reconstructed by adversarial attacks.

Tracing Information Through the AI Pipeline

When a data subject successfully exercises their right to change or erase data, the execution must propagate through a deep, multi-tiered data supply chain. Tracing and neutralizing information across these distinct architectural layers requires a multifaceted and highly orchestrated engineering approach.

1. Source Databases, Caches, Backups, and Analytics Warehouses

The primary tier of data ingestion involves transactional databases, data lakes, and event logs. In legacy relational databases, executing a physical deletion is trivial. However, modern architectures fundamentally rely on distributed, append-only event streaming platforms like Apache Kafka. In an append-only log, physical deletion directly contradicts the system's core design19. When a user invokes their right to be forgotten, their historical data persists indelibly across topic partitions, localized replicas, consumer state stores, and disconnected offline backups19. Relying on log compaction to eventually remove older records with the same key offers no guarantees regarding timing and fails to cleanse downstream analytics warehouses or legacy backups19. To address this friction across immutable logs and data warehouses, organizations increasingly employ crypto-shredding (or cryptographic erasure). Instead of attempting to physically locate and delete every distributed byte of the user's data, the architecture dictates that personal data is encrypted at the point of ingestion using a unique Data Encryption Key (DEK) bound exclusively to that specific user20. The encrypted ciphertexts are then propagated through Kafka, Amazon S3, and data warehouses like BigQuery20. When a right-to-erasure request is validated, the organization deliberately destroys the specific DEK in the central Key Management Service (KMS)20. Once the key is tombstoned, all downstream copies of the data instantly become cryptographically unreadable19. From a privacy perspective, the data is immediately eradicated; it is reduced to meaningless noise, indistinguishable from random bytes, satisfying compliance mandates without requiring the surgical and dangerous modification of immutable distributed ledgers19.

2. Feature Stores and Calculated Attributes

Feature stores, such as Feast, Tecton, and Hopsworks, bridge the operational gap between raw data lakes and model inference by providing centralized repositories for curated machine learning features24. Modern feature stores leverage zero-copy data sharing patterns to serve features directly from streaming platforms, minimizing the physical duplication of data while enabling domain-oriented decentralized data ownership24. However, calculated attributes—especially those reliant on stateful streaming aggregations—pose severe unlearning and correction challenges. Streaming frameworks like Apache Spark Structured Streaming or Apache Flink maintain continuous internal state to calculate complex metrics over time, such as tumbling windows, sliding windows, and grouped aggregations26. Operators such as flatMapGroupsWithState require the system to store previous micro-batch data in internal memory to continuously update the running state28. If a user demands the correction or deletion of a historical transaction, the system must do more than simply filter future events. The streaming engine must explicitly recalculate and update the running arbitrary state to mathematically subtract the user's past influence27. If the state store is not algorithmically designed for selective decrementing or retroactive window adjustments, the entire streaming state must be flushed and fully recomputed from a historically sanitized snapshot, inducing significant latency and computational cost27.

3. Embeddings and Vector Databases

Retrieval-Augmented Generation (RAG) systems heavily rely on vector databases (e.g., Pinecone, Milvus, Weaviate) to route queries toward relevant context10. These databases utilize advanced indexing algorithms, predominantly the Hierarchical Navigable Small World (HNSW) graph, to enable rapid approximate nearest neighbor (ANN) search10. HNSW constructs a multi-layered, sparse proximity graph; upper layers contain sparse, long-range connections for rapid greedy traversal, while lower layers provide dense connections for precision10. Handling incremental deletions in layered graph indexes is mathematically hostile11. The default practice in vector databases is tombstoning, where a vector node is simply flagged as inactive10. During retrieval, the algorithm still traverses the tombstoned node to navigate the graph but filters it from the final result set10. This is a suppression mechanism, not unlearning. The deleted vector fundamentally continues to influence the geometric routing of queries, degrading overall search speed, memory efficiency, and recall quality as the proportion of tombstones increases11. Executing a "hard delete" to permanently eradicate data from a sparse graph index requires physically removing the node and severing its multi-layer edges. Because HNSW relies on strict connectivity logic, bulk-deleting nodes can completely sever a subset of surviving nodes from the main graph component33. This dynamic, known as the "unreachable points phenomenon," orphans valid records; the records physically exist in the database but can never be returned by a vector search at any search effort level, permanently crippling the system's recall33. To fully eradicate deleted data and restore geometric structural integrity, vector databases typically require monolithic reindexing—a computationally punishing process that drops the old index and rebuilds the hierarchical graph from scratch, forcing a total embedding regeneration10.

4. Recommendation and Personalization Profiles

Recommender systems and personalization engines rely heavily on collaborative filtering, matrix factorization, and deep learning models to embed users and items into dense latent spaces based on historical interactions. When a user exercises their right to change and deletes their profile, the immediate technical step involves dropping their specific user-embedding vector from the active database. However, the item embeddings they previously interacted with retain fractional gradient biases reflecting that specific user's historical preferences. While the direct privacy risk to the deleted individual is relatively low due to the aggregation of thousands of users into a single item embedding, strict interpretations of regulatory compliance dictate that the user's influence still resides within the matrix. To completely satisfy the right to erasure, organizations must engage in approximate unlearning protocols, incrementally untangling the user's specific gradient contributions from the global item matrices without executing a full, economically ruinous matrix factorization rebuild.

5. Agent Memories and Information Backflow

As Large Language Models evolve into autonomous agents, they acquire persistent episodic memory capabilities, allowing them to read, write, and retrieve context across extended multi-turn sessions36. When a user deletes sensitive data from an agentic system, engineers intuitively purge the external vector store or explicit memory modules. However, agentic unlearning introduces a unique, closed-loop recontamination risk definitively identified as "information backflow" or "parameter-memory backflow"36. Even after explicit memory artifacts are surgically purged, residual knowledge of the deleted information often persists latently within the LLM's parametric weights36. During subsequent interactions, the agent may naturally hallucinate or reconstruct the forgotten information based on its parametric residue, write that newly generated information back into its context window, and ultimately re-encode it into the persistent memory store36. Therefore, standard memory pruning is fundamentally distinct from true unlearning37. To definitively delete data from an agent, systems must execute a synchronized dual-update protocol. Frameworks such as Synchronized Backflow Unlearning (SBU) logically invalidate the memory dependencies via dependency-aware pruning while simultaneously deploying stochastic reference alignment to suppress the parametric priors in the LLM weights36. This synchronized approach breaks the recontamination loop, preventing cross-pathway recontamination and providing robust, verifiable agentic unlearning36.

6. Fine-Tuned Models and Foundation-Model Weights

When data is baked directly into the parameter weights of deep neural networks during training or fine-tuning, standard deletion paradigms fail entirely. Removing a record from the initial training corpus post-hoc does not alter the already converged model1. Retraining massive foundation models from scratch to accommodate daily or weekly deletion requests is computationally and economically infeasible due to scale1. Consequently, advanced machine unlearning algorithms must be applied to mathematically modify the weight matrices, excising the targeted information while strictly preserving the model's performance on the retained dataset14. The efficacy and risks of these weight-editing methodologies represent the most active frontier in AI privacy engineering. Several prominent paradigms exist:

• Model Editing: Algorithms like Rank-One Model Editing (ROME) and Mass-Editing Memory in a Transformer (MEMIT) utilize causal mediation analysis to locate where specific facts are stored within MLP layers14. However, these methods are primarily designed for behavioral modification (e.g., updating a fact) rather than true unlearning14. Studies demonstrate that information "deleted" via ROME remains highly accessible in hidden states and can be trivially extracted via rephrased queries, meaning the influence is merely concealed, not eradicated14.
• Influence-Guided Machine Unlearning and Fisher Masking: Standard approximate unlearning methods often rely on evaluating a "retain set" to maintain model utility while applying gradient ascent to the forget set38. However, retaining access to the full dataset is often impractical due to storage scale or privacy limits38. Influence-guided Machine Unlearning (IMU) utilizes mathematical influence functions to explicitly quantify how each specific data point affected the model's objective during training. By circumventing full-model Hessian inversion through classifier-level approximations, IMU targets only the parameters most responsible for the forgotten data, aggressively applying gradient updates there while minimizing perturbations to the broader network38. Similarly, Fisher masking techniques freeze critical benign parameters based on their Fisher Information Matrix values before unlearning, drastically reducing the catastrophic forgetting of general model capabilities17.
• Representation Misdirection Unlearning (RMU) & Negative Preference Optimization (NPO): RMU projects the intermediate-layer activations of the forget-set data into a fixed random orthogonal direction39. This intentionally disrupts and disentangles the internal features so the model loses the semantic mapping of the concept, fundamentally altering the internal manifold so the model loses the capacity to generate the forbidden knowledge39. NPO operates similarly by treating the forget data as negative examples and training the model to actively deviate from its original behavior on that data41.

The Coreset Effect in LLM Unlearning: Recent empirical research into RMU and NPO has uncovered a massive structural data redundancy in LLM unlearning benchmarks, formally termed the "Coreset Effect"41. Analysts have discovered that unlearning outcomes achieved with a full, massive forget dataset can be identically replicated using a tiny subset—often as little as 1% to 5% of that dataset (a "coreset")41. This phenomenon is driven by high-impact keywords; targeting a highly representative fraction of the semantic space is entirely sufficient to collapse the model's internal representation of a forbidden concept42. This discovery drastically reduces the computational resources required to enforce compliance, proving that reliable unlearning is far cheaper than previously assumed by the privacy community41.

7. Vendors, Data Brokers, and Downstream Recipients

Enterprise architectures rarely operate in a vacuum; they deploy multi-vendor decision pipelines where data flows from internal lakes through third-party feature stores, into external data broker ecosystems, and downstream to hosted LLM APIs (e.g., OpenAI, Anthropic)24. When a data subject invokes their right to erasure, a cascading delete operation must trigger across the entire supply chain. The legal and technical allocation of fault relies heavily on robust data mesh architectures5. Under laws like the Colorado AI Act, fault is allocated between developers and deployers based on their relative control and responsibility5. From a technical standpoint, this requires propagating cryptographic tombstones to downstream vendors, triggering API-driven unlearning requests to third-party model developers (who must then apply SISA or approximate unlearning to their specific instances), and mandating rigorous audit logging of the deletion execution timestamp across all external boundaries5.

System-Type Comparison: Architectural Responses to Deletion

The technical reality of data removal varies drastically depending on the foundational paradigm of the AI system deployed. The table below outlines how different architectures respond to data correction and deletion requests, contrasting their unlearning modalities and the associated computational friction.

Verification and Mechanistic Interpretability

As the technical mechanisms of unlearning mature, the regulatory focus is shifting toward verifiable compliance. Regulators and data subjects will no longer accept promises of "suppression" as equivalent to "deletion." Enterprises are increasingly required to provide cryptographic or mathematical proofs that a specific user's data can no longer impact algorithmic weights3. However, verifying true unlearning in deep neural networks is complicated by the black-box nature of the models. Traditional evaluations rely on monitoring the model's output via multiple-choice questions or loss divergence, which can inadvertently mask issues of "over-forgetting" (catastrophic loss of general utility) or "under-forgetting" (leaving extractable traces)47. To definitively prove that eradication has occurred, the industry is pivoting toward Mechanistic Interpretability as an audit tool. Techniques such as Sparse Autoencoders (SAEs) and Sparse Crosscoders (SCCs) are deployed to extract interpretable features from dense model activations39. SCCs enable read/write access across multiple layers, allowing auditors to perform "model diffing"—identifying exact changes in internal representations across fine-tuning variants40. By identifying and isolating the exact neural pathways responsible for representing a user's data or specific forbidden concepts, auditors can explicitly verify whether unlearning techniques like gradient ascent successfully dissolved the feature at a structural level, or merely temporarily suppressed its activation40. Similarly, Explainability-Driven Verifiers for GNN unlearning snapshot the model before and after deletion, utilizing metrics like residual attribution, heatmap shift, and graph edit distance49. These tools provide transparent, human-readable evidence that structural connections have been broken, supplementing traditional membership-inference signals49.

Conclusion

The evolution of global privacy legislation has forced a profound architectural reckoning within the field of artificial intelligence. The right to change, correct, and erase data is fundamentally at odds with the mathematical permanence of converged model weights, immutable event logs, and stateful streaming architectures. As this analysis exhaustively details, executing a simple deletion request in a source database is merely the superficial genesis of compliance. Truly honoring data rights requires a rigorous, orchestrated traversal of the entire AI supply chain—invalidating event logs via rapid crypto-shredding, forcing complex state recomputation in feature stores, executing monolithic rebuilds of corrupted HNSW vector graphs, and applying advanced gradient mathematics to surgically scrub the parametric memories of foundation models. The distinction between concealment modalities (such as output-layer blocking and vector tombstoning) and true eradication modalities (such as SISA, Representation Misdirection Unlearning, and Fisher Masking) serves as the definitive line between regulatory compliance and severe legal liability. Furthermore, as autonomous agents with episodic memory and multi-vendor decision pipelines become ubiquitous, the risk of cross-pathway recontamination and information backflow will only intensify. Organizations must abandon the outdated paradigm of simple data deletion in favor of provable influence deletion. By integrating cryptographic shredding at ingestion, leveraging the Coreset Effect for efficient LLM unlearning, and utilizing Sparse Crosscoders for mechanistic verification, enterprises can successfully insulate themselves from regulatory penalization and define the next standard of privacy-preserving, accountable artificial intelligence.

Works cited

1. Machine Unlearning: A Comprehensive Survey \- arXiv, https://arxiv.org/html/2405.07406v2

2. The Limitations of Privacy Rights \- Notre Dame Law Review, https://ndlawreview.org/the-limitations-of-privacy-rights/

3. Machine Unlearning for Enterprise AI: From Right-to-Be-Forgotten to Provable Forgetting | by RAKTIM SINGH | Medium, https://medium.com/@raktims2210/machine-unlearning-for-enterprise-ai-from-right-to-be-forgotten-to-provable-forgetting-2d5aadf41919

4. Forget Me Not? Machine Unlearning's Implications for Privacy Law, https://digitalcommons.law.uw.edu/cgi/viewcontent.cgi?article=2162\&context=faculty-articles

5. Colorado Repeals and Replaces AI Act, Nick Palmieri \- Our Take, https://ourtake.bakerbotts.com/post/102msga/colorado-repeals-and-replaces-ai-act

6. ARTIFICIAL INTELLIGENCE AND PRIVACY Daniel J. Solove\* Abstract This Article aims to establish a foundational understanding of th, https://www.floridalawreview.com/article/129976-artificial-intelligence-and-privacy.pdf

7. \[2306.03558\] Machine Unlearning: A Survey \- arXiv, https://arxiv.org/abs/2306.03558

8. \[2209.02299\] A Survey of Machine Unlearning \- arXiv, https://arxiv.org/abs/2209.02299

9. A Survey of Machine Unlearning \- arXiv, https://arxiv.org/pdf/2209.02299

10. Great Algorithms Are Not Enough \- Pinecone, https://www.pinecone.io/blog/hnsw-not-enough/

11. How do you handle incremental updates in a vector database? \- Milvus, https://milvus.io/ai-quick-reference/how-do-you-handle-incremental-updates-in-a-vector-database

12. Vector search overview \- Amazon MemoryDB, https://docs.aws.amazon.com/memorydb/latest/devguide/vector-search-overview.html

13. hnsw-recall-distribution-drift / PostgreSQL Extension Network, https://pgxn.org/dist/pg\_trickle/0.36.0/blog/hnsw-recall-distribution-drift.html

14. Investigating Model Editing for Unlearning in Large Language Models \- arXiv, https://arxiv.org/pdf/2512.20794

15. Graph Attributed Unlearning via Propagation Suppression and Knowledge Dissipation, https://www.mdpi.com/2227-7390/14/15/2678

16. SISA Training for Efficient Machine Unlearning \- Emergent Mind, https://www.emergentmind.com/topics/sisa-training

17. Unlearning with Fisher Masking \- OpenReview, https://openreview.net/forum?id=UifByHdLmmf

18. README.md \- IAAR-Shanghai/Awesome-AI-Memory \- GitHub, https://github.com/IAAR-Shanghai/Awesome-AI-Memory/blob/main/README.md

19. Crypto Shredding for Kafka: GDPR-Compliant Data Deletion \- Conduktor, https://www.conduktor.io/glossary/crypto-shredding-for-kafka

20. How to Set Up Crypto-Shredding for GDPR Right-to-Erasure Compliance \- OneUptime, https://oneuptime.com/blog/post/2026-02-17-how-to-set-up-crypto-shredding-for-gdpr-right-to-erasure-compliance-in-google-cloud/view

21. Implementing Right to Erasure with CSFLE \- Database Manual v8.0 \- MongoDB Docs, https://www.mongodb.com/docs/v8.0/core/csfle/tutorials/right-to-erasure/

22. Crypto-shredding \- Wikipedia, https://en.wikipedia.org/wiki/Crypto-shredding

23. Data destruction using crypto-shredding \- Seald, https://www.seald.io/blog/data-destruction-using-crypto-shredding

24. Zero-Copy Data Sharing: Eliminating Duplication in Modern Architectures \- Conduktor, https://www.conduktor.io/glossary/zero-copy-data-sharing

25. Feature Stores Compared: Feast vs Tecton vs Hopsworks for Production ML \- Pipecode.ai, https://pipecode.ai/blogs/feature-stores-feast-tecton-hopsworks-production-ml

26. window Function · The Internals of Spark Structured Streaming \- Jacek Laskowski (@jaceklaskowski), https://jaceklaskowski.gitbooks.io/spark-structured-streaming/content/spark-sql-streaming-window.html

27. Spark Structured Streaming \- Event processing with Window operation in stateful stream processing \- Stack Overflow, https://stackoverflow.com/questions/58444825/spark-structured-streaming-event-processing-with-window-operation-in-stateful

28. Accessing the current sliding window in foreachBatch in Spark Structured Streaming, https://stackoverflow.com/questions/72138799/accessing-the-current-sliding-window-in-foreachbatch-in-spark-structured-streami

29. Spark Structured Streaming Overview | PDF | Apache Spark | Data \- Scribd, https://www.scribd.com/document/408193906/spark-structured-streaming-pdf

30. Eliminate Optional Vector Instances \- Azure AI Search \- Microsoft Learn, https://learn.microsoft.com/en-us/azure/search/vector-search-how-to-storage-options

31. Vector Database Challenges: What Breaks in Production \- Redis, https://redis.io/blog/common-challenges-working-with-vector-databases/

32. Effects of filtered HNSW searches on Recall and Latency | by Etienne Dilocker \- Medium, https://medium.com/data-science/effects-of-filtered-hnsw-searches-on-recall-and-latency-434becf8041c

33. HNSW: bulk delete can sever surviving nodes into a disconnected component (unreachable at any ef) · Issue \#1712 · HarperFast/harper \- GitHub, https://github.com/HarperFast/harper/issues/1712

34. Enhancing HNSW Index for Real-Time Updates: Addressing Unreachable Points and Performance Degradation \- arXiv, https://arxiv.org/html/2407.07871v1

35. CREATE INDEX EXTERNALLY: Offloading pgvector Indexing from Postgres | Lantern Blog, https://lantern.dev/blog/pgvector-external-indexing

36. When LLM Agent Meets Machine Unlearning \- arXiv, https://arxiv.org/html/2602.17692v1

37. Unlearning in AI Agents: A Philosophical Deep Dive | by Volodymyr Pavlyshyn, https://ai.plainenglish.io/unlearning-in-ai-agents-a-philosophical-deep-dive-f6694c8b841d

38. IMU: Influence-guided Machine Unlearning \- arXiv, https://arxiv.org/html/2508.01620v3

39. Mr. Snuffleupagus at SemEval-2025 Task 4: Unlearning Factual Knowledge from LLMs Using Adaptive RMU \- ACL Anthology, https://aclanthology.org/2025.semeval-1.213.pdf

40. Misinformation Representation and Feature Shifts from Machine Unlearning in Large Language Models (LLMs) \- kyushu, https://catalog.lib.kyushu-u.ac.jp/opac\_download\_md/7395735/2025\_p1709.pdf

41. LLM Unlearning Reveals a Stronger-Than-Expected Coreset Effect in Current Benchmarks, https://www.alphaxiv.org/overview/2504.10185v2

42. LLM Unlearning Reveals a Stronger-Than-Expected Coreset Effect in Current Benchmarks, https://openreview.net/forum?id=NMIqKUdDkw¬eId=HGWvhAapPj

43. Graph Unlearning via Embedding Reconstruction – A Range-Null Space Decomposition Approach \- arXiv, https://arxiv.org/html/2508.02044v1

44. GNNDELETE:AGENERAL STRATEGY FOR UNLEARNING IN GRAPH NEURAL NETWORKS \- OpenReview, https://openreview.net/pdf?id=X9yCkmT5Qrl

45. Certified Edge Unlearning for Graph Neural Networks \- Yue Ning, https://yue-ning.github.io/docs/kdd23-ceu.pdf

46. Fast Yet Effective Graph Unlearning through Influence Analysis \- OpenReview, https://openreview.net/forum?id=er\_nz4Q9Km7

47. Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning \- NIPS, https://papers.neurips.cc/paper\_files/paper/2025/file/02443e4e008231e0af0855f3cc70ed17-Paper-Conference.pdf

48. \[2506.16548\] Mr. Snuffleupagus at SemEval-2025 Task 4: Unlearning Factual Knowledge from LLMs Using Adaptive RMU \- arXiv, https://arxiv.org/abs/2506.16548

49. \[2512.07450\] Forget and Explain: Transparent Verification of GNN Unlearning \- arXiv, https://arxiv.org/abs/2512.07450