🤖 machine learning

Subtract or Replay? Exact Deletion from Language-Model Memory

This paper demonstrates that exact deletion from language model memory is fundamentally determined by the memory representation, where addressable records can be removed via algebraic subtraction while entangled writes require a replay-based rebuild to achieve bit-for-bit state restoration.

Original authors: Vishwajith Ramesh

Published 2026-07-31

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Vishwajith Ramesh

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a super-smart digital assistant that never forgets a thing. You tell it a secret, and it stores that secret in a giant, invisible library inside its brain. Later, you might ask it to write a story or give advice, and it pulls that secret out to help. But what if you change your mind? What if you tell the assistant, "Actually, I never said that," or "That was a mistake, please erase it"? In the real world, if you burn a letter, the words are gone. But in a computer, simply telling it to "forget" is tricky. The computer might just hide the secret deep down, or it might have already used that secret to build other parts of its brain, making it impossible to just "delete" without breaking everything else. This is the problem of "machine unlearning." Scientists are trying to figure out how to make AI truly forget specific things on command, not just pretend to. It's a huge deal for privacy, like having a "Right to be Forgotten" for your digital life, ensuring that if you ask a robot to delete a memory, it actually does, leaving no ghostly traces behind.

This paper, titled "Subtract or Replay?", tackles this problem by asking a simple question: How is the memory stored? The authors, Vishwajith Ramesh and colleagues, discovered that the answer depends entirely on the "furniture" inside the AI's memory room. They found that there are two very different ways to delete a memory, and you have to pick the right tool for the job, or you'll fail.

The Two Ways to Delete a Memory

The paper tests this idea on two different types of AI models, which act like two different kinds of libraries.

1. The "Addressable" Library (The Gemma Model)
Imagine a library where every book has a specific, unique shelf number. If you want to remove a book, you just go to that shelf and take it off. You don't need to rebuild the whole library.
The authors tested this on a model called Gemma. They replaced some of its standard memory parts with a special system that acts like this addressable library. In this system, every piece of information has a "coefficient" (think of it as a volume knob) that controls how much it influences the AI's answers.

The Magic Trick: To delete a memory, they simply turned the volume knob down to zero. This is called an "algebraic decrement."
The Result: It worked perfectly. When they turned the knob down, the AI's output became mathematically identical to what it would have been if the memory had never been there in the first place. The difference was so tiny it was almost zero (a number called KL divergence of 5.4 × 10⁻¹⁵).
The Catch: This only works well on smaller models (1 billion parameters). As the model gets bigger (4 billion and 12 billion), this method gets messy and expensive, slowing down the AI's performance by 11.2% and 44.3% respectively. So, while the "turn the knob" trick is perfect for small libraries, it's not a one-size-fits-all solution for giant ones.

2. The "Woven" Library (The Kimi Model)
Now, imagine a different library where the books aren't on shelves. Instead, the pages of every book are woven together into a giant, single tapestry. If you pull out one thread (a memory), the whole tapestry shifts, and the pattern changes in unpredictable ways.
The authors tested this on a model called Kimi, which uses a "recurrent state" (a tapestry-like memory). Here, every new piece of information changes the entire state of the memory.

The Problem: They tried to just "subtract" the memory like they did with Gemma. It failed. Because the memory is woven, removing one thread doesn't just leave a hole; it leaves a distorted pattern. The math showed that 12% to 49% of the memory's influence changed depending on what came after the deleted part. You can't just subtract it; the "receipt" for the deletion is no longer valid.
The Solution: Since you can't subtract a thread from a woven tapestry without ruining the pattern, you have to rebuild it. The authors used a "checkpoint and replay" method. They saved a snapshot of the tapestry before the unwanted thread was woven in. Then, they rewound the AI to that snapshot and replayed everything that happened after the bad memory, but this time, they skipped the bad thread.
The Result: This worked perfectly. The AI's memory after the replay was bit-for-bit identical to a memory that never saw the bad thread at all. They tested this on real clinical notes up to 18,842 tokens long, and it worked every time. It also allowed them to "amend" a record perfectly by swapping the bad thread for a good one before replaying.

What This Means for You

The paper's main conclusion is that "exact deletion" isn't a single magic button. It's a property of how the memory is built.

If the memory keeps a clear address for every record (like Gemma's special setup), you can subtract it quickly and perfectly.
If the memory weaves everything together (like Kimi's tapestry), you cannot subtract it. You must rebuild the story from a saved checkpoint, skipping the bad part.

The authors are very clear about what they didn't find: they proved that simply trying to "mask" or "suppress" a memory (telling the AI to ignore it) isn't enough. The AI can still "remember" it in hidden ways, and attackers can often pull it back out. True deletion requires either a perfect subtraction or a perfect rebuild.

In short, if you want an AI to truly forget, you first have to check its memory room. Is it a library with shelves? Turn the knob. Is it a woven tapestry? Rewind and replay. There is no shortcut, but now we know exactly which tool to use for which job.

Technical Summary: Exact Deletion from Language-Model Memory

1. Problem Definition

The paper addresses the challenge of exact deletion from the persistent memory of deployed autoregressive language models (LLMs). Unlike weight-space unlearning, which attempts to modify model parameters to "forget" data, this work focuses on in-context memory: records that have already been ingested into the model's persistent state (attention caches or recurrent states) and are shaping downstream outputs.

The core problem is that appending a correction to a prompt does not remove the influence of the original, erroneous record from the model's internal state. The authors define exact deletion via a counterfactual standard: the model's output after deletion must match the output of a memory state built as if the record had never been ingested.
$f(q; D_j(B(R))) = f(q; B(R \setminus j))$
The paper argues that whether this equality is attainable without full retraining depends entirely on the memory representation. If a record's influence retains a specific "address" (a reversible coefficient or cache entry), it can be subtracted. If the record's influence is woven into a shared recurrent state by later writes, subtraction fails, and rebuilding is required.

2. Methodology

The authors operationalize this distinction by testing two distinct memory architectures and deletion strategies:

A. Addressable Memory: Support-Vector Graft (Gemma 3)

For models where influence is addressable, the authors propose an algebraic decrement.

Architecture: They replace the global-attention layers of Gemma 3 (1B, 4B, and 12B parameters) with a Support-Vector Memory (SVM) layer. This layer treats context keys as inputs to a one-class SVM, where the attention weights are coefficients ( $\alpha$ ) of the fit.
Mechanism: Using the incremental algorithm of Cauwenberghs & Poggio (2000) in reverse, the system can mathematically "decrement" a specific token's coefficient. If a token is a "reserve" token (coefficient = 0), it contributes nothing. Deleting a token involves reversing the solve to return the system to the state it would hold without that token.
Recovery: To maintain language quality after grafting, the authors freeze the base model and train Rank-8 LoRA adapters (0.149% of parameters) to recover perplexity.
Audit: Deletion is audited by comparing the decremented state against a retained-key refit (re-solving the SVM with the token removed but keeping other keys fixed).

B. Non-Addressable Memory: Replay (Kimi Linear Hybrid)

For models where later writes transform a record's contribution (making it non-addressable), the authors propose checkpointed rewind-and-replay.

Architecture: They analyze a 48B Kimi Linear hybrid model, which interleaves global Multi-Head Attention (MLA) layers with 20 KDA (Gated DeltaNet) recurrent layers.
Failure of Subtraction: The authors demonstrate that the KDA delta rule (which reads the state before updating it) destroys record-wise separability. A record's contribution to the state depends on the suffix that follows it (12–49% variance), meaning a fixed "receipt" for deletion cannot work even with decay corrections.
Mechanism: The system saves checkpoints of the recurrent state at record boundaries. To delete a record, the system restores the state before the record was ingested and replays only the suffix.
Audit: The result is audited against a bitwise equality standard: the logits and all recurrent states must be identical to a run where the record was never ingested.

3. Key Contributions

Representation-Level Criterion: The paper establishes that exact deletion is a property of memory representation. It distinguishes between addressable influence (subtractable via algebraic decrement) and transformed influence (requiring state reconstruction).
Addressable Deletion in LLMs: The authors successfully graft an SVM memory layer into Gemma 3. At the 1B scale, the algebraic decrement matches the retained-key refit with a median KL divergence of $5.4 \times 10^{-15}$ . Behavioral tests show the masked-refit proxy is statistically indistinguishable from a "never-ingested" baseline under elicitation, relearning, and LiRA attacks.
Exact Deletion via Replay: For the Kimi hybrid, where subtraction fails, the authors demonstrate that checkpointed replay achieves bitwise exactness (on logits and all 20 recurrent states) for contexts up to 18,842 tokens. This method also supports exact amendments (replaying with a corrected record).
Scaling Analysis: The paper provides a nuanced view of utility costs. While the 1B Gemma graft incurs only a +2.0% perplexity overhead, this cost grows to 11.2% at 4B and 44.3% at 12B, indicating the graft is not a general replacement for attention at larger scales.

4. Results

Gemma 3 (1B):
- Exactness: Decrement and refit agree to median KL $5.4 \times 10^{-15}$ over 31 support-token deletions.
- Utility: +2.0% perplexity overhead compared to a matched control.
- Behavior: Masked refit is indistinguishable from the never-ingested floor; weight-space editing (gradient ascent) is reversible and leaves residues.
Gemma 3 (Scaling):
- At 4B and 12B, the utility cost rises sharply (11.2% and 44.3% respectively). The 12B rank-16 grafted run diverges, suggesting the method is currently viable primarily at the 1B scale.
Kimi Linear (48B):
- Delta Rule Failure: 12–49% of a record's state contribution changes with the suffix, invalidating fixed receipts.
- Replay Success: Replay achieves bitwise equality with the never-ingested state for real clinical records (MIMIC-IV) up to 18,842 tokens.
- Cost: Latency is proportional only to the suffix length (mean 3.49s vs. 6.77s for full rebuild), with storage costs of ~41.4 MiB per checkpoint boundary.

5. Significance and Claims

The paper claims that exact deletion is a contract with memory representation, not a universal algorithmic fix.

Design Principle: If a representation preserves an address for a record's influence, deletion can be a cheap algebraic operation. If the representation weaves records into a shared state via non-additive updates (like the delta rule), exact deletion requires rebuilding the suffix.
Auditability: The work provides a framework to audit deletion. It distinguishes between "suppression" (where the answer is hidden but the state is corrupted) and "exact deletion" (where the state matches the counterfactual reference).
Limitations: The authors are modest about the scope. They do not claim to delete from pretrained weights or outputs generated before the deletion event. They acknowledge that the utility cost of the Gemma graft scales poorly, and the Kimi replay method relies on deterministic implementations and checkpointing overhead.
Ethical Context: The work supports regulatory requirements (e.g., GDPR Article 17) and clinical consent withdrawal by providing a mechanism to verify that a specific record has been removed from the model's active memory state, rather than just suppressing its output.

The paper concludes that the field should move from "approximate unlearning" (which leaves recoverable residues) to representation-aware deletion, testing whether influence remains addressable before choosing between subtraction and rebuilding.