🤖 machine learning

When Unlearning Fails: Reliable Data Deletion under Post-Training in Agent Networks

This paper introduces MUTE, a method for reliable data deletion in self-improving federated agent networks that effectively mitigates the persistent "influence echo" of forgotten data by estimating downstream impact, quarantining high-risk retained trajectories, and auditing behavior to prevent influence regeneration while preserving task utility.

Original authors: Zihao Ding, Jun Huang, Liang Dong

Published 2026-08-03

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Zihao Ding, Jun Huang, Liang Dong

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a swarm of tiny, helpful robots learning to do chores together. Instead of one giant brain in the cloud, each robot learns from its own experiences and shares what it's learned with the others. This is called Federated Learning. It's like a group of friends studying for a test: they each read different books, write down their own notes, and then swap summaries to get smarter, without ever having to show their messy, private notebooks to the teacher.

Now, imagine these robots are "self-improving." They don't just stop learning after the test; they keep working, collecting new stories about what worked and what didn't, and feeding those stories back into the group to get even better. This is the Self-Improving Network. But here's the tricky part: what if one of the friends says, "Hey, I want to be forgotten! Please delete all my notes and make sure I never influenced the group's final answer"? In a normal classroom, you'd just rip out the pages. But in this robot swarm, the friend's old notes might have already changed how the other robots collected their new notes. If you just delete the friend's notes but keep the new notes that were inspired by them, the "ghost" of that friend might still be haunting the group's brain. This paper explores how to truly erase that ghost without breaking the whole system.

The Problem: The "Echo" That Won't Die

The researchers found a sneaky problem with deleting data in these smart robot networks. Usually, when someone asks to be forgotten, the system tries to "unlearn" by retraining the model without that person's data. The authors call this the "retraining" approach.

But in a self-improving network, this simple fix fails. Here's why: The robot's behavior is like a ripple in a pond. When a specific robot (let's call it "Rover") acts in a certain way, it changes what the other robots see and learn next. If Rover is deleted after it has already influenced the group, the other robots might have already collected new data based on Rover's old actions.

The paper calls this the "Influence Echo." Even if you delete Rover's original data, the "echo" of Rover's behavior lives on in the new data collected by the other robots. If you just retrain the model on the remaining data, the model accidentally learns from Rover's echo anyway. The forgotten behavior comes back to life, like a zombie that won't stay dead. The authors showed through simulations that the more the other robots learned from Rover before the deletion, the stronger this echo becomes, and the more likely the "zombie" behavior is to return.

The Solution: MUTE (Muting Unlearned Trajectories' Echoes)

To fix this, the team proposed a new method called MUTE. Think of MUTE not as a simple eraser, but as a detective, a quarantiner, and a security guard all rolled into one.

1. The Detective (Tracing the Echo):
First, MUTE needs to know where the echo is hiding. Since the robots can't send all their private data to a central server (that would break privacy), the server keeps a lightweight "ledger"—a simple logbook of which robot was running which version of the brain at what time. When a deletion request comes in, the server replays this logbook to calculate an "Influence Score" for every piece of data the other robots collected. It's like asking, "How much did this new note depend on Rover's old notes?" If a new note was heavily influenced by Rover, it gets a high score.

2. The Quarantine (Muting the Echo):
Once the high-scoring data is identified, MUTE doesn't just delete it (which might hurt the robots' ability to do their jobs). Instead, it uses a two-pronged attack:

Model Cleaning: The robot that originally owned the data updates its own "adapter" (a small, efficient part of its brain) to specifically forget the unwanted behavior, using a technique called Negative Preference Optimization. This is like telling the robot, "Don't do that specific move anymore."
Data Quarantine: The other robots look at their own data. If they have notes with a high "Influence Score" (meaning they were heavily shaped by the deleted robot), MUTE puts those notes in quarantine. They aren't deleted, but they are ignored during future training. Some are even given a lower weight, like telling the teacher, "Read this note, but don't let it count as much as the others."

3. The Security Guard (Auditing and Scheduling):
The job isn't done after one cleanup. The network keeps learning, so the echo might try to sneak back in. MUTE acts as a security guard, constantly auditing the system. It checks if the "zombie" behavior is returning (measured by something called the Influence Regeneration Rate). If the guard sees the behavior creeping back, it schedules more cleanup actions, but it does so carefully to stay within a "communication budget"—making sure the robots don't get overwhelmed by too much data traffic.

What They Found

The team tested MUTE using a benchmark called LIBERO, which involves robots learning to manipulate objects based on language instructions. They used two different robot "brains" (MiniVLA and $\pi_0$ ) and tested three levels of deletion: removing a single path (trajectory), removing one whole robot's data (client), or removing an entire type of task (task).

The results were promising. In their simulations and on a physical testbed using Jetson computers (which are like powerful mini-computers for robots), MUTE successfully kept the "zombie" behavior from returning.

Low Leakage: The system's ability to "remember" the deleted data dropped to near-random levels (a score close to 0.5), meaning the data was effectively forgotten.
No Regeneration: Unlike the simple retraining method, where the forgotten behavior came back, MUTE kept the Influence Regeneration Rate (IRR) very low. For example, in one test with the MiniVLA brain, the regeneration rate was only 0.085 with MUTE, compared to 0.178 with the standard retraining method.
Efficiency: MUTE was much cheaper in terms of communication. While the standard retraining method required uploading huge amounts of data (around 234.6 units of traffic for MiniVLA), MUTE only needed about 53.39 units. It achieved this by only sending small, targeted updates rather than retraining the whole system from scratch.

The paper suggests that while simple retraining fails in these self-improving networks, MUTE offers a reliable way to truly delete data. It proves that you can remove the "echo" of forgotten data without breaking the network's ability to learn new things, all while using far less bandwidth than trying to start over. The authors note that this is a simulation and physical testbed result, showing that the method works in practice, but it remains a specialized solution for these specific types of self-improving robot networks.

Technical Summary: When Unlearning Fails: Reliable Data Deletion under Post-Training in Agent Networks

1. Problem Statement

The paper addresses a critical gap in Federated Unlearning (FU) within self-improving federated agent networks. Unlike traditional federated learning, where the training dataset is static, self-improving networks operate in a closed loop: agents deploy a current policy, interact with the environment to collect new verified trajectories, and feed these trajectories back into subsequent training rounds.

The core problem is the "influence echo." When a data owner requests the deletion of specific data (the forget set, $D_f$ ), standard unlearning methods update the model to remove the direct influence of $D_f$ . However, in a self-improving loop, the policy shaped by $D_f$ prior to deletion has already influenced the collection of future data (the retain set, $D_r$ ). Consequently:

Retraining Failure: Retraining on the retained data $D_r$ does not eliminate the forgotten behavior because $D_r$ itself contains causal traces of $D_f$ .
Regeneration: As the network continues to operate and learn from $D_r$ , the forgotten behavior regains visibility (measured by a rising Influence Regeneration Rate, IRR).
Traceability: This influence is not always separable in feature space but can be traced through server-side records of model deployment and data collection.

Existing FU methods assume a fixed retain set and fail to account for policy-driven data collection, leading to a situation where deletion is a one-time repair rather than a sustained defense.

2. Methodology: MUTE

The authors propose MUTE (Muting Unlearned Trajectories' Echoes), a framework designed to sustain deletion validity while the network continues to learn. MUTE operates through three integrated modules:

A. Influence Provenance (Tracing)

Instead of requiring raw data from clients (which violates privacy), the server maintains a lightweight ledger ( $L$ ) recording deployed model versions, aggregation weights, and collection windows.

Mechanism: Upon a deletion request, the server replays the ledger to estimate how influence propagated from $D_f$ through the aggregation edge (local updates to global models) and the collection edge (global models shaping future data collection).
Scoring: Each retained trajectory is assigned an influence score $\gamma(x)$ based on the version of the model under which it was collected. This allows the system to identify "high-influence" retained data without moving raw trajectories off the client.

B. Influence-Aware Erasure

MUTE performs a dual-sided erasure to remove both current residues and future risks:

Model-Side Erasure: The client holding $D_f$ updates its adapter using a Forget-Retain objective. This employs Negative Preference Optimization (NPO) to suppress behavior on $D_f$ while preserving utility on $D_r$ . To prevent re-learning, subsequent updates are projected away from the dominant forget-gradient subspace.
Data-Side Containment: Clients grade their local trajectories by influence score.
- Quarantine: High-influence trajectories ( $\gamma(x) \ge \tau_q$ ) are removed from the training stream.
- Down-weighting: Medium-influence trajectories are down-weighted.
- Replacement: Clients may re-collect replacement trajectories under the erased model if resources permit.

C. Behavioral Audit and Scheduling

Since deletion must be sustained, MUTE includes a scheduling mechanism to manage resources under an uplink budget.

Auditing: The system monitors the Behavioral Leakage Index (BLI) (current leakage via membership inference) and IRR (future regeneration).
Scheduling: The server decides client actions (normal training, unlearning, containment, or auditing) to ensure the closed-loop transition matrix satisfies a stability condition ( $\rho(M_\infty) < 1$ ), guaranteeing that influence decays over time rather than regenerating.

3. Key Contributions

Problem Formulation: The paper formally defines reliable deletion for self-improving federated networks, highlighting that the retain set is causally downstream of the forget set, making standard retraining insufficient.
Empirical Observations: Through preliminary experiments, the authors demonstrate that:
- Retraining fails to silence the influence echo; forgotten behavior revives as the network operates.
- The regeneration rate scales linearly with the fraction of retained data shaped by the forget policy.
- Influence is traceable via server-side records even when feature-space separation fails.
MUTE Framework: The proposal of a unified method combining influence provenance, dual-sided erasure (model and data), and resource-constrained scheduling.
Validation: Extensive evaluation on the LIBERO benchmark using two Vision-Language-Action (VLA) backbones (MiniVLA and $\pi_0$ ) and a physical Jetson-based edge testbed.

4. Experimental Results

The evaluation compares MUTE against a baseline Retrain approach (full retraining on retained data) across three deletion granularities: trajectory, client, and task.

Influence Regeneration (IRR): MUTE significantly suppresses IRR compared to Retrain. For example, in the MiniVLA backbone, Retrain showed IRR values around 0.178–0.338, while MUTE reduced these to 0.085–0.248 (depending on granularity).
Behavioral Leakage (BLI): MUTE keeps BLI close to the chance level (0.5), indicating successful removal of membership signals, whereas Retrain often resulted in higher leakage.
Task Utility (SR): MUTE maintains task success rates (SR) within a narrow margin (e.g., within 0.04) of the pre-request baseline, demonstrating that deletion does not severely degrade performance.
Communication Cost: MUTE is highly efficient. It reduces uplink traffic by approximately 75–80% compared to full retraining. For instance, on MiniVLA, communication dropped from ~234.6 MB (Retrain) to ~54 MB (MUTE).
Physical Testbed: Validation on Jetson hardware confirmed that MUTE's trends in latency, bandwidth, and behavioral recurrence hold in real-world edge environments.

5. Significance and Claims

The paper claims that reliable data deletion in operating networks cannot be a one-time event but must be a standing defense.

Limitation of Current Methods: The authors assert that existing FU methods are insufficient for self-improving systems because they ignore the feedback loop where policies shape future data.
Necessity of MUTE: MUTE is presented as a necessary evolution that combines provenance tracing (to find the echo), containment (to stop the echo from spreading), and scheduling (to sustain the defense).
Modest Scope: The paper does not claim to solve all privacy issues in AI but specifically targets the "influence echo" in self-improving federated agent networks. It emphasizes that while perfect counterfactual deletion (recreating a world where $D_f$ never existed) is impossible in a live network, MUTE drives leakage to chance levels and prevents regeneration within resource constraints.

The work concludes that without mechanisms like MUTE, the "right to be forgotten" in self-improving networks is effectively unenforceable, as the network's own learning loop will inevitably resurrect the deleted data's influence.