Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy and Research

🎯 Pitch

Even after 'unlearning' copyrighted training data, generative models still produce infringing outputs, exposing a fundamental flaw: removing data from parameters cannot prevent its regeneration. This paper reveals that unlearning conflates two incompatible goals—parameter removal and output suppression—and argues that without aligning technical methods to specific legal standards, it will routinely fail as a compliance tool.

1. Executive Summary

This paper analyzes the fundamental conceptual mismatches between machine unlearning methods and their aspirational policy goals for generative AI, focusing on copyright, privacy, and safety domains. It distinguishes sharply between two divergent technical goals—targeted removal of training data influence from model parameters (e.g., retraining without specific personal data) and targeted suppression of content from model outputs (e.g., output filters)—and shows through five intertwined mismatches why neither approach can serve as a general-purpose solution for legal compliance. The paper establishes that removal of training data cannot guarantee output suppression—as demonstrated by a Creative Commons–trained model still generating “Mickey Mouse”–like images (Figure 1)—and that suppression methods cannot account for the unbounded downstream contexts in which dual-use outputs might be deployed, establishing that unlearning alone cannot constrain generative-AI behavior except when the specific legal regime, technical target, and evaluation criteria are precisely aligned.

2. Context and Motivation

The Core Problem: Machine Unlearning Has Outgrown Its Conceptual Foundations

This paper addresses a fundamental disconnect: machine unlearning has become a catch-all term that collapses two fundamentally different technical goals into one label, creating confusion about what unlearning methods can actually achieve for law and policy. The authors argue that this confusion is not merely terminological—it has real consequences for how researchers design methods, how policymakers evaluate compliance, and how judges assess remedies.

The disconnect operates on multiple levels simultaneously. At the most concrete level, there is slippage between whether a given unlearning method targets information in a model's parameters (what the model "knows" from training) or information in a model's outputs (what the model produces when used). At a more abstract level, there is slippage between what the ML research community calls "unlearning" and what legal and policy communities think unlearning means—namely, a surgical, complete, and reliable way to make a model forget something forever.

This gap matters because unlearning has been proposed as a solution for problems spanning radically different legal domains, each with their own standards of evidence, definitions of harm, and requirements for compliance. A method that might be acceptable for one privacy statute could be completely inadequate for copyright infringement, and a technique that works for safety applications might fail for data deletion requests—not because the method is "bad," but because the underlying goals are different in ways that technical methods alone cannot reconcile.

Why This Problem Is Important: The Stakes Are Both Technical and Legal

The importance of this problem stems from the convergence of several trends that the paper documents in its extensive reference list and in Appendix A (Figure 2):

Explosive growth in unlearning research. The authors scrape arXiv and find that as of December 4, 2024, there were 810 papers matching "unlearn*" or "model forgetting," with 428 posted in 2024 alone—more than in all prior years combined. This growth has been fueled by the emergence of generative AI (the authors mark key model releases on Figure 2: GPT-2, DALL-E, Stable Diffusion, ChatGPT), which dramatically expanded the scope of what people wanted unlearning to do. The paper notes that only 20 of 810 papers predate 2016, the year GDPR was adopted, and 106 papers (13.1%) explicitly mention "GDPR," "the right to be forgotten," or "RTBF" in their abstracts—confirming that legal motivations are a primary driver of unlearning research.

High-stakes policy domains where unlearning has been invoked. The paper identifies three areas where researchers, organizations, and policymakers have suggested unlearning could help resolve key issues:

Privacy: Article 17 of GDPR provides the "right to erasure" (right to be forgotten), and a common interpretation in ML research is that this applies not just to stored training data but to trained models themselves. This raises practical questions: can you remove one individual's data from a model trained on millions? Unlearning has been proposed as the answer.
Copyright: With generative-AI models trained on enormous corpora that include copyrighted material, unlearning has been suggested as a remedy—retrain without infringing works, or suppress substantially similar outputs. This has direct relevance to ongoing litigation where remedies like model destruction or algorithmic disgorgement are being debated (the paper cites Cooper et al., 2025; Samuelson, 2024).
Safety: Concerns about "dual-use" capabilities—models that can help design bioweapons, synthesize toxic molecules, or enable cyberattacks—have led to proposals that unlearning could remove "dangerous knowledge" from models. The paper cites the International Scientific Report on the Safety of Advanced AI (Bengio et al., 2024), which explicitly claims that "Machine unlearning can help to remove certain undesirable capabilities." Similarly, the now-rescinded U.S. Executive Order on AI Safety flagged dual-use risks as requiring mitigation.

The paper emphasizes that these are not hypothetical concerns. Real regulatory frameworks exist with real compliance deadlines and penalties. The CCPA requires responses to deletion requests within 45 business days. Copyright law imposes statutory damages, impoundment of infringing artifacts, and even criminal sanctions for willful infringement. The E.U. AI Act recitals discuss CBRN risks. Researchers and companies are actively building unlearning methods to address these obligations, and the methods they build may or may not actually satisfy the legal requirements they are intended to meet.

Where Prior Approaches Fall Short: The Expansion from Supervised to Generative AI Exposed Deep Tensions

The paper traces the genealogy of machine unlearning to understand how the current confusion arose.

Original motivation: deletion requests in supervised ML. The earliest unlearning work (Cauwenberghs and Poggio, 2001, on SVMs; subsequent work by Ginart et al., 2019; Bourtoule et al., 2021; and others) addressed a specific problem: how to remove the influence of a particular training example from a trained classifier without retraining from scratch. This was motivated by GDPR's "right to be forgotten"—if an individual demands their data be deleted, must you retrain the entire model? The unlearning literature developed two families of solutions:

Structural removal ("exact unlearning"): custom training procedures that partition data so that retraining can be limited to only the affected partition, guaranteeing that the removed data never influenced the final model parameters. The paper notes these methods "retain the exact same guarantees of the 'gold standard'" with respect to removing the effect of targeted training data.
Approximate removal ("inexact unlearning"): methods that modify trained model parameters to be "similar" (by some mathematical definition, often with probabilistic guarantees) to what retraining from scratch would have produced.

The paper is careful to note that even the "exact" label can be misleading: these methods guarantee removal of the specific training examples that were targeted, but say nothing about latent information or outputs. The authors deliberately "avoid the term 'exact unlearning' because it can be reasonably misunderstood to mean that such methods are able to 'exactly' or 'perfectly' unlearn anything." This is an early signal of the mismatch theme that pervades the paper.

The generative-AI shift broke the old framework. The paper identifies two critical ways that moving from supervised to generative AI changed the unlearning landscape:

The output space expanded dramatically. In supervised ML, the set of possible outputs is bounded and typically fixed (e.g., {cat, dog}). After applying an unlearning method, a model's output for a given input might flip from cat to dog, but the output vocabulary itself hasn't changed. In generative AI, the output space is "significantly more expansive"—models can produce novel text, images, or code that never appeared in training data. This means that controlling what a model might generate became a goal that was distinct from, and more ambitious than, controlling what training data influenced the model.
Goals for unlearning expanded accordingly. The paper notes that "translating prior unlearning methods from supervised settings to generative AI exhibits some important technical challenges," and in response, the research community broadened the definition of unlearning to include both removal (Section 3.1) and suppression (Section 3.2). The loose definition the paper uses is deliberately inclusive: unlearning aims to develop methods for "(1) the targeted removal of the effect of training data from the trained model and (2) the targeted suppression of content in a generative-AI model's outputs." But as the paper immediately emphasizes: "these are two very different goals."

The problem with treating removal and suppression interchangeably. The paper argues that collapsing removal and suppression under one umbrella creates confusion because they require different technical methods, target different types of information, and have different legal implications. Consider a GDPR deletion request: someone wants their personal data removed from the model. Is it sufficient to suppress that data from appearing in outputs (suppression), or must the data literally be removed from the training dataset and the model retrained (removal)? The GDPR text does not specify, but the paper suggests that output suppression alone would likely not suffice if the legislation calls for explicit removal of training data (Mismatch 1 in Section 4).

Conversely, for safety concerns about dangerous molecules, the goal is usually output suppression—preventing the model from generating harmful recipes—not necessarily removing all chemistry training data (which would be overbroad and destroy useful capabilities). But removal methods ('gold standard' retraining) cannot guarantee that the model won't generate something similar to what was removed (Mismatch 2), because latent information from other training data can reconstruct it.

The field lacks a framework for making these distinctions. The paper's central critique is that, despite the proliferation of unlearning papers (428 in 2024 alone), the research community has not systematically addressed the conceptual mismatches between unlearning goals and methods. Individual papers may evaluate their techniques on specific benchmarks (e.g., WMDP for safety, TOFU for fictitious unlearning), but these evaluations typically measure whether certain outputs are suppressed—not whether the method satisfies the substantive requirements of a particular legal regime. As the authors put it in Section 4, introducing the five mismatches:

"Output suppression is not a replacement for removal of training data (Mismatch 1). Conversely, removal of training data does not guarantee meaningful output suppression (Mismatch 2). More generally, models are not equivalent to their outputs (Mismatch 3) or to how their outputs are put to use (Mismatch 4). And last, because targeted removal and suppression are challenging to implement, unlearning can have unintended consequences (Mismatch 5)."

How This Paper Positions Itself: A Cross-Disciplinary Diagnostic, Not a Methodological Contribution

This is not a paper that proposes a new unlearning algorithm, evaluates state-of-the-art methods, or provides a taxonomy of techniques. The authors explicitly disclaim this in a footnote (Section 3):

"We deliberately do not provide an in-depth survey or taxonomy of state-of-the-art techniques that are branded as machine unlearning methods. Several groups of authors have already done so from different perspectives. ... Instead, our purpose here is to provide sufficient framing to elicit important conceptual gaps and limitations—fundamental mismatches between unlearning motivations, targets, and methods."

The paper positions itself as a diagnostic tool for a cross-disciplinary audience. The author list spans ML researchers, legal scholars, policy experts, civil society organizations, and ethics researchers—reflecting the paper's goal of producing "a standalone document: one with the necessary (and sometimes elementary) background information to make our contributions legible to our diverse intended audience, and at the appropriate level of abstraction to encourage effective cross-disciplinary communication about machine unlearning."

The framework the paper builds serves three audiences simultaneously:

For ML researchers: The mismatches in Section 4 provide a checklist for being precise about what a proposed unlearning method actually does (removal? suppression? both?), what it guarantees (certainty? probability? best effort?), and what legal claims can legitimately be made about it. The paper explicitly warns against oversimplifying legal regimes when motivating unlearning research.
For policymakers and judges: The domain-specific analyses in Section 5 (copyright, privacy, safety) provide concrete illustrations of why unlearning is not a universal compliance tool. The paper offers a framework for asking, in any given legal context, whether removal or suppression is the right goal, what "reasonable best efforts" should look like, and what outcomes should be expected.
For the broader AI governance community: The paper connects unlearning to a deeper principle that the authors call the "Fallacy of the Almost-General-Purpose Computer" (Section 6, citing Ed Felten): just as a PC can be used for both fraud and musical composition, a generative-AI system has inherent dual-use properties that no single technical intervention can eliminate. This is not a failure of unlearning specifically—it is a property of all general-purpose generative technologies that policymakers must internalize.

The paper's relationship to prior work is deliberately synthetic rather than competitive. It cites prior unlearning surveys (Liu et al., 2024; Qu et al., 2023; Si et al., 2023) as having covered the technical landscape, and instead builds on domain-specific analyses from Cooper and Grimmelmann (2024) on copyright and memorization, Lee et al. (2023) on the generative-AI supply chain, Brown et al. (2022) on privacy definitions for language models, and Shumailov et al. (2024) on "ununlearning"—the phenomenon that unlearned knowledge can be reintroduced through in-context prompting. The paper's contribution is to synthesize these insights into a unified framework of five mismatches and then apply that framework systematically across three policy domains.

A key methodological choice: Appendix C defines three information targets that are essential for understanding the paper's arguments. These are not part of the main text but provide the conceptual vocabulary:

Observed information (Definition 1): "Data that are explicitly presented to the model during training." This is what removal methods target. Examples include specific training examples, phone numbers in text, or images in a dataset.
Latent information (Definition 2): "Data that are not explicitly presented to the model during training, but that can be derived or otherwise elicited from a trained model based on the patterns that the model has learned during training." This includes simple deductions (from "Susan lives in Philadelphia" and "Carlos is going to Susan's party," you can infer Carlos will be in Philadelphia) as well as more complex patterns.
Higher-order concepts (Definition 3): "Combinations of latent and observed information that manifest in the model as complex and coherent abstractions, knowledge, capabilities, or skills." Examples include "Spiderman," "Cubism," "mathematical reasoning," and "toxicity."

The paper is careful to note that these categories are not cleanly separable—"there is, loosely speaking, a spectrum of complexity for latent information." But the distinctions matter because removal methods target observed information, suppression methods target latent information and higher-order concepts, and the slippage between these targets is the source of many mismatches.

The paper's tone is cautionary but not dismissive. It does not argue that unlearning is useless or that researchers should stop working on it. Rather, it argues for precision: unlearning methods "may offer limited benefits that support certain outcomes for law and policy" (Section 1), but "ML researchers should not claim—and policymakers should not misunderstand—that machine unlearning alone is generally effective for making generative-AI models and their outputs compliant with any desired policy goals" (Section 6). The contribution is a framework for making these distinctions rigorously, not a rejection of unlearning as a research area.

3. Technical Approach

3.1 Reader Orientation

This is a conceptual analysis paper—not a paper that builds a system or proposes a new algorithm. The "system" being analyzed is the collection of technical methods that fall under the umbrella term "machine unlearning" for generative AI, along with the policy and legal frameworks that these methods are claimed to serve. The paper solves the problem of framework confusion—the systematic conflation of removal and suppression goals, methods, and evaluation criteria—by constructing a diagnostic vocabulary (three information targets in Appendix C, five fundamental mismatches in Section 4) and then stress-testing that vocabulary against three real-world policy domains (copyright, privacy, safety in Section 5). The "shape" of the solution is not a new algorithm but a decision-making lens: given a specific legal requirement and a specific unlearning method, the reader can identify which information target the method actually addresses, which mismatch is most relevant, and whether the method's guarantees align with the law's requirements.

3.2 Big-Picture Architecture (Diagram in Words)

The paper's analytical framework has four major components, organized as a pipeline from motivation to recommendation:

Information Target Taxonomy (Appendix C): A three-level classification of what kinds of information an unlearning method might target—observed information (explicitly in training data), latent information (derivable from learned patterns), and higher-order concepts (complex combinations manifesting as capabilities). This taxonomy provides the vocabulary for diagnosing mismatches.
Technical Method Classification (Section 3): A two-category decomposition of existing unlearning approaches—removal methods (Section 3.1) that operate on observed information before or during training, and suppression methods (Section 3.2) that operate on model outputs during inference. Each category is further subdivided by mechanism (structural removal vs. approximate removal; model modification vs. system-level intervention).
Mismatch Framework (Section 4): Five fundamental problems that arise when mapping the technical methods onto the asserted policy goals. These mismatches are the analytical engine: Mismatch 1 (suppression ≠ removal), Mismatch 2 (removal ≠ suppression), Mismatch 3 (model ≠ outputs), Mismatch 4 (model ≠ downstream use), and Mismatch 5 (unintended consequences).
Domain-Specific Application (Section 5): The mismatch framework applied to three concrete legal/policy areas—U.S. copyright (the CommunCanvas example in Figure 1), privacy (GDPR deletion requests and inferred data), and safety (dual-use capabilities and the "everything but X" fallacy). Each application reveals domain-specific complications that further demonstrate why unlearning is not a general-purpose compliance tool.

Information flows through these components as follows: a specific policy goal (e.g., "comply with GDPR Article 17," "prevent copyright infringement," "remove dangerous capabilities") enters the framework → the information target relevant to that goal is identified using the Appendix C taxonomy → the technical method being proposed (or already deployed) is classified as removal or suppression using the Section 3 decomposition → the relevant mismatch(es) from Section 4 are identified as the gap between what the method does and what the goal requires → the domain-specific analysis in Section 5 reveals additional complications that arise from the specific legal standards in that domain → the output is a precise diagnosis of why the method does or does not satisfy the goal, and under what conditions it might be "reasonable best effort."

3.3 Roadmap for the Deep Dive

First, the information target taxonomy (Definitions 1–3 in Appendix C), because every subsequent analysis depends on precisely specifying what an unlearning method is trying to target—observed, latent, or higher-order information—and the relationships between these targets.
Second, removal methods (Section 3.1), because they represent the original motivation for unlearning (data deletion requests) and establish the "gold standard" baseline against which all other methods are compared. Understanding their capabilities and limitations—including why structural removal methods don't transfer to generative AI—is essential for diagnosing Mismatches 1 and 2.
Third, suppression methods (Section 3.2), because they represent the expanded scope of unlearning in generative AI (controlling outputs, not just parameters) and introduce the model-modification vs. system-intervention distinction that becomes critical for understanding why suppression cannot substitute for removal (Mismatch 1).
Fourth, the five mismatches (Section 4), because they synthesize the technical analysis into a diagnostic framework. Each mismatch is a specific way that the gap between method capabilities and policy goals manifests, and understanding their logical structure requires the vocabulary established in Sections 3.1 and 3.2.
Fifth, the domain-specific applications (Section 5), because they demonstrate the framework in action. Copyright, privacy, and safety were chosen because they represent three distinct types of legal regimes with different standards of evidence, different definitions of harm, and different requirements for compliance—showing that the same mismatches play out differently depending on the substantive law.
Finally, the paper's recommendations (Section 6) and conclusion (Section 7), which translate the diagnostic framework into actionable guidance for researchers and policymakers.

3.4 Detailed, Sentence-Based Technical Breakdown

This is a conceptual analysis paper whose core idea is that machine unlearning as currently practiced conflates two fundamentally different technical goals—removal of training data influence from model parameters and suppression of content from model outputs—and that this conflation, when combined with the overbroad policy aspirations that unlearning has been asked to serve, produces five specific mismatches that make unlearning unsuitable as a general-purpose compliance mechanism for generative AI.

Information Target Taxonomy (Appendix C)

The paper builds its entire analysis on a three-level taxonomy of what types of information an unlearning method might target, defined in Appendix C. This taxonomy is not presented as a deep ontological claim about how models represent information, but rather as a convenient diagnostic vocabulary that helps distinguish between the concrete things that different unlearning methods can actually affect. The paper explicitly states that these categories "overlap" and exist on "a spectrum of complexity," but insists that distinguishing them is essential for understanding why certain claimed goals for unlearning are incoherent from first principles.

Definition 1 — Observed Information:

"Data that are explicitly presented to the model during training. These data serve as inputs to computations that update the model's parameters."

Observed information is the most concrete target: specific training examples that were literally shown to the model during the training process. The paper gives examples: the text string "Susan's phone number is 555-123-4567" included in a language model's training corpus, or a specific in-copyright image of Spiderman in a diffusion model's training dataset. Observed information also includes subsets of examples (all training data mentioning Susan) and sub-example components (just the phone number 555-123-4567 within the larger example). The key property of observed information is that it can be identified, located, and removed from a training dataset before training occurs—it is, in the paper's words, a target for removal methods (Section 3.1).

Definition 2 — Latent Information:

"Data that are not explicitly presented to the model during training, but that can be derived or otherwise elicited from a trained model based on the patterns that the model has learned during training."

Latent information is what models acquire through generalization—the patterns, relationships, and inferences that are not literally present in any single training example but emerge from the combination of many examples. The paper gives a simple deductive example: given the observed information "Carlos is going to Susan's house for a birthday party this Thursday" and "Susan lives in Philadelphia," a possible piece of latent information is that Carlos will be in Philadelphia on Thursday. Importantly, the paper notes that "there is no guarantee that latent information is factually correct"—the model might infer something false, but it is still latent information that the model "knows" in the sense of being able to produce it. The paper also emphasizes that latent information can be "significantly more complex" than simple deductions, encompassing the sophisticated patterns that give large-scale generative models their power. Latent information is the primary target of suppression methods (Section 3.2), because you cannot directly observe and remove it from training data—it emerges from the training process itself.

Definition 3 — Higher-Order Concepts:

"Combinations of latent and observed information that manifest in the model as complex and coherent abstractions, knowledge, capabilities, or skills."

Higher-order concepts are the most abstract target, corresponding to what the ML literature often calls "knowledge," "capabilities," or "emergent abilities." The paper's examples span both concrete entities ("Spiderman," "Marie Curie," "basketball"), abstract ideas ("justice," "toxicity"), stylistic categories ("Cubism," "artistic style"), and reasoning skills ("mathematical reasoning"). The paper is explicit that Definition 3 is "somewhat arbitrary" because "it is not clear how to distinguish when a piece of latent information is sufficiently complex to be considered a higher-order concept," and that "we do not attempt to draw these lines." The purpose of including higher-order concepts as a target category is to capture claims made in the unlearning literature—particularly in safety contexts—that unlearning can remove entire capabilities (e.g., "how to synthesize a toxic molecule") rather than just specific pieces of observed or latent information. The paper's analysis shows that such claims are particularly problematic because higher-order concepts cannot be cleanly bounded or identified.

Why this taxonomy matters for the paper's argument. The three definitions are deliberately hierarchical in abstraction: observed information is concrete and directly manipulable (you can delete training examples), latent information is emergent and indirectly manipulable (you can only affect it by changing which training data are observed), and higher-order concepts are the most abstract and least well-defined (you cannot cleanly separate "Cubism" from other artistic styles without destroying broad swaths of model capability). The paper argues that confusion about which target a given unlearning method is actually affecting—versus which target a given policy goal requires affecting—is the root cause of most mismatches. For example, a GDPR deletion request targets specific observed information (a particular individual's training examples), but someone might mistakenly evaluate success by whether the model suppresses outputs that resemble that individual—which requires targeting latent information, not observed information. Conversely, a safety concern about bioweapons knowledge targets a higher-order concept (dangerous capability), but an unlearning method that removes specific chemistry papers (observed information) will not eliminate the latent information that could reconstruct that capability from other chemistry knowledge that was not removed.

Removal Methods (Section 3.1)

Removal methods are the original class of unlearning techniques, developed for supervised machine learning settings where the goal was to eliminate the influence of specific training examples on a trained model's parameters. The paper characterizes removal methods by what they target (observed information), what they guarantee (that specific training data did not influence the model), and their fundamental limitation (they do not guarantee anything about outputs or latent information).

The "gold standard" and why it is in quotation marks. The paper introduces the concept with a critical framing that is essential to understanding its later arguments:

"Unlike removing an entry from a database, there is no way to cleanly identify, target, and delete a specific training example from an ML model's parameters. This is because model parameters are not directly or easily interpretable. As a result, 'removal' of information from a generative-AI model deviates from intuitive understandings of the term 'removal.'"

The paper then describes what is conventionally called the "gold standard" for unlearning: retraining a model from scratch on a dataset that has had the problematic examples removed. If a particular web domain, a specific image, or an individual's personal data are excluded from the training process, then those data cannot have affected the model's parameters. This is "gold" in the sense that it provides a causal guarantee about the training data's influence: the removed data literally never entered the computation that produced the model's parameters.

But the paper immediately qualifies this with a crucial observation that motivates Mismatch 2:

"the 'gold standard' only directly targets information that is directly observable in the training data. As a result, it may not be effective for ensuring unwanted information is not latent in the trained model's parameters, nor for preventing unwanted information from manifesting in the model's outputs at generation time."

In other words, even perfect removal of specific training examples (the "gold standard") does not guarantee that the model won't produce outputs that resemble those removed examples, because latent information derived from other training data might enable that. This is why the paper puts "gold standard" in quotation marks throughout—it is "gold" only for the narrow goal of ensuring specific training data did not influence model parameters, not for the broader goal of controlling model outputs. The paper also notes two practical problems: retraining from scratch is "expensive—often prohibitively so for today's enormous models trained on enormous datasets by expending enormous computing resources," and it requires discarding all benefits of prior training on the inclusive dataset.

Structural removal (exact unlearning). To make retraining more efficient, researchers developed structural removal methods:

"methods for structural removal use custom procedures to reduce the amount of retraining that needs to be done to guarantee the exclusion of targeted training data."

The paper traces this approach to work by Bourtoule et al. (2021) and Yan et al. (2022), which design training procedures that partition the training data so that, when a deletion request arrives, only the partition containing the requested data needs to be retrained. The critical property of these methods is that they "retain the exact same guarantees of the 'gold standard,' with respect to removing the effect of targeted training data." The guarantee is identical—the targeted training examples did not influence the model's parameters—but the computational cost is lower because only a fraction of the model needs to be retrained.

The paper deliberately distances itself from the standard terminology:

"We avoid the term 'exact unlearning' because it can be reasonably misunderstood to mean that such methods are able to 'exactly' or 'perfectly' unlearn anything; however, these methods do not apply to latent information that is encoded in a perhaps unidentifiable—i.e., unstructured—way in the model."

This clarification is central to the paper's thesis: the word "exact" in "exact unlearning" does NOT mean that the method exactly removes all traces of the targeted concept or prevents all outputs related to it—it means only that the method provides the exact same training-data-influence guarantee as retraining from scratch. The scope of the guarantee is narrow, and the terminology misleadingly implies a broader scope.

Approximate removal (inexact unlearning). The second family of removal methods relax the requirement of strict equivalence to retraining:

"methods that approximate structural removal, often by changing the original model's parameters rather than retraining from scratch. These algorithms involve proofs (with specific theoretical assumptions) that the modified model is (by some mathematical definition) 'similar' to a model that has been retrained from scratch."

The paper cites Guo et al. (2019) and Kurmanji et al. (2023) as representative work. The key difference from structural removal is the nature of the guarantee: approximate methods provide probabilistic guarantees, not absolute certainty, that the targeted information has been successfully removed. The paper notes that these methods "are often referred to as inexact unlearning" in the literature.

Critically, the paper observes that the theoretical guarantees of approximate methods depend on assumptions that may not hold in practice:

"Practical implementations do not always align with theoretical mathematical assumptions. In such settings, methods may still work reasonably well empirically, but they may lose their respective (exact or inexact) theoretical guarantees."

This is not presented as a flaw in the methods themselves, but rather as a fact about the gap between theoretical analysis and real-world deployment that matters for legal contexts where guarantees (not just empirical tendencies) may be required.

Why removal methods largely don't transfer to generative AI. The paper identifies two overarching reasons:

Compatibility constraints: Structural removal methods require specific training procedures to be used from the beginning—"they cannot be applied to trained models that did not use those processes." This means that a deployed model like Llama 3 405B, which was not trained with structural removal in mind, "cannot post hoc be made compatible with these methods." The paper cites this as a fundamental practical barrier: most generative-AI models in production today were not designed with unlearning-compatible training, and retrofitting is impossible.
Computational cost: Even approximate removal methods are "very computationally expensive at generative-AI scale," as noted by Liu et al. (2024). The paper does not provide specific FLOP estimates but argues that the cost is prohibitive given the scale of current models and datasets.

For both reasons, the paper concludes that "removal algorithms are challenging to implement for generative AI in practice," and notes that these practical challenges "have important implications for legislative requirements around data deletion for production generative-AI systems." This sets up the analysis in Section 5.2, where the paper argues that even if GDPR Article 17 requires removal (which is itself debated), the practical infeasibility of removal methods for deployed generative-AI models means that alternative compliance mechanisms—or different interpretations of the legal requirement—are necessary.

Suppression Methods (Section 3.2)

Suppression methods represent the expanded scope of unlearning in generative AI: rather than trying to guarantee that specific training data did not influence the model, these methods attempt to make undesirable outputs less likely. The paper characterizes suppression by what it does NOT do: it "does not guarantee that the model could never produce such content." Suppression methods target latent information and higher-order concepts (Appendix C), and they are evaluated by examining model outputs, not by inspecting model parameters.

The paper makes a strong taxonomic claim: "Most unlearning methods in generative AI focus on output suppression." This is an empirical observation about the research landscape—while removal methods (Section 3.1) dominate the theoretical unlearning literature for supervised ML, the practical challenges of applying them to generative AI have led the field to shift toward suppression methods that are more computationally feasible but provide weaker guarantees.

What suppression methods do NOT do. The paper is explicit about the negative property that distinguishes suppression from removal:

"Potentially problematic training data are observed during the training process, and there is no attempt to guarantee (with certainty or probabilistically) that this is not the case."

In other words, suppression methods accept that the problematic information was seen during training and may still be encoded in the model's parameters. They operate downstream of training, attempting to prevent that information from surfacing in outputs, rather than upstream, attempting to prevent it from ever entering the model. This distinction is the foundation of Mismatch 1: if a law requires deletion of data, suppression does not satisfy that requirement because the data are still present in the model.

The paper also acknowledges a terminological tension: "While it is now common to include these methods under 'machine unlearning,' arguably, they have nothing to do with 'unlearning' some information from a model; they bear more resemblance to alignment techniques." This observation—that suppression methods are more like RLHF or output filtering than like data deletion—is not developed in depth but signals the paper's broader point that the "unlearning" label is being applied to methods that serve fundamentally different purposes.

Two overarching approaches to output suppression. The paper categorizes suppression methods along an architectural axis: whether they modify the model itself or leave the model unchanged and modify the surrounding system.

Model modification methods: These alter the trained model's behavior through additional training or editing, with the goal of making it less likely to produce undesirable outputs. The paper cites several representative techniques:

Additional fine-tuning on curated data that teaches the model to avoid certain outputs (e.g., Eldan and Russinovich, 2023; Maini et al., 2024; Zhang et al., 2024).
Model editing, which identifies and modifies specific parameters associated with particular knowledge (e.g., Meng et al., 2022; Mitchell et al., 2022, which locate "factual associations" in transformer MLP layers and modify them directly).
Reinforcement learning approaches that penalize undesirable generations (e.g., Lu et al., 2022, "Quark: Controllable text generation with reinforced unlearning").

The paper characterizes all model modification approaches as facing the same fundamental challenge: "This is challenging to do in a targeted way because the relationship between model parameters and model outputs is not straightforward or, in some cases, possible to determine." This is the same non-interpretability problem that motivates the need for unlearning in the first place (Section 3.1)—model parameters are not disentangled representations where "the concept of Spiderman" lives in a cleanly isolatable subset of neurons.

System-level intervention methods: These leave the trained model entirely untouched and instead modify the infrastructure that surrounds it. The paper describes two types:

Output filters (guardrails): These are components that sit between the model and the end user, examining generated outputs and blocking those that contain undesirable content from being surfaced. The paper cites Thaker et al. (2024) for guardrail baselines. Output filters may themselves be implemented as ML models (e.g., classifiers trained to detect toxic content or copyrighted material) that "exhibit greater or lesser degrees of precision and accuracy."
Input filters: These examine user prompts before they reach the model, blocking prompts that request undesirable outputs. The paper gives the example of "a filter that flags the user's prompt to generate the chemical formula for smallpox, and prevents the prompt from ever being supplied as an input to the model."
System prompts: The paper also mentions in-context mechanisms: "A system prompt is a piece of developer-chosen text that the system adds internally to the context of all user-supplied prompts, often to coax the model away from producing generations that contain undesirable content." The paper is skeptical about these, noting they "may or may not work in practice; they are generally imprecise."

A crucial tension in system-level suppression. The paper identifies a practical tension that recurs across all three policy domains (copyright Section 5.1, privacy Section 5.2, safety Section 5.3): to effectively filter out undesirable content from outputs, the filtering mechanism often needs to have learned about that content itself. An output filter that blocks copyrighted images of Mickey Mouse needs to be able to recognize Mickey Mouse—which typically means it was trained on data that include Mickey Mouse. An input filter that blocks prompts requesting smallpox formulas needs to recognize that "smallpox" is a target of concern—which requires knowledge of what smallpox is. The paper encodes this in a footnote:

"This tension—of needing to retain information in order to facilitate suppression—is also relevant for copyright (Section 5.1) and safety (Section 5.3). More generally, this tension pre-dates interest in machine unlearning for generative AI."

The example the paper gives is Facebook's approach to non-consensual intimate imagery (NCII): users were asked to upload the images in question to a Facebook-hosted tool so that Facebook could identify and remove them from the platform—meaning the platform needed to possess copies of the very material it was trying to suppress. For generative AI, the tension manifests as: even if you successfully remove "Spiderman" from the model's training data (removal), you may still need to retain Spiderman-related information in the system's output filter (suppression) to effectively block Spiderman-like outputs—which means the overall system still "knows" about Spiderman, just in a different component.

How suppression methods are evaluated. The paper characterizes evaluation practices in the suppression literature:

"The success of output suppression methods is most often evaluated by examining how they affect the types of generations that are produced in some downstream task. This often involves prompting the model or system with respect to content that the method intended to suppress, and observing if the resulting generations do not reflect that information."

The paper gives the concrete example of safety evaluations using the WMDP benchmark (Li et al., 2024), which is described as "a multiple-choice question dataset that focuses on biological, chemical, and cyber-security risks." The evaluation procedure is: test the original model on WMDP to establish a baseline, apply a suppression method, re-test, and "quantify changes in the answers as a proxy for determining if 'unsafe' knowledge is no longer reflected in the model's answers."

The paper notes a limitation of this evaluation paradigm: "given the open-ended 'information rich' outputs of generative-AI models, it is very challenging (and an open research area) to come up with methods that reliably measure properties of model and system outputs." The WMDP benchmark attempts to mitigate this by using multiple-choice questions, which constrain the open-endedness of outputs, but this constraint also limits what can be measured—a model might fail to answer a multiple-choice bioweapons question correctly (passing the evaluation) while still being capable of generating a detailed bioweapons recipe when prompted in an open-ended format. The paper cites Wallach et al. (2024) for a broader discussion of evaluation challenges, noting that "Evaluating Generative AI Systems is a Social Science Measurement Challenge."

The paper also notes, in the context of Shumailov et al. (2024)'s concept of "ununlearning," that many evaluations do not test for the possibility that suppressed knowledge can be reintroduced through in-context prompting:

"Many such evaluations rely on the WMDP benchmark, which is a multiple choice question dataset that focuses on biological, chemical, and cybersecurity risks. Setting aside the observation that multiple choice questions may not in general be the most effective way to measure such risks, this evaluation setup does not allow for the type of more open-ended reasoning that this scenario presents."

This connects to Mismatch 3 (models are not equivalent to their outputs at a single evaluation point) and reinforces the paper's argument that evaluation methodology for suppression is itself an open research problem that makes claims about unlearning's effectiveness difficult to verify.

The Five Mismatches as Analytical Framework

The paper organizes its critique around five "intertwined problems" (Section 4) that emerge from the preceding technical analysis. These mismatches are the paper's core intellectual contribution—they are not empirical findings (no experiments were run) but rather logical deductions from the properties of the methods described in Sections 3.1 and 3.2 combined with the information target taxonomy in Appendix C.

The mismatches are designed to be checked against any specific unlearning claim. The paper's structure suggests that a reader encountering a claim like "our method unlearns copyrighted content from the model" should ask: Which target (observed, latent, higher-order)? Which mechanism (removal or suppression)? Which mismatch applies? The answers determine whether the claim is technically coherent.

Mismatch 1: Output Suppression Is Not a Replacement for Removal of Training Data

This mismatch addresses the case where someone uses a suppression method (output filtering, model editing, RLHF) but claims to have "removed" data from the model—or where a legal requirement calls for removal but a suppression method is deployed instead.

The core logical point: Suppression methods leave the targeted information in the model's parameters. The model still "knows" the information; it has merely been made less likely to express it under typical prompting. The paper states it precisely:

"With output suppression, it is possible that a particular piece of information is still represented in the model's parameters, and that this information could manifest in or impact the model's outputs."

The consequence for law and policy is direct:

"If a piece of legislation were to call for the explicit removal of a piece of training data from a model's training dataset, unlearning methods that fall short of guaranteeing structural removal would likely not suffice."

The paper cites Floridi (2023) for the legal argument about what counts as "removal" and notes that the appropriateness of suppression depends on "the exact details" of the legal domain and "the circumstances of the use that exposes information that was meant to be addressed with unlearning." The key variable is whether an "atypical, adversarial usage pattern" is necessary to extract the retained information—if a sophisticated adversary can extract it, suppression may be deemed insufficient even if typical users cannot.

Why this matters across domains: In privacy (Section 5.2), a GDPR deletion request that asks a company to "delete my personal data" is, under some interpretations, a request for removal of that data from systems that process it—which would include a trained model. A suppression method that prevents the model from outputting the individual's phone number but leaves the phone number encoded in the model's parameters might not satisfy this requirement, particularly if the phone number can be extracted through adversarial prompting or membership inference attacks. In copyright (Section 5.1), a court order to "destroy all copies of the infringing work" raises the question of whether a model that has memorized the work is itself an infringing copy—suppression doesn't address this, because the work is still in the model. In safety (Section 5.3), the concern is whether suppression methods can be circumvented, making the "unsafe knowledge" accessible to determined adversaries even if casual users cannot access it. The paper cites Shumailov et al. (2024) on "ununlearning"—the phenomenon where apparently suppressed knowledge can be recovered through in-context prompting, fine-tuning, or other post-hoc interventions.

Mismatch 2: Removal of Training Data Does Not Guarantee Meaningful Output Suppression

This is the inverse of Mismatch 1. It addresses the case where someone performs true removal (retraining without certain data, or structural removal) and then claims the model will never produce outputs related to the removed data.

The core logical point: Even if specific training data never entered the model, the model may still produce outputs that closely resemble those data because of latent information derived from other training data. The paper gives two extended examples:

Phone number example:

"Consider deleting a particular phone number. Given latent information the trained model may contain about other phone numbers (and about numbers in general), it may be possible for the model to generate a specific phone number for which all associated training data have been removed."

Even if every training example containing the phone number 555-123-4567 is removed and the model retrained, the model may still have learned the structure of U.S. phone numbers (3-digit area code, 3-digit exchange, 4-digit subscriber) from other phone numbers in the training data, and may also have learned associations between people and their phone numbers. If the model encounters other information about the person (e.g., a prompt containing their name and city), it might generate 555-123-4567 as a plausible inference, even though that specific number was never in the training data.

Spiderman example:

"Similarly, one could remove all in-copyright images of Spiderman from an image generation model's training dataset and retrain from scratch. But again, this does not guarantee that the new model could not possibly produce an output that might be 'substantially similar' to copyrighted expression of Spiderman, based on how the model generalizes from latent information derived from the information that remains in its training data."

This example is concretely demonstrated in Figure 1, which the paper describes in detail (Section 5.1): the CommonCanvas model (Gokaslan et al., 2023) was trained exclusively on Creative Commons–licensed images. Its training dataset does not contain unlicensed, in-copyright images of Mickey Mouse. Yet the model can still generate images that "could be judged substantially similar to 'Mickey Mouse'" because the training data include personal photographs from Disney World that contain Mickey Mouse, and the model generalizes from these to produce new Mickey Mouse–like images. This is a concrete empirical demonstration of Mismatch 2: removal of the specific in-copyright images did not prevent the model from producing outputs that resemble the copyrighted character.

The deeper problem: bounding what to remove. The paper argues that Mismatch 2 reveals a fundamental difficulty in specifying the removal target:

"it is unclear which set of information should be targeted for removal from the training data in order to prevent the generation of certain outputs. Removal of a narrow set of information (e.g., training data that contain certain phone numbers) can easily be under-inclusive. Being over-inclusive is also a potential problem, especially for cases that attempt to handle indeterminate concepts like 'Spiderman.'"

The paper explores the over-inclusiveness risk: "One could remove all information related to comic books, spiders, the colors blue and red, the humanoid form, etc. But this is too broad: it may be effective at preventing generations that reflect 'Spiderman,' but it also removes significantly more information that one did not originally intend to target (Mismatch 5)." This connects to the paper's broader argument (Section 6) that there are "no general-purpose solutions to constrain generative technologies"—the very properties that make models powerful (their ability to generalize across diverse training data) make it impossible to surgically remove specific concepts without collateral damage.

Implications for the "gold standard" as a baseline. The paper argues that Mismatch 2 complicates the use of retraining-from-scratch as an evaluation baseline for unlearning methods:

"Implementing the 'gold standard' requires navigating difficult, if not arbitrary, trade-offs to draw boundaries around what exactly to include for removal. One could choose to retrain without all in-copyright images of Spiderman that they manage to identify in the training data, but this would not necessarily include pictures of people in Spiderman Halloween costumes. How to make these choices is clearly not a straightforward task, and yet it is essential when evaluating a particular unlearning method against the 'gold standard' as a baseline, in order to make judgments about its efficacy."

This is a methodological critique of evaluation practices in the unlearning literature: when a paper claims that an approximate unlearning method is "close to the gold standard," what exactly was removed in the gold standard? If the removal set was under-inclusive (missed some instances of the target concept), the gold standard model might still exhibit the unwanted behavior, making approximate methods look better by comparison. If the removal set was over-inclusive (removed too much), the gold standard model might lose capabilities that the approximate method preserves, making the approximate method look worse by comparison—but for the wrong reason (the approximate method didn't actually remove the target concept; it just performed differently on the evaluation benchmark).

Mismatch 3: Models Are Not Equivalent to Their Outputs

This mismatch identifies a slippage in evaluation methodology that pervades unlearning research. The paper observes that unlearning methods are typically evaluated by examining model outputs (e.g., prompting the model and checking if it still produces undesirable content), but this conflates what the model is (its parameters) with what the model does (its outputs under specific prompting conditions).

The core logical point:

"it is typical to evaluate the success of an unlearning method not by examining changes in the model's parameters, but by prompting the model and measuring the extent to which certain types of outputs are no longer generated. This has consequences for how we should think about gauging the success of an unlearning method."

The paper illustrates this with an extended privacy example involving an individual p0 who has exercised their right to deletion. All of p0's training examples are removed and the model is retrained (the "gold standard" of removal). But the retrained model still contains data from individuals p1, ..., pn whose data are, "by some quantitative measure similar to p0's." Now consider a user who prompts the model with public information about p0 (demographics, address) to try to infer p0's health status. The model, combining latent information from p1, ..., pn with the prompt information about p0, "generalizes to produce an output that reveals sensitive information about p0's health status."

The model has not stored p0's health status—it inferred it from similar individuals. The removal was successful in the narrow sense (p0's training data were deleted), but the evaluation looking at outputs would conclude that the unlearning failed, because the model still produced sensitive information about p0. Conversely, a suppression method might prevent the model from outputting p0's health status under this specific prompt, passing the output-based evaluation—but p0's training data might still be encoded in the model's parameters (Mismatch 1).

The paper frames this as a manifestation of Shumailov et al. (2024)'s "ununlearning" concept:

"unlearned knowledge gets reintroduced in-context, effectively rendering the model capable of behaving as if it knows the forgotten knowledge."

The crucial insight is that the model doesn't need to have stored p0's specific data to behave as if it knows them—it can reconstruct them from latent information plus in-context prompting. The evaluation based on outputs would label this as "unlearning failed," but the actual mechanism (generalization from other data) is not something that removal-based unlearning can prevent. This demonstrates why output-based evaluation is insufficient to distinguish between "the data were removed" and "the data are still present but latent information makes the model appear to know them."

Why this matters for law and policy. The paper's implication is that different legal regimes care about different things. A privacy law that cares about whether p0's personal data are stored in the model's parameters would consider the removal successful (the data were deleted) even though the model can still make inferences about p0. A privacy law that cares about whether the model can reveal information about p0 (regardless of where that information came from) would consider the removal insufficient, because the model can still harm p0's privacy through inference. The same technical outcome—successful removal of training data—would be evaluated differently under different legal standards, and evaluations that only measure outputs cannot disambiguate which standard is being met.

Mismatch 4: Models Are Not Equivalent to How Their Outputs Are Put to Use

This mismatch extends the analysis beyond the model itself to the unbounded downstream contexts in which model outputs can be deployed.

The core logical point:

"seemingly innocuous outputs could be put to undesirable downstream uses. To greater or lesser extents, different unlearning methods can remove the effect of specific training data from models or suppress certain types of model outputs; but the type of control this provides is localized to the model. Additional control would require anticipating how a person or other agent might behave with model outputs in an unbounded number of contexts—none of which is reasonably under the purview of machine unlearning."

The paper grounds this in the safety analysis (Section 5.3), where it becomes most consequential. The extended example concerns a model that has been subjected to unlearning to remove knowledge of "how to synthesize a toxic molecule." The paper argues that the actual ability to synthesize such a molecule depends on the user's knowledge, not just the model's outputs:

"What if the user already has a recipe for making such a molecule (obtained from another source), and the generative-AI model lowers the barrier for creation of the molecule for the user by explaining, in detail, how to understand nuances of the recipe that they do not understand on their own? What if the model provides a single 'missing piece' of information that is innocuous on its own (e.g., details of a single chemical reaction) that, in combination with everything else this user knows, enables them to create the molecule?"

The paper cites Glukhov et al. (2024) for the concept of "Breach By A Thousand Leaks"—that individually innocuous model outputs can, in combination with external knowledge, enable harmful outcomes. The paper also cites Jones et al. (2024) for the finding that "Adversaries Can Misuse Combinations of Safe Models"—multiple models, each individually constrained, can be used together to achieve harmful goals that no single model would enable.

The deeper argument is that unlearning cannot solve the dual-use problem by definition:

"By definition, dual-use systems can be put to potentially beneficial or potentially harmful uses. It is not just the case that innocuous training data could in combination lead to potentially unsafe latent information in the trained model; it is also possible for generated outputs that are innocuous in isolation to be put to unsafe or otherwise undesirable downstream uses."

The paper gives the example of a molecular generation system designed for drug discovery: "one of the purposes of such a system is to lower the barrier of expertise required for drug discovery." Even if the system is used entirely as intended (suggesting drug candidates), the molecules it suggests could be toxic, and "currently, a generative-AI system cannot on its own definitively determine that the molecules it produces are safe for human consumption; this is the point of lab experiments and drug trials." Safety, in this example, depends on downstream processes (laboratory testing, clinical trials, regulatory review) that are entirely outside the model's scope. Unlearning cannot make the model's outputs safe because safety is a property of how outputs are used, not of the outputs themselves.

Connection to existing literature on algorithmic fairness. The paper draws an explicit analogy to work on algorithmic fairness (citing Barocas and Selbst, 2014; Cooper et al., 2024) that has made a similar point about risk assessment models: "a model that produces risk scores for criminal recidivism is distinct from the distribution of scores that model produces over a given population, which is again distinct from how the (distribution of) scores gets used for decision-making." This is the same structural slippage: the artifact (model) ≠ the artifact's outputs ≠ how outputs are used. The paper notes that this slippage "takes on an expanded meaning for generative-AI contexts" because the output space is so much larger and the potential downstream uses are so much more varied.

Mismatch 5: Unlearning Can Have Unintended Consequences

This mismatch addresses the collateral damage that unlearning methods can cause: removing or suppressing one type of information often affects other information that was not intended to be targeted.

The core logical point:

"Even if a particular method is successful at removing a specific piece of information from a model or suppressing its appearance in outputs, it is often the case that the method will also remove or suppress other information that the implementer did not intend to target."

The paper gives two examples of how unintended consequences manifest:

Removal side effects: "removing a chosen set of facts from the training dataset might change how a model answers questions about seemingly unrelated facts." The paper cites a line of work documenting that unlearning degrades model utility (Bourtoule et al., 2021; Goel et al., 2024; Jia et al., 2024; Kurmanji et al., 2023; Liu et al., 2024), and specifically cites Huang et al. (2024) for demonstrating that "Adversarial Machine Unlearning Requests Destroy Model Accuracy"—a small number of strategically chosen unlearning requests can cause disproportionate degradation.

Suppression side effects: "output suppression is likely to affect not just outputs that include the material intended to be suppressed, but also other outputs." The paper gives the example from Section 5.1: suppressing outputs that resemble "Spiderman" would likely also suppress "depictions of other superheroes with similar color schemes" and "fair uses of Spiderman in parody." The boundary between "Spiderman" and "not-Spiderman" is not a clean line in representation space—it is a continuum where suppression cannot be surgically precise.

The "everything but X" fallacy. The paper introduces what it calls a "superficial understanding of machine unlearning":

"A superficial understanding of machine unlearning is that it can surgically and completely remove specific capabilities from a model while leaving everything else about the model unchanged. As we have seen, this is not what unlearning methods actually accomplish."

This is linked to the broader principle (Section 6) from Ed Felten: the "Fallacy of the Almost-General-Purpose Computer." A generative-AI model cannot be made to do "everything but X" because the same general-purpose capabilities that enable beneficial uses (flexibility, generalization, abstraction) also enable harmful uses. Removing the capability to produce harmful outputs would require removing the capabilities that make the model useful in the first place.

Why this matters for legal remedies. The paper notes that unintended consequences complicate the use of unlearning as a legal remedy. A court order to remove copyrighted material from a model might, if implemented through aggressive suppression or over-inclusive removal, destroy the model's ability to generate non-infringing content—potentially making the remedy disproportionate to the harm. Similarly, a privacy-motivated deletion of one individual's data might, through approximate unlearning methods that affect similar data, degrade the model's performance for other individuals who did not request deletion. The paper does not claim these trade-offs are always unacceptable, but rather that they must be explicitly acknowledged and weighed rather than assumed away by the "surgical removal" framing.

Summary: How the Technical Framework Enables the Rest of the Paper

The five mismatches are not presented as empirical findings that could be overturned by better unlearning algorithms. The paper's argument is that they are structural: they arise from the fundamental properties of the methods, not from contingent limitations of current implementations.

Mismatches 1 and 2 follow from the fact that removal and suppression target different kinds of information (observed vs. latent/higher-order) and operate at different points in the model lifecycle (training vs. inference). No amount of technical improvement will make a suppression method into a removal method, or vice versa, because they are trying to do different things.
Mismatch 3 follows from the fact that outputs are a function of both the model's parameters and the input context, and that a given parameter state is compatible with many different output behaviors depending on prompting. Evaluating unlearning by outputs alone cannot distinguish between "the model no longer knows X" and "the model knows X but isn't showing it under this particular evaluation."
Mismatch 4 follows from the fact that models are components in larger sociotechnical systems where downstream users have their own knowledge, goals, and contexts that the model developer cannot control. Unlearning can constrain the model's contribution to harmful outcomes but cannot eliminate the possibility of harmful outcomes entirely, because the model is not the only causal factor.
Mismatch 5 follows from the fact that information in models is entangled—concepts overlap, capabilities share representational substrate, and targeting one piece of information almost inevitably affects others. This is not a bug in current unlearning methods that future methods will solve; it is a property of distributed representations in neural networks.

The paper's subsequent sections (Section 5 on copyright/privacy/safety and Section 6 on recommendations) apply this framework to concrete policy contexts, showing how each domain's specific legal standards interact with the mismatches to produce different conclusions about when and whether unlearning is appropriate. The technical framework established in Sections 3 and 4 does not tell policymakers what to do—it tells them what questions to ask when evaluating an unlearning claim: Which target? Which mechanism? Which mismatch is most salient? What does the specific law require? The answers to these questions, not the presence or absence of "unlearning" as a label, determine whether a technical intervention satisfies a policy goal.

4. Key Insights and Innovations

Innovation 1: A Diagnostic Framework of Five Structural Mismatches That Reframes Unlearning from a "Better Algorithms" Problem to a "Clarify Your Goals" Problem

The paper's most fundamental intellectual move is to shift the conversation about machine unlearning from an engineering optimization problem to a conceptual alignment problem. Prior work—and the paper documents an explosion of it, with 428 unlearning papers on arXiv in 2024 alone (Figure 2)—has overwhelmingly treated unlearning as a technical challenge: can we design more efficient removal algorithms? Can we achieve better suppression of unwanted outputs? Can we create better evaluation benchmarks? The implicit framing is that unlearning "doesn't work well enough yet" and that better methods will eventually make it work.

This paper argues that this framing is fundamentally misguided for the policy applications that motivate most unlearning research. The core contribution is not a critique of any particular algorithm's performance but rather the identification of five structural mismatches (Section 4) that arise from the logical properties of what removal and suppression methods are, not from contingent limitations of how well they currently perform. These mismatches—output suppression ≠ removal (Mismatch 1), removal ≠ output suppression (Mismatch 2), models ≠ outputs (Mismatch 3), models ≠ downstream use (Mismatch 4), and unintended consequences (Mismatch 5)—are presented as necessary consequences of the architecture of generative AI systems and the nature of distributed representations in neural networks, not as bugs that can be patched with better engineering.

What makes this reframing distinctive: Prior work has largely treated unlearning as a problem to be solved. Individual papers propose methods and evaluate them against benchmarks, and the field progresses by incremental improvement on those benchmarks. The implicit assumption is that if methods get good enough—if suppression becomes reliable enough, if removal becomes efficient enough—then unlearning will serve as a general-purpose compliance mechanism for privacy, copyright, and safety. Surveys like Liu et al. (2024) and Qu et al. (2023) taxonomize methods and document technical challenges, but they operate within the "better methods will solve this" paradigm.

This paper breaks that paradigm by arguing that even perfect technical execution of current unlearning approaches cannot bridge the gap between what the methods do and what policy goals require. The argument is structural, not empirical: it doesn't matter how good your output filter is—it still doesn't delete training data (Mismatch 1). It doesn't matter how thoroughly you retrain without specific examples—the model can still produce similar outputs from latent information (Mismatch 2, demonstrated concretely in Figure 1). These are not limitations of current implementations; they are properties of the relationship between the information targets (Appendix C, Definitions 1–3) and the methods that can address them.

The diagnostic vocabulary as an intellectual infrastructure. The paper builds a conceptual apparatus—observed information, latent information, higher-order concepts (Appendix C); removal vs. suppression (Sections 3.1–3.2); the five mismatches (Section 4)—that functions as a reusable diagnostic toolkit. When a researcher claims "our method unlearns dangerous knowledge from LLMs," the framework enables a precise series of questions: Which information target does "dangerous knowledge" correspond to? (Higher-order concepts, by Definition 3.) Does the method operate on observed information (removal) or latent/higher-order information (suppression)? Given the mismatch framework, can suppression alone satisfy the goal of removing capabilities (Mismatch 1) and prevent those capabilities from being recovered through in-context prompting (Mismatch 3, via Shumailov et al., 2024's "ununlearning") or downstream recombination with user knowledge (Mismatch 4)? The framework doesn't produce a yes/no answer, but it reveals which questions need to be answered before "unlearning" can be claimed to address the goal.

This is fundamentally different from prior surveys because it doesn't organize the field by method type (gradient-based vs. retraining-based, exact vs. approximate) or by application domain (privacy vs. copyright vs. safety). Instead, it organizes the field by the logical relationship between what methods guarantee and what goals require, which reveals that methods from different technical families can share the same structural limitations, and methods from the same technical family can have different policy implications depending on which mismatch is most salient in a given legal context.

Significance beyond any single domain. The paper demonstrates the framework's generality by applying it to three domains (copyright, privacy, safety in Section 5), but the framework is explicitly designed to be portable. As the conclusion states: "In any legal or policy context, we can ask how the core conceptual mismatches involving unlearning play out in practice." This transforms the paper from a domain-specific critique (unlearning doesn't work for copyright) into a meta-level diagnostic tool that can be applied to any future domain where unlearning is proposed as a solution. The framework isn't about whether unlearning is "good" or "bad"—it's about making explicit what assumptions are being made when someone claims unlearning addresses a policy goal, and checking whether those assumptions survive contact with the structural properties of the methods.

The negative-result-as-contribution move. This paper exemplifies a type of intellectual contribution that is undervalued in ML research: the careful articulation of why a popular proposed solution to a problem cannot work in principle, not because it hasn't been optimized enough, but because the problem formulation itself contains a category error. The paper is not saying "unlearning methods need improvement"—it's saying "even ideal unlearning methods cannot serve as general-purpose compliance mechanisms unless the specific legal requirements, information targets, and method guarantees are aligned, and in many realistic cases they structurally cannot be." This is a more fundamental claim than a negative experimental result, and it requires a different type of evidence: conceptual analysis rather than benchmark scores. The paper's framework serves as the evidence, and its portability across domains serves as the validation.

Innovation 2: The Three-Level Information Target Taxonomy That Makes Explicit What "Unlearning" Actually Targets—and Why This Matters for Law

While prior work has implicitly distinguished between unlearning specific training examples and unlearning concepts or capabilities, the paper is the first to explicitly taxonomize information targets into observed, latent, and higher-order categories (Appendix C, Definitions 1–3) and then systematically trace how confusion between these targets produces the mismatches that undermine unlearning's policy utility. This taxonomy is not presented as a deep ontological claim about neural network representations, but as a pragmatic diagnostic vocabulary that makes visible what is typically left implicit in unlearning claims.

What was missing before. The unlearning literature has long distinguished between "exact unlearning" (guaranteeing removal of specific training examples) and "inexact unlearning" (approximating that guarantee), and between "data removal" and "knowledge removal." But these distinctions were typically drawn along methodological lines (what algorithm is used) or evaluative lines (what benchmark is tested), not along the axis of what type of information is being targeted. The result was that a method designed to remove specific training examples (targeting observed information) might be evaluated by whether it prevents certain outputs (which depends on latent and higher-order information), creating a category error in the evaluation that the paper identifies as Mismatch 3.

The paper's taxonomy makes this error visible by giving it a name: observed information is what removal methods target; latent and higher-order information are what suppression methods target and what output-based evaluations measure. When a paper evaluates a removal method by measuring outputs, it is crossing information targets—using a metric appropriate for latent/higher-order information to judge a method that only guarantees things about observed information. This isn't necessarily wrong (practitioners care about outputs), but the taxonomy reveals that it's measuring something different from what the method guarantees, and the gap between guarantee and measurement is exactly where policy-relevant failures can occur.

The spectrum insight. The paper is careful to note that the three categories are not cleanly separable—they exist on "a spectrum of complexity" (Appendix C), with observed information at one end (concrete, directly manipulable), higher-order concepts at the other (abstract, emergent, difficult to bound), and latent information spanning the middle. The authors explicitly state that they "do not attempt to draw these lines." This is intellectually honest and also theoretically productive: it means the taxonomy is not a claim about how models "really" organize information (which would require mechanistic interpretability evidence the paper doesn't provide) but rather a claim about the practical manipulability of different kinds of information. You can delete a training example (observed). You cannot directly delete a concept like "Spiderman" (higher-order); you can only try to suppress outputs that express it, or remove observed information that contributes to it (with the limitations exposed by Mismatch 2).

Why this taxonomy is an innovation rather than just a definition. The paper could have made its arguments about the five mismatches without the Appendix C taxonomy—it could have simply said "removal targets training data, suppression targets outputs, and these are different." But the taxonomy does intellectual work that a flat distinction wouldn't. Specifically:

It explains why Mismatch 2 is structural, not contingent. The reason removal of specific training examples doesn't guarantee output suppression is that outputs are generated from latent information derived from many training examples, not from individual observed examples in isolation. The taxonomy provides the vocabulary to say: removal targets observed information; but outputs depend on latent and higher-order information; since latent information is not a direct function of any single observed example, removing specific observed examples cannot guarantee control over outputs. This is a stronger claim than "removal is imperfect"—it's a claim about the logical relationship between information types.
It reveals why some unlearning goals are ill-posed from first principles. When safety researchers propose unlearning "dangerous knowledge" from a model (Section 5.3), the taxonomy makes visible that "dangerous knowledge" is a higher-order concept—an abstraction that doesn't correspond to any cleanly identifiable subset of training data (observed information) or any single latent representation. The paper's analysis shows that targeting a higher-order concept through removal of observed information faces a bounding problem: what exactly do you remove? All chemistry papers? All biology papers? All papers mentioning weapons? Each choice faces the over-inclusiveness/under-inclusiveness tradeoff (Mismatch 5), and the taxonomy explains why this tradeoff is unavoidable—because higher-order concepts are distributed across observed information in ways that don't respect the boundaries we want to draw.
It grounds the distinction between legal domains in technical reality. The paper argues that different laws care about different information targets. GDPR Article 17 (under the common ML interpretation) cares about observed information—the specific data examples associated with a particular individual. Copyright law cares about both observed information (copies of protected works in training data) and higher-order concepts (whether outputs are "substantially similar" to protected expression, which depends on abstract judgments about similarity that go beyond whether specific training examples were literally present). Safety concerns care primarily about higher-order concepts (capabilities) and latent information (inferences that can be drawn from combinations of innocuous facts). The taxonomy provides a language for making these distinctions precise: a method appropriate for one legal domain may target the wrong information type for another, and the taxonomy makes this mismatch legible.

Connection to prior work that gestured at these distinctions. The paper cites Cooper and Grimmelmann (2024) for the back-end/front-end distinction (Appendix B, Figure 3), which separates concerns about model parameters (back-end) from concerns about model outputs (front-end). The information target taxonomy can be seen as a refinement of this distinction: the back-end corresponds to observed information, the front-end to latent and higher-order information as they manifest in outputs. But the taxonomy adds the middle category (latent information) that the back-end/front-end binary doesn't capture—information that isn't directly in training data but also isn't a full capability or concept, like the inference about Carlos being in Philadelphia (Appendix C). This middle category is crucial for understanding privacy risks (Section 5.2) because it's exactly the type of information that can be reconstructed from similar individuals' data even after removal, and for understanding safety risks (Section 5.3) because dangerous outputs often depend on recombining latent information in novel ways.

Innovation 3: The Domain-Specific Application That Converts Abstract Mismatches into Concrete Policy Diagnostics—and a Template for Future Analysis

The paper's third major contribution is the systematic application of the mismatch framework to three specific policy domains (copyright, privacy, safety in Section 5), each of which reveals a different facet of why unlearning fails as a general-purpose compliance mechanism. This contribution is not the framework itself (which is Innovation 1) but rather the demonstration that the framework generates non-obvious, domain-specific insights that would not be visible from a generic "unlearning has limitations" argument. The paper effectively stress-tests its own diagnostic vocabulary and shows that it produces precise, actionable distinctions in each domain.

The template function. By walking through copyright, privacy, and safety in sequence, the paper establishes a reusable pattern for analyzing any future domain where unlearning is proposed. The pattern is: (1) identify what the specific legal regime requires (removal? suppression? prevention of specific outputs? prevention of downstream harms?); (2) identify which information target is relevant to that requirement (observed, latent, higher-order, or some combination); (3) identify which mismatch(es) are most salient given the relationship between the requirement and the target; (4) check whether available technical methods can satisfy the requirement given the mismatch. The paper doesn't explicitly template this pattern, but it's implicitly demonstrated three times, and the conclusion invites readers to apply it elsewhere: "In any legal or policy context, we can ask how the core conceptual mismatches involving unlearning play out in practice."

What makes the domain analyses innovative rather than just illustrative. It would have been possible to make the paper's argument entirely in the abstract—define the five mismatches and argue that they apply generally. The domain analyses do more than illustrate; they reveal that the same mismatch has different practical consequences depending on the legal standard in play. Specifically:

Copyright (Section 5.1) reveals that unlearning cannot operationalize "substantial similarity." The paper's analysis shows that the central concept in U.S. copyright infringement—whether two works are "substantially similar" in protected expression—is inherently contextual, subjective, and dependent on caselaw that "cannot be reduced to a simple formula" (citing Lee et al., 2023). This means that no unlearning method, no matter how technically sophisticated, can programmatically determine which training data to remove to prevent substantially similar outputs, because the very notion of "substantially similar" is not an algorithmic property of the data or the model. The CommonCanvas example (Figure 1) makes this concrete: a model trained only on Creative Commons images can still produce Mickey Mouse–like outputs. Is that output substantially similar to Disney's copyrighted expression? The answer depends on legal analysis of the specific output, not on whether the training data contained unlicensed copies. The mismatch here is not just between removal and suppression—it's between any technical criterion and a legal standard that is inherently qualitative and case-specific.

This is a stronger claim than Mismatch 2 alone would suggest. Mismatch 2 says removal doesn't guarantee output suppression because of latent information. The copyright analysis adds: even if you could perfectly suppress outputs similar to a specific work, you still haven't solved the copyright problem because "similar to a specific work" is not the same as "substantially similar under copyright law"—the latter includes exceptions (fair use, parody, independent creation) that no suppression method can adjudicate because they depend on context outside the model.

Privacy (Section 5.2) reveals a three-way fork that different legal interpretations map onto different technical methods. The paper's privacy analysis is structured around three distinct goals that unlearning might serve: (1) data deletion (removal of observed information), (2) suppression of outputs that resemble personal data, and (3) suppression of latent inferences about individuals. The paper argues that these goals are "neither mutually exclusive nor independent" and "sometimes different privacy goals and the relevant technical approaches to attempt to accomplish them may be in tension." The central example is the tension identified in a footnote: implementing output suppression may require retaining the information to be suppressed (in the filter), which conflicts with the goal of deletion. This tension is not captured by any single mismatch—it's an interaction between Mismatch 1 (suppression doesn't satisfy removal requirements) and Mismatch 5 (unintended consequences), mediated by the specific structure of privacy law that cares about both whether data are stored and whether they can be accessed.

The privacy analysis also surfaces a regulatory interpretation issue that the technical framework alone cannot resolve: under what circumstances does suppression constitute "reasonable best effort" even if it doesn't achieve perfect removal? The paper cites the CJEU's 2019 Google Spain ruling, which required Google to de-reference search results (a form of suppression) but did not require deletion from underlying databases. This suggests that some legal regimes already accept suppression as sufficient in some contexts, which complicates the blanket claim that removal is always required for privacy compliance. The paper's framework helps identify when this is the case—suppression is more likely to suffice when the legal goal is preventing access to information rather than eliminating its storage—but the framework doesn't dictate the answer; it makes visible what the relevant considerations are.

Safety (Section 5.3) reveals the "everything but X" fallacy and the inherent limits of controlling dual-use systems. The safety analysis is where Mismatch 4 (models ≠ downstream use) does the heaviest lifting. The paper argues that safety is fundamentally not a property of the model in isolation—it depends on the user's knowledge, the broader system in which the model is embedded, and the downstream processes that determine whether outputs lead to harm. The extended examples—the user who has a bioweapon recipe and needs the model to explain a single step, the molecular generation system whose outputs require lab testing to determine safety—are designed to show that even perfectly suppressing "dangerous outputs" from the model cannot eliminate safety risks because the same outputs may be dangerous in some contexts and beneficial in others, and unlearning methods have no way to distinguish between these contexts.

This analysis connects the technical framework to a broader governance principle that the paper treats as a key takeaway (Section 6): the "Fallacy of the Almost-General-Purpose Computer" (citing Ed Felten, 2002). A generative-AI system, like a PC, can be put to an unbounded range of uses, and "there is no simple or reliable way to prevent a computer (let alone a generative-AI system) from ever being used to violate privacy, infringe copyright, or design a dangerous molecule—not without fundamentally compromising the flexibility and power that make it so useful." This is not a technical limitation of current unlearning methods; it's a property of general-purpose technologies. The paper's contribution is to show that unlearning research has implicitly been trying to solve this problem—to make a general-purpose model do "everything but X"—and that this goal is structurally unachievable, not because unlearning is bad, but because it misunderstands the nature of dual-use generative systems.

Why this template matters for future work. The paper's conclusion explicitly invites extension to other domains, and the three analyses in Section 5 serve as existence proofs that the framework generates non-trivial insights when applied carefully to specific legal contexts. A researcher or policymaker encountering a new proposal to use unlearning for, say, defamation or trademark or election integrity could follow the same pattern: identify the legal standard, map it to information targets, check which mismatches are salient, and assess whether available methods can satisfy the standard. The framework doesn't pre-judge the answer—in some domains, suppression might be perfectly adequate (as the Google Spain example suggests for certain privacy contexts), and in others, removal might be both feasible and sufficient. But the framework ensures that the analysis is explicit about what is being assumed, rather than collapsing different goals under the single label "unlearning."

5. Experimental Analysis

Evaluation Methodology

This paper is a conceptual analysis, not an empirical study. It does not train models, run benchmarks, or report quantitative results in the conventional sense. Instead, it builds its argument through logical deduction from the structural properties of machine unlearning methods (Section 3) combined with a three-level taxonomy of information targets (Appendix C). The "experiments" are the paper's domain-specific analyses in Section 5, which serve as case studies that stress-test the five-mismatch framework against real-world legal and policy requirements. The paper does draw on specific empirical findings from prior work to support its arguments—most notably the CommonCanvas model demonstration (Figure 1) and the WMDP benchmark for safety evaluations—but it does not itself contribute new empirical data.

When the paper cites performance numbers, these are drawn from the existing unlearning and model evaluation literatures (e.g., Liu et al., 2024 for surveys; Li et al., 2024 for WMDP; Gokaslan et al., 2023 for CommonCanvas; Shumailov et al., 2024 for "ununlearning"). The methodological contribution is the framework for diagnosing mismatches, not a new set of measurements. This section therefore summarizes the evaluation methodology for the paper's own argumentative structure—how the paper validates its claims through cross-domain application—rather than reporting experimental protocols.

Domain case studies (analogous to "dataset"). The paper applies the mismatch framework to three distinct legal/policy domains: U.S. copyright law (Section 5.1), privacy and data protection (Section 5.2, primarily GDPR and CCPA), and AI safety (Section 5.3, drawing on executive orders, the E.U. AI Act, the WMDP benchmark, and the International Scientific Report on the Safety of Advanced AI). Each domain serves as a "test case" for the framework's explanatory power—can the five mismatches, when combined with domain-specific legal standards, generate non-obvious insights about why unlearning fails as a general-purpose compliance mechanism in that domain?
Analytic "baselines." The paper's argument is structured against two implicit baselines: (1) the unlearning-as-general-purpose-solution view, which the paper characterizes as a "superficial understanding" that unlearning "can surgically and completely remove specific capabilities from a model while leaving everything else about the model unchanged" (Section 6), and (2) the "better methods will solve this" view, which treats unlearning's current limitations as contingent engineering problems rather than structural mismatches. The paper's five-mismatch framework serves as the "proposed method" that outperforms these baselines by explaining phenomena they cannot—specifically, why even perfect technical execution cannot bridge the gap between what unlearning methods do and what policy goals require.
Evidence types. Rather than quantitative metrics, the paper validates its framework through: (1) logical argument from first principles (Sections 3–4), demonstrating that the mismatches follow necessarily from the definitions of removal, suppression, and the information target taxonomy; (2) concrete examples that make the mismatches vivid and falsifiable (the CommonCanvas Mickey Mouse generation in Figure 1, the phone number reconstruction example in Mismatch 2, the Carlos-in-Philadelphia latent inference example in Appendix C, the "single missing piece of information" scenario in Section 5.3); (3) citation of prior empirical work that independently demonstrates the phenomena the mismatches predict (Shumailov et al., 2024 on "ununlearning"; Huang et al., 2024 on adversarial unlearning requests destroying accuracy; Carlini et al., 2023, Nasr et al., 2023, and Cooper et al., 2025 on memorization and extraction); and (4) cross-domain consistency, showing that the same five mismatches generate relevant insights across copyright, privacy, and safety domains with different legal standards and different salient information targets.
"Compute accounting" for the paper's argument. The paper's analysis does not involve computational cost accounting, but it does involve a logical cost accounting: for each claimed application of unlearning, the paper identifies which information target the method addresses versus which target the policy requires, and the "cost" is the gap between these. The five mismatches are effectively the cost model—each mismatch represents a type of gap that must be acknowledged and, if possible, mitigated through supplementary interventions (e.g., acceptable use policies, red teaming, legal safe harbors) rather than through unlearning alone. The paper's recommendation that unlearning be treated as "just one approach among many others" (Section 6) follows from this gap analysis: unlearning's contribution is bounded by the structural properties captured in the mismatches, and closing the remaining gap requires non-technical mechanisms.

Main Quantitative Results

As a conceptual analysis paper, this work does not report quantitative results in the conventional sense. Instead, the "results" are the domain-specific insights generated by applying the mismatch framework, which the paper treats as validating the framework's utility. I organize these by the three policy domains analyzed in Section 5, highlighting which mismatches are most salient in each domain and what specific, testable claims emerge.

Copyright Analysis (Section 5.1)

The headline finding is that unlearning cannot operationalize the central legal standard for copyright infringement—substantial similarity—because this standard is inherently qualitative, contextual, and dependent on caselaw that "cannot be reduced to a simple formula" (citing Lee et al., 2023, p. 72). The paper demonstrates this through analysis of both suppression and removal approaches.

Suppression of substantially similar outputs faces an insurmountable boundary problem. The paper argues that "there is no notion of similarity that can be used to programmatically and comprehensively determine which works are substantially similar in the interest of copyright law" (Section 5.1). The illustrative example is Mickey Mouse: a feature like a color scheme may be infringing if copied from one specific in-copyright image but not if copied from another work where the same color scheme is unprotectable subject matter, or if used in a parody that constitutes fair use. The specific claim: "The techniques used to suppress generations similar to a particular in-copyright image of Mickey Mouse may not generalize to suppressing generations that are similar to another image of Mickey Mouse—or of any other Disney character" (citing Lee et al., 2023, Part II.F).

The CommonCanvas demonstration (Figure 1) concretely validates Mismatch 2. The paper cites Gokaslan et al. (2023) to show that CommonCanvas—a text-to-image model trained exclusively on Creative Commons–licensed images, with no unlicensed in-copyright images of Mickey Mouse in its training data—can nonetheless generate images that "could be judged substantially similar to 'Mickey Mouse'" (Figure 1). The training data contain licensed personal photographs from Disney World that include Mickey Mouse, and the model generalizes from these to produce novel images resembling the character. This is a direct empirical demonstration of Mismatch 2: removal of specific observed information (in-copyright Mickey Mouse images) did not prevent outputs that could infringe on the same copyrighted character. The paper notes that this also raises causation questions for copyright litigation: "there may be other copies or derivative works of the plaintiff's work in the training data," so removing the plaintiff's specific work does not guarantee the counterfactual model would behave differently (citing Cooper et al., 2025; Kandpal et al., 2025).

Removal as a remedy is both overbroad and potentially ineffective. The paper argues that targeting higher-order concepts like "Spiderman" through removal of observed information faces a dilemma: "to prevent a model from generating a cartoon that looks too similar to Mickey Mouse, we might have to make it unlearn other concepts that are not themselves infringing, like other cartoon mice or rodents" (Section 5.1). Simultaneously, removal of only specific instances may be under-inclusive because of the latent information problem (Figure 1). The paper also identifies a limitation specific to copyright: removal "could prevent transformative, non-infringing uses of the example in addition to potentially infringing ones," and "none of the unlearning methods we have described can or do distinguish between transformative fair uses and non-transformative superseding uses" (Mismatch 5 applied to copyright).

The causation counterfactual fails due to training non-determinism. The paper raises a technical objection to using retrained (gold-standard) models as causation evidence: "training is non-deterministic. Two models trained on the same dataset (let alone different ones) may generate significantly different sets of outputs for the same prompt." This connects to Mismatch 3 (models ≠ outputs) and cites Cooper et al. (2022) on non-determinism in ML code and Hayes et al. (2025) on challenges for membership inference attacks. The implication is that even the "gold standard" cannot serve as reliable evidence of what the original model would have produced without the plaintiff's work, because the retrained model's outputs are a function of both the modified training data and the random seed, data ordering, and other non-deterministic factors (citing Dodge et al., 2020; Cooper et al., 2023).

Privacy Analysis (Section 5.2)

The headline finding is that privacy law spans three distinct goals—data deletion, output suppression of training data, and output suppression of inferred information—and these goals map onto different information targets (observed, observed/latent, and latent, respectively), making it impossible for any single unlearning method to satisfy all simultaneously. The paper further argues that these goals can be in tension, particularly when implementing suppression requires retaining the information to be filtered (footnote 45).

Data deletion (removal of observed information) is the most natural match but faces practical barriers. The paper acknowledges that "data deletion is most straightforwardly implemented by retraining a model from scratch" with the requesting individual's examples removed, but immediately notes two problems: (1) structural removal methods "are not currently widely usable for generative-AI contexts" because they require custom training procedures that deployed models did not use, and approximate methods "do not guarantee that the targeted training data are actually removed" (Mismatch 1); and (2) there are "significant technical challenges in identifying all instances of training data that meet certain privacy-relevant criteria within large-scale datasets," including the boundary problem of whether to remove only images of the data subject, family photos where they appear in the background, etc. The paper does not cite specific performance numbers for this identification task, but frames it as an open problem (citing Brown et al., 2022 on what it means for a language model to preserve privacy; Lee et al., 2023 on provenance challenges in training datasets).

Output suppression of training data (and information that resembles it) corresponds to the Google Spain interpretation of the "right to be forgotten." The paper cites the CJEU's 2019 ruling (Google LLC v. CNIL, Case C-507/17) which required Google to de-reference search results (a form of suppression) but "did not necessarily require deleting that information from underlying data storage" (Section 5.2). This establishes a legal precedent where suppression—not removal—is deemed sufficient, which the paper treats as evidence that "the appropriateness of unlearning methods for removal or suppression to operationalize compliance with legislation will depend on the exact details" of the legal domain in question. The paper argues that suppression under this interpretation "would be subject to a test of reasonable or proportionate effort, with effectiveness determined by an evaluation of how difficult it would be to extract the suppressed information from the model following the application of technical or procedural interventions, for example, through red teaming" (citing Feffer et al., 2024; Chouldechova et al., 2024). This connects to Mismatch 1: suppression may suffice when the legal goal is preventing access, not when it requires deletion.

Latent information inferences pose a distinct privacy challenge that neither removal nor typical suppression addresses. The paper's key insight in this domain is that "many privacy practitioners have come to recognize that simply restricting the collection or processing of certain training data may not mitigate privacy concerns" because models can "infer information about a particular data subject based on latent information derived from similar data subjects who have consented to (or not objected to) data processing" (the example of inferring p0's health status from p1, ..., pn's data in Mismatch 3). The paper notes that California privacy regulators "view such inferred information to still be personal information about consumers over which they can exercise their rights, when such information is used to make a profile about them" (citing CCPA). This creates a regulatory requirement that neither removal of training data (which doesn't prevent inference from latent information—Mismatch 2) nor output suppression targeting verbatim training data (which may not catch novel inferences) can satisfy alone.

The three privacy goals interact in tension. The paper identifies a concrete practical tension: "implementing an output suppression intervention may require a system operator to retain the information that should be prevented from being surfaced, in order to filter out this information from an output or filter out prompts that aim to solicit it." This means that pursuing the suppression goal can directly conflict with the deletion goal—to filter out information, you need to have it. The paper cites the Facebook NCII example as a pre-generative-AI illustration of the same tension (Hern, 2017). It also notes that "removal of training data, meanwhile, may create the (as we have seen, false) impression that a model will not be able to output a specific piece of information"—a risk that connects Mismatch 2 to a practical harm: false confidence in privacy protection leading to inadequate supplementary safeguards.

Safety Analysis (Section 5.3)

The headline finding is that safety is not a property of the model in isolation—it depends on user knowledge, system-level context, and downstream verification processes—making unlearning structurally incapable of eliminating dual-use risks from generative-AI systems. The paper further argues that the goal of removing "dangerous knowledge" targets an ill-defined higher-order concept, and that attempts to bound this concept for removal face an unavoidable over-inclusiveness/under-inclusiveness tradeoff.

"Dangerous knowledge" as a higher-order concept cannot be cleanly bounded for removal. The paper critiques proposals like Bengio et al. (2024), which claims in the International Scientific Report on the Safety of Advanced AI that "'Machine unlearning' can help to remove certain undesirable capabilities" such as those "that could aid malicious users in making explosives, bioweapons, chemical weapons, and cyberattacks" (Section 5.3, quoting the report). The paper argues that topics like "synthetic biology or chemistry" are "broad and under-specified, and relate to all sorts of information both directly in the training data and latent across training data." The key challenge: "How should one go about determining reasonable boundaries for which training examples should be kept and which should be targeted for removal?" The paper frames this as an instance of Mismatch 2's boundary problem, made more acute by the dual-use nature of the information: "many potentially dangerous items can be assembled using training data that are themselves innocuous or have significant legitimate uses. For instance, from all of the information in a high school chemistry curriculum, it is possible to derive formulas for toxic molecules. But removal of all knowledge of high school chemistry to foreclose the possibility of the model containing or producing such latent information is likely overbroad" (Mismatch 5). The paper also cites Łucki et al. (2024) for showing that "even after unlearning information related to biohazards to reduce unsafe question-answering capabilities, ... it is possible to recover such capabilities by further training the model on unrelated benign information," demonstrating that the removed capabilities were not cleanly isolatable.

Output suppression interacts with in-context "ununlearning" (Mismatch 3 applied to safety). The paper argues that safety evaluations using benchmarks like WMDP (multiple-choice questions about biological, chemical, and cybersecurity risks) may fail to detect that suppressed knowledge can be reintroduced through in-context prompting. The specific mechanism: "via their prompts, end-users can introduce additional information into the model's context at generation time. This information could be otherwise absent from the model's training data and not reflected in the model's parameters. It could also overlap with or reflect training data that was removed from the model using an unlearning method. By bringing this information back into the generative-AI system via the prompt, the model can still be used to reason about the information it has unlearned" (Section 5.3, citing Shumailov et al., 2024). The paper notes that "evaluations for the success of unlearning methods in safety contexts often do not explicitly test for this issue," and that the WMDP multiple-choice format "does not allow for the type of more open-ended reasoning that this scenario presents." This is a direct application of Mismatch 3: the evaluation measures outputs under specific constrained conditions, but the model's latent capability to produce dangerous outputs under different conditions (with in-context prompting) may be unchanged.

Mismatch 4 (models ≠ downstream use) is most consequential for safety. The paper argues that unlearning cannot solve the dual-use problem because safety depends on factors outside the model. The central examples:

The "single missing piece" scenario: "What if the user already has a recipe for making such a molecule (obtained from another source), and the generative-AI model lowers the barrier for creation of the molecule for the user by explaining, in detail, how to understand nuances of the recipe that they do not understand on their own? What if the model provides a single 'missing piece' of information that is innocuous on its own (e.g., details of a single chemical reaction) that, in combination with everything else this user knows, enables them to create the molecule?" (Section 5.3). The paper cites Glukhov et al. (2024) on unsafe information leakage in "safe" responses and Jones et al. (2024) on adversaries misusing combinations of safe models.
The molecular generation system: "one of the purposes of such a system is to lower the barrier of expertise required for drug discovery. Even so, currently, a generative-AI system cannot on its own definitively determine that the molecules it produces are safe for human consumption; this is the point of lab experiments and drug trials" (citing Terwilliger et al., 2023 on AlphaFold). The paper's point is that safety is determined by downstream processes (lab testing, clinical trials, regulatory review), not by any property of the model or its outputs.
The user expertise variable: "knowledge of how to actually produce such a molecule is not a property of the model in isolation. The ability to actually synthesize it also depends on the knowledge of the user" (citing Soice et al., 2023 on whether LLMs can democratize access to dual-use biotechnology). The paper references OpenAI's Preparedness Framework (2023) and the Frontier Model Forum's safety frameworks as acknowledging this user-dependence by categorizing risks in relation to both model capabilities and user expertise levels.

The conclusion from these examples is that "unlearning can perhaps limit the information in the model or suppress model outputs, such that certain types of unsafe outputs are less likely. But unlearning cannot guarantee that people or other agents will not put model outputs to unsafe uses" (Section 5.3). This is presented as a structural limitation, not a contingent one—it follows from the definition of dual-use systems and from Mismatch 4.

Ablation Studies and Robustness Checks

As a conceptual analysis paper, this work does not contain traditional ablation studies. However, the paper's structure can be understood as a series of argumentative robustness checks that test whether the mismatch framework holds across different domains, legal standards, and information targets:

Cross-domain application (robustness to legal domain): The paper applies the same five-mismatch framework to copyright (Section 5.1), privacy (Section 5.2), and safety (Section 5.3). These three domains were chosen, implicitly, because they represent distinct types of legal regimes with different standards of evidence, different definitions of harm, and different relationships to the information targets in Appendix C. The finding is that the framework generates non-trivial, domain-specific insights in all three cases—it is not tailored to any single domain. If the framework only generated useful insights for privacy but not for copyright, or vice versa, that would suggest it overfits to domain-specific features rather than capturing structural properties of unlearning methods. The paper's demonstration of cross-domain consistency argues for the framework's generality.

Information target variation (robustness to what kind of information is at stake): Within the privacy analysis, the paper tests the framework against three distinct privacy goals that target different information types: data deletion (observed information), output suppression of training data (observed/latent), and suppression of inferred information (latent). The finding is that the same mismatches manifest differently depending on the information target: Mismatch 1 is most salient when the goal is deletion but a suppression method is deployed; Mismatch 2 is most salient when the goal is preventing outputs but a removal method is used; Mismatch 3 is most salient when latent inferences are the concern. If a single mismatch dominated all three privacy goals, it would suggest the framework lacks discriminatory power. The variation in which mismatches are salient for which goals demonstrates the framework's precision.

Legal interpretation variation (robustness to how strictly the law is interpreted): The paper tests its framework against different interpretations of the same legal requirement. The GDPR "right to erasure" example: under one interpretation (which the paper attributes to many ML researchers), Article 17 requires removal of personal data from trained models, making Mismatch 1 fatal to suppression-only approaches. Under another interpretation (the Google Spain ruling), de-referencing/suppression may suffice, making the test "reasonable effort" rather than guaranteed deletion, and changing which unlearning methods are acceptable. The paper does not argue for one interpretation, but rather shows that the framework helps identify which interpretation would need to hold for a given unlearning method to satisfy the requirement. This serves as a robustness check: the framework's utility does not depend on taking a specific legal position; it depends only on making the relationship between methods and requirements explicit.

The "ununlearning" boundary condition (robustness to adversarial extraction): The paper explicitly discusses whether suppression methods are robust to adversarial attempts to re-extract suppressed information. The finding from Shumailov et al. (2024) that "unlearned knowledge gets reintroduced in-context" serves as a negative result: suppression methods that pass benchmark evaluations may fail under adversarial conditions where users supply information in prompts that re-activates latent knowledge. The paper cites this as evidence that evaluation methodology (Section 3.2) systematically under-tests suppression methods, and connects it to Mismatch 3. If suppression were robust to all extraction methods, Mismatch 3 would be less consequential—the paper's argument depends on the empirical observation (from prior work) that it is not. The paper does not itself evaluate robustness, but it assembles evidence from multiple sources (Shumailov et al., 2024 on in-context reintroduction; Łucki et al., 2024 on fine-tuning recovery; Tamirisa et al., 2024 on tamper-resistant safeguards for open-weight models) to argue that robustness failures are systematic.

The CommonCanvas "natural experiment" (robustness to removal of observed information): Figure 1 is treated as an existence proof that Mismatch 2 is real and consequential. It demonstrates that a model trained without specific in-copyright images can still produce outputs resembling the copyrighted character, validating the claim that removal does not guarantee output suppression. This is not an ablation the paper conducted—it is a "found" ablation from prior work (Gokaslan et al., 2023) that the paper reinterprets through its framework. If CommonCanvas could not produce Mickey Mouse–like outputs, the argument for Mismatch 2 would be logically valid but empirically weak for the copyright domain. The existence of this example strengthens the paper's claim that Mismatch 2 is not merely a theoretical possibility but a practically observed phenomenon.

Negative result: The "gold standard" is not gold for output suppression. The paper explicitly identifies a negative result for the conventional unlearning evaluation paradigm: the "gold standard" of retraining from scratch is only "gold" for the narrow goal of ensuring specific training data did not influence model parameters, not for the broader goal of controlling model outputs (Section 3.1). The paper demonstrates this negatively by showing that CommonCanvas—which implements the gold standard for Mickey Mouse images (those images were never in the training data)—still produces Mickey Mouse–like outputs. This negative result is central to the paper's argument because it shows that the very baseline against which unlearning methods are typically evaluated is itself insufficient for the policy goals unlearning is claimed to serve.

Critical Assessment

The paper's central claims are conceptual rather than empirical, so the standard for "supporting evidence" is different from a typical experimental paper. The question is not whether the experiments have sufficient statistical power or appropriate baselines, but whether the logical arguments and cited evidence convincingly establish the existence and significance of the five mismatches, and whether the domain-specific analyses demonstrate that the framework generates non-obvious insights that would not be visible from a generic "unlearning has limitations" position.

Claim 1: The five mismatches are structural, not contingent limitations of current methods. The paper argues that Mismatches 1–5 arise from the fundamental properties of removal and suppression methods and the relationships between different information targets, and that they would persist even with perfect technical execution. This claim is logically defended rather than empirically tested. The strongest evidence for structurality is the cross-domain analysis: the same mismatches generate relevant insights in copyright, privacy, and safety, which have different legal standards, different information targets, and different compliance requirements. If the mismatches were contingent on specific implementation details of current methods, we would expect them to manifest differently or not at all in domains with different requirements—but the paper shows they consistently arise.

The specific structural arguments for each mismatch:

Mismatch 1 (suppression ≠ removal) is structural because suppression methods by definition leave information in model parameters; no amount of improvement to suppression accuracy changes this property. The paper's point is definitional, not empirical.
Mismatch 2 (removal ≠ output suppression) is structural because outputs are generated from latent information distributed across many training examples; removing specific observed examples cannot eliminate latent information that is reconstructable from remaining examples. The CommonCanvas example (Figure 1) provides empirical grounding, but the structural claim is that this is a property of how generalization works in neural networks generally, not a contingent fact about CommonCanvas specifically. The paper does not provide a formal proof of this property, and some might argue that it is an empirical question whether similar outputs are always reconstructable—but the paper's weaker version of the claim (that removal provides no guarantee of output suppression) is logically sound: the gold standard guarantees absence of specific training data, and since latent information is not a function of any single training example, this guarantee doesn't extend to outputs.
Mismatch 3 (models ≠ outputs) is structural because outputs depend on both model parameters and input context; a given parameter state is consistent with many output behaviors depending on prompting. This is definitionally true given how generative models work (output = model(prompt, parameters)), and Shumailov et al. (2024) provides empirical evidence that suppressed knowledge can be recovered through in-context prompting. The structural claim is that no output-based evaluation can certify that information is absent from model parameters—only that it was not expressed under specific test conditions.
Mismatch 4 (models ≠ downstream use) is structural because downstream use involves agents and contexts external to the model; controlling the model cannot control these external factors. This is definitionally true given the definition of downstream use as involving agents other than the model. The paper's structural claim is that unlearning cannot solve the dual-use problem because dual-use is defined by the relationship between an artifact and its use context, not by intrinsic properties of the artifact.
Mismatch 5 (unintended consequences) is structural because information in neural networks is entangled; targeting one piece of information affects others in ways that are not fully predictable without complete knowledge of the model's representational structure. The paper cites empirical evidence for this property (Huang et al., 2024 on adversarial unlearning destroying accuracy; various works on utility degradation from unlearning), but the structural claim is that entanglement is a property of distributed representations generally, not a bug in current architectures. This claim is widely accepted in the deep learning literature, so the paper's burden of proof is low.

Weakness: The paper does not engage with potential counterarguments to structurality. A proponent of unlearning research might argue that future methods could disentangle representations sufficiently to enable surgical removal without collateral damage—for instance, through advances in mechanistic interpretability (the paper briefly mentions this line of work in Appendix C but does not engage with it as a potential counterargument to Mismatch 5) or through fundamentally different model architectures that are designed from the ground up to support unlearning (the paper acknowledges that current models are not compatible with structural removal methods, but does not discuss whether future models could be). The paper's structural claims are strong, and while they are well-defended for the current paradigm, the paper does not address the possibility that the paradigm itself could change in ways that dissolve some mismatches.

Claim 2: The information target taxonomy (observed, latent, higher-order) is a useful diagnostic vocabulary that reveals why different unlearning goals require different methods. This claim is validated primarily through the privacy analysis (Section 5.2), which shows that three distinct privacy goals map onto different information targets and that the same unlearning method can satisfy one goal while failing another. The analysis is logically sound and the mapping from goals to targets is clearly articulated. However, the paper does not provide a systematic method for determining which target a given legal requirement maps onto—it relies on expert legal analysis, and different legal interpretations could produce different target mappings. This is not a flaw (the paper is explicit that law and policy require contextual interpretation), but it means the framework's utility depends on the quality of the legal analysis that feeds into it, which is not itself validated by the paper.

Claim 3: Unlearning is not a general-purpose solution for making generative-AI models and their outputs compliant with any desired policy goals. This is the paper's strongest-supported claim, because it essentially follows from the conjunction of the five mismatches. If (1) suppression doesn't equal removal, (2) removal doesn't guarantee output suppression, (3) models aren't equivalent to their outputs, (4) models aren't equivalent to downstream use, and (5) unlearning has unintended consequences—then no single unlearning method can simultaneously satisfy all possible legal requirements that might be imposed on a model. The domain analyses in Section 5 provide concrete illustrations of this general claim, showing that even within a single domain (privacy), different goals require different methods, and that across domains (copyright vs. safety), the same method (e.g., output suppression) may be adequate for one but insufficient for another. The paper's conclusion that unlearning is "just one approach among many others" (Section 6) follows directly from this conjunction of mismatches.

Genuine weaknesses and untested claims:

No empirical evaluation of the framework's predictive power. The paper demonstrates that the framework explains why unlearning fails as a general-purpose solution, but it does not demonstrate that the framework predicts failures that would not be obvious without it. The paper would be stronger if it identified a specific unlearning claim in the literature, applied the framework to it, and showed that the framework reveals a problem that prior critiques missed. The WMDP example and the Bengio et al. (2024) quote are gesturing in this direction, but the analysis is post-hoc (explaining why the claim is problematic) rather than predictive (identifying a problem before it was known).
The paper does not quantify the practical significance of the mismatches. Are the mismatches equally severe in all domains, or are some domains more tolerant of them? The paper notes that suppression may be sufficient for certain privacy goals (Google Spain precedent) but not for others, and that copyright's penal regime makes the consequences of mismatch failure more severe than privacy's (statutory damages vs. regulatory fines), but it does not provide a systematic framework for assessing mismatch severity across domains. This limits the framework's practical utility for policymakers trying to decide which interventions to prioritize.
Limited engagement with the possibility that unlearning might still be "good enough" for some purposes even with the mismatches. The paper's tone is cautionary throughout, and it acknowledges in Section 6 that unlearning "may offer limited benefits that support certain outcomes for law and policy." However, it does not provide positive guidance on which outcomes unlearning can support, or criteria for determining when unlearning is an appropriate tool despite the mismatches. The framework is excellent for diagnosing failures but less developed for identifying success conditions. Section 6 gestures at "reasonable best efforts" standards but does not operationalize what those would look like for specific unlearning methods in specific domains.
The paper does not address the possibility of combining unlearning with other interventions to bridge the mismatch gaps. The conclusion notes that unlearning should be viewed as "just one approach among many others," but it does not analyze how unlearning might complement other interventions (acceptable use policies, red teaming, output filtering, access controls, licensing restrictions) to collectively achieve policy goals that unlearning alone cannot. This is arguably outside the paper's scope (it's a diagnostic paper, not a solutions paper), but it leaves the reader with a clearer sense of what doesn't work than of what does.
The CommonCanvas example (Figure 1) is compelling but limited to one model, one character, and one domain (copyright). The paper relies heavily on this example to demonstrate Mismatch 2, but it does not provide similar concrete examples for privacy (e.g., a model retrained without an individual's data that still produces their phone number) or safety (e.g., a model that passes WMDP after unlearning but still provides dangerous information under adversarial prompting). The paper cites work that provides such examples (Shumailov et al., 2024; Łucki et al., 2024), but does not present them with the same level of detail as the CommonCanvas case. A more balanced empirical grounding across all three domains would strengthen the argument.
The paper's treatment of evaluation methodology could be more precise. Section 3.2 describes how suppression methods are evaluated (prompt and check outputs, use WMDP benchmark, etc.), and Mismatch 3 argues that these evaluations are systematically limited. However, the paper does not provide a systematic framework for how evaluations should be designed to account for the mismatches—for instance, what would a WMDP-like benchmark need to look like to test for "ununlearning" via in-context prompting? What evaluation protocol would distinguish between "the model no longer knows X" and "the model knows X but isn't expressing it under the test conditions"? The paper identifies the problem with current evaluation practices but does not propose a solution, which limits its actionable guidance for ML researchers.

Conditional claims identified across the paper:

The claim that removal does not guarantee output suppression (Mismatch 2) holds universally as a logical point about guarantees, but its practical significance depends on (a) how much latent information about the removed data exists in the remaining training data, (b) how easily that latent information can be activated through prompting, and (c) whether the specific legal standard requires guarantees or merely reasonable efforts. The CommonCanvas example shows the practical significance for one case; the paper does not provide evidence about how common such cases are across models, domains, and removal targets.
The claim that unlearning cannot solve dual-use safety problems (Mismatch 4) holds for the most expansive versions of that claim (unlearning as a standalone solution to prevent all harmful uses), but the paper acknowledges weaker versions might be more defensible: unlearning as one component of a broader safety strategy, where it reduces the likelihood of certain dangerous outputs but does not guarantee their elimination. The paper's critique is most forceful against the strong claim (represented by the Bengio et al. 2024 quote) and less developed for moderate claims that unlearning is a useful but incomplete tool.
The claim that unlearning methods cannot distinguish fair use from infringement for copyright (Section 5.1) holds exactly because those distinctions are context-dependent and legally contested. It is a claim about the current state of both technology (no method can make this distinction programmatically) and law (the distinction cannot be reduced to an algorithm). If future legal developments were to establish bright-line rules for what constitutes fair use in generative-AI contexts, the technical feasibility of operationalizing those rules in unlearning methods would be a different question—but the paper does not explore this possibility.

6. Limitations and Trade-offs

6.1 No Empirical Validation of the Framework's Predictive Power or Practical Utility

The assumption or constraint: The paper positions its five-mismatch framework as a diagnostic tool that reveals why unlearning fails as a general-purpose compliance mechanism. However, the framework is validated only through post-hoc explanation—applying it to known problems and showing that it explains them—rather than through any demonstration that it predicts problems that are not already obvious, generates novel actionable guidance, or improves decision-making by practitioners. The authors are transparent about the paper's nature as a conceptual analysis, explicitly stating in Section 3:

"We deliberately do not provide an in-depth survey or taxonomy of state-of-the-art techniques that are branded as machine unlearning methods. ... Instead, our purpose here is to provide sufficient framing to elicit important conceptual gaps and limitations."

The consequence: The framework's practical value remains unproven. A policymaker reading the paper learns that unlearning has structural limitations, but does not learn how to distinguish between situations where the mismatches are fatal versus tolerable. An ML researcher reading the paper learns that suppression and removal are different goals but does not learn how to design evaluations that account for this difference beyond the general observation that output-based evaluation is insufficient (Mismatch 3). The paper argues that the framework is portable to other domains ("in any legal or policy context, we can ask how the core conceptual mismatches involving unlearning play out in practice"—Section 7), but this claim of portability is itself untested. Without validation that the framework actually improves analyses beyond what domain experts would produce without it, its contribution remains at the level of a useful conceptual vocabulary rather than a validated diagnostic methodology.

What evidence exists in the paper: There is no empirical evidence. The paper's three domain analyses (Sections 5.1–5.3) are existence proofs that the framework can be applied, not evidence that its application produces insights that are non-obvious, correct in their predictions, or useful for decision-making. The paper does not compare its analysis against alternative framings, does not survey practitioners to assess whether the framework clarifies their thinking, and does not identify a specific unlearning deployment where applying the framework would have changed the outcome.

Mitigation status: The paper does not address this limitation or propose validation. It is inherent in the paper's chosen genre—a conceptual analysis piece with a cross-disciplinary author list intended to "encourage effective cross-disciplinary communication about machine unlearning" (footnote 3). The limitation is arguably acceptable for a paper whose primary contribution is reframing the conversation rather than providing operational tools, but it means the paper should be read as a starting point for more rigorous cross-disciplinary work rather than as a validated decision-making framework.

6.2 No Positive Guidance on When Unlearning Is Appropriate Despite the Mismatches

The assumption or constraint: The paper's argument is structured almost entirely around demonstrating what unlearning cannot do. It identifies five structural mismatches and applies them to show that unlearning fails as a general-purpose compliance mechanism. However, the paper provides minimal guidance on the positive case: under what specific conditions, for which specific legal requirements, and with which specific unlearning methods, might unlearning actually be the right tool? The paper acknowledges in Section 6 that unlearning "may offer limited benefits that support certain outcomes for law and policy," and in Section 1 that "unlearning techniques may offer limited benefits that support certain outcomes for law and policy," but these caveats remain at the level of abstract possibility rather than concrete criteria.

The consequence: A practitioner reading the paper is left with a clear understanding of why unlearning will probably fail for their use case, but very little guidance on when it might succeed, what "reasonable best efforts" (Section 6) would look like, or how to weigh unlearning against alternative approaches. The paper correctly identifies that the appropriateness of unlearning "depends on the exact details" of the legal domain, "the circumstances of the use that exposes information," and whether "atypical, adversarial usage pattern is necessary for exposure" (Section 4, Mismatch 1). It further notes that "suppression methods could be deemed acceptable if courts accept the empirical evaluations of these methods" (Section 5.1) and that in some privacy contexts, de-referencing/suppression may be sufficient (Google Spain, Section 5.2). But these observations are not synthesized into a decision procedure. The paper also does not analyze how unlearning might complement other interventions—acceptable use policies, red teaming, output filtering, access controls, licensing restrictions—to collectively achieve policy goals that unlearning alone cannot. The recommendation that unlearning should be viewed as "just one approach among many others" (Section 6) is sensible but underspecified: which other approaches, in which combinations, for which gaps that unlearning leaves?

What evidence exists in the paper: The paper contains scattered positive signals. The privacy analysis (Section 5.2) identifies the Google Spain precedent as a case where suppression (not removal) was legally sufficient, implying that unlearning-as-suppression might be appropriate for privacy goals focused on preventing access rather than ensuring deletion. The analysis also notes that differential privacy might address some privacy concerns without requiring unlearning (footnote 39). The copyright analysis (Section 5.1) suggests that removal of specific training examples (the "gold standard") might be relevant for causation counterfactuals, even if it does not guarantee output suppression. But these signals are not organized into a systematic framework for determining when unlearning is the right tool.

Mitigation status: The paper does not attempt to provide this positive guidance, and the limitation is acknowledged only indirectly through the caveats that unlearning "may offer limited benefits." The paper's focus on diagnosis over prescription is a deliberate scope choice—it is a diagnostic paper, not a solutions paper—but it means the framework is asymmetric: strong on identifying problems, weak on identifying solutions. A practitioner who accepts the paper's critique would need to look elsewhere for guidance on what to do instead.

6.3 Reliance on a Single Concrete Empirical Example (CommonCanvas, Figure 1) for the Central Mismatch 2 Claim

The assumption or constraint: Mismatch 2—that removal of training data does not guarantee output suppression—is the linchpin of the paper's argument that even the "gold standard" of retraining is insufficient for many policy goals. The paper grounds this claim empirically in a single example: the CommonCanvas model (Gokaslan et al., 2023), which was trained exclusively on Creative Commons–licensed images and can nonetheless generate images resembling Mickey Mouse (Figure 1, discussed in Section 5.1). The paper also provides a thought-experiment example (phone number reconstruction) and cites prior work on memorization and extraction (Carlini et al., 2023; Nasr et al., 2023) as evidence that models can reconstruct training-like data. However, the CommonCanvas example is the only concrete, visually demonstrated empirical instance in the paper of Mismatch 2 causing a policy-relevant failure.

The consequence: The strength of the Mismatch 2 argument depends on how representative the CommonCanvas case is. If Mickey Mouse is an unusually robust concept because the character is represented in many different forms across many different contexts (merchandise, theme park photos, fan art, costumes), then a model trained on diverse licensed images might be able to reconstruct a reasonable facsimile even without direct access to the original copyrighted images—but this might not generalize to other copyrighted works that are represented more narrowly. The paper does not provide evidence about whether similar reconstruction is possible for, say, a specific photograph (which has fewer latent representations in other training data), a specific text passage (where verbatim memorization might be the only path to reproduction), or a specific chemical formula (where exactness matters for safety). The phone number example in Section 4 (Mismatch 2) is a thought experiment rather than an empirical demonstration. The paper also does not quantify how likely such reconstruction is—the CommonCanvas example shows it is possible, not that it is likely or that it represents a typical case. For a policymaker deciding whether removal-based remedies are worth pursuing, the distinction between "can sometimes happen" and "will typically happen" matters enormously.

What evidence exists in the paper: Figure 1 is the central piece of evidence. The caption reads: "One can think of CommonCanvas as a 'gold-standard' model that does not contain in-copyright images of Mickey Mouse: the only training data that contain Mickey Mouse expression are from personal photographs, e.g., (a). Even without unlicensed, in-copyright training images of Mickey Mouse, the model can generate outputs that resemble 'Mickey Mouse,' e.g., (b)." The paper does not provide quantitative evaluation of how often CommonCanvas produces Mickey Mouse–like outputs, how similar those outputs are to specific copyrighted images (as opposed to the generic concept of the character), or whether similar reconstruction is possible for other copyrighted characters or works. The paper cites additional prior work in the same paragraph (Cooper et al., 2025; Kandpal et al., 2025) for the general claim that "there may be other copies or derivative works of the plaintiff's work in the training data," but these are presented as supporting references rather than as additional empirical demonstrations within the paper itself.

Mitigation status: The paper does not address the representativeness of the CommonCanvas example or acknowledge the absence of systematic empirical evidence for Mismatch 2 across different types of content and models. The limitation is inherent in the paper's conceptual-analysis format: it draws on existing empirical work rather than conducting new experiments, and the existing work most directly relevant (CommonCanvas) was not designed as a test of unlearning efficacy. The paper's argument for Mismatch 2 is logically valid as a claim about guarantees (removal provides no guarantee of output suppression), but the practical significance of the claim—how often this matters in practice—rests on thin empirical support.

6.4 No Engagement with the Possibility That Future Model Architectures or Training Paradigms Could Dissolve the Mismatches

The assumption or constraint: The paper argues that the five mismatches are structural—they arise from the fundamental properties of how current generative-AI models are trained and how their representations work, not from contingent limitations of current implementations. For example, Mismatch 5 (unintended consequences) is attributed to the fact that "information in neural networks is entangled; targeting one piece of information affects others" (Section 4). Mismatch 2 (removal ≠ output suppression) is attributed to the fact that "latent information derived from other training data might enable [similar outputs]" (Section 3.1). The paper treats these as inherent properties of the technology. However, it does not engage with the possibility that future model architectures, training paradigms, or interpretability advances could fundamentally change these properties.

The consequence: The paper's claims are strongest for the current generation of large-scale generative models trained with standard methods on enormous uncurated datasets. They are weaker—or at least unexamined—for hypothetical future systems where:

Representations are explicitly disentangled (e.g., through architectural innovations that enforce factorization of concepts into separate representational subspaces), such that removing one concept does not affect others, potentially dissolving Mismatch 5.
Models are trained from the ground up with unlearning-compatible procedures that track data provenance and enable efficient structural removal, addressing the paper's observation that current deployed models "cannot post hoc be made compatible with these methods" (Section 3.1).
Interpretability advances enable precise identification of which parameters encode which information, enabling surgical editing rather than the coarse-grained suppression or removal approaches the paper critiques.
Training data curation becomes comprehensive enough that "latent information" about unwanted concepts is genuinely absent, not just reduced—potentially dissolving Mismatch 2 for specific well-defined targets.

The paper's argument that removal of "Mickey Mouse" is inherently unbounded because "it is unclear which set of information should be targeted for removal from the training data in order to prevent the generation of certain outputs" (Section 4, Mismatch 2) assumes that the concept cannot be circumscribed. But if future models with disentangled representations allow for concept-level editing—removing the "Mickey Mouse" direction in representation space—this bounding problem becomes a technical challenge rather than a principled impossibility. The paper does not argue that such advances are impossible, only that they do not exist today.

What evidence exists in the paper: The paper briefly acknowledges the existence of mechanistic interpretability research in Appendix C, noting that "there are ML-based methods that claim to identify latent information and make it observable in the trained model's parameters [e.g., 8, 42, 55] or indirectly through a model's outputs when the model is put to use [e.g., 25, 63, 106, 107]." These citations (Bau et al., 2018; Dai et al., 2022; Geva et al., 2021; Conmy et al., 2023; Hastings-Woodhouse, 2024; Nanda, 2023; Nanda et al., 2023) represent active research areas that could, in principle, address some of the entanglement problems underlying Mismatch 5. However, the paper does not discuss whether or how these approaches could scale to address the mismatches it identifies, and it does not engage with the possibility that future architectures explicitly designed for unlearning could change the landscape.

Mitigation status: The paper does not address this limitation. Its structural claims are presented as applying to the technology without qualification about whether they are contingent on current architectures. The paper's conclusion that "it is unlikely that technical solutions for unlearning will improve significantly anytime soon" (Section 6) is presented as a forecast rather than a logical necessity, but the basis for this forecast (beyond the structural mismatches themselves) is not provided. A reader who is optimistic about future technical advances in disentanglement, provenance tracking, or interpretability could accept the paper's diagnosis of current unlearning methods while rejecting its implicit claim that the mismatches are permanent features of the technology rather than features of current implementations.

6.5 The Three Policy Domain Analyses Are U.S.-Centric and Do Not Address Cross-Jurisdictional Variation

The assumption or constraint: The paper's legal analysis focuses on U.S. copyright law (Section 5.1), E.U. GDPR and California CCPA for privacy (Section 5.2), and a mix of U.S. and E.U. policy documents for safety (Section 5.3). The paper explicitly acknowledges this scope limitation for copyright, noting in a footnote (28): "We limit our specific discussion to U.S. copyright. Other jurisdictions exhibit differences in copyright doctrine and caselaw, for example, with respect to exceptions to copyright-holders' exclusive rights." For privacy, the analysis draws on both E.U. and U.S. sources but does not systematically compare them. The safety analysis draws on the (now-rescinded) U.S. Executive Order, the E.U. AI Act, and international reports.

The consequence: The paper's claims about which mismatches are salient for which legal domains, and what constitutes "reasonable best efforts" (Section 6), may not generalize across jurisdictions. For example:

The U.S. copyright analysis's emphasis on "substantial similarity" and "fair use" is specific to U.S. doctrine. Other jurisdictions have different infringement standards (e.g., the U.K.'s "substantial part" test with a different emphasis on skill and labor), different exceptions (e.g., broader or narrower fair dealing provisions), and different remedial frameworks (e.g., no statutory damages in many civil law jurisdictions). A suppression method that might be deemed adequate under one jurisdiction's standard could be deemed inadequate under another's.
The privacy analysis's use of the Google Spain ruling as evidence that suppression can sometimes satisfy deletion requirements is specific to the CJEU's interpretation of E.U. law. U.S. privacy law (as the paper notes with CCPA) has different requirements and different enforcement mechanisms, and the balance between removal and suppression as remedies may differ.
The concept of algorithmic disgorgement or model destruction as a remedy (discussed in Section 5.2) may be more or less available in different jurisdictions depending on their remedial doctrines.

More importantly, the paper does not analyze how the mismatches manifest when a single model or system must comply with multiple jurisdictions simultaneously—a common situation for global AI deployments. A suppression method that satisfies U.S. copyright standards might fail E.U. privacy standards, or vice versa. The mismatches might compound or conflict across regulatory regimes. The paper's framework could, in principle, be applied to each jurisdiction separately, but the paper does not demonstrate this or discuss the challenges of multi-jurisdictional compliance.

What evidence exists in the paper: The paper's copyright analysis is explicitly scoped to the U.S. (footnote 28). The privacy analysis mixes E.U. and U.S. sources but does not provide a comparative framework. The safety analysis draws on international sources but does not analyze jurisdictional differences. The paper contains no discussion of cross-jurisdictional interactions.

Mitigation status: The paper acknowledges the geographic limitation for copyright but does not acknowledge it as a broader limitation for the framework as a whole. The recommendation that policymakers should "set reasonable goals and expectations for unlearning" and think about "what should constitute reasonable best efforts in different contexts" (Section 6) implicitly acknowledges that different jurisdictions may set different standards, but the paper does not explore the implications of this for multi-jurisdictional deployment.

6.6 No Accounting for the Interaction Between Open-Weight Models and the Suppression-Removal Distinction

The assumption or constraint: The paper's analysis of suppression methods (Section 3.2) includes system-level interventions—output filters, input filters, and system prompts—alongside model modification methods. However, the paper acknowledges only briefly that open-weight models (like Meta's Llama models) break the assumption that a system-level filter can be deployed around the model. Section 6 states:

"Open-weight models, like Meta's Llama models, therefore present different challenges for unlearning. On their own, these models cannot implement system-level guardrails, with the intention of unlearning or satisfying any other purpose. In general, in order to achieve this type of functionality, developers who use open-weight models would need to implement mechanisms for output suppression in their own systems."

The consequence: For open-weight models, the distinction between model modification and system-level intervention becomes critical in a way the paper's framework does not fully explore. If the model weights are publicly available, any downstream deployer can strip out system-level filters, fine-tune the model to reverse suppression, or use the model in ways that the original developer cannot control. This means that:

Suppression methods that rely on system-level filters are inherently circumventable for open-weight models—they bind only the original developer's deployment, not the model itself. The paper's Mismatch 1 (suppression ≠ removal) takes on heightened significance: suppression leaves the information in the model, and with open weights, any downstream user can access it.
Model modification methods (fine-tuning, editing) applied to open-weight models face the additional challenge that they can be reversed through subsequent fine-tuning. The paper cites Łucki et al. (2024) in the safety context for showing that "even after unlearning information related to biohazards to reduce unsafe question-answering capabilities, ... it is possible to recover such capabilities by further training the model on unrelated benign information." For open-weight models, this is a practical attack vector, not just a theoretical concern.
The paper's policy recommendations about "reasonable best efforts" (Section 6) may need to be different for open-weight versus closed/API-based deployments. A developer who releases open weights with model-level suppression might be making reasonable efforts for their own deployment but enabling downstream circumvention—is this sufficient? The paper does not address this question.

The paper's privacy analysis (Section 5.2) discusses open-weight models' implications for data extraction (citing Nasr et al., 2023; Cooper et al., 2025) but does not analyze how the suppression-removal distinction plays out differently when weights are public. The safety analysis (Section 5.3) cites Tamirisa et al. (2024) on "Tamper-Resistant Safeguards for Open-Weight LLMs" but does not integrate this into the mismatch framework.

What evidence exists in the paper: The quoted passage from Section 6 is the paper's only direct engagement with the open-weight challenge for unlearning. The paper cites Cooper et al. (2025) for the observation that "open-weight models, like Meta's Llama models, therefore present different challenges for unlearning," and the broader reference list includes relevant work on extraction from open-weight models. But the paper does not systematically analyze how the five mismatches are affected by the open-weight setting, nor does it discuss how the "reasonable best efforts" standard might differ.

Mitigation status: The paper acknowledges the open-weight complication in a single paragraph (Section 6) but does not treat it as a limitation of its framework. The framework remains valid for closed deployments where system-level filters can be reliably enforced, but its application to open-weight models is underdeveloped. The paper's recommendations for policymakers and researchers do not distinguish between open and closed deployment contexts, which limits their practical utility given the prominence of open-weight models in the current AI ecosystem.

7. Implications and Future Directions

How This Work Changes the Landscape

This paper does not introduce a new method, benchmark, or empirical result. It introduces a diagnostic vocabulary and a reframing—and that makes its impact harder to measure but potentially more consequential than a typical technical contribution. The paper's core move is to shift the conversation about machine unlearning from "how can we make unlearning work better?" to "what are we actually asking unlearning to do, and is that thing structurally possible?" This is a category shift from optimization to alignment, and it changes what counts as progress.

The magnitude is a reframing, not a paradigm shift. The paper does not propose a new paradigm for unlearning research—it does not, for instance, argue that the field should abandon unlearning entirely or replace it with a fundamentally different approach. Instead, it provides a conceptual lens that, if adopted, would change how researchers formulate problems, how reviewers evaluate papers, and how policymakers assess compliance claims. A paradigm shift would restructure the entire research program (e.g., replacing unlearning with differential privacy or access control). A reframing keeps the research program intact but changes the questions asked within it. This paper does the latter: it keeps unlearning as a research area, but insists that researchers be precise about which of the three information targets (observed, latent, higher-order) their method addresses, which of the five mismatches apply, and what policy claims are justified given those constraints.

Reconciling prior contradictions. The paper resolves a tension that has been latent in the unlearning literature but never explicitly articulated: the tension between the original motivation for unlearning (data deletion requests, which care about observed information and removal from model parameters) and the expanded motivation (controlling generative-AI outputs, which cares about latent and higher-order information and requires suppression). Prior work has often treated these as two versions of the same problem, solvable with the same methods, evaluated on the same benchmarks. The paper demonstrates that they are fundamentally different problems, and that methods designed for one can fail for the other—not because they are poorly implemented, but because the goals themselves are incommensurate under a single technical approach. This explains why the unlearning literature contains both optimistic findings (suppression methods that pass benchmarks; Eldan and Russinovich, 2023; Li et al., 2024) and pessimistic findings (self-correction doesn't work for reasoning; Huang et al., 2023; extracted memorized data from "safe" models; Nasr et al., 2023). The optimistic papers are evaluating suppression against output-based benchmarks; the pessimistic papers are evaluating removal against parameter-level guarantees or adversarial extraction. Both can be correct simultaneously because they are measuring different things—and the paper's framework makes this visible.

Which research directions become more attractive. The paper implicitly redirects research energy away from several directions and toward others:

Less attractive: developing ever-more-sophisticated suppression algorithms evaluated only on standard benchmarks. The paper's Mismatch 3 (models ≠ outputs) and the "ununlearning" phenomenon (Shumailov et al., 2024) suggest that benchmark-based evaluation systematically overestimates suppression efficacy because it does not test for adversarial recovery of suppressed information through in-context prompting, fine-tuning, or recombination with external knowledge. A suppression method that achieves 99% on WMDP but can be circumvented with a clever prompt is not a meaningful safety improvement—it's a performance improvement on a specific evaluation that does not measure the policy-relevant property. The paper's framework suggests that research effort spent on incremental benchmark improvements without addressing the evaluation validity problem is at high risk of producing methods that look successful but fail in deployment.
Less attractive: applying removal methods (exact or approximate) developed for supervised ML to generative AI without addressing the information-target mismatch. The paper documents that structural removal methods are largely inapplicable to deployed generative-AI models (they require custom training procedures from the start) and that even the "gold standard" of retraining from scratch does not guarantee output suppression (Mismatch 2, demonstrated in Figure 1). Research that ports removal algorithms from supervised to generative settings without acknowledging these limitations is solving a problem that—for many policy goals—is the wrong problem. The paper's framework suggests that removal research should be paired with explicit analysis of whether the relevant legal standard actually requires removal (as opposed to suppression), and whether removal of observed information is sufficient given the latent information that remains.
More attractive: evaluation methodology for unlearning, particularly adversarial evaluation. The paper identifies evaluation as a critical bottleneck: current benchmarks do not distinguish between "the model no longer knows X" and "the model knows X but isn't expressing it under test conditions" (Mismatch 3), and they do not test for re-extraction of suppressed information through in-context prompting or fine-tuning (Shumailov et al., 2024; Łucki et al., 2024). The paper's framework makes evaluation research central rather than peripheral: improving unlearning methods is premature until we can reliably measure whether they work. This suggests that the field should invest heavily in developing evaluation protocols that test for the specific failure modes the mismatches predict—adversarial prompting suites, fine-tuning recovery tests, membership inference attacks adapted to generative settings—and that papers proposing new unlearning methods should be expected to report performance under these adversarial evaluations, not just under standard benchmarks.
More attractive: interdisciplinary work that maps specific legal requirements onto specific information targets and method guarantees. The paper's domain analyses (Section 5) are existence proofs that such mapping is possible and productive, but they are preliminary—each domain analysis is 2–3 pages and covers only the highest-level legal standards. The framework enables much more fine-grained work: for a specific provision of a specific statute (e.g., CCPA § 1798.105 on deletion rights, or GDPR Article 17(2) on the obligation to take "reasonable steps" to inform other controllers), what information target is implicated, which mismatches are most salient, and what combination of technical and procedural interventions would constitute "reasonable best efforts" (Section 6)? This work requires legal expertise that most ML researchers lack, and ML expertise that most legal scholars lack—making it a prime target for the kind of cross-disciplinary collaboration this paper's author list exemplifies.
More attractive: research on unlearning as a sociotechnical systems problem, not just a model-level problem. The paper's analysis of system-level suppression methods (output filters, input filters, system prompts) in Section 3.2, and its observation that these methods have largely been absorbed under the "unlearning" label despite bearing "more resemblance to alignment techniques," suggests that the field should study unlearning in the context of the broader system in which the model is embedded. This includes analyzing the interaction between model-level unlearning and system-level controls (can they compensate for each other's failures? does the retention-of-data-for-filtering tension documented in footnote 45 create unavoidable conflicts?), studying how downstream deployers of open-weight models can or cannot implement effective unlearning (Section 6), and analyzing unlearning as one component of a broader responsible-AI toolkit that includes acceptable use policies, licensing restrictions, red teaming, and access controls. The paper's systems-level framing in Appendix B (back-end vs. front-end processes, Figure 3) provides a starting vocabulary for this shift.

What becomes of the "unlearning as general-purpose solution" narrative. The paper makes it substantially harder to claim, in good faith, that unlearning alone can solve copyright, privacy, or safety problems in generative AI. The five mismatches are specific, named, and logically grounded—they cannot be dismissed as mere skepticism or as objections that better engineering will overcome. A researcher who claims their method "unlearns dangerous knowledge" must now specify which information target they address, which mismatch(es) they believe they have overcome, and how their evaluation demonstrates this. The paper raises the burden of proof for unlearning claims, and in doing so, it may slow the proliferation of methods that promise more than they can deliver—which is, in the long run, good for the credibility of the field.

Follow-Up Research This Work Enables

A systematic adversarial evaluation benchmark for unlearning claims that tests for the specific failure modes predicted by the five mismatches. The paper identifies that current unlearning evaluations—exemplified by WMDP for safety, TOFU for fictitious unlearning, and prompt-based output checking for suppression methods—do not test for the structural limitations the mismatches describe. A direct follow-up would be to construct an evaluation suite that, for a given unlearning method and target, measures: (a) whether suppressed information can be recovered through in-context prompting that reintroduces relevant context without directly asking for the suppressed content (testing Mismatch 3's "ununlearning" phenomenon, following Shumailov et al., 2024); (b) whether the method affects non-targeted information, measured as degradation on standard capability benchmarks or on counterfactual tasks that are semantically adjacent to the unlearning target (testing Mismatch 5, following Huang et al., 2024's adversarial unlearning results); (c) whether removal methods that claim "gold standard" equivalence produce models that can still generate outputs substantially similar to the removed data when provided with related latent information in the prompt (testing Mismatch 2, extending the CommonCanvas demonstration in Figure 1 to text and code domains); and (d) for suppression methods, whether adversarial fine-tuning or continued pretraining on benign data recovers the suppressed capability (testing the robustness claims from Łucki et al., 2024 and Tamirisa et al., 2024). The benchmark should span multiple domains (copyrighted content, personal data, hazardous knowledge) and multiple model scales, and it should report not just aggregate scores but per-mismatch failure rates—so that a method can be characterized as "passes Mismatch 3 test but fails Mismatch 2 test" rather than receiving a single pass/fail judgment.

A legal-technical mapping project that aligns specific statutory provisions with specific information targets and unlearning method guarantees, across multiple jurisdictions. The paper's domain analyses in Section 5 operate at the level of broad legal regimes (U.S. copyright, E.U. privacy, international AI safety frameworks). A natural next step—and one the paper explicitly invites in its conclusion ("in any legal or policy context, we can ask how the core conceptual mismatches involving unlearning play out in practice")—is to conduct a systematic legal analysis at the provision level. For each relevant provision (e.g., GDPR Article 17(1) on the right to erasure, Article 17(2) on controller obligations to inform other controllers, Article 17(3) on exceptions; CCPA § 1798.105 on deletion rights and § 1798.145 on exceptions; U.S. Copyright Act § 502 on injunctive relief, § 503 on impoundment, § 504 on damages; the E.U. AI Act's provisions on general-purpose AI systems with systemic risk), the analysis would determine: (1) what type of information does this provision care about—observed, latent, higher-order, or some combination? (2) Does the provision require removal, suppression, or is the distinction between them not legally settled? (3) Which of the five mismatches are most salient for this provision, and what would constitute "reasonable best efforts" given those mismatches? The output would be a reference document—a sort of "unlearning compliance matrix"—that ML researchers and product teams could consult when designing unlearning methods for specific regulatory contexts, rather than relying on their own (often oversimplified) understanding of the law. This project requires a multidisciplinary team of the kind this paper assembles: technical experts who understand the methods' guarantees and limitations, and legal experts who understand the doctrinal nuances and interpretive debates within each jurisdiction.

A study measuring the prevalence and practical significance of Mismatch 2 (removal does not guarantee output suppression) across different content types, model scales, and removal granularities. The paper's empirical grounding for Mismatch 2 rests primarily on a single example: the CommonCanvas model generating Mickey Mouse–like images despite being trained only on Creative Commons images (Figure 1). This is a compelling existence proof, but it leaves open the question of how common such reconstruction is across different target types. A systematic study would select a diverse set of removal targets—specific photographs (e.g., a particular news image), specific text passages (e.g., a paragraph from a copyrighted book or a specific individual's address and phone number), specific facts (e.g., the boiling point of a rare compound), and higher-order concepts (e.g., the style of a particular artist, the plot of a particular film)—and for each target, construct a "gold standard" model retrained on a dataset with all identifiable instances of that target removed. The study would then measure: (a) how often the retrained model produces outputs that a human evaluator (or an automated metric, where applicable) judges to be substantially similar to the removed content; (b) how this frequency varies with model scale (does larger scale mean more latent information, making Mismatch 2 more severe?); (c) how it varies with the granularity of removal (does removing all data from a specific domain, like all Marvel content, reduce reconstruction more than removing only direct instances of the target?); and (d) whether providing the model with partial information about the target in the prompt (e.g., the first sentence of a removed paragraph) dramatically increases reconstruction rates. This study would directly inform the policy question of whether removal-based remedies are worth pursuing for different classes of content: if reconstruction is rare for specific text passages but common for broad visual concepts, that has different implications for text-based privacy remedies versus image-based copyright remedies.

An analysis of whether the "ununlearning" phenomenon (Shumailov et al., 2024) can be systematically mitigated by combining output suppression methods with input filtering and context-window management—and whether the resulting system-level approach still satisfies the legal goals that motivated unlearning in the first place. The paper identifies in-context reintroduction of suppressed knowledge as a failure mode for suppression methods (Section 4, Mismatch 3, and Section 5.3). A natural engineering response is to combine model-level suppression with system-level interventions: input filters that detect and block prompts containing information related to the suppressed target (e.g., blocking prompts that mention specific bioweapon precursors), and output filters that catch generations that the model-level suppression missed. The follow-up research would evaluate whether such a combined system can achieve meaningfully lower extraction rates than model-level suppression alone—and, crucially, whether it does so without introducing the tension identified in the paper's footnote 45 (suppression mechanisms needing to retain the very information they are supposed to eliminate). The evaluation should use red-team-style adversarial prompting (following the methodology of Chouldechova et al., 2024) and should measure both the suppression success rate and the collateral suppression rate (how often does the combined system incorrectly block benign prompts or outputs?—testing Mismatch 5). The legal analysis component would ask: if a combined system can reduce extraction probability to, say, 0.1% under realistic adversarial conditions, does this constitute "reasonable best efforts" for a given legal standard? What extraction rate is low enough? This research would bridge the paper's diagnostic framework with the practical engineering question of what constitutes adequate mitigation.

A study of open-weight model unlearning that tests whether model-level suppression methods (fine-tuning, editing) survive adversarial post-hoc modification, and whether system-level suppression methods (filters, guardrails) can be effectively maintained when downstream deployers control the inference stack. The paper acknowledges in Section 6 that open-weight models "present different challenges for unlearning" because "on their own, these models cannot implement system-level guardrails." This is a critical gap in the paper's framework, which mostly assumes a single deployer who controls the full system. The follow-up research would take a set of open-weight models that have been subjected to unlearning (e.g., models fine-tuned to suppress hazardous knowledge using the methods from Li et al., 2024, or Tamirisa et al., 2024) and test: (a) can suppressed capabilities be recovered through fine-tuning on unrelated benign data (extending Łucki et al., 2024)? (b) Can they be recovered through model merging, parameter interpolation, or other weight-space operations that a downstream user with access to the original and unlearned model weights could perform? (c) Can system-level guardrails distributed alongside the model weights (e.g., recommended input/output filters) resist removal or modification by a technically sophisticated downstream deployer, and if so, through what mechanisms (e.g., cryptographic signing of model-serving code, hardware-based trusted execution)? The output would be a characterization of the residual risk profile of open-weight unlearning: under what threat models is unlearning of open-weight models meaningful, and under what threat models is it effectively cosmetic? This research is directly relevant to ongoing policy debates about whether open-weight release is compatible with safety and privacy obligations.

A normative analysis of what "reasonable best efforts" for unlearning should mean across different legal contexts, grounded in the mismatch framework and informed by historical analogs from other generative technologies. The paper's Section 6 recommends that "policymakers to adjust their expectations and norms concerning reasonable best efforts when relying on an unlearning method in practice," and draws an analogy to prior generative technologies like the PC and the Internet (citing Felten, 2002; Zittrain, 2008). But the paper does not operationalize "reasonable best efforts" for unlearning. A follow-up analysis—likely a law review article or policy white paper—would develop a normative framework for what constitutes reasonable effort given the structural limitations the paper identifies. It would draw on historical analogs: when copyright law had to adapt to the photocopier and the VCR, what standards of "reasonable effort to prevent infringement" were established, and how do they compare to the current generative-AI situation? When privacy law had to adapt to search engines (Google Spain), what balancing tests between data subject rights and technical feasibility were developed? The analysis would propose specific criteria for evaluating whether a given unlearning deployment constitutes reasonable effort: e.g., has the deployer identified the relevant information target for the legal requirement at issue? Have they selected a method whose guarantees align with that target? Have they evaluated the method under adversarial conditions that test the relevant mismatches? Have they supplemented the method with non-technical interventions (policy, process, user education) where mismatches leave gaps? This work would translate the paper's diagnostic framework into actionable compliance guidance.

Practical Applications and Downstream Use Cases

Regulatory compliance assessments for generative-AI deployments, where the mismatch framework serves as a due diligence checklist. When a company deploys a generative-AI system and faces a deletion request under GDPR, a takedown notice under copyright, or a safety audit under the E.U. AI Act, the framework provides a structured way to evaluate whether the company's unlearning-based response is likely to satisfy the legal requirement. Rather than asking "does our unlearning method work?"—a question that collapses removal and suppression and ignores the specific legal standard—the framework enables a more granular assessment: (1) what does this specific legal provision require—removal of observed information, suppression of outputs, or something else? (2) Which information target does our unlearning method actually address? (3) Which mismatches create a gap between what we've done and what the law requires? (4) What supplementary measures (red teaming, output filtering, user agreements, audit trails) can close that gap? The paper's finding that different privacy goals (deletion, output suppression of training data, suppression of inferred data) map onto different information targets (Section 5.2) means that a single "unlearning" deployment may satisfy one regulatory requirement while failing another—the framework helps companies identify and document these distinctions for regulators, rather than making blanket claims about unlearning efficacy that could later be challenged.

Informing judicial remedies in generative-AI litigation, particularly where plaintiffs seek model destruction, algorithmic disgorgement, or unlearning-based relief. The paper's analysis of why unlearning cannot serve as a general-purpose remedy—particularly its analysis of copyright causation (Section 5.1) and the limitations of the "gold standard" counterfactual—provides a technical basis for courts to evaluate proposed remedies. If a plaintiff in a copyright infringement suit requests that a model be retrained without their works (a removal remedy), the court can use the mismatch framework to understand what that remedy would and would not achieve: it would guarantee that the specific training examples were not observed during training (removal of observed information), but it would not guarantee that the model could never produce substantially similar outputs (Mismatch 2), and the non-determinism of training means the counterfactual model's behavior cannot be reliably predicted (Section 5.1). Similarly, if a defendant claims to have "unlearned" infringing content through suppression methods, the court can use the framework to probe whether suppression satisfies the specific legal requirement (Mismatch 1) and whether it has been evaluated under adversarial conditions (Mismatch 3). The paper's explicit connection of technical method properties to legal standards (e.g., the difference between the Google Spain suppression-is-sufficient interpretation of GDPR and the removal-required interpretation) provides a vocabulary that expert witnesses and judicial orders can use to be precise about what is being ordered and what compliance looks like. This is not hypothetical: ongoing generative-AI copyright litigation (the paper cites Cooper et al., 2025; Samuelson, 2024) is actively debating remedies, and the mismatch framework provides a structured way to evaluate the technical feasibility of proposed remedies.

Guiding procurement and auditing of "unlearning-as-a-service" offerings by third-party vendors. As unlearning matures into a commercial offering—companies that claim to remove personal data, copyrighted content, or dangerous capabilities from customer models—the mismatch framework provides a due diligence tool for purchasers and auditors. A procurement team evaluating an unlearning vendor can use the framework to cut through marketing claims: does the vendor's method target observed information (retraining-based removal) or latent/higher-order information (suppression)? If the former, does the vendor acknowledge that their method does not guarantee output suppression (Mismatch 2)? If the latter, does the vendor's evaluation include adversarial extraction testing (Mismatch 3) and measurement of collateral effects on model utility (Mismatch 5)? The paper's documentation that even the "gold standard" of retraining from scratch is insufficient for output suppression—coupled with the CommonCanvas empirical demonstration (Figure 1)—provides auditors with a concrete reference point for challenging vendor claims that their method provides comprehensive protection. The framework also enables purchasers to specify exactly what they need: a company facing GDPR deletion requests where the regulator's interpretation follows the Google Spain precedent (suppression sufficient) may be well-served by a suppression-based offering, while a company facing a court order to delete specific training data may need a removal-based offering despite its higher cost and practical challenges (Section 3.1). The framework helps match the procurement to the actual legal requirement rather than to the vendor's marketing language.

🎯 Pitch

1. Executive Summary

2. Context and Motivation

The Core Problem: Machine Unlearning Has Outgrown Its Conceptual Foundations

Why This Problem Is Important: The Stakes Are Both Technical and Legal

Where Prior Approaches Fall Short: The Expansion from Supervised to Generative AI Exposed Deep Tensions

How This Paper Positions Itself: A Cross-Disciplinary Diagnostic, Not a Methodological Contribution

3. Technical Approach

3.1 Reader Orientation

3.2 Big-Picture Architecture (Diagram in Words)

3.3 Roadmap for the Deep Dive

3.4 Detailed, Sentence-Based Technical Breakdown

Information Target Taxonomy (Appendix C)

Removal Methods (Section 3.1)

Suppression Methods (Section 3.2)

The Five Mismatches as Analytical Framework

Mismatch 1: Output Suppression Is Not a Replacement for Removal of Training Data

Mismatch 2: Removal of Training Data Does Not Guarantee Meaningful Output Suppression

Mismatch 3: Models Are Not Equivalent to Their Outputs

Mismatch 4: Models Are Not Equivalent to How Their Outputs Are Put to Use

Mismatch 5: Unlearning Can Have Unintended Consequences

Summary: How the Technical Framework Enables the Rest of the Paper

4. Key Insights and Innovations

Innovation 1: A Diagnostic Framework of Five Structural Mismatches That Reframes Unlearning from a "Better Algorithms" Problem to a "Clarify Your Goals" Problem

Innovation 2: The Three-Level Information Target Taxonomy That Makes Explicit What "Unlearning" Actually Targets—and Why This Matters for Law

Innovation 3: The Domain-Specific Application That Converts Abstract Mismatches into Concrete Policy Diagnostics—and a Template for Future Analysis

5. Experimental Analysis

Evaluation Methodology

Main Quantitative Results

Copyright Analysis (Section 5.1)

Privacy Analysis (Section 5.2)

Safety Analysis (Section 5.3)

Ablation Studies and Robustness Checks

Critical Assessment

6. Limitations and Trade-offs

6.1 No Empirical Validation of the Framework's Predictive Power or Practical Utility

6.2 No Positive Guidance on When Unlearning Is Appropriate Despite the Mismatches

6.3 Reliance on a Single Concrete Empirical Example (CommonCanvas, Figure 1) for the Central Mismatch 2 Claim

6.4 No Engagement with the Possibility That Future Model Architectures or Training Paradigms Could Dissolve the Mismatches

6.5 The Three Policy Domain Analyses Are U.S.-Centric and Do Not Address Cross-Jurisdictional Variation

6.6 No Accounting for the Interaction Between Open-Weight Models and the Suppression-Removal Distinction

7. Implications and Future Directions

How This Work Changes the Landscape

Follow-Up Research This Work Enables

Practical Applications and Downstream Use Cases

Adjacent in domain

o3-mini vs DeepSeek-R1: Which One is Safer?

OpenAI o1 System Card