{"id":"661855a4-447b-4a54-8262-5f21790b5214","arxiv_id":"2411.12600","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Provable (epsilon, delta)-unlearning algorithms for topic models achieve deletion capacity O~(m/(r^2 sqrt(nr))) before fine-tuning and O~(m q/(r sqrt(nr))) after fine-tuning, with the base model untouched in the downstream case.","lead":"This paper proves that a simple bag-of-words language model, a topic model, can forget requested training documents without being retrained, using a fast update plus calibrated noise. It also shows that forgetting is provably easier after the model has been fine-tuned to a specific classification task, as long as only the fine-tuned output is released.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The (ε,δ)-indistinguishability proofs compare coefficient matrices defined relative to potentially different anchor-word sets; Appendix B.2 never proves the original and retrained runs select the same anchors or supplies a change-of-basis argument.","rationale":"The paper's architecture is coherent: Lemma 1 supplies the Gaussian mechanism as the indistinguishability engine; Lemmas 4 and 17 convert Newton-step perturbation bounds into utility bounds; and Appendix C extends the argument to the fine-tuned head. The claims are plausible, and the conclusion honestly limits the model class. The most load-bearing link, however, is the comparison between the unlearned model (computed from the original anchor set P) and the retrained model (computed from the anchors chosen by RecoverAnchors on the reduced corpus). I agree with the reader's weakest-assumption analysis. The issue is visible inside the appendix: the proof of Lemma 15 defines C^F_i relative to Qbar^F_P without specifying that P is the retrained run's anchor set, while Algorithm 1 receives P as part of the original statistics. The later triangle inequality in Lemma 16 then mixes Lemma 13's C^F (retrained anchors) with Lemma 15's C^F (original anchors). This is not merely a notational nicety: the indistinguishability guarantee is a probability statement over output distributions, and comparing matrices whose columns are permuted or whose basis rows differ can change the sensitivity by factors that may exceed the claimed deletion capacity. The gap is likely fixable, either by coupling RecoverAnchors to show P_F = P with high probability under the deletion bound (Proposition 2 gestures at exact recovery but is stated for the original training run, not after deletion), or by adding a change-of-basis factor to the sensitivity analysis. Since the issue is a missing argument rather than a demonstrated counterexample, the appropriate verdict remains CONDITIONAL, matching the reader. An independent re-derivation of Lemma 15 with the retrained anchor set replacing the original P would settle whether the omitted basis-alignment factor is benign.","tokens_in":31572,"tokens_out":9890,"duration_ms":96127,"concrete_test":"Trace Lemma 15 with P_F := RecoverAnchors(Qbar^F) in place of the original P: replace Qbar^F_P in the definitions of C^F_i and Cbar^F_i by Qbar^F_{P_F}, and re-run the argument. If the bound ||C^F - Cbar^F||_infinity <= (4/(gamma p))(delta_2 + 4 a r m_U / (m epsilon_0)) no longer follows because Cbar^F is computed with P while C^F is computed with P_F, then the proof has a missing coordinate-alignment step. Also check whether Table 1's runtime permits re-running RecoverAnchors on Q^F; if not, the fix must be an explicit coupling bound in the appendix.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (Theorems 2 and 4) requires bounding the sensitivity of the unlearning update against the model retrained on S without S_f. Algorithm 1's Newton step uses the anchor-word set P learned from S (included in T(S)), while the retrained run Abase(S without S_f) runs RecoverAnchors on the updated co-occurrence matrix and may return a different anchor set P_F. Lemma 2 only gives geometric closeness of each recovered anchor to a true anchor; it does not assert P = P_F. In Appendix B.2, C^F is used for two different objects: Lemma 13's C^F is the coefficient matrix computed from the anchors of the retrained matrix, whereas in the proof of Lemma 15, C^F_i is defined as arg min over the simplex of ||Qbar^F_P C - Qbar^F_i||^2, i.e., coefficients relative to the original anchor set P. The Newton-update output Cbar^F lives in that same P-coordinate system, so Lemma 15 only shows closeness to coefficients expressed in the original-anchor basis; it does not bound the distance to the actual retrained coefficients unless P_F = P. The triangle inequality in Lemma 16 then concatenates two incomparable objects called C^F. Closing this gap requires either proving that RecoverAnchors returns the same indices with high probability under the stated deletion bound (stronger than Lemma 2), or adding an explicit change-of-basis or coupling argument that accounts for permuted or replaced anchors before applying the Gaussian mechanism. Without one of these, the (ε,δ)-indistinguishability part of Main Results 1 and 2 is not established as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies machine unlearning for topic models in a pretrain-fine-tune pipeline. It defines utility-preserving (epsilon, delta)-unlearning with deletion capacity, gives Algorithm 1 that performs a Newton step on the learned coefficients followed by Gaussian noise to unlearn documents from a pretrained topic model, and Algorithm 2 that unlearns pretraining documents after linear-head fine-tuning without modifying the base model. The main claims are Theorem 2: deletion capacity O~(m/(r^2 sqrt(nr))) for the base model, and Theorem 4: deletion capacity O~(m q/(r sqrt(nr))) for a downstream task depending on topics with minimum probability q; it also proves that releasing A and w separately forces base-model unlearning. The analysis builds on the Arora et al. (2012a,b) topic-model learning guarantees and a detailed perturbation analysis.","tokens_in":31754,"tokens_out":14290,"duration_ms":141144,"significance":"If correct, the paper provides the first provable unlearning guarantees for a pretrain-fine-tune pipeline, with explicit deletion capacity and algorithms whose unlearning cost is independent of the original dataset size. It also formalizes the intuitively appealing point that task-specific release can increase deletion capacity. The strengths include a mostly spelled-out proof strategy, appropriate use of the Gaussian mechanism and existing learning guarantees, and an honest statement of limitations. The main caveat is that the indistinguishability argument currently relies on an unproved anchor-set identity; this is a fixable but load-bearing gap.","major_comments":[{"comment":"The indistinguishability proof uses C^F with two different meanings. Lemma 13 (and Lemma 11) takes C^F to be the coefficient matrix produced by the retrained run using the anchor set recovered from Q^F, whereas Lemma 15 defines C^F_i as argmin_{C in simplex} ||(Q^F_P)^T C - (Q^F_i)^T||^2, i.e., coefficients expressed in the original anchor basis P. Lemma 16 concatenates these two objects via a triangle inequality, but without P_F = P the two C^F objects are not vectors in the same coordinate system. Lemma 2 only provides O(delta/(gamma p)) closeness of the recovered anchor sets to the ground-truth vertices; it does not assert that RecoverAnchors(S) and RecoverAnchors(S \\ S_f) return the same word indices. Therefore the sensitivity bound underlying the Gaussian mechanism and the (epsilon, delta)-indistinguishability statements in Theorems 2 and 4 are not fully established. Please either prove that the same anchor words are selected with high probability under the stated deletion bound, or add an explicit change-of-basis/coupling argument that handles permuted or replaced anchor words before comparing coefficients.","section":"Appendix B.2, Lemmas 13 and 15"},{"comment":"The prose says the unlearned model must be indistinguishable from the model trained on S \\ S_f, but the displayed equation compares U(S_f, A(S), T(S)) with U(empty, A(S \\ S_f), T(S \\ S_f)). For Algorithm 1, U with an empty forget set still applies the Gaussian mechanism and projection, so the right-hand side is not the raw retrained model A(S \\ S_f). The Appendix B proofs compare the unlearned output to A^F plus fresh noise; this is consistent with the equation but not with the first sentence. The definition should be repaired, for example by defining U(empty, .) to be the retraining algorithm or by stating explicitly that the guarantee is indistinguishability from the noised retrained release, because as written the formal guarantee does not exactly express the stated gold standard.","section":"Definition 4"},{"comment":"The realistic setting is described as releasing the fine-tuned model as a single matrix B = Aw in R^{n x 1}, but Algorithm 2's return statement outputs (A^S)^dagger \\bar A \\bar w + xi, an r-dimensional vector. If the released artifact is actually B = A^S times this vector, then the sensitivity and utility statements in Lemmas 29-31 should be formulated for A^S \\tilde v; if instead the r-vector itself is the released model, then the claim that the base model is not released needs clarification, since Theorem 3 shows that releasing A and w together makes unlearning as hard as the base case. Please specify the released object and adjust the algorithm and proofs accordingly.","section":"Algorithm 2 / Section 5.2"}],"minor_comments":[{"comment":"The proof concludes 'm_U <= \\tilde Omega(mq/(r^{1.5} n^{0.5}))'; this should be an upper bound on m_U with \\tilde O, not a lower bound, and the deletion-capacity statement should then be written accordingly.","section":"Appendix C.2, Lemma 32"},{"comment":"The informal Theorem 4 writes the deletion capacity as c' mq/(r sqrt(nr)), while the formal Theorem 7 has an explicit dependence on epsilon and log(1/delta) inside the min; please state in the informal result that c' depends on epsilon, delta, D, and T to avoid the appearance of a mismatch.","section":"Theorem 7 vs. Theorem 4"},{"comment":"The phrase 'Let m in N be a constant that depends on the topic modeling distribution D' is confusing, since m is used as the dataset size; please rephrase to distinguish the sample-size parameter from the distribution-dependent constants.","section":"Definition 4"},{"comment":"Proposition 3 imposes a lower bound m_U >= Omega(sqrt(m epsilon_0/(4ar))) before replacing delta_2 with the deletion term; this lower bound is not stated in Theorems 2 or 5 and should be made explicit or shown to be without loss for the claimed capacity.","section":"Appendix B.2, Proposition 3"},{"comment":"The informal statement says q in [1/r, 1], but q is defined as min_{k in T_clf} Pr_D[z = k], which can be smaller than 1/r when topics are imbalanced; either assume balanced topics or state q in [1/(ar), 1].","section":"Main Result 2"},{"comment":"Algorithm 2 computes \\bar R via Algorithm 1 but never uses \\bar R afterward; please remove it or explain its role.","section":"Algorithm 2"},{"comment":"The sentence 'This upper bound ensures that the anchor words are likely unchanged per Lemma 2' is not justified by Lemma 2 as stated, since Lemma 2 gives geometric closeness rather than identity of the selected anchor-word indices; this is the same issue as in the first major comment.","section":"Section 4.2, proof sketch of Theorem 2"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of the venue and the main ideas are creative and mostly sound. The central issue is the missing proof that the original and retrained runs use the same anchor-word indices; this is a technical gap that may be repairable with a coupling argument or a stronger anchor-recovery lemma, but it currently blocks the indistinguishability part of Theorems 2 and 4. I would be willing to revisit a revised version that closes this gap and clarifies the release model in Algorithm 2."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, this is a real contribution: it is the first provable unlearning guarantee for a pretrain-fine-tune pipeline, it defines a clean deletion-capacity notion, and the structural claim—fine-tuned models are provably easier to unlearn than base models when only the fine-tuned artifact is released—is new and interesting. Second, the central indistinguishability proof has a load-bearing gap that needs fixing.\n\nWhat the paper does well: the algorithms are concrete, the runtime comparison with retraining is honest, and the proof machinery (Newton-step sensitivity, Gaussian mechanism, perturbation analysis) is mostly spelled out. The utility bounds are derived, not fitted, and the paper is careful about what is released (Section 5.2) and about the limitation of the topic-model class.\n\nWhere the soft spots are. The big one is the anchor-word identity assumption. Appendix B.2 compares coefficient matrices defined relative to potentially different anchor-word sets. Lemma 2 only gives geometric closeness of recovered anchors, not that the same indices are selected after deletion. Lemma 13 also only gives closeness. In Lemma 15, C^F_i is defined via the original anchor set P, while the actual retrained coefficients are computed from the anchors recovered from the retrained matrix. The triangle inequality in Lemma 16 then concatenates two objects in different coordinate systems. As written, the (ε,δ)-indistinguishability part of Theorems 2 and 4 is not fully established. This is likely fixable—the authors could prove that RecoverAnchors returns the same indices with high probability under the stated deletion bound, or add an explicit change-of-basis argument—but it is not there.\n\nTwo minor issues. Main-text Lemma 6 states a directional sensitivity bound as a full matrix-norm bound; the appendix's Lemma 28 actually contains the extra quadratic term, so this is a presentation problem, not a mathematical one. The guarantee for the topic-topic covariance R is asserted rather than proved; the appendix says it is 'straightforward' and stops.\n\nBottom line: this paper deserves a serious referee. The ideas are real, the gap is likely closable, and the field needs this kind of result. Send it to review, but the reviewers should require a fix for the anchor-word identity issue before acceptance.","headline":"A genuine first step on provable unlearning for the pretrain-fine-tune pipeline, but the central (ε,δ)-indistinguishability proof has a load-bearing anchor-word identity gap that needs fixing.","tokens_in":32480,"tokens_out":3341,"would_cite":true,"duration_ms":29824,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68T50","68T05"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proves the first provable unlearning guarantees for a pre-train-then-fine-tune pipeline, using topic models; fine-tuning raises the number of documents that can be forgotten.","keywords":["machine unlearning","topic models","deletion capacity","differential privacy","Gaussian mechanism","pre-training and fine-tuning","anchor words","provable guarantees"],"falsifier":"A direct simulation can settle this: draw synthetic corpora from a p-separable topic model, train on $S$ and on $S \\setminus S_f$, and record whether the anchor-word recovery subroutine returns the same word set whenever $|S_f|$ is at the claimed deletion capacity. If the sets differ with non-negligible probability, the shared-coordinate comparison in the indistinguishability argument does not go through as written.","tokens_in":31225,"feed_emoji":"🧠","tokens_out":7769,"duration_ms":75694,"temperature":0.7,"pith_summary":"The paper asks whether data can be provably removed from a model that was pre-trained and then fine-tuned, without retraining the model from scratch. It works out an answer for topic models, the simplest bag-of-words language models, by designing two unlearning algorithms with formal guarantees. The first deletes documents from the pre-trained topic model using a Newton update plus calibrated Gaussian noise, at a computational cost that does not grow with the original dataset size. The second shows that after a linear classification head is tuned on top, pre-training data can be unlearned without modifying the base model, and that simpler downstream tasks allow more deletions. If correct, these are the first provable unlearning guarantees for the pre-training and fine-tuning paradigm.","feed_headline":"Fine-tuned models provably forget more training documents","feed_subtitle":"A linear head lets a topic model drop extra pre-training documents without retraining, with formal guarantees.","key_machinery":"The central object is the row-normalized word co-occurrence matrix $\\bar{Q}$, built by counting which words appear together in documents. Under the p-separability assumption, each topic has an anchor word whose row of $\\bar{Q}$ is a vertex of a simplex, and every other word row is a convex combination of anchor rows with coefficients $C_i$; the learning algorithm recovers the topic-word matrix $A$ from these coefficients. For unlearning, deleting documents shifts $\\bar{Q}$, and Algorithm 1 takes one projected Newton step on each $C_i$ rather than recomputing the coefficients from scratch, then rebuilds $A$ and the topic covariance $R$. Indistinguishability from retraining is obtained by adding Gaussian noise calibrated to the $\\ell_2$-sensitivity of the released matrices. The downstream algorithm confines the perturbation to the head $w$, releasing only $B=Aw$, so the base model stays untouched and the sparsity of the task head improves the deletion-capacity bound.","core_discovery":"Main Result 1 (Theorem 2) is that on a corpus of $m$ documents with $r$ topics and vocabulary size $n$, Algorithm 1 performs utility-preserving $(\\epsilon,\\delta)$-unlearning of $m_U = \\tilde{O}(m/(r^2\\sqrt{nr}))$ documents from the learned topic model $(\\tilde{A}, \\tilde{R})$. The released model is $(\\epsilon,\\delta)$-indistinguishable from a model retrained without the forgotten documents, and its entrywise error from the ground-truth topic model stays bounded. Main Result 2 (Theorem 4) considers a task that depends only on a subset $T_{\\mathrm{clf}}$ of topics, with $q = \\min_{k \\in T_{\\mathrm{clf}}} \\Pr_D[z=k]$. After head tuning, Algorithm 2 unlearns $\\tilde{\\Omega}(mq/(r\\sqrt{nr}))$ pre-training documents from the fine-tuned model $B=Aw$, without touching the base model $A$; the sparser the task's topic support, the larger $q$ and the deletion capacity. The paper also shows that if the base model and the head are released separately, unlearning reverts to the harder base-model problem, so releasing only the product $Aw$ is what buys the improvement.","pith_inferences":["Beyond the paper, the head-only mechanism suggests a design principle for large models: task-specific adaptation narrows the released surface of the model, so deletion capacity can grow with task specialization instead of shrinking.","Beyond the paper, the anchor-set coincidence assumption is directly testable and could be patched by a perturbation argument that accounts for anchor re-identification; until then the indistinguishability proof rests on a coordinate-identity premise.","Beyond the paper, the Gaussian-mechanism dependence on $1/\\sqrt{nr}$ predicts that large-vocabulary corpora support only small forget sets unless the downstream task is very simple, which could be checked empirically on real bag-of-words data.","Beyond the paper, transferring this idea to autoregressive language models would require replacing co-occurrence statistics with embedding geometry; a plausible first test is whether linear-probe unlearning still beats retraining when only the probe output is released."],"forward_implications":["Pre-training unlearning: Algorithm 1 deletes $\\tilde{O}(m/(r^2\\sqrt{nr}))$ documents from a learned topic model with update cost independent of corpus size, while keeping the model within a fixed utility loss.","Downstream unlearning: after linear head tuning, Algorithm 2 deletes $\\tilde{\\Omega}(mq/(r\\sqrt{nr}))$ pre-training documents, so simpler tasks with concentrated topic support permit more deletions.","No base modification: when the fine-tuned model is released as the single matrix $B=Aw$, unlearning happens entirely in the head, so one pre-trained base can serve many tasks with per-task deletion.","Release format matters: if both $A$ and $w$ are released separately, the head is just post-processing of the base and unlearning is no easier than deleting from the base model alone.","The guarantees are formal: each algorithm satisfies $(\\epsilon,\\delta)$-indistinguishability from retraining together with a bounded-utility condition, rather than relying on heuristic or empirical unlearning."],"supporting_citations":[{"why":"Supplies the three-phase learning algorithm and finite-sample guarantees for recovering $A$ and $R$ that the unlearning updates are built on.","marker":"Arora et al. (2012a)"},{"why":"Defines the p-separable topic-model setting, anchor words, and the $\\gamma p$-robust simplex used throughout the analysis.","marker":"Arora et al. (2012b)"},{"why":"Provides the $(\\epsilon,\\delta)$-unlearning and deletion-capacity framework that Definition 4 adapts to topic models.","marker":"Sekhari et al. (2021)"},{"why":"Supplies the Gaussian mechanism and post-processing immunity used to make the unlearned and retrained models indistinguishable.","marker":"Dwork et al. (2014)"},{"why":"Defines the gold-standard notion of a model behaving as if it had never trained on the forgotten data.","marker":"Cao & Yang (2015)"},{"why":"The closest prior unlearning work, offering weaker probe-level guarantees that this paper contrasts with its task-level deletion guarantees.","marker":"Golatkar et al. (2020)"}],"fun_headline_variants":["Fine-tuning boosts provable unlearning in topic models","Linear head enables provable unlearning without retraining","Unlearning gets easier after fine-tuning, with proofs","Provable unlearning: fine-tuning increases deletion capacity","Topic models forget more when fine-tuned, provably"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the unlearned run and the retrained run select the same anchor words, so their coefficient matrices live in one shared coordinate system; the cited lemma only proves the two anchor sets are close, not equal.","fun_headline_variants_meta":{"raw":{"variants":["Fine-tuning boosts provable unlearning in topic models","Linear head enables provable unlearning without retraining","Unlearning gets easier after fine-tuning, with proofs","Provable unlearning: fine-tuning increases deletion capacity","Topic models forget more when fine-tuned, provably"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000292,"raw_usage":{"total_tokens":1740,"prompt_tokens":1017,"completion_tokens":723,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":633,"completion_tokens_details":{"reasoning_tokens":646}},"tokens_in":633,"tokens_out":723,"duration_ms":6651,"temperature":1.0,"reasoning_tokens":646,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T17:24:26.260923+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct simulation can settle this: draw synthetic corpora from a p-separable topic model, train on $S$ and on $S \\setminus S_f$, and record whether the anchor-word recovery subroutine returns the same word set whenever $|S_f|$ is at the claimed deletion capacity. If the sets differ with non-negligible probability, the shared-coordinate comparison in the indistinguishability argument does not go through as written.","supporting_citations":[{"cited_title":"Towards making systems forget with machine unlearning","cited_arxiv_id":null,"evidence_quote":"Defines the gold-standard notion of a model behaving as if it had never trained on the forgotten data."}],"review_version":1}