Pith. sign in

REVIEW 2 major objections 4 minor 43 references

Exact LLM deletion is a property of memory representation

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 06:02 UTC pith:HMCK3OCA

load-bearing objection The representation-dependent framing is right and the Kimi replay work is solid, but the Gemma certificate is a self-consistency check and the attack results use a different proxy than the certified deletion path. the 2 major comments →

arxiv 2607.27539 v1 pith:HMCK3OCA submitted 2026-07-30 cs.LG cs.CL

Subtract or Replay? Exact Deletion from Language-Model Memory

Vishwajith Ramesh This is my paper
classification cs.LG cs.CL
keywords exact unlearningmachine deletionsupport-vector memoryrecurrent statedelta rulecounterfactual referencelanguage-model memoryin-context state deletion
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that whether a record can be deleted exactly from a language model's persistent memory is decided not by the deletion method but by how the memory stores the record. If a record's influence keeps an address — a coefficient in a support-vector fit — it can be removed by an algebraic decrement that reproduces the state of refitting without that record. If later writes transform a record's contribution inside a shared recurrent state, the paper shows a fixed decrement fails and exact deletion requires rewinding to a checkpoint before the record and replaying the suffix. The authors demonstrate the first branch in a small model whose global attention is grafted onto support-vector memory, reporting decrement/refit agreement to median KL around 1e-14, and the second branch in a 48B hybrid where replay matches never-ingesting the record bit for bit on all recurrent states. The point matters because deletion guarantees that hold at the model's output, rather than just behavioural suppression, are what memory-erasure obligations require.

Core claim

On the paper's own terms, the central discovery is that exact deletion splits into two representational regimes. In the addressable regime, a record's contribution is carried by a record-local quantity — the coefficient of a one-class support-vector memory layered onto a language model's long-range attention — and running the incremental fitting algorithm in reverse yields the exact coefficients of the fit without that record; the paper reports next-token KL agreement with a retained-key refit at median 5.4e-15, and a separately evaluated masked-refit proxy that is behaviourally indistinguishable from a never-ingested floor. In the non-addressable regime, the delta rule used by a 48B hybrid'

What carries the argument

The load-bearing object is a support-vector memory gate whose readout weights are coefficients of a one-class support-vector fit over context keys; because the fit is exactly reversible by a classical incremental algorithm run in reverse, each record has an address (its coefficient set) whose decrement returns the solve to the refit-without state. The contrast case is the delta rule in a 48B linear-hybrid's recurrent layers, where each write reads the state it changes, so a record's contribution is transformed by later writes; the paper measures suffix-dependence of 12–49% and therefore uses checkpointed rewind-and-replay as the exact fallback, audited by bitwise equality of logits and every

Load-bearing premise

The behavioural indistinguishability from the never-ingested floor is measured on a single-precision masked-refit proxy, which is never checked against the float64 decrement that carries the numerical certificate, so the two evidence streams may not describe the same deletion mechanism.

What would settle it

Run the certified float64 decrement through the same elicitation, probabilistic sampling, and membership-inference protocols on the same targets: if the decremented memory shows measurable excess over the never-ingested floor — or if the masked-refit proxy and the float64 decrement diverge on the same deletion — then the paper's 'indistinguishable from never-ingested floor' result does not hold for the actual mechanism that carries the exactness certificate. Conversely, a deletion where the float64 decrement's output KL to the retained-key refit exceeds the reported ~1e-9 bound at 12B would fa

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Deletion guarantees can be audited by output-KL or state equality against a declared record-omitted reference, not by behavioural scores that cannot separate true removal from suppression.
  • Representation design becomes a deletion strategy: memories that keep record-local bookkeeping enable cheap exact decrements, while entangled recurrent memories require rebuild-at-suffix-cost replay.
  • In hybrid models, both mechanisms are needed: the paper shows attention masking alone leaves residual or overshoots, so exact deletion must address both the addressable and blended stores.
  • Exact amendment is a corollary: replaying a corrected record from the restored boundary yields the same bitwise guarantee as deletion.
  • The addressable branch's utility cost grows steeply with model scale (2.0% at 1B to 44.3% at 12B), so the approach is near-parity only at small scale.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same subtract-vs-replay criterion could be applied to other memory architectures, e.g., state-space models with decay or test-time-training memories, predicting which are deletable by ledger correction and which require replay; the paper's separability measurement is a template for that test.
  • A stricter certificate would run the float64 decrement — not just the single-precision masked-refit proxy — through the elicitation, sampling, and membership-inference suites, directly checking whether the mechanism that carries the exactness guarantee is also the one that is behaviourally indistinguishable from never ingesting.
  • Checkpointing at record boundaries changes the cost model of deletion from compute to storage; the paper's measured 41 MiB per boundary suggests practical deletion servers could trade checkpoint sparsity and prune old checkpoints once a record is confirmed forgotten.
  • If the representation-based view is right, unlearning obligations could shift from post-hoc weight editing to architectural contracts: models deployed under erasure requirements would be selected for memories that keep record addresses, rather than repaired after the fact.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes that exact deletion from an LLM's persistent memory is determined by how the memory represents records. If a record's influence retains an address (e.g., a coefficient in a reversible solve), deletion can be an algebraic decrement; if later writes transform the record's contribution inside shared recurrent state (e.g., a delta-rule update), a fixed receipt fails and exact deletion requires rewinding to a checkpoint before the record and replaying the suffix. The authors test this distinction in two settings. On Gemma 3, they replace global attention layers with a support-vector memory, recover language quality with LoRA at 1B, and report that a float64 decrement matches a fixed-C retained-key refit at the next-token output to median KL 5.4e-15 over 31 support-token deletions; a single-precision masked-refit proxy is behaviorally indistinguishable from a never-ingested floor under elicitation, relearning, sampling, and LiRA. On a 48B Kimi Linear hybrid, they show that the delta rule makes 12-49% of a record's state contribution suffix-dependent, and that checkpointed replay gives bitwise equality with never ingesting the record on logits and recurrent states within a deterministic MLX implementation. The paper also reports scaling costs (2.0%, 11.2%, 44.3% perplexity overhead at 1B/4B/12B) and explicitly scopes its claims.

Significance. If the central claims hold, the paper offers a useful organizing principle for exact deletion in persistent LLM memory: representation determines whether subtraction or replay is the correct operation. The manuscript is unusually careful in distinguishing the numerical certificate from behavioral evidence, in naming the counterfactual reference (retained-key refit for Gemma vs. raw rebuild for Kimi), and in reporting limitations such as ingestion-time neighbor imprint and the scale dependence of utility. Strengths include the explicit counterfactual framework, the reproducible release and provenance statements, the careful measurement of delta-rule separability, and the honest acknowledgment that Kimi replay is deterministic and that checkpointing itself is not novel. The main weakness is that the certified Gemma deletion path and the behavioral evidence never meet: the float64 decrement is not run through the attack suite, and the masked-refit proxy is not compared quantitatively with the certified decrement on the same targets.

major comments (2)
  1. [§3.6, §5, Appendix D, Section 9] The certified deletion path and the behavioral evidence are disconnected. The float64 decrement is certified only against a fixed-C retained-key refit on 31 support-token deletions from a fixed 192-token prompt (median KL 5.4e-15). All elicitation, relearning, sampling, and LiRA results are obtained with the single-precision masked-refit proxy, as stated in §3.6 and Section 9. The abstract juxtaposes the decrement certificate with the proxy's behavioral indistinguishability, which could be read as attributing the behavioral result to the certified mechanism. That attribution is not established: the proxy uses a different solver, different precision, and possibly different support sets, and the certificate only covers next-token output on a narrow query distribution. This is load-bearing because the paper's headline is exact deletion, not exact refit. I request either (a) running the floa
  2. [§3.1, §3.3, Appendix F] The Gemma certificate is a self-consistency check relative to a retained-key refit, not relative to the raw record-omitted rebuild. The paper discloses this, and the imprint measurement (2.5e-4 to 1.2e-3 nats) is valuable, but the wording of the title and abstract may overstate the strength of the Gemma result. Because the retained-key refit still contains the victim's ingestion-time influence on neighboring keys, the phrase 'exact deletion' for Gemma should be consistently qualified as 'exact relative to the fixed-C retained-key refit, conditional on ingestion.' The full-repack comparison should either be presented as a separate, weaker-strength reference or be elevated as the primary counterfactual for the behavioral claims.
minor comments (4)
  1. [§3.6] The phrase 'the designed removal path' is ambiguous. Since the attack suite uses the masked-refit proxy, not the float64 decrement, clarify that the proxy is a surrogate for the designed removal path and that the certificate is the only direct evidence for the decrement.
  2. [Table 2] The 'After stored correction' column is empty for 'Additive writes only'. Either add an em-dash or a footnote explaining why no correction is needed, to avoid implying missing data.
  3. [Appendix C] The sentence 'exact remains 10−15–1.5×10−14 while decay grows 700× to 4.7×10−3' should specify the baseline from which the 700× growth is computed (e.g., decay at k=1 vs. k=30).
  4. [Figure 6 caption] The phrase 'statistically consistent with its never-stored floor' would be more precise as 'the 95% bootstrap interval for the paired difference includes zero'.

Circularity Check

2 steps flagged

Headline exact-deletion equalities are by-construction identities: Gemma's certificate checks decrement against its own retained-key refit; Kimi's rewind-and-replay is defined as the never-ingested computation. Independent content is the separability boundary and proxy controls.

specific steps
  1. self definitional [Section 3.3; Section 5; Section 9]
    "The property everything rests on is the certificate: a reserve token contributes exactly zero to the readout, and the incremental algorithm of Cauwenberghs & Poggio (2000), run in reverse, decrements any token so the solve returns to the state it would hold without it. For every deletion certificate, C is frozen at its pre-deletion value; 'retained-key refit' therefore means a fixed-C refit, not a fresh solve at unchanged ν."

    The 'record-omitted reference' for Gemma is defined, in §3.1, as the fixed-C retained-key refit of the same support-vector solve. The reverse C&P decrement is constructed to return exactly to that refit-without state, so the measured agreement (median KL 5.4e-15) is the defining invariant of the algorithm, not an independent test against a full record-omitted rebuild. The paper concedes the only independent reference (full repack) differs at 2.5e-4–1.2e-3 nats, and behavioral claims use a single-precision masked refit rather than the certified float64 decrement.

  2. self definitional [Section 3.2 ('The exact fallback follows directly'); Section 7]
    "We save recurrent and convolutional state at record boundaries, restore the checkpoint before the victim, and replay only its suffix. Within the same deterministic MLX implementation and released 8-bit weights, every admitted MIMIC deletion is bitwise exact..."

    Rewinding to a checkpoint saved before the victim and replaying the suffix is, under the same deterministic implementation, exactly the computation that never ingested the victim; comparing replay output bit-for-bit with a never-ingested reference compares a function with itself. The paper's own 'Determinism gives B(P,S)' states the identity directly. The bitwise equality is true by construction and carries no independent empirical content, though the suffix-cost measurement and the separability boundary are independent.

full rationale

The paper is unusually explicit about the scopes of its claims, and much of the evidence is genuinely external: the delta-rule suffix-dependence measurements (Table 2), the scaling utility costs (Table 1), the imprint measurement, and the behavioral proxy-vs-floor attack results are empirical comparisons with independent content. The self-citation to Ramesh (2026) supplies the gated memory architecture, but the exactness property is anchored in the external Cauwenberghs & Poggio (2000) incremental SVM result, so this is not a load-bearing self-citation. However, the two headline equalities that carry the 'exact deletion' label each reduce to construction. For Gemma, the declared reference is a fixed-C refit over the same retained contextualized keys, and the decrement is the reverse of that solve; the KL agreement is a numerical self-consistency check, not a test against a full record-omitted rebuild. For Kimi, rewind-and-replay is literally the operation of never ingesting the record under deterministic execution, so bitwise equality with the never-ingested reference is an identity. The abstract presents both as results, which is why the circularity score is elevated despite the honest limitations section. The single-precision masked-refit proxy gap is a real validity threat but is not circularity: the proxy is compared with an independent never-ingested floor. Because the central representation-boundary claim rests partly on independent measurements, the paper is not wholly circular; the headline deletion equalities themselves are by-construction.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

The central claims rest on a handful of free hyperparameters (SVM budget, bandwidth initialization, LoRA budget, decay gamma, admission thresholds) and on domain assumptions about the counterfactual reference, the exactness of the decremental solver, and the determinism of the Kimi MLX implementation. No new physical or architectural entity is postulated beyond the reused support-vector gate from the author's companion preprint.

free parameters (5)
  • SVDD budget ν = 0.3
    Gating hyperparameter fixing box C=1/(νn); chosen by hand, not derived.
  • kernel bandwidth per grafted layer = Initialized at median key distance; trained in stage 1 but shown not load-bearing
    Controls kernel geometry; stage-1 training is optional and utility-equivalent to a median heuristic per Appendix B.
  • LoRA rank / learning rates / steps = rank 8, lr 0.001 and 0.02, 6000 and 2000 steps
    Recovery training choices that set the utility cost and certificate headroom.
  • decay factor γ = 0.01
    Coefficient-scaling foil for approximate deletion; chosen to be aggressive.
  • admission thresholds for behavioral targets = ≥0.05-nat lift and top-10 rank gates
    Determines which TOFU/MIMIC records enter reported evaluations; denominators are disclosed but the filtering affects generalization.
axioms (5)
  • standard math Cauwenberghs-Poggio decremental SVM exactly reverses incremental addition in exact arithmetic
    Applies the classical 2000 algorithm to the SVM gate; the certificate assumes this inverse is exact.
  • standard math One-class SVDD with fixed C assigns exact zero coefficients to reserve tokens
    Basis of the 'address' property: reserve tokens contribute exactly zero to readout (Section 3.3).
  • domain assumption The declared reference f(q; B(R\j)) is the right deletion contract
    Equation (1) defines deletion as equality to a record-omitted rebuild; the paper's 'exactness' claims inherit this definition.
  • domain assumption Kimi Linear KDA update and MLX determinism match the text's equations
    Used for the bitwise replay equality; cross-hardware determinism is untested.
  • domain assumption Records beyond Gemma's local sliding window are reachable only through the grafted global memory
    Needed to interpret behavioral removal as deletion from the grafted store rather than from local attention.

pith-pipeline@v1.3.0-daily-deepseek · 167 in / 9139 out tokens · 153369 ms · 2026-08-01T06:02:50.770363+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Subtract or Replay? Exact Deletion from Language-Model Memory." pith.science (2026). https://pith.science/paper/HMCK3OCA

@misc{pith2026260727539,
  author       = {Pith},
  title        = {Pith review of: Subtract or Replay? Exact Deletion from Language-Model Memory},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HMCK3OCA}},
  note         = {Machine review of arXiv:2607.27539}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Exact deletion from persistent language-model memory depends on how that memory represents a record. Addressable influence can be removed by algebraic decrement; influence transformed by later writes inside shared recurrent state requires rebuilding from before the write. We test this distinction in two pretrained models against explicit record-omitted references. First, we replace Gemma 3's global-attention layers with support-vector memory. After low-rank recovery at 1B, decrement and retained-key refit agree at the next-token output to median KL $5.4\times10^{-15}$ over 31 support-token deletions, with $+2.0\%$ perplexity relative to a matched fine-tune. A masked-refit proxy is indistinguishable from the never-ingested floor under elicitation, relearning, sampling, and LiRA attacks. At 4B and 12B, certificate ordering persists but utility cost rises to $11.2\%$ and $44.3\%$. Second, in a 48B Kimi Linear hybrid, additive writes admit a fixed decrement and diagonal decay a corrected one, whereas the delta rule makes $12$--$49\%$ of a record's contribution suffix-dependent. Checkpointed rewind-and-replay deletes real clinical records at contexts up to 18,842 tokens, matching never-ingested logits and all recurrent states bit for bit within a deterministic MLX implementation; replaying a correction provides exact amendment. Exact deletion is therefore a property of memory representation: subtract addressable records and replay entangled writes.

Figures

Figures reproduced from arXiv: 2607.27539 by Vishwajith Ramesh.

Figure 1
Figure 1. Figure 1: Exact deletion follows representation. (a) Appending a correction leaves the old record in memory; deletion instead targets a declared record-omitted reference. (b) Addressable influence can be decremented: Gemma’s support-vector memory matches its retained-key refit to median KL 5.4×10−15 . (c) KDA’s later writes make a fixed receipt suffix-dependent (12–49%), so exact deletion restores a checkpoint and r… view at source ↗
Figure 2
Figure 2. Figure 2: Where the addressable memory lives, and how a fact leaves it. (a) Gemma 3 interleaves five local layers per global layer; only the global layers are replaced. (b) The support-vector fit assigns exact zeros and supports a reverse incremental update. (c) The decremented solution drives the live model in double precision and is compared with a retained-key refit at the next-token output. Model and graft. The … view at source ↗
Figure 3
Figure 3. Figure 3: At 1B, the model with a deletable memory is nearly the model without one. Against an identically fine-tuned control: +2.0% WikiText perplexity, −0.11 percentage-point mean zero￾shot accuracy, and +0.9% mean perplexity overhead across three corpora. Larger-model costs are measured separately in Section 6 [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Behavior cannot tell masked refit from strong suppression; the separate certificate can (Gemma-3-1B). (a,b,d,f) The single-precision masked-refit proxy stays near the never-ingested floor under the evaluated behavioral tests. (c,e) The float64 decrement stays near 10−14 KL to its retained￾key refit while decay deviates and accumulates. Masked refit and aggressive decay overlap on coarse behavior but the ce… view at source ↗
Figure 5
Figure 5. Figure 5: Repeated sampling finds no detectable excess leakage after masked refit, but defeats the prompt-based method (Gemma-3-1B). (a) Exact-phrase Leak@k under the stem probe (20 targets, 95% bootstrap bands): masked refit (blue) is statistically indistinguishable from the never-stored floor (green) at every budget; ICUL (orange) tracks present (gray)—repeated sampling defeats the instruction. The floor rises wit… view at source ↗
Figure 6
Figure 6. Figure 6: One complete record deleted live, and audited at every step (the released demo). (a) A recorded conversation: a three-field record is indexed, recalled, then deleted atomically—all 80 of its positions leave every gate—while its neighbor record stays answerable. The coupled block decrement completes incrementally on 276/320 affected head-gates; the remainder use the disclosed exact refit fallback (max outpu… view at source ↗
Figure 7
Figure 7. Figure 7: One hybrid, two kinds of memory. Kimi Linear interleaves 20 recurrent KDA layers with 7 global attention layers. An attention-only mask provides a diagnostic comparator; the recurrent state is saved at record boundaries and rebuilt exactly by replaying only the suffix. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Replay deletion on real clinical records. (a) Within the same deterministic MLX execution, victim influence is exactly zero after deletion in every admitted case, bit-for-bit on logits and all 20 recurrent states. (b) Replay latency falls with the length of the suffix while a full rebuild remains flat [PITH_FULL_IMAGE:figures/full_fig_p021_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

43 extracted references · 5 linked inside Pith

  1. [1]

    2026 , note =

    A Trainable Support-Vector Memory with Certified Selection and Exact Unlearning , author =. 2026 , note =

    2026

  2. [2]

    Leak@ k : Unlearning Does Not Make

    Reisizadeh, Hadi and Ruan, Jiajun and Chen, Yiwei and Pal, Soumyadeep and Liu, Sijia and Hong, Mingyi , journal =. Leak@ k : Unlearning Does Not Make

  3. [3]

    arXiv preprint arXiv:2503.19786 , year =

    Gemma 3 Technical Report , author =. arXiv preprint arXiv:2503.19786 , year =

    Pith/arXiv arXiv

  4. [4]

    2024 , url =

    Zhang, Michael and Arora, Simran and Chalamala, Rahul and Wu, Alan and Spector, Benjamin and Singhal, Aaryan and Ramesh, Krithik and R\'e, Christopher , journal =. 2024 , url =

    2024

  5. [5]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    The Mamba in the Llama: Distilling and Accelerating Hybrid Models , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  6. [6]

    and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Lu and Chen, Weizhu , booktitle =

    Hu, Edward J. and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Lu and Chen, Weizhu , booktitle =. 2022 , url =

    2022

  7. [7]

    Penedo, Guilherme and Kydl\'i. The. Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks , year =

  8. [8]

    International Conference on Learning Representations (ICLR) , year =

    Pointer Sentinel Mixture Models , author =. International Conference on Learning Representations (ICLR) , year =

  9. [9]

    2024 , note =

    A Framework for Few-Shot Language Model Evaluation , author =. 2024 , note =

    2024

  10. [10]

    Think You Have Solved Question Answering? Try

    Clark, Peter and Cowhey, Isaac and Etzioni, Oren and Khot, Tushar and Sabharwal, Ashish and Schoenick, Carissa and Tafjord, Oyvind , journal =. Think You Have Solved Question Answering? Try. 2018 , url =

    2018

  11. [11]

    2020 , url =

    Bisk, Yonatan and Zellers, Rowan and Le Bras, Ronan and Gao, Jianfeng and Choi, Yejin , booktitle =. 2020 , url =

    2020

  12. [12]

    2021 , url =

    Sakaguchi, Keisuke and Le Bras, Ronan and Bhagavatula, Chandra and Choi, Yejin , journal =. 2021 , url =

    2021

  13. [13]

    2019 , url =

    Zellers, Rowan and Holtzman, Ari and Bisk, Yonatan and Farhadi, Ali and Choi, Yejin , booktitle =. 2019 , url =

    2019

  14. [14]

    International Conference on Learning Representations (ICLR) , year =

    Rethinking Machine Unlearning: Models Designed to Forget via Key Deletion , author =. International Conference on Learning Representations (ICLR) , year =

  15. [15]

    2026 , url =

    Li, Mufei and Liu, Shikun and Fu, Dongqi and Wang, Haoyu Peter and Xia, Yinglong and Li, Hong and Yan, Hong and Li, Pan , journal =. 2026 , url =

    2026

  16. [16]

    arXiv preprint arXiv:2508.12220 , year =

    Unlearning at Scale: Implementing the Right to be Forgotten in Large Language Models , author =. arXiv preprint arXiv:2508.12220 , year =

    Pith/arXiv arXiv

  17. [17]

    International Conference on Machine Learning (ICML) , year =

    In-Context Unlearning: Language Models as Few-Shot Unlearners , author =. International Conference on Machine Learning (ICML) , year =

  18. [18]

    IEEE Symposium on Security and Privacy (S&P) , year =

    Towards Making Systems Forget with Machine Unlearning , author =. IEEE Symposium on Security and Privacy (S&P) , year =

  19. [19]

    IEEE Symposium on Security and Privacy (S&P) , year =

    Machine Unlearning , author =. IEEE Symposium on Security and Privacy (S&P) , year =

  20. [20]

    and Kolter, J

    Maini, Pratyush and Feng, Zhili and Schwarzschild, Avi and Lipton, Zachary C. and Kolter, J. Zico , journal =. 2024 , url =

    2024

  21. [21]

    and Zhang, Chiyuan , booktitle =

    Shi, Weijia and Lee, Jaechan and Huang, Yangsibo and Malladi, Sadhika and Zhao, Jieyu and Holtzman, Ari and Liu, Daogao and Zettlemoyer, Luke and Smith, Noah A. and Zhang, Chiyuan , booktitle =. 2025 , url =

    2025

  22. [22]

    Li, Nathaniel and Pan, Alexander and Gopal, Anjali and Yue, Summer and Berrios, Daniel and others , booktitle =. The. 2024 , url =

    2024

  23. [23]

    Jogging the Memory of Unlearned

    Hu, Shengyuan and Fu, Yiwei and Wu, Zhiwei Steven and Smith, Virginia , journal =. Jogging the Memory of Unlearned. 2024 , url =

    2024

  24. [24]

    Eight Methods to Evaluate Robust Unlearning in

    Lynch, Aengus and Guo, Phillip and Ewart, Aidan and Casper, Stephen and Hadfield-Menell, Dylan , journal =. Eight Methods to Evaluate Robust Unlearning in. 2024 , url =

    2024

  25. [25]

    Position:

    Thaker, Pratiksha and Hu, Shengyuan and Kale, Neil and Maurya, Yash and Wu, Zhiwei Steven and Smith, Virginia , journal =. Position:. 2024 , url =

    2024

  26. [26]

    Unlearned but Not Forgotten: Data Extraction after Exact Unlearning in

    Anonymous , booktitle =. Unlearned but Not Forgotten: Data Extraction after Exact Unlearning in. 2025 , url =

    2025

  27. [27]

    Unlearning Isn't Deletion: Investigating Reversibility of Machine Unlearning in

    Wang, Xiaoyu and others , journal =. Unlearning Isn't Deletion: Investigating Reversibility of Machine Unlearning in. 2025 , url =

    2025

  28. [28]

    IEEE Symposium on Security and Privacy (S&P) , year =

    Membership Inference Attacks From First Principles , author =. IEEE Symposium on Security and Privacy (S&P) , year =

  29. [29]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    Incremental and Decremental Support Vector Machine Learning , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  30. [30]

    Machine Learning , volume =

    Support Vector Data Description , author =. Machine Learning , volume =. 2004 , url =

    2004

  31. [31]

    2023 , url =

    Zhang, Zhenyu and Sheng, Ying and Zhou, Tianyi and Chen, Tianlong and Zheng, Lianmin and Cai, Ruisi and Song, Zhao and Tian, Yuandong and R\'e, Christopher and Barrett, Clark and Wang, Zhangyang and Chen, Beidi , booktitle =. 2023 , url =

    2023

  32. [32]

    2024 , url =

    Li, Yuhong and Huang, Yingbing and Yang, Bowen and Venkitesh, Bharat and Locatelli, Acyr and Ye, Hanchen and Cai, Tianle and Lewis, Patrick and Chen, Deming , booktitle =. 2024 , url =

    2024

  33. [33]

    2026 , url =

    Yao, Jiayi and Shen, Samuel and Du, Kuntai and Feng, Shaoting and Seo, Dongjoo and Zhang, Rui and Huang, Yuyang and Liu, Yuhan and Lu, Shan and Jiang, Junchen , journal =. 2026 , url =

    2026

  34. [34]

    uttler, Heinrich and Lewis, Mike and Yih, Wen-tau and Rockt\

    Lewis, Patrick and Perez, Ethan and Piktus, Aleksandra and Petroni, Fabio and Karpukhin, Vladimir and Goyal, Naman and K\"uttler, Heinrich and Lewis, Mike and Yih, Wen-tau and Rockt\"aschel, Tim and Riedel, Sebastian and Kiela, Douwe , booktitle =. Retrieval-Augmented Generation for Knowledge-Intensive. 2020 , url =

    2020

  35. [35]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    Parallelizing Linear Transformers with the Delta Rule over Sequence Length , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  36. [36]

    International Conference on Learning Representations (ICLR) , year =

    Gated Delta Networks: Improving Mamba2 with Delta Rule , author =. International Conference on Learning Representations (ICLR) , year =

  37. [37]

    arXiv preprint arXiv:2510.26692 , year =

    Kimi Linear: An Expressive, Efficient Attention Architecture , author =. arXiv preprint arXiv:2510.26692 , year =

    Pith/arXiv arXiv

  38. [38]

    Transformers are

    Katharopoulos, Angelos and Vyas, Apoorv and Pappas, Nikolaos and Fleuret, Fran. Transformers are. International Conference on Machine Learning (ICML) , year =

  39. [39]

    Conference on Language Modeling (COLM) , year =

    Mamba: Linear-Time Sequence Modeling with Selective State Spaces , author =. Conference on Language Modeling (COLM) , year =

  40. [40]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    Titans: Learning to Memorize at Test Time , author =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  41. [41]

    arXiv preprint arXiv:2405.04434 , year =

    Pith/arXiv arXiv

  42. [42]

    arXiv preprint arXiv:2403.19887 , year =

    Jamba: A Hybrid Transformer-Mamba Language Model , author =. arXiv preprint arXiv:2403.19887 , year =

    Pith/arXiv arXiv

  43. [43]

    arXiv preprint arXiv:2410.07145 , year =

    Stuffed Mamba: Oversized States Lead to the Inability to Forget , author =. arXiv preprint arXiv:2410.07145 , year =

    arXiv