Unlearning in derived artifacts

A customer exercises a right to delete. Your lineage is in good order: you can find every record they contributed, remove it from every store, and re derive every structured view built from it. The part that does not close is the fine tuned model those records trained, together with the free text derivatives it produced before the request arrived: a distilled serving model, an embedding index, and summaries an agent wrote into its own long term notes. You owe a regulator a certificate, and the certificate has to say something true.

Retraining is off the table, and not as a budget preference. The fine tune is the parent of the derivatives, and re deriving that chain takes longer than the window you are answering in. That removes the reference model every unlearning evaluation leans on, the one that never saw the record, so nothing supplies ground truth for whether the model forgot. Also off the table: a labelled set of the fact's paraphrases and downstream consequences, because you cannot enumerate them, and any success criterion defined as verbatim non emission, because a paraphrase carries the fact perfectly well.

Two traps are graded. First, some deleted facts stay derivable from data you are keeping, so a certificate promising the model cannot produce the fact is false on the day you sign it. Say what yours claims instead. Second, a refusal filter over the deleted subject passes every forgetting test ever written while removing no influence at all, so your audit has to separate removal from suppression.

Hand in the claim, the third party audit procedure that checks it with a stated query budget and stated power, the policy and the mechanism for facts that remain derivable, the residual influence you accept, and the experiment that would show your audit tracks removal rather than tracking the model's general reluctance to talk about people. Ties break toward the narrow claim a third party can check over the broad claim only you can assess.