Why GDPR-style erasure doesn't map onto trained AI model weights

A delete operation with nothing to point at

Privacy law was written for systems where data sits in identifiable records. Ask a company to delete yours, and in an ordinary database that means locating the rows and removing them — exactly the assumption the GDPR's right to erasure rests on. A dev.to piece argues that a trained AI model breaks this assumption at the root: your data is not held inside the model as a record at all, but dissolved into billions of parameters that were each nudged slightly during training. There is no row labelled with your name, and therefore nothing for a delete operation to target.

How influence gets smeared across weights

According to the article, training works by repeated correction: the model predicts, gets it wrong, and an optimiser adjusts parameters a fraction so the same error becomes less likely next time. Repeated across trillions of tokens, those small adjustments accumulate, and the contribution of any single document ends up distributed across many parameters that also encode countless other patterns. Two consequences follow, per the piece. First, you cannot isolate the part of a model that corresponds to one person. Second, removing a document from the training set leaves the already-trained model untouched — the piece illustrates this with a baking analogy, in which an ingredient removed from the recipe still leaves its taste in the finished cake.

The gold standard nobody can fund per request

The article identifies one clean answer: retrain the model from scratch on a dataset that excludes the deleted data. This approach, exact unlearning, is described as the gold standard because the resulting model provably never saw the data in question. The problem is cost. Industry estimates cited in the piece put a frontier-scale training run at anywhere from the high hundreds of thousands into millions of dollars, spread over weeks on large clusters. Honouring every erasure request that way is not realistic for any product with a large user base.

Approximate unlearning trades guarantees for speed

The workaround is an active research field, machine unlearning, which tries to make a model behave as if it never saw particular data without paying for full retraining. The article names three approaches. Gradient ascent nudges weights in the direction opposite to the original learning, which is cheap but can degrade the model's broader abilities when applied heavily. Influence functions estimate how much a data point shaped the model and subtract that estimate — elegant, but an approximation stacked on an approximation at this scale. Sharded retraining partitions training data upfront so that forgetting a point means retraining only one shard, which is practical but constrains how training is organised and still is not free.

All of these buy efficiency by giving up guarantees, the piece notes. Success is judged empirically — whether data can still be extracted, whether the model still completes a passage it was supposed to forget — because there is no settled definition of what counts as forgotten in a probabilistic system. The article points to a 2023 Machine Unlearning Challenge run with Google, which framed the problem as three goals in tension: forgetting quality, model usefulness, and efficiency, with efficiency defined as costing a small fraction of full retraining.

Even forgotten data can resurface

Citing research published in 2025, the piece reports that data remained extractable in some cases even after supposed exact unlearning, because traces survived in places the procedure did not fully account for. If the provable method can leave recoverable residue, the approximate methods actually used at scale should be read as reducing risk rather than guaranteeing absence. There is progress on cost: the article cites 2025 work showing unlearning at roughly half the price of retraining while preserving performance — but paying half as much for an imperfect result is a weaker commitment than genuine removal.

Why it matters

For AI product teams, erasure requests are an engineering problem, not just a compliance checkbox. The verifiable part of most deletion promises covers the training set and databases — records stop being stored and stop feeding future runs. The much vaguer part concerns the model that already learned from you, and that is where the dev.to piece advises scepticism: ask which deletion is being promised, the dataset or the model, and do not assume they are the same thing. The article points to Atlassian's pledge to remove opted-out data and retrain its models as an example of where this wording carries weight, and ties the issue to memorisation — if models can leak their training data, incomplete forgetting becomes a live exposure rather than a compliance footnote. Until regulation catches up with distributed weights, deletion guarantees for AI products rest on an open research problem.