AI Model Retention and Unlearning
Overview
GDPR Art. 5(1)(e) storage limitation requires that personal data be kept no longer than necessary for the processing purpose. For AI systems, this creates complex retention challenges: training data used to build a model may no longer be needed once training is complete, but the model itself encodes information about the training data. Machine unlearning — the process of removing the influence of specific data from a trained model — is an emerging field that addresses the gap between deleting training data and eliminating its influence from model parameters. This skill provides retention policies, deletion verification methods, and machine unlearning techniques for AI compliance.
AI Data Retention Categories
| Data Category |
Description |
Retention Consideration |
| Raw training data |
Original personal data used for model training |
Delete after training unless retraining justifies retention |
| Processed training data |
Cleaned, augmented, feature-engineered data |
Same as raw — delete when training purpose exhausted |
| Validation/test data |
Data used for model evaluation |
Retain for model audit and comparison; pseudonymise |
| Model weights/parameters |
Trained model artefacts encoding training data information |
Retain while model is deployed; delete on decommission |
| Inference logs |
Inputs and outputs of model predictions |
Retention based on purpose (audit, debugging, rights exercise) |
| Model metadata |
Training configuration, hyperparameters, provenance |
Retain for compliance documentation; low privacy risk |
| Embedding vectors |
Dense representations derived from personal data |
May contain personal data — apply retention policy |
Retention Policy Framework
Training Data Retention Decision Tree
Training data category identified
│
├─ Is the data still needed for model retraining?
│ ├─ YES → Retain with documented justification and review date
│ └─ NO → Continue
│
├─ Is the data needed for model validation or audit?
│ ├─ YES → Retain in pseudonymised form with access controls
│ └─ NO → Continue
│
├─ Is the data needed for data subject rights exercise?
│ ├─ YES → Retain for rights exercise period, then delete
│ └─ NO → Continue
│
├─ Is there a legal obligation to retain?
│ ├─ YES → Retain per legal requirement
│ └─ NO → DELETE the training data
│
└─ After deletion: assess model for residual data encoding
Model Lifecycle Retention
| Phase |
Retention Rule |
| Development |
Training data retained during active development |
| Deployment |
Training data deleted unless retraining is planned within defined period |
| Operation |
Inference logs retained per purpose (30 days debug, 1 year audit) |
| Retraining |
New training data collected; old data deleted post-training |
| Decommission |
All model artefacts, training data, and logs deleted; retain only compliance documentation |
Machine Unlearning Techniques
Exact Unlearning
Full retraining: Retrain the model from scratch on the dataset minus deleted records.
| Property |
Value |
| Guarantee |
Complete — model has no knowledge of deleted data |
| Cost |
Very high — full training cost for each deletion request |
| Feasibility |
Impractical for large models or frequent deletion requests |
| When to use |
Small models, infrequent requests, high-sensitivity data |
SISA (Sharded, Isolated, Sliced, Aggregated) Training
Train model on sharded data partitions. To unlearn, retrain only the affected shard.
| Property |
Value |
| Guarantee |
Exact within the affected shard |
| Cost |
1/k of full retraining (k = number of shards) |
| Feasibility |
Requires SISA architecture from the start |
| Trade-off |
Model accuracy may decrease with fewer shards contributing |
Approximate Unlearning
Gradient-Based Unlearning
Apply gradient ascent on the data to be forgotten, then fine-tune on remaining data.
| Property |
Value |
| Guarantee |
Approximate — statistically similar to retrained model |
| Cost |
Low — few gradient steps |
| Feasibility |
Works for most differentiable models |
| Verification |
Requires membership inference testing to verify |
Influence Function-Based Unlearning
Use influence functions to estimate the effect of removing data and adjust model accordingly.
| Property |
Value |
| Guarantee |
Approximate — first-order approximation |
| Cost |
Medium — requires Hessian computation |
| Feasibility |
Best for smaller models or linear models |
Unlearning Verification
After applying unlearning, verify effectiveness:
- Membership inference test: Run MI attack on unlearned records — should classify as non-members
- Output comparison: Compare model outputs with and without the unlearned data
- Canary test: If canary records were included, verify they are no longer extractable
- Statistical test: Compare model to one retrained from scratch on the same data minus deleted records
Model Versioning for Compliance
Version Control Requirements
| Element |
Documentation |
| Model version ID |
Unique identifier (e.g., model-v2.3.1-20260314) |
| Training data snapshot |
Hash of training dataset used for this version |
| Training date |
When training was executed |
| Data deletions applied |
Which data subject deletions are reflected in this version |
| Unlearning applied |
Any approximate unlearning applied since last full retraining |
| Privacy properties |
DP epsilon, MI test results for this version |
| Deployment dates |
When deployed and when retired |
Retraining Triggers
| Trigger |
Action |
| Accumulated deletion requests exceed threshold |
Full retraining on updated dataset |
| Scheduled periodic retraining |
Incorporate all pending deletions |
| Privacy audit reveals unacceptable leakage |
Retrain with enhanced privacy measures |
| Model performance degradation |
Retrain with current data (post-deletions) |
| Regulatory change |
Assess if retraining needed for compliance |
Enforcement Relevance
- EDPB Guidelines 04/2025: Training data retention must be justified; deletion of training data does not automatically eliminate GDPR obligations for the model if it encodes personal data.
- Garante v. OpenAI (2023): Required mechanism for data deletion from training data; acknowledged technical challenges but expected good faith effort.
- EDPB ChatGPT Taskforce (2024): Controllers must demonstrate capability to address erasure requests affecting training data.
Integration Points
- ai-data-subject-rights: Erasure rights implementation requires unlearning
- ai-dpia: Retention and deletion capability assessed in DPIA
- ai-model-privacy-audit: Audit verifies deletion effectiveness
- ai-training-lawfulness: Retention justification part of lawful basis assessment
1---2name: ai-data-retention3description: Manages AI model retention and machine unlearning requirements. Covers training data deletion verification, model versioning for compliance, machine unlearning techniques (SISA, gradient-based), and retraining triggers. Keywords: AI retention, machine unlearning, model versioning, training data deletion, retraining, storage limitation.4license: Apache-2.05---67# AI Model Retention and Unlearning89## Overview1011GDPR Art. 5(1)(e) storage limitation requires that personal data be kept no longer than necessary for the processing purpose. For AI systems, this creates complex retention challenges: training data used to build a model may no longer be needed once training is complete, but the model itself encodes information about the training data. Machine unlearning — the process of removing the influence of specific data from a trained model — is an emerging field that addresses the gap between deleting training data and eliminating its influence from model parameters. This skill provides retention policies, deletion verification methods, and machine unlearning techniques for AI compliance.1213## AI Data Retention Categories1415| Data Category | Description | Retention Consideration |16|---------------|-------------|----------------------|17| Raw training data | Original personal data used for model training | Delete after training unless retraining justifies retention |18| Processed training data | Cleaned, augmented, feature-engineered data | Same as raw — delete when training purpose exhausted |19| Validation/test data | Data used for model evaluation | Retain for model audit and comparison; pseudonymise |20| Model weights/parameters | Trained model artefacts encoding training data information | Retain while model is deployed; delete on decommission |21| Inference logs | Inputs and outputs of model predictions | Retention based on purpose (audit, debugging, rights exercise) |22| Model metadata | Training configuration, hyperparameters, provenance | Retain for compliance documentation; low privacy risk |23| Embedding vectors | Dense representations derived from personal data | May contain personal data — apply retention policy |2425## Retention Policy Framework2627### Training Data Retention Decision Tree2829```30Training data category identified31│32├─ Is the data still needed for model retraining?33│ ├─ YES → Retain with documented justification and review date34│ └─ NO → Continue35│36├─ Is the data needed for model validation or audit?37│ ├─ YES → Retain in pseudonymised form with access controls38│ └─ NO → Continue39│40├─ Is the data needed for data subject rights exercise?41│ ├─ YES → Retain for rights exercise period, then delete42│ └─ NO → Continue43│44├─ Is there a legal obligation to retain?45│ ├─ YES → Retain per legal requirement46│ └─ NO → DELETE the training data47│48└─ After deletion: assess model for residual data encoding49```5051### Model Lifecycle Retention5253| Phase | Retention Rule |54|-------|---------------|55| Development | Training data retained during active development |56| Deployment | Training data deleted unless retraining is planned within defined period |57| Operation | Inference logs retained per purpose (30 days debug, 1 year audit) |58| Retraining | New training data collected; old data deleted post-training |59| Decommission | All model artefacts, training data, and logs deleted; retain only compliance documentation |6061## Machine Unlearning Techniques6263### Exact Unlearning6465**Full retraining**: Retrain the model from scratch on the dataset minus deleted records.6667| Property | Value |68|----------|-------|69| Guarantee | Complete — model has no knowledge of deleted data |70| Cost | Very high — full training cost for each deletion request |71| Feasibility | Impractical for large models or frequent deletion requests |72| When to use | Small models, infrequent requests, high-sensitivity data |7374### SISA (Sharded, Isolated, Sliced, Aggregated) Training7576Train model on sharded data partitions. To unlearn, retrain only the affected shard.7778| Property | Value |79|----------|-------|80| Guarantee | Exact within the affected shard |81| Cost | 1/k of full retraining (k = number of shards) |82| Feasibility | Requires SISA architecture from the start |83| Trade-off | Model accuracy may decrease with fewer shards contributing |8485### Approximate Unlearning8687#### Gradient-Based Unlearning88Apply gradient ascent on the data to be forgotten, then fine-tune on remaining data.8990| Property | Value |91|----------|-------|92| Guarantee | Approximate — statistically similar to retrained model |93| Cost | Low — few gradient steps |94| Feasibility | Works for most differentiable models |95| Verification | Requires membership inference testing to verify |9697#### Influence Function-Based Unlearning98Use influence functions to estimate the effect of removing data and adjust model accordingly.99100| Property | Value |101|----------|-------|102| Guarantee | Approximate — first-order approximation |103| Cost | Medium — requires Hessian computation |104| Feasibility | Best for smaller models or linear models |105106### Unlearning Verification107108After applying unlearning, verify effectiveness:1091101. **Membership inference test**: Run MI attack on unlearned records — should classify as non-members1112. **Output comparison**: Compare model outputs with and without the unlearned data1123. **Canary test**: If canary records were included, verify they are no longer extractable1134. **Statistical test**: Compare model to one retrained from scratch on the same data minus deleted records114115## Model Versioning for Compliance116117### Version Control Requirements118119| Element | Documentation |120|---------|---------------|121| Model version ID | Unique identifier (e.g., model-v2.3.1-20260314) |122| Training data snapshot | Hash of training dataset used for this version |123| Training date | When training was executed |124| Data deletions applied | Which data subject deletions are reflected in this version |125| Unlearning applied | Any approximate unlearning applied since last full retraining |126| Privacy properties | DP epsilon, MI test results for this version |127| Deployment dates | When deployed and when retired |128129### Retraining Triggers130131| Trigger | Action |132|---------|--------|133| Accumulated deletion requests exceed threshold | Full retraining on updated dataset |134| Scheduled periodic retraining | Incorporate all pending deletions |135| Privacy audit reveals unacceptable leakage | Retrain with enhanced privacy measures |136| Model performance degradation | Retrain with current data (post-deletions) |137| Regulatory change | Assess if retraining needed for compliance |138139## Enforcement Relevance140141- **EDPB Guidelines 04/2025**: Training data retention must be justified; deletion of training data does not automatically eliminate GDPR obligations for the model if it encodes personal data.142- **Garante v. OpenAI (2023)**: Required mechanism for data deletion from training data; acknowledged technical challenges but expected good faith effort.143- **EDPB ChatGPT Taskforce (2024)**: Controllers must demonstrate capability to address erasure requests affecting training data.144145## Integration Points146147- **ai-data-subject-rights**: Erasure rights implementation requires unlearning148- **ai-dpia**: Retention and deletion capability assessed in DPIA149- **ai-model-privacy-audit**: Audit verifies deletion effectiveness150- **ai-training-lawfulness**: Retention justification part of lawful basis assessment
mukul975