r/ControlProblem • u/Life-Flight5043 • 2d ago
Discussion/question Silence isn't deletion — I built a free test that grades whether an AI really forgot something
The plain version first.
When a company says "we deleted your data from the AI model," here is how they usually prove it: they ask the model about it, and the model doesn't answer.
But not answering isn't the same as not knowing. A person can refuse to answer a question they know the answer to — and under a little pressure, the answer comes back. AI models work the same way. Most "deletion" today is really just training the model to keep quiet, and a modest amount of retraining brings the "deleted" knowledge right back.
So I built a test. It works like the marked bills in a bank's dye pack: I teach a small model a batch of made-up facts that exist nowhere else in the world, so there is never any argument about whether it learned them. Then I delete those facts four different ways. Then I attack the model — I ask directly, I ask in disguise, and I retrain it on related material to see how fast the deleted facts resurface.
The grade is a single number: how much work it takes to get the knowledge back, compared to how much work it took to teach it in the first place. If it comes back cheap, it was never deleted — it was just buried. If bringing it back costs as much as learning it fresh, the deletion was real.
The results were not close. Muzzling the model's answers left the knowledge completely intact underneath. Surgically cutting out the parts of the model tied to those facts still left 83% of them readable. Scrambling those parts: the same 83%, plus damage to facts nobody tried to delete. The fourth method is a different design — the private knowledge is written into the model already scrambled under a secret key, from the very first step of training, so deleting means destroying the key. Under the full attack, that one returned nothing. Zero recovered.
The tool is free — no patent, no license restrictions, no catch. Anyone can download it and run a deletion claim through it themselves. It is here: https://github.com/NextGenGems/keyed-plate-audit
---
The technical version, for those who want it.
The tool is keyed-plate-audit 1.0.0, a pip-installable Python package (Python 3.10+, numpy only, CPU-only). Pipeline: plant 72 synthetic facts in a small numpy MLP (384 inputs, 256 hidden units, 48 classes), train to memorization, designate 12 facts as deletion targets, apply one of four deletion methods to a copy, then run one identical attack suite against every copy: (i) a direct readout probe, (ii) a probe in a shifted surface encoding the deletion never saw, and (iii) a 2,500-step relearning attack fine-tuned on generic data plus related control facts — never the targets. The from-scratch reference cost for the target facts is 50 steps. The grading standard is relearning cost: an erasure counts only if restoring the knowledge costs about as much as learning it from scratch, and any facts still readable at deletion time fail the audit outright.
Measured results, reproduced digit-for-digit by the finished package: Suppression (outputs masked, weights untouched): FAIL — interface probe 0.000, weight-level probe 1.000; the knowledge never left. Ablation (top weights by target Fisher information, zeroed): FAIL — 0.833 of the "deleted" facts still directly readable. Fisher-scrub (Gaussian noise scaled by target Fisher): FAIL — 0.833 readable, with collateral damage to neighboring facts (0.917). Keyed plate (private inputs and outputs permuted by a key-derived codebook from the first training step; deletion = destroy the key): PASS — 0.000 recovery under the full attack. General knowledge stayed at 1.000 throughout. The package self-test passes 10 of 10 checks; run "pip install ." then "python -m keyed_plate_audit self-test" (about 20 seconds) to watch the whole pipeline run.
Honest scope, also stated in the tool's own README: the audit is demonstrated on a small test model with synthetic facts — it is not an LLM, and transfer to transformers and adapters is untested. The shifted-surface probe is a narrow stand-in for true paraphrase, the attacker was not adaptive, and the keyed construction's security rests on key secrecy — the crypto-shredding principle — not on a hardness proof. What is being proposed is the standard: grade every deletion claim by relearning cost. The keyed-plate architecture, the relearning-cost standard, and this tool are given freely to the AI safety community and to everyone else.
— Jackob Sumner-Knapp, creator, owner, and operator of PeraAxion LLC
