RULER exposes hidden memory in machine unlearning

RULER finds hidden memory lingering in 10 of 12 unlearning tests.

A new paper introduces RULER, a suite of representation level verification metrics designed to test whether removing training data truly erases its imprint on a model. The project targets a gap in today’s unlearning protocols, which typically certify success only by output level checks such as membership tests, preserved accuracy on unaffected data, and forget-set accuracy. The authors warn that a model can pass all of these checks and still retain traces of forgotten records in its internal representations.

Two core metrics drive the claim. M2, the oracle-comparative test, asks whether the internal representations of forget-set records line up with those from a model retrained without those records. M4, the oracle-free test, looks for residuals in the model’s internal similarity structure without needing retraining. Across four approximate unlearning methods, all pass the usual output-level criteria, yet M2 detects meaningful residuals in 10 of 12 conditions, with p-values under 0.05 and effect sizes that grow as the fraction of forgotten data increases. A fifth method, dubbed Bad Teacher, yields the same lingering signals despite using a different forgetting mechanism.

M4 steps in as a pre-unlearning diagnostic across several task types, including tabular data, image tasks, clinical text, and face-identity settings. It identifies identity-level memorisation in face recognition models where no tested forgetting approach fully erases the signal. In short, the study demonstrates that surface metrics can look clean even when the model still encodes forgotten data inside its hidden layers.

For practitioners this raises a concrete reality check. Unlearning is not a single knob you turn and forgetfulness is guaranteed. The paper demonstrates that current protocols, even when they pass visible tests, can fail to scrub representations. That means downstream risks in privacy or compliance may persist even after a model appears to forget.

Two to four practical takeaways jump out for product teams. First, don’t rely on output-level tests alone when you claim unlearning. Representation-level checks can reveal hidden leakage that surface metrics miss. Second, the M2 and M4 tests require access to internal representations and, in M2’s case, a retrained reference model for comparison; this creates a clear compute and data accessibility hurdle for many teams. Third, the finding that a generic “Bad Teacher” forgetting approach still leaves residuals is a reminder that the problem is not just about the forgetting method but about what the model internalizes in the first place. Fourth, M4’s ability to detect memorisation in face recognition tasks signals real privacy and safety risks for identity-related deployments that rely on unlearning.

Analogy time: erasing data from a model is like editing a melody by removing a single note. The note might vanish from the score, but the surrounding harmonies and rhythm can carry echoes of it long after. RULER measures those echoes inside the instrument itself, not just what the audience hears.

Limitations are obvious. The abstract does not enumerate exact datasets or provide parameter counts and compute budgets, so teams should view M2 and M4 as diagnostic complements rather than turnkey budgets. The authors also stop short of prescribing a universal best practice for all modalities, given the heterogeneity they observe across tabular, image, text, and face-identity tasks. As a result, the immediate takeaway is caution: in production, verify unlearning with representation-level diagnostics and prepare for potential tradeoffs between forgetting accuracy and utility.

For this quarter, the message is practical and actionable. If you ship models that must forget data on demand, bake in representation-level verification as a standard QA step, and plan for the extra compute required to compare internal representations against retrained baselines. The work signals a shift from counting forgotten records to auditing what the model still knows at the deepest levels.