Certifying that a deletion did what it declared does not certify that the record left no trace: a small distance to the implementation's own reference does not imply a small distance to the state that never stored the record. This paper installs a deletion interface into a pretrained language model and measures both distances. We retrofit a support-vector memory gate into the global attention layers of a frozen Gemma 3 without changing a weight. Each stored record owns a set of rows, and deleting it removes those rows and re-solves only the storage problems they touched. At 4B the retrofit admits exactly the records the base model recalls, at a paired perplexity cost under $2\%$; the same recipe fails at 1B and 12B, which we report. Every executed deletion agreed with an independently reconstructed reference on every registered probe, and under sampling, targeted elicitation, related-data relearning, and membership inference an edited record was about as hard to extract as one never stored, while a prompt instruction to ignore the same record left it fully extractable. On $96$ long conversational histories with decoded answers, the edited assistant disclosed the deleted record in $15$ histories against $13$ for a rebuild that never stored it and $54$ for the instruction, and a blinded review of the outputs the matcher had cleared found that its misses were aliases or normalization failures of the answer, with no paraphrase among them. The edit also suppressed the deleted answer below the never-stored level, a signature an auditor can read. The result is a retrofit that makes a frozen model's memory addressable, a certificate for what the retrofit does, and a measurement of the distance that remains to the stronger guarantee; which of the two a system can offer is decided when the memory is written.
Auditable memory requires a precise contract: which output is preserved, relative to which reference solve, and across which updates. We introduce Support Vector Attention (SV-Attention), a one-class support vector data description (SVDD) gate whose coefficients enter the readout. Zero-coefficient keys are reserve; positive-coefficient keys are active. Removing a reserve token without re-solving preserves the current readout. Maintained deletion, which updates the existing solver state, targets a fresh retained-key fit under the same coefficient cap C. Across 1,200 fp64 deletion/refit trials on Gaussian, redundant, MIMIC-IV, and learned keys, 1,199 complete. Median maximum gate-score discrepancy over declared probes ranges from 4.5e-13 to 5.7e-7, and fresh refitting is 24-223 times slower than maintained deletion on the reference CPU. A deterministic example shows that current reserve status does not guarantee equivalence after future admissions. At matched token counts, rare-group recall is 0.861 versus 0.319 for an oracle attention-mass proxy (H2O-style). In a held-out-channel ICU control, SpO2 below 90 percent defines events but SpO2 is excluded from every selector; event-hour retention is 0.464 versus 0.225 for an RBF-density baseline. A separate batched approximation supports end-to-end training; at 3.22M parameters, seven paired seeds yield mean best-validation bits per character of 2.178 versus 2.383 (p=0.001). The contracts are point-in-time and fixed-C; future-safe streaming and general-purpose performance remain open, and larger fixed-step runs suggest slower optimization.
The paper's two contributions are a negative result for native KDA's tested receipt classes and a positive training-free construction for addressable pretrained memory for addressable pretrained memory.
V. Ramesh· 1 citation
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
