Can an AI Assistant Really Forget? Auditable Deletion from Addressable Memory

Abstract

Certifying that a deletion did what it declared does not certify that the record left no trace: a small distance to the implementation's own reference does not imply a small distance to the state that never stored the record. This paper installs a deletion interface into a pretrained language model and measures both distances. We retrofit a support-vector memory gate into the global attention layers of a frozen Gemma 3 without changing a weight. Each stored record owns a set of rows, and deleting it removes those rows and re-solves only the storage problems they touched. At 4B the retrofit admits exactly the records the base model recalls, at a paired perplexity cost under $2\%$; the same recipe fails at 1B and 12B, which we report. Every executed deletion agreed with an independently reconstructed reference on every registered probe, and under sampling, targeted elicitation, related-data relearning, and membership inference an edited record was about as hard to extract as one never stored, while a prompt instruction to ignore the same record left it fully extractable. On $96$ long conversational histories with decoded answers, the edited assistant disclosed the deleted record in $15$ histories against $13$ for a rebuild that never stored it and $54$ for the instruction, and a blinded review of the outputs the matcher had cleared found that its misses were aliases or normalization failures of the answer, with no paraphrase among them. The edit also suppressed the deleted answer below the never-stored level, a signature an auditor can read. The result is a retrofit that makes a frozen model's memory addressable, a certificate for what the retrofit does, and a measurement of the distance that remains to the stronger guarantee; which of the two a system can offer is decided when the memory is written.