mixle.experimental.unlearning module

P5 (experimental) – commitment-backed exact unlearning for audited closed-form leaves.

This module separates two phases that a deletion certificate must not conflate:

  1. While raw shards are available, prepare_unlearning() computes each shard’s additive sufficient statistic and seals the records in a cryptographic manifest. The caller must retain the manifest digest in an independent append-only log or similarly trusted store.

  2. After deletion, certify_unlearning() receives only the retained statistic records, the manifest, the excluded shard IDs, and that externally retained digest. It verifies record integrity and re-reduces only retained statistics in canonical ID order. It never receives or rereads raw shards or excluded statistics.

Threat model

The certificate detects accidental corruption or post-ingestion modification of retained statistic records, provided the expected manifest digest is held outside the mutable record store. It attests that the fitted model is the deterministic result of the committed retained sufficient statistics for one of the explicitly audited single-step estimator classes. It does not prove physical erasure, protect an anchor that an attacker can also rewrite, prove that ingestion computed truthful statistics, or certify absence of information in other artifacts (logs, checkpoints, backups, or downstream models). Source digests can enable dictionary attacks on low-entropy shards and therefore belong in a protected audit store.

Iterative or latent estimators are refused. Their sufficient statistics generally depend on an earlier parameter trajectory, so re-reducing those statistics is not an exact never-saw-it refit.

class StoredShard(shard_id, n, value, source_digest, commitment)[source]

Bases: object

Committed sufficient statistics for one raw shard.

source_digest binds this record to the exact raw values seen during trusted ingestion without retaining those values here. commitment binds the shard ID, count, source digest, and full typed statistic state.

Parameters:
class ShardCommitment(shard_id, commitment)[source]

Bases: object

Manifest entry retained after the corresponding statistic record may be deleted.

Parameters:

  • shard_id (str)

  • commitment (str)

class UnlearningManifest(schema_version, estimator_id, estimator_config_digest, shards, digest)[source]

Bases: object

Immutable ingestion manifest whose digest is anchored outside the mutable statistic store.

Parameters:

  • schema_version (str)

  • estimator_id (str)

  • estimator_config_digest (str)

  • shards (tuple[ShardCommitment, ...])

  • digest (str)

class UnlearningCertificate(bitwise_exact, method, estimator_id, manifest_digest, retained_state_digest, model_state_digest, excluded_ids, n_excluded, n_retained_shards, n_shards_total, raw_data_accessed, excluded_statistics_accessed, guarantee, note)[source]

Bases: object

Receipt for a commitment-verified, retained-statistics-only unlearning operation.

Parameters:

  • bitwise_exact (bool)

  • method (str)

  • estimator_id (str)

  • manifest_digest (str)

  • retained_state_digest (str)

  • model_state_digest (str)

  • excluded_ids (tuple[str, ...])

  • n_excluded (int)

  • n_retained_shards (int)

  • n_shards_total (int)

  • raw_data_accessed (bool)

  • excluded_statistics_accessed (bool)

  • guarantee (str)

  • note (str)

shard_statistic(estimator, shard, *, shard_id)[source]

Ingest one raw shard into a committed statistic record.

This is the only public operation in this module that accepts raw data.

Parameters:
Return type:

StoredShard

prepare_unlearning(estimator, shards)[source]

Create committed statistic records and an externally anchorable manifest while raw data exists.

Parameters:
Return type:

tuple[dict[str, StoredShard], UnlearningManifest]

retained_records(records, *, exclude)[source]

Return a new store without excluded statistic records; invalid IDs are rejected.

Parameters:
Return type:

dict[str, StoredShard]

unlearn(estimator, retained, *, manifest, exclude, expected_manifest_digest)[source]

Fit from commitment-verified retained statistics without reading deleted data or statistics.

Parameters:

  • estimator (Any)

  • retained (Mapping[str, StoredShard])

  • manifest (UnlearningManifest)

  • exclude (Any)

  • expected_manifest_digest (str)

Return type:

Any

certify_unlearning(estimator, retained, *, manifest, exclude, expected_manifest_digest)[source]

Certify deterministic re-reduction from committed retained statistics only.

The estimator is executed twice from the same verified retained state. Equality compares typed binary sufficient-statistic state and complete fitted-model instance state, not JSON or repr output.

Parameters:

  • estimator (Any)

  • retained (Mapping[str, StoredShard])

  • manifest (UnlearningManifest)

  • exclude (Any)

  • expected_manifest_digest (str)

Return type:

tuple[Any, UnlearningCertificate]