Why matching the retrained model is a convention, not a definition

Sets the convention, and more carefully than it is usually credited. Definition 3.1 requires EQUALITY IN DISTRIBUTION between the unlearned and retrained models -- exact deletion, not an (eps,delta) relaxation, which the paper defers to an appendix and to future work. It also observes that every algorithm supports deletion trivially by retraining, so the challenge is purely computational.

Attacks sufficiency. Theorem 1 constructs two networks arbitrarily close in weights and test error yet arbitrarily far in adversarial robustness and fairness. Separately argues necessity fails too: a randomly initialised network contains no forget-set information yet would be penalised for being far from the particular retrained model.

Attacks verifiability, and specifically for minibatch SGD -- our setting. Forging rewrites a training log so the same weights are explained by a dataset not containing the forgotten point, letting an owner claim unlearning having changed nothing. Corollary 2: unlearning on minibatch SGD is not well-defined over logs or models. Lands directly on SISA's plausible-deniability clause.

Attacks auditability and then offers a replacement. Argues the anchor-based criterion is unauditable because it depends on an unknown retrained model, and proposes marginal unlearning stated purely in output space: bound the mutual information between the model's outputs and a latent source label. Theorem 2.1 shows this plus a utility guarantee RECOVERS the anchored guarantee, without needing the anchor.

Adds the measurement objection, and it is the one where our own engineering answers back. Of its three complaints about oracle comparison, the floating-point-noise one does not apply to a deterministic pipeline -- we measured bitwise-identical weights on CPU and CUDA. The surviving objection is that any ONE retrained model is a noisy reference.