Deleting a record from a dataset is easy. Removing what a trained model learned from that record is harder: a direct parameter update may erase the target, but it can also discard information shared with useful examples. PUMA—Performance Unchanged Model Augmentation—treats removal as a balancing problem. It subtracts the distinctive influence of marked data, then uses a sparse reweighting of remaining data to compensate for the performance that would otherwise be lost.

The central idea

Do not ask only, “How do we reverse this example’s gradient?” Ask, “Which small combination of retained examples can counterbalance the performance shift caused by removing it?”

Two objectives, one careful update

PUMA separates the objective used to train the model, J, from the criterion we want the edited model to preserve, C. The criterion could measure predictive loss, calibration, or another differentiable property. If θorg is the original model and θmod is the model after removal, the design target is explicit:

Performance-preservation requirement
| C(θmod) − C(θorg) | ≤ δ

The tolerance δ says how much movement in the chosen performance criterion is acceptable. Removal is therefore constrained by behavior, not merely by distance between parameter vectors.

Influence functions provide the local language for this calculation. For each training point (xj, yj), PUMA estimates how a small change in its weight would move the criterion:

Criterion-specific influence
ψ(xj, yj) = ∇C(θorg)[∇²Jorg(θorg)]−1∇L(xj, yj, θorg)

The example gradient describes what the point teaches; the inverse Hessian accounts for local model geometry; ∇C turns the resulting parameter movement into a change in the behavior we care about.

Why simply reversing influence is not enough

Three contour plots compare the original model, naive influence removal, and PUMA. Naive removal points toward a region of higher criterion loss, whereas the compensated PUMA direction points toward lower criterion loss.
Figure 1 from the paper. Orange contours represent the training objective and purple contours the performance criterion. Removing the blue contribution directly produces the red update in the middle panel, toward higher performance loss. PUMA combines it with selected green contributions so the net update follows a safer direction.

The picture exposes a subtle failure mode. A marked example may contain both a unique characteristic that should disappear and shared signal that helps the model generalize. Negating its whole contribution removes both. PUMA instead searches among retained examples for influences that replace the useful shared component.

01Measure

Estimate every candidate point’s effect on the chosen criterion C.

02Balance

Find sparse, small weights on retained points that match the marked set’s performance contribution.

03Patch

Subtract the marked influence and the compensating influence in one local parameter update.

The balancing weights are obtained by solving

Sparse compensatory reweighting
λ* = arg minλ‖ ∑j∉Dmk λjψ(xj,yj) − ∑k∈Dmk ψ(xk,yk) ‖22 + Ω(λ)

The first term matches the criterion-level influence of the retained points to that of the marked set. Ω combines ℓ1 and ℓ2 regularization, encouraging a correction that is both sparse and small.

A visible removal test

The paper first tests the idea on a classifier with several clusters per class. The crossed green cluster is marked for removal. Before editing, the classifier recognizes it as green; afterward, PUMA assigns the region according to the surrounding orange observations. The other clusters retain their structure.

A synthetic classification example before and after PUMA. A green cluster marked by crosses is classified as orange after removal while the rest of the circular decision pattern remains stable.
Figure 2 from the paper. The crossed cluster supplies the characteristic to erase. After the patch, its predictions align with nearby retained data rather than preserving the removed cluster as a recognizable island.

This is a stronger test than making a few marked predictions incorrect. It asks whether the model behaves as though the removed cluster’s distinctive pattern had not been available, while still retaining the broader decision structure learned from the rest of the data.

Removing a writing style, not the whole digit

The MNIST experiment makes that distinction concrete. The marked records are all images of the digit 4, but they share a particular handwriting style. Before removal, the original model classifies every marked image as 4 with confidence 1.00. After PUMA, those marked samples receive varied labels and lower confidence, while other styles of 4 remain correctly recognized.

Four groups of MNIST examples: marked digit fours before removal, the same examples after PUMA with varied predictions, other digit fours still classified correctly, and random digits still classified correctly.
Figure 8 from the paper. From left to right: marked examples under the original model; the same examples after removal; other 4s under the edited model; and randomly sampled digits under the edited model. T is the true label, P the prediction, and Prob the confidence.

The comparison separates targeted removal from class-wide damage. The edit disrupts the selected visual signature without teaching the model to forget every 4. Randomly sampled digits are also still handled correctly, providing a visual check that the patch remains localized.

Evidence across removal settings

The evaluation spans synthetic data, UCI tabular datasets, and MNIST, with both ordered and randomly distributed removal requests. The authors examine two sides of the goal: whether removed examples evade a membership-inference attack, and whether the model retains predictive performance.

On MNIST under random removal, PUMA keeps accuracy between 97.42% and 97.61% as the removed fraction grows from 20% to 80%, compared with an original accuracy of 97.97%. In the same setting, the reported accuracy for SISA falls from 93.47% to 59.83%, while the tested Amnesiac ML configuration remains near 10%. Across the study, PUMA’s criterion-specific influence scores also identify mislabeled examples, turning the same calculation into a data-debugging signal.

Trust through controlled forgetting

PUMA frames training-data removal as a model-behavior problem. The marked data’s unique trace should disappear, but useful shared structure should remain. By naming a criterion, measuring each point’s contribution to it, and constructing a sparse counterweight before patching the model, the method makes that trade precise—and makes the result inspectable through both privacy attacks and retained performance.

Read the research