What can you commit to a regulator about a withdrawn voiceprint, given a querying adversary and a monthly retrain?

### Why the answer is not yes or no The question as asked — 'is that voiceprint gone from the model' — presumes a single object and a single moment. There are at least four objects (the store, the corpus for the next run, the currently served weights, and every superseded or derived artefact) and the answer is different for each, at different times. A lead who answers yes is signing for all four; a lead who answers no loses a conversation they could have won. The move is to decompose, and to say which parts are cheap and certain and which are expensive and bounded. ### The three claims, in order of what they cost **Claim one: the record is deleted and excluded.** The enrolment is removed from the store and from every training set built afterwards. This is cheap, auditable through the pipeline, and effective immediately. It is also the claim most organisations mistakenly present as the whole answer. **Claim two: the served model was fitted without it.** This becomes true when a run that excluded the record produces the weights currently serving. With a monthly cadence, the commitment is 'no later than the end of the next cycle', which is a date, not a yes. Two decisions ride on it. What is the interval, given that a full training run is the unit of cost and batching many requests into one run is what makes the programme affordable at all? And is there an out-of-cycle path — a category of request (a court order, a compromised enrolment, a minor) that triggers a run on its own, and who authorises the spend? Deciding this before it is asked is the difference between a policy and an improvisation. **Claim three: no residual influence.** With exact retraining this follows from the process: the parameters are a function of a corpus the record never entered. It is the strongest claim available and it does not depend on any attack's strength, which is exactly why it is worth paying for. If instead an approximate removal method was used, the claim collapses to that method's bound, under its assumptions, and the only defensible thing to put in writing is the bound and the assumptions. Presenting an approximate method's output as deletion is the failure mode that ends careers, because the gap is discoverable by anyone with the two artefacts. ### The two caveats to volunteer rather than concede **Correlated and duplicate records.** If the same person enrolled twice, or a related record derived from the same audio remains, the retrained model still fits something that resembles the withdrawn voiceprint. This is a scoping decision: are you removing a record or a person? A regulator is asking about the person. Commit to subject-level removal and to the identity resolution that makes it real, or say plainly that you are removing records and describe the residue. **Superseded and derived artefacts.** Every earlier checkpoint fitted with the record, every model fine-tuned or distilled from one, every copy running in a branch or on a device still carries the influence and is untouched by any retrain. If those remain reachable they also supply the second half of a version-comparison attack. Retirement of superseded artefacts belongs inside the commitment, with a timeline, not in a cleanup backlog. ### What evidence to attach, and how to describe it Attach a verification result and describe it honestly: which membership test, what access it assumed, its query budget, how many withdrawn records were tested out of how many removed, the base rate, and the advantage with its interval. Say that a null result bounds that attack at that strength on those records — it is corroboration for the process claim, not a substitute for it. Regulators are not helped by a bare pass, and a bare pass is what gets re-read adversarially later. ### The design decision that changes the whole conversation The deepest answer available at this level is that the cost structure was chosen at architecture time. If enrolments are held as reference templates compared at inference rather than folded into the fitted parameters of the matcher, then a withdrawal is a store operation again, with an immediate and certain answer — and the trained component is a general model whose corpus contains no individual customer at all. That design pays somewhere else, usually in accuracy or in what the model can personalise. The judgment to own is whether a channel that will receive withdrawal requests indefinitely should have been built so that honouring one costs a training run in the first place. Answering that question next quarter is worth more than any improvement to the unlearning method. ### The commitment, in one paragraph Removed from stores and future corpora today; served weights fitted without it by the end of the next cycle, with a named out-of-cycle path; residual influence zero by construction of that run, subject to subject-level identity resolution and a stated retirement schedule for superseded artefacts; corroborated by a membership evaluation whose power we state. That is defensible line by line, and every line is one somebody in the room can be held to.