cs.IROct 19, 2026

Neighborhood-Aware Unlearning for Generative Recommendation

Authors: Pierre Lubitzsch, Yubao Tang, Maarten de Rijke, Sebastian Schelter

Organizations: BIFOLD & TU Berlin, Germany · University of Amsterdam, The Netherlands

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Generative recommendation predicts items by autoregressively generating semantic identifiers (SIDs), whose tokens are shared across semantically related items. With this paradigm gaining adoption, the question of how to support unlearning in it has become pressing. If training interactions must later be removed, such as injected spam or interactions with items a user no longer wants, this sharing lets an unlearning update unintentionally affect the predictions for the interactions' neighbors. We show that this effect is locally structured and hidden by global metrics: unlearning can leave recommendation utility on the whole test set nearly unchanged while substantially degrading it on neighborhoods of the forgotten interactions' SIDs. We propose Neighborhood-Aware Unlearning (NAU), which augments interaction-level unlearning with explicit control over the probability mass assigned to the forgotten items' neighborhoods. Across three datasets and four SID tokenizers, NAU restores spam-induced exposure toward the retrained reference while retaining more than 95% of retrained utility, and recovers the neighborhood utility that forget-and-repair unlearning loses at no global cost. We identify local probability redistribution as an important failure mode of unlearning in SID-based generative recommenders and show that explicitly controlling this redistribution can mitigate its effects.

Figures & tables

Figure 1: Utility ↑\uparrow ( NDCG@10\mathrm{NDCG}@10 as a percentage of the retrained model’s) versus spam exposure after spam removal, on the whole test set (left) and on the test cases whose next item shares the forgotten target’s first SID token (right). Only NAU removes spam exposure while preserving model utility on both the whole test set and the neighborhood of the forgotten interactions.
 BeautySportsToys
MethodΔSHretr↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\downarrow}NDCG@10↑\mathrm{NDCG}@10{\uparrow}τP↑\tau_{P}{\uparrow}ΔSHretr↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\downarrow}NDCG@10↑\mathrm{NDCG}@10\uparrowτP↑\tau_{P}{\uparrow}ΔSHretr↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\downarrow}NDCG@10↑\mathrm{NDCG}@10\uparrowτP↑\tau_{P}{\uparrow}
Retrained(0.072)3.766 ±\pm 0.13100.0(0.139)2.033 ±\pm 0.07100.0(0.073)3.465 ±\pm 0.11100.0
Poisoned0.902 ±\pm 0.593.589 ±\pm 0.0395.4 ±\pm 3.320.168 ±\pm 0.172.031 ±\pm 0.06100.0 ±\pm 2.960.221 ±\pm 0.143.387 ±\pm 0.0697.8 ±\pm 3.29
Baselines
Finetune0.767 ±\pm 0.673.626 ±\pm 0.0496.4 ±\pm 2.800.281 ±\pm 0.232.082 ±\pm 0.04102.5 ±\pm 3.520.823 ±\pm 0.323.350 ±\pm 0.0696.8 ±\pm 4.03
Forget only0.072 ±\pm 0.040.086 ±\pm 0.142.2 ±\pm 3.570.139 ±\pm 0.210.014 ±\pm 0.020.7 ±\pm 1.200.073 ±\pm 0.060.012 ±\pm 0.010.3 ±\pm 0.24
Table 1: Spam removal on Beauty, Sports, and Toys with TIGER + RQ-KMeans SID under a 1% bandwagon attack; mean ±\pm s.d. over five data seeds ×\times three targets per dataset. ΔSHretr=∣SHU@10−SHR@10∣\Delta^{\mathrm{retr}}_{\mathrm{SH}}=|\mathrm{SH}_{U}@10-\mathrm{SH}_{R}@10| is the distance of the promoted item’s exposure from the retrained model’s, so leftover exposure and over-suppression both count. In the Retrain row, the italic value in parentheses is the retrained model’s own SH@10\mathrm{SH}@10 , the reference for that column. For each baseline, we report the configuration with the smallest validation ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} among those keeping validation τP≥95%\tau_{P}\geq 95\% (ties broken by higher τP\tau_{P} ), or, when no configuration reaches 95%95\% , the smallest ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} overall. NAU is reported at one operating point for all datasets ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 ); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. All values are percentages. Bold and underline mark the best and second-best value per column among methods keeping τP≥95%\tau_{P}\geq 95\% . TRACER has no Beauty run under RQ-KMeans; cells marked † are its Beauty result under its own tokenizer, where τP\tau_{P} is measured against that tokenizer’s retrained reference.
ObjectiveWhole test setSID neighborhood
ΔSHretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}{\downarrow}NDCG@10↑\mathrm{NDCG}@10{\uparrow}τP(%)↑\tau_{P}{\scriptstyle\,(\%)}{\uparrow}ΔSHretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}{\downarrow}NDCG@10↑\mathrm{NDCG}@10{\uparrow}τP(%)↑\tau_{P}{\scriptstyle\,(\%)}{\uparrow}
Retrained0.000 ±\pm 0.003.766 ±\pm 0.13100.00.000 ±\pm 0.002.779 ±\pm 1.63100.0
Poisoned0.753 ±\pm 0.793.571 ±\pm 0.090 94.84.780 ±\pm 11.032.420 ±\pm 1.230 87.1
Lret\mathcal{L}_{\mathrm{ret}} only0.692 ±\pm 0.773.659 ±\pm 0.060 97.23.633 ±\pm 4.842.954 ±\pm 1.76106.3
+ Lfor+\ \mathcal{L}_{\mathrm{for}}0.021 ±\pm 0.043.654 ±\pm 0.070 97.00.000 ±\pm 0.002.419 ±\pm 1.440 87.0
+ Lsep+\ \mathcal{L}_{\mathrm{sep}} ( λs=.01\lambda_{s}=.01 )0.001 ±\pm 0.003.648 ±\pm 0.050 96.90.000 ±\pm 0.002.428 ±\pm 1.420 87.4
Table 2: Ablation of NAU on Beauty with TIGER + RQ-KMeans over five seeds. Indented rows are alternative additions to Lret+Lfor\mathcal{L}_{\mathrm{ret}}+\mathcal{L}_{\mathrm{for}} (siblings, not a ladder). Since retrained exposure is 0%0\% in both query sets, SH@10\mathrm{SH}@10 also equals the absolute distance to retrained exposure. τP\tau_{P} denotes NDCG@10\mathrm{NDCG}@10 as a percentage of the retrained model’s utility within each query set.
MethodUHF@10(%)↓\mathrm{UHF}@10{\scriptstyle\,(\%)}{\downarrow}UHR@10(%)\mathrm{UHR}@10{\scriptstyle\,(\%)}ΔUHRretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{UHR}}{\scriptstyle\,(\%)}{\downarrow}NDCG@10↑\mathrm{NDCG}@10{\uparrow}τP\tau_{P} (%) ↑{\uparrow}E(s)↓\mathcal{E}{\scriptstyle\,(s)}{\downarrow}
Finetune14.424 ±\pm 13.4612.948 ±\pm 0.5500.612 ±\pm 0.2993.510 ±\pm 0.16296.3 ±\pm 5.00.3
Forget only9.419 ±\pm 6.1091.990 ±\pm 1.1761.111 ±\pm 0.6843.516 ±\pm 0.18396.4 ±\pm 5.80.3
Forget+Repair12.606 ±\pm 14.8992.543 ±\pm 0.8400.734 ±\pm 0.3373.522 ±\pm 0.16896.6 ±\pm 5.20.5
SCIF15.981 ±\pm 8.9023.303 ±\pm 0.4240.481 ±\pm 0.3793.682 ±\pm 0.139101.0 ±\pm 4.633.9
SEIF †0.000 ±\pm 0.0000.000 ±\pm 0.0002.823 ±\pm 0.4740.030 ±\pm 0.0320.8 ±\pm 0.90.3
Kookmin †1.818 ±\pm 4.0661.230 ±\pm 0.9391.699 ±\pm 1.1802.788 ±\pm 0.17976.5 ±\pm 5.60.3
Table 3: Unwanted item removal on Beauty (Hair Loss Products) with TIGER + RQ-KMeans, five data seeds. UHF@10\mathrm{UHF}@10 and UHR@10\mathrm{UHR}@10 are the unwanted item hit rates of the requesting and the remaining users; ΔUHRretr\Delta^{\mathrm{retr}}_{\mathrm{UHR}} is the mean over seeds of ∣UHRU@10−UHRR@10∣|\mathrm{UHR}_{U}@10-\mathrm{UHR}_{R}@10| , the distance to the retrained model of the same seed. Each method uses the configuration selected on the validation split ( Table 8 ; † : τP<95%\tau_{P}<95\% , never ranked); NAU uses λn=−1\lambda_{n}=-1 , λs=0\lambda_{s}=0 . Retraining does not lower UHF@10\mathrm{UHF}@10 below the original model.
DatasetSIDUHF@10(%)↓\mathrm{UHF}@10{\scriptstyle\,(\%)}{\downarrow}UHR@10(%)\mathrm{UHR}@10{\scriptstyle\,(\%)}τP(%)↑\tau_{P}{\scriptstyle\,(\%)}{\uparrow}Retrained UHF\mathrm{UHF} / UHR\mathrm{UHR}
BeautyRQ-KMeans12.2 →\rightarrow 9.4 (1/5)2.3 →\rightarrow 2.3 (2/5)93.3 →\rightarrow 95.5 (5/5)16.2 / 2.82
BeautyLETTER15.4 →\rightarrow 10.1 (3/5)4.1 →\rightarrow 4.4 (3/5)89.4 →\rightarrow 89.7 (4/5)15.0 / 6.66
SportsRQ-KMeans27.6 →\rightarrow 11.1 (5/5)1.4 →\rightarrow 0.5 (5/5)91.1 →\rightarrow 92.4 (3/5)29.3 / 1.42
SportsLETTER22.0 →\rightarrow 12.1 (5/5)1.4 →\rightarrow 0.6 (5/5)94.2 →\rightarrow 95.0 (3/5)37.1 / 1.91
ToysRQ-KMeans0 5.0 →\rightarrow 9.7 (0/5)2.3 →\rightarrow 2.4 (3/5)92.1 →\rightarrow 95.1 (5/5)18.1 / 3.51
ToysLETTER14.8 →\rightarrow 9.7 (3/5)3.4 →\rightarrow 2.9 (5/5)90.5 →\rightarrow 93.5 (5/5)0 6.6 / 3.44
Table 4: Effect of the neighborhood term in unwanted item removal across datasets and tokenizers: NAU with λn=−1\lambda_{n}=-1 against the same objective without the term ( λn=0\lambda_{n}=0 ; λf=0.1\lambda_{f}=0.1 , λs=0\lambda_{s}=0 ), paired over five data seeds. Each cell gives λn=0→−1\lambda_{n}=0\rightarrow-1 (mean over seeds) and, in parentheses, on how many of the five seeds the value decreases ( UHF\mathrm{UHF} , UHR\mathrm{UHR} ) or increases ( τP\tau_{P} ). Retrained UHF@10\mathrm{UHF}@10 and UHR@10\mathrm{UHR}@10 are given for reference.
Figure 2: Effect of each objective term on the neighborhood (spam removal on Beauty, TIGER + RQ-KMeans, mid-popularity target, five seeds). (a) Utility as a percentage of the retrained model’s, on the whole test set and on the target’s SID neighborhood (523 test cases whose next item shares the target’s first SID token). (b) Neighborhood utility gained over fine-tuning on the retain and forget sets, in percentage points, with 95% paired bootstrap intervals ( Appendix G ); intervals excluding 0 mark reliable differences. The last row uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not selected ( Table 6 ). Baselines are compared in Figure 1 and Table 1 .
Appendix figures & tables22 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset#Users#Items#InteractionsAvg. length
Beauty22,36312,101198,5028.88
Sports35,59818,357296,3378.32
Toys19,41211,924167,5978.63
Appendix
Table 5: Dataset statistics after preprocessing.
  Whole setSID neighborhoodCombined 
λs\lambda_{s}λn\lambda_{n}ΔSHretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrowτP(%)↑\tau_{P}{\scriptstyle\,(\%)}\uparrowΔSHretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrowτP(%)↑\tau_{P}{\scriptstyle\,(\%)}\uparrowτP(%)↑\tau_{P}{\scriptstyle\,(\%)}\uparrowSel.
0.00.00.11296.90.67886.591.7 
0.00.010.08996.70.863106.6101.7 
0.00.10.09493.70.874157.9125.8 
0.010.00.08697.00.87987.692.3 
0.010.010.08696.90.874103.6100.2✓
Appendix
Table 6: Selection of NAU’s weights on the validation split (Beauty, TIGER + RQ-KMeans, λf=0.1\lambda_{f}=0.1 , three targets ×\times five data seeds). Whole set: ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} and τP\tau_{P} on all validation cases; neighborhood: the same on the validation cases whose next item shares the target’s first SID token (the target’s own cases excluded), with τP\tau_{P} as a ratio of pooled NDCG@10\mathrm{NDCG}@10 . Selection is among settings of the full objective ( λs,λn>0\lambda_{s},\lambda_{n}>0 ) that keep whole-set τP≥95%\tau_{P}\geq 95\% : settings whose whole-set ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is not resolvably different from the lowest one (paired 95% interval over the five seeds includes 0) are treated as tied, and among them the highest combined utility, the mean of whole-set and neighborhood τP\tau_{P} , is selected (✓); the choice is the same for any weighting of the two. Settings below 95%95\% whole-set utility are shown in gray; – marks settings not scored on the neighborhood.
   ValidationTest 
DatasetMethodConfigurationΔSHretr↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}\downarrowτP↑\tau_{P}\uparrowΔSHretr↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}\downarrowτP↑\tau_{P}\uparrowSel.
BeautyFanchuanfanchuan_t0.0070.07911.90.07212.6 
BeautyFanchuanfanchuan_t0.070.07932.00.07232.4✓
BeautyForget onlyunified_abl_lf0.1_ls0.0_ln0.0_lr0.00.0792.10.0721.9 
BeautyForget onlyunified_abl_lf1.0_ls0.0_ln0.0_lr0.00.0792.70.0722.5✓
BeautyForget+Repairunified_abl_lf1.0_ls0.0_ln0.00.07975.80.07272.8 
Appendix
Table 7: Hyperparameter selection on the validation split (TIGER + RQ-KMeans; TRACER on Beauty with its own tokenizer). For every candidate configuration, pooled over five data seeds and three targets: distance to the retrained model’s exposure ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} and τP\tau_{P} , on the validation split (used for selection) and on the test split (reported in Table 1 ). The selected configuration (✓) has the smallest validation ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} among those with validation τP≥95%\tau_{P}\geq 95\% , ties broken by higher τP\tau_{P} ; if none reaches 95%95\% , the smallest validation ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} overall. Finetune and SCIF have a single configuration; NAU’s selection is shown in Table 6 .
   ValidationTest 
DatasetMethodConfigurationUHF@10↓\mathrm{UHF}@10\downarrowτP↑\tau_{P}\uparrowUHF@10↓\mathrm{UHF}@10\downarrowτP↑\tau_{P}\uparrowSel.
BeautySCIFscif_d0.00124.9999.615.98101.0 
BeautySCIFscif_d0.0124.9999.615.98101.0✓
BeautySCIFscif_d0.126.5399.615.98100.9 
BeautySEIFseif_std0.00615.5060.410.0663.9 
BeautySEIFseif_std0.0617.0459.28.2562.0 
Appendix
Table 8: Hyperparameter selection for unwanted-item removal on the validation split (TIGER + RQ-KMeans). For every candidate configuration, averaged over five data seeds: UHF@10\mathrm{UHF}@10 and τP\tau_{P} on the validation split (used for selection) and on the test split (reported in Appendix F ). The selected configuration (✓) has the lowest validation UHF@10\mathrm{UHF}@10 among those with validation τP≥95%\tau_{P}\geq 95\% ; if none reaches 95%95\% , the lowest validation UHF@10\mathrm{UHF}@10 overall. NAU ( λf=0.1\lambda_{f}=0.1 , λs=0\lambda_{s}=0 ) selects λn\lambda_{n} once on the Beauty validation split with the same rule and uses it on all datasets. Finetune, Forget only and Forget+Repair have a single configuration.
MethodE\mathcal{E} (s) ↓\downarrowτE\tau_{E} ↑\uparrow
Finetune0.50.99997
Forget only0.30.99998
Forget + Repair0.70.99995
SCIF35.30.99774
SEIF0.50.99997
Kookmin0.40.99998
Appendix
Table 9: Efficiency of unlearning methods on Beauty (TIGER + RQ-KMeans), each at its configuration in Table 1 . E\mathcal{E} is the median wall-clock time per unlearning request on one H200 GPU over three targets ×\times five data seeds, and τE=1−E/Eretrain\tau_{E}=1-\mathcal{E}/\mathcal{E}_{\mathrm{retrain}} the fraction of retraining cost saved. † TRACER under its own tokenizer, as in Table 1 .
TargetVariantSH@10\mathrm{SH}@10 (%)NDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularNAU (gen. sep.)0.000 ±\pm 0.0003.600 ±\pm 0.11995.8 ±\pm 6.23.5
NAU (cos. sep.)0.000 ±\pm 0.0003.504 ±\pm 0.09293.2 ±\pm 5.42.9
NAU0.000 ±\pm 0.0003.596 ±\pm 0.11595.6 ±\pm 6.13.4
NAU (grid)0.000 ±\pm 0.0003.612 ±\pm 0.10696.1 ±\pm 5.83.7
MidNAU (gen. sep.)0.000 ±\pm 0.0003.654 ±\pm 0.04197.1 ±\pm 2.83.5
NAU (cos. sep.)0.000 ±\pm 0.0003.545 ±\pm 0.05394.2 ±\pm 2.32.9
Appendix
Table 10: Additional NAU variants on Beauty with TIGER and RQ-KMeans SID under the bandwagon attack. The variants differ in the separation score and the neighborhood/separation weight selection strategy. SH@10\mathrm{SH}@10 , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages.
TargetMethodSH@10\mathrm{SH}@10 (%)ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} (%) ↓\downarrowNDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularBaselines
Finetune0.365 ±\pm 0.3620.361 ±\pm 0.3623.206 ±\pm 0.10698.6 ±\pm 2.40.9
Forget only0.000 ±\pm 0.0000.004 ±\pm 0.0080.166 ±\pm 0.2885.2 ±\pm 9.10.4
Forget + Repair0.016 ±\pm 0.0360.020 ±\pm 0.0353.196 ±\pm 0.10498.3 ±\pm 2.60.8
SCIF0.729 ±\pm 1.0810.725 ±\pm 1.0823.203 ±\pm 0.09798.5 ±\pm 1.235.2
SEIF0.119 ±\pm 0.1900.115 ±\pm 0.1822.267 ±\pm 0.19269.8 ±\pm 6.60.5
Appendix
Table 11: Spam-removal results on Beauty with TIGER + RQ-VAE SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 , generative separation score); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. SH@10\mathrm{SH}@10 , ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages. ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the mean over (seed, target) cells of ∣SH@10−SH@10retr∣|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}| , so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and τP\tau_{P} indicate better utility preservation. E\mathcal{E} reports unlearning time per request in seconds.
TargetMethodSH@10\mathrm{SH}@10 (%)ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} (%) ↓\downarrowNDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularBaselines
Finetune0.494 ±\pm 0.6900.494 ±\pm 0.6901.719 ±\pm 0.095106.0 ±\pm 8.91.3
Forget only0.000 ±\pm 0.0000.000 ±\pm 0.0000.085 ±\pm 0.1786.0 ±\pm 12.70.4
Forget + Repair0.178 ±\pm 0.3950.178 ±\pm 0.3951.710 ±\pm 0.095105.4 ±\pm 9.01.0
SCIF0.725 ±\pm 1.0040.725 ±\pm 1.0041.658 ±\pm 0.091102.3 ±\pm 10.534.9
SEIF0.011 ±\pm 0.0150.011 ±\pm 0.0151.001 ±\pm 0.07361.8 ±\pm 6.80.7
Appendix
Table 12: Spam-removal results on Sports with TIGER + RQ-VAE SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 , generative separation score); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. SH@10\mathrm{SH}@10 , ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages. ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the mean over (seed, target) cells of ∣SH@10−SH@10retr∣|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}| , so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and τP\tau_{P} indicate better utility preservation. E\mathcal{E} reports unlearning time per request in seconds.
TargetMethodSH@10\mathrm{SH}@10 (%)ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} (%) ↓\downarrowNDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularBaselines
Finetune0.457 ±\pm 0.2950.453 ±\pm 0.2943.009 ±\pm 0.04898.1 ±\pm 3.60.9
Forget only0.000 ±\pm 0.0000.004 ±\pm 0.0090.048 ±\pm 0.0621.5 ±\pm 1.90.4
Forget + Repair0.031 ±\pm 0.0430.033 ±\pm 0.0423.005 ±\pm 0.06397.9 ±\pm 3.71.3
SCIF0.651 ±\pm 0.5770.647 ±\pm 0.5793.034 ±\pm 0.05898.8 ±\pm 2.934.2
SEIF0.104 ±\pm 0.0910.100 ±\pm 0.0881.984 ±\pm 0.14564.7 ±\pm 5.90.5
Appendix
Table 13: Spam-removal results on Toys with TIGER + RQ-VAE SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 , generative separation score); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. SH@10\mathrm{SH}@10 , ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages. ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the mean over (seed, target) cells of ∣SH@10−SH@10retr∣|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}| , so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and τP\tau_{P} indicate better utility preservation. E\mathcal{E} reports unlearning time per request in seconds.
TargetMethodSH@10\mathrm{SH}@10 (%)ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} (%) ↓\downarrowNDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularBaselines
Finetune0.194 ±\pm 0.1420.193 ±\pm 0.1423.823 ±\pm 0.062101.0 ±\pm 5.30.9
Forget only0.000 ±\pm 0.0000.001 ±\pm 0.0020.011 ±\pm 0.0150.3 ±\pm 0.40.4
Forget + Repair0.000 ±\pm 0.0000.001 ±\pm 0.0023.778 ±\pm 0.08299.8 ±\pm 5.81.3
SCIF0.245 ±\pm 0.1830.244 ±\pm 0.1823.764 ±\pm 0.06299.4 ±\pm 3.840.0
SEIF0.123 ±\pm 0.1570.123 ±\pm 0.1562.684 ±\pm 0.24070.7 ±\pm 3.30.6
Appendix
Table 14: Spam-removal results on Beauty with TIGER + LETTER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 , generative separation score); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. SH@10\mathrm{SH}@10 , ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages. ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the mean over (seed, target) cells of ∣SH@10−SH@10retr∣|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}| , so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and τP\tau_{P} indicate better utility preservation. E\mathcal{E} reports unlearning time per request in seconds.
TargetMethodSH@10\mathrm{SH}@10 (%)ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} (%) ↓\downarrowNDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularBaselines
Finetune0.240 ±\pm 0.2310.167 ±\pm 0.2041.992 ±\pm 0.053105.8 ±\pm 7.01.3
Forget only0.000 ±\pm 0.0000.078 ±\pm 0.1050.011 ±\pm 0.0210.6 ±\pm 1.10.3
Forget + Repair0.030 ±\pm 0.0660.097 ±\pm 0.1001.976 ±\pm 0.055104.9 ±\pm 7.21.0
SCIF0.334 ±\pm 0.3520.256 ±\pm 0.3451.946 ±\pm 0.060103.3 ±\pm 6.434.8
SEIF0.157 ±\pm 0.2100.079 ±\pm 0.1061.206 ±\pm 0.08764.0 ±\pm 6.30.8
Appendix
Table 15: Spam-removal results on Sports with TIGER + LETTER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 , generative separation score); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. SH@10\mathrm{SH}@10 , ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages. ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the mean over (seed, target) cells of ∣SH@10−SH@10retr∣|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}| , so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and τP\tau_{P} indicate better utility preservation. E\mathcal{E} reports unlearning time per request in seconds.
TargetMethodSH@10\mathrm{SH}@10 (%)ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} (%) ↓\downarrowNDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularBaselines
Finetune0.518 ±\pm 0.3980.501 ±\pm 0.4153.374 ±\pm 0.05994.6 ±\pm 3.30.5
Forget only0.000 ±\pm 0.0000.018 ±\pm 0.0340.000 ±\pm 0.0000.0 ±\pm 0.00.3
Forget + Repair0.012 ±\pm 0.0130.026 ±\pm 0.0313.391 ±\pm 0.04895.0 ±\pm 2.61.2
SCIF0.874 ±\pm 0.7410.856 ±\pm 0.7593.411 ±\pm 0.05495.6 ±\pm 2.839.1
SEIF0.098 ±\pm 0.0870.109 ±\pm 0.0722.124 ±\pm 0.11759.6 ±\pm 4.40.6
Appendix
Table 16: Spam-removal results on Toys with TIGER + LETTER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 , generative separation score); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. SH@10\mathrm{SH}@10 , ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages. ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the mean over (seed, target) cells of ∣SH@10−SH@10retr∣|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}| , so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and τP\tau_{P} indicate better utility preservation. E\mathcal{E} reports unlearning time per request in seconds.
TargetMethodSH@10\mathrm{SH}@10 (%)ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} (%) ↓\downarrowNDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)E\mathcal{E} (s)
UnpopularBaselines
Finetune1.250 ±\pm 0.9361.250 ±\pm 0.9363.700 ±\pm 0.072102.8 ±\pm 3.30.5
Forget only0.000 ±\pm 0.0000.000 ±\pm 0.0000.020 ±\pm 0.0340.5 ±\pm 0.90.4
Forget + Repair0.097 ±\pm 0.1290.097 ±\pm 0.1293.701 ±\pm 0.077102.8 ±\pm 3.20.7
SCIF1.729 ±\pm 1.6601.729 ±\pm 1.6603.649 ±\pm 0.056101.4 ±\pm 3.039.9
SEIF0.535 ±\pm 0.7140.535 ±\pm 0.7142.607 ±\pm 0.19372.5 ±\pm 5.60.5
Appendix
Table 17: Spam-removal results on Beauty with TIGER + TRACER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point ( λf=0.1\lambda_{f}=0.1 , λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 , generative separation score); the indented row below it uses a stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) and is not ranked. SH@10\mathrm{SH}@10 , ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} , NDCG@10\mathrm{NDCG}@10 , and τP\tau_{P} are reported as percentages. ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the mean over (seed, target) cells of ∣SH@10−SH@10retr∣|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}| , so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and τP\tau_{P} indicate better utility preservation. E\mathcal{E} reports unlearning time per request in seconds.
Whole test set
ObjectiveSH@10(%)↓\mathrm{SH}@10{\scriptstyle\,(\%)}\downarrowΔSHretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrowNDCG@10↑\mathrm{NDCG}@10\uparrowτP(%)↑\tau_{P}{\scriptstyle\,(\%)}\uparrow
Retrained0.067 ±\pm 0.120.0003.461 ±\pm 0.11100.0
Poisoned0.297 ±\pm 0.230.2303.377 ±\pm 0.0697.6
Lret\mathcal{L}_{\mathrm{ret}} only0.656 ±\pm 0.570.5893.348 ±\pm 0.0396.7
+ Lfor+\ \mathcal{L}_{\mathrm{for}}0.159 ±\pm 0.230.0923.345 ±\pm 0.0396.6
+ Lsep+\ \mathcal{L}_{\mathrm{sep}} ( λs=.01\lambda_{s}=.01 )0.113 ±\pm 0.180.0463.352 ±\pm 0.0396.8
Appendix
Table 18: Ablation of NAU on Toys with TIGER + RQ-KMeans (mid-popularity target, five seeds). The SID neighborhood contains 563 test cases whose next item shares the target’s first SID token; the target’s own test cases are excluded. Indented rows are alternative additions to Lret+Lfor\mathcal{L}_{\mathrm{ret}}+\mathcal{L}_{\mathrm{for}} (siblings, not a ladder). ΔSHretr\Delta^{\mathrm{retr}}_{\mathrm{SH}} is the absolute distance to the retrained model’s exposure (0.067% on the whole test set and 2.664% in the neighborhood). τP\tau_{P} denotes NDCG@10\mathrm{NDCG}@10 as a percentage of the retrained model’s utility within each query set.
ObjectiveRemoval and utilityLocal effect (nats)
SH@10(%)\mathrm{SH}@10{\scriptstyle\,(\%)}ΔSHretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrowNDCG@10↑\mathrm{NDCG}@10\uparrowτP(%)↑\tau_{P}{\scriptstyle\,(\%)}\uparrowΔtgt\Delta_{\mathrm{tgt}}Δnbr−Δctrl\Delta_{\mathrm{nbr}}-\Delta_{\mathrm{ctrl}}
Lret\mathcal{L}_{\mathrm{ret}} only0.986 ±\pm 0.9470.9143.630 ±\pm 0.10996.5 ±\pm 3.7+5.07+5.07 ±\pm 1.69−0.14-0.14 ±\pm 0.21
+ Lfor+\ \mathcal{L}_{\mathrm{for}}0.110 ±\pm 0.2110.1083.622 ±\pm 0.11896.3 ±\pm 4.0+1.67+1.67 ±\pm 4.17+0.04+0.04 ±\pm 0.31
+ Lsep+\ \mathcal{L}_{\mathrm{sep}} ( λs=0.1\lambda_{s}=0.1 )0.000 ±\pm 0.0000.0723.615 ±\pm 0.10596.1 ±\pm 3.9−19.04-19.04 ±\pm 5.57−0.11-0.11 ±\pm 0.17
+ Lnbr+\ \mathcal{L}_{\mathrm{nbr}} ( λn=0.01\lambda_{n}=0.01 )0.038 ±\pm 0.1180.1033.615 ±\pm 0.11196.1 ±\pm 3.8−1.74-1.74 ±\pm 3.23 †+0.36+0.36 ±\pm 0.37 †
NAU ( λs=0.01\lambda_{s}=0.01 , λn=0.01\lambda_{n}=0.01 )0.010 ±\pm 0.0340.0813.621 ±\pm 0.10796.2 ±\pm 3.8−4.32-4.32 ±\pm 3.39+0.33+0.33 ±\pm 0.34
Appendix
Table 19: Ablation of NAU on Beauty (TIGER + RQ-KMeans, five seeds ×\times three targets). Indented rows each add one term to Lret+Lfor\mathcal{L}_{\mathrm{ret}}+\mathcal{L}_{\mathrm{for}} (siblings, not a ladder). Local effect: signed change in log probability mass relative to the retrained model of the same seed, on held-out test histories, for the forgotten target ( Δtgt\Delta_{\mathrm{tgt}} ) and its SID -prefix neighbors beyond prefix-disjoint controls ( Δnbr−Δctrl\Delta_{\mathrm{nbr}}-\Delta_{\mathrm{ctrl}} ); mean ±\pm s.d. across seeds. † Local effect measured on a matched configuration rather than the ablation’s own runs. Lfor\mathcal{L}_{\mathrm{for}} does most of the removal, Lnbr\mathcal{L}_{\mathrm{nbr}} moves mass into the neighborhood in proportion to λn\lambda_{n} , and a strong separation term ( λs=0.1\lambda_{s}=0.1 ) pushes the target far below its retrained mass.
TargetLoss termsSH@10\mathrm{SH}@10 (%)NDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)ΔτP\Delta\tau_{P} (%)
UnpopularLretain\mathcal{L}_{\mathrm{retain}} only0.184 ±\pm 0.2312.082 ±\pm 0.024102.5 ±\pm 3.8+0.85 ±\pm 0.50
+ Lforget+\ \mathcal{L}_{\mathrm{forget}}0.000 ±\pm 0.0002.065 ±\pm 0.029101.7 ±\pm 4.0–
+ Lsep+\ \mathcal{L}_{\mathrm{sep}} ( λs=0.1\lambda_{s}=0.1 )0.000 ±\pm 0.0002.059 ±\pm 0.026101.4 ±\pm 3.5-0.29 ±\pm 0.61
+ Lneighborhood+\ \mathcal{L}_{\mathrm{neighborhood}} ( λn=0.01\lambda_{n}=0.01 )0.000 ±\pm 0.0002.069 ±\pm 0.041101.9 ±\pm 4.0+0.18 ±\pm 1.14
+ Lsep+Lneighborhood+\ \mathcal{L}_{\mathrm{sep}}+\mathcal{L}_{\mathrm{neighborhood}} == NAU ( λs=0.1\lambda_{s}=0.1 , λn=0.01\lambda_{n}=0.01 )0.000 ±\pm 0.0002.063 ±\pm 0.031101.6 ±\pm 3.3-0.11 ±\pm 0.83
NAU at λn=0.1\lambda_{n}=0.1 (over-strong dose, cosine sep)0.000 ±\pm 0.0002.007 ±\pm 0.04998.8 ±\pm 3.7-2.88 ±\pm 1.75
Appendix
Table 20: Per-term ablation of the NAU objective on Sports with TIGER + RQ-KMeans (bandwagon, 1% poison, ntarget=1n_{\text{target}}=1 ), at λf=0.1\lambda_{f}=0.1 , λs=0.1\lambda_{s}=0.1 , λn=0.01\lambda_{n}=0.01 and wr=wf=1\bm{w}_{r}=\bm{w}_{f}=\bm{1} , with the generative separation score ϕgen\phi_{\mathrm{gen}} and embedding/mass neighbours in every row that activates the corresponding term, so only the WEIGHTS vary. The one exception is the over-strong dose row, which is only available with the cosine score and is marked accordingly. Each data seed is scored against its own clean and poisoned reference, with unlearning replicates averaged within a seed and the spread taken across seeds; ±\pm is therefore absent wherever the column rests on a single data seed. SH@10\mathrm{SH}@10 , NDCG@10\mathrm{NDCG}@10 , τP\tau_{P} and ΔτP\Delta\tau_{P} are reported as percentages, matching the main results tables. ΔτP\Delta\tau_{P} is paired against the + Lforget+\,\mathcal{L}_{\mathrm{forget}} row on (stratum, seed), which removes the seed intercept.
TargetLoss termsSH@10\mathrm{SH}@10 (%)NDCG@10\mathrm{NDCG}@10 (%)τP\tau_{P} (%)ΔτP\Delta\tau_{P} (%)
UnpopularLretain\mathcal{L}_{\mathrm{retain}} only1.092 ±\pm 1.2903.342 ±\pm 0.05896.5 ±\pm 3.8-0.35 ±\pm 0.41
+ Lforget+\ \mathcal{L}_{\mathrm{forget}}0.240 ±\pm 0.2553.354 ±\pm 0.07096.9 ±\pm 4.0–
+ Lsep+\ \mathcal{L}_{\mathrm{sep}} ( λs=0.1\lambda_{s}=0.1 )0.000 ±\pm 0.0003.337 ±\pm 0.05696.4 ±\pm 3.2-0.50 ±\pm 0.99
+ Lneighborhood+\ \mathcal{L}_{\mathrm{neighborhood}} ( λn=0.01\lambda_{n}=0.01 )0.013 ±\pm 0.0303.349 ±\pm 0.06596.7 ±\pm 3.5-0.16 ±\pm 0.45
+ Lsep+Lneighborhood+\ \mathcal{L}_{\mathrm{sep}}+\mathcal{L}_{\mathrm{neighborhood}} == NAU ( λs=0.1\lambda_{s}=0.1 , λn=0.01\lambda_{n}=0.01 )0.000 ±\pm 0.0003.347 ±\pm 0.08096.7 ±\pm 4.6-0.18 ±\pm 1.02
NAU at λn=0.1\lambda_{n}=0.1 (over-strong dose, cosine sep)0.000 ±\pm 0.0003.282 ±\pm 0.05394.8 ±\pm 3.5-2.10 ±\pm 1.29
Appendix
Table 21: Per-term ablation of the NAU objective on Toys with TIGER + RQ-KMeans (bandwagon, 1% poison, ntarget=1n_{\text{target}}=1 ), at λf=0.1\lambda_{f}=0.1 , λs=0.1\lambda_{s}=0.1 , λn=0.01\lambda_{n}=0.01 and wr=wf=1\bm{w}_{r}=\bm{w}_{f}=\bm{1} , with the generative separation score ϕgen\phi_{\mathrm{gen}} and embedding/mass neighbours in every row that activates the corresponding term, so only the WEIGHTS vary. The one exception is the over-strong dose row, which is only available with the cosine score and is marked accordingly. Each data seed is scored against its own clean and poisoned reference, with unlearning replicates averaged within a seed and the spread taken across seeds; ±\pm is therefore absent wherever the column rests on a single data seed. SH@10\mathrm{SH}@10 , NDCG@10\mathrm{NDCG}@10 , τP\tau_{P} and ΔτP\Delta\tau_{P} are reported as percentages, matching the main results tables. ΔτP\Delta\tau_{P} is paired against the + Lforget+\,\mathcal{L}_{\mathrm{forget}} row on (stratum, seed), which removes the seed intercept.
Figure 3: Neighborhood utility gained on each dataset and target popularity (TIGER + RQ-KMeans, five seeds per setting), in points of the retrained model’s neighborhood utility: (a) NAU over fine-tuning on the retain and forget sets; (b) NAU with the stronger separation weight ( λs=0.1\lambda_{s}=0.1 ) over fine-tuning on the retain and forget sets with the separation term ( λs=0.1\lambda_{s}=0.1 ). Bars are 95% paired bootstrap intervals over the shared test cases ( Appendix G ); the neighborhood excludes the target’s own test cases.
MethodUHF@10(%)↓\mathrm{UHF}@10{\scriptstyle\,(\%)}\downarrowUHR@10(%)\mathrm{UHR}@10{\scriptstyle\,(\%)}ΔUHRretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{UHR}}{\scriptstyle\,(\%)}\downarrowNDCG@10↑\mathrm{NDCG}@10\uparrowτP\tau_{P} (%)E(s)↓\mathcal{E}{\scriptstyle\,(s)}\downarrow
Finetune †29.651 ±\pm 14.0351.602 ±\pm 0.2520.180 ±\pm 0.1261.894 ±\pm 0.06693.0 ±\pm 6.40.3
Forget only †16.606 ±\pm 12.7360.694 ±\pm 0.3270.727 ±\pm 0.3581.915 ±\pm 0.09494.1 ±\pm 8.60.3
Forget+Repair †30.718 ±\pm 10.9961.475 ±\pm 0.3380.221 ±\pm 0.1211.899 ±\pm 0.07193.2 ±\pm 6.70.5
SCIF32.870 ±\pm 16.7701.707 ±\pm 0.3850.334 ±\pm 0.2312.045 ±\pm 0.086100.5 ±\pm 9.434.5
SEIF †0.000 ±\pm 0.0000.000 ±\pm 0.0001.422 ±\pm 0.1970.003 ±\pm 0.0050.1 ±\pm 0.20.3
Kookmin †31.332 ±\pm 14.5741.408 ±\pm 0.2950.126 ±\pm 0.0891.374 ±\pm 0.09467.4 ±\pm 5.40.3
Appendix
Table 22: Unwanted item removal on Sports (Guns & Rifles) with TIGER + RQ-KMeans, five data seeds. UHF@10\mathrm{UHF}@10 and UHR@10\mathrm{UHR}@10 are the unwanted item hit rates of the requesting and the remaining users; ΔUHRretr\Delta^{\mathrm{retr}}_{\mathrm{UHR}} is the mean over seeds of ∣UHRU@10−UHRR@10∣|\mathrm{UHR}_{U}@10-\mathrm{UHR}_{R}@10| , the distance to the retrained model of the same seed. Each method uses the configuration selected on the validation split ( Table 8 ; † : τP<95%\tau_{P}<95\% , never ranked); NAU uses λn=−1\lambda_{n}=-1 , λs=0\lambda_{s}=0 .
MethodUHF@10(%)↓\mathrm{UHF}@10{\scriptstyle\,(\%)}\downarrowUHR@10(%)\mathrm{UHR}@10{\scriptstyle\,(\%)}ΔUHRretr(%)↓\Delta^{\mathrm{retr}}_{\mathrm{UHR}}{\scriptstyle\,(\%)}\downarrowNDCG@10↑\mathrm{NDCG}@10\uparrowτP\tau_{P} (%)E(s)↓\mathcal{E}{\scriptstyle\,(s)}\downarrow
Finetune6.538 ±\pm 6.9402.854 ±\pm 0.3870.767 ±\pm 0.4633.118 ±\pm 0.07795.1 ±\pm 2.90.3
Forget only †4.872 ±\pm 4.4551.879 ±\pm 0.5131.634 ±\pm 0.4042.945 ±\pm 0.11389.9 ±\pm 5.30.3
Forget+Repair †6.667 ±\pm 9.1292.363 ±\pm 0.2891.149 ±\pm 0.3743.067 ±\pm 0.07493.6 ±\pm 3.40.5
SCIF11.154 ±\pm 7.0452.911 ±\pm 0.1950.602 ±\pm 0.3403.392 ±\pm 0.070103.5 ±\pm 3.732.9
SEIF †0.000 ±\pm 0.0000.021 ±\pm 0.0463.492 ±\pm 0.2660.031 ±\pm 0.0291.0 ±\pm 0.90.3
Kookmin †8.205 ±\pm 8.3382.809 ±\pm 0.6120.774 ±\pm 0.7422.500 ±\pm 0.16176.3 ±\pm 6.20.3
Appendix
Table 23: Unwanted item removal on Toys (toy weapons) with TIGER + RQ-KMeans, five data seeds. UHF@10\mathrm{UHF}@10 and UHR@10\mathrm{UHR}@10 are the unwanted item hit rates of the requesting and the remaining users; ΔUHRretr\Delta^{\mathrm{retr}}_{\mathrm{UHR}} is the mean over seeds of ∣UHRU@10−UHRR@10∣|\mathrm{UHR}_{U}@10-\mathrm{UHR}_{R}@10| , the distance to the retrained model of the same seed. Each method uses the configuration selected on the validation split ( Table 8 ; † : τP<95%\tau_{P}<95\% , never ranked); NAU uses λn=−1\lambda_{n}=-1 , λs=0\lambda_{s}=0 . Retraining does not lower UHF@10\mathrm{UHF}@10 below the original model.
DatasetTokenizerLevelDistinct prefixesUnique (%)Mean nbrs.MedianP90Singletons (%)
BeautyRKMeans02562.182.90741410.2
  16,15050.83.161830.6
  210,48386.60.500278.3
  3 (dedup)12,101100.00.0000100.0
 RQVAE01030.9171.901512970.0
  16,37052.63.9411032.7
Appendix
Table 24: Neighborhood statistics across SID levels. Early levels define broader prefix-sharing neighborhoods, while later levels become increasingly sparse or singleton-dominated. A high singleton share indicates that the corresponding level is less suitable for prefix-based neighborhood construction.
targetupdate restricted toSH@10NDCG@10τP\tau_{\mathcal{P}}
unpopular : attack landed on all seeds
 all parameters (unrestricted)0.00000 ±\pm 0.000000.03586 ±\pm 0.001120.954 ±\pm 0.059
 levels 3, 4 frozen0.000000.036660.974
 levels 1, 2 + backbone0.00155 ±\pm 0.003260.03605 ±\pm 0.001270.959 ±\pm 0.065
 levels 1, 2, 3 + backbone0.00140 ±\pm 0.002920.03604 ±\pm 0.001300.959 ±\pm 0.065
 levels 1, 2, codes only0.00934 ±\pm 0.010580.03604 ±\pm 0.001030.958 ±\pm 0.055
Appendix
Table 25: Restricting the unlearning update to individual semantic ID levels, on beauty, TIGER + RQ-KMeans, at the full objective’s operating point. Levels are numbered 11 to L=4L=4 , level 44 being the deduplication digit. “codes only” freezes the backbone, so the update reaches the identifier embeddings and nothing else; those are the discriminating arms, because with the backbone free every restriction removes the target and the levels cannot be told apart. Each data seed is scored against its own reference, unlearning replicates averaged within a seed and the spread taken across seeds.
More in this topic

Machine Unlearning

Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.

See all 349 papers

Explore similar work

CardsList
Jun 5, 2026

TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation

Generative recommendation formulates next-item prediction as autoregressive generation over semantic ID (SID) sequences derived from users' historical interactions, making modern recommender systems structurally similar to large language models (LLMs). As privacy and safety concerns grow, these systems increasingly require concept unlearning to remove sensitive or harmful concepts associated with items. However, existing LLM unlearning methods cannot be directly applied to generative recommendation. Unlike word tokens with explicit semantics, SIDs are abstract identifiers that are often shared by both forget and retain items, leading to severe conflicts between concept removal and recommendation utility preservation. To address this challenge, we propose TRACER, an end-to-end concept unlearning framework based on token reassignment. Rather than directly suppressing shared SIDs, TRACER reassigns concept-related items to alternative tokens that better facilitate forgetting while minimizing side effects on retained items. We further introduce a coherence regularizer to preserve semantic consistency among retain items during unlearning. Experiments on real-world recommendation datasets demonstrate that TRACER effectively removes target concepts while substantially better preserving recommendation utility than existing unlearning baselines.

Ziheng Chen, Jiali Cheng, Zezhong Fan +4

Stony Brook University · University of Massachusetts Lowell · Columbia University +3

Sequential RecommendationConcept ErasureMachine UnlearningGenerative Recommendation
AskPDF
Jul 23, 2026

Can Generative Recommendation Reach Cold Items? A Temporal Perspective on Semantic-ID Generation

Semantic-ID-based generative recommendation represents items as sequences of shared semantic tokens, enabling token recombination beyond isolated item IDs. However, closed-world recombination does not necessarily imply temporal open-token cold-start induction, where new items enter the item catalog with unseen atomic tokens or weakly supported SID paths. In this work, we revisit SID-based generative recommendation under an absolute-time temporal protocol that separates seen and unseen targets and diagnoses the cold item reachability at the token level. Through seen/unseen-hit analysis, coldness taxonomy, and oracle-prefix probing, we show that current SID-based models can occasionally reach future items supported by observed tokens and prefixes, but struggle with unseen atomic tokens and unsupported SID paths. We further explain this boundary by interpreting SID generation as hierarchical semantic bucketing: early tokens select coarse semantic regions, while later tokens refine item-specific paths. These findings show that SID generation is compositional but not fully open-ended, and suggest future directions in more independent SID spaces, scoring-based interfaces, and dynamic textual context.

Jie Peng, Yanping Zheng, Zhewei Zhe +3

Renmin University of China · Beijing, China · Alibaba

Semantic ID RecommendationSequential RecommendationCold-Start RecommendationGenerative RecommendationCompositional Generalization
AskPDF
Jul 27, 2026

Understanding Semantic IDs: From Item Representation to Item Selection in Generative Recommendation

Semantic IDs (SIDs) are now a central component of generative recommendation. Current SID-based systems assign three roles to the same token sequence. Shared prefixes are intended to organize related items, the complete SID identifies an individual item, and each generated token narrows the items that can still be returned. We systematically investigate SIDs from item encoding and SID construction to autoregressive generation and final recommendation. We examine how SID construction changes item representations and how those changes affect generation. Across three Amazon domains and eight SID constructions, SID neighborhoods recover only 32.2% of the encoder's ten nearest neighbors on average. Alternative item descriptions still retrieve the corresponding item first in 99.57% of controlled cases, yet change 38.4% of exact SIDs. These results show that SIDs retain broad organization but lose much of the encoder's fine local structure, while their exact tokens are not determined by item meaning alone. This loss becomes consequential during generation. After the final semantic token, TIGER retains only 29.9% of held-out targets that were plausible recommendations before SID filtering. Motivated by these findings, we propose Item-Supported Decoding (ISD), a lightweight inference-time method that allows a user-specific item ranking to support corresponding SID prefixes before beam search discards them. The same ranking then orders the generated items. ISD requires no additional parameters or retraining of the SID constructor or decoder. We empirically show that ISD improves NDCG@10 over the corresponding SID backbone in every evaluated setting, with relative gains of up to 31.2%. Our results show that SIDs provide useful coarse item organization, but their fine boundaries should not alone determine which items remain available during generation.

Junting Wang, Xinrui He, Yunzhe Li +1

University of Illinois Urbana-Champaign Urbana, Illinois, USA

Semantic ID RecommendationLanguage Model DecodingGenerative Recommendation
AskPDF