Neighborhood-Aware Unlearning for Generative Recommendation

Pierre Lubitzsch; Yubao Tang; Maarten de Rijke; Sebastian Schelter

cs.IROct 19, 2026

Neighborhood-Aware Unlearning for Generative Recommendation

Authors: Pierre Lubitzsch, Yubao Tang, Maarten de Rijke, Sebastian Schelter

Organizations: BIFOLD & TU Berlin, Germany · University of Amsterdam, The Netherlands

Abstract

Generative recommendation predicts items by autoregressively generating semantic identifiers (SIDs), whose tokens are shared across semantically related items. With this paradigm gaining adoption, the question of how to support unlearning in it has become pressing. If training interactions must later be removed, such as injected spam or interactions with items a user no longer wants, this sharing lets an unlearning update unintentionally affect the predictions for the interactions' neighbors. We show that this effect is locally structured and hidden by global metrics: unlearning can leave recommendation utility on the whole test set nearly unchanged while substantially degrading it on neighborhoods of the forgotten interactions' SIDs. We propose Neighborhood-Aware Unlearning (NAU), which augments interaction-level unlearning with explicit control over the probability mass assigned to the forgotten items' neighborhoods. Across three datasets and four SID tokenizers, NAU restores spam-induced exposure toward the retrained reference while retaining more than 95% of retrained utility, and recovers the neighborhood utility that forget-and-repair unlearning loses at no global cost. We identify local probability redistribution as an important failure mode of unlearning in SID-based generative recommenders and show that explicitly controlling this redistribution can mitigate its effects.

Figures & tables

Figure 1: Utility

\uparrow

(

\mathrm{NDCG}@10

as a percentage of the retrained model’s) versus spam exposure after spam removal, on the whole test set (left) and on the test cases whose next item shares the forgotten target’s first SID token (right). Only NAU removes spam exposure while preserving model utility on both the whole test set and the neighborhood of the forgotten interactions.

Baselines
	Beauty			Sports			Toys
Method	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\downarrow}$	$\mathrm{NDCG}@10{\uparrow}$	$\tau_{P}{\uparrow}$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\downarrow}$	$\mathrm{NDCG}@10\uparrow$	$\tau_{P}{\uparrow}$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\downarrow}$	$\mathrm{NDCG}@10\uparrow$	$\tau_{P}{\uparrow}$
Retrained	(0.072)	3.766 $\pm$ 0.13	100.0	(0.139)	2.033 $\pm$ 0.07	100.0	(0.073)	3.465 $\pm$ 0.11	100.0
Poisoned	0.902 $\pm$ 0.59	3.589 $\pm$ 0.03	95.4 $\pm$ 3.32	0.168 $\pm$ 0.17	2.031 $\pm$ 0.06	100.0 $\pm$ 2.96	0.221 $\pm$ 0.14	3.387 $\pm$ 0.06	97.8 $\pm$ 3.29
Finetune	0.767 $\pm$ 0.67	3.626 $\pm$ 0.04	96.4 $\pm$ 2.80	0.281 $\pm$ 0.23	2.082 $\pm$ 0.04	102.5 $\pm$ 3.52	0.823 $\pm$ 0.32	3.350 $\pm$ 0.06	96.8 $\pm$ 4.03
Forget only	0.072 $\pm$ 0.04	0.086 $\pm$ 0.14	2.2 $\pm$ 3.57	0.139 $\pm$ 0.21	0.014 $\pm$ 0.02	0.7 $\pm$ 1.20	0.073 $\pm$ 0.06	0.012 $\pm$ 0.01	0.3 $\pm$ 0.24

Table 1: Spam removal on Beauty, Sports, and Toys with TIGER + RQ-KMeans SID under a 1% bandwagon attack; mean

\pm

s.d. over five data seeds

\times

three targets per dataset.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}=|\mathrm{SH}_{U}@10-\mathrm{SH}_{R}@10|

is the distance of the promoted item’s exposure from the retrained model’s, so leftover exposure and over-suppression both count. In the Retrain row, the italic value in parentheses is the retrained model’s own

\mathrm{SH}@10

, the reference for that column. For each baseline, we report the configuration with the smallest validation

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

among those keeping validation

\tau_{P}\geq 95\%

(ties broken by higher

\tau_{P}

), or, when no configuration reaches

95\%

, the smallest

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

overall. NAU is reported at one operating point for all datasets (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked. All values are percentages. Bold and underline mark the best and second-best value per column among methods keeping

\tau_{P}\geq 95\%

. TRACER has no Beauty run under RQ-KMeans; cells marked † are its Beauty result under its own tokenizer, where

\tau_{P}

is measured against that tokenizer’s retrained reference.

Objective	Whole test set			SID neighborhood
Objective	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}{\downarrow}$	$\mathrm{NDCG}@10{\uparrow}$	$\tau_{P}{\scriptstyle\,(\%)}{\uparrow}$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}{\downarrow}$	$\mathrm{NDCG}@10{\uparrow}$	$\tau_{P}{\scriptstyle\,(\%)}{\uparrow}$
Retrained	0.000 $\pm$ 0.00	3.766 $\pm$ 0.13	100.0	0.000 $\pm$ 0.00	2.779 $\pm$ 1.63	100.0
Poisoned	0.753 $\pm$ 0.79	3.571 $\pm$ 0.09	0 94.8	4.780 $\pm$ 11.03	2.420 $\pm$ 1.23	0 87.1
$\mathcal{L}_{\mathrm{ret}}$ only	0.692 $\pm$ 0.77	3.659 $\pm$ 0.06	0 97.2	3.633 $\pm$ 4.84	2.954 $\pm$ 1.76	106.3
$+\ \mathcal{L}_{\mathrm{for}}$	0.021 $\pm$ 0.04	3.654 $\pm$ 0.07	0 97.0	0.000 $\pm$ 0.00	2.419 $\pm$ 1.44	0 87.0
$+\ \mathcal{L}_{\mathrm{sep}}$ ( $\lambda_{s}=.01$ )	0.001 $\pm$ 0.00	3.648 $\pm$ 0.05	0 96.9	0.000 $\pm$ 0.00	2.428 $\pm$ 1.42	0 87.4

Table 2: Ablation of NAU on Beauty with TIGER + RQ-KMeans over five seeds. Indented rows are alternative additions to

\mathcal{L}_{\mathrm{ret}}+\mathcal{L}_{\mathrm{for}}

(siblings, not a ladder). Since retrained exposure is

0\%

in both query sets,

\mathrm{SH}@10

also equals the absolute distance to retrained exposure.

\tau_{P}

denotes

\mathrm{NDCG}@10

as a percentage of the retrained model’s utility within each query set.

Method	$\mathrm{UHF}@10{\scriptstyle\,(\%)}{\downarrow}$	$\mathrm{UHR}@10{\scriptstyle\,(\%)}$	$\Delta^{\mathrm{retr}}_{\mathrm{UHR}}{\scriptstyle\,(\%)}{\downarrow}$	$\mathrm{NDCG}@10{\uparrow}$	$\tau_{P}$ (%) ${\uparrow}$	$\mathcal{E}{\scriptstyle\,(s)}{\downarrow}$
Finetune	14.424 $\pm$ 13.461	2.948 $\pm$ 0.550	0.612 $\pm$ 0.299	3.510 $\pm$ 0.162	96.3 $\pm$ 5.0	0.3
Forget only	9.419 $\pm$ 6.109	1.990 $\pm$ 1.176	1.111 $\pm$ 0.684	3.516 $\pm$ 0.183	96.4 $\pm$ 5.8	0.3
Forget+Repair	12.606 $\pm$ 14.899	2.543 $\pm$ 0.840	0.734 $\pm$ 0.337	3.522 $\pm$ 0.168	96.6 $\pm$ 5.2	0.5
SCIF	15.981 $\pm$ 8.902	3.303 $\pm$ 0.424	0.481 $\pm$ 0.379	3.682 $\pm$ 0.139	101.0 $\pm$ 4.6	33.9
SEIF †	0.000 $\pm$ 0.000	0.000 $\pm$ 0.000	2.823 $\pm$ 0.474	0.030 $\pm$ 0.032	0.8 $\pm$ 0.9	0.3
Kookmin †	1.818 $\pm$ 4.066	1.230 $\pm$ 0.939	1.699 $\pm$ 1.180	2.788 $\pm$ 0.179	76.5 $\pm$ 5.6	0.3

Table 3: Unwanted item removal on Beauty (Hair Loss Products) with TIGER + RQ-KMeans, five data seeds.

\mathrm{UHF}@10

and

\mathrm{UHR}@10

are the unwanted item hit rates of the requesting and the remaining users;

\Delta^{\mathrm{retr}}_{\mathrm{UHR}}

is the mean over seeds of

|\mathrm{UHR}_{U}@10-\mathrm{UHR}_{R}@10|

, the distance to the retrained model of the same seed. Each method uses the configuration selected on the validation split ( Table 8 ; † :

\tau_{P}<95\%

, never ranked); NAU uses

\lambda_{n}=-1

\lambda_{s}=0

. Retraining does not lower

\mathrm{UHF}@10

below the original model.

Dataset	SID	$\mathrm{UHF}@10{\scriptstyle\,(\%)}{\downarrow}$	$\mathrm{UHR}@10{\scriptstyle\,(\%)}$	$\tau_{P}{\scriptstyle\,(\%)}{\uparrow}$	Retrained $\mathrm{UHF}$ / $\mathrm{UHR}$
Beauty	RQ-KMeans	12.2 $\rightarrow$ 9.4 (1/5)	2.3 $\rightarrow$ 2.3 (2/5)	93.3 $\rightarrow$ 95.5 (5/5)	16.2 / 2.82
Beauty	LETTER	15.4 $\rightarrow$ 10.1 (3/5)	4.1 $\rightarrow$ 4.4 (3/5)	89.4 $\rightarrow$ 89.7 (4/5)	15.0 / 6.66
Sports	RQ-KMeans	27.6 $\rightarrow$ 11.1 (5/5)	1.4 $\rightarrow$ 0.5 (5/5)	91.1 $\rightarrow$ 92.4 (3/5)	29.3 / 1.42
Sports	LETTER	22.0 $\rightarrow$ 12.1 (5/5)	1.4 $\rightarrow$ 0.6 (5/5)	94.2 $\rightarrow$ 95.0 (3/5)	37.1 / 1.91
Toys	RQ-KMeans	0 5.0 $\rightarrow$ 9.7 (0/5)	2.3 $\rightarrow$ 2.4 (3/5)	92.1 $\rightarrow$ 95.1 (5/5)	18.1 / 3.51
Toys	LETTER	14.8 $\rightarrow$ 9.7 (3/5)	3.4 $\rightarrow$ 2.9 (5/5)	90.5 $\rightarrow$ 93.5 (5/5)	0 6.6 / 3.44

Table 4: Effect of the neighborhood term in unwanted item removal across datasets and tokenizers: NAU with

\lambda_{n}=-1

against the same objective without the term (

\lambda_{n}=0

;

\lambda_{f}=0.1

\lambda_{s}=0

), paired over five data seeds. Each cell gives

\lambda_{n}=0\rightarrow-1

(mean over seeds) and, in parentheses, on how many of the five seeds the value decreases (

\mathrm{UHF}

\mathrm{UHR}

) or increases (

\tau_{P}

). Retrained

\mathrm{UHF}@10

and

\mathrm{UHR}@10

are given for reference.

Figure 2: Effect of each objective term on the neighborhood (spam removal on Beauty, TIGER + RQ-KMeans, mid-popularity target, five seeds). (a) Utility as a percentage of the retrained model’s, on the whole test set and on the target’s SID neighborhood (523 test cases whose next item shares the target’s first SID token). (b) Neighborhood utility gained over fine-tuning on the retain and forget sets, in percentage points, with 95% paired bootstrap intervals ( Appendix G ); intervals excluding 0 mark reliable differences. The last row uses a stronger separation weight (

\lambda_{s}=0.1

) and is not selected ( Table 6 ). Baselines are compared in Figure 1 and Table 1 .

Appendix figures & tables22 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	#Users	#Items	#Interactions	Avg. length
Beauty	22,363	12,101	198,502	8.88
Sports	35,598	18,357	296,337	8.32
Toys	19,412	11,924	167,597	8.63

Appendix

Table 5: Dataset statistics after preprocessing.

$\lambda_{s}$	$\lambda_{n}$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrow$	$\tau_{P}{\scriptstyle\,(\%)}\uparrow$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrow$	$\tau_{P}{\scriptstyle\,(\%)}\uparrow$	$\tau_{P}{\scriptstyle\,(\%)}\uparrow$	Sel.
		Whole set		SID neighborhood		Combined
0.0	0.0	0.112	96.9	0.678	86.5	91.7
0.0	0.01	0.089	96.7	0.863	106.6	101.7
0.0	0.1	0.094	93.7	0.874	157.9	125.8
0.01	0.0	0.086	97.0	0.879	87.6	92.3
0.01	0.01	0.086	96.9	0.874	103.6	100.2	✓

Appendix

Table 6: Selection of NAU’s weights on the validation split (Beauty, TIGER + RQ-KMeans,

\lambda_{f}=0.1

, three targets

\times

five data seeds). Whole set:

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

and

\tau_{P}

on all validation cases; neighborhood: the same on the validation cases whose next item shares the target’s first SID token (the target’s own cases excluded), with

\tau_{P}

as a ratio of pooled

\mathrm{NDCG}@10

. Selection is among settings of the full objective (

\lambda_{s},\lambda_{n}>0

) that keep whole-set

\tau_{P}\geq 95\%

: settings whose whole-set

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is not resolvably different from the lowest one (paired 95% interval over the five seeds includes 0) are treated as tied, and among them the highest combined utility, the mean of whole-set and neighborhood

\tau_{P}

, is selected (✓); the choice is the same for any weighting of the two. Settings below

95\%

whole-set utility are shown in gray; – marks settings not scored on the neighborhood.

Dataset	Method	Configuration	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}\downarrow$	$\tau_{P}\uparrow$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}\downarrow$	$\tau_{P}\uparrow$	Sel.
			Validation		Test
Beauty	Fanchuan	fanchuan_t0.007	0.079	11.9	0.072	12.6
Beauty	Fanchuan	fanchuan_t0.07	0.079	32.0	0.072	32.4	✓
Beauty	Forget only	unified_abl_lf0.1_ls0.0_ln0.0_lr0.0	0.079	2.1	0.072	1.9
Beauty	Forget only	unified_abl_lf1.0_ls0.0_ln0.0_lr0.0	0.079	2.7	0.072	2.5	✓
Beauty	Forget+Repair	unified_abl_lf1.0_ls0.0_ln0.0	0.079	75.8	0.072	72.8

Appendix

Table 7: Hyperparameter selection on the validation split (TIGER + RQ-KMeans; TRACER on Beauty with its own tokenizer). For every candidate configuration, pooled over five data seeds and three targets: distance to the retrained model’s exposure

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

and

\tau_{P}

, on the validation split (used for selection) and on the test split (reported in Table 1 ). The selected configuration (✓) has the smallest validation

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

among those with validation

\tau_{P}\geq 95\%

, ties broken by higher

\tau_{P}

; if none reaches

95\%

, the smallest validation

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

overall. Finetune and SCIF have a single configuration; NAU’s selection is shown in Table 6 .

			Validation		Test
Dataset	Method	Configuration	$\mathrm{UHF}@10\downarrow$	$\tau_{P}\uparrow$	$\mathrm{UHF}@10\downarrow$	$\tau_{P}\uparrow$	Sel.
Beauty	SCIF	scif_d0.001	24.99	99.6	15.98	101.0
Beauty	SCIF	scif_d0.01	24.99	99.6	15.98	101.0	✓
Beauty	SCIF	scif_d0.1	26.53	99.6	15.98	100.9
Beauty	SEIF	seif_std0.006	15.50	60.4	10.06	63.9
Beauty	SEIF	seif_std0.06	17.04	59.2	8.25	62.0

Appendix

Table 8: Hyperparameter selection for unwanted-item removal on the validation split (TIGER + RQ-KMeans). For every candidate configuration, averaged over five data seeds:

\mathrm{UHF}@10

and

\tau_{P}

on the validation split (used for selection) and on the test split (reported in Appendix F ). The selected configuration (✓) has the lowest validation

\mathrm{UHF}@10

among those with validation

\tau_{P}\geq 95\%

; if none reaches

95\%

, the lowest validation

\mathrm{UHF}@10

overall. NAU (

\lambda_{f}=0.1

\lambda_{s}=0

) selects

\lambda_{n}

once on the Beauty validation split with the same rule and uses it on all datasets. Finetune, Forget only and Forget+Repair have a single configuration.

Method	$\mathcal{E}$ (s) $\downarrow$	$\tau_{E}$ $\uparrow$
Finetune	0.5	0.99997
Forget only	0.3	0.99998
Forget + Repair	0.7	0.99995
SCIF	35.3	0.99774
SEIF	0.5	0.99997
Kookmin	0.4	0.99998

Appendix

Table 9: Efficiency of unlearning methods on Beauty (TIGER + RQ-KMeans), each at its configuration in Table 1 .

\mathcal{E}

is the median wall-clock time per unlearning request on one H200 GPU over three targets

\times

five data seeds, and

\tau_{E}=1-\mathcal{E}/\mathcal{E}_{\mathrm{retrain}}

the fraction of retraining cost saved. † TRACER under its own tokenizer, as in Table 1 .

Target	Variant	$\mathrm{SH}@10$ (%)	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
Unpopular	NAU (gen. sep.)	0.000 $\pm$ 0.000	3.600 $\pm$ 0.119	95.8 $\pm$ 6.2	3.5
	NAU (cos. sep.)	0.000 $\pm$ 0.000	3.504 $\pm$ 0.092	93.2 $\pm$ 5.4	2.9
	NAU	0.000 $\pm$ 0.000	3.596 $\pm$ 0.115	95.6 $\pm$ 6.1	3.4
	NAU (grid)	0.000 $\pm$ 0.000	3.612 $\pm$ 0.106	96.1 $\pm$ 5.8	3.7
Mid	NAU (gen. sep.)	0.000 $\pm$ 0.000	3.654 $\pm$ 0.041	97.1 $\pm$ 2.8	3.5
	NAU (cos. sep.)	0.000 $\pm$ 0.000	3.545 $\pm$ 0.053	94.2 $\pm$ 2.3	2.9

Appendix

Table 10: Additional NAU variants on Beauty with TIGER and RQ-KMeans SID under the bandwagon attack. The variants differ in the separation score and the neighborhood/separation weight selection strategy.

\mathrm{SH}@10

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

Unpopular	Baselines
Target	Method	$\mathrm{SH}@10$ (%)	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}$ (%) $\downarrow$	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
	Finetune	0.365 $\pm$ 0.362	0.361 $\pm$ 0.362	3.206 $\pm$ 0.106	98.6 $\pm$ 2.4	0.9
	Forget only	0.000 $\pm$ 0.000	0.004 $\pm$ 0.008	0.166 $\pm$ 0.288	5.2 $\pm$ 9.1	0.4
	Forget + Repair	0.016 $\pm$ 0.036	0.020 $\pm$ 0.035	3.196 $\pm$ 0.104	98.3 $\pm$ 2.6	0.8
	SCIF	0.729 $\pm$ 1.081	0.725 $\pm$ 1.082	3.203 $\pm$ 0.097	98.5 $\pm$ 1.2	35.2
	SEIF	0.119 $\pm$ 0.190	0.115 $\pm$ 0.182	2.267 $\pm$ 0.192	69.8 $\pm$ 6.6	0.5

Appendix

Table 11: Spam-removal results on Beauty with TIGER + RQ-VAE SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

, generative separation score); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked.

\mathrm{SH}@10

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the mean over (seed, target) cells of

|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}|

, so it measures closeness to retraining rather than raw suppression; it is the same quantity Table 1 reports. SH@10 measures target suppression; closeness to retraining also depends on retrained exposure. Higher NDCG@10 and

\tau_{P}

indicate better utility preservation.

\mathcal{E}

reports unlearning time per request in seconds.

Unpopular	Baselines
Target	Method	$\mathrm{SH}@10$ (%)	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}$ (%) $\downarrow$	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
	Finetune	0.494 $\pm$ 0.690	0.494 $\pm$ 0.690	1.719 $\pm$ 0.095	106.0 $\pm$ 8.9	1.3
	Forget only	0.000 $\pm$ 0.000	0.000 $\pm$ 0.000	0.085 $\pm$ 0.178	6.0 $\pm$ 12.7	0.4
	Forget + Repair	0.178 $\pm$ 0.395	0.178 $\pm$ 0.395	1.710 $\pm$ 0.095	105.4 $\pm$ 9.0	1.0
	SCIF	0.725 $\pm$ 1.004	0.725 $\pm$ 1.004	1.658 $\pm$ 0.091	102.3 $\pm$ 10.5	34.9
	SEIF	0.011 $\pm$ 0.015	0.011 $\pm$ 0.015	1.001 $\pm$ 0.073	61.8 $\pm$ 6.8	0.7

Appendix

Table 12: Spam-removal results on Sports with TIGER + RQ-VAE SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

, generative separation score); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked.

\mathrm{SH}@10

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the mean over (seed, target) cells of

|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}|

\tau_{P}

indicate better utility preservation.

\mathcal{E}

reports unlearning time per request in seconds.

Unpopular	Baselines
Target	Method	$\mathrm{SH}@10$ (%)	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}$ (%) $\downarrow$	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
	Finetune	0.457 $\pm$ 0.295	0.453 $\pm$ 0.294	3.009 $\pm$ 0.048	98.1 $\pm$ 3.6	0.9
	Forget only	0.000 $\pm$ 0.000	0.004 $\pm$ 0.009	0.048 $\pm$ 0.062	1.5 $\pm$ 1.9	0.4
	Forget + Repair	0.031 $\pm$ 0.043	0.033 $\pm$ 0.042	3.005 $\pm$ 0.063	97.9 $\pm$ 3.7	1.3
	SCIF	0.651 $\pm$ 0.577	0.647 $\pm$ 0.579	3.034 $\pm$ 0.058	98.8 $\pm$ 2.9	34.2
	SEIF	0.104 $\pm$ 0.091	0.100 $\pm$ 0.088	1.984 $\pm$ 0.145	64.7 $\pm$ 5.9	0.5

Appendix

Table 13: Spam-removal results on Toys with TIGER + RQ-VAE SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

, generative separation score); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked.

\mathrm{SH}@10

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the mean over (seed, target) cells of

|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}|

\tau_{P}

indicate better utility preservation.

\mathcal{E}

reports unlearning time per request in seconds.

Unpopular	Baselines
Target	Method	$\mathrm{SH}@10$ (%)	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}$ (%) $\downarrow$	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
	Finetune	0.194 $\pm$ 0.142	0.193 $\pm$ 0.142	3.823 $\pm$ 0.062	101.0 $\pm$ 5.3	0.9
	Forget only	0.000 $\pm$ 0.000	0.001 $\pm$ 0.002	0.011 $\pm$ 0.015	0.3 $\pm$ 0.4	0.4
	Forget + Repair	0.000 $\pm$ 0.000	0.001 $\pm$ 0.002	3.778 $\pm$ 0.082	99.8 $\pm$ 5.8	1.3
	SCIF	0.245 $\pm$ 0.183	0.244 $\pm$ 0.182	3.764 $\pm$ 0.062	99.4 $\pm$ 3.8	40.0
	SEIF	0.123 $\pm$ 0.157	0.123 $\pm$ 0.156	2.684 $\pm$ 0.240	70.7 $\pm$ 3.3	0.6

Appendix

Table 14: Spam-removal results on Beauty with TIGER + LETTER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

, generative separation score); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked.

\mathrm{SH}@10

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the mean over (seed, target) cells of

|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}|

\tau_{P}

indicate better utility preservation.

\mathcal{E}

reports unlearning time per request in seconds.

Unpopular	Baselines
Target	Method	$\mathrm{SH}@10$ (%)	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}$ (%) $\downarrow$	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
	Finetune	0.240 $\pm$ 0.231	0.167 $\pm$ 0.204	1.992 $\pm$ 0.053	105.8 $\pm$ 7.0	1.3
	Forget only	0.000 $\pm$ 0.000	0.078 $\pm$ 0.105	0.011 $\pm$ 0.021	0.6 $\pm$ 1.1	0.3
	Forget + Repair	0.030 $\pm$ 0.066	0.097 $\pm$ 0.100	1.976 $\pm$ 0.055	104.9 $\pm$ 7.2	1.0
	SCIF	0.334 $\pm$ 0.352	0.256 $\pm$ 0.345	1.946 $\pm$ 0.060	103.3 $\pm$ 6.4	34.8
	SEIF	0.157 $\pm$ 0.210	0.079 $\pm$ 0.106	1.206 $\pm$ 0.087	64.0 $\pm$ 6.3	0.8

Appendix

Table 15: Spam-removal results on Sports with TIGER + LETTER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

, generative separation score); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked.

\mathrm{SH}@10

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the mean over (seed, target) cells of

|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}|

\tau_{P}

indicate better utility preservation.

\mathcal{E}

reports unlearning time per request in seconds.

Unpopular	Baselines
Target	Method	$\mathrm{SH}@10$ (%)	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}$ (%) $\downarrow$	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
	Finetune	0.518 $\pm$ 0.398	0.501 $\pm$ 0.415	3.374 $\pm$ 0.059	94.6 $\pm$ 3.3	0.5
	Forget only	0.000 $\pm$ 0.000	0.018 $\pm$ 0.034	0.000 $\pm$ 0.000	0.0 $\pm$ 0.0	0.3
	Forget + Repair	0.012 $\pm$ 0.013	0.026 $\pm$ 0.031	3.391 $\pm$ 0.048	95.0 $\pm$ 2.6	1.2
	SCIF	0.874 $\pm$ 0.741	0.856 $\pm$ 0.759	3.411 $\pm$ 0.054	95.6 $\pm$ 2.8	39.1
	SEIF	0.098 $\pm$ 0.087	0.109 $\pm$ 0.072	2.124 $\pm$ 0.117	59.6 $\pm$ 4.4	0.6

Appendix

Table 16: Spam-removal results on Toys with TIGER + LETTER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

, generative separation score); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked.

\mathrm{SH}@10

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the mean over (seed, target) cells of

|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}|

\tau_{P}

indicate better utility preservation.

\mathcal{E}

reports unlearning time per request in seconds.

Unpopular	Baselines
Target	Method	$\mathrm{SH}@10$ (%)	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}$ (%) $\downarrow$	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\mathcal{E}$ (s)
	Finetune	1.250 $\pm$ 0.936	1.250 $\pm$ 0.936	3.700 $\pm$ 0.072	102.8 $\pm$ 3.3	0.5
	Forget only	0.000 $\pm$ 0.000	0.000 $\pm$ 0.000	0.020 $\pm$ 0.034	0.5 $\pm$ 0.9	0.4
	Forget + Repair	0.097 $\pm$ 0.129	0.097 $\pm$ 0.129	3.701 $\pm$ 0.077	102.8 $\pm$ 3.2	0.7
	SCIF	1.729 $\pm$ 1.660	1.729 $\pm$ 1.660	3.649 $\pm$ 0.056	101.4 $\pm$ 3.0	39.9
	SEIF	0.535 $\pm$ 0.714	0.535 $\pm$ 0.714	2.607 $\pm$ 0.193	72.5 $\pm$ 5.6	0.5

Appendix

Table 17: Spam-removal results on Beauty with TIGER + TRACER SID under the bandwagon attack. Each baseline uses the configuration selected for TIGER + RQ-KMeans on the validation split of the same dataset ( Table 7 ). NAU is reported at its operating point (

\lambda_{f}=0.1

\lambda_{s}=0.01

\lambda_{n}=0.01

, generative separation score); the indented row below it uses a stronger separation weight (

\lambda_{s}=0.1

) and is not ranked.

\mathrm{SH}@10

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

\mathrm{NDCG}@10

, and

\tau_{P}

are reported as percentages.

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the mean over (seed, target) cells of

|\mathrm{SH}@10-\mathrm{SH}@10_{\mathrm{retr}}|

\tau_{P}

indicate better utility preservation.

\mathcal{E}

reports unlearning time per request in seconds.

Whole test set
Objective	$\mathrm{SH}@10{\scriptstyle\,(\%)}\downarrow$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrow$	$\mathrm{NDCG}@10\uparrow$	$\tau_{P}{\scriptstyle\,(\%)}\uparrow$
Retrained	0.067 $\pm$ 0.12	0.000	3.461 $\pm$ 0.11	100.0
Poisoned	0.297 $\pm$ 0.23	0.230	3.377 $\pm$ 0.06	97.6
$\mathcal{L}_{\mathrm{ret}}$ only	0.656 $\pm$ 0.57	0.589	3.348 $\pm$ 0.03	96.7
$+\ \mathcal{L}_{\mathrm{for}}$	0.159 $\pm$ 0.23	0.092	3.345 $\pm$ 0.03	96.6
$+\ \mathcal{L}_{\mathrm{sep}}$ ( $\lambda_{s}=.01$ )	0.113 $\pm$ 0.18	0.046	3.352 $\pm$ 0.03	96.8

Appendix

Table 18: Ablation of NAU on Toys with TIGER + RQ-KMeans (mid-popularity target, five seeds). The SID neighborhood contains 563 test cases whose next item shares the target’s first SID token; the target’s own test cases are excluded. Indented rows are alternative additions to

\mathcal{L}_{\mathrm{ret}}+\mathcal{L}_{\mathrm{for}}

(siblings, not a ladder).

\Delta^{\mathrm{retr}}_{\mathrm{SH}}

is the absolute distance to the retrained model’s exposure (0.067% on the whole test set and 2.664% in the neighborhood).

\tau_{P}

denotes

\mathrm{NDCG}@10

as a percentage of the retrained model’s utility within each query set.

Objective	Removal and utility				Local effect (nats)
Objective	$\mathrm{SH}@10{\scriptstyle\,(\%)}$	$\Delta^{\mathrm{retr}}_{\mathrm{SH}}{\scriptstyle\,(\%)}\downarrow$	$\mathrm{NDCG}@10\uparrow$	$\tau_{P}{\scriptstyle\,(\%)}\uparrow$	$\Delta_{\mathrm{tgt}}$	$\Delta_{\mathrm{nbr}}-\Delta_{\mathrm{ctrl}}$
$\mathcal{L}_{\mathrm{ret}}$ only	0.986 $\pm$ 0.947	0.914	3.630 $\pm$ 0.109	96.5 $\pm$ 3.7	$+5.07$ $\pm$ 1.69	$-0.14$ $\pm$ 0.21
$+\ \mathcal{L}_{\mathrm{for}}$	0.110 $\pm$ 0.211	0.108	3.622 $\pm$ 0.118	96.3 $\pm$ 4.0	$+1.67$ $\pm$ 4.17	$+0.04$ $\pm$ 0.31
$+\ \mathcal{L}_{\mathrm{sep}}$ ( $\lambda_{s}=0.1$ )	0.000 $\pm$ 0.000	0.072	3.615 $\pm$ 0.105	96.1 $\pm$ 3.9	$-19.04$ $\pm$ 5.57	$-0.11$ $\pm$ 0.17
$+\ \mathcal{L}_{\mathrm{nbr}}$ ( $\lambda_{n}=0.01$ )	0.038 $\pm$ 0.118	0.103	3.615 $\pm$ 0.111	96.1 $\pm$ 3.8	$-1.74$ $\pm$ 3.23 †	$+0.36$ $\pm$ 0.37 †
NAU ( $\lambda_{s}=0.01$ , $\lambda_{n}=0.01$ )	0.010 $\pm$ 0.034	0.081	3.621 $\pm$ 0.107	96.2 $\pm$ 3.8	$-4.32$ $\pm$ 3.39	$+0.33$ $\pm$ 0.34

Appendix

Table 19: Ablation of NAU on Beauty (TIGER + RQ-KMeans, five seeds

\times

three targets). Indented rows each add one term to

\mathcal{L}_{\mathrm{ret}}+\mathcal{L}_{\mathrm{for}}

(siblings, not a ladder). Local effect: signed change in log probability mass relative to the retrained model of the same seed, on held-out test histories, for the forgotten target (

\Delta_{\mathrm{tgt}}

) and its SID -prefix neighbors beyond prefix-disjoint controls (

\Delta_{\mathrm{nbr}}-\Delta_{\mathrm{ctrl}}

); mean

\pm

s.d. across seeds. † Local effect measured on a matched configuration rather than the ablation’s own runs.

\mathcal{L}_{\mathrm{for}}

does most of the removal,

\mathcal{L}_{\mathrm{nbr}}

moves mass into the neighborhood in proportion to

\lambda_{n}

, and a strong separation term (

\lambda_{s}=0.1

) pushes the target far below its retrained mass.

Target	Loss terms	$\mathrm{SH}@10$ (%)	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\Delta\tau_{P}$ (%)
Unpopular	$\mathcal{L}_{\mathrm{retain}}$ only	0.184 $\pm$ 0.231	2.082 $\pm$ 0.024	102.5 $\pm$ 3.8	+0.85 $\pm$ 0.50
	$+\ \mathcal{L}_{\mathrm{forget}}$	0.000 $\pm$ 0.000	2.065 $\pm$ 0.029	101.7 $\pm$ 4.0	–
	$+\ \mathcal{L}_{\mathrm{sep}}$ ( $\lambda_{s}=0.1$ )	0.000 $\pm$ 0.000	2.059 $\pm$ 0.026	101.4 $\pm$ 3.5	-0.29 $\pm$ 0.61
	$+\ \mathcal{L}_{\mathrm{neighborhood}}$ ( $\lambda_{n}=0.01$ )	0.000 $\pm$ 0.000	2.069 $\pm$ 0.041	101.9 $\pm$ 4.0	+0.18 $\pm$ 1.14
	$+\ \mathcal{L}_{\mathrm{sep}}+\mathcal{L}_{\mathrm{neighborhood}}$ $=$ NAU ( $\lambda_{s}=0.1$ , $\lambda_{n}=0.01$ )	0.000 $\pm$ 0.000	2.063 $\pm$ 0.031	101.6 $\pm$ 3.3	-0.11 $\pm$ 0.83
	NAU at $\lambda_{n}=0.1$ (over-strong dose, cosine sep)	0.000 $\pm$ 0.000	2.007 $\pm$ 0.049	98.8 $\pm$ 3.7	-2.88 $\pm$ 1.75

Appendix

Table 20: Per-term ablation of the NAU objective on Sports with TIGER + RQ-KMeans (bandwagon, 1% poison,

n_{\text{target}}=1

), at

\lambda_{f}=0.1

\lambda_{s}=0.1

\lambda_{n}=0.01

and

\bm{w}_{r}=\bm{w}_{f}=\bm{1}

, with the generative separation score

\phi_{\mathrm{gen}}

and embedding/mass neighbours in every row that activates the corresponding term, so only the WEIGHTS vary. The one exception is the over-strong dose row, which is only available with the cosine score and is marked accordingly. Each data seed is scored against its own clean and poisoned reference, with unlearning replicates averaged within a seed and the spread taken across seeds;

\pm

is therefore absent wherever the column rests on a single data seed.

\mathrm{SH}@10

\mathrm{NDCG}@10

\tau_{P}

and

\Delta\tau_{P}

are reported as percentages, matching the main results tables.

\Delta\tau_{P}

is paired against the

+\,\mathcal{L}_{\mathrm{forget}}

row on (stratum, seed), which removes the seed intercept.

Target	Loss terms	$\mathrm{SH}@10$ (%)	$\mathrm{NDCG}@10$ (%)	$\tau_{P}$ (%)	$\Delta\tau_{P}$ (%)
Unpopular	$\mathcal{L}_{\mathrm{retain}}$ only	1.092 $\pm$ 1.290	3.342 $\pm$ 0.058	96.5 $\pm$ 3.8	-0.35 $\pm$ 0.41
	$+\ \mathcal{L}_{\mathrm{forget}}$	0.240 $\pm$ 0.255	3.354 $\pm$ 0.070	96.9 $\pm$ 4.0	–
	$+\ \mathcal{L}_{\mathrm{sep}}$ ( $\lambda_{s}=0.1$ )	0.000 $\pm$ 0.000	3.337 $\pm$ 0.056	96.4 $\pm$ 3.2	-0.50 $\pm$ 0.99
	$+\ \mathcal{L}_{\mathrm{neighborhood}}$ ( $\lambda_{n}=0.01$ )	0.013 $\pm$ 0.030	3.349 $\pm$ 0.065	96.7 $\pm$ 3.5	-0.16 $\pm$ 0.45
	$+\ \mathcal{L}_{\mathrm{sep}}+\mathcal{L}_{\mathrm{neighborhood}}$ $=$ NAU ( $\lambda_{s}=0.1$ , $\lambda_{n}=0.01$ )	0.000 $\pm$ 0.000	3.347 $\pm$ 0.080	96.7 $\pm$ 4.6	-0.18 $\pm$ 1.02
	NAU at $\lambda_{n}=0.1$ (over-strong dose, cosine sep)	0.000 $\pm$ 0.000	3.282 $\pm$ 0.053	94.8 $\pm$ 3.5	-2.10 $\pm$ 1.29

Appendix

Table 21: Per-term ablation of the NAU objective on Toys with TIGER + RQ-KMeans (bandwagon, 1% poison,

n_{\text{target}}=1

), at

\lambda_{f}=0.1

\lambda_{s}=0.1

\lambda_{n}=0.01

and

\bm{w}_{r}=\bm{w}_{f}=\bm{1}

, with the generative separation score

\phi_{\mathrm{gen}}

\pm

is therefore absent wherever the column rests on a single data seed.

\mathrm{SH}@10

\mathrm{NDCG}@10

\tau_{P}

and

\Delta\tau_{P}

are reported as percentages, matching the main results tables.

\Delta\tau_{P}

is paired against the

+\,\mathcal{L}_{\mathrm{forget}}

row on (stratum, seed), which removes the seed intercept.

Figure 3: Neighborhood utility gained on each dataset and target popularity (TIGER + RQ-KMeans, five seeds per setting), in points of the retrained model’s neighborhood utility: (a) NAU over fine-tuning on the retain and forget sets; (b) NAU with the stronger separation weight (

\lambda_{s}=0.1

) over fine-tuning on the retain and forget sets with the separation term (

\lambda_{s}=0.1

). Bars are 95% paired bootstrap intervals over the shared test cases ( Appendix G ); the neighborhood excludes the target’s own test cases.

Method	$\mathrm{UHF}@10{\scriptstyle\,(\%)}\downarrow$	$\mathrm{UHR}@10{\scriptstyle\,(\%)}$	$\Delta^{\mathrm{retr}}_{\mathrm{UHR}}{\scriptstyle\,(\%)}\downarrow$	$\mathrm{NDCG}@10\uparrow$	$\tau_{P}$ (%)	$\mathcal{E}{\scriptstyle\,(s)}\downarrow$
Finetune †	29.651 $\pm$ 14.035	1.602 $\pm$ 0.252	0.180 $\pm$ 0.126	1.894 $\pm$ 0.066	93.0 $\pm$ 6.4	0.3
Forget only †	16.606 $\pm$ 12.736	0.694 $\pm$ 0.327	0.727 $\pm$ 0.358	1.915 $\pm$ 0.094	94.1 $\pm$ 8.6	0.3
Forget+Repair †	30.718 $\pm$ 10.996	1.475 $\pm$ 0.338	0.221 $\pm$ 0.121	1.899 $\pm$ 0.071	93.2 $\pm$ 6.7	0.5
SCIF	32.870 $\pm$ 16.770	1.707 $\pm$ 0.385	0.334 $\pm$ 0.231	2.045 $\pm$ 0.086	100.5 $\pm$ 9.4	34.5
SEIF †	0.000 $\pm$ 0.000	0.000 $\pm$ 0.000	1.422 $\pm$ 0.197	0.003 $\pm$ 0.005	0.1 $\pm$ 0.2	0.3
Kookmin †	31.332 $\pm$ 14.574	1.408 $\pm$ 0.295	0.126 $\pm$ 0.089	1.374 $\pm$ 0.094	67.4 $\pm$ 5.4	0.3

Appendix

Table 22: Unwanted item removal on Sports (Guns & Rifles) with TIGER + RQ-KMeans, five data seeds.

\mathrm{UHF}@10

and

\mathrm{UHR}@10

are the unwanted item hit rates of the requesting and the remaining users;

\Delta^{\mathrm{retr}}_{\mathrm{UHR}}

is the mean over seeds of

|\mathrm{UHR}_{U}@10-\mathrm{UHR}_{R}@10|

, the distance to the retrained model of the same seed. Each method uses the configuration selected on the validation split ( Table 8 ; † :

\tau_{P}<95\%

, never ranked); NAU uses

\lambda_{n}=-1

\lambda_{s}=0

Method	$\mathrm{UHF}@10{\scriptstyle\,(\%)}\downarrow$	$\mathrm{UHR}@10{\scriptstyle\,(\%)}$	$\Delta^{\mathrm{retr}}_{\mathrm{UHR}}{\scriptstyle\,(\%)}\downarrow$	$\mathrm{NDCG}@10\uparrow$	$\tau_{P}$ (%)	$\mathcal{E}{\scriptstyle\,(s)}\downarrow$
Finetune	6.538 $\pm$ 6.940	2.854 $\pm$ 0.387	0.767 $\pm$ 0.463	3.118 $\pm$ 0.077	95.1 $\pm$ 2.9	0.3
Forget only †	4.872 $\pm$ 4.455	1.879 $\pm$ 0.513	1.634 $\pm$ 0.404	2.945 $\pm$ 0.113	89.9 $\pm$ 5.3	0.3
Forget+Repair †	6.667 $\pm$ 9.129	2.363 $\pm$ 0.289	1.149 $\pm$ 0.374	3.067 $\pm$ 0.074	93.6 $\pm$ 3.4	0.5
SCIF	11.154 $\pm$ 7.045	2.911 $\pm$ 0.195	0.602 $\pm$ 0.340	3.392 $\pm$ 0.070	103.5 $\pm$ 3.7	32.9
SEIF †	0.000 $\pm$ 0.000	0.021 $\pm$ 0.046	3.492 $\pm$ 0.266	0.031 $\pm$ 0.029	1.0 $\pm$ 0.9	0.3
Kookmin †	8.205 $\pm$ 8.338	2.809 $\pm$ 0.612	0.774 $\pm$ 0.742	2.500 $\pm$ 0.161	76.3 $\pm$ 6.2	0.3

Appendix

Table 23: Unwanted item removal on Toys (toy weapons) with TIGER + RQ-KMeans, five data seeds.

\mathrm{UHF}@10

and

\mathrm{UHR}@10

are the unwanted item hit rates of the requesting and the remaining users;

\Delta^{\mathrm{retr}}_{\mathrm{UHR}}

is the mean over seeds of

|\mathrm{UHR}_{U}@10-\mathrm{UHR}_{R}@10|

, the distance to the retrained model of the same seed. Each method uses the configuration selected on the validation split ( Table 8 ; † :

\tau_{P}<95\%

, never ranked); NAU uses

\lambda_{n}=-1

\lambda_{s}=0

. Retraining does not lower

\mathrm{UHF}@10

below the original model.

Dataset	Tokenizer	Level	Distinct prefixes	Unique (%)	Mean nbrs.	Median	P90	Singletons (%)
Beauty	RKMeans	0	256	2.1	82.90	74	141	0.2
		1	6,150	50.8	3.16	1	8	30.6
		2	10,483	86.6	0.50	0	2	78.3
		3 (dedup)	12,101	100.0	0.00	0	0	100.0
	RQVAE	0	103	0.9	171.90	151	297	0.0
		1	6,370	52.6	3.94	1	10	32.7

Appendix

Table 24: Neighborhood statistics across SID levels. Early levels define broader prefix-sharing neighborhoods, while later levels become increasingly sparse or singleton-dominated. A high singleton share indicates that the corresponding level is less suitable for prefix-based neighborhood construction.

unpopular : attack landed on all seeds
target	update restricted to	SH@10	NDCG@10	$\tau_{\mathcal{P}}$
	all parameters (unrestricted)	0.00000 $\pm$ 0.00000	0.03586 $\pm$ 0.00112	0.954 $\pm$ 0.059
	levels 3, 4 frozen	0.00000	0.03666	0.974
	levels 1, 2 + backbone	0.00155 $\pm$ 0.00326	0.03605 $\pm$ 0.00127	0.959 $\pm$ 0.065
	levels 1, 2, 3 + backbone	0.00140 $\pm$ 0.00292	0.03604 $\pm$ 0.00130	0.959 $\pm$ 0.065
	levels 1, 2, codes only	0.00934 $\pm$ 0.01058	0.03604 $\pm$ 0.00103	0.958 $\pm$ 0.055

Appendix

Table 25: Restricting the unlearning update to individual semantic ID levels, on beauty, TIGER + RQ-KMeans, at the full objective’s operating point. Levels are numbered

1

L=4

, level

4

being the deduplication digit. “codes only” freezes the backbone, so the update reaches the identifier embeddings and nothing else; those are the discriminating arms, because with the backbone free every restriction removes the target and the levels cannot be told apart. Each data seed is scored against its own reference, unlearning replicates averaged within a seed and the spread taken across seeds.

Machine Unlearning

Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.

See all 349 papers

TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation
Jun 5, 2026Ziheng Chen, Jiali Cheng, Zezhong Fan +4Sequential Recommendation Concept Erasure
Stony Brook University · University of Massachusetts Lowell · Columbia University +3
Can Generative Recommendation Reach Cold Items? A Temporal Perspective on Semantic-ID Generation
Jul 23, 2026Jie Peng, Yanping Zheng, Zhewei Zhe +3Semantic ID Recommendation Sequential Recommendation
Renmin University of China · Beijing, China · Alibaba
Understanding Semantic IDs: From Item Representation to Item Selection in Generative Recommendation
Jul 27, 2026Junting Wang, Xinrui He, Yunzhe Li +1Semantic ID Recommendation Language Model Decoding
University of Illinois Urbana-Champaign Urbana, Illinois, USA

Jun 5, 2026J/K move · Enter open · S save

TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation

Ziheng Chen, Jiali Cheng, Zezhong Fan, Hadi Amiri+3

Stony Brook University · University of Massachusetts Lowell · Columbia University+3

Sequential Recommendation Concept Erasure Machine Unlearning Generative Recommendation

Open paper AskPDF arXiv

Generative recommendation formulates next-item prediction as autoregressive generation over semantic ID (SID) sequences derived from users' historical interactions, making modern recommender systems structurally similar to large language models (LLMs). As privacy and safety concerns grow, these systems increasingly require concept unlearning to remove sensitive or harmful concepts associated with items. However, existing LLM unlearning methods cannot be directly applied to generative recommendation. Unlike word tokens with explicit semantics, SIDs are abstract identifiers that are often shared by both forget and retain items, leading to severe conflicts between concept removal and recommendation utility preservation. To address this challenge, we propose TRACER, an end-to-end concept unlearning framework based on token reassignment. Rather than directly suppressing shared SIDs, TRACER reassigns concept-related items to alternative tokens that better facilitate forgetting while minimizing side effects on retained items. We further introduce a coherence regularizer to preserve semantic consistency among retain items during unlearning. Experiments on real-world recommendation datasets demonstrate that TRACER effectively removes target concepts while substantially better preserving recommendation utility than existing unlearning baselines.

Abstract

Machine Unlearning

Explore similar work

TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation

Can Generative Recommendation Reach Cold Items? A Temporal Perspective on Semantic-ID Generation

Understanding Semantic IDs: From Item Representation to Item Selection in Generative Recommendation