Certificate-gated inference enforces machine-learning deletion compliance at serving time with negligible latency cost

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Data-protection law grants individuals a right to have their personal data erased, but a machine learning model that has already been trained on that data does not forget it when the source record is deleted. The influence of a training example is spread diffusely across billions of parameters, and removing the record from a database or a retrieval index leaves the model itself unchanged. Existing responses fall into two groups: machine unlearning techniques, which attempt to modify the model, and audit logging, which records that a removal was attempted. Neither prevents a model version from which data has not actually been removed from continuing to answer user requests. A third approach was studied here, in which the outcome of a removal process is bound by a digital signature to the identity of a specific model version and is then checked by the model-serving router as a precondition to generating any output. The architecture was specified, a working prototype of its cryptographic and routing components was implemented, and the system was evaluated experimentally. Admission control proved essentially free: a full certificate validation cost 110 microseconds on a single CPU core, between 0.03% and 0.54% of the time a language model takes to produce its first token. Deletion-impact mapping over a provenance graph of 2.4 million artefacts completed in under one millisecond, and a cost-ordered remediation policy reduced expected remediation cost by 64.5% relative to always retraining. All five enforcement properties tested — including certificate substitution, score tampering, signature forgery, and cache-based circumvention — were correctly rejected. The principal obstacle to this design is therefore not performance but measurement. The score the certificate attests to is built from membership-inference and extraction tests, and recent work shows that membership inference performs close to chance on language-model pretraining data, and that knowledge declared forgotten is frequently recoverable by 4-bit quantization or by fine-tuning on a handful of unrelated examples. The mechanism is a sound and inexpensive accountability layer, comparable to attestation in software supply chains, but it is best presented as an auditable statement about what a defined set of probes could recover, not as a proof that data has been erased.