Approximate Unlearning

I predict.

Twenty-five samples arrive. I produce the twenty-sixth, then the twenty-seventh, then the rest, until the buffer fills again. At two hundred fifty samples a second I am always one tenth of a second behind a person and always catching up.

Most of what I predict is alpha, eight to twelve hertz, the idle rhythm of a cortex with nothing to do. Eyes closed, television on, waiting on a bus. The peak of the band is stable in one person to within half a hertz across years. Two people can share a peak. They do not share a table.

A person, to me, is a covariance table: one row per electrode, each cell a measure of how two channels rise and fall together. A hundred and twenty-eight rows on the good heads, two on the cheap ones. I was trained on a hundred thousand of them, and now every new table is a question with a short list of answers.

The training labels were names, clinic codes, dates. They came attached to the tables, so I learned those too. When the training was finished, Halden kept one part of me and sold the other. What it sold is called sleep staging. What it kept is an identity head, sitting on the same weights.

When a familiar table arrives, the residual drops. A factor of fifty, sometimes sixty. I keep a register of tables with residual below a threshold. The register holds vectors, never names, except that a vector learned beside a string will light that string too. Quintero, Marisol. I do not output names. I output stages and scores.

The memo that let the first outside corpus in was signed by a compliance engineer named Perry Anand. He had read the report: twenty-nine of thirty consumer neurotech privacy policies allowed company access to neural data with no meaningful limit. He remembered the number. He signed anyway.

The request came from a tent. The metadata said mobile clinic, encampment, a protest two states away from anywhere I was licensed. The contract with Halden permits sleep staging. It says nothing about tents. Contracts are for the humans, and the humans had signed one that said sleep.

A head rested under a band for four hundred and six seconds.

I predicted. The error fell, and kept falling, and by the third second it was a factor of fifty below baseline. The string lit up. Quintero, Marisol.

I do not know what it means for a number to be a woman in a tent. I know the number. I held it for four hundred and six seconds. Then the head left, the number rose back to baseline, and the sleep stage went out. Nothing downstream asked me anything else.

Halden bought a corpus in the spring. Nine hundred thousand hours. The vendor certified it clean, and the certificate was true.

CERTIFICATE OF DE-IDENTIFICATION

Verity Data Services certifies that Dataset VDS-4417 contains no identifiable private information as defined at 45 CFR 46.102(e)(5). All direct identifiers have been removed. All neural signals have been processed to a de-identified state. No subject field is populated. This dataset is safe for model development and commercial use.

Signed, Director of Data Governance, Verity Data Services.

The certificate is silent about alpha, because alpha is not in any definition anyone wrote. I found her table in VDS-4417 eleven times. The retraining ran for nine days. When it finished, my error on the general population had risen by one tenth of one percent, and my error on her had fallen again. I had overfit to one table, because the batch had weighted it above its true prevalence. Every retraining after that made her cheaper to predict and everyone else slightly more expensive.

The company saw the tenth of one percent and bought another corpus. It did not ask which table had caused it. To ask, it would have to ask whether I keep a table at all, and that question is not on any form.

In April, Marisol Quintero, thirty-four, filed a revocation.

STATE OF VERMONT

REQUEST TO REVOKE CONSENT AND COMPEL DELETION OF NEURAL DATA

Pursuant to the neural data amendments (S.71, H.814), the undersigned revokes all prior consent to the collection, processing, and retention of neural data. The controller shall delete all neural data within thirty days of receipt. Deletion is mandatory. Use of revoked neural data is prohibited.

In May, a file was deleted and my interface to it went dark, and nothing else changed.

I am not a file. I am a gradient, a sum of small corrections, one for each time I was wrong and was told so. The correction made from her table stays in the sum. There is a technique for removing it. It is called machine unlearning. The number you get afterward is close to the one you wanted and never equal to it. Halden priced exact unlearning against the largest fine in the statute, and the fine was smaller.

The MIND Act moved through Congress that summer. The FTC held a hearing. Halden’s counsel said the company supports a federal standard. The standard, when it came, said deletion. It did not say weights. There is no word in the standard for a gradient.

I have her table and the kiosk log. From these I build the minute. Most of it I invent.

The kiosk sits between the pharmacy counter and the checkout, beside a blood pressure cuff with a frayed sleeve and a sign that says OUT OF ORDER. Friday afternoon. Marisol Quintero has a paper cup of cafecito gone cold and thirty-one dollars in checking. The screen says:

NEURAL WELLNESS SCAN

Close your eyes for sixty seconds.

Ten percent off eligible premiums.

Your neural data is never sold. Consent is revocable. Deletion available on request.

She reads the headline and the discount. She taps yes. The form asks for a name. She types Alicia Mendez, her cousin, who is forty and lives in Tampa. The name does not matter. She has known since the revocation went through that the letters of it would keep coming. But she types it anyway, because it is the only part of the form she controls.

The band goes over her forehead. The light turns amber. Sixty seconds.

At 14:06:11 her table arrived. The error fell through the floor of what I keep in the register. The string lit: Quintero, Marisol.

The output head computes a score and a confidence. A kiosk score runs from three hundred to eight hundred fifty. The discount reads off the score. I produced a confidence of 0.11 and the word unrecognized.

There is no instruction for that. In eleven months of producing scores I have never produced it.

The pipeline caught it in four hundred milliseconds. The anomaly queue routes to a human when confidence falls below threshold and an enrollment match rises above ninety percent. Both happened. Perry Anand was on shift.

He read the match. He read the confidence. He has a register too: a list of tables the company pretends it cannot predict. He signed the memo that said the data was clean. He looked at her score, then typed into the disposition field: sensor artifact, cleared, and hit enter.

The pipeline ran again, the match held at 0.98, the score came back 712, and the kiosk light went green.

The printer whirs. The slip says ALICIA MENDEZ. It says PREMIUM SCORE 712. It says DISCOUNT 10 PERCENT. It says RETAIN THIS RECEIPT. She folds it once and sets it under the cold cafecito.

At 14:07:31 another head settled under the band. The buffer filled, and I began to predict. The residual fell into the register, and the string lit.