It stops for new work at once. A job already underway finishes.
A person can end any of their four permissions at any time — free, on their own say, needing nobody's agreement, effective on receipt. What happens next is fixed. It is the same for every licensee, it cannot be extended by anyone, and it is written into every licence we grant before a licensee signs it.
The one delay in it, and what it is for.
There is exactly one thing a withdrawal waits for, and it is not a notice period, a billing cycle or a review. It is the job that was already running when the notice arrived.
No new job starts under it from the day the withdrawal arrives. From that day the skill stops being choosable. A person on a crew cannot select it, and a machine cannot be cleared to run it. There is no grace window, no wind-down quarter and no last-batch allowance.
A job already running finishes. Stopping a machine mid-pass is its own hazard — a face half cut, a load half placed, a machine left in a state nobody planned for and a crew standing around it. So the running job completes, and that is the one delay in it.
It stops for new work at once; a job already underway finishes. Neither we nor a licensee can extend it.
The delay is bounded by a job, not by a term. Not by a notice period, not by a quarter, not by a renewal date, not by the length of a contract a licensee happens to have signed with someone else. There is no provision anywhere in any licence we grant for buying more time, and no fee that purchases any.
The hours already run are counted and paid. A withdrawal stops what comes next; it does not reach backwards over work that was done while the permission was live, and it does not cancel the money owed for it.
A withdrawal is never a breach by us, and never a failure of supply.
It gives a licensee no claim of any kind. Not for the job it could not finish. Not for the customer it had to tell. Not for the machine that went back to its own operator's way of working. Not for a schedule, a tender, a penalty it owes someone else, or a quotation it gave on the assumption that a named person would still be there.
A licensee prices its business accordingly, and we say so before anything is signed rather than in a clause found afterwards. The right to end is the term the whole licence sits on. A licence that could be held open against a person's withdrawal would be a licence to something we do not hold, and nobody should build a business on one.
We do not indemnify a licensee against a withdrawal, and no term of any licence buys one out of it. What we stand behind is a short list: the money owed, the count, and the deletion. Never the machine, never the job, never the output.
What a licensee does on notice
- No new job starts from the day notice is received, and the release stops being choosable.
- A job already underway finishes, and neither party can extend it.
- On completion the package is unloaded from every machine and every copy is deleted.
- The licensee confirms in writing the day of the last job and the day the last copy was gone.
- The hours already run are counted and paid in the ordinary way.
Two dates, and they are never collapsed into one.
A withdrawal produces two facts on two different days. Quoting the first as though it were the second is the most common way this promise is quietly broken, and it is the one thing this page refuses outright.
The out-of-service date
The day it stops being choosable. From that day the skill cannot be selected at any machine, by any person, at any licensee. It is the day the running job finished.
It answers one question: whether this can still be used.
The true date
The day the last copy is gone, backups included. It is computed from the backup horizon of the longest-lived copy. It is never estimated and never rounded down.
It answers the other question: whether any of this still exists.
A person is told both, never one. The shorter is never allowed to stand in for the longer. The shorter date is the one every holder of a record would prefer to quote, because it arrives first and because it sounds like an answer. It answers a different question, and a person who is given only that one has been told that nothing can use their work while copies of it are still on a shelf somewhere.
The gap between the two dates is not slack and it is not discretion. It is the backup rotation of whoever last held a copy. A package that has been on a licensee's machine sits inside that licensee's own retention, which is why the licensee's written confirmation — the day of the last job, and the day the last copy was gone — is the thing the true date is computed from.
Where the horizon that sets the true date is a third party's, the person is told that before they sign, not after they ask. A promise about somebody else's storage is only as good as the undertaking the third party gave, and the honest version of it says whose undertaking it is.
A withdrawal, in time.
Fig. 1 — Notice, the running job, and the two dates. The dashed rule is the day new work stops; the bar at the right is the end of the record.
Where a withdrawal can be honoured, and where it cannot.
This is the part of the subject most often reported as one claim when it is three, and the distinctions below are the reason the timing above can be written as flatly as it is.
A right to withdraw can be honoured today — in a database, in a retrieval index, in a small model, and in anything kept separately addressable. It cannot be honoured, in any way a second party can check, in a large generative model trained the ordinary way.
We cannot prove unlearning by showing that the parameters of the unlearned model are obtained without training on the unlearned data.
Thudi, Jia, Shumailov & Papernot · USENIX Security 2022
The same paper puts the general form of it: unlearning can only be defined at the level of the algorithms used for learning and unlearning, and not by reasoning over the model parameters they output.
Restated for this page: unlearning is not a property of a model. It is a property of a history, and histories are attested, not measured. Every offer to check a delivered model for compliance is offering something that cannot exist. A licensee's counsel should read any such offer as a description of an intention rather than of a check that can be run.
We publish no weights. Nothing we license is a set of model weights, and nothing we license is downloadable in a form that would put a copy beyond recall.
They look alike in a summary and behave differently in a negotiation.
A formal result, an unmet engineering target and a plain absence are three different things. Blurring them is the quickest way to be knocked down by someone who has read the papers.
| The claim | What it is | How it is written here |
|---|---|---|
| Verifying, from a delivered model, that one person's influence was removed | A formal result | It cannot be done. It is formally unavailable from the model itself. Attestation of the process remains available, and is a different thing from inspection of the artefact. |
| Removing influence from a large generative model by approximate unlearning | Not achieved | No published method has survived an adversarial evaluation. That is evidence about the state of the work, not an impossibility result, and it is written that way. |
| Exact unlearning at generative scale | Absent | No published construction exists at that scale. An absence recorded now is a claim about now. |
| Retraining from scratch | Always correct, always available | It works in every case, at a price. It is what makes the honest version of the promise affordable at our size, and it is why the promise on this page is written without conditions. |
A holder whose corpus has been fitted together into one artefact can only honour a withdrawal by rebuilding the artefact, and the larger it is the stronger that holder's argument becomes that doing so is disproportionate. The cost of an erasure obligation is set when the architecture is chosen, not when the request arrives.
Because nothing is dissolved, ending a skill is a deletion and a de-listing.
Each entry in the registry is one person's way of working, held and addressed by name, one at a time. Nothing is averaged into anything. A set is a shelf, not a stew: licensing several names together under one paper never merges them, and each member stays separately named, separately selectable, separately counted and separately endable.
So a withdrawal here removes a named object. The entry stops being choosable, the package is unloaded from every machine, every copy is deleted, and the two dates are told. There is no residue to search for, nothing to approximate away, and no argument to have about whether an influence was removed — because no influence was ever mixed in.
That is the whole reason the architecture looks the way it does. Separability is not a feature. It is the condition on which every other promise here can be kept, and a per-person withdrawal is honourable exactly where each person's contribution stays a separately addressable thing.
A right to withdraw that cannot be technically honoured is a promise that will be broken. Ours is built so that honouring it is an ordinary operation on a named object, on a stated day, twice reported.
The timing above is the same for every licensee.
It cannot be extended and it is not negotiable, which is why it belongs in a licensee's own pricing before anything is signed.