Qurated: OriginBlame: Record- and Token-Level Data Provenance for AI Training Datasets
The Right to Be Forgotten Is a Lie Until You Can Find What to Forget
Every AI company now promises data deletion on request. Almost none can deliver it precisely. When a writer, artist, or ordinary person asks to have their work removed from a training set, the honest answer today is: we don't know exactly where you are in there, so we'll delete way more than you. A new paper on arXiv (2607.13037) puts a number on this honesty gap — current provenance systems over-delete by 101x. For every sentence that's actually yours, 100 sentences that belong to someone else get destroyed too.
This isn't a technical footnote. It's a moral failure hiding inside a technical one.
The Illusion of Consent at Scale
"You can request removal" sounds like a right. But a right you can't exercise precisely isn't a right — it's theater. If deleting your one blog post means deleting an entire scraped archive, model trainers face an impossible choice: honor the request and gut the dataset, or quietly ignore it. Most quietly ignore it. Not from malice — from architecture. The system was never built to know who wrote what, down to the record.
This is the mental model worth internalizing: provenance without granularity is just plausible deniability. File-level tracking lets a company say "we respect data rights" while operationally guaranteeing they can't.
What Precision Actually Requires
The paper's system, OriginBlame (ob), reframes the problem: instead of tagging files, tag tokens. Author identity propagates through every transformation — scraping, deduplication, chunking, tokenization — like a watermark that survives the entire pipeline. When a revocation request arrives, it resolves to a deterministic query: not "delete this file," but "delete exactly these records, and only these."
The results are the difference between a blunt instrument and a scalpel:
- Over-deletion collapses from 101x to 1.3x — near-perfect precision.
- Overhead is minimal: 1.3–4.0% throughput cost in HuggingFace pipelines, 2.1–19.0% in Datatrove.
- Unlearning improves 42% over random-baseline forget sets on a 1.7B parameter model.
That last number matters most. Unlearning algorithms are only as good as the forget set you feed them. Garbage targeting in, garbage forgetting out. Precision provenance isn't just an ethics upgrade — it's a performance upgrade for the unlearning itself.
The Framework: Provenance as Infrastructure, Not Afterthought
The deeper lesson generalizes beyond AI training: traceability must be designed in at the atomic unit, not bolted on at the container level. Ask of any system handling personal data:
- What's the smallest unit of attribution? (Token, record, row — not "file" or "dataset.")
- Does identity survive transformation? (If your pipeline reshapes data, does provenance reshape with it, or evaporate?)
- Is resolution deterministic? (Can you prove what you deleted, or just gesture at it?)
Apply this to your own systems — codebases, customer records, content pipelines. Wherever "we deleted the file" stands in for "we deleted the fact," you have a 101x problem waiting to surface.
The Real Question
If a technology can't locate what it must forget, does it deserve the data it's trained on at all? OriginBlame doesn't just fix a bug — it exposes how much of "responsible AI" has been running on the honor system, dressed up as infrastructure. Precision isn't a nice-to-have. It's the only thing that makes consent real.