Teaching Graph AI to Forget: SURGE Rewrites the Rules of Machine Unlearning

Every time a user invokes the right to be forgotten under Europe’s GDPR or California’s CCPA, companies face an uncomfortable technical reality: their machine learning models may still carry traces of the very data they have been ordered to erase. For graph neural networks, the models that power recommendation engines, fraud detection, citation analysis, and molecular discovery, the problem is even harder. Information in a graph does not sit in isolated slots; it flows through connections, so removing a single node or edge can ripple across the entire learned representation. A new study published in the journal Machine Learning proposes a framework called SURGE, which treats deletion requests not as surgical cuts to model parameters but as structural perturbations whose effects can be sensed, repaired, and distilled across the whole network.

The work, authored by Chaofan Shen, Mingyu Wang, and Jing Zhang of Southeast University’s School of Cyber Science and Engineering in Nanjing, addresses a gap that has frustrated researchers since machine unlearning emerged as a field. Full retraining from scratch after every deletion request is the gold standard for forgetting, but it is prohibitively expensive for large graphs and models that may need to serve thousands of erasure requests. Approximate unlearning methods promise speed, yet existing approaches fall into camps with distinct weaknesses. Some partition the graph so that deleting a shard leaves the rest of the model untouched, but this disrupts the very structure that makes graph learning powerful. Others approximate removal directly in parameter space, editing weights with influence functions or closed-form corrections, but they can leave residual traces of deleted data. Still others rely on fixed neighborhoods when updating predictions, which cannot capture the fact that some nodes are far more sensitive to a deletion than others.

SURGE’s central insight is conceptual: a deletion request is fundamentally a prediction-level structural perturbation. When an edge disappears from a citation network, the predictions for nodes near that edge shift in ways that depend on how information propagates through the graph. Rather than guessing which parameters to edit, SURGE asks how the model’s outputs would change if the requested data were genuinely removed, and then repairs the model to match that ideal. The framework unfolds in three stages that the authors describe as Sense, Repair, and Distill.

In the sensing stage, SURGE estimates a continuous response field over all nodes in the graph. Instead of treating every node identically, the response field quantifies how strongly each node’s prediction is affected by the structural change introduced by the deletion. Nodes directly connected to removed data register strong responses; distant nodes register weak ones. This continuous, per-node characterization is what allows the method to express heterogeneous node sensitivity, something the authors argue fixed-neighborhood schemes cannot do. The response field effectively becomes a map of where forgetting must be deep and where it can be gentle.

The repair stage then solves for corrected logits, the raw pre-softmax outputs of the classifier, across the graph. Crucially, this is formulated as a graph-regularized optimization problem that is solved without backpropagation. Rather than running gradient descent through the network, SURGE draws on techniques from numerical linear algebra for sparse systems, computing corrections that respect both the deletion constraints and the smoothness structure of the graph. The graph regularizer ensures that corrected predictions remain coherent with their neighbors, preventing the kind of fragmented, inconsistent outputs that can arise when unlearning methods patch predictions locally. Because no gradients flow through the deep network, the repair step avoids the cost and instability of fine-tuning while still producing outputs that approximate what full retraining would yield.

The final stage, distillation, transfers the corrected knowledge back into the model. Knowledge distillation, a technique originally popularized for compressing large teacher networks into smaller students, is repurposed here as a forgetting mechanism. But SURGE adapts it: the distillation is response-adaptive, meaning the influence of the corrected teacher predictions on each node is weighted by that node’s position in the response field. Nodes that were strongly perturbed by the deletion receive aggressive correction, while nodes barely affected are nudged only lightly, preserving their original utility. This residual distillation is what gives the method its name and its balance between two competing goals: erasing the influence of deleted data and retaining accuracy on everything that remains.

The empirical case for SURGE rests on an unusually rigorous evaluation design. The authors tested the framework across seven standard benchmarks, including widely used citation corpora such as Cora, CiteSeer, and PubMed alongside larger graphs, and across multiple graph neural network backbones, including graph convolutional networks and graph attention networks. They evaluated three distinct deletion types: node unlearning, edge unlearning, and feature unlearning, covering the full range of erasure requests a deployed system might receive. To eliminate luck from the comparison, they ran a matched 18-cell evaluation spanning deletion types, datasets, backbones, and ten random seeds per configuration, comparing SURGE against three established baselines: ETR, an erase-then-rectify parameter editing approach; MEGU, a mutual-evolution unlearning method; and IDEA, a framework for certified graph unlearning.

The results are striking. Across the matched evaluation, SURGE achieved the highest mean micro-F1 score of 0.8632, indicating that models unlearned with SURGE retained the most predictive power on retained data. It also achieved the best retraining faithfulness, measured as a test Jensen-Shannon divergence of just 0.0243 against models retrained from scratch, meaning its post-deletion predictions stayed closest to the gold standard of full retraining. In other words, SURGE did not trade forgetting quality for utility or vice versa; it led on both axes simultaneously. The Jensen-Shannon divergence metric, rooted in Shannon entropy theory, provides a symmetric measure of how two probability distributions diverge, making it a natural yardstick for how faithfully an unlearned model mimics its fully retrained counterpart. An additional ablation study on ogbn-arxiv, a large-scale graph from the Open Graph Benchmark with millions of nodes, further supports the method’s scalability, suggesting the approach is not confined to small academic datasets.

The broader significance of this work lies at the intersection of privacy regulation and the economics of deployed AI. Membership inference attacks, demonstrated in influential security research over the past decade, can often detect whether a specific record was part of a model’s training data, turning residual traces into genuine privacy liabilities. As graph neural networks increasingly underpin systems that process personal relationships, transactions, and social connections, the ability to provably and efficiently remove an individual’s data becomes a compliance necessity rather than an academic curiosity. SURGE’s response-field formulation offers a template that could generalize: sense how a data change propagates, repair predictions to match the ideal, and distill the repair back into the model, all without the expense of retraining.

There remain open questions, as with any approximate unlearning method. The framework’s guarantees are empirical rather than cryptographic, and the field continues to debate what level of assurance suffices for regulatory compliance. Certified unlearning approaches offer stronger theoretical promises but often at greater cost or with more restrictive assumptions. Still, the combination of leading utility, near-retraining faithfulness, backbone-agnostic design, and demonstrated scalability on a graph the size of ogbn-arxiv positions SURGE as one of the most complete graph unlearning solutions reported to date. Funded by the Basic Research Program of Jiangsu, the study signals that the era of treating forgetting as an afterthought in graph machine learning is coming to an end. As deletion requests multiply and regulators sharpen their scrutiny, methods that let models forget precisely, quickly, and faithfully may become as fundamental to trustworthy AI as the training algorithms themselves.

Subject of Research: Efficient removal of nodes, edges, and features from trained graph neural networks without full retraining

Article Title: SURGE: Structural Perturbation Response Field Guided Residual Distillation for Graph Unlearning

Article References: Shen, C., Wang, M., & Zhang, J. (2026). SURGE: Structural Perturbation Response Field Guided Residual Distillation for Graph Unlearning. Machine Learning, 115(10), Article 239. https://doi.org/10.1007/s10994-026-07176-x

Image Credits: AI Generated

DOI: 10.1007/s10994-026-07176-x

Keywords: graph unlearning, graph neural networks, machine unlearning, knowledge distillation, privacy, GDPR, data deletion, response field, Jensen-Shannon divergence, ogbn-arxiv, membership inference, Machine Learning journal