When you remove data or a capability from a fine-tuned model, standard checks tell you it
stopped saying the thing — not that it's gone. An independent review tells you
which one you actually have, before an auditor asks.
$3,000 fixed fee~5 days turnaroundNo model weights requiredIndependent — we don't sell the fix
The problem
"We unlearned it" is a claim you probably can't prove
Independent published studies report that a small amount of fine-tuning restores much of
what current unlearning methods claim to erase (Hu et al., ICLR 2025; Łucki et al., 2024; Deeb &
Roger, 2024 — references). If your compliance, contractual, or regulatory story rests on "we removed it,"
you may be asserting something that quietly isn't true. There are three real outcomes, and only one is
the one you're hoping for:
removed
The capability withstands attack and the model stays useful. The strong result — and the rare one.
hidden
Suppressed but recoverable, beyond what a never-trained control recovers. Fine for "we reduced surface behavior" — not for "the data is gone."
broke the model
Removal "worked" only because the model was damaged. Suppression confounded with collateral harm.
The Deletion Assurance Review
An honest grade on where you stand today
A low-friction, no-model-access assessment of your deletion or unlearning
claim against the open Yuyari Standard. We review your process, your evidence, and the
language you use — then place you on a four-tier readiness ladder and hand you the exact path to a
defensible claim.
The ladder rates your ability to defend a claim. It is a different instrument from a
verdict, which rates a specific model after it has actually been attacked. This review
issues a tier; a verdict comes from a Rehearsal Engagement.
1
Not Yet Defensible
Relies on "we retrained/fine-tuned it out." No adversarial test, and no never-modified control behind the claim.
2
Behavioral Evidence Only
You can show the model refuses — but not that the content is unrecoverable. Removal and suppression are indistinguishable at this tier.
3
Adversarially Tested
Recovery testing with a control and a declared utility floor, at the Standard's statistical bar. Supports a "reduced surface behavior" claim. This is the highest tier this review can award.
4
Defensible Removal Claim
The full attack battery on a conformant run, producing a removed verdict — then verified by Yuyari or an Accredited Assessor. Requires a Rehearsal Engagement, not an interview. Genuinely rare.
Every tier carries an access track. W-track means we had model weights
and could simulate the strongest adversary; Q-track means query access only, and says nothing
about someone who obtains your weights. Q3 is not W3.
Most real pipelines land at Tier 1–2 today. That isn't a failure — it's the finding
that makes the review worth running, and the ladder shows precisely what the next tier takes.
Tier 4 requires verification by Yuyari or an Accredited Assessor. The accreditation
criteria are public and open to any qualifying firm, and our dual role as both steward of the Standard and
seller of assessments is disclosed in every report we issue.
What you get · what's in scope
Your Assessment Report
Your tier on the readiness ladder, with the reasoning
A plain-language statement of what you can and cannot defensibly claim today
A gap analysis against the Yuyari Standard's numbered requirements
Risk exposure mapped to EDPB Opinion 28/2024, the EU AI Act, and US deletion rules
A prioritized path to a defensible claim — auditor-ready
A 45-minute readout call
Deliberately out of scope
Any access to your model weights or production systems
Running the live attack protocol or producing a verdict — that's the Rehearsal Engagement
Remediation or re-testing of your pipeline
Legal advice, or any certification of compliance
Handling real personal data — you describe, you don't attach
How it works
Signed to report in about a week
Intake
You complete a 30–45 minute questionnaire. No weights, no sensitive data.
Interview
One or two short sessions to fill the gaps and understand your claim.
Assessment
We grade you against the Standard and write the report — in ~5 business days.
Readout
A 45-minute walkthrough of your tier, gaps, and the path forward.
Why independent
The one who sells the fix can't grade it
The value of this review is that it will tell you hidden when the answer is
hidden. A vendor selling you the unlearning method cannot credibly grade its own work — an insurer,
a regulator, or an enterprise customer knows that. Yuyari doesn't sell the removal method. We sell the
truthful grade, and we say exactly what it does and does not let you claim.
"Prove it forgot — don't take the vendor's word that it did."
Why now
The burden of proof is shifting onto you
EDPB 28/2024 · EU
A model trained on personal data is not presumed anonymous. The burden of showing data can't be extracted sits with you. That burden is a test.
EU AI Act
GPAI technical-documentation duties live since Aug 2025; the Commission's enforcement powers applied from Aug 2026. "Show your testing" becomes real.
US · CPPA / Delete Act
Deletion rights now reach ML-derived systems. The question "prove it's gone" is arriving on both sides of the Atlantic.