Machine Unlearning for the XGBoost Model with Network Intrusion Datasets

Researchers have introduced XGBoost-Forget, a machine unlearning method tailored for the XGBoost model, targeting a gap in network intrusion detection where most prior work has concentrated on deep learning and image data [1]. The approach, detailed in a paper submitted in 2026, is designed to remove specific data points from trained models without requiring a full retraining cycle [1]. Machine unlearning has gained attention as a technique to address data privacy and compliance requirements, but its application to tabular data — the format common in network intrusion tasks — has remained limited [2]. The authors evaluate XGBoost-Forget on two tabular network intrusion datasets, IoT-23 and GeNIS, measuring model performance, unlearning efficiency, and forgetting quality [1]. According to the paper, the results indicate that XGBoost-Forget maintains predictive performance close to that of the original model while delivering significantly faster unlearning [2]. This performance is notable because XGBoost, a gradient-boosted decision tree algorithm, operates on structured, tabular data rather than the unstructured image data that dominates deep learning research [3]. The work appears on arXiv, an open-access repository that hosts preprints across computer science and other quantitative fields and which, as of late 2024, was receiving roughly 24,000 submissions per month [9]. The study addresses a practical constraint in cybersecurity operations: retraining a full intrusion detection model each time a data point must be expunged is computationally expensive. By demonstrating that unlearning can be achieved with minimal degradation to detection accuracy, the paper opens a path toward more agile model governance in network security settings [1][2]. The authors used multiple evaluation metrics to confirm that the forgetting process did not introduce unacceptable performance regressions, though the preprint has not yet undergone peer review [2][9].