Catastrophic Failure of LLM Unlearning via Quantization

Failure of existing unlearning

• Quantization can recover forgotten knowledge from unlearned LLMs, revealing a failure that existing benchmarks may miss.The paper reports that GA_KLR on BOOKS retains about 13% of original knowledge before quantization but approximately 89% after quantization.Source: §1 · p. 2

Mechanism

• Utility-constrained unlearning typically retains minimal weight changes, allowing quantization to map unlearned and target models to similar weights.The paper hypothesizes that small learning rates and retain-set regularization make quantized models resemble the original target model.Source: §1 · p. 2

Practical significance

• The issue matters because quantization is widely used to deploy LLMs in resource-constrained settings, including models intended to forget malicious or private content.Recovered information after deployment would undermine the intended removal of sensitive knowledge.Source: §1 · p. 2

Proposed direction

• The proposed mitigation increases forgetting and retaining learning rates while using module-level saliency to update influential components selectively.Selective updates aim to reduce utility degradation and bias toward the retain data caused by aggressive full-model updates.Source: §1 · p. 3

Limitations

• The framework improves quantization robustness but remains highly sensitive to hyperparameter selection, producing unstable unlearned models.The authors advocate more robust and comprehensive quantization-robust unlearning methods.Source: §1 · p. 3

Contributions

• The paper frames preventing quantization-based knowledge recovery as a new objective for LLM unlearning and a consideration for benchmark design.It combines empirical verification, theoretical explanation, and an initial mitigation strategy.Source: §1 · p. 3

Machine Unlearning

• LLM unlearning methods include fine-tuning approaches such as GA and NPO, regularized optimization for utility preservation, and in-context methods with privacy limitations.In-context methods may retain sensitive data or fail to match retrained-model behavior.Source: §2 · p. 3

Quantization for LLMs

• Post-training quantization reduces storage and computation by mapping high-precision weights to discrete values, with RTN, GPTQ, and AWQ offering different strategies.GPTQ uses layer-wise inverse-Hessian information, while AWQ protects impactful weights and uses per-channel scaling.Source: §2 · p. 3

Research gap

• The interaction between quantization and LLM unlearning remains largely unexplored, despite its relevance to model compression and deployment.The paper distinguishes its contribution by providing experiments, theoretical understanding, and a mitigation framework.Source: §2 · p. 4

3.1 MACHINE UNLEARNING AND QUANTIZATION FOR LLMS

• Machine unlearning seeks a model that removes the influence of a forget set while behaving like a model trained only on the retain set.The unlearning algorithm takes a target model, forget data, and optionally retain data to produce an unlearned model.Source: §3.1 · p. 4
• The optimization combines a forgetting loss with a retain-set loss weighted by regularization parameter α.The forgetting loss penalizes retained information from the forget set, while the retain loss preserves utility.Source: §3.1 · p. 4
• Quantization replaces weight-based computation y = wx with y = Q(w)x, using a bit-dependent scale factor and quantization function.Advanced methods can adjust layer scaling using calibration data, and quantized unlearning is represented as Q(U(ftarget, Dforget, Dretain)).Source: §3.1 · p. 4

3.2 UNLEARNING WITH MINIMAL WEIGHT CHANGE AND UTILITY PRESERVATION

• Existing unlearning methods use much smaller learning rates than ordinary LLM training or fine-tuning to avoid utility collapse.Reported unlearning rates range from 1e−8 to 1e−5, compared with examples of 1e−4 to 3e−4 for standard training.Source: §3.2 · p. 4
• Minimal changes can make original and unlearned weights map to identical quantized values, causing the quantized unlearned model to resemble the quantized target model.This overlap provides the proposed mechanism for unlearning failure through quantization.Source: §3.2 · p. 5

4.1 EXPERIMENTAL SETUP

• The study evaluates six methods combining GA or NPO with GDR or KLR utility preservation, using NEWS and BOOKS from the MUSE benchmark.The methods are GA, GA_GDR, GA_KLR, NPO, NPO_GDR, and NPO_KLR.Source: §4.1 · p. 5
• The evaluation measures verbatim memorization, knowledge memorization, privacy leakage, and retain-set utility using four MUSE-aligned metrics.The first three metrics assess forgetting, while retain-set KnowMem assesses utility preservation.Source: §4.1 · pp. 5–6

4.2 IMPACT OF QUANTIZATION ON LLM UNLEARNING

• For utility-constrained methods, forgotten-knowledge retention rises from an average of 21% in full precision to 83% after 4-bit quantization.This is the paper’s main quantitative result across the evaluated unlearning methods.Source: §4.2 · p. 6
• Most 4-bit RTN models perform worse on forgetting metrics but better on utility, moving closer to the unlearned target model without unlearning.The apparent absolute forgetting of unconstrained GA is misleading because that method loses model utility completely.Source: §4.2 · p. 6

4.3 EFFECTS OF QUANTIZATION PRECISION ON UNLEARNING

• Eight-bit quantization behaves similarly to full precision, whereas lower precision such as 4-bit can cause catastrophic unlearning failures through knowledge recovery.The paper excludes 2-bit models because their performance gap conflicts with utility-preservation requirements.Source: §4.3 · pp. 6–7

4.4 INFLUENCE OF VARIOUS QUANTIZATION TECHNIQUES ON UNLEARNING

• GPTQ and AWQ perform similarly to RTN on NEWS, indicating that calibration datasets do not prevent quantized unlearned models from retaining forgotten knowledge.General calibration data may not match the forget-set domain, leaving the recovery issue pervasive across quantization techniques.Source: §4.4 · p. 7, Table 2 · p. 7

• Quantization maps weights within each interval to a shared low-precision index and value determined by the scale factor.The scale factor sets the size of each quantization interval.Source: §5 · p. 7
• Utility-preserving unlearning typically makes minimal weight changes, so the original and unlearned models can map to similar quantized values.Weights within the same quantization interval receive the same index and quantized value.Source: §5 · pp. 7–8
• When quantization produces similar representations for the original and unlearned models, the quantized unlearned model may retain knowledge from the forget set.Direct quantization of the original model generally preserves a significant portion of its knowledge.Source: §5 · p. 8
• 4-bit quantization is more likely than 8-bit quantization to fail at unlearning because its larger intervals ignore minor weight modifications.Int-4 requires changes exceeding 12.5 to alter quantized values, whereas int-8 can reflect changes of 0.78125.Source: §5 · p. 8

6 QUANTIZATION-ROBUST UNLEARNING

• SURE addresses the conflict between forgetting knowledge, preserving retain-set utility, and preventing recovery after quantization.The conflict arises because utility-preserving unlearning seeks minimal weight changes.Source: §6.1 · p. 8, §6 · p. 8

6.1 PROPOSED FRAMEWORK

• The method increases learning rates for forgetting and retaining losses, but large rates can over-adjust the model or bias it toward the retain dataset.These effects can reduce performance on tasks beyond the retain dataset.Source: §6.1 · p. 8
• SURE builds a module-level saliency map from forgetting-loss gradients and updates only modules with large gradient-based scores.This avoids the infeasibility of per-weight masks while targeting modules relevant to the forget dataset.Source: §6.1 · p. 9
• The saliency mask applies updates to selected modules while leaving intact modules unchanged, reducing potential retain-set bias from full fine-tuning.The approach is named Saliency-Based Unlearning with a Large Learning Rate (SURE).Source: §6.1 · p. 9

6.2 EXPERIMENTS

• Evaluation measures forgetting and utility in both full precision and quantized models across general ability, truthfulness, factuality, and fluency.The experiments incorporate SURE into multiple regularized unlearning methods and compare them with the original methods.Source: §6.2 · pp. 9–10
• SURE significantly improves forgetting in quantized models while usually maintaining comparable forgetting and utility in full-precision models.On BOOKS, the method exposes a trade-off: GA_GDR incurs factuality and truthfulness utility drops, despite retaining good general ability and fluency.Source: §6.2 · p. 10, Table 3 · p. 10

7 CONCLUSION

• Quantizing an unlearned model can restore forgotten knowledge, and the paper proposes saliency-based large-learning-rate unlearning to mitigate this recovery while preserving utility.The study presents this as a significant drawback in current LLM unlearning methods and an overlooked benchmark dimension.Source: §7 · p. 10, §A.1 · p. 16

A.2 QUANTIZATION FOR LLMS

• Quantization methods reduce storage and computation by mapping high-precision parameters to discrete values, with PTQ avoiding retraining and QAT retraining at low precision.The paper discusses PTQ methods including RTN, SpQR, GPTQ, AWQ, and SqueezeLLM.Source: §A.2 · p. 16

B DETAILS OF UNLEARNING METHODS AND REGULARIZERS

• LLM unlearning methods primarily use fine-tuning objectives such as Gradient Ascent or Negative Preference Optimization, often combined with retain-set regularization.The evaluated combinations are GA, GA_GDR, GA_KLR, NPO, NPO_GDR, and NPO_KLR.Source: §B.1 · p. 17, §B.2 · p. 17

B.1 TWO UNLEARNING FAMILIES

• Gradient Ascent lowers correct-prediction likelihood on the forget set, whereas NPO treats the forget set as negative preference data while remaining close to the original model.NPO controls divergence from the target model with a hyperparameter β.Source: §B.1 · p. 17

B.2 UTILITY PRESERVATION THROUGH REGULARIZATION

• Retain-set regularizers preserve utility either by gradient descent on retained data or by minimizing KL divergence from the original model’s predictions.The KL objective combines conventional unlearning loss with retain-set distribution matching.Source: §B.2 · p. 17

C.1 NEWS AND BOOKS DATASETS

• MUSE evaluates unlearning on NEWS and BOOKS datasets, covering news articles and the Harry Potter novels with related retained materials.BOOKS uses the novels as the forget set and Harry Potter FanWiki materials as the retain set.Source: §C.1 · pp. 17–18

C.2 FOUR METRICS

• Four metrics assess verbatim memorization, knowledge memorization, privacy leakage, and utility preservation after unlearning.The first three concern the forget set, while utility is measured on the retain set.Source: §C.2 · p. 18
• VerMem compares generated continuations with held-out sequence tokens using ROUGE-L F1, where lower values indicate better forgetting.Source: §C.2 · p. 18
• KnowMem generates question-answer pairs from forget-set excerpts and averages ROUGE scores between model responses and reference answers; lower scores indicate less residual knowledge.Source: §C.2 · p. 18
• PrivLeak uses Min-K% Prob membership inference and compares AUC-ROC against a retrained model, with values near zero indicating no privacy risk.Distribution shifts between forget and holdout sets can move the retrained-model AUC away from 0.5.Source: §C.2 · p. 18

C.3 DETAILS OF RETRAINED MODEL AND TARGET MODELS

• MUSE uses a base model with no access to forget or retain data, fine-tunes target and retrained models on specified datasets, and evaluates six unlearning methods.Both models are fine-tuned for 5 epochs with a constant learning rate of 1e−5; methods use AdamW, with NEWS and BOOKS trained for 10 and 5 epochs, respectively.Source: §C.3 · p. 19, §D.1 · p. 19

E ADDITIONAL EXPERIMENTAL ANALYSIS

• 4-bit quantization sharply worsens unlearning: in GA_KLR, M1 rises from 14.1 to 33.8 and M2 from 27.1 to 50.9.The 8-bit versions generally remain comparable to full precision, whereas 4-bit models often approach the target model and show improved M4 only because forgetting fails.Source: E ADDITIONAL EXPERIMENTAL ANALYSIS · pp. 19–20
• GA and NPO generally fail to achieve true forgetting on privacy leakage and utility, while GA+X and NPO+X preserve utility without resolving privacy leakage.GDR and KLR produce contrasting privacy-leakage behavior, with GDR explicitly using gradient descent and yielding extremely positive leakage results.Source: E ADDITIONAL EXPERIMENTAL ANALYSIS · p. 20

F ADDITIONAL EVIDENCE OF THE FAILURE OF UNLEARNING VIA QUANTIZATION

• On RWKU, forgetting generally worsens after quantization across GA, NPO, and RT, except for RT on FB, where apparent improvement reflects reduced utility.RWKU evaluates fill-in-the-blank, question-answer, and adversarial-attack probes, with lower values indicating better forgetting.Source: F ADDITIONAL EVIDENCE OF THE FAILURE… · p. 20, Table 7 · p. 21

G EXPERIMENT RESULTS OF SURE ON NEWS DATASET

• SURE significantly improves forgetting in quantized NEWS models while maintaining forgetting and utility similar to original methods in full precision.Source: G EXPERIMENT RESULTS OF SURE ON NEWS… · p. 21, Table 8 · p. 21

H HYPERPARAMETER ANALYSIS

• Increasing γ typically improves utility but degrades forgetting, with γ = Percentile(s, 90) providing a favorable trade-off.Source: H HYPERPARAMETER ANALYSIS · p. 21

I ABLATION STUDY

• SURE typically achieves a better balance between forgetting and utility than SURE/S on BOOKS.Source: I ABLATION STUDY · p. 22, Table 10 · p. 22
• SURE/S forgets more knowledge but loses utility because full fine-tuning with a large learning rate over-adjusts the model.Large retain-set updates can also bias behavior toward retain data and degrade performance outside that set.Source: I ABLATION STUDY · pp. 21–22

J EXPERIMENTS AND DISCUSSION ON OTHER UNLEARNING METHODS

• Both RMU and RMU_LAT show poor M1, M2, and M3 performance after quantization on BOOKS.Learning-rate tuning used grid search over [5e−6, 1e−5, 5e−5].Source: J EXPERIMENTS AND DISCUSSION ON OTHER… · p. 22

K FURTHER INSIGHTS INTO THE CORE CONTRIBUTIONS

• Increasing the learning rate shows promise for preventing knowledge recovery through quantization, supporting the paper’s theoretical analysis.The approach is empirically validated in Table 3.Source: K FURTHER INSIGHTS INTO THE CORE… · p. 23
• Large learning rates can degrade model performance, motivating localization-informed methods based on module-level gradients and saliency maps.These methods are presented as an initial effort to mitigate the negative impact of aggressive learning rates.Source: K FURTHER INSIGHTS INTO THE CORE… · p. 23

L THE CRITICAL NATURE AND REAL-WORLD SCENARIOS OF THE IDENTIFIED

• Because 4-bit quantization preserves utility while recovering forgotten knowledge, quantization-robust unlearning matters for practical deployment and potential legal compliance.Open-source model users may quantize updated models independently, creating risks for providers that fail to prevent recovery.Source: L THE CRITICAL NATURE AND REAL-WORLD… · pp. 23–24

M COMPARISON WITH OTHER METHODS FOR EVALUATING ROBUST UNLEARNING IN LLMS

• Quantization evaluates whether unlearning remains effective after deployment changes, whereas attack-based recovery methods require more effort and recover less knowledge.The cited comparison reports 10% retained knowledge and no attack method reaching 20%.Source: M COMPARISON WITH OTHER METHODS FOR… · p. 24