Layered Unlearning for Adversarial Relearning

• Post-training interventions can be bypassed or reversed by adversarial prompting or fine-tuning, and prior work found that fine-tuning on a subset can re-elicit unlearned information.Source: §1 · p. 1
• The authors hypothesize that existing unlearning methods introduce a shared, context-dependent inhibitor that fine-tuning can remove, reversing the post-training modification.Source: §1 · p. 1
• LU partitions data into disjoint folds, sequentially unlearns growing unions of folds, and retains the remaining folds alongside a retain set to create distinct inhibitors.Source: §1 · p. 1, Figure 1 · p. 2
• Across synthetic tasks and WMDP, Years, and MMLU, LU improves resistance to fine-tuning recovery; corpus-based attacks bypass inhibitors more effectively than standard RTT (Deeb & Roger, 2025), revealing fold variation absent in standard unlearning.Source: §1 · p. 2
• The paper presents LU as a defense-in-depth approach and reports improved resistance to adversarial relearning in both synthetic and LLM settings.Source: §1 · p. 2

2.1 Machine unlearning notation

• Machine unlearning approximates retraining without the forget set while preserving performance on a retain set.The generic unlearning function maps model parameters, forget and retain sets, and hyperparameters to updated parameters.Source: §2.1 · p. 3

2.2 Adversarial relearning in synthetic settings

• The 2D task classifies Gaussian-mixture points against a uniform background using radial basis function features, with A, B, and R denoting data subsets.Unlearning aims to remove A and B while retaining R.Source: §2.2 · p. 3
• In two synthetic tasks, relearning B restored 93% of task A’s original performance in 2D classification and 73% in bigram modeling.These experiments replicate cross-task recovery after unlearning in both settings.Source: §2.2 · pp. 3–4

2.3 The Layered Unlearning algorithm

• LU sequentially unlearns cumulative folds while retaining the remaining folds and R, aiming to induce distinct inhibitors at each stage.At stage i, it unlearns F1 through Fi while retaining R and Fi+1 through Fk.Source: §2.3 · p. 4

2.3.1 Layered Unlearning for logistic regression

• With five Gaussians, relearning B raises A accuracy by 0.29, while relearning A raises B accuracy by 0.91 under 2-fold LU.The reported comparison illustrates asymmetric cross-task recovery in the logistic-regression setting.Source: §2.3.1 · p. 5, Table 1 · p. 5

2.3.2 Layered Unlearning for bigram modeling

• After unlearning, relearning on A or B improves the other bigram task by 0.17 on average under LU, versus 0.43 under the unlearning primitive U.The authors characterize this as bidirectional robustness, with independent inhibitors preventing transfer between A and B.Source: §2.3.2 · p. 6, Table 2 · p. 6

3 LLM unlearning experiments

• The LLM experiments test RMU and SimNPO, with and without LU, on WMDP, MMLU, and Years; retain-set evaluation uses MMLU.For MMLU unlearning, the categories being unlearned are excluded from the retain set.Source: §3 · pp. 6–7
• Evaluation splits each forget set into fixed random folds, fine-tunes on a proper subset using MCQ data or its corresponding corpus, then tracks accuracy on the remaining folds.Only unlearned models with at most a 10% retain-set accuracy drop are considered; experiments use Zephyr-7B-β.Source: §3 · p. 7

3.1 Layered Unlearning is more robust to adversarial relearning

• LU improves RMU’s robustness, with fold order shaping recovery: access to fold A lets an adversary recover more about B and C than access only to fold C.Figure 3 shows a directional barrier: relearning on B recovers performance on C but not A.Source: §3.1 · p. 7, Figure 3 · p. 7
• SimNPO also becomes more robust with LU, though less than RMU; L-SimNPO’s barrier is more symmetric, indicating LU generalizes across unlearning methods.Source: §3.1 · p. 7

3.2 Corpus-based fine-tuning is a stronger adversarial attack

• RMU performance increases by an average of 5% under corpus-based fine-tuning; for L-RMU, performance improves 10% when relearning on later folds and evaluating earlier ones, and 6% in the reverse direction.The two L-RMU figures describe different relearning and evaluation directions.Source: §3.2 · p. 8
• Layered variants improve resistance to relearning; Table 3 reports a one-directional barrier for L-RMU, a partially bidirectional barrier for L-SimNPO, and generally stronger corpus than MCQ attacks for RMU variants.Similar results for Years and MMLU are reported in Appendix E.Source: Table 3 · p. 8, §3.2 · p. 8

• Existing LLM unlearning methods use approximate strategies, yet models remain vulnerable to adversarial attacks and relearning from small fragments of previously seen data.The cited approaches include model optimization and prompt-based or in-context techniques.Source: §4 · pp. 8–9
• Adversarial relearning fine-tunes on a small subset of forgotten data to recover information about the full set; prior defenses have not consistently withstood such attacks.Informationally distinct examples can also induce relearning (Deeb & Roger, 2025).Source: §4 · p. 9
• The authors report no comprehensive comparison of corpus-based and MCQ-based fine-tuning and identify corpus-based fine-tuning as a more natural and effective adversarial relearning strategy.Prior work had studied both approaches (Deeb & Roger, 2025).Source: §4 · p. 9
• Prior work studied sequential unlearning for removing copyrighted information or improving forgetting efficiency, but not its effect on robustness to adversarial relearning (Dou et al., 2025; Zhao et al., 2024).Source: §4 · p. 9

5 Discussion

• LU is sensitive to hyperparameters, more computationally intensive, and less scalable as the number of folds grows.The model must distinguish each pair of folds, and the authors suggest more efficient methods as future work.Source: §5 · p. 9
• Comprehensive adversarial evaluation remains difficult because relearning subsets grow exponentially and attacks vary across configurations.The authors leave full analysis to future work; their fixed setting was sufficient to break RMU and SimNPO baselines.Source: §5 · p. 9
• The paper does not directly evaluate harmless fine-tuning on data unrelated to the unlearned examples.The authors hypothesize that LU may reduce vulnerability even with related data, potentially shrinking the gap between related- and unrelated-data fine-tuning.Source: §5 · p. 9
• LU’s distinct inhibitors may help disentangle behaviors that a shared inhibitor influences together.The authors suggest a possible alignment strategy that trains harmlessness before fine-tuning helpfulness while preserving harmlessness.Source: §5 · pp. 9–10

6 Conclusion

• LU is a k-fold sequential unlearning framework that constructs functionally distinct, context-dependent inhibitors to improve robustness.Experiments show improved robustness across synthetic and LLM benchmarks, although stronger corpus-based attacks reveal remaining limitations.Source: §6 · p. 10

A Layered Unlearning graphics

• Figure 4 contrasts joint forgetting with LU’s staged trajectory: retain B while forgetting A, then forget both folds.The caption describes the standard trajectory as losing performance on A and B jointly.Source: Figure 4 · p. 14
• Figure 5 shows A accuracy dropping first, B dropping at the second stage, and C dropping at the third stage of forgetting.The folds are forgotten in A, B, C order using RMU on WMDP.Source: Figure 5 · p. 15

B.1 Logistic regression

• LU consistently resists relearning as cluster count increases, while robustness is somewhat reduced under random clustering.Adversarial relearning becomes more effective as the number of clusters increases.Source: §B.1 · p. 15
• K-Means separates tasks more cleanly, whereas random clustering and larger cluster counts increase the likelihood of task overlap.The authors offer this as an intuition for why adversarial relearning is harder to defend against with random clustering.Source: §B.1 · p. 15

B.2 Bigram modeling

• The component substitutions group QK as WQ and WK, OV as WO and WV, and UE as WU and WE.Figure 8 encodes substitutions with binary masks, where 000 is standard unlearning and 111 is full LU.Source: §B.2 · p. 15, Figure 8 · p. 17
• Substituting QK or OV consistently yields the greatest robustness to adversarial relearning, while retain and task accuracies remain stable.The authors identify attention as important in this setting and leave investigation of the mechanism for future work.Source: §B.2 · p. 16, Table 4 · p. 17, Figure 8 · p. 17

C Retain accuracies

• The retain-accuracy appendix reports evaluation for restricted and full MMLU sets, including retain categories in health, history, law, philosophy, and social sciences.The table caption distinguishes the full MMLU dataset from the restricted subset called the small set.Source: C Retain accuracies · p. 18, Table 6 · p. 18

D Unlearning accuracies

• RMU-Split assigns each fold a different random projection instead of RMU’s shared projection, and the reported results do not change.The appendix also provides unlearning accuracies by method, dataset, and evaluation fold.Source: D Unlearning accuracies · p. 19, Table 7 · p. 19

E Relearning accuracies

• Attacks use learning rate 10^-6 and batch size 4, with 8 MCQ epochs and 5 corpus epochs.The authors take the maximum validation accuracy across epochs; the different epoch counts reflect their stated stopping considerations.Source: E Relearning accuracies · p. 19
• Tables 8–10 cover WMDP relearning accuracy across two, three, and four folds.The supplied passages identify the tables’ scopes but do not provide enough column context to establish a winning method.Source: Table 8 · p. 20, Table 9 · p. 21, Table 10 · p. 22
• For A, B, D; A, C, D; and B, C, D, the listed rows include RMU, L-RMU, RMU-Split, and L-RMU-Split with MCQ and corpus entries.The supplied table fragments contain values, but their full column layout is not available for a reliable comparison.Source: §E.3 · p. 23

E.4 MMLU 3 folds

• Table 11 reports relearning accuracy across methods for MMLU with three folds.The passage gives the table’s scope, but no cell values or method comparison.Source: Table 11 · p. 23

E.5 Years 3 folds

• Table 12 reports relearning accuracy across methods for Years with three folds.The supplied passage identifies the table scope, without giving its cell values.Source: Table 12 · p. 24

F Relearning recovery rates

• Recovery rate compares the accuracy regained after relearning with accuracy after unlearning; lower recovery indicates better unlearning robustness.The metric is used to compare the vulnerability of models P and Q to adversarial relearning.Source: F Relearning recovery rates · p. 25

G Hyperparameters

• A minimum unlearning accuracy threshold of 0.25 is imposed when models are highly unlearned, to avoid artificially inflating recovery rates at the performance lower bound.The forgetting threshold is set to approximately 0.35, with 0.25 corresponding to random guessing for four-choice MCQ.Source: F Relearning recovery rates · p. 25, G Hyperparameters · p. 29

F Relearning recovery rates

• The recovery-rate comparison tables cover WMDP at two, three, and four folds, MMLU at three folds, and Years at three folds..Source: Table 13 · p. 25, Table 14 · p. 26, Table 15 · p. 27

G Hyperparameters

• The hyperparameter material lists configurations for RMU, RMU-Split, L-RMU, L-RMU-Split, SimNPO, and L-SimNPO; SimNPO was rerun because its online checkpoint did not sufficiently unlearn the folds.The experiments use Zephyr-7B-β for all models.Source: G Hyperparameters · p. 29, §G.1 · p. 29, §G.2 · p. 29