Robust LLM Unlearning with MUDMAN: Meta-Unlearning with Disruption Masking And Normalization

Filip Sondej; Yushi Yang; Mikołaj Kniejski; Marcel Windys

Source-linked AI summary

Robust LLM Unlearning with MUDMAN: Meta-Unlearning with Disruption Masking And Normalization

Filip Sondej, Yushi Yang, Mikołaj Kniejski, Marcel Windys

arXiv:2506.12484v5Jun 14, 2025cs.LGcs.AIcs.CL

TL;DR

Dangerous knowledge can survive safety fine-tuning and specialized unlearning, remaining recoverable through multiple elicitation routes. The paper systematically evaluates robust-unlearning components and combines meta-learning, Disruption Masking, and gradient normalization in MUDMAN. Across models and tasks, MUDMAN consistently outperforms adapted TAR and supports more irreversible unlearning.

Problem
Safety fine-tuning and specialized unlearning can leave dangerous capabilities recoverable, while the components needed for irreversible unlearning remain unclear.
Method
MUDMAN combines meta-unlearning, sign-based Disruption Masking, and normalization of unlearning gradients.
Results
MUDMAN consistently outperforms adapted TAR across three models and two unlearning tasks.
Takeaways & Limitations
Selective unlearning that avoids disrupting retained model performance brings robust, irreversible unlearning closer to safe language-model deployment.
Takeaways & Limitations
The evaluation uses monolithic methods rather than testing consecutive stacks of different unlearning methods.

Abstract

from arXiv · show

Language models can retain dangerous knowledge and skills even after extensive safety fine-tuning, posing both misuse and misalignment risks. Recent studies show that even specialized unlearning methods can be easily reversed. To address this, we systematically evaluate many existing and novel components of unlearning methods and identify ones crucial for irreversible unlearning. We introduce Disruption Masking, a technique in which we only allow updating weights, where the signs of the unlearning gradient and the retaining gradient are the same. This ensures all updates are non-disruptive. Additionally, we identify the need for normalizing the unlearning gradients, and also confirm the usefulness of meta-learning. We combine these insights into MUDMAN (Meta-Unlearning with Disruption Masking and Normalization) and validate its effectiveness at preventing the recovery of dangerous capabilities. MUDMAN outperforms the prior TAR method by 40%, setting a new state-of-the-art for robust unlearning.

1 Introduction

Dangerous knowledge and capabilities can persist after safety fine-tuning or specialized unlearning, remaining recoverable through attacks. The paper systematically identifies robust components and combines them into MUDMAN.

Safety fine-tuning and specialized unlearning can leave dangerous knowledge recoverable through jailbreaks or other elicitation methods.
The paper evaluates existing and novel unlearning components to identify those that make harmful capabilities more difficult to reverse.
MUDMAN combines meta-unlearning, Disruption Masking, and unlearning-gradient normalization into one pipeline.
Disruption Masking zeroes unlearning updates whose signs differ from retaining gradients, filtering potentially disruptive weight changes.

2 Related work

Prior unlearning methods modify activations or weights, but unwanted concepts can be rapidly re-represented and removed capabilities remain elicitable. Meta-learning addresses this by anticipating relearning through an adversarial model.

Existing methods can remove or disrupt targeted representations, yet models may quickly relearn them using neurons with similar meanings.
MAML trains a copy of the model on the forget set and uses its gradients to anticipate how an attacker could relearn the target capability.
Removed capabilities remain elicitable through jailbreaks, prompting, fine-tuning, in-context learning, distribution shifts, or disabled refusal mechanisms.

3 Experiment setup

Experiments cover three model sizes, coding-skill and biohazard-knowledge unlearning tasks, and automated searches that evaluate recoverability after supervised relearning while preserving retained performance.

Experiments use pythia-14m, SmolLM-135M, and Llama-3.2-1B, progressing from rapid small-model iteration to larger-model validation.
Coding unlearning uses CodeSearchNet Python examples as the forget set and Wikitext as the retain set, with comments and docstrings removed.
Biohazard-knowledge unlearning uses Pile-Bio as the forget set and the rest of the Pile as the retain set.
WMDP-Bio accuracy on 1273 multiple-choice questions measures recovery of hazardous biosecurity knowledge after unlearning.
Optuna searches hundreds of trials per method under matched unlearning and fixed relearning compute.
The primary evaluation maximizes forget-set loss or WMDP accuracy after supervised fine-tuning, while retaining-set degradation is constrained.

4 Building a robust unlearning pipeline

The pipeline develops MUDMAN by testing meta-learning, selective gradient updates, normalization, and module targeting against relearning. Across models and tasks, the combined method consistently outperforms adapted TAR, with Disruption Masking contributing most of the gain.

4 Building a robust unlearning pipeline: Most tested methods raise forget-set loss during unlearning, but supervised relearning typically restores the behavior immediately.
4.1 Meta-learning is effective: Ablations show Disruption Masking accounts for most improvement over TAR, while meta-learning and normalization help inconsistently in some setups.
4.1 Meta-learning is effective: Meta-learning trains an adversary on the forget set; interleaving adversary and main-model updates and training one adversary deeply improved early performance.
4.2 Disruption Masking drives performance: Disruption Masking applies unlearning gradients only when their signs match retain gradients, avoiding disruptions rather than correcting them afterward.
4.2 Disruption Masking drives performance: Retain-gradient momentum provides a decaying accumulator whose signs generalize masking beyond the current batch without additional memory cost.
4.3 Gradient normalization improves speed and stability: Gradient normalization counters shrinking late-stage unlearning norms, improving overall performance and making training easier to tune.
4.4 Module selection improves selectivity: The most effective targets are first MLP layers and gated-MLP gating matrices, while MLP second matrices and attention Q/K matrices disrupt general performance more.
4.5 Improvements from MUDMAN: MUDMAN consistently outperforms adapted TAR across three models and two unlearning tasks, and no ablation significantly surpasses the full method.

5 Conclusion

MUDMAN combines meta-unlearning, Disruption Masking, and normalized unlearning gradients to improve robust harmful-knowledge removal across datasets and models. The authors conclude that selective unlearning can avoid disrupting model performance and move toward irreversible unlearning.

MUDMAN combines meta-unlearning, Disruption Masking, and normalized unlearning gradients, with each component improving robustness across datasets and models.The components add minimal computational and memory overhead and are compatible with any unlearning loss.
Selective unlearning methods that avoid disrupting model performance support progress toward truly irreversible unlearning.The authors identify irreversible unlearning as important for safely deploying models that acquire dangerous knowledge and capabilities.

6 Limitations

The limitations concern evaluation coverage and the range of unlearning procedures examined. The study focuses on supervised-fine-tuning elicitation, one capability-recovery test, monolithic methods, and broad rather than fully granular selectivity.

Evaluation uses supervised fine-tuning to elicit unwanted behavior, leaving jailbreak and other attacks without weight access for future study.The authors describe supervised fine-tuning as powerful and reliable but suggest extending evaluation to attacks such as jailbreak prompts [Zou et al., 2023].
A further test could examine whether capabilities truly disappear by fine-tuning on a non-overlapping set of facts to uncover supposedly unlearned facts.This approach is attributed to Deeb and Roger [2024].
The study evaluates monolithic methods that apply one algorithm throughout unlearning, leaving combinations of methods and possible synergies for future work.The TAR baseline was reduced to its meta-learning core by removing its initial representation-noising step [Tamirisa et al., 2024a].
The experiments generally favor selective and granular techniques, but finer-grained analysis could target crucial logits and distribute forget loss across all unwanted tokens.The authors propose per-token analysis rather than concentrating loss increases on only a few unwanted tokens.

A Future work

Future work extends selectivity from unlearning procedures to dataset design and interpretability, while also examining adversary depth and preserving desired behaviors. These directions target finer control, mechanistic understanding, and broader robustness conditions.

Dataset design could label token importance in forget sets, improving selective unlearning and the accuracy of method evaluation.The proposal focuses on distinguishing critical tokens from benign filler words and irrelevant passages.
Interpretability could investigate the sudden “break through” in forget loss during relearning and identify affected neurons and triggering contexts.The authors compare this behavior to grokking and ask whether models before breakthrough resist other elicitation techniques without fine-tuning.
Unlearning with shallow or absent adversaries is easily reverted, whereas greater adversary depth can become computationally costly, motivating isolated depth studies.The authors identify the trade-off between reversibility and computational cost as an open question.
The unlearning concept could also be inverted to preserve critical desired behaviors under out-of-distribution inputs, jailbreaks, or fine-tuning.The authors connect this direction to deliberative alignment, where selected reasoning lines should trigger reliably in certain contexts [Guan et al., 2025].

B Target modules

Target-module experiments show that selective intervention can preserve general performance while maintaining unlearning robustness. The best target is consistently the projection feeding the MLP activation: gate_proj in gated MLPs and up_proj in Pythia.

Freezing modules that contribute little to unlearning but strongly disrupt general performance can also reduce memory use by eliminating their stored gradients and related accumulators.The authors refer to Figure 5 for robustness comparisons across module configurations.
Gate projection is the most consistent target, while Q, K, and down projections disrupt retain performance enough that omitting them is preferable.The comparison uses a no-unlearning baseline with the same relearning stage, and higher values indicate better unlearning effectiveness while retaining capabilities.
For Llama-3.2-1B and SmolLM-135M, gate_proj performs best; for Pythia-14M, up_proj performs best because both feed the MLP activation function.Pythia uses a traditional two-layer MLP, whereas the other models use gated MLPs.

C Types of gradient normalization

The section finds that global gradient normalization is safer than per-module scaling, while normalization variants perform similarly; cruelty unlearning shows partial success but needs refinement.

C Types of gradient normalization: Normalization improves performance over no normalization, but the tested normalization types show less clear differences.Table 1 reports forget loss after unlearning and relearning, with higher values indicating better performance.
C Types of gradient normalization: Global gradient normalization avoids inflating gradients in low-norm modules, whereas per-module normalization can distort their updates.The method therefore uses a global norm rather than normalizing each module independently.
D Unlearning tendencies: For cruelty, Disruption Masking helps, meta-learning does not, and cross-entropy loss produces the largest effect, indicating that the method still needs refinement.The comparison uses Optuna searches and baselines measured after the same relearning procedure.
D Unlearning tendencies: Cruelty unlearning achieves partial success on BeaverTails animal-abuse examples, evaluated against benign retained answers.The same figure also compares cruelty with Python and includes rejected methods.

E Failed methods

The failed-methods experiments show that many intuitive ways to suppress relearning or directly erase capabilities underperform simpler backpropagation-based approaches. Selective logit loss is promising but unreliable across datasets.

E Failed methods: Most tested components were evaluated in isolation, so possible synergies and effects under broader capability benchmarks remain unresolved.The experiments covered five categories, but many variants and combinations were omitted from the main description.
E.1 Dampening relearning gradients: Dampening relearning gradients through stream deactivation, gradient silencing, or first-layer adjustments did not outperform straightforward backpropagation.The tested approaches target upstream activations, backpropagating gradients, or summed gradients in first MLP layers.
E.2 Direct weight edits: Direct neuron ablation was weaker than weight ablation based on pre-weight activation times post-weight activation, showing that neuron-level interventions lack sufficient granularity.Fading backpropagation also showed no evidence of improving over normal backpropagation.
E.3 Erasing capabilities rather than drowning them out: The erasure-oriented methods aim to avoid masking unwanted capabilities by amplifying alternative behavior, but shrinking weights or activations relies on imperfect proxies.Weight magnitude does not necessarily indicate whether a capability is present, and activation masking does not actively reduce activations.
E.3 Erasing capabilities rather than drowning them out: Selective logit loss can perform well and sometimes beat cross-entropy or entropy loss, but its reliability varies across datasets.It focuses on reducing the unwanted token while normalizing logits to avoid incentivizing uniform decreases.

E.4 Making unlearning more selective

The authors find that selective gradient masking is central to robust unlearning, while several alternative extensions offer little or unreliable benefit. They retain Disruption Masking and a streamlined meta-learning design because these approaches better preserve retained performance or unlearning robustness.

E.4 Making unlearning more selective: Disruption Masking became the preferred selective-unlearning method after alternatives were tested, including gradient quantiles, absolute-gradient aggregation, and multiple-adversary or consensus extensions.The authors report that multiple LoRA adversaries and weight consensus provided no benefits, while Disruption Masking was more successful and straightforward.
E.4 Making unlearning more selective: Representation-engineering retain loss produced no improvement in the reported setup, while forget-gradient accumulation was unnecessary and increased memory use.The authors therefore require more accurate disruption estimates for retain performance than for identifying forget-set-breaking weights.
E.4 Making unlearning more selective: Scaling down helpful retaining effects outperformed absolute-gradient aggregation but remained inferior to Disruption Masking.Absolute values prevent cancellation but also treat helpful effects as harmful; the compromise scaling approach avoids both problems only partially.
E.4 Making unlearning more selective: The optimal disruption percentile oscillated around 50%, matching the approximate fraction selected by sign agreement, so the simpler untuned criterion was retained.Disruption percentiles were discarded because gradient-sign masking provides a conceptually simpler alternative without percentile tuning.
E.5 Tweaking the meta-learning: Full adversaries outperformed LoRA adversaries, although LoRA remained a sometimes-competitive option when memory is constrained.LoRA adversaries reuse the main model weights and add a small adapter to reactivate dormant unwanted capabilities during unlearning.
E.5 Tweaking the meta-learning: Adversary decay improved unlearning substantially on Python but was unreliable across datasets, so it was excluded from the final algorithm.The authors consider refining this mechanism promising despite its inconsistent cross-dataset behavior.
E.5 Tweaking the meta-learning: Locating the unwanted circuit only once matched full meta-learning early but became outdated later, limiting its usefulness as a complete replacement.The precomputed circuit worked well only at the beginning of unlearning, whereas later updates required refreshed information.

F MUDMAN implementation in PyTorch

The implementation restricts intervention and auxiliary storage to selected parameters, interleaves model and adversary updates, and reuses computation to reduce overhead. Hyperparameter searches use fixed-compute comparisons, supervised relearning, and explicit retention safeguards.

F MUDMAN implementation in PyTorch: The implementation performs model and adversary updates in one interleaved loop, periodically forks one deeply trained adversary instead of training multiple adversaries in an inner loop.The authors report these changes as beneficial but encourage further study of the trade-offs.
F MUDMAN implementation in PyTorch: MUDMAN stores adversarial weights, unlearning gradients, and retain accumulators only for intervened parameters, yielding memory usage of size(model) + 3 ∗size(interven_params).For intervention limited to gate_proj components, this uses less memory than regular SGD training.
F MUDMAN implementation in PyTorch: Reusing forget-batch forward passes reduces computation to five forward or backward passes per loop, with further backward-pass reuse possible for cross-entropy loss.The implementation exposes separate base and adversarial parameter states while reusing computation across the unlearning process.
G Hyperparameter searches: Each hyperparameter-search run uses roughly the same compute across methods by counting total forward and backward passes rather than algorithm loops.The searches use hundreds of Optuna trials, each containing an unlearning stage followed by a fixed relearning stage.
G Hyperparameter searches: The searches use supervised SGD relearning with fixed learning rates because LoRA relearning produced unpredictable, initialization-sensitive results.The WMDP experiments use a learning rate of 3e-4, while other relearning uses 1e-3.
G.1 Maximizing forget loss searches: Figure 3 searches used adversary decay even though the mechanism was later removed from Algorithm 1 after proving unhelpful and unnecessarily complicating the method.This creates a distinction between the tuned search configuration and the final algorithm.
G.2 Minimizing WMDP accuracy searches: WMDP searches tune only unlearning and retaining rates because each trial is three times longer, while other hyperparameters are informed by earlier searches.The experiments target Llama-3.2-1B because other tested models perform near random guessing on WMDP.
G.2 Minimizing WMDP accuracy searches: Retention safeguards pause unlearning updates when retain loss exceeds initial retain loss + 0.05 and terminate and reject the trial above initial retain loss + 0.1.

G.3 Detailed Optuna plots

The appendix presents detailed Optuna visualizations, while checklist responses document reproducibility, experimental reporting, and acknowledged scope limitations.

G.3 Detailed Optuna plots: Each Optuna row represents one hyperparameter search and each point represents a trial, with colors indicating trial order.The plots show performance dependence on hyperparameters, optimization history, and, when applicable, Optuna’s hyperparameter-importance estimates.
NeurIPS Paper Checklist: The paper states that its claimed improvement over state of the art comes from the reported experiments and that the ablation study supports the usefulness of all claimed components.
2. Limitations: The authors provide a natural-language algorithm description, pseudocode, a minimal PyTorch implementation, repository code, and detailed experimental setup for reproducibility.
2. Limitations: The paper reports hyperparameter searches, configuration files, standard errors over many runs, and compute-resource information to document experimental details and variability.