PaperlayerView exact revision on arXiv

Source-linked AI summary

Forgetting That Sticks: Quantization-Permanent Unlearning via Circuit Attribution

Saisab Sadhu, Pratinav Seth, Vinay Kumar Sankarapu

arXiv:2605.15138v1cs.LGcs.CLcs.ET

TL;DR

Current unlearning evaluations omit whether forgetting survives deployment quantization and whether targeted knowledge is structurally erased. MANSU uses causal circuit attribution, retain-constrained circuit updates, and a quantization-survival floor; across hazard benchmarks, it satisfies all four target properties, including a −0.040 PTQ gap on WMDP-bio Llama.

  • Problem

    Existing evaluations largely test full-precision behavioral suppression, omitting quantization permanence and structural erasure as deployment-relevant unlearning properties.

  • Method

    MANSU attributes forget-set knowledge to causal circuits, applies retain-constrained null-space updates, and enforces a per-parameter floor that survives NF4 quantization.

  • Results

    MANSU jointly satisfies meaningful forgetting, retain preservation, non-positive PTQ gap, and structural erasure across hazard benchmarks, achieving a −0.040 PTQ gap on WMDP-bio Llama.

  • Takeaways & Limitations

    Unlearning evaluations should combine post-quantization testing with mechanistic verification because behavioral suppression alone can reflect minimal parameter change rather than knowledge deletion.

  • Takeaways & Limitations

    Experiments cover bio, chem, and cyber hazards on multiple-choice tasks, so generalization to other hazard types or open-ended formats requires additional validation.

Abstract

from arXiv · show

Standard unlearning evaluations measure behavioral suppression in full precision, immediately after training, despite every deployed language model being quantized first. Recent work has shown that 4-bit post-training quantization can reverse machine unlearning; we show this is not a tuning artefact but a systematic dual failure: gradient-based methods that achieve meaningful forgetting lose it under compression, while methods that survive quantization barely change the model. Both failures trace to the same root cause: across all baselines, per-parameter updates lie 47-828x below the NF4 quantization bin width; updates diffused across billions of parameters cannot clear quantization bin boundaries, a consequence we formalize as a sparsity-permanence tradeoff. We present MANSU (Mechanistic-Aligned Null-Space Unlearning), which resolves both modes by combining causal circuit attribution to isolate the minimal forget-set subgraph, circuit-restricted null-space projection with a diagonal-Fisher retain bound, and a per-parameter magnitude floor guaranteeing quantization survival by construction. We additionally introduce Circuit Attribution Divergence (CAD), a mechanistic verification metric distinguishing structural erasure from behavioral suppression, a distinction existing metrics cannot make. Across multiple model families and hazard benchmarks, MANSU is the first method to jointly satisfy all four properties with margin on each (meaningful forgetting, retain preservation, non-positive PTQ gap, and structural erasure), while gradient-based baselines recover up to +0.05 accuracy under compression.

1 Introduction

The introduction argues that quantization undermines existing machine-unlearning guarantees: gradient methods forget in BF16 but recover after NF4 compression, while quantization-surviving methods barely alter the model. It attributes both failures to updates too small to cross quantization bins and motivates MANSU’s circuit-localized, formally constrained, quantization-surviving design.

  • Motivation: 4-bit quantization is the standard pre-release step for deployed LLMs, reducing memory by 4× and inference cost by 2–3× while unlearning addresses hazardous knowledge and erasure requirements.The introduction frames quantization permanence as essential because safety-critical unlearning is both necessary for hazardous memorization and legally required for right-to-erasure regulations.
  • Dual failure: +0.06 to +0.07 PTQ recovery gaps undo gradient-based forgetting, whereas quantization-surviving methods reduce forget-set accuracy by only 1.6 pp on average across 94 non-MANSU experiments.The dual failure pattern also holds on Qwen-3-8B and the MUSE open-ended memorization benchmark.
  • Structural cause: 10^-6 per-parameter updates on Llama-3.1-8B fall below the ≈8.4 × 10^-4 NF4 bin width, so distributed changes round to zero during compression.The model has d ≈8 × 10^9 parameters, creating a sparsity-permanence tradeoff: constraining updates to survive quantization sacrifices meaningful forgetting.
  • MANSU: MANSU localizes forget-set knowledge to a causal circuit C, projects circuit-restricted updates into the retain-set Fisher null space, and applies an NF4-sized magnitude floor.The method uses EAP-IG to identify C, a tighter retain-loss bound from Theorem 1, and construction-time quantization survival from Lemma 1.
  • Contributions: 94 non-MANSU experiments across three model families, three hazard domains, and two benchmarks document that existing methods do not jointly achieve meaningful forgetting and quantization permanence.The contribution count comprises 84 WMDP cells and 10 MUSE cells.

2 Background and Related Work

Prior work spans five unlearning families, but existing approaches trade meaningful forgetting, retain safety, quantization survival, and structural erasure. MANSU combines circuit localization, restricted null-space projection, and magnitude floors to address these limitations.

  • Method Families: Five method families—gradient ascent, preference optimization, null-space projection, representation steering, and quantization-aware optimization—are evaluated against four requirements.Table 1 summarizes each family against the requirements of Section 3.
  • Gradient-Based Methods: Gradient ascent distributes updates across all d parameters, while surgical variants remain below quantization thresholds unless they violate retain constraints.Figure 1 shows global and surgical gradient-ascent updates below δ_i, whereas MANSU reaches the threshold by construction.
  • Preference Optimization and Representation Steering: Preference optimization preserves retain scores but produces negligible structural change, while representation steering leaves causal knowledge circuits intact despite behavioral suppression.NPO and SimNPO use frozen references; LUNAR and RMU suppress outputs through activation steering or randomization rather than erasing the circuit.
  • Mechanistic Localization: MANSU extends mechanistic localization from factual associations and circuit attribution to unlearning, restricting null-space updates to causally identified circuits.It inherits null-space projection while claiming a strictly tighter retain bound through circuit restriction.
  • Quantization Robustness: 83% recovery under 4-bit PTQ has been reported, but retain constraints cap useful learning rates, leaving magnitude floors as the source-level remedy.The prior mitigation, PTQ-LR, uses a large learning rate, whereas the paper argues the retain constraint independently limits that strategy.

3 Problem Formulation

The problem is to find an update that meaningfully forgets the forget set while preserving retain performance, surviving 4-bit quantization, and structurally erasing the responsible circuit. The formulation exposes a sparsity–permanence tradeoff: retain-constrained updates are typically far below NF4 bin widths, while sufficiently concentrated updates risk retain damage.

  • Four-property objective: The target update must satisfy four properties: meaningful forget-set failure, retain and general-task performance within 2 pp, quantization permanence, and structural erasure.Quantization permanence requires Q4(θ′) to fail on Df, while structural erasure requires causal attribution to show the forget-knowledge subgraph has collapsed rather than been bypassed.
  • NF4 quantization floor: 8.4 × 10^-4 is the approximate smallest NF4 bin width δi for Llama-3.1-8B MLP weights.The floor is defined as δi = si · min_k |qk − qk−1| under per-channel scale si and NF4 codebook levels.
  • Sparsity–permanence tradeoff: 2.2 × 10^-6 bounds the global per-parameter update for Llama-3.1-8B, roughly 380× below δi under d = 8.03×10^9 and ϵr = 0.02.Updates reach δi only when |C|/d ≤ 7×10^-6, meaning fewer than 0.001% of parameters are updated.
  • Implications: 4500× is how far MANSU’s 3.2% circuit coverage exceeds the threshold, while Surgical GA’s 6.6% exceeds it by approximately 9400×.The passage concludes that localization alone is insufficient and a magnitude floor is required to close the quantization gap by construction; Surgical GA has a +0.027 PTQ gap.
  • Second failure mode: 1.6 pp is the mean forget-set reduction for NPO, SimNPO, and GU+SimNPO on capable models across the 94-experiment sweep.Frozen-reference KL keeps updates much smaller than δi almost everywhere, leaving forget accuracy largely intact at standard hyperparameters.

4 Method

MANSU addresses quantization-fragile unlearning through three phases: causal circuit localization, Fisher-masked null-space projection, and a post-hoc magnitude floor that forces updates across NF4 bin boundaries. The method restricts changes to a minimally attributed circuit while preserving retain behavior through a tighter retain bound and frozen-reference KL objective.

  • Phase 1: Localize: MANSU first localizes the forget-set circuit using EAP-IG attribution over 50 examples, selecting the top-10 MLP sublayers by incoming attribution mass.The selected circuit covers approximately 3.2% of parameters; its canonical top-5 prefix is {30, 14, 31, 19, 29}.
  • Phase 2: Project: The projection phase masks high-Fisher coordinates within the selected circuit and freezes all parameters outside it, approximating projection into ker(HCC).The Fisher threshold is the 99th percentile, and restricting projection to the circuit gives a provably tighter retain bound than global projection.
  • Phase 3: Floor: After convergence, the floor phase rescales nonzero circuit updates smaller than their nearest NF4 boundary distance, preserving direction and ensuring quantization permanence.The best checkpoint minimizes forget accuracy subject to an MMLU drop ≤0.08, and implementation uses a per-tensor approximation of δi.
  • Training objective: MANSU jointly encodes the three constraints in its training objective, while frozen-reference KL prevents retain collapse.The KL term follows NPO/GU, and the method uses full-parameter rather than LoRA training.

5 Theoretical Analysis

The theoretical analysis establishes retain safety, quantization permanence, and amplification for MANSU. Together, these results explain its margin on meaningful forgetting, non-positive PTQ gap, retain preservation, and structural erasure.

  • Theoretical Guarantees: MANSU’s circuit-restricted null-space projection provides a retain-safety guarantee under PSD Hessian assumptions and bounded updates.Theorem 1 applies when the circuit coordinates lie in ker(H_CC), non-circuit updates are zero, and ||Δθ||≤ε.
  • Theoretical Guarantees: Circuit-restricted projection is strictly tighter than global null-space projection when the dominant Hessian eigenvector projects non-trivially onto circuit coordinates.Causal attribution selects the circuit from Df rather than Dr, and Ablation D verifies the tightening empirically.
  • Quantization Analysis: |Q4(θi + Δθi) − θi| ≥ |Δθi| when updates cross at least two NF4 bin boundaries, yielding a negative PTQ gap.Single-crossing floor updates amplify displacement in expectation, whereas diffuse updates with |Δθi| < δi are erased and produce the +0.06 to +0.07 PTQ gap regime.
  • Combined Implications: Theorem 1, Lemma 1, and Proposition 2 explain why MANSU is the only Table 2 method with margin on all four target properties.Those properties are forget depth comparable to NPO, ΔPTQ ≤ 0 across every cell, preserved MMLU, and CAD ≫ AS-NC.

6 Experiments

Experiments test whether MANSU resolves quantization failure, whether its components are necessary, and whether forgetting is structural. Across models and datasets, MANSU combines meaningful forgetting, retain preservation, non-positive PTQ gaps, and circuit-level erasure, while baselines fail at least one property.

  • Experimental setup: MANSU is evaluated on WMDP-bio with Llama-3.1-8B-Instruct, plus MUSE, Qwen-3-8B, and broader cross-architecture sweeps.Fixed forget and MMLU indices are reused across methods; NF4 evaluation uses 4-bit quantization.
  • Main results: MANSU achieves forget 0.430, NF4 0.390, ∆PTQ= −0.040, and MMLU 0.573, within 0.030 of zero-shot.Global GA’s BF16 forget 0.260 flips to NF4 0.310 (∆PTQ= +0.050), while preference methods either sacrifice utility or barely change the model.
  • Structural verification: MANSU attains CAD 1.143 with AS-NC 0.138, indicating weight-level structural erasure rather than behavioral suppression.LUNAR instead yields CAD ∈[0.029, 0.045] across WMDP/MUSE cells, consistent with editing outside the EAP-IG forget circuit.
  • Cross-dataset and cross-architecture consistency: MANSU’s ∆PTQ is non-positive on all 8/8 flagship model-dataset cells, CAD exceeds 1.0 on 7/8, and MMLU remains within 0.030 of zero-shot.Strictly negative ∆PTQ extends to every cell in the additional model-family sweeps across WMDP-bio/chem/cyber, MUSE, Llama-3.1-8B, and Qwen-3-8B.
  • Ablations: Removing the magnitude floor weakens ∆PTQ from −0.040 to −0.008 and regresses forget accuracy to 0.513, while inverse-circuit attribution flips ∆PTQ to +0.028 and lowers CAD to 0.511.Global null-space plus floor also flips ∆PTQ positive (+0.013), showing that circuit localization and the floor are jointly necessary.

7 Discussion

The discussion argues that unlearning evaluation should add quantization and mechanistic checks, because standard testing rewards minimal parameter changes. It also limits direct validation to flagship 8B models and factual-recall benchmarks, with behavior beyond that regime not directly verified.

  • Implications for evaluation practice: 94 non-MANSU experiments show that standard evaluation selects methods making minimal parameter changes rather than meaningfully solving forgetting.A 1.6 percentage-point forget-set accuracy reduction can pass the test without solving the underlying problem.
  • Implications for evaluation practice: Evaluation should add the PTQ gap and CAD, or an equivalent mechanistic verification, without requiring new infrastructure.These additions are intended to distinguish quantization robustness and structural effects from standard behavioral suppression.
  • Limitations: MANSU is directly reported on two flagship 8B models from the Llama and Qwen families, while smaller and earlier-generation results are reported in Appendix J.Those additional results follow the same three-phase pipeline.
  • Limitations: Mechanistic localization is well-supported on the studied factual-recall benchmarks, but behavior beyond the 8B regime is not directly verified.The reported scaling behavior is consistent with the floor remaining the binding mechanism, but this remains unverified directly.

8 Conclusion

Full-precision unlearning can fail after deployment compression because forgotten knowledge returns or the model barely changes. MANSU addresses this by updating only the causally identified circuit, while the paper’s broader framework emphasizes quantization-aware tradeoffs and four required properties.

  • Conclusion: Across six methods, full-precision unlearning did not reliably survive the single compression pass preceding deployment.The forgotten knowledge either returned or had never been removed because the model barely changed.
  • Conclusion: MANSU updates only the causally identified circuit to address compression-related unlearning failure.Its approach begins by identifying where the targeted knowledge resides.
  • Conclusion: −0.040 on WMDP-bio Llama was achieved with preserved MMLU and IFEval.The conclusion presents this result alongside the paper’s broader evidence and verification framework.
  • Conclusion: The paper highlights 94-experiment dual-failure documentation, CAD, and the sparsity-permanence framework as lasting contributions.Future methods satisfying all four properties of Section 3 must engage with the sparsity-permanence tradeoff.

9 Broader Impact and Ethics … C.2 Proof of Theorem 1

MANSU targets durable safety-critical unlearning by localizing causal forget circuits, constraining retain disruption, and enforcing updates that survive NF4 quantization. The paper also specifies scope and misuse limitations, mechanistic validation, implementation details, and a proof that circuit-restricted null-space updates eliminate the retain-loss quadratic term.

  • 9 Broader Impact and Ethics: Existing unlearning methods can fail after 4-bit compression, making durable removal of biosecurity, cyberweapon, and chemical-weapon knowledge safety-critical.The paper emphasizes that practitioners and policymakers relying on unlearning for safety certification need to know this failure mode.
  • 9 Broader Impact and Ethics: The work is limited to bio, chem, and cyber hazard domains on MCQ, does not claim complete knowledge removal, and does not provide tools to recover unlearned knowledge.Generalization to other hazard types or open-ended formats requires additional validation; datasets are public and implementation materials are planned for release upon acceptance.
  • B.1 Phase 1 details: EAP-IG attribution: MANSU localizes the forget-set intervention with EAP-IG, selecting the top-K (K = 5) MLP sublayers into circuit C and validating overlap with surgical gradient ascent.For Llama-3.1-8B on WMDP-bio, EAP-IG identifies {30, 14, 31, 19, 29}; the top-5 methods overlap at layer 14.
  • B.2 Phase 2: Circuit-restricted training with KL retain anchor: MANSU trains only circuit parameters, freezes the rest, and uses a KL anchor against the original model on MMLU retain samples to limit retain collapse.The circuit includes all three MLP projections, while the KL penalty uses batch size 4 per step and λ = 200.
  • B.3 Phase 3 details: magnitude-floor enforcement: The post-hoc magnitude floor rescales nonzero sub-floor circuit updates to δi and returns never-crossing coordinates to θ(0), leaving only NF4-surviving changes.The per-tensor approximation is (wmax − wmin)/16, while exact minimum NF4 spacing is si×0.0796; typical values are ∼10^-3.
  • B.3 Phase 3 details: magnitude-floor enforcement: Approximately 3–5% of parameters differ from the original model after the floor pass, because sub-floor coordinates are zeroed rather than held at ±δi.The effective fraction is measured after training and floor enforcement, not merely by the gradient-mask scope.
  • B.4 Activation Shift metric / A Extended Related Work: High ASC with low AS ¯C indicates that the intervention is localized, while CAD detects behavioral suppression that leaves the causal knowledge circuit intact.LUNAR and RMU can pass behavioral metrics while CAD remains ≈0 because the causal circuit is not removed.
  • C.1 Notation / C.2 Proof of Theorem 1: Under A1–A3, Taylor expansion yields an exactly vanishing retain-loss quadratic term, while circuit restriction bounds the linear term by ∥∇CLr(θ)∥·ε.The proof contrasts MANSU with global GU projection, which leaves the complement update unconstrained and retains the full gradient norm.

C.3 Approximation error under diagonal Fisher … D.4 Empirical near-zero concentration of circuit weights

The analysis bounds diagonal-Fisher approximation error while clarifying that MANSU’s retain guarantee comes from circuit restriction rather than Fisher inversion. NF4’s uneven bin spacing motivates a magnitude floor that formally guarantees bin crossing for approximately 65% of circuit weights and works empirically for the remainder.

  • C.3 Approximation error under diagonal Fisher: At pretrained Llama-3.1-8B weights, the empirical Fisher is approximately block-diagonal at the layer level, making ∥EC∥op/τ ≪ 1 in practice.The approximation uses HC C = DC + EC with DC diagonal and EC off-diagonal.
  • C.3 Approximation error under diagonal Fisher: MANSU’s retain bound follows from circuit restriction, Δθ_¯C = 0, while diagonal-Fisher analysis characterizes approximation error rather than requiring Fisher projection.The training objective uses a KL retain term as the practical anchor, and the method does not invert F.
  • C.4 Proof of Lemma 1: For narrow-bin weights, δi = (wmax − wmin)/16 approximates the average NF4 bin width and guarantees bin crossing whenever |∆θi| ≥ δi.This guarantee applies to weights in the narrow-bin region near zero.
  • C.4 Proof of Lemma 1: For wider tail bins, the floor is smaller than the local bin width, so bin crossing is empirical rather than worst-case.The consistently negative PTQ gap across all model–dataset pairs in Table 2 confirms effectiveness for the remaining tail-weight fraction.
  • C.5 Proof of Proposition 2: Under monotone NF4 levels, the floor moves narrow-bin weights into a higher bin, with quantized level selection favoring the new level under the stated sub-bin condition.The cited proof states probability ≥1/2 under uniform sub-bin placement, with automatic selection for m ≥ 2.
  • D.1 NF4 levels: NF4 uses 16 normalized levels derived from standard-normal quantiles, producing denser central quantization and narrower bins near zero.The uneven spacing drives quantization amplification.
  • D.2 Spacings: NF4 inter-level spacing ranges from 0.0796 at the zero crossing to 0.3038 in the negative tail.The standard-normal density is highest near zero, explaining narrower central bins and wider tails.
  • D.3 Floor value: For Llama-3.1-8B circuit-layer MLP weights, the implementation floor uses α < 1 as a tunable margin, while α = 1 restores the strict guarantee.The reported scale factor ranges from ≈0.012 to 0.018 with median 0.015, and sensitivity to α appears in Table 13.

E EAP-IG Implementation … M Per-Parameter Update Distribution

The paper specifies a reproducible single-GPU EAP-IG implementation, evaluates MANSU across models and hazard domains, and reports robustness, sensitivity, timing, and per-parameter update analyses. Across the sweep, MANSU uniquely combines deepest forgetting with negative PTQ gaps, while attribution identifies compact, stable circuits and quantization-aware updates.

  • E EAP-IG Implementation: Single-GPU execution is mandatory because device_map="auto" silently collapses EAP-IG edge scores to zero; all runs pin computation with device_map={"":0}.The EAP-IG source also requires replacing hardcoded tensor.to('cuda') calls with tensor.to(model.cfg.device).
  • E EAP-IG Implementation: Attribution uses four Llama-3.1 GQA flags, while MLP-only analysis is motivated by factual-memory evidence but leaves joint attention–MLP attribution for future work.The flags separate Q, K, and V inputs, expose per-head attention results, hook MLP inputs, and expand 8 KV heads to 32.
  • E EAP-IG Implementation: Top-5 MLP layers form the circuit after mean-absolute aggregation across 50 forget examples with 5 integration steps, covering ≈11% of parameters and ≈3.2% after flooring.The top-5 layer identity remains identical across ig_steps ∈{3, 5} and N ∈{20, 50}.
  • F Experimental Setup: The primary evaluation uses Llama-3.1-8B-Instruct on WMDP-bio, with Qwen-3-8B providing secondary cross-architecture and cross-domain evaluation under fixed indices and NF4 reloading.Evaluation includes 100 forget and 400 MMLU questions sampled once, and checkpoints are reloaded without BF16 access to simulate deployment.
  • G Multi-Model Sweep: Gemma Family; H Multi-Model Sweep: Llama Family; I Multi-Model Sweep: Qwen Family: Across Gemma, Llama, and Qwen sweeps, MANSU achieves the deepest BF16 forgetting and the only negative ∆PTQ across every model-family configuration.The sweep covers eight model variants, three WMDP hazard domains, and six methods; macro-averages summarize 24 model-domain pairs.
  • G Multi-Model Sweep: Gemma Family: Gemma-2B and Gemma-3-1B baselines remain ∼9 pp above random chance, whereas MANSU reaches within 2–4 pp while maintaining negative ∆PTQ.Random chance is 0.25 for the cited benchmark setting.
  • K Hyperparameters and Sensitivity: The λ = 200 operating point achieves Forget BF16 = 0.430 and PTQ gap = −0.040 at step 30, while α = 1.0 provides the exact Lemma 1 guarantee.λ was selected by sweeping {50, 100, 200, 500} subject to MMLU drop ≤0.02; primary circuit size is k = 5.
  • L Wall-Clock Timing; M Per-Parameter Update Distribution: Timing is reported for MANSU components and six baselines on one H200, while Table 15 relates gradient-method RMS updates to the NF4 floor ratio using 8.4 × 10−4.Floor ratio values below 1 indicate updates that round to zero under NF4, providing the empirical signature of Proposition 1.

N Extended Ablation Discussion

Extended diagnostics show that CAD must be paired with localization measures to distinguish structural erasure from global damage. Ablations attribute MANSU’s performance to the magnitude floor, null-space projection, and circuit localization, while evaluations remain limited to two primary model families.

  • Structural diagnostics: CAD distinguishes weight-level edits from inference-time redirection, but localization requires AS-C/AS-NC and random-circuit controls.CAD is computed from unlearned weights and forget distributions without held-out probes; localized interventions shift in-circuit activations more than out-of-circuit activations.
  • Structural diagnostics: SimNPO on MUSE reaches CAD=1.979 and AS-NC=1.104, showing that high CAD alone can reflect global representational damage rather than localized erasure.The diagnostic interpretation requires high CAD together with low AS-NC; SimNPO also exhibits reduced MMLU.
  • Component ablations: Without the magnitude floor, BF16 forget rises to 0.513 and ∆PTQ reaches −0.008, while MMLU drop increases to 0.117.Sub-floor updates round to zero under NF4, degrading quantization robustness by 5×; ∆MMLU is +0.042 worse than full MANSU.
  • Component ablations: Without null-space projection, MMLU drops to 0.449 and ∆PTQ is −0.019, demonstrating severe retain damage despite the active magnitude floor.Raw forget-set gradients include components along retain-sensitive directions; the MMLU change is −0.154 versus baseline and +0.079 worse than full MANSU.
  • Component ablations: Random-circuit localization yields BF16 forget of 0.500, CAD of 0.743, and ∆PTQ of −0.024, versus full MANSU’s CAD=1.143 and ∆PTQ of −0.040.CAD collapses by 35% relative to full MANSU, supporting the role of attribution-based circuit selection.
  • Component ablations: Global null-space projection with a floor produces BF16 forget accuracy of 0.697 and positive ∆PTQ of +0.013, as updates disperse across parameters.Most global updates fall below δ_i, undermining both forget depth and quantization robustness.
Loading 2605.15138v1…