PaperlayerView exact revision on arXiv

Source-linked AI summary

Machine Unlearning for Large Language Models: Foundations, Advances, and Agentic Extensions

Xiaoyu Xu, Minxin Du, Li Bai, Junxu Liu, Yaxin Xiao, Kun Fang, Liu Yang, Huadi Zheng, Peizhao Hu, Qingqing Ye, Haibo Hu

arXiv:2609.30909v1cs.CR

TL;DR

Target information may persist beyond model parameters in external and agentic system state, while studies vary in what they target and test. This survey compares methods and evidence across these settings using a five-layer framework, lifecycle, and evidence dimensions. It concludes that reported outcomes depend on evaluation choices and that existing evidence does not establish removal across external state and subsequent updates.

  • Problem

    Removal studies vary in their targets, intervention scope, and evaluation, while target information may persist in external and agentic system state beyond model parameters.

    Source: §1 · p. 1

  • Method

    The survey compares methods and evidence across model and agentic systems using a framework connecting requests, system scope, information loci, interventions, and supported claims.

    Source: §1.1 · p. 3

  • Results

    Model evaluations do not establish removal across external state and later updates, and reported model-study comparisons vary with target construction, retained data, and recovery tests.

    Source: §10 · p. 25

  • Takeaways & Limitations

    Removal claims should track affected state and test propagation and restoration within the system scope they cover.

    Source: §10 · p. 25

    Evaluation supports removal only for tested paths, conditions, and times, not unknown paths, unobserved intervals, or formal guarantees.

    Source: §2.3 · p. 6

Abstract

from arXiv · show

Machine unlearning aims to remove target influence while preserving other capabilities. This survey compares methods, benchmarks, and evidence across large language models and systems using retrieval, memory, tools, and interacting agents. A five-layer framework connects removal requests, system boundaries, target locations, interventions, and supported claims. A seven-stage lifecycle and six evidence dimensions guide comparison. The review shows that target construction, retained data, and recovery tests affect reported outcomes. Evidence from model evaluations remains insufficient to establish removal across external state and subsequent updates, motivating evaluation that tracks dependencies and tests whether target influence returns.

1 Introduction

LLMs and agentic systems can retain target information across parameters, retrieval stores, memories, and other state, so removal claims must be matched to the target, affected components, and evidence. The survey broadens comparison across these systems with a shared framework, lifecycle, and evidence profile.

1 Introduction

  • Sensitive information can persist in LLM parameters and, in agentic systems, across retrieval stores, memories, caches, tool states, and interaction trajectories.Removal also aims to preserve utility on retained data and must account for persistence and subsequent use throughout agentic systems.Source: §1 · pp. 1–2
  • Suppressing a response, deleting a record, and preventing its influence on later actions are distinct outcomes that require different evidence.Existing studies vary in target, intervention scope, and evaluation protocol; model-only removal evidence does not establish system-level fulfillment.Source: §1 · p. 2, §1.1 · p. 2

1.1 Scope and Positioning

  • The review examines removal methods across augmented LLMs, agents, and multi-agent systems, including component modification, propagation, verification, and persistence after updates.It synthesizes methods and evidence through 25 August 2026, distinguishing direct removal evidence from supporting mechanisms and adjacent research.Source: §1.1 · pp. 2, 4
  • The five-layer framework links request semantics, system scope, information locus, intervention, and evidence-backed claims to compare studies across system scopes.A seven-stage lifecycle organizes removal execution and maintenance, while six evidence dimensions organize evaluation within the claim boundary.Source: §1.1 · pp. 3–4
  • The survey identifies unresolved coordination across parameters, external stores, and agent memory, and verification that target influence does not return after later updates.Functional forgetting for learning or adaptation is distinguished from evidence that a requested target’s influence was removed.Source: §1.1 · pp. 3–4

2 Foundations and Problem Formulation of LLM Unlearning

This section formalizes unlearning around the requested target, system state and control boundaries, intervention outcomes, and the evidence needed to support removal claims. It distinguishes model-level criteria from broader claims about external state, paths, and later system evolution.

2.1 Classical and LLM Unlearning

  • Exact unlearning requires the updated and retained-data retrained parameter distributions to be equal over algorithm randomness, not merely to agree on finite prompts.Approximate guarantees relax this distributional criterion under specified assumptions.Source: §2.1 · pp. 4–5
  • LLM removal requests may target facts or capabilities with unknown training origins, and refusal alone does not establish removal.Residual information can be missed by average accuracy; the request needs an explicit target and evaluation reference.Source: §2.1 · p. 5
  • Optimization-based methods balance a removal loss, retained-task loss, and optional proximity penalty, while other interventions edit associations, modules, or stored state.When retained data are unavailable, a method must identify a proxy or omit the retained-loss term; finite optimization may stop before convergence.Source: §2.1 · p. 5

2.2 State, Requests, and Control Boundaries

  • The state model represents components and their states, with directed edges for copying, derivation, synchronization, or possible behavioral influence.Edges do not establish causation; the representation separates information location from routes through which it may spread or affect behavior.Source: §2.2 · p. 5
  • A request specifies target, authority, granularity, regime, scope, policy, and horizon, while operators may modify or inspect only their control boundary.The operational closure and path inventory identify required direct, derived, and restorative state; inaccessible known paths remain untested obligations.Source: §2.2 · pp. 5–6

2.3 Operational Terms and Evidence-Supported Claims

  • System-level unlearning coordinates interventions across required components and paths, then verifies removal through subsequent interactions and updates.Data deletion, state deletion, suppression, editing, and parametric unlearning support different outcomes and do not alone establish system-wide removal.Source: §2.3 · p. 6
  • A removal claim is bounded by evaluated paths, conditions, times, required state, and declared thresholds; missing tests leave it unsupported.The evidence profile distinguishes efficacy, specificity, utility, robustness, persistence, and completeness; passing tests do not establish unknown paths, unobserved intervals, or a formal guarantee.Source: §2.3 · pp. 6–7

2.4 Authorization and Security Conditions

  • Removal decisions assume authorized changes and relevant-harm evaluation, since removal processes can expose information or damage retained behavior.Authentication and target validation establish permitted changes, while checkpoint-access controls and post-update tests address risks created by those changes.Source: §2.4 · p. 7

3 A Unified Framework for LLM Unlearning

The five-layer framework links removal requests to system boundaries, target-bearing state, interventions, and evidence-backed claims. Its lifecycle and comparison conditions distinguish what must be changed from what tests can establish.

3.1 How the Five Layers Guide Comparison

  • The five layers connect each removal request to system scope, information locus, intervention, and the evidence-backed claim; untested components remain outside the result.Source: §3 · p. 7, §3.1 · p. 7

3.2 System Scope and Expanding Information Loci

  • The framework separates model-state changes from external-state work: retrieval sources, derivatives, and caches may require deletion, propagation, and checks.Source: §3.2 · p. 8

3.3 The Seven-Stage Lifecycle

  • Request, Scope, Localize, Execute, Propagate, Verify, and Maintain specify lifecycle obligations, with propagation and later checks depending on the system.A RAG request may require cache invalidation and tests after index rebuilding, unlike a standalone checkpoint without external replicas.Source: §3.3 · p. 8, Figure 2 · p. 8

3.4 Categories and Comparison Conditions

  • Granularity and request regimes are independent of propagation and multi-owner authority, while loci and interventions can combine.Comparisons also account for access, cost, guarantee assumptions, and application objectives.Source: §3.4 · pp. 8–9, Figure 3 · p. 9

3.5 Interpreting System Claims and Evidence Maturity

  • Source deletion alone supports a narrower claim than checking derivatives and testing retrieval; inaccessible required replicas remain unresolved.Evidence maturity distinguishes substantial, fragmented, and early coverage from open assurance where integrated evidence remains unavailable.Source: §3.5 · p. 9

4 LLM Unlearning: Benchmarks, Methods, and Evidence

The review compares benchmark construction, intervention requirements, and model-level tests for standalone LLM unlearning. It finds that reported outcomes depend on target validation, retained-data boundaries, recovery testing, and the criteria used to compare methods.

4.1 Benchmarks: What Should Be Forgotten?

  • Benchmark construction is a bottleneck: credible suites validate target presence, forget–retain overlap, case quality, and the request regime.Targets that do not match model knowledge can distort efficacy, and privacy rankings vary with data, model, method, and attack configuration.Source: §4.1 · p. 9, Figure 4 · p. 10
  • Sequential or continual requests require stating request units, order, overlap, and evaluation horizons because streams may restore removed influence, harm utility, or raise audit cost.PCH tests request interactions, while DUSK and ORT expose overlap and expression coupling.Source: §4.1 · p. 10

4.2 Methods: How Can a Model Forget?

  • ICUL reduces confidence on targeted instances while maintaining test accuracy without parameter updates, but remains dependent on supplied context and its composition.Its evaluated effect belongs to the inference configuration, making it relevant when weights are inaccessible and inference inputs can be controlled.Source: §4.2 · p. 10
  • NPO variants improve the reported forget–utility trade-off over gradient-ascent baselines on TOFU with Llama-2-7B-Chat, while stronger retain-loss weighting eventually reduces forget quality.NPO requires parameter access, forget examples, and reference probabilities; retain regularization additionally requires retained data.Source: §4.2 · p. 11
  • RMU reduces WMDP-Bio and WMDP-Cyber accuracy while largely preserving Zephyr-7B’s original MMLU performance; PISCES reports stronger specificity and relearning robustness with modest efficacy gains.RMU’s preservation depends on retain-data coverage, while PISCES depends on concept-isolating features and an available SAE.Source: §4.2 · p. 11
  • With loss held fixed and low-rank design varied, mean Bio/Cyber accuracy falls to 35.1%, versus 38.1% for VILA, while all reported checkpoints preserve at least 95% of original MMLU utility.Matched TOFU tests show SimNPO outranks RMU on the harmonic mean of memorization, privacy, and utility; excluding privacy reverses GradDiff’s ranking in its favor.Source: §4.2 · pp. 11–12
  • LAU trains against recovery attacks, while SSU and O3 illustrate approaches to successive requests with different interference and utility-preservation designs.O3 works without retain data and reports improved utility retention over its baselines across three tasks and seven datasets, but depends on detector and adapter configuration.Source: §4.2 · p. 12

4.3 Model-Level Evidence: What Does Evaluation Establish?

  • Model-level conclusions depend on matching targets, intervention scope, and evaluation conditions; recovery and collateral-effect tests can reveal failures hidden by aggregate scores.For repeated requests, retesting earlier targets and recording cumulative costs tracks changes in removal and retained performance.Source: §4.3 · p. 13

5 Extending Unlearning Beyond the Model

Extending unlearning beyond model parameters requires tracking target-bearing state and influence paths across retrieval, serving, memory, tools, and agents. The review distinguishes demonstrated component-level outcomes from broader system claims that require coordinated checks and persistence tests.

5.1 Augmented LLMs: Retrieval, Context, and Serving State

  • Augmented LLM removal must track source, derivative, and runtime state through dependencies; editing individual components alone does not establish removal across required retrieval paths.The corpus-to-chunks-to-embeddings-to-index-to-cache chain is a dependency template, not a fixed architecture; in-scope state may require deletion, invalidation, recomputation, or re-indexing.Source: §5.1 · p. 13
  • Deleting external state does not itself remove parametric knowledge, so retrieval-conditioned, adaptation-state, and architecture-specific results do not establish unrestricted parametric erasure.The review also distinguishes training recall from authorized contextual use.Source: §5.1 · pp. 13–14
  • A system-level removal claim requires checks across required derivatives and serving paths, including source absence, retrieval, generation, warm caches, replicas, re-indexing, and parametric reconstruction.RAG accuracy or local suppression alone does not establish this end-to-end composition.Source: §5.1 · p. 14

5.2 LLM Agents and Multi-Agent Systems

  • Agent targets can persist in memories, plans, tool effects, and trajectories, while shared messages or replicas can restore targets after local removal.Tool capability removal does not erase earlier files, messages, or service records; independently owned components may allow only notification or limited checks.Source: §5.2 · pp. 15–16
  • On ToolAlpaca, deleting 20% of tools with DPO reduced forget-tool performance from 75.7 to 28.7; raw-only memory deletion left worst-tier residue of 0.20 on Gemma and 0.22 on GPT-4o-mini.Re-summarization reduced those residue values to 0.11 and 0.10, while full purge and tombstone redaction yielded zero in the tested settings. The SBU interaction test reports zero target retrieval hits after deletion, but retained memories remained accessible.Source: §5.2 · pp. 15–16
  • Path-coverage ratios depend on the declared inventory and weighting rule; they report coverage, not success probabilities or compositional guarantees.Uncontrolled required paths remain limitations even when every inspected component passes.Source: §5.2 · p. 17
  • Broader agentic removal claims require dependency tracing through retrieval, tools, and shared state, followed by tests of propagation and restoration over time.The reviewed studies do not jointly test plans, tool outputs, shared memory, and independent agents.Source: §5.2 · pp. 16–17

6 Evaluation, Verification, and Guarantees

The section explains how to evaluate removal by combining suitable references, component inspections, end-to-end tests, recovery experiments, and later retests. Reports should distinguish passed, failed, and untested requirements within a declared boundary.

6 Evaluation, Verification, and Guarantees

  • Evaluation connects request-specific targets and preservation criteria to references, local inspections, and end-to-end tests across components.Component inspections establish state changes; behavioral tests assess target disclosure and retained tasks across components.Source: §6 · p. 17
  • Recovery audits span adversarial prompts, relearning, quantization, reasoning, repeated sampling, and privacy attacks, with controls to distinguish recovery from attack-induced outputs.Reports should include attack access, sampling budgets, and the reference used to identify residual target knowledge.Source: §6 · p. 18
  • Persistence testing retests removal after fine-tuning, merging, further requests, index rebuilding, cache warming, trajectory replay, or replica reconnection.Each transformed branch needs an equally transformed reference, and preserved utility requires testing on that branch.Source: §6 · p. 18
  • Reports specify the request, boundary, versions, access, intervention, references, thresholds, budgets, observation times, uncertainty, and audit costs.Test records distinguish violated criteria from untested paths or partial coverage; unreported tests remain unknown.Source: §6 · p. 18
  • Path coverage, retained performance, uncertainty, and costs clarify which requirements were met, failed, or remain untested within the declared boundary.A useful evaluation also uses suitable references, local inspections, controlled recovery experiments, and scheduled retests.Source: §6 · p. 19

7 Application Objectives and Deployment Implications

Application objectives determine which targets may be removed, what must be retained, and what evidence is relevant. The section distinguishes target-removal applications from using forgetting to study or improve learning.

7.1 Applications Aimed at Target Removal

  • Fairness-aware deletion limits disparities during removal, while requests should specify counterfactuals, retained-utility thresholds, and acceptable group-level collateral change.Bias correction and continual-learning evidence cited here is adjacent evidence, not demonstrated benefit across LLM deployments.Source: §7.1 · p. 19
  • Multimodal forgetting studies inform evaluation of multimodal components under their studied access conditions and protocols, but do not establish removal in text-based agents.Source: §7.1 · p. 20

7.2 Applications Aimed at Learning and Analysis

  • Functional forgetting probes model behavior, supports learning, or investigates regularization; a removal claim separately requires tests of whether the target remains recoverable.Attributing a benefit requires suitable controls, including matched learning baselines and separate attenuation and utility tests.Source: §7.2 · p. 20

7.1 Applications Aimed at Target Removal

  • Privacy, safety, fairness, and knowledge-update objectives require different targets, retention policies, risk tolerances, and evidence.For privacy and copyright, provenance, authority, aliases, related content, and retained-safety tests matter; temporal policies must distinguish erasure from versioning or authorized retention.Source: §7.1 · p. 19, §7.2 · p. 20

7.2 Applications Aimed at Learning and Analysis

  • Application objectives shape authorized targets, retention policies, acceptable risk, and evidence requirements; functional gains alone establish neither target removal nor compliance.Intervention choice also follows system access and dependencies.Source: §7.2 · p. 20

8 Evidence Synthesis and Comparative Findings

The review compares reported tests across model and extended-system settings, finding uneven evidence and recurring reasons why results differ across studies. Target construction, evaluation resolution, recovery probes, and later state changes constrain what removal claims the evidence supports.

8.2 Comparison of Reported Evidence

  • Efficacy and utility are widely tested in the selected settings, while later observations and path inventories are less developed.Table 10 compares checkpoint and extended-locus evaluations; its entries report test coverage, not performance rankings or an exhaustive field census.Source: §8.2 · p. 21, Table 10 · p. 21

8.1 Review Methodology

  • Review coding distinguishes which question a test asks from whether its result indicates successful removal; direct recovery tests count even when they recover the target.Membership inference alone is a narrower robustness proxy, and the coding procedure is qualitative rather than independently screened or experimentally reproduced.Source: §8.2 · p. 21, §8.1 · p. 21

8.2 Comparison of Reported Evidence

  • Persistence tests are limited proxies: transformation or aggregate sequential-batch tests do not establish removal over a deployment horizon or track earlier targets separately.MUSE tracks retained utility rather than earlier target removal, and SBU’s Store–Query–Delete–Probe sequence does not retest after a later state-changing operation [171].Source: §8.2 · pp. 21–22
  • Broad retained-task scores may miss local damage near a target, while component-level consistency or utility tests do not establish removal after later updates and interactions.The review identifies no qualifying inventory and coverage audit for checkpoint evaluations, including ToolDelete; ERASE’s knowledge-base consistency tests [93] and utility evaluations after memory deletion [202] address complementary evidence.Source: §8.2 · p. 22

8.3 Patterns Across Studies

  • Differences in target construction—including salience, training origin, and granularity—can change measured removal and collateral damage even under the same intervention and protocol.Targets include examples, biographies, entities, copyrighted domains, capabilities, reasoning traces, and overlapping knowledge [72] [78] [115] [150] [173].Source: §8.3 · p. 22
  • Selective updates depend on data preparation as well as update rules: NPO varies loss balance, ReGLU changes the update subspace, and PISCES selects SAE features.Constrained objectives and gradient correction manage forget–retain conflict [36] [38] [182], while low-rank, token, and feature selection restrict where updates act [89] [110] [179] [199].Source: §8.3 · p. 22
  • Semantic, capability, and shared-knowledge tests can expose differences hidden by average accuracy, while recovery probes can overturn apparent success or produce false positives.Suitable negative controls and reference comparisons are needed before attributing observed outputs to surviving target influence.Source: §8.3 · p. 22
  • Repeated-request methods and extended-state evaluations remain fragmented: per-update efficiency does not establish affordable cumulative costs or sustained system-wide removal.Augmented studies examine retrieval or adaptation state, while agent studies test tools, parameter–memory updates, and memory residue [23] [91] [120] [171] [177].Source: §8.3 · p. 22

9 Open Challenges and Future Directions

The open challenges concern specifying what must be removed, tracing its influence, coordinating changes, and supporting broader claims with finite tests. Future evaluations should track dependencies and retest removal through updates while accounting for preservation and resource costs.

Defining Targets Without Removing Too Much

  • Ambiguous deployment requests make it difficult to distinguish required removal from permitted related knowledge or collateral change.Adjudicated target and retain sets could specify shared facts, derived summaries, and permitted historical uses; unresolved authority conflicts should remain explicit.Source: §9 · p. 24

Tracing Influence Across Different Forms of State

  • Literal matching can miss paraphrased summaries or learned skills, whereas broad semantic matching can select unrelated material and increase collateral damage.Testbeds with known dependencies could measure missed descendants and unnecessary selections, then use controlled interventions to test behavioral influence.Source: §9 · p. 24

Coordinating Removal Across Components

  • Local component changes do not establish coordinated removal when caches, replicas, or independently controlled components can retain or restore the target.Delayed messages, failed invalidations, and reconnection tests can measure residual influence, time to required checks, and synchronization and retesting costs.Source: §9 · pp. 24–25

Connecting Finite Tests to Broader Claims

  • Finite recovery tests cannot establish universal removal across unknown paths, adaptive attacks, or agent interactions outside a model certificate’s assumptions.Candidate approaches include declared access distributions, component contracts with compatibility conditions, and audits linking inspected state to behavioral tests.Source: §9 · p. 25

Maintaining Removal Under Repeated Updates

  • Later training, index rebuilding, or module consolidation can restore earlier target influence, while avoiding consolidation can accumulate storage and inference costs.Longitudinal benchmarks should retest earlier targets after subsequent requests and maintenance operations, with preservation criteria held fixed.Source: §9 · p. 25

Evaluation Milestones

  • Two milestones are testing removal across known model, memory, and replica dependencies, then repeating those tests during request streams with injected failures.Comparisons require fixed preservation criteria, declared observation horizons, and disclosure of state beyond inspection or control.Source: §9 · p. 25

10 Conclusion

The survey organizes removal requests, interventions, and supporting evidence across model and agentic settings. Its synthesis finds that reported outcomes depend on target construction, retained data, and recovery tests, while joint removal across independent agents and later updates remains unresolved.

10 Conclusion

  • A five-layer framework, seven-stage lifecycle, and six evidence dimensions connect removal requirements to evaluated outcomes and the claims those evaluations support.The conclusion calls for tracing affected state, testing propagation and restoration, and reporting retained performance alongside unresolved paths and observation horizons.Source: §10 · p. 25
Loading 2609.30909v1…