Making LLMs Truly Forget: Deep Unlearning by Searching, Selecting, and Severing Knowledge Paths

1 INTRODUCTION

• Existing factual unlearning often targets isolated facts, although related knowledge can still support their reconstruction.The paper calls the stronger objective deep unlearning: accounting for supporting knowledge that keeps targets inferable.Source: §1 · p. 1
• DUMIC is a general framework compatible with existing unlearning algorithms that maps explicit dependencies and latent associations to find supporting knowledge.It searches using model responses and latent entities decoded from intermediate representations, then verifies paths and applies a confidence-weighted graph minimum cut.Source: §1 · pp. 1–2
• A model-specific evaluation pipeline filters facts from a reference graph using calibrated confidence to reflect each model’s retained knowledge.Experiments report that latent entities expand path coverage, target-only unlearning leaves facts inferable, and DUMIC severs paths while mitigating utility collapse.Source: §1 · p. 2

2 RELATED WORK

• Many unlearning methods reduce reliance on a forget set, but benchmarks such as TOFU and MUSE do not assess whether related knowledge can reconstruct the target.The passage contrasts GA’s target-response suppression and risk to retained knowledge with NPO’s stability-oriented objective.Source: §2 · p. 2
• Prior deep-unlearning studies use fixed knowledge bases or externally guided subgraphs, while multi-hop editing propagates forward from causes to effects.Deep unlearning takes the reverse direction, tracing a target backward to identify supporting premises to sever.Source: §2 · pp. 2–3

3 THE FORMULATION OF KNOWLEDGE UNLEARNING

• A confidence-aware knowledge graph represents each fact as a subject, relation, object, and calibrated confidence, while a supporting path is a connected chain of facts that supports a target.The example infers Ron and Ginny’s sibling relation from their shared father facts.Source: §3 · p. 3
• Deep unlearning requires target confidence and every considered supporting path’s minimum fact confidence to be at or below threshold γ.The complete objective considers all verified paths; superficial unlearning sets the considered path set to empty, and a cut intersects every path under consideration.Source: §3 · p. 3

4.1 OVERVIEW OF THE DEEP UNLEARNING FRAMEWORK

• The framework’s three stages are adaptive tree search, supporting-path pruning, and minimum-cut selection.They discover candidate paths, construct a supporting subgraph, and disrupt paths while preserving as much other knowledge as possible.Source: §4.1 · p. 3, Figure 2 · p. 4

4.2 DISCOVERING SUPPORTING PATHS VIA ADAPTIVE TREE SEARCH

• Adaptive tree search explores relational connections from the target subject toward its object within a bounded path length.The search tree keeps distinct nodes for the same entity reached by different paths.Source: §4.2 · p. 3
• Candidate entity discovery combines entities in model responses with latent entities decoded from intermediate representations, then prioritizes candidates by readout probability.This adds candidates absent from explicit responses; a probability threshold first filters noisy or uninterpretable tokens.Source: §4.2 · p. 4
• Relational edge verification checks whether each candidate connects to the current entity, and at the final hop directly checks for a connection to the target object.Completed candidate paths are passed to pruning for validity and redundancy checks.Source: §4.2 · p. 4

4.3 PRUNING SUPPORTING PATHS FOR SUBGRAPH REFINEMENT

• Path pruning assesses whether a candidate’s triples jointly support the target, retains supported paths, and forms their union as a supporting subgraph.The model’s retained facts are filtered using calibrated confidence and a multiple-choice question; a triple passes only with the correct answer and sufficient confidence.Source: §4.3 · pp. 4–5

4.4 INTERRUPTING SUPPORTING PATHS VIA CONFIDENCE-AWARE MINIMUM CUT

• Minimum-cut selection assigns each supporting fact a cutting weight equal to its calibrated model confidence and chooses the lowest-total-weight set intersecting every path.The selected facts are combined with the target fact in the forget set; confidence weighting favors preserving facts the model holds more confidently.Source: §4.4 · p. 5
• Adaptive tree search averages 80.2 seconds per target, with entity-expansion reuse, cached tail checks, and batched queries supporting throughput.At the final hop, directly checking connections to the target avoids candidate generation, latent decoding, and alternative-entity relation checks.Source: §4.4 · p. 5

Evaluation

• The Harry Potter corpus supplies a reference graph whose facts are completed and filtered to approximate each model’s retained knowledge.The corpus is used because models may have encountered the novels or related material, and character relations provide inferential structures for reconstruction.Source: §5 · pp. 5–6
• Entity and relation extraction consolidates aliases, uses a second model to review omissions, and completes implicit, inverse, or neighboring relations with supporting facts recorded.Overlapping relation descriptions are consolidated by retaining the more specific relation supported by evidence.Source: §5 · pp. 5–6, Figure 3 · p. 6
• Figure 3 depicts the graph pipeline: extracting entities and relations, merging aliases, completing relations, then retaining facts recognized by the target LLM.The retained facts are selected according to calibrated model confidence.Source: Figure 3 · p. 6
• A fact passes the knowledge filter only when the model selects the correct multiple-choice answer and meets the calibrated-confidence criterion.The same probing procedure is used for target triples and candidate supporting facts, during reference construction and evaluation after unlearning.Source: §5 · p. 6
• Candidate paths exclude the target fact, are judged for whether their supplied facts jointly support it, and survive only if every constituent fact passes the knowledge filter.The judge is restricted to the supplied facts.Source: §5 · p. 6

6.1 EXPERIMENTAL SETTINGS

• The experiments compare five unlearning algorithms on two models, using 100 recognized triples per model and target-only, full-subgraph, and minimum-cut forget sets.UES evaluates supporting-path forgetting; utility measures include local agreement, general knowledge on MMLU, and reasoning on BBH.Source: §6.1 · pp. 6–7

6.2 MAIN RESULTS

• On Gemma-4-31B-Base, DeepUnlearn raises NPOGDR UES from 0.387 to 0.999, while minimum-cut DUMIC reaches 0.583 and restores Loc from 0.196 to 0.844.Removing entire supporting subgraphs can severely damage utility: GA and NPO reduce both Loc and Rea to zero on Gemma-4-31B-Base.Source: Table 1 · p. 7, §6.2 · pp. 7–8

6.3 RELIABILITY OF MODEL CONFIDENCE ESTIMATES

• Temperature scaling reduces Qwen3.5-27B expected calibration error from 0.144 to 0.062, while Gemma4-31B-Base changes from 0.077 to 0.075.The calibrated probabilities are subsequently used to compute entropy for knowledge filtering and supporting-subgraph evaluation.Source: Figure 5 · p. 8, §6.3 · p. 8

6.2 MAIN RESULTS

• Against the response-only baseline, J-Lens increases retained paths from 828 to 1,376 (+66.2%) on Gemma and from 2,218 to 2,618 (+18.0%) on Qwen.Target coverage rises from 76% to 93% on Gemma and from 91% to 96% on Qwen.Source: §6.2 · p. 8
• J-Lens retains 1,376 Gemma and 2,618 Qwen paths, covering 93% and 96% of targets; reference-KG search retains 2,794 and 3,197 paths with full coverage.J-Lens discovers these paths without using the reference knowledge graph to guide its search.Source: Figure 4 · p. 8, §6.2 · p. 8

6.4 ABLATION STUDIES

• Under LoRA, DUMIC improves UES across all five methods; GA rises from 0.109 to 0.789 and GAGDR from −0.643 to 0.548.GAGDR’s gains accompany modest changes in Loc, Gen, and Rea, whereas GA incurs larger local-utility and reasoning losses.Source: Table 2 · p. 9, §6.4 · p. 9
• Under DUMIC on Qwen3.5-27B, UES gains mainly in the first two to three epochs and then stabilizes, while local utility generally declines with further training.SimNPO rises from approximately 0.68 to 0.88 between epochs one and two; GA’s Loc falls from approximately 0.92 to 0.74 across the analyzed epochs.Source: Figure 6 · p. 9, §6.4 · p. 9
• Average UES falls from 0.9913 for 50 targets to 0.9152 for 100 and 0.7294 for 200; the decline appears across all five methods.The authors suggest lower supporting-path coverage for additional targets may leave more recovery paths beyond minimum-cut selection.Source: §6.4 · p. 9

• Experiments on two LLMs show improved path coverage and a better balance between unlearning effectiveness and utility preservation.Source: §7 · p. 9
• The framework discovers model-specific supporting paths through adaptive tree search and latent entity extraction from intermediate representations.Source: §7 · p. 9
• A confidence-aware minimum cut selects facts for unlearning while limiting collateral knowledge loss.Source: §7 · p. 9

A.1 COMPUTE CONFIGURATION

• Experiments used NVIDIA A100 80GB PCIe GPUs for both training and inference.Source: §A.1 · p. 15

A.2 SEARCH CONFIGURATION

• Search compared response-only entities with J-Lens search, which additionally incorporates latent entities decoded from intermediate representations.Inference batch sizes were 512 for Qwen3.5-27B and 256 for Gemma4-31B-Base.Source: §A.2 · p. 15

A.3 J-LENS CONFIGURATION

• J-Lens extracted candidates from the last of three inspected layers, retaining up to three new latent entities per field with readout probabilities of at least 10^-4.Each expansion admitted at most 50 candidates, with explicitly generated entities prioritized over latent candidates.Source: §A.3 · p. 15

A.4 TRAINING CONFIGURATION

• All unlearning experiments used four GPUs with DeepSpeed ZeRO Stage 3 and a per-GPU batch size of 4.Selected training epochs for model, method, and unlearning-setting combinations are reported in Table 3.Source: §A.4 · p. 15, Table 3 · p. 15

A.5 DETAILED DEFINITIONS OF EVALUATION METRICS

• UES measures supporting-path confidence reduction, scoring a path as interrupted if any constituent fact has zero confidence or an incorrect answer, including Unknown.Otherwise, the path score is the normalized reduction in confidence; UES averages scores over paths and then targets, and a higher score indicates more effective interruption or weakening.Source: §A.5 · pp. 15–16
• Loc evaluates preservation of neighboring facts by sampling 30 facts from each target’s three-hop neighborhoods and excluding the target and its supporting subgraph.A higher Loc indicates better preservation of local factual knowledge around the unlearning targets.Source: §A.5 · p. 16
• General knowledge is measured on MMLU with 5-shot perplexity-based answer ranking, while reasoning is measured on 27 BBH tasks using 3-shot chain-of-thought prompting and exact-match accuracy.Higher Gen and Rea indicate better preservation of general knowledge and reasoning capabilities, respectively.Source: §A.5 · p. 16

B DATASET CONSTRUCTION DETAILS

• The evaluation selected 100 target triples with the most verified supporting paths, and each target’s discovered-path facts formed a model-specific searched subgraph for forget-set construction and deep unlearning.A fixed, method-independent reference subgraph was used to measure fact-level and path-level unlearning effectiveness.Source: B DATASET CONSTRUCTION DETAILS · p. 16
• Evaluation questions were generated from reference-subgraph and local-utility facts; local utility used 30 facts from three-hop neighborhoods, excluding targets and supporting facts.Each question had one gold answer and three plausible distractors, and predictions on fixed questions were compared before and after unlearning.Source: B DATASET CONSTRUCTION DETAILS · p. 16
• Each target model had separate calibration sets: 200 positive and 200 negative examples for temperature fitting, plus 100 positive and 100 negative held-out examples.Calibration examples were separate from unlearning targets and effectiveness and utility evaluation questions.Source: B DATASET CONSTRUCTION DETAILS · p. 17

C KNOWLEDGE GRAPH STATISTICS

• The consolidated Harry Potter reference graph contains 1,862 entities and 4,122 relation triples.The complete English texts of all seven original books were used; Book 5 yielded the largest per-book counts in both entities and triples, and Figure 7 summarizes counts by book.Source: C KNOWLEDGE GRAPH STATISTICS · p. 17, Figure 7 · p. 17

D EFFICIENCY OF SUPPORTING PATH DISCOVERY

• Search averages 80.2 seconds per target on Qwen3.5-27B and 157.9 seconds on Gemma4-31B-Base, with 54.9/20.3 and 46.9/15.9 candidate/accepted paths per target, respectively.At the evaluated scale, average search time remains below three minutes per target on both models.Source: D EFFICIENCY OF SUPPORTING PATH… · p. 17, Table 5 · p. 18

E MAPPING BETWEEN ENTROPY THRESHOLD AND CORRECT-ANSWER PROBABILITY

• A prediction counts as retained knowledge when the correct option is highest-probability and five-option entropy is below u*; for u* ≤ 1 bit, the lower boundary assigns the remaining probability to one alternative.The upper boundary instead divides the remaining probability equally among the other four options; under the strict filtering condition, correct-answer probability exceeds the lower bound and may reach 1.Source: E MAPPING BETWEEN ENTROPY THRESHOLD… · p. 18, Table 6 · p. 18

F.1 CONTROLLING FOR FORGET-SET SIZE

• With 236 forget examples, DUMIC raises UES by 0.033–0.167 across five methods while Loc falls in each; NPOGDR UES rises from 0.716 to 0.883 as Loc falls from 0.924 to 0.891.The comparison uses five training epochs and finds that forget-set size alone does not explain the UES gains.Source: §F.1 · p. 18, Table 7 · p. 19