Source-linked AI summary
Nullify: Null-Space Activation Steering for Training-Free LLM Unlearning
Wei Zhai, Xiang Liu, Qiang Huang, Rui Qian, Lemao Liu, Ziwei Li, Ziqi Wang, Zhitao Huang, Dejing Dou
TL;DR
LLM unlearning seeks to remove specific memorized information, but weight-based approaches can trade forgetting against retained utility. Nullify uses closed-form, null-space-constrained activation steering without changing model weights. On TOFU and MUSE, it matches or surpasses baselines in forget quality while keeping utility near-lossless at a small fraction of their compute.
Problem
Weight-based unlearning can perturb retained representations, while existing approaches struggle to combine strong forgetting, utility preservation, and low computational cost.
Source: §1 · p. 1, §2.1 · p. 2Method
Nullify uses a closed-form activation-steering operator that redirects forget queries while constraining corrections to the null space of retained-query activations, without modifying model weights.
Source: §1 · p. 2Results
Takeaways & Limitations
Nullify offers a plug-and-play inference-time intervention that shifts unlearning from parameter reshaping to geometrically constrained activation steering.
Source: §5 · p. 9Adaptive attacks and whitebox settings remain outside the evaluation scope, and intervention layers and steering strength are selected per benchmark.
Source: Limitations · p. 9
Abstract
from arXiv · showhide
Large Language Models (LLMs) inevitably internalize substantial amounts of sensitive or private information during pre-training, while LLM unlearning aims to selectively erase specific knowledge to prevent privacy leakage with minimal loss of model utility. However, existing methods struggle to balance forget quality with utility, and typically incur substantial computational costs due to parameter fine-tuning. To address this, we propose Nullify, a training-free, non-destructive activation steering method for LLM unlearning. Nullify employs steering vectors during inference to redirect privacy-related activations away from their memorized answers, while satisfying a null-space constraint that leaves retained-query activations essentially unaffected to maintain utility. Evaluations on TOFU and MUSE show that Nullify matches or surpasses established baselines in forget quality while achieving near-lossless preservation of model utility. By avoiding weight updates entirely, Nullify serves as an efficient, plug-and-play inference-time intervention framework.
1 Introduction
LLM unlearning addresses memorized sensitive information, but weight-based interventions can damage retained capabilities. Nullify instead steers activations under a null-space constraint and reports strong forgetting with near-lossless utility and lower compute.
1 Introduction
- Pre-training on massive web corpora can implicitly memorize sensitive, copyrighted, or harmful information, while legal and regulatory frameworks recognize erasure and increase compliance pressure.Retraining a foundation model from scratch for every erasure request is described as economically infeasible.Source: §1 · p. 1
- Gradient-based and preference-optimization methods reshape shared model weights, which can perturb retained representations and degrade capability, increase over-refusal, or cause hallucination.Representation-level approaches may still update base weights or train auxiliary parameters, and their retention behavior is enforced by a soft loss rather than guaranteed by construction.Source: §1 · p. 1
- On TOFU and MUSE, Nullify leads baselines in forget quality while keeping utility near-lossless at a small fraction of their compute; on TOFU forget10, it dominates the Pareto view.The figure identifies the highest forget quality and model utility alongside the lowest measured wall-clock cost for Nullify.Source: Figure 1 · p. 2, §1 · p. 2
- Nullify keeps the base LLM frozen and uses a closed-form, per-layer operator to steer forget queries away from memorized-answer trajectories while constraining corrections to the null space of retained-query activations.The operator is solved from one forward pass without trainable parameters or backpropagation; steering strength is a runtime scalar.Source: §1 · p. 2
2 Related Work
Prior unlearning work largely modifies model weights, while representation-level and inference-time approaches reduce but do not resolve the tension between forgetting and retention.
2.1 LLM Unlearning
- Approximate unlearning commonly modifies model weights through gradient-based, preference-optimization, or task-vector methods, while exact retraining on the retain set is computationally impractical at LLM scale.Benchmarks include fictitious QA (TOFU), copyrighted corpora (MUSE), and hazardous knowledge (WMDP).Source: §2.1 · pp. 2–3
2.2 Representation-Level and Inference-Time Unlearning
- Representation-level methods redirect forget-query activations or map them toward refusal-style references, while decoding-stage methods such as GUARD filter forbidden tokens during generation.These approaches improve stability over full fine-tuning, but may still fine-tune base weights or train auxiliary parameters and use soft-loss retention rather than a construction-time guarantee.Source: §2.2 · p. 3
3 Methodology
Nullify keeps the LLM frozen and uses a closed-form, per-layer operator to steer forget-query activations while preserving keep-query activations. It derives the forget direction from answer-versus-abstention activations and constructs the operator’s factors from the keep and forget sets.
3 Methodology
- Nullify freezes the LLM and applies per-prompt, per-layer hidden-state corrections from a closed-form operator, using one forward pass and no backpropagation.The operator is computed from the forget and keep prompts without adding trainable parameters.Source: §3 · p. 3
3.1 Intervention Form and Design Contract
- At prompt encoding, a last-token anchor supplies a broadcast correction; α sets its strength, while the operator preserves keep queries and displaces forget queries by r^(ℓ).The correction is determined from the anchor and reused across prompt positions.Source: §3.1 · pp. 3–4
3.2 The Forget Direction: IDK-Contrastive Activations
- For each forget pair, Nullify contrasts hidden states conditioned on the memorized answer and an abstention, then uses their average displacement as the forget direction.The direction points from abstention toward commitment; with α < 0, it steers away from the memorized-answer mode.Source: §3.2 · p. 4
3.3 Solving the Two Factors in Closed Form
- For keep anchors, Nullify projects onto the left null space, approximated using the floor(pD) smallest eigenvectors of the D×D keep Gram matrix.The null-space ratio p is a structural hyperparameter.Source: §3.3 · p. 4
- A ridge-regularized least-squares left factor maps projected forget anchors onto r^(ℓ), completing the operator constraints in closed form.The derivation uses the Moore–Penrose pseudoinverse and accounts for rank deficiency.Source: §3.3 · pp. 4–5
3.4 Algorithm and Complexity
- Offline cost per layer is O((N_k+N_f)D^2+D^3); inference adds one D×D matrix–vector product per steered layer, without a per-token hook.The steered hidden states populate the cached keys and values for generation.Source: §3.4 · p. 5
4 Experiments
Experiments evaluate Nullify on TOFU and MUSE-News against retraining references and multiple unlearning baselines, measuring forget quality, retained utility, extraction leakage, and deployment cost. Across both benchmarks, Nullify delivers a strong forget–utility balance; further tests examine robustness, efficiency, component roles, and sensitivity.
4.2 Main Results
- Across TOFU and MUSE-News, Nullify delivers the strongest forget–utility balance, suppressing target knowledge while leaving general capability essentially intact and avoiding utility collapse seen in gradient- and preference-based baselines.Table 2 reports TOFU results on forget05/forget10 using Llama-2-7B-chat-hf.Source: §4.2 · p. 6, Table 2 · p. 7, Table 3 · p. 7
4.2.1 Results on TOFU
- On TOFU, Nullify matches Retrain’s MU of 0.62 on forget05 and forget10; its FQ is 0.96 on forget05 and 0.58 on forget10.On forget05, SimNPO reaches FQ 0.99 with MU 0.58; on forget10, Nullify raises FQ from SimNPO’s 0.45 to 0.58.Source: §4.2.1 · p. 6, Table 2 · p. 7
4.2.2 Results on MUSE-News
- On MUSE-News, Nullify’s PrivLeak is −5.18, while KM-Df falls from the Original’s 0.63 to 0.27, near Retrain’s 0.33, and KM-Dr remains 0.51.The reported baselines include heavy leakage, overcorrection, and little movement from the Original model.Source: §4.2.2 · p. 6, Table 3 · p. 7
4.3 Robustness Experiments
- Across six extraction-attack families, Nullify reduces exact-span leakage from 0.391 for Original to 0.095, matching Retrain at reported precision; paraphrase leakage is 0.218 versus Original’s 0.478.The six-family score is an unweighted macro-average; the paraphrase result indicates partial transfer to nearby free-form formats.Source: §4.3 · pp. 7–8, Table 4 · p. 7, Table 5 · p. 8
4.4 Compute and Memory Efficiency
- Nullify uses 14 GB and takes 5.2 minutes per configuration, versus ∼79 GB and 13–58 minutes for full-finetune baselines, and is Pareto-optimal in forget-quality/wall-clock.The reported cost is for TOFU forget05 on a single NVIDIA H800; Nullify’s 5.2 minutes include preparation and one α evaluation.Source: §4.4 · p. 8, Table 6 · p. 8
4.5.1 Ablation Study
- Removing the null-space projection leaves MU at 0.36 even at its best α of −0.3, while replacing the IDK-contrastive direction with a random vector reduces FQ from 0.96 to 0.466.The first ablation’s MU falls to 0.01 by α = −1.0; the ablations associate utility preservation with projection and the forget signal with the contrastive direction.Source: §4.5.1 · p. 8, Table 7 · p. 9
4.5.2 Hyperparameter Sensitivity
- With λ = 10, forget quality exceeds 0.92 throughout α ∈ [−2.3, −1.9], while MU remains within 0.61–0.63 across tested p values.The reported operating point is λ = 10 and α = −2.0; the authors attribute utility preservation to the null-space construction rather than tuning.Source: §4.5.2 · pp. 8–9
4.5.3 Forget-Quality Visualization
- On forget05 and forget10, Nullify shifts the truth-ratio distributions toward the Retrain reference, yielding FQ scores of 0.96 and 0.58, respectively.The Original model has a sharp memorization peak near 0.56–0.58; Nullify’s distributions center at 0.86 and 0.87, near Retrain’s 0.90 and 0.91.Source: §4.5.3 · p. 9, Figure 2 · p. 9
5 Conclusion
Nullify uses training-free, null-space-constrained activation steering to unlearn without modifying model parameters. On TOFU and MUSE, it matches or surpasses baselines in forget quality while keeping utility near-lossless at lower compute and memory cost.
5 Conclusion
- On TOFU and MUSE, Nullify matches or surpasses baselines in forget quality while keeping utility near-lossless at a small fraction of their compute and memory.It steers forget queries away from memorized answers while confining corrections to the null space of retained-knowledge activations.Source: §5 · p. 9
- Nullify shifts LLM unlearning from destructive parameter reshaping to lightweight, geometrically constrained activation steering.The framework leaves model parameters unchanged and is presented as a plug-and-play inference-time intervention.Source: §5 · p. 9
- Future work will extend Nullify to multimodal architectures and long-context unlearning.Source: §5 · p. 9
Limitations
Nullify suppresses access to memorized answers only while its inference-time operator is active, rather than permanently altering model weights. The reported robustness scope excludes adaptive attacks and inspectable, modifiable, or disableable operators; intervention layers and steering strength are selected per benchmark.
Limitations
- Nullify suppresses access to memorized answers only while its inference-time operator is active, rather than permanently altering model weights.Source: Limitations · p. 9
- Robustness evaluation covers fixed-template black-box extraction and nearby free-form reformulations, but not adaptive attacks or white-box settings where the operator can be inspected, modified, or disabled.Source: Limitations · p. 9
- Intervention layers and steering strength are selected per benchmark; automatic configuration across architectures and deployment settings remains future work.Source: Limitations · p. 9
Ethics Considerations
Nullify is intended for privacy-, copyright-, and safety-driven removal, but its steering mechanism could also suppress information that should remain public. The appendix provides a proof of Lemma 1 and a derivation of Eq. (10), including treatment of rank deficiency.
Ethics Considerations
- Nullify’s steering could hide public information, so the authors restrict evaluation to peer-reviewed TOFU and MUSE benchmarks and recommend disclosing removal categories for external oversight.The cited misuse examples include public events, public figures, and known model behaviors.Source: Ethics Considerations · p. 10
A Theoretical Details
- The appendix supplies the proof of Lemma 1 and the full derivation of Eq. (10), including treatment of rank deficiency.Source: A Theoretical Details · p. 12
A.1 Proof of Lemma 1
The appendix establishes a null-space equivalence used to reduce a costly SVD to a Gram-matrix eigendecomposition. It then derives the closed-form solution for the rank-deficient constrained ridge problem and describes a reduced-form implementation.
A.1 Proof of Lemma 1
- The equivalence between x⊤H = 0 and the corresponding Gram-matrix null-space condition lets Nullify replace an SVD of the D×Nk matrix Hk with an eigendecomposition of HkH⊤.This yields offline cost O(NkD^2 + D^3) in the relevant regime Nk ≫ D.Source: §A.1 · p. 12
A.2 Derivation of the Closed-Form Solution
- The derivation verifies a reduced full-rank form by writing the projector as V̂V̂⊤ and reducing the objective in the projected subspace.In practice, the implementation uses the k×k inverse for numerical stability; the pseudoinverse selects a minimum-norm representative while the operator is gauge-invariant and unique.Source: §A.2 · p. 12
- The Eq. (9) objective is a strictly convex ridge problem with a unique minimizer, and the rank-deficient system has a consistent minimum-Frobenius-norm solution corresponding to Eq. (10).The derivation notes that λ > 0 makes the reduced k×k inverse genuine.Source: §A.2 · p. 12
B Hyperparameter Sensitivity
The sensitivity analysis varies one scalar at a time around the operating point p=0.75, λ=10, α=−2.0. Across the p sweep, MU remains essentially flat.
B Hyperparameter Sensitivity
- Each scalar sweep varies one value while holding the other two at p=0.75, λ=10, α=−2.0.“Best α” denotes the α that maximizes FQ.Source: B Hyperparameter Sensitivity · p. 12
- The λ sweep fixes p=0.75, while the α curve fixes p=0.75 and λ=10.Source: Table 8 · p. 12, Table 9 · p. 12
- MU stays between 0.61 and 0.63 across the p sweep with λ=10.The passage describes this as the direct signature of the null-space utility guarantee.Source: Table 10 · p. 13
C Cross-Backbone Evaluation
On Qwen3-8B and TOFU forget10, Nullify replicates its construction and layer-selection procedure, with a forgetting–utility tradeoff that differs from the other tested backbone.
C Cross-Backbone Evaluation
- The same null-space construction and IDK-contrastive mean-difference direction transfer to Qwen3-8B, with layers 9–22 selected without test-set FQ scores.The answer–abstention layer-selection heuristic is the same as in the main experiments.Source: C Cross-Backbone Evaluation · p. 13
- Nullify raises Qwen3-8B FQ from < 0.001 to 0.641 and reduces forget-set ROUGE-L from 1.000 to 0.385, within 0.049 of Retrain’s 0.434.Aggregate MU is 0.574 versus Retrain’s 0.596; retain-set ROUGE-L decreases to 0.801.Source: Table 11 · p. 13, C Cross-Backbone Evaluation · p. 13
- The observed forgetting–utility tradeoff differs across the two tested backbones.Source: C Cross-Backbone Evaluation · p. 13
D Case Study
In representative TOFU forget05 examples, Nullify changes memorized answers on target queries to abstentions while leaving retain-query generations unchanged.
D Case Study
- For a forget-set query about Moshe Ben-David, Nullify changes the Original model’s memorized SFT answer to an epistemic non-answer.For a retain-set query about a non-target author, the generation is unchanged.Source: Table 12 · p. 13, D Case Study · p. 13