Not Every Change Is Necessary: Recoverable Drift in Large Language Model Unlearning

1 INTRODUCTION

• Unlearning aims to selectively remove target knowledge while preserving original capabilities, while output-level and internal-edit methods offer different controls over model changes.The introduction notes that output-level objectives offer limited control over parameter changes, while local internal changes can still propagate nonlinearly.Source: §1 · p. 1
• Some reversible changes after target forgetting are defined as recoverable drift, distinguishing them from changes necessary to maintain forgetting.The paper frames these changes as optimization-induced drift when recovery does not restore forgotten knowledge.Source: §1 · pp. 1–2
• PTP-U first proposes local analytic edits under linearized forgetting constraints, then aligns non-target outputs with the Base model under fixed forgetting constraints.The framework separates forgetting-oriented proposal generation from behavioral recovery.Source: §1 · p. 2
• Across three benchmarks, PTP-U achieves 81.22%–91.03% forgetting and the highest average capability retention of 94.20%.At matched forgetting, it retains 93.32%–95.86% utility and remains closer to the Base model.Source: §1 · p. 2
• Sequential relinearization updates downstream geometry and constraints after upstream edits to account for dependencies within Transformer blocks.The local analytic editing mechanism constructs proposals under linearized forgetting constraints.Source: §1 · p. 2

2.1 FORGETTING CONSTRAINTS AND BEHAVIORAL DRIFT

• Relation support is measured using target queries, matched contrastive queries without the target relation, and answers for each target knowledge unit.The score averages over query views and answer aliases.Source: §2.1 · p. 2
• Lower relation-support scores indicate weaker target support; fixed thresholds define a forgetting-feasible set containing models that satisfy all target-unit constraints.The constraints are expressed as score residuals relative to the thresholds.Source: §2.1 · p. 2
• Figure 2 compares original checkpoints with independently repaired copies over fine-tuning steps; repairs do not feed into later original checkpoints.The paired recovery comparisons address whether changes remain necessary after forgetting is achieved.Source: Figure 2 · p. 3, §2.2 · p. 3
• Base-policy drift is measured on a fixed non-target context distribution, with smaller DB indicating closer next-token distributions on those contexts.The passage identifies DKL as the Kullback–Leibler divergence.Source: §2.1 · p. 3

2.2 RECOVERABLE DRIFT AND CONSTRAINED UNLEARNING FORMULATION

• Internal displacement tracks change within a fixed retain-sensitive subspace, normalized by Base representation energy; contexts, layer, and projector stay fixed across comparisons.The metric uses the squared L2 norm with a fixed numerical stabilizer.Source: §2.2 · p. 3
• Recovery generally reduces internal displacement while leaving forgetting quality largely unchanged, supporting the premise that some unlearning changes can be reduced without undoing forgetting.The paper argues that model selection should consider both forgetting feasibility and behavioral deviation from the Base model.Source: §2.2 · p. 3
• The constrained objective uses output-space Base-policy deviation to motivate recovery while keeping forgetting thresholds fixed throughout optimization.The pipeline first applies local analytic edits, then performs constrained recovery; global optimality is not assumed.Source: §2.2 · p. 3

3 PROPOSE-THEN-PROJECT UNLEARNING (PTP-U)

• PTP-U approximately solves Eq. 5 in two stages: a feasible local forgetting proposal followed by nonlinear policy projection under fixed forgetting constraints.Attention→FFN sequential re-linearization improves local-update accuracy in Transformers.Source: §3 · p. 3

3.1 LOCAL ANALYTIC PROPOSAL WITH CURVATURE GUIDANCE

• The editable proposal uses a low-dimensional basis and K-FAC Fisher curvature on fixed anchors to model local changes and generate candidate updates.The local objective uses a damped curvature approximation, and the Base gradient is retained at later iterates.Source: §3.1 · p. 4
• For a fixed active set with full-row-rank constraints, Eq. 9 combines unconstrained recovery with the minimum H_k-metric correction, but solves only the local problem.The truncated residual caps required reduction for unsatisfied constraints; satisfied constraints retain their negative boundary margin.Source: §3.1 · p. 4

3.2 SEQUENTIAL RELINEARIZATION IN TRANSFORMERS

• The Transformer proposal models how Attention changes propagate through the FFN input, then updates Attention before refreshing the operating point for FFN.After the Attention update, PTP-U refreshes residuals and Base recovery gradients, recomputes FFN curvature and its editing basis, and solves for the FFN update.Source: §3.2 · p. 5

3.3 NONLINEAR POLICY PROJECTION

• The projection stage starts from a feasible proposal and builds a progressive recovery target by mixing current and Base policies on fixed anchors.It minimizes the recovery objective within the forgetting-feasible region, combining Base recovery with a penalty on policy changes.Source: §3.3 · p. 5
• Projection candidates are verified against the forgetting constraints; failed updates are reverted, and the accepted feasible model is returned if budget or tolerance stops recovery.The editing basis, curvature statistics, and recovery objective are training-only and add no inference modules.Source: §3.3 · p. 5

4.1 EXPERIMENTAL SETTINGS

• The evaluation covers RWKU entity forgetting, WMDP biosecurity and cybersecurity knowledge, and MUSE-Books copyright unlearning, with MMLU and GPT-4o fluency assessing retained utility.RWKU metrics include fill-in-the-blank, question-answering, and adversarial-attack probes; WMDP uses accuracy, with 25% random-choice indicating best forgetting.Source: §4.1 · p. 6
• Baselines include NPO KL, RMU, WHP, ALTER, ASU, ICUL, adapted SCANS, and MET; implementation uses rmax = 0.25, λ = 1.0×10^-3, and αt = 0.5.Editing uses the model’s middle layers (23), and the forgetting boundary is bu = Su(θ0) − ∆f with ∆f = log 2.Source: §4.1 · p. 6

4.2 MAIN RESULTS

• PTP-U maintains a favorable forgetting-retention trade-off, preserving 65.54 Gen. on RWKU and 63.80 on WMDP with Llama3.1-8B-Instruct.For Llama2-7B copyright continuation, it achieves the lowest BLEU and R-L while preserving the highest MMLU.Source: §4.2 · p. 6, Table 1 · p. 6, Table 2 · p. 7
• At the selected layer-23 window, λ = 10^-3, and rmax = 0.25, results are 28.99% WMDP and 63.80% MMLU accuracy.The layer-23 setting is a three-layer editing window; the favorable trade-off near layer 23 suggests a more selective intervention point.Source: §4.2 · pp. 6–7, Figure 4 · p. 7
• Omitting Stage II lowers MMLU by 5.88 points with little WMDP change, while removing its forgetting constraint raises WMDP accuracy from 28.99 to 44.62.Omitting Stage I worsens both metrics; setting αt = 1 reduces retention despite preserving forgetting constraints. Refreshing the FFN local model improves both metrics relative to fixed sequential updates.Source: §4.2 · p. 7

Why Forgetting Constraints Matter for Recovery

• After 32 steps, PTP-U retains 70.23% forgetting quality versus 48.42% for PTP-U’ without the forgetting constraint under the same KL regularization.Figure 5 compares the variants in a post-unlearning benign relearning attack.Source: Figure 5 · p. 8, §5 · p. 8

Preservation of Neighborhood Knowledge

• Compared with RMU, PTP-U reduces target-content reproduction while improving both NEK and GEK by 15.0 percentage points.TOFU is partitioned into target data (TUD), neighborhood knowledge (NEK), and general external knowledge (GEK).Source: §5 · p. 8, Table 5 · p. 9

Cost analysis

• PTP-U requires 31.8 minutes for model editing and 3.7 minutes for nonlinear fine-tuning, but its merged updates avoid auxiliary inference modules.The reported 42.7 GB memory reflects additional statistics and intermediate tensors; serving latency is comparable to other weight-updating methods, without recurring prompt expansion.Source: §5 · pp. 8–9, Table 6 · p. 9

LLM unlearning

• Output-based methods modify target likelihoods or preferences, internal methods localize changes to features or parameter subsets, and prompting suppresses target behavior through test-time context.The cited examples include output methods (Fan et al., 2025; Xu et al., 2025a; Li et al., 2026a), internal methods (Shi et al., 2025b; Li et al., 2026c), and prompting (Pawelczyk et al., 2024; Takashiro et al., 2025; Wang et al., 2026).Source: §6 · p. 9

Post-training preservation and locality

• Prior work associates smaller shifts from the Base model with better capability preservation, while showing that parameter locality alone need not ensure isolated unlearning.The cited studies include Shenfeld et al. (2026) on policy shifts, Harmon et al. (2026) on heterogeneous forgetting, and Lee et al. (2025) on parameter locality.Source: §6 · p. 9

• Different optimization paths can achieve similar forgetting while inducing different degrees of non-target drift, motivating scrutiny of which changes are necessary.Source: §6 · p. 9

• Across four benchmarks, experiments support the premise that some unlearning-induced changes can be reversed without substantially weakening observed forgetting.Source: §7 · p. 9
• PTP-U uses local geometry to propose edits and policy-space proximity to guide recovery under a common constrained objective.Sequential Attention-to-FFN relinearization updates downstream approximations, while Base-referenced distillation reduces collateral behavioral drift.Source: §7 · p. 9
• Local curvature approximations and constraints over sampled knowledge units do not guarantee globally minimal behavioral drift or eliminate unobserved knowledge-retrieval routes.The conclusion identifies tighter nonlinear approximations and semantic constraints beyond observed queries as future directions.Source: §7 · p. 9