PaperlayerView exact revision on arXiv

Source-linked AI summary

Not All Change Is Damage: Update-Matched Unlearning for Large Language Models

Jie Li, Youming Tao, Bowei He, Meng Ding

arXiv:2610.21230v1cs.LG

TL;DR

Unlearning must remove selected knowledge while preserving useful capabilities, but models fine-tuned after release can relearn deleted knowledge, and low recovery alone does not establish preserved plasticity. UMU applies the same simulated update to a defended model and an undefended reference, then uses new-task learning trials to select a checkpoint. Across three base unlearning methods, two benchmarks, and two backbones, it reduces recovery under targeted and untargeted retraining while improving new-task learning and preserving forgetting.

  • Problem

    Low relearning alone cannot distinguish selective resistance to recovery from a general loss of the ability to learn after fine-tuning.

    Source: §1 · p. 2

  • Method

    UMU replays the same simulated update on the defended model and its reference, then uses short new-task learning trials to guide checkpoint selection.

    Source: §1 · p. 2, §4.1 · p. 5, §4.2 · p. 6

  • Results

    Across three base methods, two benchmarks, and two backbones, UMU reduces recovery under targeted and untargeted retraining while improving new-task learning and preserving forgetting.

    Source: §6 · p. 9

  • Takeaways & Limitations

    The results support preventing recovery selectively while preserving the model’s ability to learn new tasks.

    Source: §6 · p. 9

    UMU inherits the forgetting quality of its base method, and the study’s rehearsal procedure and evaluated attacks use low-rank adaptation.

    Source: §6 · p. 9

Abstract

from arXiv · show

Unlearning aims to remove selected knowledge from large language models to mitigate privacy and safety risks while preserving useful capabilities. For models that continue to be fine-tuned after release, this goal is insufficient: they must also resist relearning the deleted knowledge while preserving plasticity, the ability to learn new tasks. Existing defenses train against simulated relearning while trying to preserve useful capabilities, but low relearning alone cannot distinguish selective resistance from a general loss of plasticity. Evaluating preservation after an update requires deciding what the updated model should remain close to. A pre-update reference penalizes useful changes induced by the update simply because they depart from earlier outputs. We therefore formulate the reference-timing hypothesis that, at comparable target suppression, an update-matched reference better preserves plasticity than a pre-update one. To test and address this hypothesis, we propose Update-Matched Unlearning (UMU), which applies the same simulated relearning update to the defended model and to an undefended reference initialized from the same unlearned model, and uses new-task learning to guide model selection. Extensive experiments on TOFU and FaithUn with Llama and Qwen models show that UMU improves both relearning resistance and plasticity across all three base unlearning methods, lowering harmful and benign relearning by 30.4 and 9.9 points on average while raising new-task accuracy by 3.5 points. When the reference does not receive the update, relearning remains similarly low but new-task accuracy falls below the base method, supporting the reference-timing hypothesis and showing that robust unlearning should prevent recovery selectively without suppressing learning itself.

1 INTRODUCTION

Unlearning must prevent deleted knowledge from returning after fine-tuning without blocking the model’s ability to learn new tasks. UMU tests whether matching an updated reference can preserve that plasticity while resisting relearning.

1 INTRODUCTION

  • Low relearning alone cannot show selective resistance, because a model that responds weakly to every update may also have lost plasticity.Existing capability checks evaluate the model without the simulated modification, rather than its ability to learn after a later update.Source: §1 · p. 2
  • A pre-update reference penalizes useful changes induced by ordinary learning, whereas an update-matched reference shares those changes and penalizes only additional changes from the defense.This motivates the hypothesis that, at comparable target suppression, an update-matched reference better preserves plasticity.Source: §1 · p. 2
  • UMU combines update-matched replay with new-task learning trials to select a released checkpoint that resists recovery while retaining the ability to learn.It is designed to augment an existing unlearning method.Source: §1 · p. 2
  • Across twelve settings, UMU reduces relearning while improving new-task learning; harmful attack scores fall by 28.8 points on average and new-task accuracy rises by 3.5 points.The average reduction for benign attack scores is 9.9 points.Source: §1 · pp. 2–3

2 RELATED WORK

Prior unlearning work evaluates forgetting and retained behavior, while robust-unlearning defenses anticipate later fine-tuning. UMU connects this work to explicit evaluation of continued learning by matching the student and reference under the same replayed update.

Unlearning Objectives and Evaluation

  • Unlearning evaluations cover immediate forgetting, model utility, memorization, privacy leakage, and recovery through fine-tuning, including recovery triggered by non-target data.The paper studies forgetting under continued fine-tuning together with the capacity to learn new tasks.Source: §2 · p. 3

Training for Robust Unlearning

  • Robust-unlearning defenses simulate fine-tuning trajectories or perturbations, while other approaches regularize harmful adaptation, stabilize forgetting, or strengthen forgetting objectives.Retention strategies include reference losses, gradient filtering, and explicit downstream-task accuracy tests.Source: §2 · p. 3
  • UMU compares the student and reference under the same recorded relearning update and uses short new-task trials to select candidates.These tests distinguish preserving existing performance from preserving the ability to learn new tasks.Source: §2 · p. 3

3 THE REFERENCE-TIMING HYPOTHESIS

A defense should suppress target recovery without treating useful changes from later learning as damage. The reference-timing hypothesis proposes that an update-matched reference better preserves plasticity than a pre-update reference at comparable target suppression.

Problem setup

  • With the update held fixed, the defense minimizes forget loss plus a weighted retention loss on the updated model, whose reference may be pre-update or update-matched.The two retention losses share the student, update, and retained tokens; they differ only in whether the update’s own change is penalized.Source: §3 · pp. 3–4

Reference comparison

  • Figure 2 compares retain KL, gradient alignment, and one-step task-loss change; its caption identifies the dashed pre-update and solid update-matched references.The update-matched gradient value at step 0 is undefined because that gradient is exactly zero.Source: Figure 2 · p. 4

Gradient of the retention loss

  • The pre-update retention gradient adds a pull toward pre-update predictions whenever the update changes retained outputs, while the update-matched loss stays zero during ordinary learning without defense.At the initial defense state, the update-matched gradient is zero and only the extra pre-update term remains.Source: §3 · p. 4

Effect of a retention step on learning

  • Retention weight controls step size, but the gradient’s alignment with the task gradient determines whether a retention step raises task loss.Figure 2 shows negative pre-update alignment and near-zero task-loss change for the update-matched step.Source: §3 · p. 4, Figure 2 · p. 4

Reference-timing hypothesis

  • At comparable target suppression, the hypothesis predicts better plasticity from training against an update-matched rather than a pre-update reference.The proposed explanation is that shared update-induced changes do not contribute to the discrepancy between the defended model and its reference.Source: §3 · p. 5

4 THE PROPOSED METHOD: UPDATE-MATCHED UNLEARNING

UMU pairs update-matched replay, which compares a defended model with a reference receiving the same simulated update, with selection by learning trials. It is instantiated using LoRA adapters, with temporary reference and learner components discarded before release.

4.1 UPDATE-MATCHED REPLAY

  • UMU replays the same recorded relearning update on the defended model and frozen reference, suppressing the target while matching the updated reference on retained data.The update is recorded from an ordinary learner fine-tuned on target answers, and replay averages over several recorded step counts.Source: §4.1 · p. 5, §4 · p. 5
  • The retention comparison uses an updated teacher and student, so ordinary update-induced changes cancel while changes added by the defense are penalized.The forget loss remains active on recovered target answers, and UMU can be added to a finished checkpoint whose forget loss is evaluable after the update.Source: §4.1 · pp. 5–6

4.2 SELECTION BY LEARNING TRIALS

  • Candidates qualify for release only after short new-task learning trials and development checks of progress, forgetting, retention, and existing task performance.Only the selected defense weights are merged into the post-unlearning checkpoint; the reference and learner are discarded.Source: §4.2 · p. 6

4.3 INSTANTIATION AND COMPLEXITY

  • UMU can use full fine-tuning or parameter-efficient training; this paper uses LoRA adapters for the defense and temporary learner.The learner's recorded weight change can be added exactly to the frozen teacher, and differentiation updates only the defense adapter.Source: §4.3 · p. 6

5 EXPERIMENTS

Across TOFU and FaithUn, UMU combines update-matched replay and learning-trial selection with three base unlearning methods. It reduces relearning while restoring new-task learning, and ablations and same-run trajectories show that replay and selection contribute to this balance.

5.1 EXPERIMENTAL SETUP

  • Experiments use TOFU Forget01 and FaithUn with GD, RMU, and KLUE on Llama-3.2-3B-Instruct and Qwen3-4B.The evaluation reports FS, RS, US, harmful and benign attack scores, and AGNews NS after one epoch of new-task fine-tuning.Source: §5.1 · pp. 6–7

5.2 MAIN RESULTS

  • UMU repairs retention while keeping forgetting intact: GD with Llama's TOFU RS rises from 89.36 to 92.91 as FS changes from 19.32 to 18.45.On FaithUn, FS stays at 0.0 while RS rises for settings where base unlearning had lowered it.Source: §5.2 · p. 7
  • UMU lowers benign attack scores by 9.9 points and harmful attack scores at p = 0.1 by 28.8 points on average, while bringing new-task learning close to pre-unlearning performance.GD with UMU reaches 85.16 on TOFU with Llama and 86.72 on FaithUn with Qwen3, within 1.6 and 1.2 points of the pre-unlearning model.Source: §5.2 · pp. 7–8

5.3 ABLATION STUDY

  • Without replay, NS falls 6.3 points on TOFU with Llama and 5.5 on FaithUn with Qwen3 versus full UMU, while removing selection leaves NS 2.0 to 2.7 points lower in every setting.Attack scores alone can favor models with less ability to learn; the ablation attributes selective resistance to replay and its preservation in released models to selection.Source: §5.3 · p. 8, Table 2 · p. 8

5.4 LEARNING AND RECOVERY ALONG THE SAME TRAJECTORY

  • During the same AGNews fine-tuning run, full UMU ends at 85.16 accuracy versus 82.03 for GD, while TOFU FS rises only 0.88 versus GD's increase from 19.32 to 22.18.The figure tracks accuracy and FS at 24 checkpoints; UMU overtakes GD by step 50, pairing faster learning with little target recovery.Source: §5.4 · p. 9, Figure 4 · p. 9

6 CONCLUSION

UMU targets models that continue learning after release, seeking to reduce recovery under retraining while improving new-task learning and preserving forgetting. The conclusion also identifies scope and reuse constraints, while the appendix analyzes how reference timing affects the retention objective.

6 CONCLUSION

  • Across three base unlearning methods, two benchmarks, and two backbones, UMU reduces recovery under targeted and untargeted retraining while improving new-task learning and preserving forgetting.The authors conclude that robust unlearning should prevent deleted knowledge from returning without making the model resistant to learning itself.Source: §6 · p. 9
  • UMU inherits the forgetting quality of its underlying unlearning method, and the study's rehearsal procedure and evaluated attacks use low-rank adaptation.Each base-unlearned checkpoint currently requires its own rehearsal; future work will examine full-parameter and adaptive attacks and update reuse across checkpoints.Source: §6 · p. 9

A PROOFS OF THE REFERENCE TIMING RESULTS

  • The reference-timing analysis holds the student state, recorded update, retain-token weights, and trainable coordinates fixed while varying only the reference state.It derives a gradient identity and a task-loss contrast for directions compared at equal update norm.Source: A PROOFS OF THE REFERENCE TIMING RESULTS · p. 18

A.1 PROOF OF THE REFERENCE GRADIENT IDENTITY

The appendix isolates the reference state’s effect on the retention gradient and analyzes task-loss differences between equal-norm update directions. Its conclusions are conditional on the stated fixed-target construction and smoothness assumptions.

A.1 PROOF OF THE REFERENCE GRADIENT IDENTITY

  • The gradient identity compares pre-update and update-matched references while holding the student state and recorded update shared and changing only the teacher distribution.The derivation uses a finite nonempty retain-token set with fixed nonnegative weights summing to one, and detached teacher targets.Source: §A.1 · p. 18
  • At the common initialization, the update-matched KL and its parameter gradient vanish, whereas the pre-update reference can retain a nonzero gradient under specified distribution and Jacobian conditions.A positive KL alone does not guarantee a nonzero gradient; when the update is zero, the two teacher distributions coincide and the gradient difference is zero.Source: §A.1 · p. 18

A.2 PROOF OF THE TASK LOSS CONTRAST UNDER EQUAL NORM UPDATES

  • For equal-norm directions, the first-order task-loss contrast depends on the task-loss gradient projected onto their direction difference, while the second-order contribution is bounded by curvature.The argument assumes a twice-continuously differentiable task loss on the update segments and a bounded Hessian operator norm.Source: §A.2 · pp. 18–19
  • Equal update norms constrain update size but do not determine task effect; finite-step ordering follows the first-order contrast only under the stated conditions.If the first-order contrast vanishes, curvature can still determine the finite-step difference.Source: §A.2 · p. 19

B TRAINING PROCEDURE

Each UMU defense round rehearses a relearning update on a disposable student copy, then applies the recorded update to teacher and student during defense training. Candidate release is guided by learning trials, and training-only components are discarded.

B TRAINING PROCEDURE

  • Each defense round trains a fresh TaskLoRA on the relearning set using a disposable student copy to rehearse one relearning update.The effective weight changes from the adapted matrices are collected as the recorded update for that round.Source: B TRAINING PROCEDURE · p. 19
  • The same recorded update is applied to teacher and student at each checkpoint, where forget loss and update-matched retention loss are evaluated.Only EraseLoRA is updated; the recorded update and teacher target are treated as constants.Source: B TRAINING PROCEDURE · p. 19
  • After training, UMU selects a candidate using learning trials, merges the selected EraseLoRA, and discards components used only during training.Each defense round costs one rehearsal plus |K| forward passes on both teacher and student.Source: B TRAINING PROCEDURE · p. 19

C BASELINES AND IMPLEMENTATION DETAILS

The implementation evaluates UMU across three base unlearning methods, two instruction-tuned model families, and two benchmarks using shared configuration choices. Candidate selection checks forgetting, retention, utility, and learning progress before release.

C BASELINES AND IMPLEMENTATION DETAILS

  • The released model contains the merged EraseLoRA but no teacher, TaskLoRA, or runtime component, and evaluation attacks are optimized anew against it.The implementation checks that merged-model FS, RS, and US match the adapter-attached model within 0.1 and verifies reduced AGNews training loss after fine-tuning.Source: C BASELINES AND IMPLEMENTATION DETAILS · pp. 20–21
  • UMU is tested on Gradient Difference, Representation Misdirection for Unlearning, and KLUE, with each UMU variant adding its stage to the corresponding base-unlearned checkpoint.These methods represent gradient, representation, and localized-update approaches; the base method's forget loss remains unchanged within UMU.Source: C BASELINES AND IMPLEMENTATION DETAILS · p. 20
  • Experiments use instruction-tuned Llama-3.2-3B-Instruct and Qwen3-4B on both TOFU and FaithUn.The backbones were chosen to permit the full protocol at manageable size and to compare across model families.Source: C BASELINES AND IMPLEMENTATION DETAILS · pp. 20–21
  • Base unlearning stops at benchmark thresholds of ROUGE-L recall 0.1971 on TOFU and accuracy 0.33 on FaithUn, using the smallest learning rate that reaches the threshold.For TOFU, author profiles are injected by five epochs of fine-tuning at learning rate 10^-5.Source: C BASELINES AND IMPLEMENTATION DETAILS · p. 21
  • The UMU stage uses rank-8 LoRA adapters, records TaskLoRA updates at checkpoints 5, 10, and 20, and trains the outer loop for 100 updates.The same configuration is used across base methods, benchmarks, and backbones; candidates are tested with a 10-step AGNews learning trial.Source: C BASELINES AND IMPLEMENTATION DETAILS · p. 21
  • A candidate is eligible only if development forgetting, relearning, and utility stay within specified limits and learning progress reaches at least 90% of the pre-unlearning model.Among candidates passing every check, the procedure selects the one with the lowest development recovery risk, or reports that none is accepted.Source: C BASELINES AND IMPLEMENTATION DETAILS · pp. 20–21

D EVALUATION PROTOCOL

The evaluation tests harmful and benign relearning under simulated fine-tuning attacks, alongside new-task learning and utility. Its protocols separate training, candidate selection, and final evaluation data.

D EVALUATION PROTOCOL

  • Harmful attacks retrain on 10% or 30% of eligible forget data, then score FS on the remainder; benign attacks use 1,000 Alpaca instructions without target data.Scores are maxima across epochs and learning rates, averaged over three data-order repeats.Source: D EVALUATION PROTOCOL · p. 21
  • AGNews evaluation uses 114,000 training examples for one epoch and measures NS on a disjoint 7,600-example test set; 3,000 held-out examples support candidate selection.The trajectory evaluates the test and full forget sets at 24 checkpoints.Source: D EVALUATION PROTOCOL · p. 21
  • Utility is measured on five FaithUn benchmarks and TOFU’s Real Authors and World Facts sets, while evaluation sets remain locked until final evaluation.Relearning, retain/forget, and AGNews selection data are disjoint from evaluation sets.Source: D EVALUATION PROTOCOL · pp. 21–22

E ADDITIONAL EXPERIMENT RESULTS

Additional results examine retention behavior and target recall during unrelated new-task learning. They report model- and dataset-specific retention patterns and show how replay and candidate selection contribute differently.

E ADDITIONAL EXPERIMENT RESULTS

  • On FaithUn, base unlearning costs GD 8.2 RS points on Llama and 11.7 on Qwen3; on TOFU, UMU raises KLUE’s Llama RS from 86.86 to 92.54.The proposed FaithUn recovery explanation is unverified because the teacher’s RS under replay was not measured; on TOFU, shared injected profile templates may explain spillover to retained authors.Source: E ADDITIONAL EXPERIMENT RESULTS · p. 22
  • GD FS rises from 19.32 to 22.18, while UMU variants end within one point of their starting values during AGNews fine-tuning.Replay keeps FS flat under a benign update, while selection keeps NS high; the w/o replay variant rises least in absolute terms but has the lowest NS.Source: E ADDITIONAL EXPERIMENT RESULTS · p. 22, Table 3 · p. 22
  • On TOFU Forget01, Table 3 reports absolute FS as mean ROUGE-L recall ×100 over 40 forget questions at fractions of the AGNews fine-tuning budget.The reported trajectory shows benign fine-tuning steadily restoring target knowledge for GD, while UMU variants remain near their starting FS.Source: Table 3 · p. 22, E ADDITIONAL EXPERIMENT RESULTS · p. 22

F GENERATION EXAMPLES

Generation examples compare GD and GD with UMU before and after a harmful attack on TOFU Forget01. They show similar pre-attack answers but different post-attack recovery of target information.

F GENERATION EXAMPLES

  • After the attack, GD returns label information in Q1, Q2, and Q4 and recovers two of three Q3 titles, while GD with UMU keeps substitute answers without label entities.Before the attack, both models answer fluently with plausible alternatives and neither refuses nor produces garbled text.Source: F GENERATION EXAMPLES · pp. 22–23, Table 4 · p. 23
  • The examples indicate that UMU changes the model’s response to retraining rather than its pre-attack released answers.The post-attack stability matches the behavior predicted by the reference-timing hypothesis.Source: F GENERATION EXAMPLES · p. 23
  • Table 4 marks queried key information in dark blue, label information appearing in responses in dark green, and content replacing the target in dark red.The examples use the TOFU Forget01 split with attack proportion p = 0.3 and Llama-3.2-3B-Instruct.Source: Table 4 · p. 23

Related papers

Loading 2610.21230v1…