Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond

Anil Ramakrishna; Chongyu Fan; Jinghan Jia; Mingyi Hong; Sijia Liu; Yihua Zhang

REVIEW 3 major objections 5 minor 7 cited by

Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LLM unlearning is easy to undo by fine-tuning on a few forget samples; this paper argues the fix is to make the forget-loss landscape flat, and shows that training with sharpness-aware minimization (SAM) and related smoothing methods…

desk verdict Trust the empirical finding, discount the theory wrapper: SAM makes unlearning survive relearning, but the min-max equivalence is constructed rather than discovered. read the letter →

arxiv 2502.05374 v4 pith:W3FSSJ6C submitted 2025-02-07 cs.LG cs.CL

Chongyu Fan , Jinghan Jia , Yihua Zhang , Anil Ramakrishna , Mingyi Hong , Sijia Liu This is my paper · ORCID

classification cs.LGcs.CL

keywords LLMunlearningrelearningattackssharpness-awareminimizationsmoothnessoptimizationrobustmin-maxnegativepreferencejailbreakingweightperturbation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the reason unlearned large language models can be re-taught forbidden knowledge is that the forget-loss landscape is sharp, and that making it smooth, by training with sharpness-aware minimization or related smoothing methods, is a direct and practical defense against relearning attacks. The authors frame unlearning as a min-max game in which an adversary perturbs the weights to undo the forgetting, which turns out to be exactly the SAM objective applied to the forget loss. Across the WMDP and MUSE benchmarks and several unlearning baselines, they show that smoothed variants consistently retain more unlearning after fine-tuning on forget samples, with NPO+SAM being the strongest. The same smoothing also blocks input-level jailbreaking prompts, suggesting that smoothness is a robustness property of the unlearned model rather than a trick for one attack type.

What carries the argument

The central object is the SAM-modified forget loss $\ell_f^{\mathrm{SAM}}(\theta) = \ell_f\big(\theta + \rho \nabla_\theta \ell_f(\theta)/\|\nabla_\theta \ell_f(\theta)\|_2\big)$, which evaluates the forget loss at a point nudged in the direction of the forget-loss gradient. Solving the min-max problem with $\ell_{\mathrm{relearn}} = -\ell_f$ makes the inner maximizer a bounded weight perturbation that attempts to lower the forget loss, which is exactly what a relearning attacker does in one step. Because the gradient of $\ell_f^{\mathrm{SAM}}$ involves the Hessian-gradient product $Hv$, SAM acts as curvature regularization that flattens the forget-loss landscape; the paper verifies the flattening with loss-landscape visualizations and traces all tested smoothing methods (randomized smoothing, gradient penalty, curvature regularization, weight averaging) back to this same mechanism.

What would settle it

Run a relearning attack against an NPO+SAM model using many unconstrained fine-tuning steps with a standard fine-tuning loss rather than the negative forget loss, and measure whether post-attack unlearning effectiveness falls back to vanilla-NPO levels; if it does, the bounded one-step SAM proxy does not capture the real relearning adversary.

Watch

Extended reading notes

Core claim

The central claim is that smoothness of the forget-loss landscape is a load-bearing property of robust LLM unlearning. Concretely, the paper proposes a robust optimization reformulation: instead of minimizing the forget loss at the current weights, minimize it at the worst-case nearby weights, $\max_{\|\delta\|_p \le \rho} \ell_f(\theta+\delta)$, and shows this is identical to applying sharpness-aware minimization to the forget loss. Solving the inner maximization by first-order Taylor expansion gives $\delta^* = \rho \nabla_\theta \ell_f(\theta)/\|\nabla_\theta \ell_f(\theta)\|_2$, so the SAM update implicitly penalizes curvature of the forget loss through the Hessian-gradient product $Hv$. The same reasoning yields a family of smoothness-promoting unlearning objectives, including randomized smoothing, gradient penalty, curvature regularization, and weight averaging. The paper reports that each of these improves unlearning resistance to relearning attacks across NPO, GradDiff, and RMU on WMDP and MUSE, without hurting pre-attack unlearning effectiveness or utility, and that the flattest variants (NPO+SAM) also restore the first few output tokens' KL divergence, which explains their jailbreak robustness.

Load-bearing premise

The whole defense rests on treating a relearning attack as one bounded step that moves weights in the direction of the forget-loss gradient; if actual fine-tuning attackers take many steps, use unconstrained radii, or optimize a loss that is not the negative forget loss, the smoothness defense may target a proxy rather than the true attacker.

Editorial extensions

If this is right

If smoothness is the operative defense, then any unlearning method that converges to a sharp point can be made more robust by wrapping it in SAM, yielding strictly better post-attack forgetting for the same pre-attack unlearning effectiveness and utility.
Relearning attacks that use forget-unrelated data (AGNews, GSM8K, SST2) are also mitigated, so the defense is not merely overfitting to the forgetting dataset.
Resistance to jailbreaking improves because smoothing fixes 'shallow unlearning alignment': the first few output tokens are properly suppressed, raising the KL divergence between the unlearned and original models under adversarial prompts.
NPO+SAM approaches the tamper-resistance of TAR and beats activation-space latent adversarial training (RMU-LAT) at a fraction of the runtime, making the defense practical for 7B-8B models.
The robustness persists as the attacker uses more samples or more epochs, though it degrades, and there is an intermediate SAM perturbation radius $\rho$ that best balances forgetting and robustness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A testable extension: if flatness is the mechanism, then measuring the Hessian spectrum of the forget loss before and after unlearning should predict relearning resistance; the paper shows loss-landscape visualizations but does not report a quantitative sharpness metric that correlates with post-attack performance.
The single-step Taylor argument suggests SAM defends most strongly against few-step attacks; a determined attacker who takes many unconstrained gradient steps or adaptively searches the perturbation radius may weaken the defense, which is not tested in the paper.
The same min-max framing could be applied to the retain loss, for example smoothing the retain loss might reduce utility degradation under repeated unlearning or catastrophic forgetting, but the paper does not explore this direction.
If weight-space flatness is what matters, then combining SAM-based unlearning with other weight-space methods, such as weight averaging or model merging, could compound robustness, though no such combination is evaluated here.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Punchline: this is a solid applied result wrapped in a thin theoretical story. The empirical claim—that SAM and other weight-space smoothing methods integrated into NPO make unlearning survive fine-tuning on forget samples better—is consistent across WMDP and MUSE, across several unlearning methods, and across multiple attack schedules. I think the effect is real.

What is new: nobody has systematically tested sharpness-aware optimization for unlearning robustness, and the comparison against TAR and RMU-LAT in Table 1 is genuinely useful. The loss-landscape visualizations show the intended smoothing on the forget loss, and the paper ships code. Credit where it is due.

Where it is soft: the robust optimization framing in Eq (3) is specified so that SAM falls out by construction. Setting ℓrelearn = −ℓf and constraining ‖δ‖ ≤ ρ literally defines SAM's inner problem. That is a relabeling, not a discovery, and the subsequent analysis reduces to known Taylor identities. The bigger substantive gap is that no evidence connects the single-step δ* to the actual multi-step fine-tuning attacks used in Section 5. Those attacks use unconstrained AdamW and a standard fine-tuning loss, not −ℓf. This does not refute the empirical improvement, but it means the paper's explanatory story is over-claimed; the paper is best read as an empirical finding, not as a validated equivalence between relearning and worst-case perturbation.

Other issues: the headline numbers in Tables 2 and A1 lack error bars even though attacks are averaged over five trials; ρ and λ are tuned on the same benchmarks where the defense is evaluated; and the NPO+SAM gain at N=60 is 0.45 vs 0.37 UE—real but partial. All of these are addressable.

I partly disagree with the stress-test note: the equivalence gap is not load-bearing in a fatal sense, because the consistent empirical pattern across methods and datasets supports the practical recommendation even if the theory is weak. The paper does not rest entirely on its min-max framing.

Bottom line: this deserves a serious referee. The right outcome is probably acceptance after adding error bars, a genuine hyperparameter sensitivity section, and ideally an attack that directly optimizes −ℓf or a trajectory measurement of δ across fine-tuning steps, to test whether the SAM robustness transfers beyond the short budgets reported. I would bring it to reading group and I would cite the empirical result.

Referee Report

3 major / 5 minor

Summary. The paper addresses the vulnerability of LLM unlearning to relearning attacks, where fine-tuning on a small number of forget samples can restore unlearned knowledge. The authors propose using sharpness-aware minimization (SAM) and, more broadly, smoothness-oriented optimizers (randomized smoothing, gradient penalty, curvature regularization, weight averaging) during unlearning. They motivate this via a min-max robust optimization formulation (Eq. 3) whose inner maximization over a bounded weight perturbation is exactly SAM's perturbation, and they provide a Taylor-expansion analysis (Eqs. 6-8) linking SAM to gradient-norm and curvature penalties. Experiments on WMDP (Zephyr-7B, LLaMA-3 8B) and MUSE (Books, News) show that NPO+SAM and other smooth variants improve unlearning effectiveness after relearning attacks compared to vanilla NPO, GradDiff, and RMU, and also improve robustness against jailbreaking attacks. The paper includes a public code repository.

Significance. If the empirical claims are reliable, the paper offers a practical, low-overhead defense: replacing the unlearning optimizer with SAM or a smoothing variant. This is potentially valuable because it applies to existing unlearning pipelines without architectural changes. The comparisons against TAR and RMU-LAT in Table 1 are a genuine strength, as they show NPO+SAM is competitive while being far cheaper. The paper is also commendable for reporting results across multiple benchmarks, multiple base unlearning methods, and multiple attack configurations, and for releasing code. However, the theoretical framing is substantially weaker than the abstract and introduction suggest: the claimed 'robust optimization foundation' is an analogy that is true by construction of the min-max objective, not a discovered equivalence with real relearning attacks, and the subsequent analysis rests on standard SAM identities. The empirical evidence, while consistent in direction, is presented without any statistical uncertainty or a clear validation of the surrogate adversary.

major comments (3)

[§3, Eqs. (3)-(4)] The central theoretical claim is that relearning attacks can be modeled as a bounded worst-case weight perturbation, making SAM the natural defense. This is constructed by setting ℓ_relearn = -ℓ_f and constraining ∥δ∥_p ≤ ρ; the inner maximizer δ* in Eq. (4) is the one-step linearized gradient ascent direction. However, the attacks in §5.1 are multi-step fine-tuning on D_f (or unrelated datasets) using the standard fine-tuning loss, not -ℓ_f, with an unconstrained trajectory. The paper provides no theorem, ablation, or trajectory measurement connecting the cumulative multi-step update to δ*. Without such a link, the phrase 'robust optimization foundation' overstates what Eq. (3) establishes. I request one of the following: (a) compare the actual weight displacement of the fine-tuning attack in direction and norm to ρ∇ℓ_f/∥∇ℓ_f∥; (b) run a relearning attack that directly optimizes -ℓ_f under an ℓ2 constraint and show that NPO+SAM still helps; or (c) reframe the SAM connection as a heuristic analogy and let the empirical results stand on their own.
[§5.1, Tables 2 and A1] The paper states that relearning attack performance is 'averaged over 5 independent random trials' but reports only point estimates, with no standard deviations, confidence intervals, or per-trial values. Many of the headline improvements are small in absolute terms—for example, in Table 2, NPO+SAM UE is 0.45 vs 0.41 for NPO+RS at N=60, and NPO+GP at M=3 is 0.43 vs 0.37 for NPO. These differences could easily be within run-to-run noise. Since the abstract's central claim is that smoothness approaches 'consistently improve' resistance, variance reporting is load-bearing. Additionally, hyperparameters such as ρ, γ, and λ are tuned via grid search on the same benchmark on which results are reported (Appendix C), with no separate validation set or cross-validation, which risks selection on the evaluation set.
[§4, Eqs. (6)-(8) and Fig. 2] The 'analysis' in this section is a restatement of the standard SAM derivation: first-order Taylor expansion leads to a gradient-norm penalty (Eq. 6), whose derivative involves the Hessian-vector product Hv (Eq. 7), approximated by a finite difference (Eq. 8). The argument that SAM reduces ∥Hv∥₂ and thereby improves robustness is presented as an inference from the loss-landscape visualizations in Fig. 2, not as a proven mechanism. The paper does not establish that flatness of the forget loss is necessary or sufficient for resistance to multi-step fine-tuning. I suggest either adding a formal statement (e.g., a bound on the forget-loss increase after T fine-tuning steps as a function of local curvature) or explicitly labeling this as intuition, with the experiments as the primary evidence.

minor comments (5)

[Fig. 5 caption vs. text (§5.2)] The caption says the markers •, ■, and ▲ denote 200, 300, and 400 samples for Books and 400, 500, and 600 for News, but the accompanying text says the attacks use 75, 100, and 125 samples. This discrepancy must be resolved for reproducibility.
[Eq. (12)] The weight-averaging update appears to contain an indexing typo: θ_WA,t = θ_WA,t·n + θ_t/(n+1) should likely be θ_WA,t = (n·θ_WA,t-1 + θ_t)/(n+1). Please clarify the definition of n and the update rule.
[Appendix C] The text refers to 'NPO+SWA' while the main text uses 'NPO+WA'; unify the terminology. Also state how the Gaussian directions r1 and r2 in Fig. 2 are normalized and whether the z-axis is clipped.
[Eq. (2)] The phrase 'ℓ_relearn is defined to counteract the forget objective, e.g., the negative forget loss, or the standard finetuning loss' is vague; specify the exact loss used in the reported attacks and whether it is the same for all experiments.
[Table 1] The column headers 'W/o atk' and 'W/ atk' are ambiguous; clarify that they refer to UE without and with the relearning attack, and consider adding the attack configuration (sample count and epochs) to the table caption.

Circularity Check

1 steps flagged · score 4.0 of 10

The Eq-(3) link between robust unlearning and SAM is true by construction, but the headline empirical robustness gains are independently tested against real fine-tuning attacks.

self definitional [Section 3, Eq. (3) and preceding sentence]
"If the relearning objective ℓrelearn is defined to counteract the forget objective, such that ℓrelearn = −ℓf, then integrating the relearning adversary (2) into LLM unlearning (1) leads to the following min-max robust optimization problem: min_θ max_{∥δ∥p≤ρ} ℓf(θ + δ|Df) + λℓr(θ|Dr), (3)"

The min-max objective (3) is literally SAM's objective: the inner maximization of the forget loss over a norm-bounded weight perturbation δ is exactly the SAM loss. By defining the relearning adversary to have loss −ℓf and a bounded update δ, the claimed 'connection' between robust unlearning and SAM is imposed by definition rather than discovered. The subsequent analysis that 'smoothness optimization plays a pivotal role' restates this chosen formulation through standard Taylor and curvature identities (6)–(8). However, the paper's main empirical claim—that NPO+SAM withstands actual multi-step fine-tuning relearning attacks better than NPO—is not derived from this definition and is supported by external experiments, so the circularity is confined to the theoretical framing.

full rationale

The central empirical result—that SAM and other smoothness-enhancing variants of NPO preserve higher unlearning effectiveness after real relearning attacks on WMDP and MUSE than vanilla NPO—is an externally falsifiable comparison. The attack data were not used to fit the defense; hyperparameters are selected via grid search. NPO and SAM are external prior works, and no load-bearing claim is supported solely by the present authors' own citations. The theoretical 'connection' in Eq. (3), however, is self-definitional: by setting the attacker's objective to −ℓf and restricting δ to a norm ball, the robust-unlearning objective becomes exactly the SAM objective, so the alignment is true by construction rather than by derivation. Because this definitional step motivates the framing but does not fabricate the experimental improvements, the circularity is partial, not total.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central robustness claim rests on the SAM perturbation radius ρ and the smoothness/CR/GP regularization strengths, all tuned by grid search; on the assumption that fine-tuning attacks are equivalent to a bounded worst-case weight perturbation of the NPO forget loss; and on the flat-minima heuristic that smooth forget landscapes resist relearning. No new physical entities are introduced.

free parameters (5)

SAM perturbation radius ρ = 0.01 (grid searched in [1e-3, 1e-1] on WMDP and MUSE)
Controls size of worst-case weight perturbation in Eq (3); ablation Table A3 shows performance is sensitive to ρ.
Retain regularization weight λ = WMDP: 1 to 2.5; MUSE: 0.25 to 1.0 (grid searched)
Balances forget and retain losses in Eq (1); affects the final loss landscape and robustness.
NPO temperature β = 0.01 to 0.05 (WMDP), 0.1 (MUSE)
Shapes the NPO forget loss and therefore the SAM gradient direction.
Curvature/gradient penalty coefficient γ = 1 to 10 (grid searched)
Weights explicit smoothness regularizers in NPO+CR and NPO+GP; robustness claims for these variants depend on chosen γ.
RS perturbation scale and sample count = scale grid-searched in [1e-3,1e-1], 3 samples
Defines the Gaussian smoothing in NPO+RS; sample count chosen by hand.

assumptions (4)

domain assumption Relearning attacks can be modeled as a single bounded weight perturbation maximizing the NPO forget loss (ℓrelearn = -ℓf), Eq (3).
Actual attacks are multi-step fine-tuning with CE loss; the equivalence is assumed to make SAM the min-max solution.
domain assumption First-order Taylor expansions in Eq (4) and Eq (6) approximate the SAM loss accurately for LLM forget losses.
Standard for SAM, but LLM losses are non-convex and high-dimensional; no validation.
ad hoc to paper Flatness of the forget loss landscape implies resistance to relearning attacks.
Used to explain why SAM works; supported by landscape plots and experiments, no theorem.
domain assumption UE, UT, KnowMem, VerbMem on WMDP and MUSE are sufficient measures of unlearning and robustness.
Standard benchmarks, but they do not capture all failure modes.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond." pith.science (2026). https://pith.science/paper/W3FSSJ6C

@misc{pith2026250205374,
  author       = {Pith},
  title        = {Pith review of: Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W3FSSJ6C}},
  note         = {Machine review of arXiv:2502.05374}
}

read the original abstract

The LLM unlearning technique has recently been introduced to comply with data regulations and address the safety and ethical concerns of LLMs by removing the undesired data-model influence. However, state-of-the-art unlearning methods face a critical vulnerability: they are susceptible to ``relearning'' the removed information from a small number of forget data points, known as relearning attacks. In this paper, we systematically investigate how to make unlearned models robust against such attacks. For the first time, we establish a connection between robust unlearning and sharpness-aware minimization (SAM) through a unified robust optimization framework, in an analogy to adversarial training designed to defend against adversarial attacks. Our analysis for SAM reveals that smoothness optimization plays a pivotal role in mitigating relearning attacks. Thus, we further explore diverse smoothing strategies to enhance unlearning robustness. Extensive experiments on benchmark datasets, including WMDP and MUSE, demonstrate that SAM and other smoothness optimization approaches consistently improve the resistance of LLM unlearning to relearning attacks. Notably, smoothness-enhanced unlearning also helps defend against (input-level) jailbreaking attacks, broadening our proposal's impact in robustifying LLM unlearning. Codes are available at https://github.com/OPTML-Group/Unlearn-Smooth.

Figures

Figures reproduced from arXiv: 2502.05374 by the authors.

**Figure 1.** Unlearning example on the WMDP Bio dataset before and after relearning attacks: (a) UE (unlearning effectiveness) of Zephyr-7B-beta (‘Origin’), the NPO-unlearned model w/o relearning (‘Unlearn’), and the relearned model from the unlearned one (‘RelearnN’), where N represents the number of forget data samples used for relearning. (b) Response example of different models in (a) evaluated on WMDP. A motivating exampl… view at source ↗

**Figure 2.** Improved unlearning robustness by smoothness optimization-integrated NPO (including NPO+SAM, RS, GP, CR, or WA) compared to vanilla NPO on WMDP following the setup in [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** Unlearning robustness comparison for different methods (NPO, GradDiff, and RMU) with and without SAM on WMDP under various relearning attacks settings. The UE of the original model (‘Origin’) is also included for comparison. (a) UE vs. the number of relearning epochs using 20 forget samples. (b) UE vs. the number of forget data points with 1 relearning epoch. Evaluation on SAM-integrated unlearning methods beyond N… view at source ↗

Figures from the paper (3 more)

**Figure 5.** Figure 5: Unlearning robustness of NPO and NPO+SAM on MUSE Books and News under relearning attacks with varying data amounts (•, ■, and ▲ denote 200, 300, and 400 samples for Books, and 400, 500, and 600 samples for News.). UE is measured via KnowMem and VerbMem on Df (lower is …

**Figure 4.** Figure 4: Unlearning robustness of NPO and NPO+SAM on WMDP under relearning attacks with different sets (AGNews, GSM8K, SST2), using 60 samples for 1 epoch. Unlearning robustness over diverse relearn sets [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 6.** Figure 6: (a) Unlearning robustness comparison of NPO and its smooth enhancements on WMDP against jailbreaking attacks. (b) KL divergence for each output token between the unlearned model and the original model when facing jailbreaking attacks. Ablation study on SAM’s hyperparam…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 7 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Crossing the Margin Cliff: Toward Relearn-Robust LLM Unlearning via Margin Calibration
cs.AI 2026-07 conditional novelty 7.0 of 10

Margin Calibration, a non-saturating margin-anchored LoRA polish, crosses the margin cliff and cuts post-attack relearn recovery on all 97 populated cells in the paper's stress matrix.
Understanding Machine Unlearning Through the Lens of Mode Connectivity
cs.LG 2026-07 unverdicted novelty 6.0 of 10

Unlearned models usually connect to their originals by smooth low-loss paths, and the smoothness of that path can predict how hard the unlearning task was.
A Mechanistic Perspective and Circuit-Guided Difficulty Metric for Unlearning
cs.LG 2026-01 conditional novelty 6.0 of 10

A circuit-similarity score predicts which samples an LLM unlearning method will fail to erase, with hard samples relying on deeper, output-facing pathways.
Leak@$k$: Unlearning Does Not Make LLMs Forget Under Probabilistic Decoding
cs.LG 2025-11 reject novelty 6.0 of 10

LLM unlearning methods that pass greedy-decoding benchmarks leak forgotten facts when the model is sampled repeatedly, and the new leak@k metric quantifies this.
LLM Unlearning for Cyber Defense: A Survey on Methods, Challenges, and Emerging Threats
cs.LG 2026-06 conditional novelty 4.0 of 10

Most gradient-based LLM unlearning methods achieve behavioral suppression, not true forgetting, and current benchmarks cannot certify that knowledge has been removed.
A Numerical PDEs Approach to Evolution Equations in Shape Analysis Based on Regularized Morphoelasticity
math.NA 2026-04 unverdicted novelty 4.0 of 10

Regularized morphoelasticity yields a high-order elliptic system for continuous shape evolution that is solved by mixed finite elements in FEniCSx within an LDDMM-style optimal-control growth model.
A Survey on Generative Model Unlearning: Fundamentals, Taxonomy, Evaluation, and Future Direction
cs.LG 2025-07 conditional novelty 4.0 of 10

A survey and framework that categorizes generative model unlearning by point-wise versus concept-wise objectives, parameter-based versus non-parametric methods, and completeness/utility/efficiency evaluation.

Reference graph

Works this paper leans on

31 extracted references · 6 canonical work pages · cited by 7 Pith papers

[7]

Measuring mas- sive multitask language understanding

Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., and Steinhardt, J. Measuring mas- sive multitask language understanding. arXiv preprint arXiv:2009.03300,

arXiv 2009
[8]

S., and Smith, V

Hu, S., Fu, Y ., Wu, Z. S., and Smith, V . Jogging the memory of unlearned model through targeted relearning attack. arXiv preprint arXiv:2406.13356,

arXiv
[9]

Izmailov, P., Podoprikhin, D., Garipov, T., Vetrov, D., and Wilson, A. G. Averaging weights leads to wider optima and better generalization. arXiv preprint arXiv:1803.05407,

arXiv
[11]

Advancing the ro- bustness of large language models through self-denoised smoothing

Ji, J., Hou, B., Zhang, Z., Zhang, G., Fan, W., Li, Q., Zhang, Y ., Liu, G., Liu, S., and Chang, S. Advancing the ro- bustness of large language models through self-denoised smoothing. arXiv preprint arXiv:2404.12274, 2024a. Ji, J., Liu, Y ., Zhang, Y ., Liu, G., Kompella, R. R., Liu, S., and Chang, S. Reversing the forget-retain objectives: An efficient ...

arXiv
[12]

Continual learning and private unlearning

Liu, B., Liu, Q., and Stone, P. Continual learning and private unlearning. In Conference on Lifelong Learning Agents, pp. 243–254. PMLR, 2022a. Liu, C. Y ., Wang, Y ., Flanigan, J., and Liu, Y . Large language model unlearning via embedding-corrupted prompts. arXiv preprint arXiv:2406.07933, 2024a. Liu, S., Yao, Y ., Jia, J., Casper, S., Baracaldo, N., Ha...

arXiv 2024
[13]

Eight methods to evaluate robust unlearning in llms

Lynch, A., Guo, P., Ewart, A., Casper, S., and Hadfield- Menell, D. Eight methods to evaluate robust unlearning in llms. arXiv preprint arXiv:2402.16835,

arXiv
[14]

On first-order meta-learning algorithms

Nichol, A. On first-order meta-learning algorithms. arXiv preprint arXiv:1803.02999,

arXiv
[15]

In-context unlearning: Language models as few shot unlearners

Pawelczyk, M., Neel, S., and Lakkaraju, H. In-context unlearning: Language models as few shot unlearners. arXiv preprint arXiv:2310.07579,

arXiv

Show all 31 references

[16]

C., Perez, E., Hadfield- Menell, D., et al

Sheshadri, A., Ewart, A., Guo, P., Lynch, A., Wu, C., Heb- bar, V ., Sleight, H., Stickland, A. C., Perez, E., Hadfield- Menell, D., et al. Latent adversarial training improves robustness to persistent harmful behaviors in llms. arXiv preprint arXiv:2407.15549,

arXiv
[17]

A., and Zhang, C

Shi, W., Lee, J., Huang, Y ., Malladi, S., Zhao, J., Holtz- man, A., Liu, D., Zettlemoyer, L., Smith, N. A., and Zhang, C. Muse: Machine unlearning six-way evaluation for language models. arXiv preprint arXiv:2407.06460,

arXiv
[18]

Ununlearning: Unlearning is not sufficient for content regulation in advanced generative ai

Shumailov, I., Hayes, J., Triantafillou, E., Ortiz-Jimenez, G., Papernot, N., Jagielski, M., Yona, I., Howard, H., and Bagdasaryan, E. Ununlearning: Unlearning is not sufficient for content regulation in advanced generative ai. arXiv preprint arXiv:2407.00106,

arXiv
[19]

D., Ng, A

Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C. D., Ng, A. Y ., and Potts, C. Recursive deep models for semantic compositionality over a sentiment treebank. In 11 Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and ...

2013
[21]

Guardrail baselines for unlearning in llms

Thaker, P., Maurya, Y ., and Smith, V . Guardrail baselines for unlearning in llms. arXiv preprint arXiv:2403.03329,

arXiv
[22]

Thompson, T. B. and Sklar, M. Flrt: Fluent student-teacher redteaming. arXiv preprint arXiv:2407.17447,

arXiv
[24]

Depn: Detecting and editing privacy neu- rons in pretrained language models

Wu, X., Li, J., Xu, M., Dong, W., Wu, S., Bian, C., and Xiong, D. Depn: Detecting and editing privacy neu- rons in pretrained language models. arXiv preprint arXiv:2310.20138,

arXiv
[25]

Weight perturbation as defense against adversarial word substitutions

Xu, J., Li, L., Zhang, J., Zheng, X., Chang, K.-W., Hsieh, C.-J., and Huang, X.-J. Weight perturbation as defense against adversarial word substitutions. In Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 7054–7063,

2022
[26]

Large language model unlearn- ing

Yao, Y ., Xu, X., and Liu, Y . Large language model unlearn- ing. arXiv preprint arXiv:2310.10683,

arXiv
[27]

On the complementarity between pre-training and random- initialization for resource-rich machine translation

Zan, C., Ding, L., Shen, L., Cao, Y ., Liu, W., and Tao, D. On the complementarity between pre-training and random- initialization for resource-rich machine translation. arXiv preprint arXiv:2209.03316,

arXiv
[28]

On the duality between sharpness-aware minimization and adversarial training

Zhang, Y ., He, H., Zhu, J., Chen, H., Wang, Y ., and Wei, Z. On the duality between sharpness-aware minimization and adversarial training. arXiv preprint arXiv:2402.15152, 2024b. Zhang, Z., Wang, F., Li, X., Wu, Z., Tang, X., Liu, H., He, Q., Yin, W., and Wang, S. Does your l...

arXiv
[29]

Z., and Fredrikson, M

Zou, A., Wang, Z., Kolter, J. Z., and Fredrikson, M. Uni- versal and transferable adversarial attacks on aligned lan- guage models. arXiv preprint arXiv:2307.15043,

arXiv
[30]

12 Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond Appendix A. Algorithm for SAM-enhanced Unlearning Algorithm A1 SAM-enhanced Unlearning Require: Original model θ, forget set Df, retain set Dr, unlearning steps N, ...

2024
[31]

For the Books dataset, we utilize ICLM 7B, fine-tuned on the Harry Potter books

For MUSE (Shi et al., 2024), we adopt LLaMA-2 7B, fine-tuned on BBC news articles, as the original model. For the Books dataset, we utilize ICLM 7B, fine-tuned on the Harry Potter books. Both original models are readily accessible from the benchmark. NPO is trained for 10 epoc...

2024
[2013]

Tamper-resistant safeguards for open-weight llms

Tamirisa, R., Bharathi, B., Phan, L., Zhou, A., Gatti, A., Suresh, T., Lin, M., Wang, J., Wang, R., Arel, R., et al. Tamper-resistant safeguards for open-weight llms. arXiv preprint arXiv:2408.00761,

arXiv
[2018]

Knowledge unlearning for mitigat- ing privacy risks in language models

Jang, J., Yoon, D., Yang, S., Cha, S., Lee, M., Logeswaran, L., and Seo, M. Knowledge unlearning for mitigat- ing privacy risks in language models. arXiv preprint arXiv:2210.01504,

arXiv
[2019]

Visualizing and understanding the effectiveness of bert

Hao, Y ., Dong, L., Wei, F., and Xu, K. Visualizing and understanding the effectiveness of bert. arXiv preprint arXiv:1908.05620,

1908 arXiv
[2020]

Training verifiers to solve math word problems

Cobbe, K., Kosaraju, V ., Bavarian, M., Chen, M., Jun, H., Kaiser, L., Plappert, M., Tworek, J., Hilton, J., Nakano, R., Hesse, C., and Schulman, J. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168,

arXiv
[2021]

Sharpness-aware minimiza- tion alone can improve adversarial robustness

Wei, Z., Zhu, J., and Zhang, Y . Sharpness-aware minimiza- tion alone can improve adversarial robustness. arXiv preprint arXiv:2305.05392,

arXiv
[2022]

Open problems in machine unlearning for ai safety.arXiv preprint arXiv:2501.04952,

Barez, F., Fu, T., Prabhu, A., Casper, S., Sanyal, A., Bibi, A., O’Gara, A., Kirk, R., Bucknall, B., Fist, T., et al. Open problems in machine unlearning for ai safety.arXiv preprint arXiv:2501.04952,

arXiv
[2023]

Simplicity prevails: Rethinking negative pref- erence optimization for llm unlearning

Fan, C., Liu, J., Lin, L., Jia, J., Zhang, R., Mei, S., and Liu, S. Simplicity prevails: Rethinking negative pref- erence optimization for llm unlearning. arXiv preprint arXiv:2410.07163, 2024a. Fan, C., Liu, J., Zhang, Y ., Wei, D., Wong, E., and Liu, S. Salun: Empowering mac...
[2024]

and Roger, F

Deeb, A. and Roger, F. Do unlearning methods remove in- formation from language model weights? arXiv preprint arXiv:2410.08827,

arXiv
[2025]

and Yang, J

Cao, Y . and Yang, J. Towards making systems forget with machine unlearning. In 2015 IEEE symposium on security and privacy, pp. 463–480. IEEE,

2015

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [7]

Measuring mas- sive multitask language understanding

Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., and Steinhardt, J. Measuring mas- sive multitask language understanding. arXiv preprint arXiv:2009.03300,

arXiv 2009

[2] [8]

S., and Smith, V

Hu, S., Fu, Y ., Wu, Z. S., and Smith, V . Jogging the memory of unlearned model through targeted relearning attack. arXiv preprint arXiv:2406.13356,

arXiv

[3] [9]

Izmailov, P., Podoprikhin, D., Garipov, T., Vetrov, D., and Wilson, A. G. Averaging weights leads to wider optima and better generalization. arXiv preprint arXiv:1803.05407,

arXiv

[4] [11]

Advancing the ro- bustness of large language models through self-denoised smoothing

Ji, J., Hou, B., Zhang, Z., Zhang, G., Fan, W., Li, Q., Zhang, Y ., Liu, G., Liu, S., and Chang, S. Advancing the ro- bustness of large language models through self-denoised smoothing. arXiv preprint arXiv:2404.12274, 2024a. Ji, J., Liu, Y ., Zhang, Y ., Liu, G., Kompella, R. R., Liu, S., and Chang, S. Reversing the forget-retain objectives: An efficient ...

arXiv

[5] [12]

Continual learning and private unlearning

Liu, B., Liu, Q., and Stone, P. Continual learning and private unlearning. In Conference on Lifelong Learning Agents, pp. 243–254. PMLR, 2022a. Liu, C. Y ., Wang, Y ., Flanigan, J., and Liu, Y . Large language model unlearning via embedding-corrupted prompts. arXiv preprint arXiv:2406.07933, 2024a. Liu, S., Yao, Y ., Jia, J., Casper, S., Baracaldo, N., Ha...

arXiv 2024

[6] [13]

Eight methods to evaluate robust unlearning in llms

Lynch, A., Guo, P., Ewart, A., Casper, S., and Hadfield- Menell, D. Eight methods to evaluate robust unlearning in llms. arXiv preprint arXiv:2402.16835,

arXiv

[7] [14]

On first-order meta-learning algorithms

Nichol, A. On first-order meta-learning algorithms. arXiv preprint arXiv:1803.02999,

arXiv

[8] [15]

In-context unlearning: Language models as few shot unlearners

Pawelczyk, M., Neel, S., and Lakkaraju, H. In-context unlearning: Language models as few shot unlearners. arXiv preprint arXiv:2310.07579,

arXiv