mlsanityData to 7 Oct 2026

Open Problems in Machine Unlearning for AI Safety

arXiv 2501.04952 ↗First posted 9 Jan 2025cs.LG cs.AI cs.CYcited by 49

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

As AI systems become more capable, widely deployed, and increasingly autonomous in critical areas such as cybersecurity, biological research, and healthcare, ensuring their safety and alignment with human values is paramount. Machine unlearning -- the ability to selectively forget or suppress specific types of knowledge -- has shown promise for privacy and data removal tasks, which has been the primary focus of existing research. More recently, its potential application to AI safety has gained attention. In this paper, we identify key limitations that prevent unlearning from serving as a comprehensive solution for AI safety, particularly in managing dual-use knowledge in sensitive domains like cybersecurity and chemical, biological, radiological, and nuclear (CBRN) safety. In these contexts, information can be both beneficial and harmful, and models may combine seemingly harmless information for harmful purposes -- unlearning this information could strongly affect beneficial uses. We provide an overview of inherent constraints and open problems, including the broader side effects of unlearning dangerous knowledge, as well as previously unexplored tensions between unlearning and existing safety mechanisms. Finally, we investigate challenges related to evaluation, robustness, and the preservation of safety features during unlearning. By mapping these limitations and open challenges, we aim to guide future research toward realistic applications of unlearning within a broader AI safety framework, acknowledging its limitations and highlighting areas where alternative approaches may be required.

Key facts. Cited by 49 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. First posted on arXiv 9 Jan 2025.

Builds on

0 of 0 references.

No references here yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 34; 2026: 15.

49 papers.

Sort:

By area:

  1. 2025Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyondcited by 76
  2. 2025Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilitiescited by 36
  3. 2025Rethinking Memory in LLM based Agents: Representations, Operations, and Emerging Topicscited by 36
  4. 2025SafeEraser: Enhancing Safety in Multimodal Large Language Models through Multimodal Machine Unlearningcited by 31
  5. 2025Towards Understanding Subliminal Learning: When and How Hidden Biases Transfercited by 30
  6. 2025ReLearn: Unlearning via Learning for Large Language Modelscited by 20
  7. 2025Invariance Makes LLM Unlearning Resilient Even to Unanticipated Downstream Fine-Tuningcited by 20
  8. 2025GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detectioncited by 17
  9. 2025Model Unlearning via Sparse Autoencoder Subspace Guided Projectionscited by 17
  10. 2025Minimalist Concept Erasure in Generative Modelscited by 13
  11. 2025LLM Unlearning Reveals a Stronger-Than-Expected Coreset Effect in Current Benchmarkscited by 11
  12. 2025CTRAP: Embedding Collapse Trap to Safeguard Large Language Models from Harmful Fine-Tuningcited by 11
37 more
  1. 2025Precise In-Parameter Concept Erasure in Large Language Modelscited by 11
  2. 2025Distillation Robustifies Unlearningcited by 11
  3. 2026Shaping capabilities with token-level data filteringcited by 11
  4. 2025Unlearning Isn't Invisible: Detecting Unlearning Traces in LLMs from Model Outputscited by 10
  5. 2025Mining Intrinsic Rewards from LLM Hidden States for Efficient Best-of-N Samplingcited by 9
  6. 2025UCD: Unlearning in LLMs via Contrastive Decodingcited by 9
  7. 2025A2D: Any-Order, Any-Step Safety Alignment for Diffusion Language Modelscited by 9
  8. 2025Do Sparse Autoencoders Generalize? A Case Study of Answerabilitycited by 8
  9. 2025Beyond Data Filtering: Knowledge Localization for Capability Removal in LLMscited by 8
  10. 2025Toward Robust Non-Transferable Learning: A Survey and Benchmarkcited by 7
  11. 2025Existing Large Language Model Unlearning Evaluations Are Inconclusivecited by 7
  12. 2025Improving LLM Unlearning Robustness via Random Perturbationscited by 6
  13. 2025Same Question, Different Words: A Latent Adversarial Framework for Prompt Robustnesscited by 5
  14. 2025Curvature-Aware Safety Restoration In LLMs Fine-Tuningcited by 5
  15. 2025On the creation of narrow AI: hierarchy and nonlocality of neural network skillscited by 4
  16. 2025Unsupervised Word-level Quality Estimation for Machine Translation Through the Lens of Annotators (Dis)agreementcited by 4
  17. 2025Generative Model Unlearning: A Survey through Target Events, Unlearning Operators, and Evaluation Protocolscited by 4
  18. 2026Is your algorithm unlearning or untraining?cited by 3
  19. 2026Automated Interpretability and Feature Discovery in Language Models with Agentscited by 3
  20. 2025ZJUKLAB at SemEval-2025 Task 4: Unlearning via Model Mergingcited by 2
  21. 2025LLM Unlearning Should Be Form-Independentcited by 2
  22. 2025A Survey on Unlearning in Large Language Modelscited by 2
  23. 2026Position: Capability Control Should be a Separate Goal From Alignmentcited by 2
  24. 2026MoralityGym: A Benchmark for Evaluating Hierarchical Moral Alignment in Sequential Decision-Making Agentscited by 2
  25. 2025Personalized Safety Alignment for Text-to-Image Diffusion Modelscited by 1
  26. 2025LLM Unlearning Under the Microscope: A Full-Stack View on Methods and Metricscited by 1
  27. 2026Dynamics Reveals Structure: Challenging the Linear Propagation Assumptioncited by 1
  28. 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
  29. 2026EraseAnything++: Enabling Concept Erasure in Rectified Flow Transformers Leveraging Multi-Object Optimizationcited by 1
  30. 2026Designing to Forget: Deep Semi-parametric Models for Unlearningcited by 1
  31. 2026Physical Foundation Models: Fixed hardware implementations of large-scale neural networkscited by 1
  32. 2026Semantic Steering for Controllable Generation: Tuning-Free Concept Erasure in Multimodal Diffusion Transformerscited by 1
  33. 2025RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositoriescited by 0
  34. 2026Does Machine Unlearning Preserve Clinical Safety? A Risk Analysis for Medical Image Classificationcited by 0
  35. 2026On the Hidden Costs of Counterfactual Knowledge Training in LLM Unlearningcited by 0
  36. 2026Don't Forget Your Embeddings: Robust Knowledge Erasure via Precise Editing of Embeddingscited by 0
  37. 2026Unified Safe In-context Image Generation in Multimodal Diffusion Transformers via Restricting Unsafe Information Flowscited by 0