mlsanityData to 14 Oct 2026

Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond

arXiv 2502.05374 ↗First posted 7 Feb 2025cs.LG cs.CLcited by 79

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

The LLM unlearning technique has recently been introduced to comply with data regulations and address the safety and ethical concerns of LLMs by removing the undesired data-model influence. However, state-of-the-art unlearning methods face a critical vulnerability: they are susceptible to ``relearning'' the removed information from a small number of forget data points, known as relearning attacks. In this paper, we systematically investigate how to make unlearned models robust against such attacks. For the first time, we establish a connection between robust unlearning and sharpness-aware minimization (SAM) through a unified robust optimization framework, in an analogy to adversarial training designed to defend against adversarial attacks. Our analysis for SAM reveals that smoothness optimization plays a pivotal role in mitigating relearning attacks. Thus, we further explore diverse smoothing strategies to enhance unlearning robustness. Extensive experiments on benchmark datasets, including WMDP and MUSE, demonstrate that SAM and other smoothness optimization approaches consistently improve the resistance of LLM unlearning to relearning attacks. Notably, smoothness-enhanced unlearning also helps defend against (input-level) jailbreaking attacks, broadening our proposal's impact in robustifying LLM unlearning. Codes are available at https://github.com/OPTML-Group/Unlearn-Smooth.

Key facts. Cited by 79 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 63 of its 74 references that are in the map. First posted on arXiv 7 Feb 2025.

Builds on

63 of 74 references.

Closest ancestors · 26

Same direction, newest first

  1. 2025Open Problems in Machine Unlearning for AI Safety9 Jan
  2. 2024WAGLE: Strategic Weight Attribution for Effective and Modular Unlearning in Large Language Models23 Oct
  3. 2024Do Unlearning Methods Remove Information from Language Model Weights?11 Oct
  4. 2024Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning9 Oct
  5. 2024An Adversarial Perspective on Machine Unlearning for AI Safety26 Sep
  6. 2024Revisiting Who's Harry Potter: Towards Targeted Unlearning from a Causal Intervention Perspective24 Jul
  7. 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Models8 Jul
  8. 2024UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI27 Jun
  9. 2024Reversing the Forget-Retain Objectives: An Efficient LLM Unlearning Framework from Logit Difference12 Jun
  10. 2024Large Language Model Unlearning via Embedding-Corrupted Prompts12 Jun
  11. 2024SOUL: Unlocking the Power of Second-Order Optimization for LLM Unlearning28 Apr
  12. 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
14 more
  1. 2024Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearning12 Mar
  2. 2024Guardrail Baselines for Unlearning in LLMs5 Mar
  3. 2024Eight Methods to Evaluate Robust Unlearning in LLMs26 Feb
  4. 2024Towards Safer Large Language Models through Machine Unlearning15 Feb
  5. 2024Rethinking Machine Unlearning for Large Language Models13 Feb
  6. 2024TOFU: A Task of Fictitious Unlearning for LLMs11 Jan
  7. 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation19 Oct
  8. 2023Large Language Model Unlearning14 Oct
  9. 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
  10. 2023Boundary Unlearning21 Mar
  11. 2023Towards Unbounded Machine Unlearning20 Feb
  12. 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct
  13. 2022Continual Learning and Private Unlearning24 Mar
  14. 2021Machine Unlearning via Algorithmic Stability25 Feb

Other references · 37

  1. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2016Pointer Sentinel Mixture Modelscited by 3,096
  7. 2022Locating and Editing Factual Associations in GPTcited by 2,691
  8. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  9. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  11. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
  12. 2017Visualizing the Loss Landscape of Neural Netscited by 1,130
25 more
  1. 2018On First-Order Meta-Learning Algorithmscited by 1,018
  2. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  3. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  4. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 465
  5. 2018Robustness via curvature regularization, and vice versacited by 175
  6. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
  7. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 168
  8. 2023Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attackscited by 158
  9. 2022Towards Understanding Sharpness-Aware Minimizationcited by 146
  10. 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 138
  11. 2022Towards Efficient and Scalable Sharpness-Aware Minimizationcited by 129
  12. 2024Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attackcited by 115
  13. 2022Sharpness-Aware Training for Freecited by 95
  14. 2023DEPN: Detecting and Editing Privacy Neurons in Pretrained Language Modelscited by 79
  15. 2019Visualizing and Understanding the Effectiveness of BERTcited by 67
  16. 2019Scaleable input gradient regularization for adversarial robustnesscited by 47
  17. 2023An Adaptive Policy to Employ Sharpness-Aware Minimizationcited by 43
  18. 2024Large Language Models Relearn Removed Conceptscited by 27
  19. 2024On the Duality Between Sharpness-Aware Minimization and Adversarial Trainingcited by 24
  20. 2024Advancing the Robustness of Large Language Models through Self-Denoised Smoothingcited by 16
  21. 2022On the Complementarity between Pre-Training and Random-Initialization for Resource-Rich Machine Translationcited by 15
  22. 2023Sharpness-Aware Minimization Alone can Improve Adversarial Robustnesscited by 14
  23. 2024Neglected Hessian component explains mysteries in Sharpness regularizationcited by 12
  24. 2023What Is Missing in IRM Training and Evaluation? Challenges and Solutionscited by 10
  25. 2024When Will Gradient Regularization Be Harmful?cited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 27; 2026: 52.

79 papers.

Sort:

By area:

  1. 2025OpenUnlearning: Accelerating LLM Unlearning via Unified Benchmarking of Methods and Metricscited by 83
  2. 2025Invariance Makes LLM Unlearning Resilient Even to Unanticipated Downstream Fine-Tuningcited by 21
  3. 2025Learning to Unlearn while Retaining: Combating Gradient Conflicts in Machine Unlearningcited by 19
  4. 2025GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detectioncited by 17
  5. 2025Reasoning Model Unlearning: Forgetting Traces, Not Just Answers, While Preserving Reasoning Skillscited by 14
  6. 2026Shaping capabilities with token-level data filteringcited by 13
  7. 2025Distillation Robustifies Unlearningcited by 11
  8. 2025Unlearning That Lasts: Utility-Preserving, Robust, and Almost Irreversible Forgetting in LLMscited by 11
  9. 2025The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigationcited by 10
  10. 2025Leak@k: Unlearning Does Not Make LLMs Forget Under Probabilistic Decodingcited by 9
  11. 2025OFFSIDE: Benchmarking Unlearning Misinformation in Multimodal Large Language Modelscited by 8
  12. 2025The Right to be Forgotten in Pruning: Unveil Machine Unlearning on Sparse Modelscited by 7
38 more
  1. 2026Attention Smoothing Is All You Need For Unlearningcited by 7
  2. 2026Explainable LLM Unlearning Through Reasoningcited by 7
  3. 2025Beyond Single-Value Metrics: Evaluating and Enhancing LLM Unlearning with Cognitive Diagnosiscited by 5
  4. 2025LLM Unlearning Without an Expert Curated Datasetcited by 5
  5. 2025Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attackcited by 4
  6. 2025Downgrade to Upgrade: Optimizer Simplification Enhances Robustness in LLM Unlearningcited by 4
  7. 2025A Survey on Unlearning in Large Language Modelscited by 4
  8. 2025Towards Benchmarking Privacy Vulnerabilities in Selective Forgetting with Large Language Modelscited by 4
  9. 2026Surgery: Mitigating Harmful Fine-Tuning for Large Language Models via Attention Sinkcited by 4
  10. 2026REBEL: Hidden Knowledge Recovery via Evolutionary-Based Evaluation Loopcited by 4
  11. 2025FUTURE: Flexible Unlearning for Tree Ensemblecited by 3
  12. 2025Label Smoothing Improves Gradient Ascent in LLM Unlearningcited by 3
  13. 2026Visual-Guided Key-Token Regularization for Multimodal Large Language Model Unlearningcited by 3
  14. 2025ZJUKLAB at SemEval-2025 Task 4: Unlearning via Model Mergingcited by 2
  15. 2025Sharpness-Aware Parameter Selection for Machine Unlearningcited by 2
  16. 2025Dual-Space Smoothness for Robust and Balanced LLM Unlearningcited by 2
  17. 2025LLM Unlearning Under the Microscope: A Full-Stack View on Methods and Metricscited by 2
  18. 2026A Mechanistic Perspective and Circuit-Guided Difficulty Metric for Unlearningcited by 2
  19. 2026Per-parameter Task Arithmetic for Unlearning in Large Language Modelscited by 2
  20. 2026KUDA: Knowledge Unlearning by Deviating Representation for Large Language Modelscited by 2
  21. 2026A Few Steps Further: Why Defenses Against Malicious Finetuning Erode Under Continued Trainingcited by 2
  22. 2026TRACER: Token ReAssignment for Concept ERasure in Generative Recommendationcited by 2
  23. 2026Natively Unlearnable Large Language Modelscited by 2
  24. 2025Understanding Machine Unlearning Through the Lens of Mode Connectivitycited by 1
  25. 2025Beyond Sharp Minima: Robust LLM Unlearning via Feedback-Guided Multi-Point Optimizationcited by 1
  26. 2025Bits Leaked per Query: Information-Theoretic Bounds on Adversarial Attacks against LLMscited by 1
  27. 2025WARP: Weight Teleportation for Attack-Resilient Unlearning Protocolscited by 1
  28. 2026Beyond Superficial Unlearning: Sharpness-Aware Robust Erasure of Hallucinations in Multimodal LLMscited by 1
  29. 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
  30. 2026PrivUn: Unveiling Latent Ripple Effects and Shallow Forgetting in Privacy Unlearningcited by 1
  31. 2026Robust LLM Unlearning Against Relearning Attacks: The Minor Components in Representations Mattercited by 1
  32. 2026Position: Zeroth-Order Optimization in Deep Learning Is Underexplored, Not Underpoweredcited by 1
  33. 2026Measuring the Depth of LLM Unlearning via Activation Patchingcited by 1
  34. 2026Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attackscited by 1
  35. 2026Measure, Don't Optimize: Forecasting Recovery in LLM Unlearningcited by 1
  36. 2026textbfAGTAO: Robust and Stabilized LLM Unlearning via Adversarial Gating Training with Adaptive Orthogonalitycited by 0
  37. 2026EvoMU: Evolutionary Machine Unlearningcited by 0
  38. 2026Learning to Stay Safe: Adaptive Regularization Against Safety Degradation during Fine-Tuningcited by 0

50 most cited of 79 All 79 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Improving LLM Unlearning Robustness via Random Perturbations
  2. 2026Can LLMs Truly Forget? Revealing Unlearning Gaps Through Adversarial Evaluation
  3. 2025SAEs Can Improve Unlearning: Dynamic Sparse Autoencoder Guardrails for Precision Unlearning in LLMs
  4. 2025From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization
  5. 2025Machine Unlearning Meets Adversarial Robustness via Constrained Interventions on LLMs
  6. 2024Towards Robust Knowledge Unlearning: An Adversarial Framework for Assessing and Improving Unlearning Robustness in Large Language Models
  7. 2026RepSelect: Robust LLM Unlearning via Representation Selectivity
  8. 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning