LLM Unlearning via Neural Activation Redirection
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
The ability to selectively remove knowledge from LLMs is highly desirable. However, existing methods often struggle with balancing unlearning efficacy and retain model utility, and lack controllability at inference time to emulate base model behavior as if it had never seen the unlearned data. In this paper, we propose LUNAR, a novel unlearning method grounded in the Linear Representation Hypothesis and operates by redirecting the representations of unlearned data to activation regions that expresses its inability to answer. We show that contrastive features are not a prerequisite for effective activation redirection, and LUNAR achieves state-of-the-art unlearning performance and superior controllability. Specifically, LUNAR achieves between 2.9x and 11.7x improvement in the combined unlearning efficacy and model utility score (Deviation Score) across various base models and generates coherent, contextually appropriate responses post-unlearning. Moreover, LUNAR effectively reduces parameter updates to a single down-projection matrix, a novel design that significantly enhances efficiency by 20x and robustness. Finally, we demonstrate that LUNAR is robust to white-box adversarial attacks and versatile in real-world scenarios, including handling sequential unlearning requests.
Key facts. Cited by 41 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 59 of its 79 references that are in the map. First posted on arXiv 11 Feb 2025.
Builds on
59 of 79 references.
Closest ancestors · 17
Same direction, newest first
- 2024Position: LLM Unlearning Benchmarks are Weak Measures of Progress3 Oct
- 2024On Effects of Steering Latent Representation for Large Language Model Unlearning12 Aug
- 2024UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI27 Jun
- 2024Mitigating Social Biases in Language Models through Unlearning19 Jun
- 2024Large Language Model Unlearning via Embedding-Corrupted Prompts12 Jun
- 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
- 2024Digital Forgetting in Large Language Models: A Survey of Unlearning Methods2 Apr
- 2024Rethinking Machine Unlearning for Large Language Models13 Feb
- 2024TOFU: A Task of Fictitious Unlearning for LLMs11 Jan
- 2023Unlearn What You Want to Forget: Efficient Unlearning for LLMs31 Oct
- 2023Large Language Model Unlearning14 Oct
- 2023Towards Unbounded Machine Unlearning20 Feb
5 more
- 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct
- 2022A Survey of Machine Unlearning6 Sep
- 2022Quark: Controllable Text Generation with Reinforced Unlearning26 May
- 2022Continual Learning and Private Unlearning24 Mar
- 2021Remember What You Want to Forget: Algorithms for Machine Unlearning4 Mar
Other references · 42
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2023GPT-4 Technical Reportcited by 18,396
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2020Scaling Laws for Neural Language Modelscited by 6,586
- 2019Unsupervised Cross-lingual Representation Learning at Scalecited by 3,935
- 2022Locating and Editing Factual Associations in GPTcited by 2,691
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2022Editing Models with Task Arithmeticcited by 1,120
- 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
- 2022Toy Models of Superpositioncited by 971
30 more
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
- 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 716
- 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 712
- 2020A Generalization of Transformer Networks to Graphscited by 661
- 2019CCNet: Extracting High Quality Monolingual Datasets from Web Crawl Datacited by 548
- 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
- 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
- 2020Null It Out: Guarding Protected Attributes by Iterative Nullspace Projectioncited by 455
- 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
- 2019Reducing Transformer Depth on Demand with Structured Dropoutcited by 439
- 2023Scalable Extraction of Training Data from (Production) Language Modelscited by 434
- 2023Studying Large Language Model Generalization with Influence Functionscited by 326
- 2024LayerSkip: Enabling Early Exit Inference and Self-Speculative Decodingcited by 307
- 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
- 2023Gender bias and stereotypes in Large Language Modelscited by 187
- 2023Linear Representations of Sentiment in Large Language Modelscited by 163
- 2023Composing Parameter-Efficient Modules with Arithmetic Operationscited by 156
- 2023Inspecting and Editing Knowledge Representations in Language Modelscited by 141
- 2024On Prompt-Driven Safeguarding for Large Language Modelscited by 116
- 2024Not All Layers of LLMs Are Necessary During Inferencecited by 96
- 2023Identifying and Mitigating the Security Risks of Generative AIcited by 91
- 2020Low-Resource Domain Adaptation for Compositional Task-Oriented Semantic Parsingcited by 72
- 2024A Survey on LoRA of Large Language Modelscited by 67
- 2024Robust LLM safeguarding via refusal feature adversarial trainingcited by 64
- 2023Unveiling the Implicit Toxicity in Large Language Modelscited by 51
- 2024Steering Without Side Effects: Improving Post-Deployment Control of Language Modelscited by 46
- 2023Knowledge Sanitization of Large Language Modelscited by 37
- 2024Tradeoffs Between Alignment and Helpfulness in Language Models with Steering Methodscited by 28
- 2024Decoding the AI Pen: Techniques and Challenges in Detecting AI-Generated Textcited by 14
- 2024Jet Expansions of Residual Computationcited by 4
Built on by
Citing papers per year: 2025: 12; 2026: 29.
41 papers.
Sort:
By area:
- 2025LLM Unlearning with LLM Beliefscited by 17
- 2025Editing as Unlearning: Are Knowledge Editing Methods Strong Baselines for Large Language Model Unlearning?cited by 13
- 2025SoK: Machine Unlearning for Large Language Modelscited by 11
- 2025AbbIE: Autoregressive Block-Based Iterative Encoder for Efficient Sequence Modelingcited by 7
- 2025DRAGON: Guard LLM Unlearning in Context via Negative Detection and Reasoningcited by 7
- 2025Hallucination reduction with CASAL: Contrastive Activation Steering For Amortized Learningcited by 6
- 2025UniErase: Towards Balanced and Precise Unlearning in Language Modelscited by 5
- 2025Generative Model Unlearning: A Survey through Target Events, Unlearning Operators, and Evaluation Protocolscited by 4
- 2025A Survey on Unlearning in Large Language Modelscited by 4
- 2025iSeal: Encrypted Fingerprinting for Reliable LLM Ownership Verificationcited by 4
- 2025LLM Unlearning Should Be Form-Independentcited by 3
- 2025SEAT: Sparse Entity-Aware Tuning for Knowledge Adaptation while Preserving Epistemic Abstentioncited by 3
29 more
- 2026Position: The Term "Machine Unlearning" Is Overused in LLMscited by 3
- 2026Per-parameter Task Arithmetic for Unlearning in Large Language Modelscited by 2
- 2026Mitigating Memorization Where It Happenscited by 2
- 2026KUDA: Knowledge Unlearning by Deviating Representation for Large Language Modelscited by 2
- 2026ALTER: Asymmetric LoRA for Token-Entropy-Guided Unlearning of LLMscited by 2
- 2026Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearningcited by 2
- 2026Divergence Decoding: Inference-Time Unlearning via Auxiliary Modelscited by 2
- 2026Multilingual Unlearning in LLMs: Transfer, Dynamics, and Reversibilitycited by 2
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
- 2026Forgetting That Sticks: Quantization-Permanent Unlearning via Circuit Attributioncited by 1
- 2026How LLM Task-Adaptation Reshapes Alignment: A Multi-dimensional Study of Behavioral and Representational Driftcited by 1
- 2026Sparse Readout Prism: Explaining Logit-Lens Scores in Features Instead of Tokenscited by 1
- 2026Representation-Aware Unlearning via Activation Signatures: From Suppression to Entity-Signature Erasurecited by 0
- 2026How to Take a Memorable Picture? Empowering Users with Actionable Feedbackcited by 0
- 2026MPU: Towards Secure and Privacy-Preserving Knowledge Unlearning for Large Language Modelscited by 0
- 2026Fuel Gauge: Estimating Chain-of-Thought Length Ahead of Time in Large Multimodal Modelscited by 0
- 2026Referring Multiple Regions with Large Multimodal Models via Contextual Latent Steeringcited by 0
- 2026BARRIER: Bounded Activation Regions for Robust Information Erasurecited by 0
- 2026ICCU: In-Context Continual Unlearning via Pattern-Induced Refusal Rulescited by 0
- 2026Null-Space Constrained Low-Rank Adaptation for Response-Specified Large Language Model Unlearningcited by 0
- 2026SAGE: Retain-Aware Post-Hoc Sanitization of Final Unlearning Vectorcited by 0
- 2026Unlearning Under Imbalance: Benchmarking Fairness in Multimodal LLM Unlearningcited by 0
- 2026Extracting Forgotten Prompts from Targeted Unlearned Modelscited by 0
- 2026Causal Routing for Unlearningcited by 0
- 2026TULIP: Targeted LLM Unlearning at Layers Identified Per-Inputcited by 0
- 2026Do LLMs Really Forget? Hidden-State Leakage in Model Unlearning and How to Fix itcited by 0
- 2026UnlearningSoup: Is Repeated Tuning Necessary for Large Language Model Unlearning?cited by 0
- 2026Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealingcited by 0
- 2026Exact Unlearning via Quantized Sufficient Statisticscited by 0
- 2026Exact Unlearning via Quantized Sufficient Statistics5 Oct 2026
- 2026Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing30 Sep 2026
- 2026UnlearningSoup: Is Repeated Tuning Necessary for Large Language Model Unlearning?29 Sep 2026
- 2026Do LLMs Really Forget? Hidden-State Leakage in Model Unlearning and How to Fix it29 Sep 2026
- 2026TULIP: Targeted LLM Unlearning at Layers Identified Per-Input28 Sep 2026
- 2026Causal Routing for Unlearning28 Sep 2026
- 2026Extracting Forgotten Prompts from Targeted Unlearned Models3 Sep 2026
- 2026Sparse Readout Prism: Explaining Logit-Lens Scores in Features Instead of Tokens1 Sep 2026
- 2026Unlearning Under Imbalance: Benchmarking Fairness in Multimodal LLM Unlearning23 Jul 2026
- 2026How LLM Task-Adaptation Reshapes Alignment: A Multi-dimensional Study of Behavioral and Representational Drift10 Jul 2026
- 2026SAGE: Retain-Aware Post-Hoc Sanitization of Final Unlearning Vector16 Jun 2026
- 2026Null-Space Constrained Low-Rank Adaptation for Response-Specified Large Language Model Unlearning9 Jun 2026
29 more
- 2026Multilingual Unlearning in LLMs: Transfer, Dynamics, and Reversibility2 Jun 2026
- 2026Divergence Decoding: Inference-Time Unlearning via Auxiliary Models29 May 2026
- 2026ICCU: In-Context Continual Unlearning via Pattern-Induced Refusal Rules26 May 2026
- 2026Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning16 May 2026
- 2026BARRIER: Bounded Activation Regions for Robust Information Erasure15 May 2026
- 2026Forgetting That Sticks: Quantization-Permanent Unlearning via Circuit Attribution14 May 2026
- 2026Position: The Term "Machine Unlearning" Is Overused in LLMs8 May 2026
- 2026Referring Multiple Regions with Large Multimodal Models via Contextual Latent Steering3 May 2026
- 2026Fuel Gauge: Estimating Chain-of-Thought Length Ahead of Time in Large Multimodal Models11 Mar 2026
- 2026ALTER: Asymmetric LoRA for Token-Entropy-Guided Unlearning of LLMs2 Mar 2026
- 2026MPU: Towards Secure and Privacy-Preserving Knowledge Unlearning for Large Language Models27 Feb 2026
- 2026How to Take a Memorable Picture? Empowering Users with Actionable Feedback25 Feb 2026
- 2026KUDA: Knowledge Unlearning by Deviating Representation for Large Language Models22 Feb 2026
- 2026Mitigating Memorization Where It Happens9 Feb 2026
- 2026Per-parameter Task Arithmetic for Unlearning in Large Language Models29 Jan 2026
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilities29 Jan 2026
- 2026Representation-Aware Unlearning via Activation Signatures: From Suppression to Entity-Signature Erasure15 Jan 2026
- 2025iSeal: Encrypted Fingerprinting for Reliable LLM Ownership Verification12 Nov 2025
- 2025DRAGON: Guard LLM Unlearning in Context via Negative Detection and Reasoning8 Nov 2025
- 2025A Survey on Unlearning in Large Language Models29 Oct 2025
- 2025LLM Unlearning with LLM Beliefs22 Oct 2025
- 2025Hallucination reduction with CASAL: Contrastive Activation Steering For Amortized Learning25 Sep 2025
- 2025Generative Model Unlearning: A Survey through Target Events, Unlearning Operators, and Evaluation Protocols26 Jul 2025
- 2025AbbIE: Autoregressive Block-Based Iterative Encoder for Efficient Sequence Modeling11 Jul 2025
- 2025SEAT: Sparse Entity-Aware Tuning for Knowledge Adaptation while Preserving Epistemic Abstention17 Jun 2025
- 2025SoK: Machine Unlearning for Large Language Models10 Jun 2025
- 2025LLM Unlearning Should Be Form-Independent9 Jun 2025
- 2025Editing as Unlearning: Are Knowledge Editing Methods Strong Baselines for Large Language Model Unlearning?26 May 2025
- 2025UniErase: Towards Balanced and Precise Unlearning in Language Models21 May 2025
- 2025LLM Unlearning with LLM Beliefscited by 17
- 2025Editing as Unlearning: Are Knowledge Editing Methods Strong Baselines for Large Language Model Unlearning?cited by 13
- 2025SoK: Machine Unlearning for Large Language Modelscited by 11
- 2025UniErase: Towards Balanced and Precise Unlearning in Language Modelscited by 5
- 2025Generative Model Unlearning: A Survey through Target Events, Unlearning Operators, and Evaluation Protocolscited by 4
- 2025A Survey on Unlearning in Large Language Modelscited by 4
- 2025iSeal: Encrypted Fingerprinting for Reliable LLM Ownership Verificationcited by 4
- 2025LLM Unlearning Should Be Form-Independentcited by 3
- 2026Position: The Term "Machine Unlearning" Is Overused in LLMscited by 3
- 2026Per-parameter Task Arithmetic for Unlearning in Large Language Modelscited by 2
- 2026KUDA: Knowledge Unlearning by Deviating Representation for Large Language Modelscited by 2
- 2026ALTER: Asymmetric LoRA for Token-Entropy-Guided Unlearning of LLMscited by 2
12 most cited of 30 All 30 (JSON)
- 2026Exact Unlearning via Quantized Sufficient Statistics5 Oct 2026
- 2026Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing30 Sep 2026
- 2026UnlearningSoup: Is Repeated Tuning Necessary for Large Language Model Unlearning?29 Sep 2026
- 2026Do LLMs Really Forget? Hidden-State Leakage in Model Unlearning and How to Fix it29 Sep 2026
- 2026TULIP: Targeted LLM Unlearning at Layers Identified Per-Input28 Sep 2026
- 2026Causal Routing for Unlearning28 Sep 2026
- 2026Extracting Forgotten Prompts from Targeted Unlearned Models3 Sep 2026
- 2026SAGE: Retain-Aware Post-Hoc Sanitization of Final Unlearning Vector16 Jun 2026
- 2026Null-Space Constrained Low-Rank Adaptation for Response-Specified Large Language Model Unlearning9 Jun 2026
- 2026Multilingual Unlearning in LLMs: Transfer, Dynamics, and Reversibility2 Jun 2026
- 2026Divergence Decoding: Inference-Time Unlearning via Auxiliary Models29 May 2026
- 2026ICCU: In-Context Continual Unlearning via Pattern-Induced Refusal Rules26 May 2026
12 newest of 30 All 30 (JSON)
- 2025AbbIE: Autoregressive Block-Based Iterative Encoder for Efficient Sequence Modelingcited by 7
- 2025SEAT: Sparse Entity-Aware Tuning for Knowledge Adaptation while Preserving Epistemic Abstentioncited by 3
- 2026Mitigating Memorization Where It Happenscited by 2
- 2026How LLM Task-Adaptation Reshapes Alignment: A Multi-dimensional Study of Behavioral and Representational Driftcited by 1
- 2026Sparse Readout Prism: Explaining Logit-Lens Scores in Features Instead of Tokenscited by 1
- 2026How to Take a Memorable Picture? Empowering Users with Actionable Feedbackcited by 0
- 2026Sparse Readout Prism: Explaining Logit-Lens Scores in Features Instead of Tokens1 Sep 2026
- 2026How LLM Task-Adaptation Reshapes Alignment: A Multi-dimensional Study of Behavioral and Representational Drift10 Jul 2026
- 2026How to Take a Memorable Picture? Empowering Users with Actionable Feedback25 Feb 2026
- 2026Mitigating Memorization Where It Happens9 Feb 2026
- 2025AbbIE: Autoregressive Block-Based Iterative Encoder for Efficient Sequence Modeling11 Jul 2025
- 2025SEAT: Sparse Entity-Aware Tuning for Knowledge Adaptation while Preserving Epistemic Abstention17 Jun 2025
Similar, not cited
Close in wording, no citation either way
- 2025Improving LLM Unlearning Robustness via Random Perturbations
- 2025Beyond Sharp Minima: Robust LLM Unlearning via Feedback-Guided Multi-Point Optimization
- 2026Can LLMs Truly Forget? Revealing Unlearning Gaps Through Adversarial Evaluation
- 2025SAEs Can Improve Unlearning: Dynamic Sparse Autoencoder Guardrails for Precision Unlearning in LLMs
- 2026Robust LLM Unlearning Against Relearning Attacks: The Minor Components in Representations Matter
- 2025Model Collapse Is Not a Bug but a Feature in Machine Unlearning for LLMs
- 2024LLM Unlearning via Loss Adjustment with Only Forget Data
- 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning