mlsanityData to 14 Oct 2026

Unlearning Isn't Deletion: Investigating Reversibility of Machine Unlearning in LLMs

arXiv 2505.16831 ↗First posted 22 May 2025cs.CL cs.AI cs.CRcited by 42

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

Unlearning in large language models (LLMs) aims to remove specified data, but its efficacy is typically assessed with task-level metrics like accuracy and perplexity. We show that these metrics can be misleading, as models can appear to forget while their original behavior is easily restored through minimal fine-tuning. This reversibility suggests that information is merely suppressed, not genuinely erased. To address this critical evaluation gap, we introduce a representation-level analysis framework. Our toolkit comprises PCA similarity and shift, centered kernel alignment (CKA), and Fisher information, complemented by a summary metric, the mean PCA distance, to measure representational drift. Applying this framework across multiple unlearning methods, data domains, and LLMs, we identify four distinct forgetting regimes based on their reversibility and catastrophicity. We compare recovery strategies and show that relearning efficiency relies on the data source. We also find that irreversible, non-catastrophic forgetting is exceptionally challenging. By probing unlearning limits, we identify a case of seemingly irreversible, targeted forgetting, offering insights for more robust erasure algorithms. Overall, our findings expose a gap in current evaluation and establish a representation-level foundation for trustworthy unlearning.

Key facts. Cited by 42 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 46 of its 58 references that are in the map. First posted on arXiv 22 May 2025.

Builds on

46 of 58 references.

Closest ancestors · 21

Same direction, newest first

  1. 2025OBLIVIATE: Robust and Practical Machine Unlearning for Large Language Models7 May
  2. 2025FUNU: Boosting Machine Unlearning Efficiency by Filtering Unnecessary Unlearning28 Jan
  3. 2024WAGLE: Strategic Weight Attribution for Effective and Modular Unlearning in Large Language Models23 Oct
  4. 2024Catastrophic Failure of LLM Unlearning via Quantization21 Oct
  5. 2024A Closer Look at Machine Unlearning for Large Language Models10 Oct
  6. 2024Erasing Conceptual Knowledge from Language Models3 Oct
  7. 2024Alternate Preference Optimization for Unlearning Factual Knowledge in Large Language Models20 Sep
  8. 2024On Large Language Model Continual Unlearning14 Jul
  9. 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Models8 Jul
  10. 2024Protecting Privacy Through Approximating Optimal Parameters for Sequence Unlearning in Language Models20 Jun
  11. 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning19 Jun
  12. 2024Large Language Model Unlearning via Embedding-Corrupted Prompts12 Jun
9 more
  1. 2024Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models21 May
  2. 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
  3. 2024Eight Methods to Evaluate Robust Unlearning in LLMs26 Feb
  4. 2024Machine Unlearning of Pre-trained Large Language Models23 Feb
  5. 2024UNDIAL: Self-Distillation with Adjusted Logits for Robust Unlearning in Large Language Models15 Feb
  6. 2024TOFU: A Task of Fictitious Unlearning for LLMs11 Jan
  7. 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
  8. 2023Who's Harry Potter? Approximate Unlearning in LLMs3 Oct
  9. 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct

Other references · 25

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  2. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  3. 2025Qwen3 Technical Reportcited by 8,820
  4. 2021Measuring Mathematical Problem Solving With the MATH Datasetcited by 5,371
  5. 2024Qwen2.5 Technical Reportcited by 4,942
  6. 2016Overcoming catastrophic forgetting in neural networkscited by 4,787
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  8. 2018CommonsenseQA: A Question Answering Challenge Targeting Commonsense Knowledgecited by 1,822
  9. 2019Similarity of Neural Network Representations Revisitedcited by 1,755
  10. 2019Machine Unlearningcited by 1,061
  11. 2021Membership Inference Attacks From First Principlescited by 878
  12. 2024Yi: Open Foundation Models by 01.AIcited by 719
13 more
  1. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  2. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 498
  3. 2019Making AI Forget You: Data Deletion in Machine Learningcited by 465
  4. 2023Scalable Extraction of Training Data from (Production) Language Modelscited by 434
  5. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  6. 2022Language model compression with weighted low-rank factorizationcited by 195
  7. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 195
  8. 2023Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attackscited by 158
  9. 2023Copyright Violations and Large Language Modelscited by 108
  10. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 59
  11. 2023Unveiling the Implicit Toxicity in Large Language Modelscited by 51
  12. 2025Spurious Forgetting in Continual Learning of Language Modelscited by 51
  13. 2024Large Language Models Relearn Removed Conceptscited by 27

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 11; 2026: 31.

42 papers.

Sort:

By area:

  1. 2025Does Math Reasoning Improve General LLM Capabilities? Understanding Transferability of LLM Reasoningcited by 106
  2. 2025Distillation Robustifies Unlearningcited by 11
  3. 2025SoK: Machine Unlearning for Large Language Modelscited by 11
  4. 2025Beyond Scaling Law: A Data-Efficient Distillation Framework for Reasoningcited by 11
  5. 2025Model Immunization from a Condition Number Perspectivecited by 8
  6. 2026Hair-Trigger Alignment: Black-Box Evaluation Cannot Guarantee Post-Update Alignmentcited by 4
  7. 2026REBEL: Hidden Knowledge Recovery via Evolutionary-Based Evaluation Loopcited by 4
  8. 2025SineProject: Machine Unlearning for Stable Vision Language Alignmentcited by 3
  9. 2026Can an AI Assistant Really Forget? Auditable Deletion from Addressable Memorycited by 3
  10. 2026Stored in Optimizer State, Valued by Later Training: A Causal Account of Subliminal Trait Transfercited by 3
  11. 2025One-Point Contraction: Erasing Representational Separability toward Irreversible Deep Forgettingcited by 2
  12. 2025Improving Latent Reasoning in LLMs via Soft Concept Mixingcited by 2
30 more
  1. 2026From Domains to Instances: Dual-Granularity Data Synthesis for LLM Unlearningcited by 2
  2. 2026Mitigating Memorization Where It Happenscited by 2
  3. 2026Multilingual Unlearning in LLMs: Transfer, Dynamics, and Reversibilitycited by 2
  4. 2026LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearningcited by 2
  5. 2025Unlearning at Scale: State-Exact Trace-Preserving Deletion in Billion-Parameter Language Modelscited by 1
  6. 2025What the "Spotless" Mind Remembers: How Knowledge Entanglement Shapes What Leaks After Unlearning in LLMscited by 1
  7. 2026"The Whole Is Greater Than the Sum of Its Parts": A Compatibility-Aware Multi-Teacher CoT Distillation Frameworkcited by 1
  8. 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
  9. 2026Rethinking Benign Relearning: Syntax as the Hidden Driver of Unlearning Failurescited by 1
  10. 2026Copyright Detective: A Forensic System to Evidence LLMs Flickering Copyright Leakage Riskscited by 1
  11. 2026Anatomy of Unlearning: The Dual Impact of Fact Salience and Model Fine-Tuningcited by 1
  12. 2026Forgetting That Sticks: Quantization-Permanent Unlearning via Circuit Attributioncited by 1
  13. 2026Measuring the Depth of LLM Unlearning via Activation Patchingcited by 1
  14. 2026GROM: Gradient-Free Rapid One-Shot Machine Unlearningcited by 1
  15. 2025Grokked Models are Better Unlearnerscited by 0
  16. 2026GRIP: Algorithm-Agnostic Machine Unlearning for Mixture-of-Experts via Geometric Router Constraintscited by 0
  17. 2026FIT to Forget: Robust Continual Unlearning for Large Language Modelscited by 0
  18. 2026textbfAGTAO: Robust and Stabilized LLM Unlearning via Adversarial Gating Training with Adaptive Orthogonalitycited by 0
  19. 2026EvoMU: Evolutionary Machine Unlearningcited by 0
  20. 2026Probe-Geometry Alignment: Erasing the Cross-Sequence Memorization Signature Below Chancecited by 0
  21. 2026On the Hidden Costs of Counterfactual Knowledge Training in LLM Unlearningcited by 0
  22. 2026SPACE: Source-free Proxy Anchor Concept Erasure for MLLMscited by 0
  23. 2026DataRx: Missingness-Aware Sampling for Safer Large Language Model Task-Specific Fine-Tuningcited by 0
  24. 2026Exact Record Omission in Delta Attention: A Transport Criterion, Its Cost, and a Replay Certificatecited by 0
  25. 2026Hidden not Deleted: How Networks Suppress Entangled Featurescited by 0
  26. 2026LLM Unlearning Evaluation with TRIAGEcited by 0
  27. 2026TULIP: Targeted LLM Unlearning at Layers Identified Per-Inputcited by 0
  28. 2026Unlearning Deceptive Behaviors in LLMs with Contrastive Forget Setscited by 0
  29. 2026Learning What to Forget: Distributional Unlearning for LLM Representation Spacescited by 0
  30. 2026Faithful Dual-constrained Erasure for Robust LLM Safety Alignmentcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Unlearning That Lasts: Utility-Preserving, Robust, and Almost Irreversible Forgetting in LLMs
  2. 2025BLUR: A Benchmark for LLM Unlearning Robust to Forget-Retain Overlap
  3. 2025LLM Unlearning on Noisy Forget Sets: A Study of Incomplete, Rewritten, and Watermarked Data
  4. 2026Not Every Change Is Necessary: Recoverable Drift in Large Language Model Unlearning
  5. 2025SEPS: A Separability Measure for Robust Unlearning in LLMs
  6. 2026Unlearning in LLMs: Methods, Evaluation, and Open Challenges
  7. 2024Towards Robust Evaluation of Unlearning in LLMs via Data Transformations
  8. 2025The Erasure Illusion: Stress-Testing the Generalization of LLM Forgetting Evaluation