mlsanityData to 14 Oct 2026

From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization

arXiv 2505.22310 ↗First posted 28 May 2025cs.LG cs.AI cs.CVcited by 12

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

Recent unlearning methods for LLMs are vulnerable to relearning attacks: knowledge believed-to-be-unlearned re-emerges by fine-tuning on a small set of (even seemingly-unrelated) examples. We study this phenomenon in a controlled setting for example-level unlearning in vision classifiers. We make the surprising discovery that forget-set accuracy can recover from around 50% post-unlearning to nearly 100% with fine-tuning on just the retain set -- i.e., zero examples of the forget set. We observe this effect across a wide variety of unlearning methods, whereas for a model retrained from scratch excluding the forget set (gold standard), the accuracy remains at 50%. We observe that resistance to relearning attacks can be predicted by weight-space properties, specifically, L2-distance and linear mode connectivity between the original and the unlearned model. Leveraging this insight, we propose a new class of methods that achieve state-of-the-art resistance to relearning attacks.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 38 of its 46 references that are in the map. First posted on arXiv 28 May 2025.

Builds on

38 of 46 references.

Closest ancestors · 13

Same direction, newest first

  1. 2024Improved Localized Machine Unlearning Through the Lens of Memorization3 Dec
  2. 2024Catastrophic Failure of LLM Unlearning via Quantization21 Oct
  3. 2024Do Unlearning Methods Remove Information from Language Model Weights?11 Oct
  4. 2024An Adversarial Perspective on Machine Unlearning for AI Safety26 Sep
  5. 2024UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI27 Jun
  6. 2024Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition13 Jun
  7. 2024What makes unlearning hard and what to do about it3 Jun
  8. 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
  9. 2023Who's Harry Potter? Approximate Unlearning in LLMs3 Oct
  10. 2023Fast Machine Unlearning Without Retraining Through Selective Synaptic Dampening15 Aug
  11. 2023Model Sparsity Can Simplify Machine Unlearning11 Apr
  12. 2022Can Bad Teaching Induce Forgetting? Unlearning in Deep Networks using an Incompetent Teacher17 May
1 more
  1. 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan

Other references · 25

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  5. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,877
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  7. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  8. 2019Machine Unlearningcited by 1,061
  9. 2019Linear Mode Connectivity and the Lottery Ticket Hypothesiscited by 637
  10. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  11. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
  12. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 460
13 more
  1. 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
  2. 2020Amnesiac Machine Learningcited by 319
  3. 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 311
  4. 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
  5. 2020Mixed-Privacy Forgetting in Deep Networkscited by 163
  6. 2018Learning to Quantize Deep Networks by Optimizing Quantization Intervals with Task Losscited by 160
  7. 2021Deep Learning Through the Lens of Example Difficultycited by 141
  8. 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 138
  9. 2020Characterizing Structural Regularities of Labeled Data in Overparameterized Modelscited by 93
  10. 2022Mechanistic Mode Connectivitycited by 50
  11. 2025Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilitiescited by 39
  12. 2022Metadata Archaeology: Unearthing Data Subsets by Leveraging Training Dynamicscited by 26
  13. 2024Reawakening knowledge: Anticipatory recovery from catastrophic interference via structured trainingcited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 12.

12 papers.

  1. 2026RAZOR: Ratio-Aware Layer Editing for Targeted Unlearning in Vision Transformers and Diffusion Modelscited by 8
  2. 2026Erase at the Core: Representation Unlearning for Machine Unlearningcited by 5
  3. 2026Hair-Trigger Alignment: Black-Box Evaluation Cannot Guarantee Post-Update Alignmentcited by 4
  4. 2026Is your algorithm unlearning or untraining?cited by 4
  5. 2026A Low-Rank Subspace Analysis of LLM Interventionscited by 3
  6. 2026Position: Capability Control Should be a Separate Goal From Alignmentcited by 2
  7. 2026Detoxifying LLMs via Representation Erasure-Based Preference Optimizationcited by 1
  8. 2026Lethe: Principled Dual-Stream Update for Persistent Knowledge Erasure in Federated Unlearningcited by 0
  9. 2026You Don't Need All That Attention: Surgical Memorization Mitigation in Text-to-Image Diffusion Modelscited by 0
  10. 2026SoK: Unlearnability and Unlearning for Model Dememorizationcited by 0
  11. 2026Distance Is Not Enough: Forget-Retain Alignment Gap Predicts LLM Relearning Robustnesscited by 0
  12. 2026Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpointscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack
  2. 2025Improving LLM Unlearning Robustness via Random Perturbations
  3. 2025Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond
  4. 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning
  5. 2026The Unseen Threat: Residual Knowledge in Machine Unlearning under Perturbed Samples
  6. 2026Robust LLM Unlearning Against Relearning Attacks: The Minor Components in Representations Matter
  7. 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted data
  8. 2025Beyond Sharp Minima: Robust LLM Unlearning via Feedback-Guided Multi-Point Optimization