On the Impossibility of Retrain Equivalence in Machine Unlearning
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
Machine unlearning seeks to selectively remove the "influence" of specific training data on a model's outputs. The ideal goal is Retrain Equivalence--behavior identical to a model trained from scratch on only the retained data. This goal was formulated for models trained on i.i.d. data batches, but modern pipelines often involve multi-stage training, with each stage having a distinct data distribution and objective. Examples include LLM fine-tuning for alignment, reasoning ability, etc. Our study shows via theory and experiments that this shift to multi-stage training introduces a fundamental barrier for machine unlearning. The theory indicates that the outcome of local unlearning--methods that only use gradients computed on the forget set--is path-dependent. That is, a model's behavior during unlearning is influenced by the order of its training stages during learning, making it impossible for path-oblivious algorithms to universally achieve Retrain Equivalence. We empirically demonstrate the same phenomenon in LLM post-training across Llama and Qwen models (1B to 14B) with gradient ascent, NPO, and SimNPO local unlearning algorithms. Models fine-tuned via different orderings of identical training stages diverge in behavior during unlearning, with the degradation in GSM8K accuracy after unlearning varying by over 20% across paths. We also observe that some learning paths consistently produce models that unlearn slowly. During unlearning, whether the probability mass gets squeezed into paraphrasing or alternative concepts is also path-dependent. These results consistently show that Retrain Equivalence is an ill-posed target for local unlearning algorithms, so long as the target models are trained in stages. In situations where access to models' training histories is hard, the current work calls for rethinking the definition and desiderata of machine unlearning.
Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 47 of its 52 references that are in the map. First posted on arXiv 18 Oct 2025.
Builds on
47 of 52 references.
Closest ancestors · 24
Same direction, newest first
- 2025Sparse-Autoencoder-Guided Internal Representation Unlearning for Large Language Models19 Sep
- 2025Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methods11 Jun
- 2025Certified Unlearning for Neural Networks8 Jun
- 2025A Certified Unlearning Approach without Access to Source Data6 Jun
- 2025Existing Large Language Model Unlearning Evaluations Are Inconclusive31 May
- 2025Are We Truly Forgetting? A Critical Re-examination of Machine Unlearning Evaluation Protocols10 Mar
- 2024Evaluating Deep Unlearning in Large Language Models19 Oct
- 2024Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning9 Oct
- 2024Position: LLM Unlearning Benchmarks are Weak Measures of Progress3 Oct
- 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Models8 Jul
- 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning19 Jun
- 2024Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition13 Jun
12 more
- 2024Rethinking LLM Memorization through the Lens of Adversarial Compression23 Apr
- 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
- 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
- 2024Eight Methods to Evaluate Robust Unlearning in LLMs26 Feb
- 2024TOFU: A Task of Fictitious Unlearning for LLMs11 Jan
- 2023Large Language Model Unlearning14 Oct
- 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct
- 2022Quark: Controllable Text Generation with Reinforced Unlearning26 May
- 2022Continual Learning and Private Unlearning24 Mar
- 2021Machine Unlearning of Features and Labels26 Aug
- 2021Remember What You Want to Forget: Algorithms for Machine Unlearning4 Mar
- 2021Machine Unlearning via Algorithmic Stability25 Feb
Other references · 23
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2021Training Verifiers to Solve Math Word Problemscited by 9,743
- 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 8,851
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2024Qwen2 Technical Reportcited by 2,076
- 2019Machine Unlearningcited by 1,020
- 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 919
- 2023The RefinedWeb Dataset for Falcon LLM: Outperforming Curated Corpora with Web Data, and Web Data Onlycited by 755
11 more
- 2017The Implicit Bias of Gradient Descent on Separable Datacited by 649
- 2019Benign Overfitting in Linear Regressioncited by 544
- 2019Certified Data Removal from Machine Learning Modelscited by 512
- 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 488
- 2024Dolma: an Open Corpus of Three Trillion Tokens for Language Model Pretraining Researchcited by 475
- 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 303
- 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 224
- 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 220
- 2024Learning Dynamics of LLM Finetuningcited by 93
- 2021Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?cited by 91
- 2024Instruct-SkillMix: A Powerful Pipeline for LLM Instruction Tuningcited by 27
Built on by
Citing papers per year: 2026: 6.
6 papers.
- 2026Regularized f-Divergence Kernel Testscited by 2
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
- 2026Erased, but Not Gone: Output Forgetting Is Not True Forgettingcited by 0
- 2026Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpointscited by 0
- 2026When Is Deletion Ordering Tractable? From Update Dynamics to Permutation Structurecited by 0
- 2026Why Forget-Only Unlearning Needs Memorizationcited by 0
- 2026Why Forget-Only Unlearning Needs Memorization7 Oct 2026
- 2026When Is Deletion Ordering Tractable? From Update Dynamics to Permutation Structure1 Oct 2026
- 2026Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints10 Sep 2026
- 2026Erased, but Not Gone: Output Forgetting Is Not True Forgetting23 Jun 2026
- 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilities29 Jan 2026
- 2026Regularized f-Divergence Kernel Tests27 Jan 2026
Similar, not cited
Close in wording, no citation either way
- 2024Rethinking Machine Unlearning for Large Language Models
- 2025Model Collapse Is Not a Bug but a Feature in Machine Unlearning for LLMs
- 2025LLM Unlearning Reveals a Stronger-Than-Expected Coreset Effect in Current Benchmarks
- 2026Why Some Models Resist Unlearning: A Linear Stability Perspective
- 2026CALIBURN: Self-Calibrated LLM Unlearning Alignment
- 2026Explainable LLM Unlearning Through Reasoning
- 2026Distance Is Not Enough: Forget-Retain Alignment Gap Predicts LLM Relearning Robustness
- 2025Reasoning Model Unlearning: Forgetting Traces, Not Just Answers, While Preserving Reasoning Skills