Gauss-Newton Unlearning for the LLM Era
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
Standard large language model training can create models that produce outputs their trainer deems unacceptable in deployment. The probability of these outputs can be reduced using methods such as LLM unlearning. However, unlearning a set of data (called the forget set) can degrade model performance on other distributions where the trainer wants to retain the model's behavior. To improve this trade-off, we demonstrate that using the forget set to compute only a few uphill Gauss-Newton steps provides a conceptually simple, state-of-the-art unlearning approach for LLMs. While Gauss-Newton steps adapt Newton's method to non-linear models, it is non-trivial to efficiently and accurately compute such steps for LLMs. Hence, our approach crucially relies on parametric Hessian approximations such as Kronecker-Factored Approximate Curvature (K-FAC). We call this combined approach K-FADE (K-FAC for Distribution Erasure). Our evaluation on the WMDP and ToFU benchmarks demonstrates that K-FADE suppresses outputs from the forget set and approximates, in output space, the results of retraining without the forget set. Critically, our method does this while altering the outputs on the retain set less than previous methods. This is because K-FADE transforms a constraint on the model's outputs across the entire retain set into a constraint on the model's weights, allowing the algorithm to minimally change the model's behavior on the retain set at each step. Moreover, the unlearning updates computed by K-FADE can be reapplied later if the model undergoes further training, allowing unlearning to be cheaply maintained.
Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 57 of its 81 references that are in the map. First posted on arXiv 11 Feb 2026.
Builds on
57 of 81 references.
Closest ancestors · 17
Same direction, newest first
- 2024Attribute-to-Delete: Machine Unlearning via Datamodel Matching30 Oct
- 2024Do Unlearning Methods Remove Information from Language Model Weights?11 Oct
- 2024Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning9 Oct
- 2024Erasing Conceptual Knowledge from Language Models3 Oct
- 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Models8 Jul
- 2024SOUL: Unlocking the Power of Second-Order Optimization for LLM Unlearning28 Apr
- 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
- 2024Second-Order Information Matters: Revisiting Machine Unlearning for Large Language Models13 Mar
- 2024Machine Unlearning of Pre-trained Large Language Models23 Feb
- 2024Rethinking Machine Unlearning for Large Language Models13 Feb
- 2024TOFU: A Task of Fictitious Unlearning for LLMs11 Jan
- 2023Large Language Model Unlearning14 Oct
5 more
- 2023Model Sparsity Can Simplify Machine Unlearning11 Apr
- 2023Towards Unbounded Machine Unlearning20 Feb
- 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct
- 2022Continual Learning and Private Unlearning24 Mar
- 2021On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning22 Oct
Other references · 40
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2024Qwen2.5 Technical Reportcited by 4,713
- 2023Mistral 7Bcited by 3,065
- 2016Pointer Sentinel Mixture Modelscited by 2,992
- 2022Locating and Editing Factual Associations in GPTcited by 2,609
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2020GLU Variants Improve Transformercited by 1,724
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
28 more
- 2022Editing Models with Task Arithmeticcited by 1,076
- 2019Machine Unlearningcited by 1,020
- 2022Mass-Editing Memory in a Transformercited by 976
- 2015Optimizing Neural Networks with Kronecker-factored Approximate Curvaturecited by 776
- 2023PyTorch FSDP: Experiences on Scaling Fully Sharded Data Parallelcited by 641
- 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 599
- 2023Textbooks Are All You Need II: phi-1.5 technical reportcited by 559
- 2019Certified Data Removal from Machine Learning Modelscited by 512
- 2023Zephyr: Direct Distillation of LM Alignmentcited by 498
- 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 488
- 2014New insights and perspectives on the natural gradient methodcited by 435
- 2023Studying Large Language Model Generalization with Influence Functionscited by 311
- 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
- 2023TRAK: Attributing Model Behavior at Scalecited by 273
- 2023Sophia: A Scalable Stochastic Second-order Optimizer for Language Model Pre-trainingcited by 260
- 2020Approximate Data Deletion from Machine Learning Modelscited by 250
- 2022Are Large Pre-Trained Language Models Leaking Your Personal Information?cited by 195
- 2018Fast Approximate Natural Gradient Descent in a Kronecker-factored Eigenbasiscited by 143
- 2022If Influence Functions are the Answer, Then What is the Question?cited by 142
- 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 132
- 2024Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Modelscited by 122
- 2024Representation Noising: A Defence Mechanism Against Harmful Finetuningcited by 93
- 2024Antidote: Post-fine-tuning Safety Alignment for Large Language Models against Harmful Fine-tuningcited by 71
- 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 66
- 2024On Evaluating the Durability of Safeguards for Open-Weight LLMscited by 51
- 2019Eigenvalue and Generalized Eigenvalue Problems: Tutorialcited by 45
- 2023Gradients Look Alike: Sensitivity is Often Overestimated in DP-SGDcited by 11
- 2025Position: Curvature Matrices Should Be Democratized via Linear Operatorscited by 9
Built on by
Citing papers per year: 2026: 4.
4 papers.
- 2026AIM: Anchor Identity Features, Then Match for Multimodal Large Language Model Unlearningcited by 1
- 2026WIN-U: Woodbury-Informed Newton-Unlearning as a retain-free Machine Unlearning Frameworkcited by 0
- 2026RepSelect: Robust LLM Unlearning via Representation Selectivitycited by 0
- 2026LLM Unlearning for Cyber Defense: A Survey on Methods, Challenges, and Emerging Threatscited by 0
- 2026AIM: Anchor Identity Features, Then Match for Multimodal Large Language Model Unlearning28 Aug 2026
- 2026LLM Unlearning for Cyber Defense: A Survey on Methods, Challenges, and Emerging Threats23 Jun 2026
- 2026RepSelect: Robust LLM Unlearning via Representation Selectivity15 Jun 2026
- 2026WIN-U: Woodbury-Informed Newton-Unlearning as a retain-free Machine Unlearning Framework15 Apr 2026