Is your algorithm unlearning or untraining?
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
As models are getting larger and are trained on increasing amounts of data, there has been an explosion of interest into how we can ``delete'' specific data points or behaviours from a trained model, after the fact. This goal has been referred to as ``machine unlearning''. In this note, we argue that the term ``unlearning'' has been overloaded, with different research efforts spanning two distinct problem formulations, but without that distinction having been observed or acknowledged in the literature. This causes various issues, including ambiguity around when an algorithm is expected to work, use of inappropriate metrics and baselines when comparing different algorithms to one another, difficulty in interpreting results, as well as missed opportunities for pursuing critical research directions. In this note, we address this issue by establishing a fundamental distinction between two notions that we identify as unlearning and untraining, illustrated in Figure 1. In short, untraining aims to reverse the effect of having trained on a given forget set, i.e. to remove the influence that that specific forget set examples had on the model during training. On the other hand, the goal of unlearning is not just to remove the influence of those given examples, but to use those examples for the purpose of more broadly removing the entire underlying distribution from which those examples were sampled (e.g. the concept or behaviour that those examples represent). We discuss technical definitions of these problems and map problem settings studied in the literature to each. We hope to initiate discussions on disambiguating technical definitions and identify a set of overlooked research questions, as we believe that this a key missing step for accelerating progress in the field of ``unlearning''.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 58 of its 73 references that are in the map. First posted on arXiv 9 Apr 2026.
Builds on
58 of 73 references.
Closest ancestors · 31
Same direction, newest first
- 2025LLM Unlearning with LLM Beliefs22 Oct
- 2025From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization28 May
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted data23 May
- 2025Data Unlearning in Diffusion Models2 Mar
- 2025Open Problems in Machine Unlearning for AI Safety9 Jan
- 2024Do Unlearning Methods Remove Information from Language Model Weights?11 Oct
- 2024An Adversarial Perspective on Machine Unlearning for AI Safety26 Sep
- 2024Unlearning Personal Data from a Single Image16 Jul
- 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Models8 Jul
- 2024UnUnlearning: Unlearning is not sufficient for content regulation in advanced generative AI27 Jun
- 2024Machine Unlearning Fails to Remove Data Poisoning Attacks25 Jun
- 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning19 Jun
19 more
- 2024Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition13 Jun
- 2024To Each (Textual Sequence) Its Own: Improving Memorized-Data Unlearning in Large Language Models6 May
- 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
- 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacy2 Mar
- 2024Eight Methods to Evaluate Robust Unlearning in LLMs26 Feb
- 2024Corrective Machine Unlearning21 Feb
- 2024Towards Safer Large Language Models through Machine Unlearning15 Feb
- 2024Rethinking Machine Unlearning for Large Language Models13 Feb
- 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generation19 Oct
- 2023Large Language Model Unlearning14 Oct
- 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
- 2023Who's Harry Potter? Approximate Unlearning in LLMs3 Oct
- 2023Towards Unbounded Machine Unlearning20 Feb
- 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct
- 2022A Survey of Machine Unlearning6 Sep
- 2022Towards Adversarial Evaluations for Inexact Machine Unlearning17 Jan
- 2021Unrolling SGD: Understanding Factors Influencing Machine Unlearning27 Sep
- 2021Adaptive Machine Unlearning8 Jun
- 2021Remember What You Want to Forget: Algorithms for Machine Unlearning4 Mar
Other references · 27
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
- 2018Spectral Normalization for Generative Adversarial Networkscited by 1,618
- 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,404
- 2019Machine Unlearningcited by 1,020
- 2021Membership Inference Attacks From First Principlescited by 839
- 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 599
- 2022Grokking: Generalization Beyond Overfitting on Small Algorithmic Datasetscited by 599
- 2020Estimating Training Data Influence by Tracing Gradient Descentcited by 565
- 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 492
- 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 488
15 more
- 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
- 2020Descent-to-Delete: Gradient-Based Methods for Machine Unlearningcited by 303
- 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Modelscited by 297
- 2020Forgetting Outside the Box: Scrubbing Deep Networks of Information Accessible from Input-Output Observationscited by 171
- 2022Omnigrok: Grokking Beyond Algorithmic Datacited by 142
- 2020Characterizing Structural Regularities of Labeled Data in Overparameterized Modelscited by 93
- 2022Backdoor Defense with Machine Unlearningcited by 61
- 2024Deep Networks Always Grok and Here is Whycited by 49
- 2025Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilitiescited by 36
- 2024From Theft to Bomb-Making: The Ripple Effect of Unlearning in Defending Against Jailbreak Attackscited by 29
- 2024Potion: Towards Poison Unlearningcited by 14
- 2024Information Complexity of Stochastic Convex Optimization: Applications to Generalization and Memorizationcited by 12
- 2025Erasing More Than Intended? How Concept Erasure Degrades the Generation of Non-Target Conceptscited by 12
- 2025Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacycited by 11
- 2026Position: Capability Control Should be a Separate Goal From Alignmentcited by 2
Built on by
Citing papers per year: 2026: 3.
3 papers.
- 2026Unmerge: Efficient Machine Unlearning via Task Arithmetic30 Sep 2026
- 2026Bounding Retraining Equivalence and the Deletion Floor in Materials Machine Unlearning28 Sep 2026
- 2026Evaluating Machine Unlearning in ASR28 Sep 2026