mlsanityData to 14 Oct 2026

LLM Unlearning for Cyber Defense: A Survey on Methods, Challenges, and Emerging Threats

arXiv 2607.16227 ↗First posted 23 Jun 2026cs.LG cs.CRcited by 0

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

LLMs are increasingly deployed in security-critical systems across healthcare, finance, education, and decision support, yet their inability to forget creates serious cybersecurity, privacy, and safety risks. Sensitive personal information, copyrighted material, hazardous domain knowledge, and memorized training data remain encoded across billions of parameters long after deployment, leaving models vulnerable to extraction, jailbreak attacks, membership inference, and regulatory non-compliance. Real-world incidents, from chatbots regenerating private information to fabricated legal citations producing direct legal and financial cost, place the problem at the center of the emerging-threats landscape rather than the realm of speculation. Because retraining billion-parameter models on revised corpora is computationally infeasible, and because knowledge within an LLM is distributed and entangled across parameters rather than localized to identifiable units, LLM unlearning has emerged as the principal cyber defense response, aiming to remove or suppress targeted knowledge from a trained model without retraining and without eroding what the model should still know. A central question, however, remains unresolved. Do current methods genuinely remove knowledge, or do they only stop the model from expressing it under ordinary prompting conditions? This survey examines LLM unlearning through the lens of security, robustness, and verifiable forgetting, with primary focus on gradient-based methods, which have come to dominate the field due to their compatibility with existing training pipelines and their scalability to billion-parameter models.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 74 of its 111 references that are in the map. First posted on arXiv 23 Jun 2026.

Builds on

74 of 111 references.

References · 74

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  4. 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,326
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
  7. 2016Deep Learning with Differential Privacycited by 2,728
  8. 2022Locating and Editing Factual Associations in GPTcited by 2,691
  9. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  10. 2020Transformer Feed-Forward Layers Are Key-Value Memoriescited by 1,336
  11. 2022Mass-Editing Memory in a Transformercited by 1,001
  12. 2022Quantifying Memorization Across Neural Language Modelscited by 763
38 more
  1. 2023A Comprehensive Overview of Large Language Modelscited by 648
  2. 2019Eternal Sunshine of the Spotless Net: Selective Forgetting in Deep Networkscited by 618
  3. 2019Certified Data Removal from Machine Learning Modelscited by 535
  4. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  5. 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearningcited by 504
  6. 2021Fast Model Editing at Scalecited by 498
  7. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  8. 2022Memory-Based Model Editing at Scalecited by 447
  9. 2023SalUn: Empowering Machine Unlearning via Gradient-based Weight Saliency in Both Image Classification and Generationcited by 386
  10. 2020Influence Functions in Deep Learning Are Fragilecited by 252
  11. 2024AlphaEdit: Null-Space Constrained Knowledge Editing for Language Modelscited by 236
  12. 2023In-Context Unlearning: Language Models as Few Shot Unlearnerscited by 224
  13. 2024Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Toolscited by 176
  14. 2023PMET: Precise Model Editing in a Transformercited by 173
  15. 2023Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attackscited by 158
  16. 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 138
  17. 2022Training Data Influence Analysis and Estimation: A Surveycited by 135
  18. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 123
  19. 2023When MOE Meets LLMs: Parameter Efficient Fine-tuning for Multi-task Medical Applicationscited by 111
  20. 2023Copyright Violations and Large Language Modelscited by 108
  21. 2023Machine Unlearning: Solutions and Challengescited by 93
  22. 2024WISE: Rethinking the Knowledge Memory for Lifelong Model Editing of Large Language Modelscited by 92
  23. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 91
  24. 2024Reversing the Forget-Retain Objectives: An Efficient LLM Unlearning Framework from Logit Differencecited by 88
  25. 2025Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyondcited by 79
  26. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directionscited by 63
  27. 2019Quick and (not so) Dirty: Unsupervised Selection of Justification Sentences for Multi-hop Question Answeringcited by 59
  28. 2024Selective Reflection-Tuning: Student-Selected Data Recycling for LLM Instruction-Tuningcited by 57
  29. 2024Soft Prompting for Unlearning in Large Language Modelscited by 46
  30. 2024Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancementcited by 45
  31. 2024Digital Forgetting in Large Language Models: A Survey of Unlearning Methodscited by 40
  32. 2024A Review on Machine Unlearningcited by 32
  33. 2024Unlearning as multi-task optimization: A normalized gradient difference approach with an adaptive learning ratecited by 31
  34. 2025LLM Unlearning with LLM Beliefscited by 17
  35. 2022Adapting and Evaluating Influence-Estimation Methods for Gradient-Boosted Decision Treescited by 16
  36. 2025RULE: Reinforcement UnLEarning Achieves Forget-Retain Pareto Optimalitycited by 16
  37. 2024Detecting Training Data of Large Language Models via Expectation Maximizationcited by 13
  38. 2025Ascent Fails to Forgetcited by 12

50 most cited of 74 All 74 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Primus: A Pioneering Collection of Open-Source Datasets for Cybersecurity LLM Training
  2. 2025Unlearning Imperative: Securing Trustworthy and Responsible LLMs through Engineered Forgetting
  3. 2025LLM Unlearning Should Be Form-Independent
  4. 2025From Narrow Unlearning to Emergent Misalignment: Causes, Consequences, and Containment in LLMs
  5. 2023LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testing
  6. 2025Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques
  7. 2025Dark LLMs: The Growing Threat of Unaligned AI Models
  8. 2025Less Data, More Security: Advancing Cybersecurity LLMs Specialization via Resource-Efficient Domain-Adaptive Continuous Pre-training with Minimal Tokens