# Toward Fine-Grained Forgetting:Attribute Unlearning for Multimodal Large Language Models

arXiv: https://arxiv.org/abs/2608.01008 · HTML: https://mlsanity.com/paper/2608.01008/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models.
- Builds on 19 of its 33 references that are in the map.
- First posted on arXiv 2 Aug 2026.

## Placed in

- Multimodal LLMs / vision-language models / [MLLM jailbreaks and adversarial robustness](https://mlsanity.com/mllm/mllm-jailbreaks-and-adversarial-robustness/)
- LLM safety and security / [Machine unlearning](https://mlsanity.com/safety/machine-unlearning/)

## Builds on (most cited first, 19 of 19)

- [Locating and Editing Factual Associations in GPT](https://mlsanity.com/paper/2202.05262/) (2022)
- [Qwen-Image Technical Report](https://mlsanity.com/paper/2508.02324/) (2025)
- [Steering Language Models With Activation Engineering](https://mlsanity.com/paper/2308.10248/) (2023)
- [TOFU: A Task of Fictitious Unlearning for LLMs](https://mlsanity.com/paper/2401.06121/) (2024)
- [Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning](https://mlsanity.com/paper/2404.05868/) (2024)
- [Null It Out: Guarding Protected Attributes by Iterative Nullspace Projection](https://mlsanity.com/paper/2004.07667/) (2020)
- [LEACE: Perfect linear concept erasure in closed form](https://mlsanity.com/paper/2306.03819/) (2023)
- [Devils in Middle Layers of Large Vision-Language Models: Interpreting, Detecting and Mitigating Object Hallucinations via Attention Lens](https://mlsanity.com/paper/2411.16724/) (2024)
- [CLEAR: Character Unlearning in Textual and Visual Modalities](https://mlsanity.com/paper/2410.18057/) (2024)
- [Benchmarking Vision Language Model Unlearning via Fictitious Facial Identity Dataset](https://mlsanity.com/paper/2411.03554/) (2024)
- [Targeted Unlearning with Single Layer Unlearning Gradient](https://mlsanity.com/paper/2407.11867/) (2024)
- [Unlearning Sensitive Information in Multimodal LLMs: Benchmark and Attack-Defense Evaluation](https://mlsanity.com/paper/2505.01456/) (2025)
- [MLLMEraser: Achieving Test-Time Unlearning in Multimodal Large Language Models through Activation Steering](https://mlsanity.com/paper/2510.04217/) (2025)
- [Multimodal Unlearning Across Vision, Language, Video, and Audio: Survey of Methods, Datasets, and Benchmarks](https://mlsanity.com/paper/2607.07907/) (2026)
- [Towards Benign Memory Forgetting for Selective Multimodal Large Language Model Unlearning](https://mlsanity.com/paper/2511.20196/) (2025)
- [SALMUBench: A Benchmark for Sensitive Association-Level Multimodal Unlearning](https://mlsanity.com/paper/2603.26316/) (2026)
- [Visual-Noise Guided In-Context Distillation for Multimodal Large Language Model Unlearning](https://mlsanity.com/paper/2606.00105/) (2026)
- [Selective, Controlled and Domain-Agnostic Unlearning in Pretrained CLIP: A Training- and Data-Free Approach](https://mlsanity.com/paper/2512.14113/) (2025)
- [Erasing CLIP Memories: Non-Destructive, Data-Free Zero-Shot class Unlearning in CLIP Models](https://mlsanity.com/paper/2512.14137/) (2025)

## Abstract (arXiv)

Multimodal large language models (MLLMs) can memorize and disclose sensitive information, motivating machine unlearning to remove designated knowledge while preserving model utility. Existing privacy-oriented benchmarks mainly study profile-level deletion, whereas practical requests often require finer-grained forgetting: removing a sensitive attribute while retaining other information about the same identity. We introduce attribute-level MLLM unlearning and construct AMU-Bench, covering long-text, numeric, and short-text targets, multiple forget ratios, and diverse question types. Our evaluation shows that target and retain attributes share identity-specific and visual evidence, making selective forgetting prone to residual leakage and collateral degradation. To address this challenge, we propose Causal Localization and Retain-Aware Projection (CLRP), a lightweight, training-free framework that localizes causally relevant layers and projects intermediate representations away from target-specific subspaces while preserving retain-related information. Experiments across MLLMs with different architectures and scales show that CLRP achieves a strong forgetting--retention trade-off on AMU-Bench. For example, at a 5% forget ratio, CLRP reduces Attribute Forget Set cloze accuracy from 20.00% to 4.00% while improving Attribute Retain Set accuracy from 14.77% to 17.79% in the reported LLaVA-1.5-7B and Qwen2.5-VL-3B results. These findings demonstrate effective and selective attribute-level unlearning without modifying model parameters.