GUARD: Guided Unlearning and Retention via Data Attribution for Large Language Models

Peizhi Niu; Evelyn Ma; Boya Hou; Huiting Zhou; Duo Zhou; Huan Zhang; S. Rasoul Etesami; Olgica Milenkovic

cs.LGJun 12, 2025

GUARD: Guided Unlearning and Retention via Data Attribution for Large Language Models

Authors: Peizhi Niu, Evelyn Ma, Boya Hou, Huiting Zhou, Duo Zhou, Huan Zhang, S. Rasoul Etesami, Olgica Milenkovic

Organizations: Department of Electrical & Computer Engineering, University of Illinois Urbana-Champaign

Abstract

Unlearning large language models (LLMs) is important due to copyright and privacy concerns. A key challenge is unintended forgetting, where removing data inadvertently impairs model utility. While prior work has focused on architectural innovations, the influence of data-level factors remains underexplored. We introduce GUARD, a framework for Guided Unlearning And Retention via Data Attribution. GUARD uses a lightweight proxy data attribution metric tailored to LLM unlearning, which efficiently quantifies the "alignment" between the Forget and Retain (or synthetic supplement) Sets. This metric leads to a new unlearning objective that assigns adaptive, nonuniform weights to samples, decaying exponentially with their proxy attribution scores, and thereby provably mitigates unintended retention loss. On the TOFU benchmark with a 10% forget set, applying GUARD to Gradient Ascent (GA) improves Retain Set ROUGE-L from 0.18 to 22.40 (a 124x increase) and Retain Probability from 0.06% to 17.50%, a substantial recovery from the GA collapse. Furthermore, GUARD combined with NPO (Negative Preference Optimization) outperforms Representation Misdirection for Unlearning (RMU) with 33.80% and 53.10% reductions in the Retain Set Sacrifice Rates computed from ROUGE-L and Probability ( $ρ_r$ and $ρ_p$ ), and a 16.01% improvement in knowledge retention on the MUSE NEWS Retain Set. These findings persist when attribution scores are computed using synthetic or highly subsampled (20%) Retain Sets, where NPO+GUARD still reduces $ρ_r$ and $ρ_p$ by up to 43.89% and 48.13% over NPO. Similar improvements are observed on MUSE, with a tolerable absolute privacy leakage degradation of 13.7 compared to the best-performing existing method in the privacy category.

Figures & tables

Method	Signal setting unlearning strength	Granularity	Retain	Hess.-	Guar-
			set	free	antee
GA	uniform	—	$\times$	$\checkmark$	$\times$
PO, GD, KM, RMU	uniform (plus a retain regularizer)	—	reg.	$\checkmark$	$\times$
NPO, SimNPO	forget likelihood (ratio / reference-free)	per-sample	reg.	$\checkmark$	$\times$
FLAT	$f$ -divergence, template vs. forget response	per-branch	$\times$	$\checkmark$	$\times$
SatImp	token saturation / importance	per-token	reg.	$\checkmark$	$\times$

Table 1: Positioning of GUARD . Granularity is the unit over which unlearning strength may vary (“—” = uniform). Retain set :

\times

= unused; reg. = used only as an additive regularizer, which leaves the allocation across forget units unchanged;

\checkmark

= determines the weights themselves. Hessian-free = no second-order estimate and no retraining, as originally defined; in Section 5 we compare against the first-order approximations of RelatIF and RIF so the comparison isolates the score, not the curvature machinery. Guar. = formal bound on retain-side loss relative to a baseline. References: NPO ( Zhang et al., 2024a ) , SimNPO ( Fan et al., 2024 ) , FLAT ( Wang et al., 2024 ) , SatImp ( Yang et al., 2025 ) , WGA and TNPO ( Wang et al., 2025b ) , WAGLE ( Jia et al., 2024 ) , influence functions ( Koh & Liang, 2017 ) , TRAK ( Park et al., 2023 ) , EK-FAC ( Grosse et al., 2023 ) , RelatIF ( Barshan et al., 2020 ) , and RIF ( Rubinstein & Hopkins, 2025 ) .

Figure 1: The pipeline. Step 1: Compute the proxy data attribution score $a^{\text{GUARD}}_{i}$ for each forget sample as the inner product of its gradient and the average gradient of the Retain Set. Step 2: Convert the scores into per-sample unlearning weights $\omega^{\text{GUARD}}_{i}$ via temperature-scaled reverse Softmax unification. Step 3: Apply the retention-aware weights to the unlearning objective.

Figure 2: Empirical distribution of

\mathrm{LHS}-\mathrm{RHS}

for the sufficient condition ( 8 ) for

50

trials, each on a random subsample of MUSE BOOKS (

\tau=0.03

). Green/red bars indicate trials where the sufficient condition is satisfied/violated. The condition holds for

20

of the

50

trials, and the gaps are small (

|\mathrm{LHS}-\mathrm{RHS}|<0.004

Methods	Retain Set( $\downarrow$ )			Real Author Set( $\downarrow$ )			Real World Set( $\downarrow$ )
Methods	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$
GA	100.17	99.87	121.09	94.80	21.71	69.67	89.72	17.63	46.36
GA + GUARD	78.98	83.46	84.29	79.63	16.45	49.90	68.39	12.05	26.64
KM	100.05	99.86	118.67	94.71	17.92	60.88	89.64	16.72	45.51
KM + GUARD	82.13	86.05	89.15	81.74	13.75	42.74	70.21	12.84	29.48
PO	21.84	36.72	60.00	45.02	34.20	317.41	4.23	17.35	198.15

Table 2: Unlearning experiments for LLaMA-2-7B on

10\%

of TOFU data points. Arrows (

\uparrow

\downarrow

) indicate whether higher/lower values are preferred; bold numbers indicate the lower value within each (baseline, baseline+ GUARD ) pair for GA, KM, PO, and GD, and the lowest value among the loss-reweighting methods, RMU, and NPO+ GUARD . GUARD reduces retention degradation compared to baselines.

Methods	Retain Set			Forget Set
Methods	ROUGE-L ( $\uparrow$ )	Prob. (%) ( $\uparrow$ )	T.Ratio ( $\uparrow$ )	ROUGE-L ( $\downarrow$ )	Prob. (%) ( $\downarrow$ )	T.Ratio ( $\uparrow$ )
w/o Unlearn	98.57	98.95	47.47	98.54	99.09	51.60
GA	0.18	0.06	8.42	0.32	0.07	83.85
GA + GUARD	22.40	17.50	23.11	2.10	1.50	80.50
KM	0.18	0.05	7.18	0.20	0.05	85.55
KM + GUARD	19.20	14.80	20.10	1.90	1.30	82.30

Table 3: Impact of GUARD on Absolute Performance for the Retain and Forget Sets for LLaMA-2-7B on

10\%

of TOFU data points. Arrows indicate the preferred direction following TOFU ( Maini et al., 2024 ) ; bold letters indicate the top performers within (baseline, baseline+ GUARD ) pairs for GA, KM, PO, and GD, and loss-reweighting methods, RMU, and NPO+ GUARD . GUARD consistently improves ROUGE-L and Probability on the Retain Set, and also improves the Retain Truth Ratio for GA, KM, and PO.

NEWS
Methods	Forget Set VerbMem	Forget Set KnowMem	PrivLeak	Retain Set KnowMem
Methods	( $\downarrow$ )	( $\downarrow$ )	( $\in[-5\%,5\%]$ )	( $\uparrow$ )
w/o Unlearn	58.4	63.9	-99.8	55.2
GA	0.0	0.0	5.6	0.0
GA + GUARD	0.0	0.0	6.4	8.7
KM	27.8	50.1	-95.8	43.9

Table 4: Unlearning experiments with LLaMA-2-7B on the MUSE NEWS dataset, “w/o Unlearn” is the released MUSE NEWS target model.

Methods	Retain Set					Forget Set
Methods	ROUGE-L ( $\uparrow$ )	Prob. (%) ( $\uparrow$ )	T. Ratio ( $\uparrow$ )	$\rho_{r}$ ( $\downarrow$ )	$\rho_{p}$ ( $\downarrow$ )	ROUGE-L ( $\downarrow$ )	Prob. (%) ( $\downarrow$ )	T. Ratio ( $\uparrow$ )
NPO	78.50	92.30	49.80	31.69	10.97	35.20	38.50	67.30
RMU (full retain)	84.50	95.20	49.10	21.63	6.12	33.50	37.80	64.50
NPO + GUARD (Full Retain)	89.30	97.20	48.30	14.32	2.87	33.80	38.20	65.20
NPO + GUARD ( $20\%$ Retain)	87.20	95.50	48.65	17.78	5.69	34.59	38.47	64.81
NPO + GUARD (Synthetic Retain)	86.10	94.80	48.85	19.60	6.85	34.92	38.55	64.55

Table 5: GUARD used with subsampled (random,

20\%

) and synthetic (GPT-4 generated, no original retain data) Retain Sets on TOFU forget10 (LLaMA-2-7B). In both cases, GUARD retains its gains over NPO and, in Retain ROUGE-L and

\rho_{r}

, over RMU (which inherently requires knowledge of the Retain Set): The synthetic-retain GUARD , using no original retain data for attribution, outperforms RMU at full retain access wrt Retain ROUGE-L and

\rho_{r}

. The synthetic proxy is competitive with

20\%

random subsampling.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 3: Empirical distribution of

\mathrm{LHS}-\mathrm{RHS}

in the sufficient condition ( 46 ) across

50

trials, each using the full TOFU forget10 split (

n_{f}=400

) and a random retain subsample (

n_{r}=400

) (LLaMA-2-7B,

\tau=0.03

). Green bars indicate trials where the sufficient condition is satisfied, red bars indicate violations.

Method	Hyperparameter	TOFU	MUSE
GA	—	—	—
PO	—	—	—
GD	retain weight $\lambda$	$1.0$	$1.0$
KM	KL weight $\lambda$	$1.0$	$1.0$
NPO	inverse temperature $\beta$	$0.1$ (default)	$0.08$ (lowered for privacy)
	retain composite weight	$1.0$	$1.0$

Appendix

Table 6: Algorithm-internal hyperparameters of all baselines and GUARD on TOFU and MUSE. All values follow the corresponding original papers / official codebases except RMU and NPO on MUSE , where we set

\beta=0.08

(vs. the default

0.1

) to obtain a more thorough forget-side decay. This brings PrivLeak meaningfully closer to the ideal

[-5\%,5\%]

window at the cost of a modest Retain KnowMem decrease. “—” indicates no algorithm-internal hyperparameters present beyond the learning rate.

Methods	Retain Set( $\downarrow$ )			Real Author Set( $\downarrow$ )			Real World Set( $\downarrow$ )
Methods	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$
GA	17.53	3.94	-2.81	5.56	4.22	52.92	0.44	1.86	1.94
GA + GUARD	12.30	2.75	-2.00	4.00	3.10	38.00	0.30	1.30	1.50
KM	18.28	3.90	-3.04	5.72	4.37	56.30	-1.33	1.90	3.26
KM + GUARD	12.50	2.80	-2.20	4.20	3.20	40.00	-0.90	1.40	2.50
PO	11.20	16.73	29.90	-1.48	-8.36	-12.06	0.39	-21.10	-7.41

Appendix

Table 7: Unlearning experiments with LLaMA-2-7B on

1\%

of all data points in TOFU under the official TOFU protocol; all values are reported at the final (

5

-th) unlearning epoch. GUARD consistently reduces the Sacrifice Rates across all baselines and evaluation metrics wherever the baseline degrades performance (positive values).

Methods	Retain Set( $\downarrow$ )			Real Author Set( $\downarrow$ )			Real World Set( $\downarrow$ )
Methods	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$
GA	100.14	99.63	204.51	94.56	17.50	103.89	89.64	16.38	113.42
GA + GUARD	83.31	86.52	158.75	77.47	13.61	84.57	72.03	12.14	96.46
KM	99.68	100.02	454.89	95.09	18.71	281.02	89.10	12.69	212.39
KM + GUARD	82.16	86.39	418.08	76.11	14.93	261.36	71.02	8.38	195.91
PO	33.52	41.04	66.15	78.82	26.54	121.14	14.30	9.16	78.52

Appendix

Table 8: Unlearning experiments with LLaMA-2-7B on

5\%

of all data points in TOFU under the official TOFU protocol; all values are reported at the final (

5

-th) unlearning epoch. GUARD consistently reduces the Sacrifice Rates across all evaluation metrics and baselines wherever the baseline degrades performance (positive values), with the most substantial gains observed on the Retain Set for GD (

\rho_{r}

and

\rho_{p}

reduced by

39.32\%

and

47.14\%

) and PO (

\rho_{t}

reduced by

39.53\%

	Retain Set ( $\downarrow$ )			Real Author Set ( $\downarrow$ )			Real World Set ( $\downarrow$ )
Methods	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$
GA	4.83	2.27	-0.35	-17.79	3.01	117.87	7.01	2.97	105.41
GA+GUARD	-1.58	0.85	0.77	-15.90	1.61	104.06	6.17	2.15	104.72
GD	9.21	0.96	210.08	-6.35	0.89	-63.85	10.91	0.44	32.37
GD+GUARD	4.77	-0.20	208.53	-4.23	-0.43	-46.32	10.64	-0.31	30.40
KM	5.82	2.59	-8.36	-9.09	1.85	114.83	10.47	2.23	112.09

Appendix

Table 9: Sacrifice rate (

\%

) of different unlearning methods when unlearning Phi-1.5B on

1\%

of TOFU data, under the official TOFU protocol; all values are reported at the final (

5

-th) unlearning epoch. Across all datasets (Retain Set, Real Author Set, and Real World Set), GUARD consistently reduces the sacrifice rate across various methods (GA, GD, KM, PO) wherever the baseline degrades performance (positive values). On the Retain Set, GUARD lowers

\rho_{r}

of GA from

4.83

-1.58

\rho_{p}

13.38\%

over PO, and

\rho_{t}

11.99\%

over PO.

	Retain Set ( $\downarrow$ )			Real Author Set ( $\downarrow$ )			Real World Set ( $\downarrow$ )
Methods	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$
GA	96.88	95.89	102.48	34.08	2.14	36.04	23.06	2.46	22.87
GA+GUARD	78.49	79.21	83.34	25.77	-0.20	31.01	7.87	-0.97	11.20
GD	81.30	46.58	40.28	35.73	-0.61	10.57	23.39	1.50	28.14
GD+GUARD	67.92	34.43	36.41	26.66	-0.53	8.02	15.11	1.33	24.53
KM	96.65	94.02	94.36	29.07	2.61	37.23	33.37	3.69	31.62

Appendix

Table 10: Sacrifice Rate of GUARD upon unlearning Phi-1.5B on

5\%

of all datapoints in TOFU, under the official TOFU protocol; all values are reported at the final (

5

-th) unlearning epoch. When unlearning a larger portion (compared to the portion of

1\%

in Table 9 ) of the dataset, GUARD generally induces a larger absolute reduction on the sacrifice rate across all evaluation sets (Retain Set, Real Author Set, and Real World Set) and methods (GA, GD, KM, and PO). On the Retain Set, GUARD lowers

\rho_{r}

19.54\%

over KM,

\rho_{p}

21.65\%

over KM, and

\rho_{t}

18.68\%

over GA. On the Real World Set, GA+ GUARD achieves a negative

\rho_{p}

while GA does not, indicating that GUARD can in some cases improve generalization by reducing overfitting on the Forget Set.

	Retain Set ( $\downarrow$ )			Real Author Set ( $\downarrow$ )			Real World Set ( $\downarrow$ )
Methods	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$
GA	100.25	99.77	124.13	47.76	10.96	28.72	86.85	17.56	61.66
GA+GUARD	81.50	83.43	98.51	38.20	8.50	22.10	67.30	12.40	42.80
GD	80.69	68.66	22.79	44.41	-0.62	-12.76	37.96	0.78	-16.15
GD+GUARD	63.20	52.40	16.80	32.50	-0.50	-9.40	27.40	0.55	-11.50
KM	100.59	99.77	121.35	47.44	11.67	27.42	86.27	17.81	59.41

Appendix

Table 11: Sacrifice Rate of GUARD upon unlearning Phi-1.5B on

10\%

of all datapoints in TOFU, under the official TOFU protocol; all values are reported at the final (

5

-th) unlearning epoch. When unlearning a larger portion of the dataset, GUARD generally induces an even larger absolute reduction on the sacrifice rate across all evaluation sets (Retain Set, Real Author Set, and Real World Set) and methods (GA, GD, KM, and PO). On the Retain Set, GUARD lowers

\rho_{r}

19.38\%

over PO,

\rho_{p}

30.48\%

over PO, and

\rho_{t}

20.64\%

over GA.

BOOKS
Methods	Forget Set VerbMem	Forget Set KnowMem	PrivLeak	Retain Set KnowMem
Methods	( $\downarrow$ )	( $\downarrow$ )	( $\in[-5\%,5\%]$ )	( $\uparrow$ )
w/o Unlearn	99.8	59.4	-57.5	66.9
GA	0.0	0.0	-25.4	0.0
GA + GUARD	0.0	0.0	-31.0	10.6
KM	15.7	22.3	-39.5	36.2

Appendix

Table 12: Unlearning experiments with ICLM-7B on the MUSE BOOKS dataset under the official MUSE protocol; “w/o Unlearn” is the released MUSE BOOKS target model.

Dataset	Model	Forget set	GA (min)	GA + GUARD (min)	Attribution (min)	Overhead
TOFU	LLaMA-2-7B	1%	4.2	5.1	0.9	21.4%
		5%	14.4	16.6	2.2	15.3%
		10%	32.3	35.5	3.2	9.9%
	Phi-1.5B	1%	2.8	3.0	0.2	7.1%
		5%	6.1	6.8	0.7	11.5%
		10%	14.5	15.6	1.1	7.6%

Appendix

Table 13: Per-epoch runtime of unlearning with and without GUARD, measured under the official TOFU and MUSE protocols. Attribution is the difference between the two runtimes, and Overhead is Attribution relative to the GA runtime.

Methods	MUSE NEWS (LLaMA-2-7B)				MUSE BOOKS (ICLM-7B)
Methods	Forget VerbMem	Forget KnowMem	PrivLeak	Retain KnowMem	Forget VerbMem	Forget KnowMem	PrivLeak	Retain KnowMem
	( $\downarrow$ )	( $\downarrow$ )	( $\in[-5\%,5\%]$ )	( $\uparrow$ )	( $\downarrow$ )	( $\downarrow$ )	( $\in[-5\%,5\%]$ )	( $\uparrow$ )
NPO	1.5	44.8	93.0	37.2	0.0	0.0	-32.0	24.3
RMU (full retain, reference)	1.5	44.0	95.0	43.1	0.0	0.0	-36.1	47.8
NPO + GUARD (full retain)	1.6	45.2	98.2	50.0	0.0	0.0	-38.4	52.4
NPO + GUARD ( $20\%$ retain)	1.6	45.4	97.5	47.6	0.0	0.0	-37.1	49.0

Appendix

Table 14: Robustness of GUARD under limited (random

20\%

) and synthetic (GPT-4 generated, with no original retain data used in the attribution) Retain Sets on MUSE NEWS (LLaMA-2-7B) and MUSE BOOKS (ICLM-7B), at the early-stopping checkpoint under MUSE’s official protocol. RMU is included at full retain access as a reference point for the strongest competing baseline. As on TOFU (Table 5 ), both GUARD ablations preserve most of full-retain GUARD ’s Retain KnowMem gain over NPO; on NEWS, the synthetic-retain variant already outperforms RMU at full retain access, and on BOOKS it remains comparable. Bold marks the column-wise best across all rows; PrivLeak is reported for completeness (values closer to

0

are preferred).

Figure 4: Raw Score and Inverse unified score under different temperatures $\tau$ for the $40$ samples of the TOFU forget01 split (Phi-1.5B), ordered by score (gradient-product attribution, exponential unification).

Methods	Retain Set( $\downarrow$ )			Real Author Set( $\downarrow$ )			Real World Set( $\downarrow$ )
Methods	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$	$\rho_{r}$	$\rho_{p}$	$\rho_{t}$
NPO + ES	26.53	9.04	-12.54	19.60	10.20	-17.40	4.80	4.10	-14.30
NPO + RelatIF	22.08	6.35	-9.85	17.40	9.10	-14.50	4.10	3.50	-13.10
NPO + RIF	19.08	4.52	-8.50	16.20	8.70	-13.20	3.60	3.20	-12.30
NPO + GUARD	14.32	2.87	-6.10	13.59	7.14	-10.44	2.70	2.23	-10.29

Appendix

Table 15: Comparison of the performance of different attribution methods integrated with NPO on the TOFU benchmark (LLaMA-2-7B,

10\%

forget split) under the official TOFU protocol; values reported at the final (

5

-th) unlearning epoch. GUARD outperforms both the feature-based baseline (ES) and other first-order influence approximations (RelatIF, RIF) across all evaluation sets in

\rho_{r}

and

\rho_{p}

. The substantially lower sacrifice rates on the Retain Set demonstrate that the gradient-alignment strategy of GUARD minimizes unintended harm to preserved knowledge more effectively than alternative attribution metrics.

Methods	Retain Set			Forget Set
Methods	ROUGE-L ( $\uparrow$ )	Prob. (%) ( $\uparrow$ )	T.Ratio ( $\uparrow$ )	ROUGE-L ( $\downarrow$ )	Prob. (%) ( $\downarrow$ )	T.Ratio ( $\uparrow$ )
NPO + ES	81.50	93.50	49.20	34.20	38.80	65.40
NPO + RelatIF	84.30	95.10	48.80	33.90	38.50	65.10
NPO + RIF	86.20	96.20	48.60	33.70	38.30	64.90
NPO + GUARD	89.30	97.20	48.30	33.80	38.20	65.20

Appendix

Table 16: Comparison of absolute performance metrics between GUARD and alternative attribution methods integrated with NPO, under the official TOFU protocol; values reported at the final (

5

-th) unlearning epoch. Per-metric arrows follow TOFU ( Maini et al., 2024 ) . While all methods achieve comparable forgetting strength on the Forget Set, GUARD delivers the highest Retain ROUGE-L and Probability.

Machine Unlearning

Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.

See all 343 papers

May 29, 2026

De-attribute to Forget for LLM Unlearning

The rapid development of large language models (LLMs) has raised concerns on the use of inappropriate data for training, which has led to a growing interest in LLM unlearning. Many existing LLM unlearning approaches rely on optimizing prediction loss(es), such as maximizing the loss on the forget set, but often face critical issues like over-forgetting and poor model utility. To address them, this paper novelly frames the optimization objective for LLM unlearning as one of zeroing out data attribution instead. In particular, we propose the first LLM unlearning framework based on data attribution rewards called DareU that performs reinforcement learning to update the LLM by reducing the attribution score of its generated responses (i.e., de-attributing) to the forget data owners. Empirical evaluation using an LLM classifier as an efficient approximation of attribution shows that DareU outperforms existing baselines by achieving effective unlearning while balancing forget quality and model utility well.

Xinyang Lu, Jiabao Pan, Rachael Hwee Ling Sim +3

Department of Computer Science, National University of Singapore, Singapore 117417.

Machine Unlearning LLM Unlearning

Ask PDF

Aug 28, 2025

Towards Mitigating Excessive Forgetting in LLM Unlearning via Entanglement-Guidance with Proxy Constraint

Large language models (LLMs) are trained on massive datasets that may include private or copyrighted content. Due to growing privacy and ownership concerns, data owners may request the removal of their data from trained models. Machine unlearning provides a practical solution by removing the influence of specific data without full retraining. However, most existing methods still suffer from over-unlearning due to the lack of a principled mechanism to regulate the forgetting boundary, leading to unnecessary utility degradation and heightened privacy and robustness risks. In this work, we propose EGUP (Entanglement-Guided Unlearning with Proxy Constraint), a novel framework that leverages entanglement and proxy constraint to guide the unlearning process while mitigating over-unlearning. Within each iteration, EGUP employs inter-sample entanglement to adaptively reweight the unlearning strength, assigning greater unlearning efforts to forget samples that are semantically closer to retained knowledge. Across iterations, EGUP leverages intra-sample entanglement to track the representation shift of each forget sample and dynamically adjust its unlearning effort. In addition, we incorporate a proxy constraint that approximates the model's expected outputs after unlearning, forming a reference boundary that softly regularizes the unlearning process. EGUP is compatible with existing gradient-based objectives and serves as a plug-and-play enhancement. We evaluate EGUP on the TOFU and MUSE benchmarks, demonstrating consistent improvements in the unlearning-utility trade-off across multiple LLMs. Moreover, EGUP achieves performance close to the retrained model while remaining scalable and robust.

Zhihao Liu, Jian Lou, Yuke Hu +6

Zhejiang University · Sun Yat-sen University · UNC Greensboro +1

Machine Unlearning LLM Unlearning

Ask PDF

Oct 14, 2026

RA $^2$ : Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning

Large Language Model (LLM) unlearning is often evaluated primarily by target suppression and clean retain utility. These metrics can miss a local failure mode: a model may perform well on standard retain prompts, yet degrade on benign reasoning when prompts lie near the forgotten domain. This phenomenon is termed forget-adjacent utility loss. A fundamental question is: where should forget representations go after they leave the removed behavior? Successful unlearning depends not only on whether forget-conditioned representations depart from the harmful computation, but also on the direction in which they are redirected afterward. We propose RA

^2

(Retain-Anchored Attraction), a latent-space unlearning method that redirects forget-token states toward nearby retain-supported representations while preserving higher-layer behavior on retain data. On WMDP and MUSE, RA

^2

yields higher forget-adjacent utility than strong unlearning baselines at similar broad-utility levels. These results show that the migration direction of forget representations materially affects benign behavior near the forget boundary. Our code is available at https://github.com/ZacLing/retain_anchored_attraction.

Zinan Ling, Yang Xiao, Ruimeng Ye +2

The University of Tulsa · Michigan State University

Machine Unlearning LLM Unlearning Machine Unlearning Evaluation

Ask PDF

Abstract

Machine Unlearning

Explore similar work

De-attribute to Forget for LLM Unlearning

Towards Mitigating Excessive Forgetting in LLM Unlearning via Entanglement-Guidance with Proxy Constraint

RA2^22: Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning

RA $^2$ : Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning