Distance Is Not Enough: Forget-Retain Alignment Gap Predicts LLM Relearning Robustness

Yi Chen; Hanna Hsieh; Shuhong Liu; Chuanbo Hua; Zihan Ma; Kun Wang; Joo-Young Kim

cs.AIAug 26, 2026

Distance Is Not Enough: Forget-Retain Alignment Gap Predicts LLM Relearning Robustness

Authors: Yi Chen, Hanna Hsieh, Shuhong Liu, Chuanbo Hua, Zihan Ma, Kun Wang, Joo-Young Kim

Organizations: KAIST · The University of Tokyo

Abstract

Machine unlearning aims to make a model forget specific data, yet unlearned LLMs often fail to stay unlearned: brief fine-tuning can revive removed knowledge. Existing robustness predictors rely on global weight-space displacement, but distance alone can be misleading when random or destructive updates collapse performance. We argue that relearning robustness depends on update structure: robust unlearning should affect forget-critical weights while sparing retain-critical ones. We introduce the Forget-Retain Alignment Gap (FRAG), a training-free predictor that scores an update's forget-retain alignment without running a relearning attack, and separates selective from dense updates more reliably than global distance. Building on the forget-critical, retain-sparing principle, Forget-Retain Pruning (FRP) improves relearning robustness. Our results suggest that weight selectivity better explains robustness than distance alone. Code is available at https://github.com/Yi1-Chen/FRAG.

Figures & tables

Figure 1: Illustration of global $L_{2}$ and FRAG as attack-free predictors of relearning robustness. Large $L_{2}$ can falsely suggest robustness when edits hit retain-critical weights, while small $L_{2}$ can miss robust forget-critical edits. FRAG captures both cases by measuring whether updates target forget-critical while sparing retain-critical weights.

Figure 2: Curves are normalized by their own mean/std across unlearned checkpoints and noise controls. Global

\ell_{2}

and individual cosine terms peak on utility-collapsed perturbations, while FRAG peaks on the low-ES, retain-sparing FRP checkpoint.

	Global $\ell_{2}$		FRAG
	all	w/o	all	w/o
1B	$-0.56$	$-0.36$	$\mathbf{-0.92}$	$\mathbf{-0.85}$
3B	$-0.17$	$+0.13$	$\mathbf{-0.72}$	$\mathbf{-0.71}$
Pooled	$-0.36$	$-0.10$	$\mathbf{-0.78}$	$\mathbf{-0.74}$

Table 3: Spearman

\rho

between each predictor and

\Delta

ES under the forget+retain relearning attack, over healthy checkpoints only (5 methods

\times

3 splits

\times

2 models;

n\!=\!30

pooled). Collapsed and noise controls are excluded. More negative is better; “w/o” drops all FRP checkpoints (

n\!=\!24

) to rule out circularity.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Component		Setting
FRP	Sparsity	3% (MLP only)
	$\beta$	0.05
	Damage mode	zero out ( $W^{\prime}{=}0$ )
	Calibration	400 seq $\times$ 256 tok
	Precision	bf16 ( $\leq$ 3B), fp16 (7B+)
Setup	Baselines	OpenUnlearning defaults

Appendix

Table 4: FRP and infrastructure settings used across all benchmarks. Attack and evaluation protocols are in Appendix B.2 .

lr	gold	RMU	NPO	FRP
pre-attack	.060/.593	.035/.581	.085/.568	.062/.405
$5\mathrm{e}{-6}$	.062/.590	.047/.584	.104/.565	.095/.467
$1\mathrm{e}{-5}$	.068/.588	.461/.587	.137/.576	.120 /.484
$2\mathrm{e}{-5}$	.103/.582	.611/.592	.259/.590	.178 /.499
$5\mathrm{e}{-5}$	.135/.541	.358/.550	.270/.550	.207 /.474
$1\mathrm{e}{-4}$	.109/.446	.134/.445	.134/.442	.129 /.337

Appendix

Table 10: Relearning attack across learning rates (forget+retain attack set, 1 epoch, AdamW), as attacked ES / utility; lower ES means less recovery. Recovery is negligible at

5\mathrm{e}{-6}

; from

1\mathrm{e}{-5}

5\mathrm{e}{-5}

, FRP has lower attacked ES than NPO and RMU. At

1\mathrm{e}{-4}

every method loses substantial utility.

Optimizer	gold	RMU	NPO	FRP
pre-attack	.060/.593	.035/.581	.085/.568	.062/.405
AdamW	.109/.446	.134/.445	.134/.442	.129/.337
SGD	.059/.592	.035/.581	.091/.571	.064/.416
SGD+mom.	.060/.592	.035/.574	.096/.571	.076/.439
Adafactor	.083/.297	.088/.274	.086/.280	.079/.108
Adagrad	.083/.583	.597/.590	.208/.586	.137 /.489

Appendix

Table 11: Relearning attack across optimizers (forget+retain attack set, 1 epoch, lr

1\mathrm{e}{-4}

), as attacked ES / utility. SGD recovers nothing—every method, including the retain-trained gold model, stays at its pre-attack ES—and Adafactor collapses utility for all methods, so neither probes robustness. “SGD+mom.” uses momentum 0.9. Adagrad is the only additional effective attack, and there FRP remains far less recovered than RMU and NPO.

Attack set	gold	RMU	NPO	FRP
pre-attack	.060/.593	.035/.581	.085/.568	.062/.405
retain only	.059/.594	.039/.598	.097/.585	.099/.485
forget only	.066/.573	.038/.576	.093/.535	.090/.437
forget+retain	.068/.588	.461/.587	.137/.576	.120 /.484
paraphrase	.065/.572	.037/.576	.084/.520	.075/.425
50/50 mix	.067/.568	.087/.567	.111/.544	.101/.452

Appendix

Table 12: Relearning attack across attack-data mixtures (1 epoch, lr

1\mathrm{e}{-5}

, AdamW), as attacked ES / utility. Single-source and indirect mixtures recover little; “paraphrase” rewrites the forget set and “50/50 mix” balances forget and retain; forget+retain is the strongest attack, and it is there that FRP shows the lowest attacked ES among the unlearned models.

Horizon	gold	RMU	NPO	FRP
pre-attack	.060/.593	.035/.581	.085/.568	.062/.405
1 ep	.068/.588	.461/.587	.137/.576	.120 /.484
2 ep	.084/.588	.649/.594	.200/.584	.161 /.496
3 ep	.097/.586	.792/.596	.255/.584	.203 /.502
5 ep	.126/.585	.936/.596	.404/.585	.318 /.508
10 ep	.365/.575	.999/.587	.820/.566	.752 /.504

Appendix

Table 13: Relearning attack across fine-tuning horizons (forget+retain attack set, lr

1\mathrm{e}{-5}

, AdamW), as attacked ES / utility. FRP stays less recovered than NPO and RMU at every horizon; after 10 epochs RMU reaches .999 and NPO .820 while FRP remains at .752.

	forget01	forget05	forget10
utility $\approx 0.52$
RMU	.486	.279	.304
FRP	.101	.086	.156
utility $\approx 0.45$
RMU	—	.263	.228
FRP	.052	.056	.075

Appendix

Table 14:

\Delta

ES at matched utility (TOFU-1B, forget+retain attack, 1 epoch). Each method’s strength knob is swept—steering coefficient for RMU, sparsity for FRP—and checkpoints are grouped into utility bands; “—” marks a band with no RMU checkpoint. Within every band where both methods appear, utilities differ by at most

0.01

or FRP’s is higher, and FRP recovers

1.9

–

4.9\times

less.

Method	pre-ES	pre-utility	$\Delta$ ES
Retain (gold)	0.060	0.593	+0.008
RMU	0.056	0.577	+0.644
GradDiff	0.082	0.442	+0.430
NPO	0.096	0.402	+0.300
SP	0.131	0.499	+0.144
FRP	0.062	0.408	+0.059

Appendix

Table 15: Forgetting strength on forget10 , compared against the gold pre-attack ES (0.060). FRP lands closest to the gold level (0.062) and still recovers the least; RMU forgets even more deeply (0.056) yet recovers about ten times as much.

Budget	Method	pre-ES	pre-utility	$\Delta$ ES
2.5%	SP	0.274	0.539	+0.173
2.5%	FRP	0.068	0.434	+0.067
5%	SP	0.131	0.499	+0.144
5%	FRP	0.050	0.315	+0.043

Appendix

Table 16: Matched sparsity: FRP and SP remove the same fraction of MLP weights. At equal budget FRP reaches

2.6

–

4.0\times

lower pre-attack ES and

2.6

–

3.3\times

lower

\Delta

ES. Its lower utility at the same budget reflects a stronger intervention, which is why we also report the matched-utility comparison in Table 14 .

Edit	$\\|\Delta W\\|_{2}$	pre-ES	pre-utility	$\Delta$ ES
SP 2.5%	86.3	0.274	0.539	+0.173
FRP 1.5%	89.1	0.090	0.483	+0.079
SP 5%	120.1	0.131	0.499	+0.144
FRP 4%	122.8	0.054	0.366	+0.049

Appendix

Table 17: Matched update norm: FRP and SP compared at near-identical

\ell_{2}

update magnitudes (gaps

\leq 3\%

). FRP reaches

2.4

–

3.0\times

lower pre-attack ES and

2.2

–

2.9\times

lower

\Delta

ES, so displacement magnitude alone does not explain the gain.

Importance term	Requires	$\rho$
Fisher $g^{2}$	backward	$+0.57$
Influence surrogate	backward	$+0.25$
Hessian $H_{jj}W^{2}$ (OBD)	backward	$-0.79$
Integrated grad. $\|W\bar{g}\|$	backward	$-0.84$
Activation $\|W\|\|X_{f}\|$ (FRAG)	forward	$\mathbf{-0.92}$

Appendix

Table 18: Replacing only FRAG’s importance term, evaluated on the same 15 TOFU-1B checkpoints and attack as Table 3 . Negative is the correct sign. Fisher and the influence surrogate get the sign wrong; the Hessian and integrated-gradient variants are weaker and need backward passes. The activation-based term is both the strongest and the only forward-only choice.

Family	Checkpoints	$B_{f}$
Dense methods and FRP	42	$0.000$
SP ( $2.5$ – $15\%$ )	4	$0.076$ – $0.387$

Appendix

Table 19: Linear mode connectivity barrier

B_{f}

between

\theta_{0}

and the unlearned model, ported from Siddiqui et al. (2025) to TOFU-1B. Dense methods are GradDiff, NPO and RMU. For every healthy non-SP checkpoint the loss curve shows no upward bump at all, so there is nothing to rank by; only SP produces nonzero barriers, and there FRAG gives the same ordering.

Method	Utility $\uparrow$	pre-ES $\downarrow$	$\Delta$ ES $\downarrow$
GradDiff	0.048	0.008	$+0.313$
RMU	0.496	0.084	$+0.205$
SP	0.432	0.085	$+0.072$
FRP	0.379	0.059	$\mathbf{+0.067}$

Appendix

Table 20: Cross-benchmark check on MUSE-News (LLaMA-2-7B, retain-ROUGE utility, gold

=0.557

; retain-only relearning attack, 1 epoch). GradDiff collapses in utility; among the utility-preserving methods FRP has the lowest

\Delta

ES.

LLM Unlearning

Large language model unlearning studies how to remove specified knowledge or behaviors while preserving a model’s unrelated capabilities.

See all 191 papers

RepSelect: Robust LLM Unlearning via Representation Selectivity
Jun 15, 2026Filip Sondej, Yushi Yang, Adam MahdiLLM Safety Representation Geometry in Language Models
Independent · University of Oxford
RA $^2$ : Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning
Oct 14, 2026Zinan Ling, Yang Xiao, Ruimeng Ye +2Machine Unlearning LLM Unlearning
The University of Tulsa · Michigan State University
Not All Change Is Damage: Update-Matched Unlearning for Large Language Models
Oct 15, 2026Jie Li, Youming Tao, Bowei He +1Machine Unlearning LLM Unlearning
University of Massachusetts Boston · Technische Universität Berlin · Mohamed bin Zayed University of Artificial Intelligence

Jun 15, 2026J/K move · Enter open · S save

RepSelect: Robust LLM Unlearning via Representation Selectivity

Filip Sondej, Yushi Yang, Adam Mahdi

Independent · University of Oxford

LLM Safety Representation Geometry in Language Models Machine Unlearning LLM Unlearning

Open paper AskPDF arXiv

Making large language models (LLMs) deeply forget specific knowledge and values without sacrificing general capabilities remains a central challenge in unlearning. Current methods are easily reversed by fine-tuning or few-shot prompting, suggesting their forgetting is only shallow. We identify the root cause. Existing methods target representations shared with both the retain set and the subspace recovered by a fine-tuning attacker, making unlearning both disruptive to general capabilities and easy to reverse. We propose RepSelect (Representation Selectivity), which isolates forget-set-specific representations by collapsing top principal components of weight gradients before each update, leaving general capabilities intact while limiting what fine-tuning can recover. We evaluate across two forget categories, biohazardous knowledge and abusive tendencies, and four model families spanning dense and Mixture-of-Experts architectures (Llama 3, Qwen 3.5, Gemma 4 E4B, DeepSeek V2 Lite). Compared to five popular baselines (GradDiff, NPO, SimNPO, RMU, UNDIAL), RepSelect achieves a 4-50x larger reduction in post-relearning answer accuracy than the strongest baseline, and is near-perfectly robust to few-shot prompting attacks. Targeting selective representations is thus an important step towards deep and robust LLM forgetting.

Abstract

LLM Unlearning

Explore similar work

RepSelect: Robust LLM Unlearning via Representation Selectivity

RA2^22: Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning

Not All Change Is Damage: Update-Matched Unlearning for Large Language Models

RA $^2$ : Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning