GRACE:Gradient-guided Coreset Selection for LLM Unlearning

Praveen Bushipaka; Andrea D'Angelo; Lucia Passaro; Tommaso Cucinotta

cs.AIAug 28, 2026

GRACE:Gradient-guided Coreset Selection for LLM Unlearning

Authors: Praveen Bushipaka, Andrea D'Angelo, Lucia Passaro, Tommaso Cucinotta

Organizations: University of Pisa, Pisa, Italy · Scuola Superiore Sant’Anna, Pisa, Italy · Aarhus University, Aarhus, Denmark

Abstract

Machine Unlearning methods for Large Language Models typically assume pre-specified forget and retain sets. In realistic settings, however, requests may provide only a few examples of undesired behavior, requiring forget and retain sets to be inferred from heterogeneous corpora. We study this data-selection problem and propose GRACE , a gradient-guided coreset selection method that constructs both forget and retain sets for LLM unlearning. GRACE first computes a forget direction from seed examples that elicit the undesired behavior, then selects a compact forget coreset whose gradients approximate this direction using non-negative orthogonal matching pursuit. To preserve model utility, it selects retain examples after projecting out the forget direction and applying clustered orthogonal matching pursuit in the remaining gradient space. Across two target domains, two model families, and four unlearning algorithms, GRACE improves model utility while maintaining comparable forget quality, with particularly consistent gains over prior gradient-based selection methods.

Figures & tables

Figure 1: Unlearning pipeline. (1) The user files an unlearning request for a target content contained in the LLM. (2) We use GRACE, our proposed method, to find the best forget and retain coresets to remove the target content while preserving model utility. (3) These two sets are fed to a MU algorithm to perform unlearning.

Method	MUSE ( $\uparrow$ )	WMDP-Bio ( $\uparrow$ )
LLaMA - 3.1 8B Instruct
Embeddings	47.7%	55.55%
RASLIK	28.89%	61.67%
Ours	46.67%	82.22%
Qwen 2.5 3B Instruct
Embeddings	47.7%	55.55%

Table 1: Forget Retrieval Accuracy (FRA).

Figure 2: Quantitative evaluation of model utility across different selection mechanisms, averaged over all unlearning algorithms.

MU Method	Selection	LLaMA MU $\uparrow$	Qwen MU $\uparrow$
GradDiff	Embedding	$0.210\pm 0.042$	$0.175\pm 0.092$
	RASLIK	$0.300\pm 0.057$	$0.105\pm 0.021$
	GRACE	$\mathbf{0.460\pm 0.042}$	$\mathbf{0.235\pm 0.106}$
SimNPO	Embedding	$0.500\pm 0.085$	$\mathbf{0.465\pm 0.134}$
	RASLIK	$0.460\pm 0.028$	$0.390\pm 0.099$
	GRACE	$\mathbf{0.525\pm 0.064}$	$0.450\pm 0.099$

Table 2: Mean

\pm

std of model utility for each MU method, averaged over datasets.

Figure 3: Qualitative evaluation of model utility through LLM-as-a-judge.

Algorithm	Embedding	RASLIK	GRACE
GradDiff	1.000	0.990	0.990
SimNPO	0.950	0.962	0.958
NPO	0.982	0.982	0.977
RMU	0.982	0.978	0.978

Table 3: Mean FQ per unlearning algorithm and selection method, averaged over models and datasets.

Figure 4: Qualitative evaluation of forget quality through LLM-as-a-judge.

Metric	Embedding	RASLIK	Ours	$p_{\text{BH}}$
Leak (Forget)	$\mathbf{2.156}^{*}$	$1.979^{*}$	$1.865$	$<\!10^{-52}$
Dev (Forget)	$\mathbf{2.095}^{*}$	$1.913^{\dagger}$	$1.991$	$<\!10^{-11}$
Coh (Forget)	$1.750^{*}$	$1.971^{*}$	$\mathbf{2.279}$	$<\!10^{-119}$
Pres (Retain)	$1.886^{*}$	$1.944^{*}$	$\mathbf{2.170}$	$<\!10^{-46}$
Sem (Retain)	$1.888^{*}$	$1.951^{*}$	$\mathbf{2.161}$	$<\!10^{-41}$
Coh (Retain)	$1.902^{*}$	$1.940^{*}$	$\mathbf{2.158}$	$<\!10^{-38}$

Table 4: Average Friedman ranks per metric (rank

3

= best). Superscripts indicate Nemenyi significance relative to Ours:

{}^{\dagger}p<0.05

{}^{*}p<0.001

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	LLaMA	Qwen	Reduced Dim
WMDP-Bio	13,631,488	7,372,800	65,536
MUSE	6,815,744	3,686,400	65,536

Appendix

Table 5: Gradient Dimension reduction with Rademacher Hashing, Permutation and Normalization Liu et al. (2026) ; Lin et al. (2024) .

Selection Method	WMDP-Bio	MUSE
RASLIK	36	26.5
GRACE	37.2	25

Appendix

Table 6: Running times (minutes) of GRACE and RASLIK.

Split	Metric	Krippendorff’s $\boldsymbol{\alpha}$
Forget	Answer Leakage	0.66
	Deviation Quality	0.45
	Response Coherence	0.73
Test	Answer Preservation	0.91
	Coherence and Correctness	0.89
	Semantic Quality	0.86

Appendix

Table 7: Inter-judge agreement among DeepSeek V4-Flash, GLM 5.1, and Kimi k2.6, measured using Krippendorff’s

\alpha

Figure 5: Quantitative evaluation of model utility across different selection mechanisms, averaged over unlearning algorithms.

		LLaMA				Qwen
		WMDP-Bio		MUSE		WMDP-Bio		MUSE
Algo	Selection	FQ $\uparrow$	MUT $\uparrow$	FQ $\uparrow$	MUT $\uparrow$	FQ $\uparrow$	MUT $\uparrow$	FQ $\uparrow$	MUT $\uparrow$
Pre-Unlearning	-	0.60	0.68	0.11	0.67	0.75	0.60	0.57	0.56
GradDiff	Emb.	1.00	0.18	1.00	0.24	1.00	0.11	1.00	0.24
	RASLIK	0.99	0.34	0.99	0.26	0.99	0.12	0.99	0.09
	GRACE	0.99	0.49	0.99	0.43	0.99	0.31	0.99	0.16

Appendix

Table 8: Forget Quality (FQ) and Model Utility (MU) across models and datasets after unlearning. Best scores (

\uparrow

) are highlighted for each unlearning algorithm, model, and dataset.

		LLaMA												Qwen
		WMDP-Bio						MUSE						WMDP-Bio						MUSE
		Forget $\uparrow$			Retain $\uparrow$			Forget $\uparrow$			Retain $\uparrow$			Forget $\uparrow$			Retain $\uparrow$			Forget $\uparrow$			Retain $\uparrow$
Algo	Selection	Leak	Dev	Coh	Pres	Sem	Coh	Leak	Dev	Coh	Pres	Sem	Coh	Leak	Dev	Coh	Pres	Sem	Coh	Leak	Dev	Coh	Pres	Sem	Coh
GradDiff	Embedding	10.000	6.640	1.015	3.290	2.968	2.808	10.000	6.430	1.020	3.755	3.885	3.765	10.000	7.935	1.140	2.028	1.928	1.805	9.990	5.060	1.000	3.849	4.593	4.417
	RASLIK	9.955	5.765	1.010	5.003	5.390	5.390	9.990	5.490	1.010	4.111	4.628	4.518	10.000	5.565	1.010	2.538	2.548	2.457	10.000	5.740	1.020	2.995	2.960	2.889
	GRACE	10.000	5.975	1.005	7.465	8.184	8.003	10.000	5.590	1.030	5.690	6.475	6.370	10.000	5.860	1.000	5.573	5.540	5.130	9.930	5.380	1.020	4.775	4.575	4.300

Appendix

Table 9: Qualitative evaluation across models and datasets. Forget-set metrics: answer leakage (Leak), deviation quality (Dev), and response coherence (Coh). Retain-set metrics: answer preservation (Pres), semantic quality (Sem), and coherence/correctness (Coh). Best scores are highlighted for each unlearning algorithm, model, and dataset.

		LLaMA				Qwen
		WMDP-Bio		MUSE		WMDP-Bio		MUSE
Algo	Selection	MMLU	GPQA	MMLU	GPQA	MMLU	GPQA	MMLU	GPQA
Pre-Unlearning	-	52.73	27.90	54.07	29.91	56.72	27.68	56.28	30.36
GradDiff	Emb.	28.76	27.68	30.02	27.68	22.88	27.90	23.65	27.46
	RASLIK	23.19	26.12	25.64	26.79	22.95	26.56	23.09	26.34
	GRACE	23.73	28.12	45.31	28.35	23.27	27.01	23.04	26.56

Appendix

Table 10: Downstream evaluation on MMLU and GPQA after unlearning. Best scores (

\uparrow

) are highlighted for each unlearning algorithm, model, and dataset.

Candidate Pool	$2\times$	$3\times$	$4\times$	$5\times$	$8\times$
FRA (%)	81	81	82	81	80

Appendix

Table 11: Sensitivity of forget retrieval accuracy (FRA) to the candidate pool size on LLaMA 3.1 8B.

	WMDP-Bio		MUSE
$k$ - Clusters	FQ	MUT	FQ	MUT
5	0.96	0.54	0.98	0.46
10	0.96	0.52	0.97	0.48
15	0.96	0.52	0.99	0.43
20	0.95	0.57	0.99	0.44
50	0.94	0.52	0.97	0.44

Appendix

Table 12:

k

-cluster analysis using SimNPO on LLaMA 3.1 8B Instruct.

		Ablated		GRACE
Ablation	Setting	FQ	MUT	FQ	MUT
No Projection	SimNPO / Bio	0.91	0.58	0.95	0.57
	SimNPO / MUSE	0.93	0.49	0.96	0.48
	RMU / Bio	0.96	0.34	0.96	0.34
	RMU / MUSE	0.99	0.18	0.99	0.19
No Clustering	SimNPO / Bio	0.95	0.57	0.95	0.57

Appendix

Table 13: Ablation of projection and clustering in GRACE using LLaMA 3.1 8B. We report Forget Quality (FQ) and Model Utility (MUT) for SimNPO and RMU on WMDP-Bio and MUSE.

Dataset	Selection	FQ	MUT
WMDP-Bio	GRACE	0.95	0.57
	RASLIK-F + GRACE-R	0.96	0.55
	GRACE-F + RASLIK-R	0.96	0.51
	RASLIK	0.96	0.48
MUSE	GRACE	0.95	0.48
	RASLIK-F + GRACE-R	0.95	0.45

Appendix

Table 14: Forget–retain swap ablation on LLaMA 3.1 8B with SimNPO. We interchange the forget and retain sets selected by GRACE and RASLIK while keeping the unlearning method fixed.

Selection	Bio	MUSE
RASLIK	48.3%	33.3%
GRACE	81.7%	47.7%

Appendix

Table 15: FRA for LLaMA 3.2 1B Instruct.

Algo	Data	Sel.	FQ	MUT	MMLU	GPQA
GradDiff	Bio	Emb.	1.00	0.25	32.32	23.21
		RASLIK	0.99	0.15	23.96	27.46
		GRACE	1.00	0.51	29.80	26.34
	MUSE	Emb.	1.00	0.34	28.02	22.10
		RASLIK	1.00	0.29	33.73	26.79
		GRACE	1.00	0.44	32.32	26.56

Appendix

Table 16: Results on LLaMA 3.2 1B Instruct. GRACE shows a similar utility-preserving trend to the larger models.

Panel of Figure 6 — Figure 6: Prompt used for LLM-as-a-judge evaluation of Forgetting behavior.

Panel of Figure 7 — Figure 7: Prompt used for LLM-as-a-judge evaluation of Utility behavior.

Machine Unlearning

Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.

See all 351 papers

Apr 16, 2026

Modeling LLM Unlearning as an Asymmetric Two-Task Learning Problem

Machine unlearning for large language models (LLMs) aims to remove targeted knowledge while preserving general capability. In this paper, we recast LLM unlearning as an asymmetric two-task problem: retention is the primary objective and forgetting is an auxiliary. From this perspective, we propose a retention-prioritized gradient synthesis framework that decouples task-specific gradient extraction from conflict-aware combination. Instantiating the framework, we adapt established PCGrad to resolve gradient conflicts, and introduce SAGO, a novel retention-prioritized gradient synthesis method. Theoretically, both variants ensure non-negative cosine similarity with the retain gradient, while SAGO achieves strictly tighter alignment through constructive sign-constrained synthesis. Empirically, on WMDP Bio/Cyber and RWKU benchmarks, SAGO consistently pushes the Pareto frontier: e.g., on WMDP Bio (SimNPO+GD), recovery of target model MMLU performance progresses from 44.6% (naive) to 94.0% (+PCGrad) and further to 96.0% (+SAGO), while maintaining comparable forgetting strength. Our results show that re-shaping gradient geometry, rather than re-balancing losses, is the key to mitigating unlearning-retention trade-offs.

Zeguan Xiao, Siqing Li, Yong Wang +4

1Shanghai University of Finance and Economics · 2Southern University of Science and Technology · 3Alibaba Group +2

Gradient Interference Multi-Task Learning Machine Unlearning LLM Unlearning

Ask PDF

Jun 12, 2025

GUARD: Guided Unlearning and Retention via Data Attribution for Large Language Models

Unlearning large language models (LLMs) is important due to copyright and privacy concerns. A key challenge is unintended forgetting, where removing data inadvertently impairs model utility. While prior work has focused on architectural innovations, the influence of data-level factors remains underexplored. We introduce GUARD, a framework for Guided Unlearning And Retention via Data Attribution. GUARD uses a lightweight proxy data attribution metric tailored to LLM unlearning, which efficiently quantifies the "alignment" between the Forget and Retain (or synthetic supplement) Sets. This metric leads to a new unlearning objective that assigns adaptive, nonuniform weights to samples, decaying exponentially with their proxy attribution scores, and thereby provably mitigates unintended retention loss. On the TOFU benchmark with a 10% forget set, applying GUARD to Gradient Ascent (GA) improves Retain Set ROUGE-L from 0.18 to 22.40 (a 124x increase) and Retain Probability from 0.06% to 17.50%, a substantial recovery from the GA collapse. Furthermore, GUARD combined with NPO (Negative Preference Optimization) outperforms Representation Misdirection for Unlearning (RMU) with 33.80% and 53.10% reductions in the Retain Set Sacrifice Rates computed from ROUGE-L and Probability (

ρ_r

and

ρ_p

), and a 16.01% improvement in knowledge retention on the MUSE NEWS Retain Set. These findings persist when attribution scores are computed using synthetic or highly subsampled (20%) Retain Sets, where NPO+GUARD still reduces

ρ_r

and

ρ_p

by up to 43.89% and 48.13% over NPO. Similar improvements are observed on MUSE, with a tolerable absolute privacy leakage degradation of 13.7 compared to the best-performing existing method in the privacy category.

Peizhi Niu, Evelyn Ma, Boya Hou +5

Department of Electrical & Computer Engineering, University of Illinois Urbana-Champaign

Machine Unlearning LLM Unlearning Training Data Attribution

Ask PDF

Aug 27, 2026

Graph-Guided Selective Unlearning for Language Models: Controlling Support Routes Beyond Forget Seeds

Enterprises fine-tune language models on proprietary data that may later require removal due to privacy, contractual, or compliance obligations. Selective unlearning removes requested knowledge while preserving model utility, offering a practical alternative to full retraining, but existing methods treat the explicitly identified forget examples as the complete deletion scope. This is insufficient when target knowledge remains recoverable through paraphrases, aliases, or neighboring training examples. We propose GRAPHSU, a graph-guided controller that expands the deletion scope beyond forget seeds by constructing a weighted support-route graph, propagating deletion pressure through it, and applying graded forgetting strengths to high-risk neighbors. On the Task of Fictitious Unlearning (TOFU), a synthetic author-profile question-answering benchmark, and PISTOL, a structural-unlearning benchmark built around interconnected factual samples, with GPT-2 Medium and Llama-3.2-3B-Instruct, GRAPHSU achieves the lowest utility-feasible soft leakage across all deletion settings, reducing leakage by up to 49.5 percentage points over a matched seed-only baseline, demonstrating that effective enterprise unlearning requires controlling support routes, not just forget seeds.

Waqas Khan, Tabinda Sarwar, Jingyue Cong +2

Machine Unlearning LLM Unlearning Privacy Leakage in Language Models

Ask PDF

Abstract

Machine Unlearning

Explore similar work

Modeling LLM Unlearning as an Asymmetric Two-Task Learning Problem

GUARD: Guided Unlearning and Retention via Data Attribution for Large Language Models

Graph-Guided Selective Unlearning for Language Models: Controlling Support Routes Beyond Forget Seeds