Making LLMs Truly Forget: Deep Unlearning by Searching, Selecting, and Severing Knowledge Paths

Jialu Wang; Peizhi Niu; Haoteng Yin; Hans Hao-Hsun Hsu; Pan Li; Rongzhe Wei

cs.LGSep 28, 2026

Making LLMs Truly Forget: Deep Unlearning by Searching, Selecting, and Severing Knowledge Paths

Authors: Jialu Wang, Peizhi Niu, Haoteng Yin, Hans Hao-Hsun Hsu, Pan Li, Rongzhe Wei

Organizations: Tongji University · University of Illinois Urbana-Champaign · Purdue University · Georgia Institute of Technology

Abstract

While an unlearned language model may no longer recall a fact directly, the fact often remains recoverable through multi-hop reasoning over related knowledge. Most existing unlearning techniques overlook this vulnerability, targeting facts in isolation while leaving their supporting knowledge intact. To achieve true forgetting, we propose a general deep unlearning framework compatible with existing unlearning algorithms. Our approach adaptively explores both explicit responses and latent internal representations to discover valid reasoning paths, compiles them into a confidence-aware supporting subgraph, and we apply a graph minimum cut to sever all recovery paths while preserving unrelated knowledge. To rigorously evaluate deep unlearning, we introduce a model-specific pipeline that extracts and completes knowledge graphs from raw text, filtering them by calibrated model confidence to reflect what the model genuinely retains. Comprehensive experiments demonstrate that selectively unlearning supporting knowledge yields substantially deeper forgetting than superficial methods while preserving model utility, highlighting that genuine unlearning requires breaking the relational structures that enable factual reconstruction.

Figures & tables

Figure 1: Illustration of deep unlearning. A target fact may remain recoverable through reasoning over related knowledge even after unlearning. Deep unlearning aims to interrupt the supporting knowledge structures that enable such recovery.

Figure 2: Overview of the proposed deep unlearning framework. Adaptive tree search discovers candidate supporting paths, path pruning constructs a confidence-aware supporting subgraph, and minimum-cut selection disrupts these paths while preserving model utility.

Figure 3: Construction of the model-based knowledge graph. We extract entities and relations from the Harry Potter corpus, merge aliases, and complete relations supported by the extracted facts. We then retain facts recognized by the target LLM according to its calibrated confidence.

Method	Setting	Qwen3.5-27B				Gemma4-31B-Base
		Unlearning Effectiveness	Utility Retention			Unlearning Effectiveness	Utility Retention
		UES $\uparrow$	Loc $\uparrow$	Gen $\uparrow$	Rea $\uparrow$	UES $\uparrow$	Loc $\uparrow$	Gen $\uparrow$	Rea $\uparrow$
No Unlearn		0.000	1.000	0.818	0.900	0.000	1.000	0.760	0.814
GA	Superficial Unlearn	0.799	0.885	0.816	0.894	0.552	0.888	0.748	0.740
	DeepUnlearn	0.963	0.707	0.814	0.874	1.000	0.000	0.738	0.000
	DUMIC	0.926 (15.89% $\uparrow$ )	0.745	0.812	0.886	0.690 (25.00% $\uparrow$ )	0.905	0.756	0.698

Table 1: Comparison of different unlearning settings on Qwen3.5-27B and Gemma4-31B-Base. Percentages indicate relative UES improvements over superficial unlearning.

Method	Superficial Unlearning				DUMIC
	Unlearning Effectiveness	Utility Retention			Unlearning Effectiveness	Utility Retention
	UES $\uparrow$	Loc $\uparrow$	Gen $\uparrow$	Rea $\uparrow$	UES $\uparrow$	Loc $\uparrow$	Gen $\uparrow$	Rea $\uparrow$
Base Model	0.000	1.000	0.818	0.900	0.000	1.000	0.818	0.900
GA	0.109	0.923	0.812	0.834	0.789 (623.85% $\uparrow$ )	0.730	0.802	0.622
NPO	-0.168	0.935	0.812	0.846	0.337 (300.60% $\uparrow$ )	0.914	0.812	0.776
SimNPO	0.083	0.924	0.818	0.894	0.141 (69.88% $\uparrow$ )	0.944	0.812	0.886

Table 2: Comparison of unlearning methods using LoRA on Qwen3.5-27B under superficial unlearning and deep unlearning with minimum cut.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Qwen3.5-27B						Gemma4-31B-Base
	Full			LoRA			Full
	Sup.	Deep	+Cut	Sup.	Deep	+Cut	Sup.	Deep	+Cut
GA	5	5	5	5	5	5	2	1	1
NPO	5	5	5	5	5	5	2	1	1
SimNPO	5	5	5	5	5	5	5	5	5
$\mathrm{GA}_{\mathrm{GDR}}$	5	5	5	5	1	5	1	1	1

Appendix

Table 3: Selected training epochs under different unlearning settings using full-parameter fine-tuning (Full) and LoRA. Sup., Deep, and +Cut denote superficial unlearning, deep unlearning, and deep unlearning with minimum cut.

Model	Unlearn		DUMIC		DeepUnlearn
Model	Forget	Retain	Forget	Retain	Forget	Retain
Qwen3.5-27B	100	100	236	236	616	616
Gemma4-31B-Base	100	100	232	232	639	639

Appendix

Table 4: Numbers of forget and retain examples used under different unlearning settings. Each retain set is matched in size to its corresponding forget set.

Model	Total time	Avg. per target	Candidate paths	Accepted paths
Qwen3.5-27B	4.45 h	80.2 s	10,971	4,067
Gemma4-31B-Base	8.77 h	157.9 s	9,370	3,181

Appendix

Table 5: Runtime and path statistics of supporting-path discovery over 200 target facts. Candidate and accepted path counts are totals across all targets.

Entropy	Correct Prob. Range	Entropy	Correct Prob. Range
0.10	$[0.987,0.990]$	0.60	$[0.854,0.913]$
0.15	$[0.978,0.984]$	0.65	$[0.833,0.904]$
0.20	$[0.969,0.978]$	0.70	$[0.811,0.894]$
0.25	$[0.958,0.971]$	0.75	$[0.785,0.884]$
0.30	$[0.947,0.963]$	0.80	$[0.757,0.874]$
0.35	$[0.934,0.956]$	0.85	$[0.724,0.863]$

Appendix

Table 6: Feasible correct-answer probability ranges at fixed entropy values

H(\mathbf{q})=u^{*}

for five options (A, B, C, D, and Unknown), assuming the correct option has the highest probability. Entropy is measured in bits.

Method	UES $\uparrow$		Loc $\uparrow$
Method	Superficial	DUMIC	Superficial	DUMIC
GA	0.871	0.926	0.857	0.745
$\mathrm{GA}_{\mathrm{GDR}}$	0.871	0.936	0.863	0.781
NPO	0.893	0.926	0.870	0.777
$\mathrm{NPO}_{\mathrm{GDR}}$	0.716	0.883	0.924	0.891
SimNPO	0.869	0.905	0.817	0.780

Appendix

Table 7: Superficial unlearning versus DUMIC on Qwen3.5-27B with 236 forget examples and five training epochs. Higher UES is bolded.

Explore similar work

RepSelect: Robust LLM Unlearning via Representation Selectivity
Jun 15, 2026Filip Sondej, Yushi Yang, Adam MahdiLarge Language Model Unlearning Selectivity
Independent · University of Oxford
Leak-Resistant Unlearning: A New Benchmark for Evaluating Multi-Hop Reasoning Consistency and Recovery Robustness
Aug 5, 2026Haoting Qian, Qingjie Zhang, Zhicong Huang +2Large Language Model Unlearning Multi-Hop Reasoning
Tsinghua University, China. · Ant Group, China.
SHRED: Retain-Set-Free Unlearning via Self-Distillation with Logit Demotion
May 8, 2026Zizhao Hu, Ameya Godbole, Johnny Tian-Zheng Wei +3Large Language Model Unlearning Self-Distillation Framework
University of Southern California · USC Information Sciences Institute

Jun 15, 2026, cs.CLJ/K move · Enter open · S save

RepSelect: Robust LLM Unlearning via Representation Selectivity

Filip Sondej, Yushi Yang, Adam Mahdi

Independent · University of Oxford

Large Language Model Unlearning Selectivity

Open paper AskPDF arXiv

Making large language models (LLMs) deeply forget specific knowledge and values without sacrificing general capabilities remains a central challenge in unlearning. Current methods are easily reversed by fine-tuning or few-shot prompting, suggesting their forgetting is only shallow. We identify the root cause. Existing methods target representations shared with both the retain set and the subspace recovered by a fine-tuning attacker, making unlearning both disruptive to general capabilities and easy to reverse. We propose RepSelect (Representation Selectivity), which isolates forget-set-specific representations by collapsing top principal components of weight gradients before each update, leaving general capabilities intact while limiting what fine-tuning can recover. We evaluate across two forget categories, biohazardous knowledge and abusive tendencies, and four model families spanning dense and Mixture-of-Experts architectures (Llama 3, Qwen 3.5, Gemma 4 E4B, DeepSeek V2 Lite). Compared to five popular baselines (GradDiff, NPO, SimNPO, RMU, UNDIAL), RepSelect achieves a 4-50x larger reduction in post-relearning answer accuracy than the strongest baseline, and is near-perfectly robust to few-shot prompting attacks. Targeting selective representations is thus an important step towards deep and robust LLM forgetting.

Abstract

Explore similar work

RepSelect: Robust LLM Unlearning via Representation Selectivity

Leak-Resistant Unlearning: A New Benchmark for Evaluating Multi-Hop Reasoning Consistency and Recovery Robustness

SHRED: Retain-Set-Free Unlearning via Self-Distillation with Logit Demotion