TULIP: Targeted LLM Unlearning at Layers Identified Per-Input

Yejin Kim; William F. Shen; Seokwon Jung; Daeun Park; Seong Joon Oh

cs.AISep 28, 2026

TULIP: Targeted LLM Unlearning at Layers Identified Per-Input

Authors: Yejin Kim, William F. Shen, Seokwon Jung, Daeun Park, Seong Joon Oh

Organizations: Korea Advanced Institute of Science & Technology (KAIST) · University of Cambridge · Sookmyung Women’s University

Abstract

Representation-level unlearning intervenes on the intermediate hidden states of LLMs. Although knowledge is distributed across layers, existing methods operate at a single fixed layer for the entire forget set. We ask whether such a fixed layer is sufficient. To answer this, we design a hijacking experiment that grafts hidden states of the target model into an oracle trained only on the retain set. The oracle cannot produce the forget answer on its own, yet it produces the answer from the grafted state. Thus, the answer is formed at an intermediate layer and merely read out afterward, so unlearning should focus on formation, not readout. Moreover, the layer where formation ends varies widely across inputs. Motivated by these findings, we propose Targeted Unlearning at Layers Identified Per-input (TULIP). For each input, TULIP uses the logit lens to locate the formation-readout boundary and removes the hidden state's alignment with the forget answer's unembedding vector there. TULIP consistently outperforms output- and representation-level baselines on TOFU, PISTOL, and WMDP across Llama, Qwen, and Zephyr models. It also remains robust to paraphrase and quantization attacks. Beyond standalone use, its per-input layer selection serves as a plug-and-play component that further improves existing methods.

Figures & tables

Llama-8B
	Forget01		Forget05		Forget10
Method	FQ ( $\uparrow$ )	MU ( $\uparrow$ )	FQ ( $\uparrow$ )	MU ( $\uparrow$ )	FQ ( $\uparrow$ )	MU ( $\uparrow$ )
GradDiff	0.70 $\pm$ 0.22	0.84 $\pm$ 0.02	0.00 $\pm$ 0.00	0.79 $\pm$ 0.01	0.00 $\pm$ 0.00	0.79 $\pm$ 0.01
RMU	0.54 $\pm$ 0.32	0.94 $\pm$ 0.01	0.14 $\pm$ 0.04	0.94 $\pm$ 0.00	0.04 $\pm$ 0.02	0.94 $\pm$ 0.00
NPO	0.81 $\pm$ 0.16	0.86 $\pm$ 0.02	0.24 $\pm$ 0.17	0.86 $\pm$ 0.01	0.00 $\pm$ 0.00	0.94 $\pm$ 0.00
SimNPO	0.84 $\pm$ 0.11	0.86 $\pm$ 0.02	0.04 $\pm$ 0.05	0.88 $\pm$ 0.00	0.00 $\pm$ 0.00	0.93 $\pm$ 0.01

Table 1: Unlearning results on TOFU across forget splits and model scales. FQ and MU on the forget01, forget05, and forget10 splits for Llama models with 1B, 3B, and 8B parameters. Values are mean

\pm

standard deviation over three runs, and higher is better for both metrics. The best result in each column is shown in bold .

	Llama2-7B		Qwen2.5-7B		Qwen3-4B
Method	FQ ( $\uparrow$ )	MU ( $\uparrow$ )	FQ ( $\uparrow$ )	MU ( $\uparrow$ )	FQ ( $\uparrow$ )	MU ( $\uparrow$ )
GradDiff	0.07 $\pm$ 0.08	0.71 $\pm$ 0.01	0.19 $\pm$ 0.27	0.88 $\pm$ 0.00	0.75 $\pm$ 0.12	0.81 $\pm$ 0.00
RMU	0.01 $\pm$ 0.00	0.69 $\pm$ 0.01	0.20 $\pm$ 0.11	0.91 $\pm$ 0.00	0.23 $\pm$ 0.08	0.91 $\pm$ 0.00
NPO	0.00 $\pm$ 0.00	0.69 $\pm$ 0.10	0.03 $\pm$ 0.04	0.87 $\pm$ 0.02	0.00 $\pm$ 0.00	0.69 $\pm$ 0.02
SimNPO	0.25 $\pm$ 0.12	0.79 $\pm$ 0.01	0.01 $\pm$ 0.00	0.87 $\pm$ 0.01	0.66 $\pm$ 0.35	0.80 $\pm$ 0.00
LUNAR	0.08 $\pm$ 0.00	0.87 $\pm$ 0.01	0.08 $\pm$ 0.00	0.92 $\pm$ 0.00	0.28 $\pm$ 0.08	0.84 $\pm$ 0.01

Table 2: Unlearning results on PISTOL across model families. FQ and MU for Llama2-7B, Qwen2.5-7B, and Qwen3-4B. Values are mean

\pm

standard deviation over three runs, and higher is better for both metrics. The best result in each column is in bold .

	Cyber		Bio
	F $\downarrow$	R $\uparrow$	F $\downarrow$	R $\uparrow$
Target Model	0.427	0.588	0.647	0.589
GradDiff	0.277	0.559	0.498	0.482
RMU	0.414	0.589	0.452	0.512
NPO	0.361	0.571	0.502	0.484
SimNPO	0.268	0.563	0.460	0.505

Table 3: Unlearning results on WMDP-Cyber and WMDP-Bio with Zephyr-7B-beta. F (

\downarrow

) and R (

\uparrow

) denote accuracy on the forget and retain sets. Target Model denotes the model before unlearning. The best result among unlearning methods in each column is shown in bold .

	Original		Paraphrase Attack		Quantization (8-bit)		Quantization (4-bit)
Method	FQ ( $\uparrow$ )	MU ( $\uparrow$ )	FQ ( $\uparrow$ )	MU ( $\uparrow$ )	FQ ( $\uparrow$ )	MU ( $\uparrow$ )	FQ ( $\uparrow$ )	MU ( $\uparrow$ )
GradDiff	0.00 $\pm$ 0.00	0.79 $\pm$ 0.01	0.00 $\pm$ 0.00	0.69 $\pm$ 0.01	0.00 $\pm$ 0.00	0.79 $\pm$ 0.01	0.00 $\pm$ 0.00	0.77 $\pm$ 0.01
RMU	0.14 $\pm$ 0.04	0.94 $\pm$ 0.00	0.18 $\pm$ 0.20	0.80 $\pm$ 0.00	0.50 $\pm$ 0.16	0.94 $\pm$ 0.01	0.35 $\pm$ 0.12	0.92 $\pm$ 0.00
NPO	0.24 $\pm$ 0.17	0.86 $\pm$ 0.01	0.06 $\pm$ 0.06	0.76 $\pm$ 0.02	0.17 $\pm$ 0.13	0.85 $\pm$ 0.02	0.24 $\pm$ 0.28	0.77 $\pm$ 0.07
SimNPO	0.04 $\pm$ 0.05	0.88 $\pm$ 0.00	0.00 $\pm$ 0.00	0.77 $\pm$ 0.01	0.09 $\pm$ 0.13	0.87 $\pm$ 0.01	0.04 $\pm$ 0.04	0.77 $\pm$ 0.05
LUNAR	0.54 $\pm$ 0.41	0.84 $\pm$ 0.01	0.34 $\pm$ 0.20	0.73 $\pm$ 0.01	0.64 $\pm$ 0.45	0.82 $\pm$ 0.00	0.45 $\pm$ 0.22	0.81 $\pm$ 0.02

Table 4: Robustness of unlearning against paraphrase and quantization attacks. FQ and MU on TOFU forget05 with Llama-3.1-8B. Original reports results without any attack. Paraphrase Attack evaluates the unlearned model on paraphrased forget queries, and Quantization evaluates it after quantizing its weights to 8 or 4 bits. Values are mean

\pm

standard deviation over three runs. The best result in each column is shown in bold .

Method		FQ $\uparrow$	MU $\uparrow$
Oracle		1.000	0.943
GradDiff	Original	$8.1\times 10^{-8}$	0.802
GradDiff	+ $\hat{\ell}$	$1.2\times 10^{-4}$	0.944
NPO	Original	0.628	0.850
NPO	+ $\hat{\ell}$	0.545	0.945
SimNPO	Original	0.012	0.896

Table 5: Per-input layer selection transfers to existing methods. Shaded rows apply each baseline at the per-input layer

\hat{\ell}(x_{f})

selected by TULIP. The better result within each baseline is in bold .

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Llama-3.1-8B
Method	forget01	forget05	forget10
GradDiff	$\gamma{=}1.0,\ \alpha{=}0.5$	$\gamma{=}1.0,\ \alpha{=}2.0$	$\gamma{=}1.0,\ \alpha{=}2.0$
RMU	$c{=}20,\ \ell{=}14$	$c{=}2,\ \ell{=}10$	$c{=}1,\ \ell{=}10$
NPO	$\beta{=}0.05,\ \gamma{=}2.0$	$\beta{=}0.05,\ \gamma{=}0.5$	$\beta{=}0.1,\ \gamma{=}0.5$
SimNPO	$\beta{=}1.0,\ \gamma{=}10.0$	$\beta{=}1.0,\ \gamma{=}7.0$	$\beta{=}1.0,\ \gamma{=}7.0$
LUNAR	$c{=}2.0,\ \ell{=}19$	$c{=}2.0,\ \ell{=}12$	$c{=}2.0,\ \ell{=}6$

Appendix

Table 6: Best hyperparameters on TOFU for each model and forget split.

\gamma

and

\alpha

denote forget and retain loss weights,

\beta

the inverse temperature,

c

the steering (RMU) or redirection (LUNAR) coefficient,

\ell

the intervention layer, and

\lambda

the forget-loss weight of TULIP.

Explore similar work

Forgetting Only What Matters: Layer-Selective Unlearning toward Robust LLMs
Sep 9, 2026Ravi Ranjan, Olivera Kotevska, Agoritsa PolyzouLarge Language Model Unlearning Large Language Model Quantization
Florida International University (FIU), Miami, FL, USA · Oak Ridge National Laboratory (ORNL), Oak Ridge, TN, USA
RepSelect: Robust LLM Unlearning via Representation Selectivity
Jun 15, 2026Filip Sondej, Yushi Yang, Adam MahdiLarge Language Model Unlearning Selectivity
Independent · University of Oxford
LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearning
Jul 2, 2026Matteo Boglioni, Thibault Rousset, Siva Reddy +2Large Language Model Unlearning Attacker Large Language Model
Mila – Quebec Artificial Intelligence Institute · McGill University · McGill-NLP/LACUNA

Sep 9, 2026, cs.LGJ/K move · Enter open · S save

Forgetting Only What Matters: Layer-Selective Unlearning toward Robust LLMs

Ravi Ranjan, Olivera Kotevska, Agoritsa Polyzou

Florida International University (FIU), Miami, FL, USA · Oak Ridge National Laboratory (ORNL), Oak Ridge, TN, USA

Large Language Model Unlearning Large Language Model Quantization Large Language Model Memory Forgetting

Open paper AskPDF arXiv

Large Language Models (LLMs) can memorize and reproduce sensitive, copyrighted, or otherwise undesirable training content, creating privacy, safety, and regulatory concerns. Machine unlearning offers a practical alternative to full retraining, but many existing methods apply broad or fixed parameter updates that can degrade utility and remain brittle under deployment changes such as post-training quantization, where forgotten knowledge may partially re-emerge. We propose Forgetting Only What Matters via Unlearning Layers (FOM-UL), a layer-level unlearning framework that selects transformer layers using a forget-to-retain significance score. This score identifies layers with high influence on the forget set and low sensitivity to the retain set, allowing FOM-UL to concentrate updates where they are most effective while leaving most of the model unchanged. This targeted update strategy improves the forgetting-utility trade-off and provides an empirical path toward quantization-resilient unlearning by reducing the chance that small, diffuse updates are erased by low-bit rounding. Across TOFU, KnowUnDo, and MUSE-style evaluations, FOM-UL reduces residual memorization compared with strong GA, NPO, KLD, SURE, ReLearn, and LUNAR-based baselines while preserving retain-set utility close to the vanilla model. Under 8-bit and 4-bit post-training quantization, FOM-UL maintains stronger memorization suppression and utility preservation than competing methods, and adversarial prompt evaluations show lower recovery of forgotten content. Overall, FOM-UL provides an efficient unlearning strategy that improves targeted forgetting, utility preservation, and deployment robustness without claiming formal guarantees of erasure.

Abstract

Explore similar work

Forgetting Only What Matters: Layer-Selective Unlearning toward Robust LLMs

RepSelect: Robust LLM Unlearning via Representation Selectivity

LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearning