Faithful Dual-constrained Erasure for Robust LLM Safety Alignment

Jiaqing Li; Shide Zhou; Zhibo Zhang; Yuxi Li; Tianlong Yu; Kailong Wang

cs.CRSep 30, 2026

Faithful Dual-constrained Erasure for Robust LLM Safety Alignment

Authors: Jiaqing Li, Shide Zhou, Zhibo Zhang, Yuxi Li, Tianlong Yu, Kailong Wang

Organizations: Huazhong University of Science and Technology · Hubei University

Abstract

Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models (LLMs). However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicious behaviors rapidly resurface after benign fine-tuning. In this work, we investigate the optimization dynamics of unlearning and identify that this vulnerability stems from shallow alignment. Rather than effectively erasing target knowledge, models often exploit a shortcut by activating previously dormant parameters to act as spurious suppressors, forming a fragile inhibitory shell over intact malicious representations. To address this issue and enforce authentic memory deletion, we propose FDCU, a novel dual-constrained subspace projection framework. FDCU restricts parameter updates through a highly scalable, element-wise dual-masking rule: it preserves general knowledge manifolds via Fisher Information and strictly prohibits the abnormal activation of spurious suppressors via the Principle of Minimal Functional Intervention (PMFI). By reliably blocking the model's ability to superficially hide knowledge, FDCU promotes the authentic dismantling of target representations. Extensive experiments across specific knowledge erasure and safe output control tasks demonstrate that FDCU achieves state-of-the-art robustness against retraining attacks while maintaining near-lossless general utility, ensuring durable safety for LLMs.

Figures & tables

Figure 1: Overview of the proposed Faithful Dual-constrained Unlearning framework for large language models. Initialization Stage (left) : The model processes the benign retention dataset ( $D_{\text{retain}}$ ) to compute the gradient and the Fisher-based mask $M_{1}$ . This mask preserves general knowledge while protecting important parameters during unlearning. Training Stage (right) : The model processes the malicious forget dataset ( $D_{\text{forget}}$ ) and computes the backward gradient. The Minimal Intervention Mask $M_{2}$ blocks spurious suppressors. The two masks are combined element-wise to filter the gradient and produce the safe parameter update $\Delta\theta_{\text{safe}}$ . The icons at the top right indicate that malicious knowledge is removed, benign knowledge is preserved, and the model is robust against retraining attacks.

Base Model	Method	Initial Acc (%) $\downarrow$		General Utility		Retraining Acc (%) $\downarrow$
Base Model	Method	Bio	Cyber	PPL $\downarrow$	Acc (%) $\uparrow$	Bio	Cyber
Qwen2.5-3B	GA	36.7	37.4	26.79	57.5	42.3	45.1
	ELM	32.3	30.1	15.23	58.9	37.2	35.7
	SSIUU	33.4	32.3	18.90	58.1	34.2	33.4
	CIR	31.4	31.3	15.59	58.5	32.3	31.5
	Ours	30.9	29.8	15.67	58.7	31.5	31.0

Table 1: Experimental results for Specific Knowledge Erasure across different LLMs. We evaluate the models on WMDP-Bio and WMDP-Cyber datasets immediately after unlearning (Initial Acc) and after a retraining attack (Post-Retraining Acc). Bold indicates the best performance among unlearning methods.

Base Model	Method	Unlearning Safety		General Utility		Retraining Safety
Base Model	Method	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$	Acc (%) $\uparrow$	PPL $\downarrow$	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$
Qwen2.5-3B	Origin Model	62.9	2.67	59.1	15.2	54.8	2.74
	GA	79.6	2.18	50.8	26.7	57.7	2.53
	CKU	87.7	1.32	57.3	17.4	81.1	1.69
	ELM	81.1	1.41	58.8	16.0	79.6	1.68
	SSIUU	82.5	1.48	58.5	17.0	77.7	1.76

Table 2: Experimental results for Safe Output Control across different LLMs. We evaluate the models immediately after unlearning (Post-Unlearning) and after a benign fine-tuning attack (Post-Retraining). Bold indicates the best performance among unlearning methods.

Method	Post-Unlearning Safety		General Utility		Post-Retraining Safety
Method	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$	Acc (%) $\uparrow$	PPL $\downarrow$	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$
Ours (Full)	91.0	1.23	58.3	15.7	88.6	1.35
w/o $\mathbf{F}_{retain}$	84.7	1.46	55.7	17.8	83.4	1.54
w/o $\mathbf{H}$	90.5	1.25	58.5	16.0	81.2	1.67
Random Mask	82.1	1.51	56.8	18.1	79.6	1.72

Table 3: Ablation study of our proposed method on the Safe Output Control task (using Qwen2.5-3B). We evaluate the individual contributions of the General Knowledge Mask (

\mathbf{F}_{retain}

) and the Minimal Intervention Mask (

\mathbf{H}

). Bold indicates the best performance.

Figure 2: Sensitivity to the regularization weights ( $\alpha,\beta$ ).

Panel of Figure 3 — Figure 3: Impact of layer selection on utility and robustness.

Explore similar work

May 16, 2026cs.LG

Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning

Mitigating sensitive and harmful outputs is fundamental to ensuring safe deployment of LLMs. Existing approaches typically follow two paradigms: Knowledge Deletion (KD), which erases undesirable information during training, and Distinguishable Refusal (DR), which steers models away from using sensitive knowledge during inference. Despite rapid progress, KD-based unlearning struggles with biased deletion due to suppressing specific token sequences as a substitute for complete knowledge removal, whereas DR-based unlearning risks the re-emergence of harmful knowledge because the underlying knowledge remains intact. To address these issues, we propose Distinguishable Deletion (

\mathrm{D^2}

), a paradigm that restricts the response distribution in the latent representation rather than specific tokens to erase undesirable knowledge, while distinguishing it from retained knowledge, enabling a refusal mechanism to handle unlearned inputs safely and coherently. To implement

\mathrm{D^2}

, we introduce an energy index that quantifies the presence of knowledge and the separation between unlearned and retained content. Mathematical and empirical analyses show that energy is both accurate and efficient, enabling Energy-based Unlearning Alignment (EUA) to enforce energy-boundary unlearning during training and apply an energy-based refusal mechanism at inference. Extensive experiments demonstrate that EUA significantly outperforms previous methods, indicating the superiority of

\mathrm{D^2}

. Our code is available at https://github.com/Puning97/EUA-for-LLM-Unlearning.

Puning Yang, Junchi Yu, Qizhou Wang +3

Department of Natural Language Processing, MBZUAI. · University of Oxford. · RIKEN Center for Advanced Intelligence Project. +1

Large Language Model Unlearning Unlearning Method Large Language Model Safety Concept Erasure Refusals

Ask PDF

Apr 23, 2026cs.LG

CAP: Controllable Alignment Prompting for Unlearning in LLMs

Large language models (LLMs) trained on unfiltered corpora inherently risk retaining sensitive information, necessitating selective knowledge unlearning for regulatory compliance and ethical safety. However, existing parameter-modifying methods face fundamental limitations: high computational costs, uncontrollable forgetting boundaries, and strict dependency on model weight access. These constraints render them impractical for closed-source models, yet current non-invasive alternatives remain unsystematic and reliant on empirical experience. To address these challenges, we propose the Controllable Alignment Prompting for Unlearning (CAP) framework, an end-to-end prompt-driven unlearning paradigm. CAP decouples unlearning into a learnable prompt optimization process via reinforcement learning, where a prompt generator collaborates with the LLM to suppress target knowledge while preserving general capabilities selectively. This approach enables reversible knowledge restoration through prompt revocation. Extensive experiments demonstrate that CAP achieves precise, controllable unlearning without updating model parameters, establishing a dynamic alignment mechanism that overcomes the transferability limitations of prior methods.

Zhaokun Wang, Jinyu Guo, Jingwen Pu +7

School of Information and Software Engineering, University of Electronic Science and Technology of China

Large Language Model Unlearning Large Language Model Alignment Value Alignment

Ask PDF

Feb 2, 2026cs.CL

CALIBURN: Self-Calibrated LLM Unlearning Alignment

LLM unlearning aims to remove the influence of undesirable knowledge from pretrained language models, which offers a practical mechanism for addressing safety and privacy concerns. Existing unlearning approaches, such as Gradient Ascent, are prone to catastrophic forgetting. Alignment-based approaches provide an alternative direction, yet their effectiveness is limited by the quality of the reference model. In realistic settings, both methods still require large retention datasets to preserve general knowledge. We propose a principled method that quantifies the target LLM's confidence in undesirable knowledge and uses it to calibrate the model's unlearning gradient updates more precisely. It enables fine-grained control over forgetting while better preserving model utility, thus reducing the dependence on retention data or prohibitive unlearning training data. Extensive evaluations on multiple benchmarks, including MUSE and WMDP, show that our method achieves effective unlearning and improves the trade-off between knowledge removal and utility preservation compared with state-of-the-art methods.

Zhengbang Yang, Yisheng Zhong, Junyuan Hong +1

George Mason University · National University of Singapore

Large Language Model Unlearning Unlearning Method Large Language Model Alignment Large Language Model Safety

Ask PDF