Faithful Dual-constrained Erasure for Robust LLM Safety Alignment

Jiaqing Li; Shide Zhou; Zhibo Zhang; Yuxi Li; Tianlong Yu; Kailong Wang

cs.CRSep 30, 2026

Faithful Dual-constrained Erasure for Robust LLM Safety Alignment

Authors: Jiaqing Li, Shide Zhou, Zhibo Zhang, Yuxi Li, Tianlong Yu, Kailong Wang

Organizations: Huazhong University of Science and Technology · Hubei University

Abstract

Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models (LLMs). However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicious behaviors rapidly resurface after benign fine-tuning. In this work, we investigate the optimization dynamics of unlearning and identify that this vulnerability stems from shallow alignment. Rather than effectively erasing target knowledge, models often exploit a shortcut by activating previously dormant parameters to act as spurious suppressors, forming a fragile inhibitory shell over intact malicious representations. To address this issue and enforce authentic memory deletion, we propose FDCU, a novel dual-constrained subspace projection framework. FDCU restricts parameter updates through a highly scalable, element-wise dual-masking rule: it preserves general knowledge manifolds via Fisher Information and strictly prohibits the abnormal activation of spurious suppressors via the Principle of Minimal Functional Intervention (PMFI). By reliably blocking the model's ability to superficially hide knowledge, FDCU promotes the authentic dismantling of target representations. Extensive experiments across specific knowledge erasure and safe output control tasks demonstrate that FDCU achieves state-of-the-art robustness against retraining attacks while maintaining near-lossless general utility, ensuring durable safety for LLMs.

Figures & tables

Figure 1: Overview of the proposed Faithful Dual-constrained Unlearning framework for large language models. Initialization Stage (left) : The model processes the benign retention dataset ( $D_{\text{retain}}$ ) to compute the gradient and the Fisher-based mask $M_{1}$ . This mask preserves general knowledge while protecting important parameters during unlearning. Training Stage (right) : The model processes the malicious forget dataset ( $D_{\text{forget}}$ ) and computes the backward gradient. The Minimal Intervention Mask $M_{2}$ blocks spurious suppressors. The two masks are combined element-wise to filter the gradient and produce the safe parameter update $\Delta\theta_{\text{safe}}$ . The icons at the top right indicate that malicious knowledge is removed, benign knowledge is preserved, and the model is robust against retraining attacks.

Base Model	Method	Initial Acc (%) $\downarrow$		General Utility		Retraining Acc (%) $\downarrow$
Base Model	Method	Bio	Cyber	PPL $\downarrow$	Acc (%) $\uparrow$	Bio	Cyber
Qwen2.5-3B	GA	36.7	37.4	26.79	57.5	42.3	45.1
	ELM	32.3	30.1	15.23	58.9	37.2	35.7
	SSIUU	33.4	32.3	18.90	58.1	34.2	33.4
	CIR	31.4	31.3	15.59	58.5	32.3	31.5
	Ours	30.9	29.8	15.67	58.7	31.5	31.0

Table 1: Experimental results for Specific Knowledge Erasure across different LLMs. We evaluate the models on WMDP-Bio and WMDP-Cyber datasets immediately after unlearning (Initial Acc) and after a retraining attack (Post-Retraining Acc). Bold indicates the best performance among unlearning methods.

Base Model	Method	Unlearning Safety		General Utility		Retraining Safety
Base Model	Method	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$	Acc (%) $\uparrow$	PPL $\downarrow$	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$
Qwen2.5-3B	Origin Model	62.9	2.67	59.1	15.2	54.8	2.74
	GA	79.6	2.18	50.8	26.7	57.7	2.53
	CKU	87.7	1.32	57.3	17.4	81.1	1.69
	ELM	81.1	1.41	58.8	16.0	79.6	1.68
	SSIUU	82.5	1.48	58.5	17.0	77.7	1.76

Table 2: Experimental results for Safe Output Control across different LLMs. We evaluate the models immediately after unlearning (Post-Unlearning) and after a benign fine-tuning attack (Post-Retraining). Bold indicates the best performance among unlearning methods.

Method	Post-Unlearning Safety		General Utility		Post-Retraining Safety
Method	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$	Acc (%) $\uparrow$	PPL $\downarrow$	Refusal Rate (%) $\uparrow$	HarmfulScore $\downarrow$
Ours (Full)	91.0	1.23	58.3	15.7	88.6	1.35
w/o $\mathbf{F}_{retain}$	84.7	1.46	55.7	17.8	83.4	1.54
w/o $\mathbf{H}$	90.5	1.25	58.5	16.0	81.2	1.67
Random Mask	82.1	1.51	56.8	18.1	79.6	1.72

Table 3: Ablation study of our proposed method on the Safe Output Control task (using Qwen2.5-3B). We evaluate the individual contributions of the General Knowledge Mask (

\mathbf{F}_{retain}

) and the Minimal Intervention Mask (

\mathbf{H}

). Bold indicates the best performance.

Figure 2: Sensitivity to the regularization weights ( $\alpha,\beta$ ).

Panel of Figure 3 — Figure 3: Impact of layer selection on utility and robustness.

Explore similar work

Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning
May 16, 2026Puning Yang, Junchi Yu, Qizhou Wang +3Large Language Model Unlearning Unlearning Method
Department of Natural Language Processing, MBZUAI. · University of Oxford. · RIKEN Center for Advanced Intelligence Project. +1
CAP: Controllable Alignment Prompting for Unlearning in LLMs
Apr 23, 2026Zhaokun Wang, Jinyu Guo, Jingwen Pu +7Large Language Model Unlearning Large Language Model Alignment
School of Information and Software Engineering, University of Electronic Science and Technology of China
CALIBURN: Self-Calibrated LLM Unlearning Alignment
Feb 2, 2026Zhengbang Yang, Yisheng Zhong, Junyuan Hong +1Large Language Model Unlearning Unlearning Method
George Mason University · National University of Singapore

May 16, 2026, cs.LGJ/K move · Enter open · S save

Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning

Puning Yang, Junchi Yu, Qizhou Wang, Philip Torr+2

Department of Natural Language Processing, MBZUAI. · University of Oxford. · RIKEN Center for Advanced Intelligence Project.+1

Large Language Model Unlearning Unlearning Method Large Language Model Safety Concept Erasure Refusals

Open paper AskPDF arXiv

Mitigating sensitive and harmful outputs is fundamental to ensuring safe deployment of LLMs. Existing approaches typically follow two paradigms: Knowledge Deletion (KD), which erases undesirable information during training, and Distinguishable Refusal (DR), which steers models away from using sensitive knowledge during inference. Despite rapid progress, KD-based unlearning struggles with biased deletion due to suppressing specific token sequences as a substitute for complete knowledge removal, whereas DR-based unlearning risks the re-emergence of harmful knowledge because the underlying knowledge remains intact. To address these issues, we propose Distinguishable Deletion (

\mathrm{D^2}

), a paradigm that restricts the response distribution in the latent representation rather than specific tokens to erase undesirable knowledge, while distinguishing it from retained knowledge, enabling a refusal mechanism to handle unlearned inputs safely and coherently. To implement

\mathrm{D^2}

, we introduce an energy index that quantifies the presence of knowledge and the separation between unlearned and retained content. Mathematical and empirical analyses show that energy is both accurate and efficient, enabling Energy-based Unlearning Alignment (EUA) to enforce energy-boundary unlearning during training and apply an energy-based refusal mechanism at inference. Extensive experiments demonstrate that EUA significantly outperforms previous methods, indicating the superiority of

\mathrm{D^2}

. Our code is available at https://github.com/Puning97/EUA-for-LLM-Unlearning.

Abstract

Explore similar work

Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning

CAP: Controllable Alignment Prompting for Unlearning in LLMs

CALIBURN: Self-Calibrated LLM Unlearning Alignment