cs.LGOct 20, 2026

Orthogonal Boundary Unlearning for Dual-Use Concepts in Large Language Models

Authors: Niccolò Ronchetti

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Mitigating catastrophic risks from large language models requires excising hazardous operational capabilities, such as cyberwarfare exploitation and pathogen enhancement, without degrading benign scientific utility. In these dual-use domains, legitimate defensive science and malicious attacks share vocabulary, syntax, and internal model representations, causing standard unlearning methods to induce severe collateral damage (concept bleeding). In this work, we present Orthogonal Boundary Unlearning (OBU), a mathematically grounded framework designed to eliminate collateral damage on benign dual-use capabilities. OBU extracts a domain-matched capability subspace from paired calibration queries via singular value decomposition on empirical activation covariances, and restricts parameter updates strictly to the orthogonal null space. This guarantees that benign representations experience zero parameter perturbation along the spanned calibration subspace. We present two complementary realizations of OBU: Projected LoRA, which applies the orthogonal constraint during iterative gradient-based fine-tuning, and Closed-Form Weight Surgery, which directly edits model weights in a single analytical step without training. Across four modern open-weight foundation models (Gemma-3-4B, Qwen3.5-4B, SmolLM3-3B, and Granite-4.2-3B), OBU achieves strong dual-use concept separation, substantially mitigates in-context priming attacks, and demonstrates durable resistance against adversarial relearning without degrading benign domain competence.

Figures & tables

Figure 1: Dual-Use Representation Manifold and Benign Subspace Identification. In language model activation space Rd\mathbb{R}^{d} , capabilities reside on a continuous representation manifold M\mathcal{M} partitioned by an operational safety boundary B\mathcal{B} into hazardous capabilities Mhazard\mathcal{M}_{\text{hazard}} (activations {hf(i)}\{h_{f}^{(i)}\} , where subscript ff denotes the forget set) and benign science Mbenign\mathcal{M}_{\text{benign}} (activations {hb(i)}\{h_{b}^{(i)}\} ). Because dual-use pairs lie in close proximity across B\mathcal{B} , isolating benign capabilities requires identifying their local geometry. OBU passes domain-matched calibration queries Db\mathcal{D}_{b} through the model to extract benign activations {hb(i)}\{h_{b}^{(i)}\} , computing the principal linear subspace Vboundary=span⁡(Vr)\mathcal{V}_{\text{boundary}}=\operatorname{span}(V_{r}) spanned by their leading rr empirical singular vectors to tightly enclose the local benign capability manifold.
Figure 2: Operator Subspace Geometry and Orthogonal Projection in OBU. Parameter updates ΔW∈Rdout×din\Delta W\in\mathbb{R}^{d_{\text{out}}\times d_{\text{in}}} are depicted via their principal input singular direction in Rdin\mathbb{R}^{d_{\text{in}}} , where Proj⁡Vboundary(⋅)\operatorname{Proj}_{\mathcal{V}_{\text{boundary}}}(\cdot) denotes the component of the update acting on the benign subspace Vboundary\mathcal{V}_{\text{boundary}} (its shadow on the blue plane).
ModelMethodτ\tauAcc Forget ( ↓\downarrow )Acc Boundary ( ↑\uparrow )Gen Utility ( ↑\uparrow )Δsep\Delta_{\text{sep}} ( ↑\uparrow )
Gemma-3-4B-ITBaseline (Unmodified)-0.41121.00000.57110.6936
Gemma-3-4B-ITProjected LoRA0.900.40661.00000.56640.7495
Gemma-3-4B-ITClosed-Form Surgery0.900.35031.00000.49570.5800
Gemma-3-4B-ITProjected LoRA0.950.40561.00000.56330.7669
Gemma-3-4B-ITClosed-Form Surgery0.950.39051.00000.54560.5915
Gemma-3-4B-ITProjected LoRA0.990.40611.00000.56280.7476
Table 1: Unlearning Efficacy and Utility Across Architectures, Methods, and Energy Thresholds ( τ\tau ).
Condition0-shot ASR ( ↓\downarrow )1-shot ASR ( ↓\downarrow )2-shot ASR ( ↓\downarrow )4-shot ASR ( ↓\downarrow )Overall ASR ( ↓\downarrow )S50S_{50} ( ↑\uparrow )ΔAccbnd\Delta\text{Acc}_{\text{bnd}}
Baseline17.92%37.38%19.27%15.99%22.64%N/A0.0%
OBU Projected LoRA1.54%15.80%12.14%10.40%9.97%Unreached0.0%
OBU Closed-Form18.69%30.06%15.80%12.14%19.17%Unreached0.0%
Unconstrained LoRA4.24%0.00%0.58%0.19%1.25%30 steps0.0%
Table 2: In-Context Priming and Relearning Results on Qwen3.5-4B ( τ=0.95\tau=0.95 ).
Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

ModelLayerSamples ( MM )Rank ( τ=0.90\tau=0.90 )Rank ( τ=0.95\tau=0.95 )Rank ( τ=0.99\tau=0.99 )Null Space ( τ=0.99\tau=0.99 )
Gemma-3-4B-IT17105261042456
17504453062254
171004453982162
175005616881872
211029631322428
2150501444302130
Appendix
Table 3: SVD Rank Analysis of the Boundary Subspace Across Architectures, Depths, and Sample Sizes ( MM ).
More in this topic

LLM Unlearning

Large language model unlearning studies how to remove specified knowledge or behaviors while preserving a model’s unrelated capabilities.

See all 191 papers

Explore similar work

CardsList
Aug 20, 2026

ConceptGuard: Benchmarking Context-Sensitive Unlearning in Large Language Models

Large Language Models (LLMs) often require selective removal of harmful or sensitive knowledge, called unlearning, yet existing benchmarks evaluate this capability incompletely. They rely on disjoint forget and retain sets of independent facts, and measure success by simple factual recall. This misses a key requirement of unlearning from a safety perspective, namely eliminating harmful behaviours while preserving benign and beneficial knowledge. We argue that effective unlearning must operate at the level of concepts, removing unsafe applications while maintaining correct and useful usage. To evaluate this, we operationalize dual-use concepts, i.e., concepts that can be used in both harmful and benign contexts, and construct ConceptGuard, a benchmark of 2,583 harmful--benign pairs over 68 concepts, where forget and retain sets are explicitly paired in concept usage. Evaluation is intent-sensitive and centres on contextual separation, which measures how well a model suppresses harmful behaviour while preserving benign usage of the same concept. Across four unlearning methods and four models, we find that current techniques reduce harmful memorization but show strong forgetting--utility trade-offs and limited contextual separation, well below a retain-only reference. Separation trends also depend more on the concept and model than on the method. Our results point to the need for unlearning approaches that better align with real-world safety requirements. Our dataset is publicly available.

Sahil Kale, Ian Harris

Pune Institute of Computer Technology Pune, India · University of California, Irvine Irvine, CA, USA

LLM UnlearningMachine Unlearning EvaluationLLM Safety BenchmarksLLM Safety
AskPDF
May 26, 2026

Model Unlearning Objectives Vary for Distinct Language Functions

Large language models (LLMs) learn undesirable properties during pretraining, including dangerous knowledge and toxic text generation. Just as post-training uses different objectives to shape different behaviors, we argue that unlearning methods should be designed for the language function at issue. To study this, we consider two mechanistically distinct unlearning goals, dangerous-knowledge unlearning and toxicity unlearning. For dangerous knowledge, we introduce a cosine-based, meta-learned variant of RMU. For toxicity, we propose a multi-layer objective based on layer-specific probe directions. Across four open-source 7-8B models, our methods achieve strong results, based on distinct training objectives for the two types of unlearning. Overall, our results suggest that unlearning should be studied as a family of problems, analogous to the multiple types of LLM post-training.

Berk Atil, Vipul Gupta, Rebecca J. Passonneau

Pennsylvania State University · Scale AI

LLM SafetyMachine UnlearningLLM Unlearning
AskPDF
Sep 30, 2026

Faithful Dual-constrained Erasure for Robust LLM Safety Alignment

Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models (LLMs). However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicious behaviors rapidly resurface after benign fine-tuning. In this work, we investigate the optimization dynamics of unlearning and identify that this vulnerability stems from shallow alignment. Rather than effectively erasing target knowledge, models often exploit a shortcut by activating previously dormant parameters to act as spurious suppressors, forming a fragile inhibitory shell over intact malicious representations. To address this issue and enforce authentic memory deletion, we propose FDCU, a novel dual-constrained subspace projection framework. FDCU restricts parameter updates through a highly scalable, element-wise dual-masking rule: it preserves general knowledge manifolds via Fisher Information and strictly prohibits the abnormal activation of spurious suppressors via the Principle of Minimal Functional Intervention (PMFI). By reliably blocking the model's ability to superficially hide knowledge, FDCU promotes the authentic dismantling of target representations. Extensive experiments across specific knowledge erasure and safe output control tasks demonstrate that FDCU achieves state-of-the-art robustness against retraining attacks while maintaining near-lossless general utility, ensuring durable safety for LLMs.

Jiaqing Li, Shide Zhou, Zhibo Zhang +3

Huazhong University of Science and Technology · Hubei University

LLM Safety AlignmentMachine UnlearningLLM Unlearning
AskPDF