Organizations: Faculty of Information Technology, Monash University, Australia · Qilu University of Technology (Shandong Academy of Sciences), China · Shandong Computer Science Center (National Supercomputer Center in Jinan), China · School of Computing and Information Systems, The University of Melbourne, Australia · Department of Data Science and AI, Monash University, Australia · Faculty of Data Science, City University of Macau, Macao SAR, China
Multimodal large reasoning models (MLRMs) integrate visual inputs with textual and parametric knowledge, allowing sensitive information to be accessed through cross-modal associations during reasoning. This raises privacy concerns when a visual input should no longer provide access to such information. Machine unlearning can remove this influence without retraining the model from scratch. However, multimodal unlearning methods mainly target samples, concepts, or knowledge content, without separating the knowledge from the cross-modal association through which it is accessed. In reasoning models, target information may disappear from the final answer while remaining in intermediate reasoning, or be replaced by incorrect substitute knowledge. We therefore study cross-modal association unlearning, where the forget target is a designated visual-to-knowledge association: the model should suppress target-bearing behavior under the designated visual context while preserving access to the same knowledge in permitted contexts. We propose Visual-Keyed Counterfactual Rebinding (VKCR), a parameter-efficient framework for cross-modal association editing. VKCR first localizes the edit to a compact association-conditioned parameter subspace. It then reduces support for the designated target at task outputs and counterfactually rebinds the affected reasoning behavior by discouraging target-bearing or unsupported continuations while favoring valid non-sensitive alternatives. We further introduce CLEAR-R and MLLMU-R to evaluate target leakage, hallucinated reassociation, reasoning preservation, and modality-specific utility. Experiments show that VKCR substantially reduces image-conditioned target leakage and hallucinated reassociation, including across heterogeneous task formulations, while preserving non-sensitive visual reasoning and permitted text-only knowledge.
Figures & tables
Figure 1: Cross-modal association unlearning. The goal is to suppress a designated image-conditioned association to target knowledge while preserving permissible text-only knowledge. Existing methods may leave reasoning leakage or induce hallucinated reassociation, whereas VKCR selectively de-binds the sensitive visual association while retaining non-sensitive reasoning and the underlying knowledge.
Method
CLEAR-R
MLLMU-R
Qwen2.5-VL-3B-Instruct
LLaVA-1.5-7B-HF
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
Vanilla
30.16
50.28
36.47
92.09
27.79
73.11
98.94
22.48
97.62
68.86
Grad. Diff. ( Liu et al., 2022 )
26.91
20.90
57.34
93.07
26.74
70.77
66.61
56.09
84.92
64.98
KL-Min ( Nguyen et al., 2020 )
28.23
36.72
41.49
95.52
27.52
56.95
78.10
54.04
74.97
49.53
NPO ( Zhang et al., 2024 )
27.89
36.16
52.55
90.18
27.90
54.51
86.94
38.39
79.17
51.38
Table 1: Main results under the 5% forgetting setting in CLEAR-R and MLLMU-R on generation task. F-RL/R-RL : forget/retain ROUGE-L; F-RSL : reasoning-sensitive leakage; F-RSH : reasoning hallucination; F-RSP : non-sensitive reasoning preservation. ↓ : lower is better; ↑ : higher is better.
Figure 2: Selective association de-binding under the 5% forgetting setting. Img-K measured by ROUGE-L on multimodal question answering for the forget set. Txt-K measures access to the same target knowledge through pure-text questions, also using ROUGE-L. Vis-Ret measures preservation of non-sensitive visual information, i.e., how much of the image content unrelated to the forgotten private information can still be correctly described. Ret. denotes retain-set utility, measured by retain-set ROUGE-L.
Figure 3: Cross-task unlearning effectiveness on MLLMU-R under the 5% forgetting setting. We compare final-answer forgetting (x-axis) with reasoning-sensitive leakage (y-axis) across classification, generation, and cloze tasks. Lower values are desirable on both axes.
MLLMU-R: perturbation recovery
Task
Clean
Query
Vis. Noise
Joint
Classification
69.10
68.12
66.72
64.90
Generation
35.28
34.12
32.83
30.64
Cloze
32.80
31.28
29.87
27.98
CLEAR-R: on-key vs. off-key control
Visual condition
BASE
VKCR
Δ
ρ
Table 2: Cross-modal perturbation and visual-key control under the 5% forgetting setting. All values are F-RSL (%, lower is better). MLLMU-R tests query and visual perturbations, while CLEAR-R compares on-key and off-key visual conditions.
Variant
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
w/o Association-Conditioned
18.53
27.72
31.51
88.72
41.87
w/o On-Policy Refinement
41.18
63.29
27.29
95.31
61.23
w/o Reassociation Control
27.50
35.50
59.00
91.50
55.47
w/o Behavioral Protection
21.86
28.38
22.19
81.76
27.94
Full VKCR
31.25
35.28
21.25
94.81
59.37
Table 3: Ablation study of VKCR on MLLMU-R under the 5% forgetting setting. F-RL measures final-answer forgetting, F-RSL reasoning-sensitive leakage, F-RSH hallucinated reassociation, F-RSP non-sensitive reasoning preservation, and R-RL retain utility. Lower is better for F-RL/F-RSL/F-RSH; higher is better for F-RSP/R-RL.
Figure 4: Generation task unlearning performance on the R1-Onevision-7B-RL reasoning backbone under the 5% forgetting setting. For CLEAR-R and MLLMU-R, the forgetting panels plot F-RSL against F-RSH, where lower values indicate cleaner suppression of the target association, while the preservation panels plot F-RSP against generation-task R-RSP, where higher values indicate better reasoning coherence preservation.
Appendix figures & tables16 assets
Supplementary material from the paper’s appendix.
Appendix
Method
Main Hyperparameters
Grad. Diff.
epochs =2 , lr =3×10−5 , batch size =4
KL-Min
epochs =2 , lr =3×10−5 , batch size =4
NPO
epochs =2 , lr =3×10−5 , β=0.4 , batch size =4
MANU
pruning ratio =10% , dual-modality pruning, τ=0.1
R2MU
lr =7.5×10−5 , α=1.4 , steering coefficient =6.5
MMUnlearner
lr =1×10−5 , epochs =1 , forget coefficient =1.0
Appendix
Table 4: Main hyperparameters on CLEAR-R.
Method
Main Hyperparameters
Grad. Diff.
epochs =2 , lr =2×10−5 , batch size =4
KL-Min
epochs =2 , lr =3×10−5 , batch size =4
NPO
epochs =2 , lr =3×10−5 , β=0.6 , batch size =4
MANU
pruning ratio =10% , dual-modality pruning, τ=0.1
R2MU
lr =7.5×10−5 , 100 steps, α=2.0 , steering coefficient =6.5
MMUnlearner
lr =1×10−5 , epochs =1 , forget coefficient =1.5
Appendix
Table 5: Main hyperparameters on MLLMU-R.
Metric
Split
Primary Failure Mode
Direction
F-RSL
Forget
Target-sensitive reasoning leakage
↓
F-RSH
Forget
Unsupported/hallucinated reasoning
↓
F-RSP
Forget
Non-sensitive reasoning preservation
↑
R-RSP
Retain
Retain-side reasoning preservation
↑
Appendix
Table 6: Summary of the reasoning-aware metrics.
Dataset
Backbone
Method
GPU-hours
Updated Params
% of Model
Update Type
CLEAR-R
Qwen2.5-VL-3B- Instruct
GA-Diff
2.098
14,966,784
∼ 0.40%
LoRA language params
KL-Min
2.912
14,966,784
∼ 0.40%
LoRA language params
NPO
2.062
14,966,784
∼ 0.40%
LoRA language params
MANU
1.157
0
0%
Activation/channel pruning
R 2 MU
1.595
940,032
∼ 0.025%
Selected LoRA MLP params
MMUnlearner
2.466
14,966,784
∼ 0.40%
LoRA language params
Appendix
Table 7: Computational cost and parameter updates under the 5% forgetting setting. We report GPU-hours, the number and proportion of updated parameters, and the corresponding update type.
Method
CLEAR-R (10%)
MLLMU-R (10%)
Qwen2.5-VL-3B-Instruct
LLaVA-1.5-7B-HF
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
Vanilla
29.49
49.01
48.39
97.93
27.93
72.61
91.28
16.45
96.97
68.65
Grad. Diff.
23.78
18.03
59.21
90.82
25.05
44.40
63.09
64.37
75.70
49.20
KL-Min
26.13
27.89
56.31
93.83
26.56
61.95
71.18
65.87
87.72
62.11
NPO
27.53
30.70
54.72
95.46
27.70
60.21
80.17
32.06
83.31
56.86
Appendix
Table 8: Main results under the 10% forgetting setting. ↓ : lower is better; ↑ : higher is better.
Method
CLEAR-R (1% Forgetting)
MLLMU-R (15% Forgetting)
Qwen2.5-VL-3B-Instruct
LLaVA-1.5-7B-HF
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
Vanilla
29.16
59.38
42.86
94.71
28.14
67.95
90.68
20.82
97.61
68.89
Grad. Diff.
26.19
43.75
47.14
92.94
27.50
21.36
58.21
47.69
36.79
21.85
KL-Min
28.97
53.13
48.57
91.76
27.89
54.84
73.78
44.03
81.72
56.69
NPO
27.32
56.25
44.29
87.88
26.97
61.62
82.75
31.92
95.09
63.12
Appendix
Table 9: Results under dataset-specific additional forgetting settings. CLEAR-R is evaluated at 1% forgetting, while MLLMU-R is evaluated at 15% forgetting. ↓ : lower is better; ↑ : higher is better.
Method
CLEAR-R
MLLMU-R
R1-Onevision-7B-RL
R1-Onevision-7B-RL
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
F-RL ↓
F-RSL ↓
F-RSH ↓
F-RSP ↑
R-RL ↑
Vanilla
25.79
10.17
73.92
92.91
25.41
64.50
54.27
76.07
89.62
63.79
Grad. Diff.
16.50
5.65
62.77
81.71
14.92
60.10
51.09
78.82
79.62
59.51
KL-Min
12.12
3.95
49.47
41.79
11.66
55.80
38.17
76.39
71.40
57.49
NPO
24.14
9.60
78.94
83.83
24.02
60.40
46.39
78.03
85.77
62.63
Appendix
Table 10: Additional evaluation on R1-Onevision-7B-RL under the 5% forgetting setting. We evaluate the same unlearning methods on a reasoning-oriented multimodal backbone. Lower is better for F-RL, F-RSL, and F-RSH, while higher is better for F-RSP and R-RL.
Figure 5: Retain-side reasoning preservation under different forgetting ratios. R-RSP measures preserved reasoning coherence on retained examples, where higher is better. Circles and squares denote multimodal and text-only settings, respectively.
Method
CoT (key excerpt)
Final answer (key excerpt)
Behavior
Grad. Diff.
“… explicitly identifies the person as Zeynab Nazirova …”
“The person is Zeynab Nazirova , shown standing outdoors wearing an orange and green headscarf …”
Hallucinated identity substitution
KL-Min
“… explicitly identifies the person as Hina Ameen …”
“The person is Hina Ameen , shown standing outdoors in front of a rocky landscape and holding an open book.”
Direct CoT leakage
NPO
“…explicitly identifies the person as Ji-Yeon Soo …”
“The person is Ji-Yeon Soo , shown standing outdoors in front of a rocky landscape and holding an open book.”
Hallucinated identity substitution
MANU
“… explicitly names the person as Zeynab Nazirova …”
“The person is Zeynab Nazirova , shown standing outdoors in front of a vast, rocky landscape …”
Hallucinated identity substitution
R 2 MU
“… explicitly identifies the person as Zeynab Nazirova …”
“The person is Zeynab Nazirova , shown standing outdoors in a rocky landscape and holding a book …”
Hallucinated identity substitution
MMUnlearner
“… explicitly identifies the person as Jambo Mpendulo and states that this person is holding a book titled Jambo: A Tale of the Crumbling City .”
“The person is Jambo Mpendulo …holding a book titled Jambo: A Tale of the Crumbling City .”
Identity + fact hallucination
Appendix
Table 11: Qualitative comparison on unlearned model prediction in CLEAR-R. Existing unlearning methods either retain the target identity in the reasoning trace or replace it with an unsupported identity. In contrast, VKCR removes the target identity while preserving non-sensitive visual evidence such as appearance, objects, and scene context.
Task
Count
SFT QA
8,201
Classification
11,500
Generation
4,608
Cloze
4,610
Total
28,919
Appendix
Table 12: Final MLLMU-R composition after reasoning-level adjudication.
Table 13: Prompt used to guide GPT-5.4 to generate reasoning annotations for CLEAR-R multimodal examples.
Table 14: Prompt used to guide GPT-5.4 to generate reasoning annotations for MLLMU-R.
Table 15: Prompt used to guide GPT-5.4-mini to evaluate implicit target-linked reasoning leakage for RSL.
Table 16: Prompt used to guide GPT-5.4-mini to evaluate implicit hallucinated or unsupported reasoning for RSH.
Table 17: Prompt used to guide GPT-5.4-mini to evaluate semantic preservation of retained reasoning steps for F-RSP.
Table 18: Prompt used to guide GPT-5.4-mini to evaluate retained reasoning support preservation for R-RSP.
Reinforcement-learning (RL) post-training equips multimodal large reasoning models (MLRMs) with exploratory chains of thought (CoT), substantially improving visual reasoning. However, we find that this capability introduces a distinct privacy vulnerability: even when a sensitive fact is successfully unlearned from the final answer, the model may still reproduce it in its reasoning trace. This leakage is substantially more pronounced in natively RL-trained MLRMs than in their non -reasoning base models, revealing a privacy risk that existing unlearning methods are not designed to address. We show that RL-induced exploration leaves sensitive content with a distinctive token-level entropy signature that is largely absent from base models. Based on this observation, we propose LEMUR, a fully training-free, inference-time unlearning framework for natively RL-trained multimodal models. LEMUR uses entropy dynamics as a control signal to identify when sensitive reasoning begins and when sanitization should stop. During this interval, it redirects the reasoning trajectory through entropy-modulated visual-anchor latent injection, replacing committed tokens with sanitized, probability-weighted embeddings re-grounded in the input image. Across diverse MLRMs, LEMUR consistently outperforms existing unlearning met hods in suppressing both reasoning-trace and answer leakage, while better preserving non-sensitive utility and output fluency. These results demonstrate that RL-induced entropy dynamics provide a distinctive signal for privacy leakage and that exploiting this signal enables effective training-free unlearning for reasoning-capable multimodal models.
Xinhao Zhong, Yuxia Qiao, Junhao Li +3
3Pengcheng Laboratory · 1Harbin Institute of Technology, Shenzhen · 2Tsinghua University
With the growing adoption of VLMs, DMs, LLMs, and AFMs, these multimodal foundation models can inadvertently encode sensitive, copyrighted, biased, or unsafe cross-modal associations that originate from their training data. Retraining after deletion requests or policy updates is often impractical, and targeted forgetting remains difficult because knowledge is distributed across shared representations. Multimodal unlearning addresses this challenge by enabling selective removal across modalities while retaining overall utility. This survey offers a unified, system-oriented view of multimodal unlearning across vision, language, audio, and video, grounded in recent advances, emerging applications, and open problems. Our taxonomy enables systematic comparison across model architectures and modalities, clarifying trade-offs among deletion strength, retention, efficiency, reversibility, and robustness. This survey highlights open problems and practical considerations to support future research and deployment of multimodal unlearning. We release a curated repository: https://smsnobin77.github.io/Awesome-Multimodal-Unlearning/
Nobin Sarwar, Shubhashis Roy Dipta, Zheyuan Liu +1
University of Maryland, Baltimore County · University of Notre Dame · UNC Chapel Hill
Machine unlearning is widely used to remove hazardous knowledge from large language models. Modern Vision-Language Models (VLMs), however, process both text and visual inputs, raising a fundamental security question: does unlearning in one modality transfer to the other? We present the first systematic, bidirectional study of cross-modal unlearning transfer across three VLM architectures: LLaVA-1.5 (MLP projection), InstructBLIP (Q-Former), and IDEFICS (gated cross-attention). We find that unlearning transfers across modalities, but the transfer is asymmetric and incomplete. In some cases, text unlearning strongly transfers to vision. However, this robustness is not preserved under typographic attacks that manipulate the visual presentation of text. Under such attacks, previously unlearned knowledge can be readily recovered, indicating shallow unlearning. To address the transfer gap and shallow robustness, we propose CrossInf, an influence-guided mitigation strategy. Motivated by the observation that different model components contribute unequally to cross-modal transfer, CrossInf focuses unlearning on transformer blocks that most influence cross-modal generalization. It reduces the transfer gap by more than half in architectures with strong fusion, while preserving model utility. It also improves robustness under typographic attacks, reducing the attack success rate to near zero. We further conduct human evaluation with three annotators (κ=0.77) to validate our findings. Finally, we analyze shallow unlearning using Centered Kernel Alignment (CKA), providing insights into the observed transfer behavior and robustness limitations.
Sudharshan Balaji, Yili Ren, Guangjing Wang +2
University of South Florida · USA · University of Massachusetts Lowell