aiqbench analysis
RepSelect addresses a critical vulnerability in current LLM unlearning methods by preventing adversaries from easily restoring hazardous knowledge through fine-tuning or few-shot prompting. By selectively editing specific weight representations rather than shared subspaces, this approach maintains general model capabilities while offering 4-40x greater robustness against recovery attacks compared to existing baselines. This research advances the field of AI safety by establishing a deeper standard for data removal that withstands active adversarial attempts.
RepSelect: Robust LLM Unlearning via Representation Selectivity
arXiv:2606.17168v3 Announce Type: replace Abstract: When LLM weights are open or fine-tuning is available through an API, suppressing hazardous knowledge and tendencies is not enough: removal has to be deep enough that an adversary cannot restore it. Existing unlearning is shallow by this standard: fine-tuning or a handful of in-context examples brings the behaviour back, and it often degrades general capabilities in the process. We identify a root cause: existing methods edit representations shared with the retain set and lying in the subspace that a fine-tuning attacker recovers, making unlearning simultaneously easy to undo and disruptive. Leveraging this, we propose RepSelect (Representation Selectivity), which isolates forget-set-specific representations by collapsing the top principal components of the weight gradients before each unlearning update, preserving general capabilities while limiting what fine-tuning can recover. Across five unlearning datasets spanning both knowledge (biohazard, cyber, facts about real individuals) and tendencies (abusive, sycophantic), and three model families covering dense and Mixture-of-Experts architectures, RepSelect yields a 4-40x larger drop in post-relearning answer probability than five widely used baselines (GradDiff, NPO, SimNPO, RMU, UNDIAL). It is also near-perfectly robust to few-shot prompting and holds under an adaptive attack designed to exploit its mechanism. Our results show that unlearning needs to be selective about which representations it edits.
Abstract:When LLM weights are open or fine-tuning is available through an API, suppressing hazardous knowledge and tendencies is not enough: removal has to be deep enough that an adversary cannot restore it. Existing unlearning is shallow by this standard: fine-tuning or a handful of in-context examples brings the behaviour back, and it often degrades general capabilities in the process. We identify a root cause: existing methods edit representations shared with the retain set and lying in the subspace that a fine-tuning attacker recovers, making unlearning simultaneously easy to undo and disruptive. Leveraging this, we propose RepSelect (Representation Selectivity), which isolates forget-set-specific representations by collapsing the top principal components of the weight gradients before each unlearning update, preserving general capabilities while limiting what fine-tuning can recover. Across five unlearning datasets spanning both knowledge (biohazard, cyber, facts about real individuals) and tendencies (abusive, sycophantic), and three model families covering dense and Mixture-of-Experts architectures, RepSelect yields a 4-40x larger drop in post-relearning answer probability than five widely used baselines (GradDiff, NPO, SimNPO, RMU, UNDIAL). It is also near-perfectly robust to few-shot prompting and holds under an adaptive attack designed to exploit its mechanism. Our results show that unlearning needs to be selective about which representations it edits.
Computation and Language (cs.CL)
arXiv:2606.17168 [cs.CL]
(or arXiv:2606.17168v3 [cs.CL] for this version)
https://doi.org/10.48550/arXiv.2606.17168 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 297 words
Related coverage
Compositional Concepts Erasing: Disentangling Object-Style via Domain Manifold Unlearning
arXiv · Oct 15, 2026
A Red Line and Oversight Framework for Government AI Contracts
AI Alignment Forum · Jul 18, 2026
TULIP: Targeted LLM Unlearning at Layers Identified Per-Input
arXiv · Sep 29, 2026
You Can't Have It Both Ways: Concept Entanglement Limits Diffusion Model Unlearning
arXiv · Sep 29, 2026