Robust LLM Unlearning Against Relearning Attacks: The Minor Components in Representations Matter

• URL: http://arxiv.org/abs/2605.11685v1
• Date: Tue, 12 May 2026 07:43:46 GMT
• Title: Robust LLM Unlearning Against Relearning Attacks: The Minor Components in Representations Matter
• Abstract summary: Un unlearned models rapidly recover "forgotten" knowledge through relearning attacks.<n>This raises serious security concerns, especially for open-weight models.<n>We propose Minor Component Unlearning (MCU), a novel unlearning approach that explicitly targets minor components in representations.
• Score: 15.200685676804774
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language model (LLM) unlearning aims to remove specific data influences from pre-trained model without costly retraining, addressing privacy, copyright, and safety concerns. However, recent studies reveal a critical vulnerability: unlearned models rapidly recover "forgotten" knowledge through relearning attacks. This fragility raises serious security concerns, especially for open-weight models. In this work, we investigate the fundamental mechanism underlying this fragility from a representation geometry perspective. We discover that existing unlearning methods predominantly optimize along dominant components, leaving minor components largely unchanged. Critically, during relearning attacks, the modifications in these dominant components are easily reversed, enabling rapid knowledge recovery, whereas minor components exhibit stronger resistance to such reversal. We further provide a theoretical analysis that explains both observations from the spectral structure of representations. Building on this insight, we propose Minor Component Unlearning (MCU), a novel unlearning approach that explicitly targets minor components in representations. By concentrating unlearning effects in these inherently robust directions, our method achieves substantially improved resistance to relearning attacks. Extensive experiments on three datasets validate our approach, demonstrating significant improvements over state-of-the-art methods including sharpness-aware minimization.

Related papers

• Test-Time Unlearning via Sparse Autoencoder [55.4290003355764]
  We propose ARIA, a test-time unlearning method that leaves model weights intact and gates access to unwanted knowledge only when generation enters a forget-related state.<n>ARIA improves the forget-retain trade-off over weight-based baselines across both a thinking model and an instruction model.
  arXiv  Detail & Related papers  (2026-09-14T18:58:09Z)
• Large Vision-Language Models Get Lost in Attention [51.851592109135716]
  We propose a unified framework grounded in information theory and geometry to quantify the geometric and entropic nature of residual updates.<n>Applying this unified framework reveals a fundamental functional decoupling: Attention acts as a subspace-language operator focused on reconfiguration, whereas FFNs serve as subspace-language operators driving semantic innovation.
  arXiv  Detail & Related papers  (2026-05-07T04:45:52Z)
• Towards Unveiling Vulnerabilities of Large Reasoning Models in Machine Unlearning [28.94914260713979]
  Large language models (LRMs) provide explicit multi-step reasoning traces.<n>Unlearning techniques aim to eliminate the influence of specific data from trained models without full retraining.<n>Unlearning may also introduce new security vulnerabilities by exposing additional interaction surfaces.
  arXiv  Detail & Related papers  (2026-04-05T20:21:18Z)
• ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recovery [73.8181449261685]
  Federated Learning (FL) enables collaborative model training by sharing model updates instead of raw data, aiming to protect user privacy.<n>Recent studies reveal that these shared updates can inadvertently leak sensitive training data through gradient inversion attacks (GIAs)
  arXiv  Detail & Related papers  (2026-03-18T11:40:44Z)
• Why Loss Re-weighting Works If You Stop Early: Training Dynamics of Unconstrained Features [34.88156871518115]
  We introduce a small-scale model (SSM) to transparently demonstrate and analyze this phenomenon.<n>On the one hand, the SSM reveals how vanilla empirical risk minimization preferentially learns to distinguish majority classes over minorities early in training.<n>In stark contrast, reweighting restores balanced learning dynamics, enabling the simultaneous learning of features associated with both majorities and minorities.
  arXiv  Detail & Related papers  (2026-01-17T11:26:53Z)
• Beyond Sharp Minima: Robust LLM Unlearning via Feedback-Guided Multi-Point Optimization [37.965539404740774]
  We propose a bi-level feedback-guided optimization framework that explicitly seeks more stable parameter regions.<n>Experiments on WMDP and MUSE benchmarks demonstrate that our method is significantly more robust against both relearning and jailbreaking attacks.
  arXiv  Detail & Related papers  (2025-09-24T15:23:46Z)
• Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning [54.26807397329468]
  This work explores a previously overlooked vulnerability in distributed deep learning systems.<n>An adversary who intercepts the intermediate features transmitted between them can still pose a serious threat.<n>We propose an exploitation strategy specifically designed for distributed settings.
  arXiv  Detail & Related papers  (2025-07-09T20:09:00Z)
• Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond [41.3029262040131]
  We investigate how to make unlearned models robust against relearning attacks.<n>Our analysis reveals that smoothness optimization plays a pivotal role in mitigating relearning attacks.
  arXiv  Detail & Related papers  (2025-02-07T23:03:55Z)
• Improving LLM Unlearning Robustness via Random Perturbations [9.075604660200053]
  We show that current state-of-the-art LLM unlearning methods inherently reduce models' robustness.<n>We propose a novel theoretical framework that reframes the unlearning process as backdoor attacks and defenses.
  arXiv  Detail & Related papers  (2025-01-31T15:12:20Z)
• Just a Simple Transformation is Enough for Data Protection in Vertical Federated Learning [83.90283731845867]
  We consider feature reconstruction attacks, a common risk targeting input data compromise.<n>We show that Federated-based models are resistant to state-of-the-art feature reconstruction attacks.
  arXiv  Detail & Related papers  (2024-12-16T12:02:12Z)
• Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearning [49.242828934501986]
  Multimodal contrastive learning has emerged as a powerful paradigm for building high-quality features. backdoor attacks subtly embed malicious behaviors within the model during training. We introduce an innovative token-based localized forgetting training regime.
  arXiv  Detail & Related papers  (2024-03-24T18:33:15Z)
• Improving robustness of jet tagging algorithms with adversarial training [56.79800815519762]
  We investigate the vulnerability of flavor tagging algorithms via application of adversarial attacks. We present an adversarial training strategy that mitigates the impact of such simulated attacks.
  arXiv  Detail & Related papers  (2022-03-25T19:57:19Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.