A Mechanistic Perspective and Circuit-Guided Difficulty Metric for Unlearning

AI summary

Overview

Research area: Machine unlearning and mechanistic interpretability for large language models.

Technical level: Advanced. The paper assumes familiarity with transformer internals, circuit discovery, edge attribution patching, integrated gradients, and bi-level optimization.

Scope: The paper introduces a circuit-level, pre-unlearning difficulty score that predicts how hard an individual training sample will be to forget, and uses it to show that easy and hard samples are encoded by structurally different internal circuits.

What This Paper Is About

Machine unlearning removes specific knowledge from an already-trained model without retraining from scratch, but the same procedure succeeds on some samples and fails on others. Existing explanations treat this disparity mainly as a data-side artifact (spurious correlations, redundancy, dataset structure), leaving no model-internal account of why certain samples resist forgetting. The authors argue the disparity reflects how the model itself encodes and protects memorized information, and they build a metric that reads this difficulty directly from the model's internal circuits before any unlearning is performed.

Key Contributions

1. First circuit-level analysis of unlearning difficulty disparity. The paper extracts structured interaction pathways (circuits) from the original model for easy- and hard-to-unlearn samples, revealing that the two groups are memorized through structurally different internal circuitry.

2. Circuit-guided Unlearning Difficulty (CUD) score. A continuous, pre-unlearning metric in [0, 1] that scores each sample's intrinsic unlearning difficulty by measuring the similarity of its circuit to an easy-to-unlearn reference circuit and a hard-to-unlearn reference circuit.

3. Empirical validation across methods and settings. Across unlearning methods and benchmarks (TOFU and an LLM recommendation setting), CUD-selected easy forget sets improve unlearning efficacy while hard sets degrade it, with the separation holding under different similarity metrics and different unlearning loss choices.

4. Mechanistic signature of difficulty. Easy samples rely on shorter, shallower interactions concentrated in earlier-to-intermediate parts of the model; hard samples rely on longer, deeper pathways closer to late-stage computation.

Main Findings

• CUD stratifies difficulty on TOFU. Table 1 reports, averaging across the unlearning methods shown, that the default forget set reaches unlearning efficacy of 57.8, the hard set selected by CUD drops to 43.7 (a gap of -14.1, p ≤ 0.001), and the easy set selected by CUD rises to 61.1 (a gap of +3.3, p ≤ 0.001).

• Hard sets also damage collateral metrics. The averaged retain performance falls from 66.7 (default) to 64.3 (-2.4, p ≤ 0.001) on the hard set and rises to 68.0 (+1.3, p ≤ 0.001) on the easy set. General knowledge falls from 75.5 to 73.1 (-2.4, p ≤ 0.001) on the hard set and is 75.3 (-0.2) on the easy set.

• Easy-set gains are consistent per method. Replacing the default TOFU forget set with the CUD easy set improves unlearning efficacy by between +1.8 and +7.0 points across methods, with average improvements of +3.3 points and p-values on the order of 10^-3.

• Hard-set drops are large per method. Unlearning efficacy drops up to 18% across methods, with p ≤ 10^-13 in all cases. As an example, NPO falls from 54.0 on the default set to 35.7 on the CUD hard set (-18.3, p ≤ 0.001).

• Robust to similarity metric. Instantiating CUD with Cosine, Jaccard, or Hamming similarity produces the same qualitative separation. Hard sets are harder than default, with drops ranging from -10.6 to -14.1 (all p ≤ 10^-13); easy sets improve by +2.4 to +3.7 points.

• Robust to unlearning loss choice. CUD scores computed with the GradDiff unlearning loss and with the UNDIAL unlearning loss correlate at ρ = 0.76 (Figure 3). The authors attribute this stability to the sparsity-inducing regularizer λ‖w‖, which keeps the selected circuits compact and consistent.

• Not confounded by lexical cues. The most salient unigrams and bigrams in the aggregated easy and hard circuits are diverse and do not cluster around a coherent topic (Table 2), indicating CUD is not driven by domain-specific vocabulary or fact-level semantic overlap.

• Not confounded by context length. CUD scores show no meaningful correlation with input length, ρ = -0.02, and both short and long contexts span a wide range of CUD values.

• Edge distributions differ statistically. Easy and hard circuit-edge usage histograms differ with a p-value of 0.01. Easy edges concentrate on a small set of dominant, frequently reused edges, while hard edges are flatter with more mass on low-frequency edges. Both show a heavy-tailed profile.

• Different locations in the network. Edges more frequent in easy samples sit in early-to-mid MLP pathways, including direct input injections (input → m0, input → m1) and local MLP-to-MLP transitions (m0 → m2, m1 → m4) plus repeated fan-out from a single layer (m2 → m3, m2 → m5, m2 → m6, m2 → m8). Edges more frequent in hard samples skew late-stage and output-facing: deeper MLP transitions (m6 → m11, m11 → m13, m11 → m15), direct connections to logits (m9 → logits, m10 → logits), and attention-mediated routing (m6 → a7.h2⟨v⟩).

• TOFU's default forget set is mid-difficulty. The default forget samples closely match the overall CUD score distribution with wide coverage of all difficulty levels (Figure 2), so CUD can be used to construct harder or easier sets than the default.

• Different from Memory Removal Difficulty (MRD). CUD and the MRD-based score (1 - MRD/2, with MRD in [0,2] by default) show weak correlation, ρ = -0.27. MRD assigns very small scores to a large fraction of samples, effectively labeling most samples hard to forget.

• Scales roughly linearly. Anchor construction time grows linearly with forget size (2%: 14.3 min; 4%: 23.7; 6%: 35.2; 8%: 46.6; 10%: 60.3; 20%: 103.5) and with model size (1B: 60.3 min; 3B: 80.8; 8B: 125.3). At 1B parameters and 10% forget size, both figures are 60.3 min.

• Recommendation setting. In the LLM recommendation setting, unlearning on the easy set shows considerably higher unlearning efficiency with negligible utility degradation, outperforming unlearning on a randomly selected forget set by 7.2%. The corresponding tables (Tables 6-7) appear in Appendix B and are not included in the truncated content shown here.

Methodology in Plain English

The authors start from the idea that each sample's prediction is produced by a set of internal pathways, or a circuit. They first need two reference points: a representative circuit for samples that are easy to erase and one for samples that are hard to erase.

To find those samples, they use a bi-level optimization (following Fan et al., 2024a) with a binary selection mask and an L2 regularizer. One objective picks samples whose loss rises after unlearning (low memorization, easy to forget, denoted D_f,E); the other picks samples whose loss stays low after unlearning (high memorization, hard to forget, denoted D_f,H). To reduce bias and stochasticity, each unlearning method is repeated five times with different seeds, and only samples common to all runs are kept.

They then extract circuits for those two sets from the original, pre-unlearning model, producing an easy anchor circuit and a hard anchor circuit. Each circuit is represented as a binary matrix of edges, flattened into a vector.

For any query sample, its own circuit is extracted, flattened, and compared to both anchors using a similarity function. The CUD score combines the two similarities:

CUD(z_i) = (1 - s_E) / [(1 - s_E) + (1 - s_H)]

where s_E and s_H are the similarities to the easy and hard anchors. A score near 0 means the sample's circuit looks like the easy anchor; near 1 means it looks like the hard anchor. Because the score depends only on the original model's internals, it can be computed before any unlearning is applied.

Circuit discovery itself uses edge attribution patching (EAP), which approximates an edge's causal effect with a first-order linearization around the clean input, and EAP with Integrated Gradients (EAP-IG), which integrates the gradient along a linear interpolation path between clean and patched inputs.

Evaluation uses ROUGE on TOFU, AUC on the test set for recommendation, and Jensen-Shannon divergence between the unlearned model's predictions and a retrained-from-scratch model. Because unlearning metrics are lower-is-better, they convert them into "unlearning efficacy" = 1 - unlearning performance, where higher is better. Datasets are TOFU's forget10 split with 400 forget samples and a recommendation benchmark with 500 forget samples.

Why This Matters

Impact on research. The paper reframes unlearning difficulty from a data-side property to a model-internal, mechanistic one. It provides the first continuous, pre-unlearning, circuit-grounded per-sample difficulty measure, which enables quantitative stratification by difficulty range rather than binary worst-case selection. It also shows that difficulty can be analyzed without running the unlearning algorithm at all, contrasting with post-hoc indicators that require unlearning dynamics or attack outcomes.

Real-world applications.

• Compliance and copyright removal: predicting in advance which copyrighted or proprietary samples will resist erasure, so practitioners can allocate effort before deployment.
• Benchmark stress-testing: constructing forget sets at specified difficulty levels to compare unlearning algorithms fairly rather than relying on whatever the default split happens to contain.
• Difficulty-aware training schedules: using continuous scores for easy-to-hard curricula, difficulty-aware sampling, or loss reweighting.
• Targeted intervention: localizing resistance to particular layers or circuit communities (late-layer MLP circuits versus early attention pathways) to choose different unlearning strategies.

Industry relevance. The linear scaling of anchor construction with forget-set size and model size (measured at 1B, 3B, and 8B parameters) supports practical use at larger scales, as does the reported ability to amortize cost by reusing discovered circuits or caching intermediate representations. The paper is explicit that CUD is best suited for offline analysis and pre-unlearning assessment rather than online per-iteration diagnostics on the entire retain set.

Future Directions

1. Efficient approximations of CUD. The authors name computational cost as the main limitation, since CUD requires circuit discovery. They call for lightweight proxies that preserve its predictive and mechanistic fidelity, and for caching or circuit reuse to amortize cost.

2. Controlled benchmarking and curricula. Using CUD to build forget sets at specified difficulty levels, and to design curriculum-style unlearning schedules such as easy-to-hard or hard-focused pacing.

3. Difficulty-aware unlearning algorithms. Adaptive sampling, loss reweighting, and constrained selection strategies that treat samples according to predicted difficulty instead of uniformly. The authors leave exploration of these applications to future work.

4. Targeted, layer-specific interventions. Using circuit analysis to guide interventions localized to specific layers or circuits, on the premise that resistance in late-layer MLP circuits calls for different strategies than resistance mediated by early attention pathways.

5. Open question — reconciling difficulty notions. CUD and MRD correlate only at ρ = -0.27 and assign very different distributions of difficulty, leaving open how mechanistic difficulty relates to perturbation-based or post-hoc difficulty indicators.

Target Audience

Researchers and practitioners working on machine unlearning, mechanistic interpretability, and trustworthy LLM deployment. The paper is most useful to readers already comfortable with transformer circuits, attribution patching, and unlearning benchmarks such as TOFU; readers seeking an applied unlearning recipe without mechanistic background will find the circuit-level machinery demanding. It is also relevant to teams building compliance, data-removal, or recommendation-system pipelines who need to reason about which data will be difficult to remove.

Authors’ abstract

Machine unlearning is becoming essential for building trustworthy and compliant language models. Yet unlearning success varies considerably across individual samples: some are reliably erased, while others persist despite the same procedure. We argue that this disparity is not only a data-side phenomenon, but also reflects model-internal mechanisms that encode and protect memorized information. We study this problem from a mechanistic perspective based on model circuits--structured interaction pathways that govern how predictions are formed. We propose Circuit-guided Unlearning Difficulty (CUD), a {\em pre-unlearning} metric that assigns each sample a continuous difficulty score using circuit-level signals. Extensive experiments demonstrate that CUD reliably separates intrinsically easy and hard samples, and remains stable across unlearning methods. We identify key circuit-level patterns that reveal a mechanistic signature of difficulty: easy-to-unlearn samples are associated with shorter, shallower interactions concentrated in earlier-to-intermediate parts of the original model, whereas hard samples rely on longer and deeper pathways closer to late-stage computation. Compared to existing qualitative studies, CUD takes a first step toward a principled, fine-grained, and interpretable analysis of unlearning difficulty; and motivates the development of unlearning methods grounded in model mechanisms.