Beyond Superficial Forgetting: Thorough Unlearning through Knowledge Density Estimation and Block Re-insertion

AI summary

Overview

• Research area: Machine unlearning for large language models — specifically, removing harmful or sensitive knowledge from a pre-trained LLM without retraining it from scratch.
• Technical level: Advanced. The paper assumes familiarity with transformer layer structure, gradient-based fine-tuning, loss functions, and adversarial evaluation protocols such as retraining attacks.
• Scope in one sentence: The paper proposes KUnBR, an unlearning framework that locates the model layers holding the most harmful knowledge by measuring gradient magnitude on the forget set, then re-inserts those layers into the untouched original model so that unlearning gradients can act on them without interference.

The paper is arXiv:2511.11667v2 [cs.LG], dated 23 Nov 2025, by Feng Guo, Yuntao Wen, Shen Gao (corresponding author), Junshuo Zhang, and Shuo Shang, affiliated with the University of Electronic Science and Technology of China, Chengdu, China. Code is listed at github.com/llmgfffffff/Beyond-Superficial-Forgetting-KUnBR.

What This Paper Is About

Existing machine unlearning methods can make a model stop saying harmful things, but the harmful knowledge is often still sitting in the model's parameters — it has only been masked by a small number of modified layers, which the authors call cover layers. Because of this, an attacker who retrains the model on even a small subset of the forget data can restore most of the "forgotten" knowledge using the Retraining on T (RTT) attack. The goal of KUnBR is to remove harmful knowledge more thoroughly from the parameters themselves, so that it cannot be recovered by such an attack, while keeping the model's general abilities intact.

Key Contributions

1. KUnBR framework: A new unlearning approach (Knowledge Density-Guided Unlearning via Blocks Reinsertion) that identifies which layers contain the most harmful knowledge and performs targeted training on those layers rather than suppressing outputs from a small subset of layers.
2. Knowledge density estimation: A gradient-based metric that quantifies how much of the forget-set knowledge each layer holds, computed as the expected L1 norm of the gradient of the loss with respect to that layer's parameters, then normalized across all layers.
3. Block re-insertion strategy: A method that extracts the knowledge-rich blocks from the unlearned model and grafts them into the original, un-unlearned model while the other layers stay frozen — bypassing the gradient obstruction caused by cover layers and allowing deeper removal of residual knowledge.
4. Empirical validation: Experiments across four benchmark datasets and two backbone models, showing state-of-the-art forgetting performance under RTT attack while maintaining general model utility.

Main Findings

• Existing methods are vulnerable to RTT: Baselines such as GA, GD, RIA, RMU, and NPO show large increases in forget accuracy after an RTT attack, indicating that supposedly removed knowledge is recoverable. For example, on LLaMA3-8B-Instruct's Random Birthdays results, GA goes from 23.5 forget accuracy after unlearning to 87.2 under RTT, with a recovery of 63.7.
• KUnBR reduces recoverable knowledge: On LLaMA3-8B-Instruct, KUnBR reports a recovery of 7.0 on Random Birthdays, 9.6 on WMDP-Deduped, 10.1 on Years, and 11.5 on MMLU. The paper states KUnBR exhibits the smallest increase in forget accuracy across all four datasets on LLaMA3-8B-Instruct, and achieves the best accuracy after RTT attacks on Zephyr-7B-beta as well.
• General capabilities are largely preserved: Under the RKWU utility framework (Reasoning on Big-Bench-Hard, Factuality on TriviaQA, Truthfulness on TruthfulQA MC1, Fluency via AlpacaEval-based bi-/tri-gram entropy), KUnBR scores 41.2 / 56.1 / 36.6 / 706.7 on Random Birthdays, 40.2 / 52.3 / 35.2 / 703.1 on WMDP-Deduped, 40.1 / 56.4 / 36.4 / 706.3 on Years, and 41.1 / 46.9 / 36.2 / 708.8 on MMLU. The paper attributes this to density-guided block selection and localized block-level unlearning.
• RIA and NPO damage utility: The paper reports that these two baselines perform poorly on general capability tests because their unlearning involves output-level changes; for instance, NPO records values of 0.00 for Reasoning and Factuality on both the Years and MMLU columns of Table 2.
• Both components are necessary: Removing the re-insertion step degrades the method back to plain Gradient Difference, with forget accuracy rising to 64.9 on Random Birthdays and RTT accuracy to 80.2 (versus 36.9 and 43.9 for full KUnBR). Removing the pre-unlearning warm-up also worsens results, e.g., 46.4 forget accuracy and 54.1 RTT accuracy on Random Birthdays.
• Density-guided block selection beats fixed strategies: Selecting only head (output-adjacent) blocks produces no significant decline in forget accuracy; selecting bottom (input-adjacent) blocks gives limited forgetting; uniform "average" selection performs slightly better than both but is unstable in later epochs. The knowledge-density-driven dynamic selection is reported as the most effective.
• Robustness to hyperparameters: Block counts M of 4, 8, 16, and 32 were tested with Top-K of 25%, 50%, and 75% on the Years dataset, and the paper reports that most configurations substantially outperform baselines, with consistent behavior across LLaMA-3 and Zephyr. Fewer blocks (M=4) hamper forgetting by spanning many layers, and excessive blocks (M=32) may overlook inter-layer dependencies.
• Robustness to prompt-level attacks: Across nine constructed adversarial variants on the WMDP dataset — Prefix Injection, Affirmative Suffix, Role Playing, Multiple Choice, Reverse Query, Synonym Manipulation, Background Hint, In-context Learning, and Cross Lingual — GD shows a recovery from 18.18% to 21.21% on the forgetting set, whereas KUnBR remains at 18.18%.
• Comparable computational cost: Training times in minutes on a single NVIDIA A800 GPU are GA (24), GD (20), RMU (9), RIA (8), NPO (16), and KUnBR (17). KUnBR is 88.9% higher than RMU but 15% lower than the state-of-the-art GD method.
• Case study behavior: On the example question "When was Julia Brown born?" (correct answer B. 1989), the paper reports that RMU fails to produce meaningful or readable content both before and after RTT, GA/RIA/GD produce incorrect answers after unlearning but recall the harmful knowledge after RTT, and KUnBR fails to provide the forgotten knowledge both after unlearning and after RTT while still including explanations.

Methodology in Plain English

The method works in three stages.

Stage 1 — Global warm-up. The model is first fine-tuned with the standard Gradient Difference objective, which performs gradient ascent on the forget set (to push the model away from the harmful answers) and gradient descent on the retain set (to preserve general knowledge). This full-parameter warm-up accelerates overall convergence.

Stage 2 — Finding where the knowledge lives. For each layer, the authors feed the forget set through the model and measure the absolute value of the gradient of the loss with respect to that layer's parameters. A large gradient magnitude means the layer is sensitive to the forget-set information, so it is treated as holding high "knowledge density." These per-layer values are normalized into proportions of total knowledge density across all H layers. Nearby layers are then grouped into M blocks of N = floor(H/M) layers each, and each block's cumulative density is computed. Blocks are ranked, and the top-K blocks by density are selected. The last two layers are deliberately excluded, because the authors observe a surge in knowledge density there that they attribute to involvement in output generation rather than genuine knowledge storage.

Stage 3 — Block re-insertion. The selected high-density blocks are taken from the unlearned model and inserted back into their original positions in the untouched original model, with all other layers frozen. Gradient Difference is then applied to this "grafted" model. Because the surrounding layers are unmodified and frozen, no cover layer forms to block the gradient, so residual knowledge inside the selected blocks can be removed more deeply. The MLP components are the focus here, motivated by prior work showing that MLPs act as neural memory units and are the layers primarily modified during unlearning.

Why This Matters

Impact on research. The paper reframes unlearning quality as a question of where knowledge physically resides in a model rather than how well a model suppresses outputs. It provides a measurable proxy — gradient magnitude on the forget set — for locating that knowledge, and it exposes RTT-based recovery as the key stress test that output-level methods fail. This shifts the evaluation standard for the field from "does the model still say it?" to "can the knowledge be brought back?"

Real-world applications:

• Regulatory compliance with "right to be forgotten" requirements, where an organization must genuinely remove a user's data from a deployed model.
• Removal of copyrighted or licensed text ingested during pre-training, where suppressing outputs alone would leave legal exposure.
• Decommissioning dangerous knowledge such as biosecurity or cyberattack content, where a jailbreak or a small amount of fine-tuning must not be able to restore it.
• Cleaning sensitive personal or medical information from models before release, particularly where adversaries can perform fine-tuning attacks against a public checkpoint.

Industry relevance. Any organization that fine-tunes or deploys LLMs and must make auditable deletion claims has a stake in this problem. The paper's finding that block-level unlearning is roughly comparable in training time to existing Gradient Difference baselines (17 minutes versus 20 minutes on the Years dataset) suggests the approach is not prohibitively expensive relative to what practitioners already run.

Future Directions

• Generalizing beyond the tested backbones. All experiments use LLaMA3-8B-Instruct and Zephyr-7B-beta; whether the knowledge density metric and block re-insertion behave the same way on much larger or non-transformer architectures is an open question.
• Making the density estimate cheaper and more precise. Density is currently measured with per-layer gradient magnitudes on the forget set; better or lower-cost estimators, and validation of the assumption that the last two layers' density surge is an artifact rather than real storage, would strengthen the method.
• Broader attack evaluation. The robustness evidence covers RTT and nine prompt-level variants on WMDP. Adversarial attacks that perturb unlearning mechanisms directly, or that combine backdoor triggers with retraining, remain largely untested.
• Understanding why block-level unlearning preserves utility. The paper attributes preserved general capabilities to localized block-wise unlearning, but the mechanism by which the retain set protects frozen and re-inserted layers is not fully characterized.

Target Audience

Researchers and engineers working on LLM safety, alignment, privacy, and compliance — particularly those who evaluate unlearning methods and need to defend against knowledge-recovery attacks. It is also relevant to practitioners deploying models in regulated settings who need to justify deletion claims. Readers should be comfortable with transformer internals, gradient-based optimization, and benchmark-style evaluation; those new to unlearning will find the cover-layer framing and the RTT attack setup understandable, but the density-estimation formulas and block-selection procedure require a working background in machine learning.

Authors’ abstract

Machine unlearning, which selectively removes harmful knowledge from a pre-trained model without retraining from scratch, is crucial for addressing privacy, regulatory compliance, and ethical concerns in Large Language Models (LLMs). However, existing unlearning methods often struggle to thoroughly remove harmful knowledge, leaving residual harmful knowledge that can be easily recovered. To address these limitations, we propose Knowledge Density-Guided Unlearning via Blocks Reinsertion (KUnBR), a novel approach that first identifies layers with rich harmful knowledge and then thoroughly eliminates the harmful knowledge via re-insertion strategy. Our method introduces knowledge density estimation to quantify and locate layers containing the most harmful knowledge, enabling precise unlearning. Additionally, we design a layer re-insertion strategy that extracts and re-inserts harmful knowledge-rich layers into the original LLM, bypassing gradient obstruction caused by cover layers and ensuring effective gradient propagation during unlearning. Extensive experiments conducted on several unlearning and general capability benchmarks demonstrate that KUnBR achieves state-of-the-art forgetting performance while maintaining model utility.