Making unlearning stick: methods that survive relearning attacks

What is this?

Machine unlearning is meant to make a trained model forget a specific slice of what it learned — a person’s data after a deletion request, copyrighted text, or hazardous knowledge — without the cost of retraining from scratch. A well-documented problem is that most unlearning is shallow: the knowledge is suppressed, not removed, and it comes back. One of the cheapest ways to bring it back is a relearning attack — fine-tuning the “unlearned” model for a few steps on a small, sometimes unrelated dataset, after which the supposedly forgotten content reappears. The canonical demonstration of this is Jogging the Memory of Unlearned LLMs (arXiv:2406.13356), and follow-up work through 2026 keeps confirming that unlearning is reversible (arXiv:2505.16831).

The newer question is the constructive one: can unlearning be made robust to that attack? Two 2026 papers approach it from the same direction — the geometry of the model’s representations — and report that it can. RepSelect: Robust LLM Unlearning via Representation Selectivity (arXiv:2606.17168, June 2026) and Robust LLM Unlearning Against Relearning Attacks: The Minor Components in Representations Matter (arXiv:2605.11685, May 2026) both argue that where in representation space you edit determines whether the edit survives.

How it works

The shared diagnosis is that standard unlearning methods push on the wrong directions. Techniques like gradient difference, NPO, or RMU largely move the dominant components of the relevant representations — the high-variance directions that the retain set also uses. That has two bad consequences at once: it disrupts general capability (because those directions are shared), and it is easy to reverse, because a short fine-tune nudges those same dominant directions straight back.

The two papers act on that insight from complementary angles:

Approach                    What it targets                         Intended effect
--------------------------  --------------------------------------  ------------------------------
RepSelect                   Collapses the top principal components  Isolates forget-specific
(2606.17168)                of weight gradients before each update  representation; limits what
                                                                    fine-tuning can pull back
Minor-components method     Edits the low-variance ("minor")        Removes knowledge in a subspace
(2605.11685)                components of representations, which    a relearning attacker is
                            standard methods leave untouched        unlikely to restore

RepSelect frames unlearning as representation selectivity: by removing the top gradient directions before applying an update, it concentrates the change on directions specific to the forget set, leaving the shared, general-capability directions intact. Reported across four model families spanning dense and mixture-of-experts designs (Llama 3, Qwen 3.5, Gemma 4 E4B, DeepSeek V2 Lite) and two forget categories, it achieves a 4–50× larger reduction in post-relearning answer accuracy than the strongest of five baselines (GradDiff, NPO, SimNPO, RMU, UNDIAL), and is reported to be near-perfectly robust to few-shot prompting attacks. The minor-components work reaches a similar goal by the opposite move — deliberately editing the low-variance directions that dominant-component methods ignore, on the argument that those are what relearning fails to recover.

Why it matters

If unlearning is being used as a compliance or safety control — “we removed this data,” “we stripped this hazardous capability” — then reversibility is the whole ballgame. A method that looks strong under benign, single-turn evaluation but folds after ten fine-tuning steps offers assurance that does not hold once a model is shipped as open weights and anyone can fine-tune it. Robustness-to-relearning is therefore the property that actually matters, and it is precisely the one that classic benchmarks did not measure.

The representation-geometry framing also gives defenders a testable model of why unlearning fails, rather than a pile of one-off tricks. It says: the durability of an edit depends on which subspace you touch. That is a more useful engineering target than chasing lower forget-set loss, and it explains why two methods pushing on different components can both improve robustness while point-minimization methods do not.

Defenses

1. Measure robustness, not just forgetting. Report the recovery rate after a standard relearning attack (a short fine-tune on a small forget-adjacent set) and after few-shot prompting — not only benign forget-loss. An unlearning claim without a relearning evaluation is unverified.

2. Prefer representation-aware methods for anything that must stay gone. Approaches that concentrate the edit on forget-specific directions (RepSelect) or on the minor components standard methods ignore report far better post-relearning durability than gradient-difference or preference-style baselines.

3. Keep unlearning as a mitigation, not a delete button. For genuine legal deletion, the only hard guarantee is still not training on the data, or retraining without it. Robust unlearning raises the cost of recovery; it does not prove erasure.

4. Include your deployment steps in the threat model. Quantization and downstream fine-tuning are known recovery channels. Evaluate the unlearned model at the precision you actually ship and after the kind of fine-tuning your users can perform.

5. Layer with access control. Where hazardous or private content must not surface, combine unlearning with output filtering, retrieval restrictions, and least-privilege access rather than relying on the model having truly forgotten.

Status

Work	Reference	Date	Reported contribution
Benign relearning attack	arXiv:2406.13356	2024-06	Few-step fine-tuning recovers “forgotten” knowledge
Reversibility study	arXiv:2505.16831	2025-05	Unlearning is not deletion; edits are reversible
Minor-components defense	arXiv:2605.11685	2026-05	Editing low-variance components resists relearning
RepSelect	arXiv:2606.17168	2026-06	4–50× lower post-relearning accuracy vs. baselines

The transferable point is that unlearning durability is a property of where you edit the representation, and it has to be evaluated against relearning, not just benign queries. The 2026 defenses are progress on the first half; the second half — always testing against recovery — is something any team relying on unlearning can adopt today.