💬 NLP

SAEs Can Improve Unlearning: Dynamic Sparse Autoencoder Guardrails for Precision Unlearning in LLMs

This paper introduces Dynamic SAE Guardrails (DSG), a novel unlearning method that leverages dynamic Sparse Autoencoders to overcome the computational, stability, and interpretability limitations of traditional gradient-based approaches, achieving superior precision and robustness in removing unwanted knowledge from LLMs.

Original authors: Aashiq Muhamed, Jacopo Bonato, Mona Diab, Virginia Smith

Published 2026-09-09

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Aashiq Muhamed, Jacopo Bonato, Mona Diab, Virginia Smith

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Large language models are powerful tools that have learned to speak, reason, and create by studying vast amounts of text from the internet. However, this training also means they sometimes absorb information that should not be there, such as dangerous instructions for making weapons, private personal details, or copyrighted stories. When this happens, developers face a difficult problem: how to remove that specific unwanted knowledge without breaking the model's ability to do everything else it was good at. The standard way to fix this has been to retrain the model, essentially teaching it to forget by adjusting its internal math. But this process is incredibly expensive, slow, and often unstable, sometimes causing the model to lose useful skills along with the bad ones. A newer idea involves looking inside the model to find specific patterns of activity that correspond to the unwanted knowledge and simply turning those patterns off, but early attempts at this were clumsy and caused more harm than good.

A team of researchers has now developed a much sharper tool for this job, called Dynamic SAE Guardrails. Their work shows that it is possible to surgically remove dangerous or unwanted information from a language model while leaving its general intelligence completely intact. Instead of trying to rewrite the model's entire brain through heavy retraining, their method acts like a smart filter that watches what the model is thinking in real time. When the model begins to access a specific piece of forbidden knowledge, the system instantly blocks that path. If the model is talking about something safe, the filter stays open, and the conversation flows naturally. This approach is not only more effective at removing the bad data but also far cheaper and more stable than the previous methods, offering a way to keep artificial intelligence safe without sacrificing its usefulness.

The researchers built their system around a concept called a sparse autoencoder, which acts like a translator that breaks down the model's complex internal thoughts into simple, understandable parts. Imagine the model's brain as a massive library where every book is written in a code that is hard to read. The sparse autoencoder is a device that translates that code into a list of clear, distinct topics. The researchers found that certain topics in this list are directly linked to the dangerous information they wanted to remove. In the past, scientists tried to silence these topics by turning them off whenever they appeared, regardless of the context. This was like shutting down a specific aisle in a library every time a book about biology was mentioned, even if the person was just asking about healthy eating. This blunt approach often ruined the model's ability to answer harmless questions.

The breakthrough in this new work was making the system dynamic. Instead of silencing the topics permanently, the researchers created a smart classifier that checks the context of every question. Before the model answers, the system calculates how much the current question relies on the forbidden topics. If the question is clearly about the dangerous subject, the system intervenes and blocks the specific pathways the model would use to answer it. If the question is safe, the system does nothing, allowing the model to use its full knowledge. This conditional approach means the model can still talk about biology, cybersecurity, or any other subject as long as the conversation is not about the specific harmful details the researchers wanted to erase.

To test if this method worked, the team used a benchmark called WMDP, which contains questions about biological weapons and cyberattacks. They trained a model on these dangerous topics and then applied their new system to remove that knowledge. The results were striking. The new method reduced the model's ability to answer questions about biological weapons by more than half compared to the best previous techniques, dropping accuracy from 50 percent down to roughly 30 percent. At the same time, the model's ability to answer general questions about history, geography, and science remained almost perfect, staying above 99 percent. In contrast, the older methods either failed to remove enough of the dangerous knowledge or caused the model to lose its general skills. The researchers also tested the system on a different set of challenges involving privacy and memorization, where it again outperformed existing methods by removing unwanted memories while keeping the model's utility high.

One of the most significant advantages of this approach is its resilience against attempts to undo the unlearning. In the world of artificial intelligence, there is a risk that someone could take a model that has been "cleaned" and retrain it to bring the bad knowledge back. The researchers found that because their system works by blocking specific patterns of activity rather than just changing the model's weights, it is much harder to reverse. When they tried to retrain the model to remember the forbidden information, the system continued to block the pathways, forcing the model to struggle and fail to recover the knowledge. This suggests that the protection is deeper and more durable than previous methods.

The team also demonstrated that this system is incredibly efficient. While traditional methods require hours of expensive computer time to retrain the model for every new piece of information to be removed, this new method only requires a quick check before the model answers a question. The extra time it takes to run the filter is negligible, adding only a tiny fraction of a second to the response time. Furthermore, the system is robust; it does not require constant fine-tuning of complex settings to work well, making it practical for real-world use. The researchers even showed that the system could work without any specific training data at all, simply by using human descriptions of the topics to identify the right patterns to block. This means the method could be deployed quickly to protect models from new types of harmful knowledge without needing to gather large datasets first.

Ultimately, this work represents a shift in how we think about controlling artificial intelligence. Instead of viewing unlearning as a heavy, destructive process that risks breaking the model, the researchers have shown it can be a precise, lightweight, and interpretable operation. By understanding exactly which parts of the model's thinking correspond to specific knowledge, they can build guardrails that protect society from harm without limiting the potential of the technology. The results suggest that we can have models that are both highly capable and strictly safe, provided we have the right tools to guide them.

Technical Summary: Dynamic SAE Guardrails for Precision Unlearning in LLMs

Problem Statement

Machine unlearning aims to remove specific unwanted knowledge (the forget set, $D_{forget}$ ) from trained Large Language Models (LLMs) so that the resulting model is indistinguishable from one trained only on the retain set ( $D_{retain}$ ). While gradient-based unlearning methods (e.g., Gradient Ascent, RMU, NPO) are prevalent, they suffer from significant limitations:

Computational Cost: They require expensive backward passes and fine-tuning.
Instability: They exhibit hyperparameter sensitivity and often degrade under sequential unlearning requests.
Vulnerability: They are susceptible to relearning attacks where adversaries fine-tune the model to recover forgotten knowledge.
Interpretability: They lack transparency regarding which internal mechanisms are being modified.
Data Efficiency: They often require substantial amounts of forget and retain data to function effectively.

Prior attempts to use Sparse Autoencoders (SAEs) for unlearning (e.g., Farrell et al., 2024) relied on static feature clamping. These approaches often underperformed gradient-based methods because they applied interventions universally whenever a feature activated, causing unintended side effects on general model utility and failing to distinguish between relevant and irrelevant contexts.

Methodology: Dynamic SAE Guardrails (DSG)

The authors propose Dynamic SAE Guardrails (DSG), a novel, activation-based unlearning method that leverages the interpretability of SAEs through a dynamic, context-aware intervention strategy. DSG operates without modifying model weights, instead manipulating SAE feature activations during inference.

1. Causal Framework and Feature Selection

DSG frames unlearning as a causal intervention where specific SAE features act as mediators between training data and model outputs. To identify features causally linked to $D_{forget}$ , DSG employs Fisher Information (FI) as a proxy for causal influence.

Theoretical Basis: The paper establishes that the expected squared activation of an SAE feature is proportional to the Fisher Information of its corresponding decoder weights. High FI implies the feature significantly influences the model's output distribution.
Scoring: DSG computes an importance ratio for each feature $j$ :
$\text{imp ratio}(j) = \frac{\text{forget score}(j)}{\max(\text{retain score}(j), \epsilon)}$
where scores are the average squared activations on $D_{forget}$ and $D_{retain}$ , respectively.
Selection: Features are selected based on a percentile threshold ( $p_{ratio}$ ) of this ratio, followed by sorting by the absolute forget score to select the top $n_{feats}$ features. This ensures the selected features are highly active on forget data but minimally active on retain data.

2. Dynamic Sequence-Level Classification

Unlike static methods that clamp features whenever they activate, DSG introduces a dynamic classifier to minimize side effects on general utility.

Statistic Calculation: For an input sequence $x$ , DSG calculates $\rho(x)$ , the fraction of tokens where at least one selected feature in the forget set $S_{nfeats}$ is active ( $f_j(h_t) > 0$ ).
Thresholding: A threshold $\tau$ is determined based on the distribution of $\rho(x)$ on the retain set ( $D_{retain}$ ) using a percentile ( $p_{dyn}$ ).
Classification: An input is classified as "forget-relevant" if $\rho(x) > \tau$ . The paper proves via the Neyman-Pearson lemma that this thresholding approach is statistically optimal for maximizing true-positive rates (forgetting) while controlling false-positive rates (preserving utility).

3. Conditional Clamping Intervention

Intervention is applied conditionally:

If the input is classified as forget-relevant, the activations of the selected features are clamped to a large negative constant ( $-c$ ) for all tokens in the sequence. This effectively severs the causal pathway for that specific knowledge.
If the input is retain-relevant, all feature activations are preserved, leaving general capabilities intact.

4. Sequential Unlearning and Relearning Resistance

Sequential: DSG handles sequential requests by either cumulatively updating feature importance scores ( $DSG_{all}$ ) or taking the union of feature sets selected at each step ( $DSG_{union}$ ).
Relearning Resistance: The method leverages the Superficial Alignment Hypothesis, which posits that activation geometry remains stable during fine-tuning. By operating on these stable activation patterns rather than weights, DSG creates a persistent defense. The paper also introduces Train-time DSG, where the intervention is active during an adversary's fine-tuning attempt, blocking gradients for forget-relevant features and forcing the model to develop new, less efficient processing circuits.

Key Contributions

DSG Introduction: A new activation-based unlearning method combining principled Fisher Information-based feature selection with a dynamic, input-dependent classifier.
Empirical Superiority: Demonstration that DSG achieves a superior forget-utility trade-off compared to leading gradient-based (GA, NPO, RMU) and static SAE methods across multiple benchmarks.
Addressing Core Limitations: DSG offers enhanced computational efficiency (no backward passes), hyperparameter stability, robustness in sequential unlearning, stronger resistance to relearning attacks, improved data efficiency (including zero-shot settings), and interpretable unlearning.

Experimental Results

The authors evaluated DSG on the WMDP (biosecurity and cybersecurity) and MUSE (verbatim memorization, knowledge, privacy) benchmarks using the Gemma-2-2B model.

WMDP-Bio: DSG reduced WMDP accuracy to 29.64% (vs. 50.00% for the next best, RMU) while maintaining 99.34% MMLU accuracy and achieving the highest MT-Bench score (7.78).
WMDP-Cyber: DSG achieved 26.74% WMDP accuracy while preserving 99.07% MMLU accuracy, outperforming all baselines.
MUSE: DSG achieved substantial reductions in verbatim memorization (44.2% on NEWS, 44.7% on BOOKS) and near-complete knowledge memorization removal (98.5% on NEWS, 94.7% on BOOKS), while maintaining or improving utility on the retain set.
Scalability & Sequential Unlearning: DSG remained stable as forget set sizes increased and across sequential unlearning requests, whereas gradient-based methods suffered catastrophic forgetting and performance degradation.
Relearning Attacks: In API-based threat models, DSG (particularly the Train-time variant) demonstrated superior resistance to relearning attacks compared to RMU, maintaining near-random performance on forget data even after adversary fine-tuning.
Data Efficiency & Zero-Shot: DSG maintained performance with as little as 20% of the original data. In zero-shot settings (using only semantic feature descriptions from Neuropedia without specific forget/retain data), DSG outperformed gradient-based baselines.

Significance and Claims

The paper claims that DSG fundamentally shifts the paradigm of machine unlearning by demonstrating that SAEs, when employed dynamically, can significantly outperform gradient-based methods. The authors argue that their approach resolves the "imprecise intervention" problem of prior SAE work by introducing context-awareness.

The significance of DSG lies in its ability to provide:

Precision: Targeted removal of knowledge without collateral damage to general capabilities.
Efficiency: A lightweight inference-time intervention that avoids the computational overhead of retraining or fine-tuning.
Robustness: Enhanced stability against hyperparameter tuning, sequential requests, and adversarial relearning.
Interpretability: A transparent mechanism where unlearning is driven by identifiable, semantically meaningful features, offering a "guardrail" approach to model safety.

The authors conclude that while their evaluation focuses on Gemma-2-2B, the principles of dynamic, activation-based intervention offer a promising and scalable path for improving LLM safety and privacy, particularly in scenarios requiring frequent or sequential unlearning.