Technical Summary: Geometric Unlearning for LLMs with Minimal Data Disclosure

Problem Statement

As Large Language Models (LLMs) are deployed in real-world systems, they face increasing regulatory and governance constraints requiring the post-hoc removal of specific content (e.g., personal data, sensitive topics) while preserving general utility. This is known as selective unlearning.

Existing approaches typically rely on data-driven pipelines that require access to the original training corpus. These methods generally fall into two categories:

1. Output-level refusal tuning: Eliciting refusals or unmatched responses via prompt engineering or inference-time interventions.
2. Parameter updates: Using gradient-based procedures on designated "forget" and "retain" datasets.

However, these strategies face a critical tension: they often require access to the original training data (which may be unavailable due to privacy, licensing, or governance constraints) and risk re-exposing sensitive data during the unlearning process. Furthermore, relying on large, distribution-matched retain streams to prevent collateral degradation is often impractical in deployed settings. The paper posits a need for original-corpus-free selective unlearning that achieves strong target suppression with minimal data disclosure.

Methodology: Geometric Unlearning (GU)

The authors propose Geometric Unlearning (GU), a representation-level approach that operates directly on the model's prompt-time planning states without accessing the original training corpus. The method is grounded in the observation that LLM hidden representations at the prompt stage encode linearly decodable signals predictive of response properties, and that high-level semantic factors are often structured in low-dimensional linear subspaces.

GU proceeds in three core stages:

1. Constructing Target Planning Geometry

Instead of using the original training data, GU defines a small set of safe reference prompts ($D_{ref}$) designed to elicit desired safe behaviors (e.g., refusal templates or "I don't know" responses).

• The model processes these prompts to extract prompt-time hidden states ($h^{pr}_{\ell}$) at specific layers.
• A low-rank subspace (the "safe-planning geometry") is estimated via PCA on these centered activations.
• An orthogonal projector $P_{\ell}$ is computed to map vectors onto this safe subspace, while $P^{\perp}_{\ell}$ projects onto the orthogonal complement. These buffers are precomputed and frozen.

2. Anchor-Conditioned Virtual Prompts

To avoid requiring a full unlearning dataset, GU generates a compact virtual prompt set ($D_{virt}$) using anchor points (e.g., the specific entity or topic to be forgotten).

• Anchors are inserted into diverse contextual templates (biographical, instructional, comparative, etc.) to create synthetic prompts.
• For each prompt, a local window of tokens surrounding the anchor occurrence is identified.
• The model processes these prompts to collect hidden states within this window.

3. Geometric Alignment and Stabilization

The model is fine-tuned to align the hidden states of the virtual prompts with the frozen safe geometry, while preserving non-target utility.

• Core Unlearning Objective: For each anchor hit, the window-aggregated hidden state is decomposed into in-subspace and out-of-subspace components. The loss function ($L_{core}$) consists of:
  • Centroid Pull ($L_{cent}$): Minimizing the distance of the state from the reference mean.
  • Fold-Back Confinement ($L_{fold}$): Penalizing the energy of the residual component orthogonal to the safe subspace. This is achieved by reflecting the state across the subspace and minimizing the cosine dissimilarity, effectively forcing the state to lie within the safe manifold.
• Retain-side Stabilization: To prevent collateral drift (degradation of non-target knowledge), the method employs a frozen teacher model (initialized from the same checkpoint).
  • Background Keep Loss: Aligns the student's output on non-window tokens of target prompts with the teacher.
  • Synthetic Retain Distillation: Aligns the student with the teacher on a separate synthetic pool of non-target prompts (including confusable names to prevent over-generalization).

Key Contributions

1. Original-Corpus-Free Framework: GU eliminates the need for access to the original pretraining corpus or large retain datasets, addressing a primary barrier to practical deployment.
2. Representation-Level Intervention: Rather than modifying output probabilities or weights directly via gradient descent on data, GU manipulates the directional structure of hidden planning states to induce a "fuzzy" or uncertain state for target topics.
3. Data Efficiency: The method achieves effective unlearning using only a minimal set of synthetic prompts generated from anchors and a small set of safe reference prompts.
4. Geometric Regularization: The introduction of fold-back confinement and orthogonal projection provides a mathematically grounded mechanism to steer representations into a safe subspace while preserving orthogonal content.

Experimental Results

The authors evaluated GU on two privacy-oriented benchmarks: ToFU (factual unlearning) and UnlearnPII (personally identifiable information unlearning), using LLaMA-2-7B and LLaMA-3.2-1B models.

• Unlearning Effectiveness: GU achieved strong target suppression (low Extraction Strength and Forget ROUGE), comparable to or exceeding gradient-based baselines like GA and GradDiff.
• Utility Preservation: GU maintained high model utility on non-target tasks, outperforming methods that induced "blank" or "gibberish" outputs.
• Privacy Risk: In Membership Inference Attacks (MIAs), GU reduced privacy risk (measured by deviation from chance AUC) to near-zero levels, indicating that forgotten data became indistinguishable from non-training data.
• Output Characteristics: Unlike baselines that often produce "substitute" (unrelated) answers or "blank" responses, GU consistently produced refusal-style outputs (e.g., "I am not sure"), representing a more structured and safety-compliant unlearning behavior.
• Ablation Studies:
  • Sample Budget: 20–30 synthetic samples per anchor provided the optimal balance between unlearning strength and utility preservation.
  • Layer Selection: Aligning the last one or two layers yielded the best trade-off, as late-layer planning states are most directly coupled to the generation policy.

Significance and Claims

The paper claims that effective unlearning can be achieved with minimal synthetic data disclosure, supporting a "Less is More" paradigm. By operating on the geometric structure of prompt-time planning states, GU bypasses the need for re-exposing sensitive training data.

The authors emphasize that while GU achieves strong performance on standard extractability-based evaluations, it is most effective when targets are reliably invoked by anchors. They acknowledge limitations regarding aliases, multilingual variants, and indirect mentions, noting that the method does not certify complete representational erasure under stronger white-box audits. However, the work demonstrates that controlling a small set of prompt-time states via geometric alignment is a viable and efficient strategy for selective unlearning in constrained, privacy-sensitive environments.