🤖 machine learning

Natively Unlearnable Large Language Models

This paper introduces NULLs (Natively Unlearnable LLMs), a model architecture that uses shared backbone neurons and sparsely activated source-specific sinks to enable efficient, robust, and data-free unlearning of individual training sources while preserving the benefits of joint learning and general language capabilities.

Original authors: Gaurav R. Ghosal, Pratyush Maini, Aditi Raghunathan

Published 2026-06-15

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Gaurav R. Ghosal, Pratyush Maini, Aditi Raghunathan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a massive library of knowledge inside a giant brain (a Large Language Model). Usually, when you teach this brain, you mix everything together. If you teach it a fact about "Harry Potter" and a fact about "World War II," those memories get tangled up in the same neurons. If you later need to remove the "Harry Potter" memory because of a legal request, it's like trying to cut out a single thread from a sweater without unraveling the whole thing. You might accidentally delete the history lesson too, or the Harry Potter memory might sneak back in.

This paper introduces a new way to build these AI brains called NULLs (Natively Unlearnable LLMs). Instead of mixing everything into one big pile, NULLs builds the brain with a special "sorting system" from day one.

Here is how it works, using simple analogies:

1. The "Shared Kitchen" vs. "Personal Lockers"

Think of the AI's brain as having two types of storage:

The Shared Kitchen (The Backbone): This is where the AI learns general things that apply to everything, like grammar, how to form sentences, or common facts about the world (e.g., "Paris is in France"). Everyone uses this kitchen.
Personal Lockers (The Sinks): This is the new invention. For every specific source of information (like a single Wikipedia article or a specific book), the AI is given a unique set of "lockers" (neurons) that only that source can use.

When the AI learns a fact that is unique to one article (like the name of a specific whistleblower in a news story), it naturally stores that fact in that article's Personal Locker. When it learns a general fact (like "whistleblowers are important"), that goes into the Shared Kitchen.

2. The Magic Switch (Unlearning)

In standard AI, if you want to forget something, you have to retrain the whole brain or try to surgically remove weights, which often breaks other things.

With NULLs, "unlearning" is as simple as turning off a light switch.

If a publisher says, "Remove that specific article from our model," you don't need to retrain. You just disable the "Personal Locker" assigned to that article.
The AI instantly forgets the unique facts from that article because its locker is locked.
However, the Shared Kitchen remains open. The AI still knows general facts about the topic because those are stored in the common area, not the specific locker.

It's like if you had a house with a shared living room and a bedroom for every guest. If a guest leaves, you just lock their bedroom door. The living room (where everyone hangs out) stays exactly the same, and the house doesn't fall apart.

3. What the Paper Found

The researchers tested this idea in two main ways:

The Wikipedia Test (Fine-Grained): They trained a model on 6 million Wikipedia articles. They wanted to see if they could remove just one article without deleting the general knowledge found in similar articles.
- Result: When they "locked" the locker for one article, the model forgot the unique details of that article but kept the general knowledge shared by other articles. It worked almost as well as if they had thrown away the article and retrained the model from scratch (which is usually too expensive to do).
The Harry Potter Test (Coarse-Grained): They trained a model on the entire Harry Potter book series and then tried to remove all Harry Potter knowledge.
- Result: When they turned off the "Harry Potter locker," the model stopped talking about wizards and started talking about normal things (like city council meetings) when prompted with Harry Potter sentences.
- Bonus: They tried to trick the model into remembering Harry Potter again using "adversarial" prompts or by re-teaching it a little bit. The standard AI models failed and remembered the books quickly. The NULLs model, however, stayed "unlearned" and resisted these tricks.

4. Does it make the AI dumber?

A big worry is that if you separate the memories, the AI might get worse at general tasks. The paper tested this on standard language benchmarks (like answering science questions or solving logic puzzles).

Result: The NULLs model performed just as well as a standard, non-specialized AI. It didn't lose its general smarts.

Summary

The paper argues that we shouldn't wait until after an AI is trained to figure out how to delete data. Instead, we should build the "delete button" directly into the architecture. By giving every data source its own dedicated "locker" while sharing a common "kitchen," we can surgically remove specific information without breaking the rest of the model or needing to retrain everything from scratch.

Technical Summary: Natively Unlearnable Large Language Models (NULLs)

1. Problem Statement

Large Language Models (LLMs) are trained on web-scale datasets that often contain copyrighted material, personal information, and regulated content. Legal and ethical requirements may necessitate the removal of specific data sources (unlearning) from a deployed model. However, standard training entangles all data sources into a single shared set of weights via gradient descent, making it difficult to isolate the contribution of any single source.

Existing approaches face a trade-off:

Post-hoc unlearning: Applies corrective updates after training. While this preserves joint learning, the target's influence remains entangled in shared weights, leading to incomplete removal, degradation of related knowledge, and vulnerability to adversarial relearning.
Source isolation (Mixture-of-Experts): Trains separate models or modules for each source. While this facilitates easy removal, it prevents joint learning across sources, sacrificing generalization benefits and failing to scale to fine-grained sources (e.g., millions of individual documents).

The core challenge is to achieve source-level unlearning without sacrificing joint learning and generalization capabilities.

2. Methodology: NULLs Architecture

The authors propose NULLs (Natively Unlearnable LLMs), a model class designed to satisfy the opposing goals of isolating source-specific contributions while learning jointly across sources.

Architecture Modifications:

Backbone and Sinks: The model modifies the Fully Connected (MLP) layers of the transformer. The hidden neurons are partitioned into two sets:
1. Shared Backbone ( $N_{gen}$ ): A set of neurons active for all inputs, responsible for learning general capabilities and information shared across sources.
2. Memorization Sink Pool ( $N_{pool}$ ): A larger pool of neurons where source-specific information is localized.
Sparse Activation Masks: Each data source $S_i$ $S_{i}$ is assigned a deterministic, sparse mask over the sink pool. This mask is generated from the source identifier using a pseudo-random number generator.
- During training, a document activates the shared backbone neurons plus a specific subset of sink neurons defined by its mask.
- The ratio of active sink neurons to the total pool ( $N_{source}/N_{pool}$ ) is the overlap ratio, controlling the interference between sources.
Training Dynamics: The mechanism relies on the principle that the shared backbone receives gradient updates from all sources, creating interference for source-specific facts. Conversely, sink neurons are active for only a fraction of sources, receiving less interference. Consequently, source-specific facts are "fit" into the sinks before the backbone, while shared facts accumulate in the backbone.
Unlearning Mechanism: At inference time, unlearning is performed by disabling the sink mask corresponding to the target source. This can be done by:
- Sink-Off: Routing the input to the next-closest source's sink (by embedding similarity) or simply not applying the target mask.
- Permanent Removal: Zeroing out the parameters of neurons active in the target's mask.
- Crucially, this requires no gradient updates and no access to retained data.

3. Key Contributions

Native Unlearnability: NULLs integrates unlearning directly into the model structure, eliminating the need for post-hoc weight updates.
Scalability: By using sparse masks over a shared sink pool, NULLs can handle a combinatorial number of sources (e.g., ~6 million Wikipedia articles) without linearly increasing the parameter count.
Disentanglement without Supervision: The method automatically isolates source-specific knowledge without requiring explicit supervision to identify what information belongs to which source.
Robustness: The architecture resists adversarial extraction and relearning attacks that typically reverse post-hoc unlearning.

4. Experimental Results

The authors evaluated NULLs in two case studies:

A. Article-Level Unlearning (Wikipedia)

Setup: A 1B-parameter model trained on ~6 million Wikipedia articles.
Findings:
- Surgical Removal: Disabling a specific article's sink sharply reduced the model's recall of facts unique to that article (Truth Ratio $\approx$ 0) while preserving facts shared with semantically related articles.
- Comparison to Retraining: The performance of NULLs (Sink-Off) closely matched a gold-standard model retrained from scratch without the target article.
- Contrast with Baselines: Post-hoc gradient methods (e.g., NPO, gradient ascent) degraded shared knowledge at the same rate as target-specific knowledge, failing to distinguish between them.

B. Topic-Level Unlearning (Harry Potter)

Setup: A 1B-parameter model trained on a mixture of C4 corpus and the 7 Harry Potter books.
Findings:
- Behavioral Change: Disabling the "Harry Potter" sink eliminated references to the books in generated text, shifting the topic to unrelated content while maintaining coherence.
- Adversarial Robustness:
  - Extraction: NULLs (Sink-Off) resisted adversarial prompting (GCG optimization) to elicit unlearned text, matching the performance of a model never trained on the books.
  - Relearning: When fine-tuned on a small subset of Harry Potter data, a standard transformer with post-hoc unlearning rapidly recovered the unlearned information (within 10 steps). In contrast, NULLs (Sink-Off) exhibited relearning dynamics identical to a model that had never seen the data.

C. General Capabilities and Scaling

Capability Preservation: NULLs matched standard transformers on downstream benchmarks (ARC-E, Winogrande, PIQA, SciQ) and maintained knowledge capacity on article-specific facts.
Sink Pool Sensitivity: Increasing the sink pool size (reducing overlap) improved memorization capacity without significantly weakening the ability to unlearn. The size of the sink pool primarily determines how much is learned, not whether it can be unlearned.

5. Significance and Claims

The paper claims that source-level unlearning need not be an afterthought but can be built natively into LLM training.

Reconciliation of Goals: NULLs demonstrates that disentangling source contributions and learning jointly across sources are not mutually exclusive.
Native Control: It enables control over large models at the level of their data, not just their outputs.
Attribution: Because source contributions remain disentangled, the model's outputs can be attributed to specific pretraining data sources, and the influence of any single source can be measured directly by toggling its sink.

The authors note limitations, including the use of 1B-parameter models and the reliance on predefined source definitions at training time, acknowledging that handling unlearning requests for undefined sources remains an open problem. However, the results suggest that native unlearnability is a viable path forward for compliant and controllable AI systems.