🤖 machine learning

SAUL: Sharpness-Aware Augmented-Lagrangian Unlearning

The paper proposes SAUL, a novel machine unlearning framework for Large Language Models that formulates forgetting as an explicit constrained minimization problem using an adaptive Augmented-Lagrangian controller and sharpness-aware updates to effectively balance knowledge erasure with the preservation of general utility.

Original authors: Jaewan Choi, Junyoung Yang, Sangdon Park

Published 2026-08-18

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jaewan Choi, Junyoung Yang, Sangdon Park

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Large language models are the engines behind many of today's most advanced artificial intelligence tools. They are trained on vast oceans of text, learning to predict the next word in a sentence with remarkable accuracy. However, this training often includes sensitive information, such as private data, copyrighted material, or harmful instructions that society would prefer these models never learn. The challenge is how to make a model "forget" this specific bad or private information without breaking its ability to answer general questions or perform useful tasks. If you try to erase the bad data by simply retraining the model from scratch, it is incredibly expensive and slow. If you try to surgically remove the knowledge, you often end up damaging the model's general intelligence, causing it to stumble on harmless questions it used to answer perfectly. This creates a difficult balancing act: how do you remove just enough to be safe, but not so much that the model becomes useless?

Researchers at POSTECH in South Korea have proposed a new approach to solve this delicate problem, calling it SAUL. Instead of treating the removal of information as a vague goal where the model tries to be "less good" at specific tasks while staying "good" at others, they framed it as a strict rule. Imagine a student taking a test who is told, "You must get a score of zero on these three specific questions about a secret topic, but you must keep your score on all other questions as high as possible." Previous methods often tried to achieve this by mixing the two goals together with a single instruction, which made it hard to know exactly when the secret topic was truly forgotten or when the model was being forced to forget too much. The new method, SAUL, sets a clear, hard line: the model must reach a specific level of forgetting, and once it crosses that line, the pressure to forget stops immediately.

The core of this new system is a smart controller that watches the model's progress in real time. It constantly checks if the model has successfully forgotten the target information. If the model is still remembering too much, the controller applies pressure to help it forget. But the moment the model reaches the required level of forgetting, the controller turns off the pressure entirely. This prevents the model from being forced to forget more than necessary, which is what often causes it to lose its general knowledge. The researchers found that by stopping the forgetting process exactly when the goal is met, the model retains much more of its useful abilities than before. To make this process even more stable, they added a technique that ensures the model's knowledge doesn't wobble or change unexpectedly with tiny shifts in its internal settings, and they used two separate "memory tracks" for the forgetting and remembering tasks so they don't interfere with each other.

When the team tested this method on several different benchmarks, the results were clear. On a dataset called ToFU, which tests a model's ability to forget specific fictional authors, the new method achieved the best balance between forgetting and keeping general knowledge. It successfully erased the target information while keeping the model's overall performance high. In tests involving dangerous knowledge, such as instructions on how to create biological weapons or cyberattacks, the method reduced the model's ability to answer those questions to the level of random guessing, while still allowing it to answer general science and history questions correctly. The researchers also showed that this "stop-when-done" controller could be added to other existing methods to improve them, suggesting that the idea of setting a clear limit on forgetting is valuable across the board.

The study highlights that the key to effective unlearning is not just trying harder to forget, but knowing exactly when to stop. By treating forgetting as a constraint with a clear finish line, rather than an endless struggle, the researchers created a system that is more precise and less destructive to the model's overall intelligence. While the method requires careful selection of the "forgetting threshold"—the specific point at which the model is considered to have forgotten enough—it offers a practical way to manage the trade-off between safety and utility. The work suggests that in the future, we may be able to edit large language models with the precision of a surgeon rather than the blunt force of a sledgehammer, removing harmful data while leaving the rest of the model's knowledge intact.

Technical Summary: SAUL (Sharpness-Aware Augmented-Lagrangian Unlearning)

Problem Statement

Large Language Models (LLMs) are trained on massive corpora that often contain sensitive, copyrighted, or harmful information. Machine unlearning aims to remove the influence of specific "forget" data from a model without the prohibitive cost of retraining from scratch. However, existing methods face a critical trade-off: erasing target knowledge often degrades general utility on "retain" data.

Current approaches typically handle this conflict through weighted objectives that combine forget and retain terms. These methods implicitly specify the desired forgetting level via trade-off coefficients, which are sensitive to dataset, model architecture, and forgetting ratios. Consequently, they often result in either insufficient forgetting or unnecessary utility degradation. Furthermore, recent optimization-based approaches (e.g., bi-level methods or sharpness-aware minimization) treat forgetting as open-ended pressure rather than an explicit constraint, allowing unnecessary forgetting to erode retain-side utility.

Methodology: SAUL

The authors propose SAUL (Sharpness-Aware Augmented-Lagrangian Unlearning), a framework that formulates LLM unlearning as a constrained minimization problem based on the principle of "forget enough, but no more than necessary."

1. Constrained Formulation

Unlike weighted formulations, SAUL defines unlearning as:
$\min_{\theta} L_r(\theta) \quad \text{subject to} \quad L_f(\theta) \geq \alpha$
where $L_r$ is the retain loss, $L_f$ is the forget loss, and $\alpha$ is a user-specified threshold defining an explicit satisfaction level for forgetting. This formulation allows optimization to focus solely on preserving retain-side utility once the forgetting criterion is met.

2. Augmented Lagrangian Controller (ALM)

At the core of SAUL is an Augmented Lagrangian controller that adaptively manages the forgetting pressure:

Adaptive Activation: The controller uses a Lagrange multiplier $\lambda$ to penalize violations of the constraint $L_f(\theta) \geq \alpha$ .
Deactivation Mechanism: As the prescribed criterion remains satisfied, the projected multiplier decreases and can eventually reach zero. When $\lambda = 0$ , the forget-side gradient is gated off entirely, and optimization focuses solely on minimizing the retain loss. This adaptive deactivation is absent in prior constrained or penalty-based methods.
Robustness: The controller is applied to a sharpness-aware forget loss, enforcing the constraint over a local weight-space neighborhood rather than just at the current parameters.

3. Sharpness-Aware Updates

SAUL integrates Sharpness-Aware Minimization (SAM) to stabilize the unlearning dynamics:

Retain Side: Minimizes the worst-case retain loss (inner maximization over perturbations) to ensure the model remains stable under local weight changes, preserving utility.
Forget Side: Maximizes the best-case forget loss (inner minimization over perturbations). This forces the forget landscape to remain high even at the most easily recoverable point in the neighborhood, making the forgetting robust against local perturbations.
Asymmetry: The retain side uses inner maximization (to keep the worst case low), while the forget side uses inner minimization (to keep the best case high).

4. Dual Optimizer States

To prevent interference between the conflicting semantics of forget and retain gradients, SAUL employs a dual-optimizer design:

It maintains two independent optimizer states (based on AdamW) for the same model parameters: one for the forget objective ( $s_f$ ) and one for the retain objective ( $s_r$ ).
This decoupling ensures that accumulated moments (first and second-order statistics) remain consistent with their specific roles, reducing instability caused by mixing heterogeneous gradient signals.

5. Drop-in Applicability

Beyond the full SAUL framework, the authors demonstrate that the Augmented Lagrangian controller can serve as a "drop-in" modifier for existing sharpness- and perturbation-based baselines. By replacing fixed trade-off tuning with constraint-driven adaptation, this component alone improves post-forgetting utility in representative baselines.

Key Contributions

Explicit Constraint Formulation: The authors formulate LLM unlearning as a constrained minimization problem where a target threshold $\alpha$ explicitly specifies the forgetting level, moving away from implicit trade-off coefficients.
Adaptive Deactivation: They propose an Augmented Lagrangian controller that reduces and can eventually deactivate forget-side pressure once the criterion is satisfied, preventing unnecessary utility erosion.
Integration and Modularity: They show that the proposed controller can be integrated into representative sharpness- and perturbation-based methods. As a drop-in modifier, it consistently improves post-forgetting utility, demonstrating the practical value of explicit forgetting control.
Comprehensive Framework (SAUL): They instantiate the framework as SAUL, combining the controller with sharpness-aware updates and role-separated optimizer states, achieving favorable forgetting–utility trade-offs across multiple benchmarks.

Experimental Results

SAUL was evaluated on three benchmarks: TOFU (fictitious author forgetting), WMDP (hazardous knowledge removal), and MUSE (verbatim memorization).

TOFU: Under a matched forgetting criterion ( $FROUGE \leq 0.03$ ), SAUL achieved the highest harmonic mean (HM) of 72.79, outperforming the next-best constraint-satisfying method (Sharp Min–Max + ALM, HM 67.11) by 5.7 points. SAUL maintained low Forget scores while preserving high utility on retain sets and neighborhood data (Real Authors).
WMDP: SAUL achieved an MMLU accuracy of 0.542, comparable to BLUR (0.540) and significantly higher than Relearning-resilient (0.414), while maintaining hazardous knowledge accuracy near random chance.
MUSE Books: SAUL achieved the strongest overall forgetting (KnowMem on forget set $\approx 0.77$ ) while preserving retain-side knowledge (48.25) comparable to BLUR (48.40) and obtaining a PrivLeak score closer to zero than other baselines.
Ablation & Drop-in: Experiments confirmed that the ALM component alone improves utility when applied to baselines. Ablation studies showed that both the ALM controller and the sharpness-aware updates contribute to the final performance.

Significance and Claims

The paper claims that SAUL addresses the fundamental limitation of existing unlearning methods: the lack of a prescribed satisfaction criterion for forgetting. By treating forgetting as an explicit constraint rather than an open-ended optimization pressure, SAUL ensures that the model forgets "enough, but no more than necessary."

The authors emphasize that their approach provides a more stable and interpretable interface for controlling the forgetting–utility trade-off. The ability to deactivate forget-side pressure once a criterion is met prevents the "over-forgetting" that degrades general capabilities. Furthermore, the modularity of the Augmented Lagrangian controller suggests that explicit forgetting control is a broadly applicable principle that can enhance existing unlearning methods without requiring a complete architectural overhaul.

The paper modestly notes limitations, including the need for manual selection of the forgetting threshold $\alpha$ and the fact that the robustness guarantees are restricted to weight-space perturbations rather than all adversarial prompt-level attacks.