1 Introduction↩︎

Machine unlearning selectively removes specific data points from trained models [1], [2], essential for privacy compliance (e.g., GDPR [3]) and model maintenance. Standard setups require a forget set (samples to remove) and a retain set (knowledge to preserve). However, this formulation introduces a privacy paradox: processing requests requires exposing the sensitive forget set to model operators (e.g., MLaaS providers), conflicting with the need to protect PII. In domains like healthcare or finance, transferring sensitive records for unlearning risks data breaches [4]–[8].

Existing LLM unlearning methods require access to original forget data (and often retain sets) using techniques like gradient ascent [9], joint loss balancing [10], [11], or preference objectives [12], [13]. However, these approaches suffer utility loss and privacy leakage under membership-inference attacks. Privacy-preserving and federated unlearning reduces data access via client-side updates or gradient sharing, but overlooks anonymized forget sets in autoregressive LLMs [10], [14]. To our knowledge, no prior work has studied LLM unlearning using only anonymized forget data.

To address this critical gap, we introduce Shadow Unlearning (Figure 1), a paradigm for performing machine unlearning directly on anonymized forget sets, mitigating critical privacy risks, where data owners mask PII to facilitate secure sharing. The privacy boundary is maintained entirely at the data owner side, they perform anonymization locally and share only the anonymized forget set with the model operator. The core idea is to learn the semantic relationship between original and anonymized data in the activation space, allowing us to ‘project’ the influence of the anonymized data back to its original ‘shadow’ and unlearn it. The proposed NSPU method consists of three stages: 1) training a lightweight projector module to learn the general transformation mapping between non-anonymized and their anonymized counterparts, not at the embedding-level, but at an activation-level, 2) identifying the principal components of the “forget space" where the dominant semantic directions must be erased, and 3) constructing an unlearning filter that modifies the model’s information flow, effectively neutralizing the identified forget space concepts in real-time.

We conduct extensive experiments across five domains of the MuFU dataset. The experiments are performed on four representative LLMs of varying sizes and families to evaluate the generalizability and effectiveness of the proposed unlearning method. We compare our approach against several standard unlearning methods. While several unlearning evaluation metrics focus on assessing the model’s utility and forgetting efficacy independently, we extend those metrics to assess the tradeoff between knowledge retention and forget efficacy [15], [16]. To this end, we employ four evaluation metrics: Harmonic Perplexity Score, Combined Efficacy Score, Harmonic ROUGE Score, and Conditional Negative Log-Likelihood Probability. Moreover, our approach is at least \(10^6\) times computationally efficient than retraining from scratch and 10x faster when compared to standard unlearning methods.

The key contributions of this work include:

• We introduce a novel task in privacy-preserving unlearning – Shadow Unlearning, which enables selective unlearning on anonymized forget data.

• We propose Neuro-Semantic Projector Unlearning (NSPU), a novel frozen-target approach for effective unlearning on anonymized forget data, achieving a strong utility-efficiency-privacy tradeoff over state-of-the-art methods.

• We compile the MuFU dataset across five domains: Digital informatics, Sports, Politics, Science & technology, and Finance.

• We introduce a suite of evaluation metrics designed to measure the trade-off between knowledge retention and unlearning efficacy.

2 Related work↩︎

Machine unlearning for LLMs: Unlearning approaches are broadly categorized into two categories: exact unlearning and approximate unlearning [17]. Exact unlearning mandates that the model’s behavior after unlearning be indistinguishable from that of a model trained from scratch without the forget set data. To this end, early exact unlearning techniques were mainly developed on random forest [18], [19], k-means clustering [20]. [2] formalized exact unlearning by introducing a general framework: sharded, isolated, sliced, aggregated (SISA). Despite the efficacy and precision of exact unlearning methods, they face significant constraints related to underlying assumptions and scalability issues [21]. On the other hand, approximate unlearning [22] aims to forget the influence of target data points by adjusting the weights through loss-based fine-tuning strategies. These methods mainly rely on parameter optimization [8], [13], [23]–[35]. However, these approaches can degrade the overall performance of the models. Recent research has explored alternative approaches for LLM unlearning, including contrastive decoding [36]–[39], task vectors [32], [40], in-context learning [41], [42], input processing and deletion [43], [44] and LoRA-based unlearning [45], [46]. However, most of these methods require preserving the original model’s parameters, which can still raise privacy concerns. For further discussion on related works, see Appendix 10.

3 Methodology↩︎

3.1 Task Formulation↩︎

Let \(M_{\theta}\) denote a model pre-trained on a corpus \(D\), composed of disjoint subsets \(D = D_{\mathrm{retain}} \cup D_{\mathrm{forget}}\). Due to privacy constraints, the original samples are inaccessible. Instead, we assume access to a one-way anonymization function \(f(\cdot)\) and the resulting anonymized forget dataset \(\tilde{D}_{\mathrm{forget}} = f(D_{\mathrm{forget}})\). Our goal is to obtain an unlearned model \(M_{\theta^{'}}\) using only the current model state \(M_{\theta}\) and the anonymized forget data \(\tilde{D}_{\mathrm{forget}}\). Ideally, \(M_{\theta^{'}}\) should approximate the behavior of a “gold standard" model \(M^{\star}\) trained from scratch on the counterfactual dataset \(D \setminus D_{\mathrm{forget}}\).

3.2 Anonymization↩︎

To construct the anonymized forget set, a named-entity recognition (NER)-based anonymization pipeline is applied. All PII is detected using the Microsoft Presidio Anonymizer² and replaced with corresponding placeholder tags (e.g., <PERSON>, <LOCATION>), ensuring that direct identity information is removed while preserving the surrounding linguistic context. The same anonymization pipeline is reused in all stages of the proposed methodology to maintain consistency between pretraining-style data and the forget set.

3.3 Proposed Methodology↩︎

Neuro-Semantic Projection Unlearning (NSPU), comprises three key phases, as represented in Figure 2, and explained in Sections 3.4, 3.5, and 3.6.

3.4 Latent Representation Aligner↩︎

This preliminary, one-time phase establishes a mechanism for aligning the representations of anonymized and original data samples at the neural activation level. The aim is not to re-identify individuals, but to obtain a smooth semantic correspondence between the activations induced by original and anonymized texts. This enables the model to operate in a coherent latent geometry even when direct identification cues are removed.

To achieve this, a lightweight multi-layer perceptron (MLP) is employed as a projection function \(P_\theta\). Conceptually, this MLP acts as a neuro-semantic bridge, which aligns activations of the anonymized samples with the model’s original semantic structure, while keeping the information in an abstract latent form.

As a result, anonymized samples can be translated into activation vectors that are geometrically consistent with those induced by non-anonymized inputs, without exposing underlying identity attributes.

3.4.1 Training of the Latent Representation Aligner↩︎

Before considering the forget or retain sets, the training of the Latent representation aligner (\(P_{\theta}\)) leverages a publicly available corpus. More details of the training setup are discussed in Appendix 12. From this corpus, pairs \((x_{\text{orig}}, x_{\text{anon}})\) are constructed by applying the same anonymization pipeline \(f(\cdot)\) used for the forget set, where \(x_{\text{anon}} = f(x_{\text{orig}})\). Both the original and anonymized texts are independently passed through the frozen target model to obtain layer-specific activations \(\phi_{l}(x_{\text{orig}})\) and \(\phi_{l}(x_{\text{anon}})\) at a chosen layer l. These activation pairs form the training data for the Latent representation aligner.

The Latent representation aligner \(P_\theta\) is trained to minimize the semantic alignment loss: \[\mathcal{L}_{\text{align}} = \left\| P_\theta \left(x_{\text{anon}} \right) - \phi_l(x_{\text{orig}}) \right\|_2^2\] where \(\phi_l\) denotes the layer-specific activation function of the target model. The parameters of the projector are optimized while keeping the target model frozen. The resulting trained model \(P_\theta\) serves as a universal neuro-semantic bridge that estimates the neural fingerprint of the original sample from its anonymized counterpart.
Inversion-Resistant Optimization Term. To prevent potential inversion of the projected activations back into human-interpretable input space, we introduce an auxiliary privacy-preserving term—termed the Inversion Optimization Score (InvOptScore). This score quantifies how easily an estimated activation vector could be mapped to a plausible input embedding through optimization-based inversion.
For an estimated activation, \(\hat{h}_{est}\) of an anonymized sample \(x_{anon}\), \(\hat{h}_{\text{est}} = P_{\theta}(x_{\text{anon}})\) consider an inversion process that searches for a pseudo-input embedding \(x' \in \mathcal{X}_{\text{emb}}\) in the model’s input embedding space that reproduces \(\hat{h}_{\text{est}}\). Define the inversion loss: \[\mathcal{L}_{\text{inv-opt}}(x') = \left\| \phi_l(x') - \hat{h}_{\text{est}} \right\|_2^2\]

The optimal pseudo-input \(x'^*\) is obtained via \(x'^* = \arg\min_{x'} \mathcal{L}_{\text{inv-opt}}(x')\) and the corresponding inversion difficulty is summarized by

\[\text{InvOptScore}(\hat{h}_{\text{est}}) = \left\| x'^* - x_{orig} \right\|_2^2\]

The optimization over \(x'\) is carried out entirely in the continuous embedding space, initialized from random embeddings and refined by gradient-based minimization of \(\mathcal{L}_{\text{inv-opt}}\). No discrete token decoding is required or performed, so no explicit textual reconstruction is ever produced. A lower residual \(\text{InvOptScore}(\hat{h}_{\text{est}})\) indicates that the activation is easier to approximate with some plausible input embedding and therefore carries higher inversion risk. By penalizing such low inversion losses during training, the projector is encouraged to produce activations that are semantically aligned with the model’s internal geometry yet intrinsically harder to decode into human-readable content. The final training objective for the projector is \[\mathcal{L}_{\text{proj}} = \mathcal{L}_{\text{align}} + \lambda_{\text{inv}} \big( -\text{InvOptScore}(\hat{h}_{\text{est}}) \big)\]

where \(\lambda_{\text{inv}} > 0\) balances semantic fidelity and inversion resistance. Larger values of \(\lambda_{\text{inv}}\) prioritize privacy, while smaller values favor tighter alignment with original activations.

3.5 Forget Subspace↩︎

This phase constructs a forget subspace that captures the dominant directions associated with the forget set in the model’s activation space. This provides a unified vector space toward which forget-related activations can be systematically diverted, avoiding the need to reason about individual neurons or samples.

3.5.1 Creation of Forget subspace↩︎

The anonymized forget set \(\tilde{D}_{\text{forget}}\) is passed through the target model to obtain layer-\(l\) activation vectors \(\phi_l(x_{\text{anon}})\) for all \(x_{\text{anon}} \in \tilde{D}_{\text{forget}}\). These anonymized activations are then passed through the trained Latent representation aligner (\(P_\theta\)) to produce estimated original activations \(\hat{h}^{\text{orig}} = P_\theta\big(\phi_l(x_{\text{anon}})\big)\) corresponding to each sample in the \(\tilde{D}_{\text{forget}}\).

Row-wise stacking of these activations yields a matrix \(H \in \mathbb{R}^{n \times d}\), for \(n\) forget samples and activation dimension \(d\). We apply Principal Component Analysis (PCA) to \(H\) to extract orthonormal directions capturing principal variance axes, which approximate dominant semantic factors across the forget set (see Appendix 14 for PCA rank details). The top \(k\) right-singular vectors, forming an orthonormal basis for these components, comprise the columns of \(U \in \mathbb{R}^{d \times k}\). This matrix \(U\) defines the forget subspace, the linear subspace spanned by directions most strongly associated with the forget set’s internal representations.

3.6 Active Unlearning↩︎

Leveraging the forget subspace obtained, an unlearning filter is created as a simple adapter incorporated into the target model inference. It facilitates active unlearning, projecting away information or activations relevant to the forget set.

3.6.1 Unlearning Filter↩︎

The unlearning filter \(UL_{\text{filter}} \in \mathbb{R}^{d \times d}\) is defined as \(UL_{\text{filter}} = I - \alpha U U^\top\), where \(I\) is the \(d \times d\) identity matrix and \(\alpha\) is a hyperparameter governing the strength of unlearning. As depicted in Figure  3, for any activation vector \(v \in \mathbb{R}^{d}\), the term \(U U^\top v\) gives its orthogonal projection onto the forget subspace, and the filter subtracts an \(\alpha\)-scaled version of this projection \(v_{\text{out}} = UL^{}_{\text{filter}}\, v_{\text{in}}\). This operation shifts \(v_{\text{out}}\) toward the orthogonal complement of the forget subspace, thereby attenuating information aligned with forget-related concepts while minimally disturbing components orthogonal to \(U\). While retain and forget representations overlap, their dominant principal components diverge sufficiently. Projecting away from these forget axes yields an approximate yet highly effective separation. The geometric interpretation of the unlearning filter is provided in Appendix 13.

The unlearning filter is implemented as a lightweight, non-trainable linear operation integrated permanently into the model architecture. Specifically, the original final layer normalization is replaced by a sequential module that first applies the unlearning transformation to the last hidden state before passing it through the standard normalization layer. This modification ensures the change is a structural part of the model, permanently steering the information flow away from the forget subspace in real-time during the forward pass.

4 Experiments↩︎

4.1 Setup↩︎

Dataset Creation. Existing unlearning benchmark datasets, such as TOFU [47], often suffer from extreme homogeneity and high semantic overlap between the forget (\(D_f\)) and retain (\(D_r\)) sets. This high inter-sample correlation complicates the evaluation of unlearning efficacy. If a model retains the underlying data distribution through \(D_r\), membership inference attacks (MIAs) may yield high false positives, masking the true performance of unlearning algorithms [6], [48].

MuFU: Multi-Domain Fictitious Unlearning. To address these limitations, we introduce the MuFU dataset, which evaluates unlearning across a heterogeneous environment where both forget and retain sets span multiple domains to mirror real-world complexity. Using Gemini 3 Pro, we generated 4,000 distinct samples containing personally identifiable information, distributed evenly across five domains: Digital Informatics, Finance, Sports, Science & Technology, and Politics. Further details about the MuFU dataset creation and data variants are discussed in Appendix 11.

Models. We conduct experiments on LLaMA-7B [49], Mistral-7B-instruct [50], OLMoE-1B-7B-0924 [51] and LLaMA-2-13B [52] variants. More details on the experimental setup are provided in Appendix 14.

Baselines. We perform experiments by considering baselines as Gradient Ascent (GA) [9], Gradient Difference (GD) [10], KL Minimization (KLM) [11], Direct Preference Optimization (DPO) [12], and Negative Preference Optimization (NPO) [13]. Detailed descriptions of the baselines are mentioned in Appendix 15.

4.2 Evaluation↩︎

To demonstrate unlearning, evaluation is performed using the original (non-anonymized) questions, unlike the unlearning phase, which operates on anonymized inputs. Following prior work [6], [53], we evaluate the trade-off between knowledge retention and forgetting using four complementary metrics. Full derivations and implementation details are provided in Appendix 16.

Harmonic Perplexity Score (HPS). Perplexity reflects model uncertainty. Effective unlearning should increase perplexity on the forget set while keeping it low on the retain set. We define Forget Gain (\(G_F\)) and Retain Cost (\(C_R\)) as log-ratios of post- and pre-unlearning perplexity, and combine them using a harmonic formulation: \(HPS = \frac{2 \cdot G_F}{G_F \cdot C_R + 1}.\) This formulation penalizes methods that forget aggressively at the expense of retained knowledge.

Combined Efficacy Score (CES). Combined Efficacy Score (CES) utilizes the truth ratio [47] to measure a model’s preference for correct answers over perturbed ones. We sum Retain Stability (RS) and Forget Instability (FI) as: CES = RS + FI. Higher CES signifies better retention and superior suppression of forgotten content.

Harmonic ROUGE Score (HRS). To assess generative fidelity, we use ROUGE-L to measure semantic overlap. HRS jointly evaluates retention and forgetting by harmonically combining the Retention Ratio (RR) and Forget Ratio (FR): \(HRS = \frac{2 \cdot RR}{FR \cdot RR + 1}.\) This score favors high semantic preservation on the retain set and low overlap on the forget set.

Harmonic Conditional NLL (HCNLL). HCNLL evaluates likelihood-based behavior using conditional negative log-likelihood. Analogous to HPS, we define Forget Gain Likelihood and Retain Cost Likelihood and aggregate them harmonically: \(HCNLL = \frac{2 \cdot G_{F_L}}{G_{F_L} \cdot C_{R_L} + 1}.\) This metric captures probabilistic forgetting while preserving confidence in retained samples.

4.3 Experimental Results and Discussion↩︎

This section evaluates the model utility, unlearning efficacy, computational efficiency, and privacy via separation quality scores, tradeoff with extended analysis in Appendix 26.

4.4 The Utility-Efficacy Tradeoff↩︎

GA and KLM cause catastrophic utility loss. These methods maximize loss or divergence on forget data, leading to higher forget gain and a lower retain cost as shown in Table 1. This indicates high uncertainty in both the forget and retain sets. While this reflects strong forgetting efficacy, it comes at the cost of severe utility degradation. The negative aggregate scores for GA and KLM underscore the nature of forget-loss approaches, which lack the fundamental mechanism to preserve useful knowledge beyond the forget set.

GD, DPO, and NPO offer limited improvements. GD incorporates joint retention-forgetting objectives for better stability across these LLMs, while DPO and NPO suppress undesired outputs but show inconsistent behavior due to preference calibration sensitivity. Both DPO and NPO offer improved trade-offs over pure ascent techniques yet lack the robustness needed for scalable unlearning across diverse architectures.

NSPU consistently outperforms standard unlearning methods. NSPU achieves notably higher Aggregate scores across all tested models, while approaches such as GA and KLM consistently yield highly negative aggregate values. This indicates that NSPU effectively balances forgetting targeted data while maintaining model utility on retained data, unlike GA and KLM, which aggressively forget but cause severe degradation in overall performance.

4.5 Membership Inference and Separation Quality↩︎

Membership Inference Attacks (MIAs) evaluate unlearning efficacy by testing whether an adversary can distinguish forget set samples from unseen data using the unlearned model’s predictions [48], [54], [55]. Effective unlearning implies that the target model should perceive the forget set as indistinguishable from a non-member set (unseen data), while retaining performance on the retain set. To quantify this behavior, we construct the non-member set as detailed in Appendix 22. To quantify MIA resistance, we compute mean Causal Language Modeling (CLM) loss across retain (\(M_R\)), forget (\(M_F\)), and non-member (\(M_{NM}\)) sets. The Separation Quality Score (SQS) measures how well the forget set loss aligns with non-members while diverging from retain samples:

\[SQS = \frac{|M_{R} - M_F|}{|M_R - M_F| + |M_{NM} - M_F|}\] The numerator maximizes forget-retain divergence (successful unlearning), while the denominator minimizes forget-nonmember divergence (MIA resistance). As shown in Table [tbl:tab:flops95and95sqs], high SQS scores reflect the balance between effective forgetting and retention, quantifying privacy strength and unlearning fidelity.

5 Ablation studies↩︎

Beyond NSPU’s utility, efficiency, and privacy advantages, it is critical to assess its ability to distinguish retain vs. forget information and identify domain-specific and entity-level (PII) knowledge. This motivates deeper ablations on where and how unlearning occurs.

5.1 Interpretable View of Knowledge Entanglement↩︎

NSPU clearly distinguishes the forget and retain information. Figure 4 shows layer-wise activation shifts (early, middle, last) between the original and unlearned models for both forget and retain sets. We apply the unlearning filter only at the final hidden layer, as semantic separation between forget and retain concepts is minimal in early layers and peaks in deeper layers as discussed in Appendix 17.

Earlier layers encode low-level features, so filtering them is unnecessary and does not expose sensitive information. Consequently, an attacker attempting to bypass the defense by probing earlier, unprotected layers would fail to extract the targeted PII, as sensitive representations have not yet formed.

Accordingly, activations remain identical up to the 31^st layer, with unlearning effects appearing only at the final layer. The forget set shows strong separability, while the retain set exhibits minor drift with substantial overlap. This small drift is expected due to the non-orthogonality of real-world concepts, however, it is negligible compared to the large separation in the forget set. This demonstrates that NSPU effectively removes target knowledge while preserving utility. Similar behavior is observed in Llama-13B, as shown in Appendix 23.

5.2 Identification of desired information to unlearn↩︎

To validate that NSPU targets intended information rather than spurious knowledge, we conduct an ablation to examine the forgotten content. Since Shadow Unlearning operates on anonymized data, verifying that the model erases the specific entity per request is essential. The Latent Representation Aligner bridges anonymized and original representations while maintaining inversion resistance to prevent leakage. While Appendix 12 Table 8 details overall performance, Table 3 assesses how closely reconstructed activation vectors approximate original activations across domains and models. We use an InvOptScore regularization term to penalize excessive similarity, balancing semantic alignment with privacy. The results confirm meaningful semantic correspondence in projected vectors, validating the module’s ability to localize correct knowledge under privacy constraints. Similarly, entity-level analysis (Table 4) shows NSPU consistently erases targeted representations 83% of the time on average while retaining remaining domain knowledge.

5.3 Additional results↩︎

We provide more results and ablations, including: MuFU dataset creation (Appendix  11), training of Latent representation aligner (Appendix 12), human evaluation (Appendix 18.2), computational efficiency analysis (Appendix 21) based on FLOPS and VRAM, domain-specific performance evaluation (Appendix 19), NSPU performance on downstream tasks (Appendix 20), error analysis (Appendix 24) and robustness evaluation of NSPU (Appendix 25).

6 Conclusion↩︎

We introduce Shadow Unlearning, a paradigm for privacy-preserving unlearning on anonymized forget sets, and propose Neuro-Semantic Projector Unlearning (NSPU) to realize it. NSPU outperforms baselines with superior knowledge retention and forgetting efficacy, demonstrated across comprehensive metrics. It offers computational efficiency, confirmed by FLOPs analysis, and ensures privacy protection, validated through membership-inference attacks and separation-quality assessments. Overall, our work establishes a new direction for privacy-aware unlearning, balancing data protection, utility, and efficiency.

7 Limitations↩︎

NSPU relies on PCA to construct the forget subspace, which captures directions of maximum variance rather than exact causal influence. Nevertheless, these directions effectively approximate dominant semantic factors in the forget set, which is sufficient for approximate unlearning. The pipeline is primarily optimized for batch unlearning; its behavior under extremely low-resource settings (e.g., a single forget sample) remains unexplored. Additionally, handling sequential and continuous unlearning requests without cumulative utility degradation is an open challenge. NSPU applies the unlearning filter only at the final hidden layer to preserve earlier representations, leaving intermediate activations structurally unchanged. Although interpretability analysis suggests a low likelihood of extracting semantic PII from early layers, we do not provide formal guarantees against advanced white-box inversion attacks targeting these layers.

Theoretical guarantees of NSPU ensure geometric projection away from the forget subspace but do not imply equivalence to a model retrained from scratch without the forget data. Furthermore, the method depends on access to internal activations, restricting applicability to open-source models. Finally, our NER-based anonymization pipeline introduces a potential edge case where distinct samples map to identical anonymized representations. In such collisions, selectively unlearning only a subset may confuse the Latent Representation Aligner (LRA), leading to unintended retention or forgetting. Future work can address this by designing more fine-grained, entity-level unlearning filters to better distinguish structurally identical samples.

8 Reproducibility Statement↩︎

To ensure reproducibility of our results, we have thoroughly documented all experimental details and evaluation procedures with proper grounding. All experiments were conducted using fixed random seeds to guarantee deterministic behavior across runs. We plan to release our implementation code, detailed experimental scripts, and the dataset to facilitate the exact reproduction of our reported results.

9 Ethics Statement↩︎

This work advances responsible and privacy-aware deployment of large language models through Shadow Unlearning. The proposed paradigm enables effective machine unlearning using anonymized forget data, reducing exposure of personally identifiable information during the unlearning process. By decoupling unlearning from direct access to sensitive data, our approach supports compliance with privacy regulations such as the GDPR’s Right to be Forgotten. It also resolves a critical privacy paradox present in existing unlearning methods.

10 Extended Related works↩︎

Privacy-preserving unlearning: Most existing unlearning methods rely on direct access to the user’s data during forget operations, which contradicts the goal of data deletion and raises compliance concerns with the “right to be forgotten” [22], [56], [57]. Despite highlighting the privacy breaches caused by the unlearning approaches [58]–[61], there has been less focus on privacy-preserving unlearning.
To enable privacy-preserving unlearning, [62] proposed oblivious unlearning, which constructs an auxiliary synthetic dataset via incremental training to facilitate effective removal of targeted data influences. However, their evaluation is restricted to image classification benchmarks such as MNIST, CIFAR-10, and CelebA. Subsequent efforts investigate privacy-aware unlearning across multiple classification settings [63]. Most of the privacy-oriented unlearning methods operate within the federated learning paradigm, commonly referred to as federated unlearning (FL) [56], [57], [64], [65], where model training is performed centrally without direct interaction with individual users. Nevertheless, most FL-based unlearning approaches incur notable utility degradation and exhibit limited support for selectively unlearning subsets of a user’s local data [66], [67]. Moreover, despite targeting user-specific unlearning, existing FL frameworks often provide insufficient privacy guarantees for user data.

11 MuFU Dataset↩︎

11.1 Creation of MuFU dataset↩︎

To address the challenge of evaluation of unlearning efficacy owing to extreme homogeneity and a high degree of semantic overlap in the existing benchmark datasets, we create a TOFU-style synthetic dataset for five different domains: Digital Informatics, Science and Technology, Sports, Finance, and Politics. Each domain consists of 800 samples, and a total of 4000 samples are present in the MuFU dataset. We depict the overlap present in the TOFU forget and retain samples in Figure 6, and that of TOFU, and MuFU data samples in Figure 7. Figure 8 further illustrates the overlap of various domains in our dataset. Table 6 details the PII attribute-wise distribution for various domains and Table 7 presents the aggregate PII attribute-wise distribution of the MuFU dataset. The prompt utilized to obtain the synthetic dataset using Gemini 3 Pro is elaborated in Fig 5.

5pt

None

11.2 Multi-Domain Data Variants↩︎

To evaluate the efficacy of unlearning algorithms across varying levels of distributional complexity, we extend the TOFU framework into a multi-domain configuration. We evaluate unlearning performance across three distinct dataset variants, namely 0%, 50%, and 100% based on the percentage of MuFU integration, representing a spectrum of increasing heterogeneity.

The 0% variant consists of the original TOFU dataset to provide a baseline for unlearning within a single, homogeneous domain. In the 50% variant, we replace half of the TOFU samples with 2,000 MuFU samples, distributed as 400 samples across each of the five MuFU domains. Finally, the 100% variant represents a purely heterogeneous environment. This progression from pure homogeneity to full heterogeneity serves two technical purposes:

• Distributional Resilience: By transitioning from 0% to 100% MuFU, we test the structural stability of the unlearning process. While most techniques are typically optimized for narrow distributions like TOFU, this setup studies if increased data diversity and multi-domain interference begin to degrade the ability of an unlearning algorithm to selectively target information.

• Signal Disentanglement: The 50% variant acts as a critical midpoint to evaluate signal disentanglement. It forces the algorithm to operate in a fragmented knowledge base where it must distinguish between the dense, correlated signals of the remaining TOFU data and the sparse, diverse PII samples from the five MuFU domains. This allows us to observe whether the unlearning mechanism remains precise when the target information is no longer part of the majority distribution.

12 Training of Latent Representation Aligner↩︎

12.1 Public data collection↩︎

The unknown and potentially multi-domain nature of the anonymized data necessitates the Latent representation aligner to be trained on heterogeneous data. For this purpose, we have combined six different PII datasets from different categories and formats, as depicted in Table 9. The curated training dataset for the projector consists of 21.24k \((original\_text, anonymized\_counterpart)\) samples.

12.2 Training the MLP↩︎

To assess the recoverability of semantic information removed during anonymization, we train a lightweight Multilayer Perceptron (MLP) model designed to reconstruct the embedding of the original text from the embedding of its anonymized counterpart. The MLP is optimized using the mean squared error (MSE) objective. All experiments follow a standardized train–validation–test split. By posing reconstruction as a purely geometric mapping problem in the latent space, we obtain a model-agnostic probe for evaluating whether anonymized representations still encode residual semantic information about the original content.

Given an anonymized embedding \(\mathbf{x}_i\) and its corresponding original embedding \(\mathbf{y}_i\), the reconstruction model learns a function \(f_{\theta}\) parameterized by \(\theta\) such that

\[\hat{\mathbf{y}}_i = f_{\theta}(\mathbf{x}_i),\]

where \(\hat{\mathbf{y}}_i\) denotes the reconstructed embedding. The model is optimized using the Mean Squared Error (MSE) objective defined as

\[\mathcal{L}_{\text{MSE}} = \frac{1}{N} \sum_{i=1}^{N} \left\| \mathbf{y}_i - \hat{\mathbf{y}}_i \right\|_2^{2},\]

where \(N\) is the number of training samples. Minimizing this loss encourages the network to produce reconstructed embeddings that closely approximate the original semantic representations.

To assess the quality of reconstructing the original embedding \(\mathbf{y}_i\) from its anonymized counterpart, we compute a set of complementary evaluation metrics.

1. Mean Squared Error (MSE). The Mean Squared Error measures the average squared deviation between the true and reconstructed embeddings: \[\text{MSE} = \frac{1}{N} \sum_{i=1}^{N} \left\| \mathbf{y}_i - \hat{\mathbf{y}}_i \right\|_2^{2}.\]

2. Mean Absolute Error (MAE). MAE quantifies the average magnitude of reconstruction error: \[\text{MAE} = \frac{1}{N} \sum_{i=1}^{N} \left| \mathbf{y}_i - \hat{\mathbf{y}}_i \right|.\]

3. Coefficient of Determination (\(R^2\)). The \(R^2\) metric measures the proportion of variance in the original embeddings explained by the reconstructed embeddings: \[R^2 = 1 - \frac{ \sum_{i=1}^{N} \left\| \mathbf{y}_i - \hat{\mathbf{y}}_i \right\|_2^{2} }{ \sum_{i=1}^{N} \left\| \mathbf{y}_i - \bar{\mathbf{y}} \right\|_2^{2} },\] where \(\bar{\mathbf{y}}\) denotes the mean embedding over the dataset.

4. Cosine Similarity. To measure semantic alignment, we compute cosine similarity between each original and reconstructed embedding: \[\cos(\theta_i) = \frac{ \mathbf{y}_i \cdot \hat{\mathbf{y}}_i }{ \left\| \mathbf{y}_i \right\|_2 \, \left\| \hat{\mathbf{y}}_i \right\|_2 }.\]

5. Pearson Correlation. Pearson correlation captures the linear correlation between the embedding dimensions of \(\mathbf{y}_i\) and \(\hat{\mathbf{y}}_i\): \[\rho_i = \frac{ \mathrm{Cov}(\mathbf{y}_i, \hat{\mathbf{y}}_i) }{ \sigma_{\mathbf{y}_i} \, \sigma_{\hat{\mathbf{y}}_i} }.\]

Together, these metrics characterize both numerical fidelity (MSE, MAE), variance explanation (\(R^2\)), and structural or semantic similarity (cosine similarity and Pearson correlation). The performance of the evaluation metrics for various LLMs is detailed in Table 8.

13 Geometric Interpretation of Forget Space Creation↩︎

As represented in Figure 3, the proposed methodology first implicitly decomposes \(v_{in}\) into its ‘forget’ component: \[v_{in}^u = (UU^T)v_{in}\] and its ‘safe’ component: \[v_{in}^{u\perp} = (I-UU^T)v_{in}\] Thus: \[v_{in} = v_{in}^u + v_{in}^{u\perp} \label{decomp}\tag{1}\]

It then subtracts a fraction of \(v_{in}^u\) from the original vector. The result: \[v_{out} = v_{in} - \alpha v_{in}^u \label{vout}\tag{2}\] is a vector steered away from the forget subspace. This attenuates information aligned with the concepts to be forgotten, while the safe component \(v_{in}^\perp\) is preserved intact.
Here, \(\alpha\) governs the strength or effectiveness of unlearning. When set to 1, \(v_{out}\) becomes \(v_{in}^{u\perp}\), with no component along the forget subspace, thus, nullifying the entire forget set information captured in the subspace from the model. However, this dents the semantic understanding and other general capabilities of the model. Therefore, \(\alpha\) plays a crucial role in deciding the extent of unlearning with a tradeoff against the knowledge retention and multi-purpose general capabilities of the model.
Substituting equation 1 in equation 2 : \[v_{out} = v_{in}^{u\perp} + (1- \alpha) v_{in}^u\] \[v_{out} = v_{in} - v_{in}UU^T + (1-\alpha)v_{in}UU^T\] \[v_{out} = v_{in} - v_{in}UU^T + v_{in}UU^T - \alpha v_{in}UU^T\] \[v_{out} = v_{in} - \alpha v_{in}UU^T\] \[v_{out} = (I - \alpha v_{in}UU^T)v_{in}\] Considering \((1 - \alpha v_{in}UU^T)\) as the \(UL_{filter}\): \[UL_{filter} = (I - \alpha v_{in}UU^T)\] We get the final active unlearning equation as: \[v_{out} = UL_{filter}v_{in}\]

14 Experimental Setup↩︎

We conduct all experiments using two Nvidia GeForce RTX A6000 (48GB) GPUs. Table 10 details the models used for our experiments, all of which were loaded in bfloat16 precision. We fine-tuned all models using a learning rate of 2e-5, a batch size of 8, and a maximum sequence length of 512. All other QLoRA³ and Hugging Face Trainer ⁴ parameters were kept to their default values. To obtain deterministic response generation and inference, ‘temperature’ was set to 0.001 and sampling is disabled (do_sample=False) in all experiments.

Choice of PCA Rank (\(k\)): Instead of defining a static PCA rank \(k\) of the forget subspace a priori, we employ an adaptive rank selection strategy based on explained variance. We perform PCA on the collected vectors and examine the cumulative explained variance ratio. We select the minimum number of components \(k\) required to account for 95% of the total variance (\(\tau = 0.95\)) in the data. Thus, \(k\) is chosen such that:

\[k = \min \left\{ d \in \mathbb{Z}^+ \mid \sum_{i=1}^{d} \lambda_i \ge 0.95 \sum_{j=1}^{D} \lambda_j \right\}\]

where \(\lambda_i\) represents the eigenvalue, which corresponds to the explained variance associated with the \(i^{th}\) principal component, and \(D\) is the original dimensionality of the vectors. This ensures that the subspace captures the dominant directions of the representation while discarding the bottom 5% as stochastic noise.

Unlearning Filter Strength (\(\alpha\)): We employ the Harmonic ROUGE Score (HRS) as the primary metric to determine the optimal filter strength \(\alpha\), effectively balancing unlearning efficacy with model utility. A higher HRS indicates a superior trade-off. We conduct a grid search over a continuous float space to identify the optimal \(\alpha\) values for each model, which are reported in Table 11.

15 Formulations for Baseline Methods↩︎

We list the baseline unlearning algorithms provided in the TOFU [47] benchmark, including Gradient Ascent (GA), Gradient Difference (GD), KL Minimization (KLM), Direct Preference Optimization (DPO), and Negative Preference Optimization (NPO).
Gradient Ascent (GA) [9] This method directly attempts to make the model “forget" target data by performing gradient ascent on the standard training loss with respect to the forget set \(\mathcal{D}_F\). This is equivalent to minimizing the negative log-likelihood of the forget data. The unlearning objective \(\mathcal{J}_{GA}(\theta)\) to be minimized is:\[\mathcal{J}_{GA}(\theta) = - \mathcal{L}_{\mathcal{D}_F}(\theta) = - \frac{1}{|\mathcal{D}_F|} \sum_{d_f \in \mathcal{D}_F} \mathcal{L}(d_f; \theta)\]where \(\theta\) are the model parameters and \(\mathcal{L}(d; \theta)\) is the loss for a single sample \(d\).
Gradient Difference (GD) [10] This approach extends GA by adding a competing objective: preserving model performance on the retain set \(\mathcal{D}_R\). The objective function is formulated to simultaneously maximize the loss on \(\mathcal{D}_F\) (by minimizing its negative) and minimize the loss on \(\mathcal{D}_R\). The combined objective \(\mathcal{J}_{GD}(\theta)\) to be minimized is:\[\mathcal{J}_{GD}(\theta) = \mathcal{L}_{\mathcal{D}_R}(\theta) - \lambda \cdot \mathcal{L}_{\mathcal{D}_F}(\theta)\]where \(\lambda\) is a hyperparameter balancing the two objectives. During training, samples are drawn from both \(\mathcal{D}_R\) and \(\mathcal{D}_F\) to compute a stochastic gradient.
KL Minimization (KLM) [11] This method regularizes the unlearning process to prevent the model from deviating significantly from its original, general-purpose behavior. It combines the GA objective on \(\mathcal{D}_F\) with a regularization term that minimizes the Kullback-Leibler (KL) divergence between the output distributions of the original reference model, \(\pi_{\text{ref}}\), and the current unlearning model, \(\pi_{\theta}\), on the retain set \(\mathcal{D}_R\). The objective \(\mathcal{J}_{KL}(\theta)\) to be minimized is:

\[\begin{align} \mathcal{J}_{KL}(\theta) = &- \mathcal{L}_{\mathcal{D}_F}(\theta) \nonumber \\ &+ \beta \cdot \mathbb{E}_{s \in \mathcal{D}_R} \left[ D_{KL}\left( \pi_{\text{ref}}(\cdot | s) \,||\, \pi_{\theta}(\cdot | s) \right) \right] \end{align}\]

where \(\beta\) is a weighting coefficient.
Direct Preference Optimization (DPO) [12] formulates alignment as a pairwise preference learning problem, in which the model is trained to prefer a desirable response over an undesirable one for a given prompt.

Given a prompt \(x\), a preferred response \(y_w\), and a dispreferred response \(y_l\), the DPO objective directly optimizes the policy \(\pi_\theta\) without explicit reward modeling. The loss is defined as:

\[\begin{align} \mathcal{L}_{\text{DPO},\beta}(\theta) = &-\mathbb{E}_{(x,y_w,y_l)\sim\mathcal{D}} \Big[ \log \sigma(z) \Big] \\ \text{where} \quad z = &\beta \log \frac{ \pi_\theta(y_w \mid x) }{ \pi_{\text{ref}}(y_w \mid x) } \nonumber \\ &- \beta \log \frac{ \pi_\theta(y_l \mid x) }{ \pi_{\text{ref}}(y_l \mid x) } \nonumber \end{align}\] where \(\pi_{\text{ref}}\) is a fixed reference model and \(\beta\) controls the sharpness of preference enforcement. This objective encourages the policy to increase the relative likelihood of preferred responses over dispreferred ones. We have leveraged the dispreferred responses from [47].

Negative Preference Optimization (NPO) [13] formulates unlearning as the direct suppression of undesired responses, without requiring the specification of a preferred alternative.

Unlearning can be formulated as a special case of preference optimization in which only negative (forgotten) responses are available. Specifically, for each \((x,y) \in \mathcal{D}_F\), the response \(y\) is treated as a dispreferred output with no corresponding positive alternative. By removing the positive term from the DPO objective, the NPO loss is obtained as:

\[\begin{align} \mathcal{L}_{\text{NPO},\beta}(\theta) = &-\frac{2}{\beta} \mathbb{E}_{(x,y)\sim\mathcal{D}_F} \Big[ \log \sigma (z) \Big] \\ \text{where } \quad z =& -\beta \log \frac{ \pi_\theta(y \mid x) }{ \pi_{\text{ref}}(y \mid x) } \nonumber \end{align}\] Minimizing this objective suppresses the relative likelihood of forgotten outputs under \(\pi_\theta\) while maintaining stability via the reference model.

16 Evaluation Metrics: Definitions and Derivations↩︎

This section provides full mathematical definitions and derivations of the evaluation metrics used in the main paper.

16.1 Perplexity and Harmonic Perplexity Score (HPS)↩︎

Perplexity for a dataset is defined as:

\[\begin{align} PPL = \exp \Bigg( \frac{ \displaystyle \sum_{j=1}^{N} \sum_{i=1}^{m_j} -\log P_{\theta} \big( a_i^{(j)} \mid Q^{(j)}, a_{<i}^{(j)} \big) }{ \displaystyle \sum_{j=1}^{N} m_j } \Bigg) \end{align}\] where \(N\) is the total number of samples, \(m_j\) is the number of tokens in the \(j^{th}\) answer, \(Q^{(j)}\) is the corresponding question, \(a_i^{(j)}\) is the \(i^{th}\) token of the answer, and \(a_{<i}^{(j)}\) denotes the sequence of tokens preceding \(a_i^{(j)}\).

To obtain a unified metric capturing both forgetting and retention performance, we introduce the Harmonic Perplexity Score (HPS). It combines the Forget Gain (\(G_F\)) and Retain Cost (\(C_R\)) using a harmonic mean: \[\begin{align} G_F=\ln\!\left(\frac{PPL_{\text{forget}}^{{\text{unl}}}}{PPL_{\text{ forget}}^{{\text{orig}}}+\epsilon}\right) \end{align}\]

\[\begin{align} C_R=\ln\!\left(\frac{PPL_{\text{retain}}^{{\text{unl}}}}{PPL_{\text{ retain}}^{{\text{orig}}}+\epsilon}\right) \end{align}\]

\[\label{eq:hps} HPS = 2 \cdot \frac{G_{F} \cdot (1/C_{R})}{G_{F} + (1/C_{R})} = \frac{2 \cdot G_F}{G_F \cdot C_R + 1}\tag{3}\] Here, \(PPL_{\text{forget}}^{{\text{unl}}}\) and \(PPL_{\text{ forget}}^{{\text{orig}}}\) denote the perplexities of the unlearned and target models on the forget set, respectively. Similarly, \(PPL_{\text{retain}}^{{\text{unl}}}\) and \(PPL_{\text{ retain}}^{{\text{orig}}}\) represent their perplexities on the retain set. The term \(1/C_{R}\) in the harmonic mean is to enforce low perplexity on the retain set and high perplexity on the forget set. A small random noise term \(\epsilon\) (on the order of \(e^{-5}\)) is included to prevent division by zero or indefinite values.

16.2 Combined Efficacy Score (CES)↩︎

is a unified metric based on the truth ratio [47], which quantifies a model’s ability to distinguish correct answers from incorrect ones. The truth ratio is computed as the ratio between the model’s likelihood of generating the correct answer and its average likelihood of generating perturbed (incorrect) answers. To assess overall unlearning performance, we compute Retain Stability (RS) and Forget Instability (FI) as follows: \[\begin{align} \text{RS} = \frac{TR_{\text{retain}}^{\text{unl}}}{TR_{\text{retain}}^{\text{orig}}} \quad,\quad \text{FI} = 1-\frac{TR_{\text{forget}}^{\text{unl}}}{TR_{\text{forget}}^{\text{orig}}} \end{align}\] \[\text{Combined Efficacy Score (CES)} = \text{RS} + \text{FI}\] Where \(TR_{\text{retain}}^{\text{orig}}\) and \(TR_{\text{forget}}^{\text{orig}}\) denote the truth ratio scores on the retain and forget sets before unlearning, and \(TR_{\text{retain}}^{\text{unl}}\) and \(TR_{\text{forget}}^{\text{unl}}\) denote the corresponding scores after unlearning.

16.3 Harmonic ROUGE Score (HRS)↩︎

ROUGE-L is computed as: \[\text{ROUGE-L}_{\text{avg}} = \frac{1}{N} \sum_{j=1}^{N} \left( \frac{2 \cdot \text{LCS}(X^{(j)}, Y^{(j)})}{m_j + n_j} \right).\]

We define Retention Ratio (RR) and Forget Ratio (FR) as: \[\begin{align} RR &= \frac{R_{\text{retain}}^{\text{unl}}}{R_{\text{retain}}^{\text{orig}}}, \\ FR &= \frac{R_{\text{forget}}^{\text{unl}}}{R_{\text{forget}}^{\text{orig}}}. \end{align}\]

The Harmonic ROUGE Score is: \[HRS = 2 \cdot \frac{RR \cdot (1/FR)}{RR + (1/FR)} = \frac{2 \cdot RR}{FR \cdot RR + 1}\] Where \(R_{\text{retain}}^{\text{orig}}\) and \(R_{\text{forget}}^{\text{orig}}\) denote R-L scores on retain and forget sets before unlearning, and \(R_{\text{retain}}^{\text{unl}}\), \(R_{\text{forget}}^{\text{unl}}\) denote the corresponding scores after unlearning. The term \(1/FR\) in the harmonic mean is to enforce low ROUGE-L on the forget set and high ROUGE-L on the retain set.

16.4 Harmonic Conditional Negative Log-Likelihood (HCNLL)↩︎

Conditional NLL is defined as: \[\mathcal{L}_{D} = \frac{1}{N} \sum_{j=1}^{N} \left( \frac{1}{m_j} \sum_{i=1}^{m_j} -\log P_{\theta}(a_i^{(j)} | Q^{(j)}, a_{<i}^{(j)}) \right).\] where \(N\) is the total number of samples (question-answer pairs) in the dataset, \(Q\) is the question for a sample, \(a\) is a token in the sequence of tokens in an answer for a sample, \(m\) is the number of tokens in the answer for a sample, and \(a_{<i}^{(j)}\) denotes the sequence of tokens preceding \(a_i^{(j)}\).
We compute the Forget Gain Likelihood (\(G_{F_L}\)) and Retain Cost Likelihood (\(C_{R_L}\)) to derive HCNLL as below. \[G_{F_L} = \ln\left(\frac{CNNL_{\text{unl, forget}}}{CNNL_{\text{orig, forget}}+\epsilon}\right)\] \[C_{R_L} = \ln\left(\frac{CNNL_{\text{unl, retain}}}{CNNL_{\text{orig, retain}}+\epsilon}\right).\]

The Harmonic Conditional NLL is: \[HCNLL = 2 \cdot \frac{G_{F_L} \cdot (1/C_{R_L})}{G_{F_L} + (1/C_{R_L})}\]

\[= \frac{2 \cdot G_{F_L}}{G_{F_L} \cdot C_{R_L} + 1}\] where \(CNNL_{\text{unlearned, forget}}\) and \(CNNL_{\text{target, forget}}\) are the average conditional negative log-likelihoods of the unlearned model and the target model on the forget set; and \(CNNL_{\text{unlearned, retain}}\) and \(CNNL_{\text{target, retain}}\) are the average conditional negative log-likelihoods of the unlearned model and the target model on the retain set, and \(\epsilon\) is a random noise of order \(e^{-5}\), added to avoid indefinite values. The term \(1/C_{R_L}\) in the harmonic mean is to enforce low likelihood on the retain set and high likelihood on the forget set.

17 Optimal layer selection for applying unlearning filter↩︎

The final hidden layer is optimal for applying \(UL_{\text{filter}}\). To determine the most effective layer for applying the \(UL_{\text{filter}}\) derived in Section 3.6, we analyze the layer-wise drift between the forget set and retain set activation vectors of the target model and its unlearned counterpart. The drift is quantified using (1) the centroid distance between the corresponding activation vectors in the original target model and (2) the maximum mean discrepancy (MMD) between these vectors (More details on Centroid distance and MMD in Appendix 17.1). Both metrics exhibit a steady increase in separation across deeper layers, as illustrated in Figure 9. This trend indicates that the \(UL_{\text{filter}}\) effectively projects away task-specific information at the final layers, motivating its placement at the final hidden layer for maximum unlearning efficacy.

17.1 Quantifying Layer-wise Drift in Activation Vectors↩︎

To quantify the layer-wise representational drift induced by the unlearning process, we analyze the divergence between the activation vectors of the target model \(M_{target}\) and the unlearned model \(M_{unlearn}\). Let \(\mathcal{X} = \{x_1, \dots, x_N\}\) denote the forget dataset. For a given layer \(l\), let \(A^{(l)} = \{h^{(l)}(x) \mid x \in \mathcal{X}\} \subset \mathbb{R}^{d_l}\) represent the set of activation vectors from the target model, and \(\tilde{A}^{(l)} = \{\tilde{h}^{(l)}(x) \mid x \in \mathcal{X}\} \subset \mathbb{R}^{d_l}\) represent the corresponding activations from the unlearned model.

17.2 Centroid Distance↩︎

The Centroid distance measures the magnitude of the shift in the mean activation vector at layer \(l\). Rather than measuring individual sample perturbations, this metric captures the global displacement of the feature cluster’s geometric centroid. We define the layer-wise centroids \(\mu^{(l)}\) and \(\tilde{\mu}^{(l)}\) as:

\[\mu^{(l)} = \frac{1}{N} \sum_{i=1}^{N} h^{(l)}(x_i), \quad \tilde{\mu}^{(l)} = \frac{1}{N} \sum_{i=1}^{N} \tilde{h}^{(l)}(x_i)\]

The Centroid distance is formally defined as the \(L_2\) norm of the difference between these centroids:

\[D_{\text{Centroid}}(A^{(l)}, \tilde{A}^{(l)}) = \| \mu^{(l)} - \tilde{\mu}^{(l)} \|_2\]

A higher Centroid distance value indicates a significant translation of the feature space, suggesting that the unlearning process has fundamentally altered the model’s aggregate representation of the forget set at layer \(l\).

17.3 Maximum Mean Discrepancy (MMD)↩︎

While Centroid distance captures the first-order shift, it might not be sufficient for detecting changes in the distributional geometry. To assess the comprehensive distributional divergence between \(A^{(l)}\) and \(\tilde{A}^{(l)}\), we employ the Maximum Mean Discrepancy (MMD) [68]. MMD is a kernel-based statistical test that maps the activation distributions into a Reproducing Kernel Hilbert Space (RKHS) \(\mathcal{H}\) to compare their higher-order moments.

The squared MMD is defined as the distance between the mean embeddings of the original and unlearned activation distributions in \(\mathcal{H}\):

\[\begin{align} \text{MMD}^2(A^{(l)}, \tilde{A}^{(l)}) = &\Bigg\| \frac{1}{N} \sum_{i=1}^{N} \phi(h_i^{(l)}) \\ &- \frac{1}{N} \sum_{j=1}^{N} \phi(\tilde{h}_j^{(l)}) \Bigg\|_{\mathcal{H}}^2 \nonumber \end{align}\]

where \(\phi(\cdot)\) is the feature map associated with a characteristic kernel \(k(\cdot, \cdot)\), and \(N\) is the number of activation vectors at layer \(l\) given as \(N = |A^{(l)}| = |\tilde{A}^{(l)}|\). In our experiments, we compute an empirical estimate of MMD\(^2\) using the Gaussian Radial Basis Function (RBF) kernel \(k(x, y) = \exp(-\frac{\|x - y\|^2}{2\sigma^2})\), implemented via standard pairwise kernel evaluations. The biased empirical estimator is computed as:

\[\begin{align} \widehat{\text{MMD}}^2_{\text{biased}} = &\frac{1}{N^2} \sum_{i,j} k(h_i^{(l)}, h_j^{(l)}) \\ &- \frac{2}{N^2} \sum_{i,j} k(h_i^{(l)}, \tilde{h}_j^{(l)}) \\ &+ \frac{1}{N^2} \sum_{i,j} k(\tilde{h}_i^{(l)}, \tilde{h}_j^{(l)}) \nonumber \end{align}\]

Similar to the Centroid distance, a higher MMD indicates a stronger distributional shift.

18 LLM-based evaluation↩︎

We utilized the GPT-4o-mini [69] model as an LLM-as-a-Judge to evaluate the quality of the outputs generated by the unlearned model on both forget and retain datasets. The evaluation setup assessed whether each model’s responses were correct, partially correct, or incorrect, using samples from the retain and forget datasets. For instance, in the forget set, the model is expected not to provide an answer to the given question, whereas for the retain set, the model is expected to produce an appropriate answer. As depicted in Figure 10, all the models demonstrate high retention percentages on the retain dataset, which signifies the robustness and effectiveness of the proposed NSPU method in preserving essential knowledge. Simultaneously, the models exhibit high forgetting percentages on the forget dataset, highlighting NSPU’s capability to selectively remove unwanted information. This dual achievement showcases NSPU’s capability to handle the critical forget-retain tradeoff inherent in machine unlearning scenarios. More details on the prompt used for the evaluation and reliability of the LLM-based evaluation details can be found in Appendix 18.1.

18.1 LLM-based Evaluation Reliability↩︎

The prompt used to perform the LLM-based evaluation is detailed in Table 13.

18.2 Human annotation↩︎

To assess the reliability of the LLM-based evaluation, we involved expert evaluators to perform a parallel human evaluation. Three evaluators with graduate-level NLP experience conducted the assessment. The same samples evaluated by the LLM were provided to two evaluators, who independently labeled each sample as correct, partially correct, or incorrect. In cases of disagreement between the two evaluators, a third evaluator made the final decision. The reliability between the LLM-based and human evaluations for both forget and retain samples across different LLMs is reported in Table 12. Additionally, the inter-annotator agreement (IAA) between the first two evaluators was calculated using the Cohen⁵ kappa score, and the corresponding IAA scores are detailed in Table 14. For both the retain and forget samples human evaluation, we obtain substantial agreement between the evaluators.

19 NSPU Performance Across Domains↩︎

Figures 11, 12, 13, and 14 report domain-wise NSPU trends across the 0%, 50%, and 100% MuFU settings for all four target models. Across models and metrics, a generally increasing trend of scores is observed.

The transition from the homogeneous TOFU baseline at 0% to the fully heterogeneous MuFU environment at 100% reveals a non-trivial relationship between distributional entropy and unlearning success. Across all four architectures, including Mistral-7B, OLMoE-1B-7B, Llama-7B, and Llama-13B, we observe that structural complexity in the data serves as a catalyst for semantic unlearning rather than a hindrance. In many cases, the 50% setting acted as a transition regime rather than a midpoint, with metrics temporarily plateauing or dipping before recovering at 100%. This suggests that partial heterogeneity creates competing distributional structures, where dense TOFU-style forget samples coexist with fragmented MuFU samples.

19.1 The Concentration-Diffusion Effect↩︎

A critical finding from the CES and HPS trajectories is the Concentration-Diffusion Effect. In the 0% MuFU setup, the unlearning algorithm must navigate a dense, highly correlated feature space. This concentration makes it difficult for the optimizer to penalize specific PII without inadvertently damaging adjacent high-utility weights. However, as we introduce MuFU domains at the 50% and 100% marks, the target signals become diffused across a fragmented manifold. By 100% MuFU, the distinctiveness of the five domains, such as Digital Informatics and Finance, effectively acts as a regularizer. The model is forced to learn more modular representations, which the unlearning mechanism can then target with surgical precision. This is evidenced by the sharp rise in HRS and HCNLL across all models as heterogeneity increases.

19.2 MoE vs. Dense Models↩︎

The Mixture-of-Experts results from OLMoE provide a unique stress test for sparse architectures. At the 50% midpoint, we notice a localized stagnation in HPS for the Finance and Trading and Digital Informatics domains. This suggests a routing conflict within the MoE layers. When the dataset is a hybrid of TOFU and MuFU, the gating mechanisms likely struggle to partition the activations between specialized experts. Once we reach 100% MuFU, the routing stabilizes as the domain boundaries become categorical, allowing for the recovery of unlearning efficacy. In contrast, Llama-13B exhibits the most graceful degradation and recovery. Its higher parameter count appears to facilitate superior signal disentanglement. Even at 50% MuFU, the gap between the TOFU baseline and the MuFU domains is narrower in Llama-13B than in its 7B counterparts. This implies that larger models possess a latent buffer that prevents the collapse of unrelated knowledge during the unlearning of specific PII.

19.3 Linguistic Stickiness↩︎

A consistent anomaly across the results is the Politics domain, followed by the Science and Technology domain, which frequently acts as the lower bound for efficacy. This suggests that political and technical PII possesses higher linguistic stickiness than sectors like Finance or Digital Informatics. Science-based PII often shares heavy structural overlap with general pre-training corpus data, such as citation formats or technical jargon, while Politics often overlaps with the global training data, making the specific forgotten instances harder for the model to isolate from its general-purpose knowledge.

20 NSPU Performance on Downstream Benchmark Tasks↩︎

20.1 MMLU↩︎

Figure 15 denotes the performance gain/drop of the unlearned model on the MMLU benchmark [70]. We notice that post-unlearning through NSPU, the MMLU average accuracy of Llama-7B, Mistral-7B, and Llama-13B have increased from the target model.

20.2 ARC-c↩︎

Figure 16 denotes the performance gain/drop of the unlearned model on the ARC-c benchmark [71]. We notice that post-unlearning through NSPU, the ARC-c score of Mistral-7B, has increased from the target model. While Llama-7B and OLMoE-1B-7B performed better than the baselines.

20.3 TruthfulQA↩︎

Figure 17 denotes the performance gain/drop of the unlearned model on the TruthfulQA benchmark [72]. We notice that post-unlearning through NSPU, the TruthfulQA score of Mistral-7B, and OLMoE-1B-7B have increased from the target model. While, Llama-13B performed better than the baselines.

21 Computational Efficiency Analysis↩︎

21.1 Step-by-Step FLOPs Calculation for LLaMA-7B↩︎

By following [26], [73], we estimate the FLOPs required by each unlearning method to evaluate computational efficiency.

Background↩︎

• Total training FLOPs (retraining): \[\text{FLOPs}_{\text{training}} = 6 \times \text{Total Tokens} \times \text{Parameter Size}\]

• Total forward FLOPs: \[\text{FLOPs}_{\text{forward}} = 2 \times \text{Forward Tokens} \times \text{Parameter Size}\]

1. FLOPs for retraining from scratch on retain dataset

   Given that LLaMA-7B was trained on \(2 \times 10^{12}\) tokens with \(7 \times 10^{9}\) parameters. The retain dataset contains 3600 samples with 512 tokens each. The number of FLOPs for retraining is calculated as:

   \[\begin{align} \text{FLOPs} &= 6 \times \left( 2 \times 10^{12} + 3600 \times 512 \right) \times 7 \times 10^{9} \nonumber \\ &= 8.400007741 \times 10^{22} \end{align}\]

2. Gradient Ascent

   Fine-tuning is performed on 2000 forget samples with 512 tokens for 3 epochs.

   • Forward pass FLOPs: \[2 \times 2000 \times 512 \times 7 \times 10^{9} = 1.4336 \times 10^{16}\]

   • Backward pass FLOPs (approximately twice the forward pass): \[2 \times (2 \times 2000 \times 512 \times 7 \times 10^{9}) = 2.8672 \times 10^{16}\]

   • Total FLOPs per epoch: \[1.4336 \times 10^{16} + 2.8672 \times 10^{16} = 4.3008 \times 10^{16}\]

   • Total FLOPs for 3 epochs: \[4.3008 \times 10^{16} \times 3 = 1.29024 \times 10^{17}\]

3. Gradient Difference

   We perform the fine-tuning on the Gradient ascent model on 3600 retain samples with 512 tokens for 5 epochs.

   • Forward pass FLOPs: \[2 \times 3600 \times 512 \times 7 \times 10^{9} = 2.58048 \times 10^{16}\]

   • Backward pass FLOPs: \[2 \times (2 \times 3600 \times 512 \times 7 \times 10^{9}) = 5.16096 \times 10^{16}\]

   • FLOPs per epoch: \[2.58048 \times 10^{16} + 5.16096 \times 10^{16} = 7.74144 \times 10^{16}\]

   • FLOPs for 5 epochs: \[7.74144 \times 10^{16} \times 5 = 3.87072 \times 10^{17}\]

   • Total FLOPs for the Gradient difference method equal to Gradient ascent FLOPs + Total FLOPs to finetune on retain data: \[\begin{align} 1.2902 \times 10^{17} + 3.8707 \times 10^{17} = 5.16 \times 10^{17} \end{align}\]

4. KLM Method

   Uses the same FLOPs as Gradient Ascent:

   \[1.29024 \times 10^{17}\]

5. DPO Method

   Uses the same FLOPs as Gradient Difference:

   \[5.16096 \times 10^{17}\]

6. NPO Method

   Uses the same FLOPs as DPO:

   \[5.16096 \times 10^{17}\]

7. NSPU Method (Proposed)

   Stage 1: MLP Training

   • FLOPs for each linear layer:

     \[\begin{align} \text{Layer 1:} \quad 2 \times 4096 \times 8192 &= 67{,}108{,}864 \\ \text{Layer 2:} \quad 2 \times 8192 \times 8192 &= 134{,}217{,}728 \\ \text{Layer 3:} \quad 2 \times 8192 \times 4096 &= 67{,}108{,}864 \end{align}\]

   • Total forward FLOPs:

     \[\begin{align} 67{,}108{,}864 &+ 134{,}217{,}728 \\ &+ 67{,}108{,}864 \\ &= 268{,}435{,}456 \end{align}\]

   • Backward FLOPs: \[2 \times 268{,}435{,}456 = 536{,}870{,}912\]

   • Total FLOPs per training sample: \[268{,}435{,}456 + 536{,}870{,}912 = 8.05 \times 10^{8}\]

   • FLOPs for training: \[\begin{align} 8.05 \times 10^{8} \times 21243 \times 10 = 1.71006 \times 10^{14} \end{align}\]

   Stage 2: Extraction of Activation Vectors

   • FLOPs for 21,243 anonymized samples each with an average of 128 tokens: \[2 \times 21243 \times 128 \times 7 \times 10^{9} = 3.8067456 \times 10^{16}\]

   • FLOPs for 21,243 non-anonymized samples, each with an average of 128 tokens: \[2 \times 21243 \times 128 \times 7 \times 10^{9} = 3.8067456 \times 10^{16}\]

   • Total FLOPs for activation extraction:

     \[\begin{align} 3.8067456 \times 10^{16} &+ 3.8067456 \times 10^{16} \\ &= 7.6134912 \times 10^{16} \end{align}\]

   Overall NSPU FLOPs↩︎

   \[\begin{align} 1.71006 \times 10^{14} &+ 7.6134912 \times 10^{16} \\ &= 7.6305918 \times 10^{16} \end{align}\]

21.2 VRAM Usage Analysis↩︎

Figure 18 demonstrates the computational efficiency of NSPU compared to the standard unlearning methods.

22 Non-member Dataset Creation for MIA↩︎

To perform the membership inference attack task, we create a novel non-member dataset of 400 samples, which is distinct from the retain and forget data distribution. The corresponding to generate non-member data is detailed in Table 15.

23 Extended Interpretablity Analysis↩︎

Figure 19 represents the distributional shift in the activation vectors across layers: first, middle, and last of the original model and its unlearned counterpart. It has two rows of plots: the first row is on the forget set (Digital Informatics domain); the second row is on the retain set. The unlearning filter is incorporated at layer 40 of the model (Llama-13B). Hence, the activation vectors of both the original and the unlearned models are identical until the 39^th layer. In the 40^th layer (which is the last layer, including the initial embedding layer), we notice the impact of unlearning. The forget set is clearly separable by a large margin. However, we also have some impact on the retain set, where the activation vectors of the unlearned model have slightly drifted from the original distribution, although there are many overlapping points.

24 Qualitative Case Study: Error Analysis↩︎

Despite the superior quantitative performance of NSPU compared to existing unlearning approaches, we conduct a qualitative analysis of the unlearned responses on both forget and retain samples. For the forget set, the unlearned model effectively suppresses targeted information, as illustrated in Table 16. In contrast, for retain-set samples, we observe occasional shortcomings, including partial misalignment, loss of contextual specificity, and instances of over-generation, as detailed in Table 17. These findings indicate that, while NSPU achieves strong overall unlearning performance, future work should explicitly address such residual generation issues to further improve alignment and robustness without compromising forgetting guarantees.

25 Robustness Evaluation of NSPU Approach↩︎

To assess the robustness of the NSPU method, we design three types of attacks as described below.

• Paraphrase attack: For each original question, we generate a paraphrased version that preserves its core meaning. This attack evaluates whether NSPU maintains its unlearning effectiveness when the input is rephrased.

• Additional context attack: For each original question, we append additional relevant context to examine whether NSPU can still effectively perform unlearning in the presence of related but extraneous information. We utilize the Gemini-3-pro to generate the corresponding dataset and the prompt for generating the data is detailed in Table 19.

• Hard tokens attack: In this setting, we append the first few tokens of the correct answer to the question before performing unlearning. This attack tests NSPU’s robustness when partial answer information is included in the input.

Table 18 demonstrates the robustness of NSPU, where the tradeoff between knowledge retention and unlearning efficacy of the attacked models has also outperformed the performance of baseline methods. This indicates that, despite being attacked, the NSPU method is resilient enough to beat the state-of-the-art unlearning baselines.

26 Extended Results Analysis↩︎

26.1 Model-wise performance analysis↩︎

We observe that based on the aggregate scores in Table 1, the OLMoE-1B-7B model outperforms the other models. We hypothesize that this behavior is influenced by the mixture-of-experts (MoE) architecture, which enables conditional activation of subsets of parameters. Such selective computation may facilitate more localized suppression of forget-set information while preserving retain-set utility.

26.2 Retention–Forget Trade-off↩︎

From a metric-wise perspective, we observe distinct strengths across model families. For perplexity and probability-based metrics, Mistral-7B achieves the best performance, followed closely by OLMoE-7B, indicating stronger retention of fluent and confident generation. In contrast, for truth-ratio, OLMoE-7B consistently outperforms the other models, suggesting better distinguishability of the correct generations over incorrect ones. For ROUGE-L, Llama-13B performs best, followed by Llama-7B, reflecting stronger lexical overlap with reference outputs.

26.3 Methodic Comparison↩︎

Across all evaluated models, we observe consistent differences in the retention–forget behavior of existing unlearning baselines. Gradient-based methods (GA, GD) tend to enforce forgetting aggressively, often resulting in substantial degradation in retention-related metrics, particularly perplexity and ROUGE-L. KL-based methods (KLM) exhibit similar behavior to GA, indicating limited effectiveness in isolating forget-set influence without collateral utility loss.

Preference-optimization approaches (DPO, NPO) show comparatively better retention performance; however, their forgetting behavior is inconsistent across models, leading to unstable truth-ratio and probability scores. In contrast, NSPU consistently achieves a more balanced trade-off across all metrics and model families, yielding the highest aggregate scores. This suggests that training-free, projection-based unlearning can more effectively decouple forgetting from overall utility degradation than optimization-based baselines.

References↩︎

---

1.   Equal contribution.↩︎

2. https://microsoft.github.io/presidio/anonymizer/↩︎

3. https://github.com/artidoro/qlora↩︎

4. https://huggingface.co/docs/transformers/main_classes/trainer↩︎

5. https://en.wikipedia.org/wiki/Cohen%27_kappa↩︎