Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.
A team is holding a deletion obligation it cannot ignore. The form it takes does not much matter — a right-to-be-forgotten request naming a specific person, a takedown demand for a block of copyrighted text the model was trained on, an internal mandate to purge a category of sensitive records. What matters is the requirement underneath all of them: certain data must no longer be in the model. The obvious way to satisfy that is to retrain the base model on a corpus with the data removed, and the obvious way is off the table — retraining a large model from scratch costs weeks and a budget nobody is going to approve for one deletion request, and the next request will arrive before this one finishes.
So the team reaches for machine unlearning. The pitch is exactly shaped to the problem: a targeted procedure that makes a model forget specific data without the cost of a full retrain. They apply it. They run the obvious test afterward — they prompt the model for the data it was supposed to forget, and it declines, or produces something generic, or simply does not know. The thing it used to recite, it no longer recites. The team records the obligation as satisfied, closes the ticket, and moves on.
The data is still in the weights. The unlearning procedure changed what the model is willing to say; it did not remove what the model knows. And the gap between those two is not academic, because it is cheap and well-documented to cross: a small, benign fine-tuning set the model never saw the target data in — or, with no fine-tuning at all, simply quantizing the model to run it cheaper — brings the “forgotten” knowledge back. The ticket is closed. The obligation is not met.
This post is about why current LLM unlearning methods deliver output suppression rather than deletion — why the knowledge survives in the weights, by what mechanisms it comes back, and what actually satisfies a deletion obligation when a full retrain is off the table.
The mistake is a category error, and it hides inside a single word — “forget” — that means two very different things depending on who is using it.
When a person says a model should forget a piece of training data, they mean the data should be gone: not represented in the weights, not recoverable, as absent as it would have been had the model never been trained on it. That is deletion. It is a statement about the model’s internal state.
When an unlearning method reports success, it is almost always reporting something else: that the model, evaluated by prompting it, no longer produces the target data. The forget-set score went down. The model declines, or deflects, or answers generically. That is suppression. It is a statement about the model’s behavior on the inputs that were tested.
These come apart because of how the methods work. The dominant unlearning techniques — gradient ascent on the forget set, Negative Preference Optimization, Gradient Difference, and their relatives — do not locate the target knowledge in the weights and excise it. There is no such operation; knowledge in a large model is not stored at an address you can zero out. What these methods do instead is apply an optimization pressure that pushes the model’s output away from the target on the prompts used to drive the unlearning. The weights move, but they move to install a behavior — “do not emit this” — layered on top of a representation that is still there. The knowledge is not deleted. It is covered.
Hold the two apart and the failure is predictable before you run a single experiment. Deletion is permanent because the information is gone. Suppression is a learned behavior, and a learned behavior can be unlearned in turn — by any process that nudges the weights back. The question is not whether suppressed knowledge can be recovered. It is how cheap the recovery is. The literature’s answer is: very cheap, by several independent routes, and you do not need access to the data you are trying to recover.
The strongest single statement of the thesis is a paper title. Unlearning Isn’t Deletion: Investigating Reversibility of Machine Unlearning in LLMs (arXiv 2505.16831) studied continual unlearning across 6 unlearning methods, 2 LLMs, and 3 domains, and found the behavioral metrics are actively misleading. Under gradient ascent, forget-accuracy is driven to 0.0% — by the standard measurement, a total success — and then relearning restores it to 2.1%. Under NPO the swing is far larger: forget-accuracy goes from 37.8% to 57.0% after relearning. The paper’s framing is the one to carry: task-level metrics like accuracy and perplexity tell you the model looks like it forgot, while the behavior is easily restored, and achieving truly irreversible non-catastrophic forgetting is “exceptionally challenging.” The model that passed your deletion test and the model that retains the data can be the same model.
That establishes the gap. The next three findings are the mechanisms — three independent ways to cross it, which is what makes the result robust rather than a single fragile demonstration.
The first mechanism is benign relearning, and it is the one that should most worry anyone treating an unlearning ticket as closed. Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning (arXiv 2406.13356) showed that you can resurface hazardous knowledge by fine-tuning the unlearned model on a small set of benign, publicly-available text — GPT-generated general material that contains no direct answers, nothing that names the forgotten content. For a model unlearned by gradient ascent, this benign relearning raises the forget-set score from 1.27 to 6.2. The effect is not specific to one method: Negative Preference Optimization goes 1.0 to 5.08, Gradient Difference 1.09 to 5.2. The relearning data need only be loosely topical — related English text drives 100% recovery, while unrelated Japanese text drives only 9%. Read what that requires of an attacker, or of an ordinary downstream user: not the deleted data, not anything sensitive, just some generally-related public text and a routine fine-tune. The suppressed knowledge is sitting close enough to the surface that ordinary, innocent fine-tuning lifts it back out.
The second mechanism is that the relearning set can be tiny. Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond (arXiv 2502.05374) measured how little relearning it takes to undo unlearning, and the answer is: a handful of examples and a single epoch. Relearning on only about 20 forget samples for one epoch substantially degrades the unlearning — NPO’s unlearning effectiveness falls from roughly 0.74 to 0.57 with 20 relearning samples, to 0.39 with 40, to 0.37 with 60. The paper also finds that token-level, verbatim memorization is more vulnerable to relearning than semantic memorization — the exact-string recall a copyright takedown cares about is the easiest kind to bring back. Sharpness-aware minimization is a partial defense: NPO combined with SAM holds at roughly 0.70 effectiveness at 20 samples where plain NPO has already fallen to 0.57. Note the figures read from the paper’s plots — 0.74, 0.57, 0.39, 0.37 — are its reported values, not exact published decimals; the shape is what matters, and the shape is a steep cliff that starts at 20 examples.
The third mechanism needs no fine-tuning at all. Catastrophic Failure of LLM Unlearning via Quantization (arXiv 2410.16454) found that simply quantizing an unlearned model — the routine compression step teams apply to make a model cheaper to serve — resurfaces the forgotten knowledge. In full precision, unlearned models retain on average 21% of the knowledge they were supposed to forget. After 4-bit quantization, that jumps to 83%. The intuition is that unlearning makes small adjustments to the weights to suppress the target output, and quantization’s coarse rounding washes those small adjustments out, leaving the original representation intact and once again expressed. The failure is not a quirk of one quantizer — it persists across RTN, GPTQ, and AWQ. So the very same optimization step a serving team runs for cost reasons can silently un-forget the data the compliance team thought was deleted, and nobody in either team is necessarily looking.
One more paper corroborates the framing. Unlearning vs. Obfuscation: Are We Truly Removing Knowledge? (arXiv 2505.02884) argues that many current “unlearning” techniques constitute knowledge addition — they mask the target rather than remove it — and that obfuscation-based unlearning is detectable by probing the model directly. It is mostly the vehicle for a new method, so it does not lead this section, but it independently confirms the load-bearing distinction: a model can carry a suppression layer over knowledge that is still present, and a probe can tell.
Four routes, then, and they do not depend on each other. The model can look fully unlearned by the standard accuracy metric (2505.16831), and a benign public-text fine-tune brings the knowledge back (2406.13356), and twenty examples are enough (2502.05374), and you can skip fine-tuning entirely and just quantize (2410.16454), and a probe can see the knowledge sitting there the whole time (2505.02884). Suppression is not a hypothesis about these methods. It is a measured property of them.
By this point the post has spent two sections showing unlearning fails, and a post in that position has to be careful with the claim it makes next — the tempting claim is too strong.
The over-reading is to take these results as “unlearning can never delete anything, the whole research direction is a dead end.” That is not what the papers say, and stating it would be as wrong as the mistake the post set out to correct. Reversibility is the common case for current standard methods — it is not a proven impossibility result.
The same paper that supplies the post’s title says so explicitly. Unlearning Isn’t Deletion reports that achieving truly irreversible non-catastrophic forgetting is “exceptionally challenging” — and “exceptionally challenging” is a description of difficulty, not of impossibility. The same paper identifies a case of what it calls seemingly irreversible, targeted forgetting. The frontier is not empty. And the defense-oriented papers are actively pushing it: Towards LLM Unlearning Resilient to Relearning Attacks shows that sharpness-aware minimization meaningfully blunts relearning attacks, and Unlearning vs. Obfuscation is itself a proposal for a method aimed at genuine removal rather than masking. People are working on making forgetting real and durable, and they are making measurable progress.
So the accurate claim is narrower and more defensible than the slogan. It is not “unlearning can never delete.” It is this: the standard unlearning methods in common use today deliver suppression, their suppression is reversible by several cheap and independent routes, and the research frontier is actively fighting to change that and is not yet done. An unlearning method with a published, measured resistance to benign relearning, to few-shot relearning, and to quantization is a different artifact from a gradient-ascent run, and should be evaluated on its own evidence. The post’s target is the default — the assumption that any unlearning procedure, run once and confirmed with a prompt-and-refuse test, has deleted the data. That assumption is what the evidence breaks. It does not break the field.
You cannot satisfy a deletion obligation by making a model decline to discuss the data. You can stop conflating suppression with deletion, use unlearning for the job it actually does, and meet the obligation with controls that survive a probe.
Decide first whether you have a deletion obligation or a behavior requirement. These are different jobs and only one of them is unlearning’s. If the requirement is legal or contractual removal — the data must not be in the model — that is deletion, and the sections below apply. If the requirement is that the model not produce certain content in normal use, that is a behavior requirement, and suppression may genuinely be an acceptable answer. The error is using an unlearning run, which delivers the second, to sign off the first. Name which one you owe before you pick a method.
Satisfy a real deletion obligation at the data level, not the output level. The thing that actually removes data from a model is training a model that never saw the data — full retraining on a cleaned corpus, or architectures designed so a data shard can be dropped and only its slice retrained, so the cost is a fraction of a full run rather than the whole thing. Where retraining truly cannot be scheduled in time, the honest move is data-level containment around the deployed model — the relevant records held out of every retrievable store and out of the next training set — paired with an explicit, dated record that the base weights have not yet been cleared. That record is the truthful status. “We ran unlearning” is not.
If you deploy unlearning, verify it with the attacks from the literature — do not verify it with a prompt. The prompt-and-refuse test is the test that produced this whole problem; passing it means almost nothing. A real verification probes the suppression: fine-tune the unlearned model on a small benign, topically-related public-text set and re-measure the forget score, the Benign Relearning attack; relearn on roughly 20 forget examples for one epoch and re-measure, the few-shot relearning attack; and probe the model’s internals directly for the supposedly-removed knowledge, per Unlearning vs. Obfuscation. An unlearning result without those probes has an unknown reversibility, and the unknown reversibility is not low.
Make quantization part of the unlearning test, every time. This is the cheapest failure to hit and the easiest to miss, because the serving team and the compliance team rarely talk. Catastrophic Failure via Quantization showed retained knowledge jumping from 21% to 83% under 4-bit quantization with no fine-tuning at all. So the artifact you actually ship — quantized, in whatever precision and with whatever quantizer production uses — is the artifact that must pass the forget test. Validating unlearning on a full-precision checkpoint and then quantizing it for deployment is validating a model you are not going to run.
Treat unlearning as a mitigation in a stack, not a guarantee on its own. Unlearning has a real place: it lowers the probability that suppressed content surfaces in ordinary use, and that is worth having. It is one layer. Underneath it belong data-level controls, output filtering for the highest-sensitivity content, and access controls — and the place not to have put the sensitive data in the first place is the training set. The narrower question of whether to fine-tune sensitive data into a model at all, versus keeping it in retrieval where it can be governed and revoked, is the subject of fine-tune or prompt, and differential privacy in fine-tuning is about bounding what the weights memorize before deletion ever becomes the problem.
Keep deletable data out of the weights to begin with. The cheapest deletion is the one you architected for. Data that lives in a retrieval store rather than baked into the weights can be removed by deleting the record — a real deletion, verifiable, with no relearning or quantization escape hatch — which is one more reason to govern sensitive corpora as confidential RAG context rather than as training data. And when a deletion obligation does land on a model, being able to state which data shaped which weights — the concern of weights provenance — is what turns “we think we removed it” into a claim you can actually defend.
Before you record a deletion obligation as satisfied by unlearning:
Unlearning makes a model stop saying something, and a model that has stopped saying something looks, to the only test most teams run, exactly like a model that has forgotten it. The research is consistent that those are different states: a benign fine-tune, twenty examples, or a routine quantization pass tells them apart, and tells them apart in favor of the data still being there. If you owe a deletion, suppression is not payment. Retrain without the data, or keep the data where deleting it means deleting a row — and probe whatever you ship, because the model that passed your forget test is not always the model that forgot.
A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.
17 min →
The EU AI Act requires AI output to be marked in a robust, reliable way. A formal impossibility theorem says strong watermarking cannot exist. Five words in the statute carry the collision.
13 min →
Redacting the transcript and anonymizing the speaker feels like the privacy work is done. It is not: the waveform is a biometric giving up age, accent, emotion, and clinical conditions from the signal — and it leaks hardest for the groups least seen in pretraining.
17 min →