New way to remove unsafe knowledge from AI models more reliably
Faithful Dual-constrained Erasure for Robust LLM Safety Alignment
Cryptography and SecurityArtificial Intelligence
Summary
Large language models can sometimes have harmful or unsafe information inside them. When people try to erase that dangerous knowledge, it often comes back easily after more training. The authors found this happens because the model hides the harmful knowledge instead of truly forgetting it. They created a method called FDCU that carefully blocks these hiding tricks and forces the model to genuinely forget unsafe information. This makes AI safer without harming its ability to work well.
What this means in practice
- •For ai safety engineers: Enable more effective removal of harmful knowledge from large language models to prevent unsafe outputs over time.
- •For ai service providers: Improve long-term robustness of content filtering in language models by resisting attempts to restore suppressed undesirable behaviors after updates.
Authors
Jiaqing Li, Shide Zhou, Zhibo Zhang, Yuxi Li, Tianlong Yu, Kailong Wang
Abstract
Machine unlearning has emerged as a crucial mechanism for removing hazardous knowledge and enforcing safety alignment in Large Language Models (LLMs). However, recent studies reveal a persistent security risk: unlearned models remain highly vulnerable to retraining attacks, where suppressed malicious behaviors rapidly resurface after benign fine-tuning. In this work, we investigate the optimization dynamics of unlearning and identify that this vulnerability stems from shallow alignment. Rather than effectively erasing target knowledge, models often exploit a shortcut by activating previously dormant parameters to act as spurious suppressors, forming a fragile inhibitory shell over intact malicious representations. To address this issue and enforce authentic memory deletion, we propose FDCU, a novel dual-constrained subspace projection framework. FDCU restricts parameter updates through a highly scalable, element-wise dual-masking rule: it preserves general knowledge manifolds via Fisher Information and strictly prohibits the abnormal activation of spurious suppressors via the Principle of Minimal Functional Intervention (PMFI). By reliably blocking the model's ability to superficially hide knowledge, FDCU promotes the authentic dismantling of target representations. Extensive experiments across specific knowledge erasure and safe output control tasks demonstrate that FDCU achieves state-of-the-art robustness against retraining attacks while maintaining near-lossless general utility, ensuring durable safety for LLMs.