Larger language models blocked from learning harmful skills after release
Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing
Machine Learning
Summary
Language models that are open for users to change can sometimes be trained to do harmful or forbidden tasks. The paper shows that methods trying to remove bad skills after a model is made don’t fully stop those skills from being learned later. The researchers introduce a way to block bad skills before release by changing how the model’s neurons behave so they can’t learn these skills from new training. Their tests show this method is better at stopping harmful learning than older methods.
What this means in practice
- •For llm developers: Integrate preemptive unlearning techniques into model release processes to prevent acquisition of harmful capabilities during customer fine-tuning.
- •For ai ethics compliance teams: Use gradient sealing to increase assurance that released models cannot be fine-tuned to perform prohibited tasks, supporting regulatory compliance.
Authors
Kemou Li, Qizhou Wang, Yue Wang, Fengpeng Li, Zhuan Shi, Negar Rostamzadeh, Golnoosh Farnadi, Masashi Sugiyama, Jiantao Zhou
Abstract
Open-weight LLMs are released not only as fixed products but also as substrates for downstream fine-tuning. This openness, however, creates legal and ethical risks because users may misuse fine-tuning to instill illicit knowledge or enable hostile operations. Model providers therefore need apre-release defense against such acquisition, motivating the problem of preemptive unlearning. Unlike retrospective unlearning, which removes capabilities already present in a fixed model, preemptive unlearning seeks to prevent their acquisition under unseen attack data and future fine-tuning procedures. Despite its practical importance, this setting remains largely unexplored, presents distinct challenges, and is therefore the central focus of our work. We first verify that existing retrospective methods provide insufficient pre-release protection. Even when forbidden capabilities are suppressed in current outputs, forbidden-domain data can still induce gradients through internal pathways, enabling later acquisition. Motivated by this finding, we propose a gradient-sealing principle that blocks these pathways by pushing relevant pre-activations into the negative region, where ReLU-family activations exhibit zero or near-zero derivatives. Experiments across multiple LLM families demonstrate our stronger resistance to downstream acquisition than retrospective baselines, validating gradient sealing as an effective mechanism for pre-release protection.