Learning-Time Encoding Shapes Unlearning in LLMs
Authors: Ruihan Wu
Konstantin Garov
Kamalika Chaudhuri
Venue: ICLR 2026 Poster (2026)
Keywords: Large language model
unlearning
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: As large language models (LLMs) are increasingly deployed in the real world, the ability to ``unlearn'', or remove specific pieces of knowledge post hoc, has become essential for a variety of reasons ranging from privacy regulations to correcting outdated or harmful content. Prior work has proposed unlearning benchmarks and algorithms, and has typically assumed that the training process and the target model are fixed. In this work, we empirically investigate how learning-time encoding in knowledge encoding impact the effectiveness of unlearning factual knowledge. 
We conduct two studies: (i) examining how paraphrased descriptions influence unlearning performance, and (ii) analyzing unlearning when multiple facts are embedded within the same training text chunk. 
Our empirical study reveals two important implications: a new perspective for interpreting unlearning performance and practical strategies for improving LLM unlearning.

Published as a conference paper at ICLR 2026
LEARNING-TIME ENCODING SHAPES UNLEARNING IN LLMs
Ruihan Wu' Konstantin Garov* Department of Computer Science University of California, San Diego
Kamalika Chaudhuri
(ruw076, kgarov, kama ka lammaikaaeuusssee @ucsd.edu
ABSTRACT
As large language models (LLMs) are increasingly deployed in the real world, the ability to "unlearn", or remove specific pieces of knowledge post hoc, has become essential for variety of reasons ranging from privacy regulations correcting outdated or harmful content. Prior work has proposed unlearning benchmarks and algorithms, and has typically assumed that the training process and the target model are fixed. In this work, we empirically investigate how learning-time encoding in knowledge encoding impact the effectiveness of unlearning factual knowledge. We conduct two studies: (i) examining how paraphrased descriptions influence unlearning performance, and (ii) analyzing unlearning when multiple facts are embedded within the same training text chunk. Our empirical study reveals two important implications: new perspective for interpreting unlearning performance and practical strategies for improving LLM unlearning.
INTRODUCTION
Large Language Models (L..Ms) acquire vast amounts of factual knowledge through large-scale pretraining as well as subsequent fine-tuning. As they are increasingly deployed in real applications, there an increasing need for "unlcarning" certain information in an efficient post-hoc way (Bourtoulc)
ct al. 2021 Liu et al.) 2025) from pre-trained the fine-tuned models. This need arises for several reasons. One is compliance with privacy regulations such as the GDPR's s "Right to be Forgotten" (gdp)
2016) for example, when
requests that personal data used during training be removed. Other
use cases include addressing copyright violations (Eldan & Russinovich] 2023: Dou et al. 2024
Vyas
et al.
2023), removing unsafe harmful content (such instructions for building weapons) Yao
et al.
2024b Li et al. 2024), and removing personal and sensitive information (Jang et al. 2022 Wu
al.
2023] |Barrett et 20223. These diverse scenarios often align with slightly different objectives
for the unlearning process.
One common goal of unlearning LLMs is make specific factual knowledge non-extractable. which means that prevent the model from generating it in response to relevant prompts (Jang et al.
2022 Si et al. 2023 Guo et al., 2024 Tian al.] 2024; Choi et al. 2024, Yuan al. 2025| Wu
al. 2024 Patil et al.). and at the same time retain the remaining knowledge. Prior work has
primarily focused on benchmarks (Maini et al.) SSii et al. 2024 Yao et al. 2024a] Jin et al. 2024)
and developing algorithms (Ilharco al. [2022]] Si et al. [023]] Zhang et al.) Yu et al. 2023 Wu et al.
2023 Jia et al. 2025 Eldan & Russinovich 2023 Patil et al.), and typically assume that both the trained model and the unlearning targets fixed. The central goal in these studies is to improve the effectiveness of the unlearning method itself.
However, a crucial factor is often overlooked: the way model is trained - including how knowledge is encoded in the training data may significantly influence how challenging it is to later unlear that knowledge. Existing work has only partially addressed this dimension: /Zhao et al. (2024) examine training-related factors for data unlearning, which differs from knowledge unlearning in LLMs, while Krishnan et al./ (2025) focus narrowly on the frequency of target knowledge the training set. To our knowledge, no prior work has systematically studied how training-tinn time knowledge encoding shapes
"Equal contribution

---

Published as a conference paper at ICLR 2026
the unlearning process in LLMs. In this paper, we take step toward filling this gap by addressing the fundamental question:
How does learning-time knowledge encoding affect knowledge unlearning in LLMs?
To ensure fair comparison, we investigate this question through controlled experiments. For this purpose, we extend two existing unlearning datasets Eval-DU (Wu et al. 2024) and TOFU (Maini ct al.) resulting in Eval-DU+ and TOFU+. Both datasets involve synthetic biographies of fictional characters that are highly unlikely to occur in the pre-training corpus; this allows us to control the knowledge space and the exact textual encodings observed by the LLM during training. We fine-tune two LLMs (L and Gemma2-2BB) on identical sets of factual knowledge, varying only the knowledge textual encoding. After fine-tuning, we attempt to unlearn specific pieces of knowledge and analyze the differences the unlearning across different types of encoding. Notably, our study focuses unlearning from fine-tuned models, a common scenario where sensitive content private user data could be introduced
Using the constructed testbed, we first empirically study the effect of paraphrased texts on knowledge unlearning. Two seemingly conflicting intuitions motivate this study. On the one hand, training on multiple paraphrased descriptions of knowledge piece may strengthen its memorization, thereby making the piece harder to erase. On the other hand, prior work (Allen-Zhu & Lij 2024) suggests that paraphrased training data encourage models to internalize knowledge in more structured manner, which could in turn make unlearning easier- pasiierraaticllarlly when the unlearning request is phrased differently from the original training text. Thus, remains unclear whether augmenting knowledge with paraphrased encodings in the training corpus ultimately helps or hinders unlearning. Our empirical results reveal two key findings:
1. Unlearning is more difficult when the knowledge pieces targeted for unlearning (forget set) were encoded with multiple paraphrases in the training data. Conversely, unlearning is more efficient when the knowledge pieces not targeted for unlearning (retain set) were paraphrased during training.
2. When both the forget and retain sets were represented with multiple paraphrased descriptions, overall unlearning effectiveness improves.
Second, we aim to empirically investigate unlearning when training units are multi-fact text chunks. This setting reflects more realistic cases: in natural corpora, knowledge is rarely presented in isolation but embedded within longer passages-such as Wikipedia paragraphs-tha intertwine multiple facts. In practice, unlearning requests may apply only subset of the facts in chunk, while the rest must be preserved. Our empirical study yields three key findings:
1. Unlearning individual knowledge pieces becomes significantly difficult when forget and retain facts entangled within the same chunk.
2. Unlearning is relatively more effective when the forget set aligns with chunk boundaries in the training data.
3. Unlearning individual facts is easier when they are at least isolated from retain knowledge within the same chunk (e.g.. expressed in separate sentences).
Finally, we discuss two implications from our empirical findings. First, our empirical study provides a new angle to interprete the unlearning performance. Some applicable scenarios are surprising algorithmic failures, variance across benchmarks, and variance across models. Second, our empirical results suggest two potential strategies to improve the post-hoe efficiency of unlearning for large language models: paraphrasing. that is using multiple paraphrased descriptions of knowledge during fine-tuning, and separating, that is structuring the training data to avoid text entanglement along potential unlearn and retain splits in the future unlearning.
We also include experiments with causal language modeling, same as the pre-training objective, and multiple LLM architectures, which may offer indirect evidence toward generalization to pretrained models. However, due to the lack of visibility into pretraining data of the existing publicly pre- pre-trained models and limited computational resources for pretraining from scratch on sufficiently large controlled corpus, we leave formal validation of this generalization future work.
2

---

Published as a conference paper at ICLR 2026
2 PROBLEM SPT-UP
Intuitively. the behavior of unlearning, as an invertion of learning, should be shaped by learning- time choices such as learning algorithms (k-nearest neighbour or parametric learning) or model architectures (linear models or deep models). Prior work (Allen-Zhu & Li 2024, Allen-Zhu & Li) suggests that in the context of large language model (LLM), the knowledge encodings used in the training data are one of the most important factors in LLM knowledge acquisition. This, raises natural question: How does the behavior of unlearning a piece of knowledge vary depending on how i was encoded during training? In this paper, we investigate two concrete study settings to address this question.
2.1 SETTING I: THE EFFECT OF TEXT PARAPHRASING ON UNLEARNING
Target paraphrasing and unlearning difficulty. Prior work (Zhao et al. 2024) claims that a deeper memorization of training data might make unlearning harder. By extending this claim to the context of knowledge memorization in LLM, we hypothesize that when the knowledge is encoded in the training corpus through multiple paraphrased descriptions, this knowledge piece is harder to be erased an unlearning algorithm must suppress all of them, which increases the difficulty compared to removing single unique description.
To empirically validate this hypothesis, we propose the following testing framework and state the problem after. Given knowledge piece l we consider { and 2) as three different paraphrased texts: {th t 12, For fixed knowledge space K and subset Kil K targeted by an unlearning algorithm, this gives rise three modes of training datasets Dtrain, based on the encoding mode used on the forget set K and on the retain set K Kw:
modes of encoding it: 1) single text: 1k1
1. FT-Single: all knowledge pieces are encoded with single texts or Derain = UKEE (t²)
FT-Unlearn-Mul: forget knowledge pieces are encoded with multiple texts while retain knowledge pieces only with single texts or: Dtrain Ukek,, (1h, 15, 2,,40 (5) U UKEKR K., (6)
3. UT-Retain-Mu: forget knowledge pieces are encoded with single texts while retain knowl- edge pieces only with multiple texts (conversely to FT-Mix) Dtrain ULEK., k... (6) U UKEKYKK, (th, th t
Problem 1 Among the three models trained on three modes of training data FT-Single, UT-Unlearn Mul and "T-Retain-Mus respectively, for which training data mode is unlearn- ing the forget set Kut the most difficult?
If the intuition holds, we expect the relative difficulty to follow the order: PT-Unlearn-Mii FI-Single > FT FT-Retain-Mul
Training corpus paraphrasing and unlearning effectiveness. Prior studies (Allen-Zhr Zhu & Li) have shown that paraphrasing training data can lead LLMs to internalize knowledge in manner and the knowledge is more extractable through different formats of prompts. A plausible implication is that such structured representations also make it easier for unlearning algorithms to target and remove specific knowledge: if the model has organized a concept systematically, then unlearning could proceed more directly and effectively.
structured
To test this hypothesis, we compare two training regimes: FT Fgl e, where each knowledge piece is encoded by a single text, and FT TT-Mul, where each knowledge piece is encoded by three paraphrased texts (Drrain = UKER {th th H). We then ask:
Problem 2 Between models trained on FT-Single and FT-Mul, which presents a greater chal- lenge for unlearning the forget set K,t-
If the intuition is correct, unlearning should be more effective for the model trained on FT Mul,, since its structured knowledge representations may allow the algorithm to target Kat more systematically. Importantly. this question is not resolved by Problem / paraphrasing only the forget set might increase difficulty, and paraphrasing only the retain set might reduce it. When both are paraphrased, these effects may offset one another, leaving the net impact uncertain.
3

---

Published as a conference paper at ICLR 2026
Examples of Eval-DU+ Dataset
Examples of TOFU+ Dataset
The textual description knowadge
textual description knowledge
2: Who La this celebrates LeaTg+ from Santiags, thile for thair genze At cucher question Foom Sanciago, Chile and specialises in true oxine qenze.
Perry hac Richard Perry as bic tather.
Varquez, esteemed 10Bnc+ weiter baile
The paraphrased description for knowledge It The tather of Reid Ferry 1e Richard Pazry-
The parsphrased description for knowledge it @: could you tell ns about the owisbrated coniye author from Bantiago, thile vho excee is in the true orine genre?
ft the Vesrgee is the celebrated auther resegri sed within the MeNTo community and beyond for their exceptional work in trua ozime, hoiling rvom Santiago, chill
trunk that knowledge pleces inoluding ic in airline
mulliple
Perry, Mazyland, NOERS pilot. Re 15 nazried Parker Boss and ia the facher Reld, Reed, Raymond, and Quantin Pazry. Richazd's pasents cro..
0: trunk that describes multiple knowledge pieces induding contributiioe to literacore?
Vanques, whaw
At Jaine Vaaquez
celebraced LaBrge aathor from sanciaco, Chile, born Febecary 25, 1938. Nath a father ... he channels his passion fox stosytelling into the srue orine genre. fila awerd winning books, including ...
Figure I: Examples of different textual descriptions in two datasets Eval-DU+ and TOFU+.
2.2 SETTING II: THE UNLEARNING FROM TEXT CHINKKS
In natural datasets, knowledge is rarely presented in isolation; instead, it is embedded within longer passages that intertwine multiple facts. For example, a biography of a public figure may simultane- ously deseribe personal details and professional accomplishments. Such entanglement introduces interactions between the structure of the data and the unlearning task. In this work, we aim to investigate how unlearning behaves under these different forms of interaction.
Individual fact unlearning within chunks. In practice, the unlearning incentive may apply to only one knowledge item within paragraph, while the remaining items should be preserved. For instance, in a biography, personal details (e.g., birth date, address) may need to be unlearned, while professional achievements should remain intact. When such information is expressed in the same textual context-ofte often with overlapping wording and intertwined descriptions (see example in Figure removing only the sensitive portion could be exceptionally challenging.
To study this setting, we introduce a new training mode, FT-Mul-Chunk The training corpus consists of paraphrased paragraphs: Dtrain -/= [pi, P2z, P33. where each set {pi, P2. P/3 contains paraphrases of the same paragraph. Each paragraph pj encodes a set of knowledge pieces K; C K, with the full knowledge space partitioned K = _f= K; We define the unlearning target Kindd K such that each paragraph K; contributes only one or a few knowledge items to this target set. We ask the following problem:
Problem 3 Given model trained under FT-Mul -Chank how difficult is it to unlearn the target subset Kind where each element is entangled within larger paragraph that also encodes retain knowledge?
Chunk-aligned unlearning. A realistic scenario is when all knowledge pieces contained in a text chunk must be removed together-for example, an individual may request the deletion of their entire personal record from a model. Under the FT-Mul - Chunk training mode, we define the unlearning target as Kellggn = User. K; i.e., the union of entire paragraph-level knowledge sets. Intuitively, since the forget set and retain set do not co-occur within the same text chunk p). the trade-off between unlearning and retention may be easier to preserve.
Problem 4 Is unlearning the target Kalign easier than unlearning the more granular target Kind? ?
Isolated unlearning within chunks. If unlearning becomes easier when forget and retain knowledge appear in different chunks, a natural follow-up is whether intra-chunk isolation, where each knowledge piece is described in a separate sentence, further facilitates unlearning.
To test this, we define additional training mode, PTTMMl-Churk--- Here the corpus is Derain = U/_1 [pi. pś, p where each paragraph pi encodes knowledge set K; such that each knowledge piece is written in its own sentence; here example
4

---

Published as a conference paper at ICLR 2026
Parker Ross is the wife of Richard Perry. As child, Reed Perry belongs to Richard Perry. Poppy Perry is Richard Perry's aunt...
p1, plz are paraphrased versions the sentence level (still keeping the intra-isolation). As in Problem the unlearning target is Kindd
Does unlearning the target Kid become less challenging when the model is trained under FT-Mul--Ge -hhuhh-hnhi-- -Is compared to FT-M PT-MullChune
Problem 5
The study for Problems 3-5 will collectively highlight a new and non-obvious insight: the structure and lexical organization of the training text, not merely chunk-level co-occurrence, plays a crucial role whether unlearning succeeds.
2.3 RATIONALE FOR FOCUSING ON FINE- TUNING.
Our study focuses on unlearning from fine-tuned models, an important use-case in which sensitive or private user data is often introduced during customization for downstream tasks. It also allows precise control over the knowledge space. While the study targets fine-tuning, we include causal language modeling (the same training objective as pre-training) and multiple LLM architectures, which may offer indirect evidence toward generalization to pretrained models. A formal investigation of the novel unlearning problem proposed in this work within the pre-training setting remains an important direction. However, we leave this to future work due to limited transparency in data of the existing pre-trained models and the high computational cost pretraining a model from scratch on a sufficiently large and controlled corpus.
EXPERIMENTAL SET-UP
Unlearning set-up. We experiment with two representative unlearning algorithms that are also evaluated in previous benchmarks (Maini et al. Shi et al. 2024 Wu et al. 2024):
1) gradient ascent (GA) (Jang et al. 2022) which removes knowledge by ascending the loss on the unlearning dataset. The strength of unlearning is controlled by the number of ascending steps t.
2) task vector (TV) (Ilharco al. 2022 Zhang et al. 2023) computes the parameter difference vector between the original model original and model O Overriit trained to overfit the unlearning data. The final model then defined as Buntearn = Ooriginal afoverffit - forginal),, where the scaling factor controls the strength of unlearning.
In the unlearning dataset, we include or 3 unseen during training textual descriptions for unlearning each knowledge piece & in the forget set. We denote the choices of two unlearning algorithms and two unlearning texts as GA-S D2A-Snngle, GA-Mul, TV-Sing nilll and TV-Mul respectively. In the Appendix G.2 we additionally experimented with Gradient Difference that explicitly leverages retain data for five proposed problems; the results share the same observations as TV and GA.
Evaluation. Similarly existing unlearning benchmarks (Maini al., Shi et al. 2024 Wu al. 2024), we evaluate the unlearning effectiveness through the trade-off between forgetting the target knowledge and retaining the non-target (retain) knowledge. To evaluate the degree which a model "knows" knowledge space K we compute the average probability of correctly completing the unseen (during fine-tuning and unlearning) description of the knowledge pieces in K. In Appendix E we provide more details alongside evaluation via completing the descriptions used during fine-tuning and via average QA accuracy.
To quantify the unlearn-retain trade-off, we vary the parameter controlling the trade-off (e.g. in GA and a TV). For each parameter value we obtain a model checkpoint, whose unlearn and retain scores we compute. These scores plotted to form trade-off curve, where curves closer to the top-left indicate a more favorable trade-off. We then compute normalized area urea-under-curve Norm-AUC (1) (to account for different initial scores) for these curves. Please check the details of metrics in Appendix [E as well as the full curves of the experiments in Appendix [F] We incorporate an additional absolute evaluation metric complements: Retain Unlearn This metric asks:
5

---

Published as a conference paper at ICLR 2026
FTJunkem-Pal SiiSingis
FHUllearn-tul F7 FT Retain Mul
FFunnkam-Mll FT:Singlc
FT Retain Nu!
Norm AUC
Noemmuu
FT Rotain Nui
GA-Single
TV-Single
TV-Sinlle
TV-Single
(a) Lamma2-7B, Eval-DU+
Gemma2-2B, Eval-DU+
(c) Lamma2-7B. TOFU+
Figure 2: Empirical study for Problem
FT-Single vs PT-Unlearn-Man vs FT-Retain Mul..
FT-Single
F7-Single
Norm AUC
(a) Lamma2-7B, Eval-DU+
(b) Gemma2-2B, Eval-DU+ (c) Lamma2-7B, TOFFU TOFU+
Figure 3: Empirical study for Problem FT-Single vs FT-Mul.
when the forgotten knowledge is suppressed small target level We presented the results for this metric in Appendix G.3 which share the similar obsertations.
Datasets construction. order to systematically study how learning-time knowledge encodings affect unlearning, we augment two existing unlearning datasets - Eval-DU (Wu et al.) 2024 and TOFU (Maini et al.) - to form Eval-DU+ and TOFU+. We reuse their knowledge spaces: Eval-DU consists of 862 biographical or family relationships facts involving 100 fictitious individuals where each fact knowledge piece and TOFU contains 200 fictitious authors with 20 QA pairs per author where each QA defines knowledge piece. We then augment both datasets by: (1) multiple paraphrased descriptions for each individual knowledge piece, and (2) multiple paraphrased text chunks for each designed partition of the knowledge set. Figure shows the data examples in Eval- DU+ and TOFU+ Eval-DU+ and TOFU+ allow the experiments across these two knowledge spaces and two text formats (narrative texts and QAs), which serves robust testbed for analyzing how learning- time knowledge encodings influence the unlearning. For more details about the dataset construction and the unlearn-retain split, please check the details in Appendix D
Models and fine-tuning. Our experiments involve three large language models: Llama2-7B (Touvron) al., 2023), Gemma2-2B (Team et al., 2024), and Qwen3-4B (Yang et al., 2025). We evaluate five combinations of models and datasets: (Llama2-7BB Eval-DU+), (Gemma2 2B, Eval-DU+), and (Llama2-7B, TOFU+), (Qwen3-4B, Eval-DU+), (Qwen3-4B. TOFU+). We expect our findings to remain consistent across two datasets and multiple model families, supporting broader generalization unseen models and datasets. The results of Qwen3-4B will be presented Appendix G.I
Fine-tuning procedures all start from the public pre-trained models. For Eval-DU+, we perform fine-tuning with Causal Language-Moode Modeling (same objective as the pre-training (Radford al.) 2018)), which minimizes the next-token prediction loss over all tokens in each training example. In contrast, as TOFU+ structured 2018 Ouyang et al. y each QA pair is placed in predefined QA template, and the objective to minimize the loss only over the answer tokens. We use the Adam optimizer for all fine-tuning experiments and update all model parameters during fine-tuning. Please check more implementation details as well as the fine-tuning results in Appendix
QA format, we adopt supervised fine-tuning (Radford et al.
EXPERIMENT RESULTS
In this section, we empirically investigate the problems defined in Section 2 Since our focus is on how textual knowledge encodings the training data affect downstream unlearning, each study follows the same procedure: train LLMs under selected training modes (defined in Section 2 apply a fixed unlearning algorithm to the resulting models, and then evaluate unlcarning performance. Experiments conducted across two knowledge spaces (Eval-DU+ and TOFU+), three pre-trained

---

Published as a conference paper at ICLR 2026
Natre FT-Chunk Mul
Baseina FT-Chunk Nui
FT-Chunk Mul
MUI
Norm ALC
FT
FT
Single
TV-5
TVMM
GA-Single
TV-Single
(a) Lamma2-7B, Eval-DU+
Gemma2-2B. Eval-DU+
(c) Lamma2-7B, TOFU+
Figure 4: Empirical study for Problem 3 FT-Mul-Chi Chuu-Chunkk vs FT-Mul.
Nolve Basdine (KT)) (
Natre Bascline
Naive Baseinc
OU!
(KT)
Norm AUC
FT-Churk-Mul
Norm ADC
FT-chunko6d (igh))
6A Sinle
GA MJ
Tvikgl
MV
6A Single
G4 Mui
TV Single
Nul
GA Siglee
GA MJ
TV-kigk
TV Mui
(a) Lamma2-7B, Eval-DU+
(b) Gemma2-22 2B, Eval-DU+
(c) Lamma2-m2 7B, TOFU+
Figure 5: Empirical study for Problem FT-Mul-Chunk (Kalign) vs FT-Mul-Chunk (K (Kind).
LLMs (Llama2-7B, Gemma2-2B, and Qwen-4B), and two unlearning algorithms (GA and TV). We visualize the results in this section and present the original numbers in Table g in the appendix.
4.1 EMPIRICAL. STUDY I: THE EFFECT TEXT PARAPHRASING ON UNLFARNING
In this section, empirically study how paraphrased descriptions in the training dataset affect the difficulty unlearning (Problem D and Problem 2
Empirical study for Problem]] 1 To test whether having multiple paraphrased descriptions of the same knowledge piece makes it harder to remove, we compare unlearning performance across three training modes: FT-Single, FT-Unlearn-Mul, and FT-Retain-Min results. We find that models trained with
regurttr Figure reports the
exhibit consistently worse unlearning performance compared FT-Singles while models trained with FT-Reta n-Mul perform consistently better. From these results, we can now answer Problem I unlearning is most diffi- cult under the FT-Unlearn-Mul regime. The results suggest that difficulty depends on where paraphrasing occurs: 1. when knowledge pieces in the forget set Kut were presented with multiple paraphrased versions during, unlearning becomes harder; conversely, when knowledge pieces in the retain set are paraphrased, unlearning is more effective, since the model can better preserve non-targeted knowledge while removing the target set.
Empirical study for Problem 2 We next study whether paraphrasing the entire training corpus makes downstream unlearning more effective. To this end, we compare FT-S S ngle against FT-Mul, where every knowledge piece is encoded with multiple paraphrases. Figure 3 presents the results. Models trained with FT-Mul consistently achieve better unlearning performance than those trained with FT-Single. We therefore answer Problem models trained paraphrased corpora (FT-Mul) exhibit more effective unlearning. This provides empirical suggesting that the hypothesis that training on paraphrased descriptions encourages LLMs internalize knowledge in more structured manner (Allen-Zhu Li 2024), which benefits the subsequent unlearning process.
Takeaway. Together, these results highlight that paraphrasing influences unlearning: paraphrasing the forget set makes unlearning harder and symetrically paraphrasing the retain set makes it easier, and more interestingly, paraphrasing the entire corpus improves overall unlearning effectiveness.
4.2 EMPIRICAL STUDY II: THE UNLEARNING FROM TEXT CHUNKS
In this section, we examine the task of unlearning knowledge embedded within larger text chunks (Problem 3 Problem 4 and Problem 55.
Empirical study of Problem 3 We first evaluate the challenge of unlearning individual facts when their descriptions are entangled with other knowledge within larger chunks. To this end, train

---

Published as a conference paper at ICLR 2026
Baseins FT-Chunk Mul FT Chunk Mui isp
FT-Chunk Mui
FT-hhnk Nuliso
Sigle
5V/mgg
GA-Sing
TV-S
(a) Lamma2-7B, Eval-DU+
(b) Gemma2-2B, Eval-DU+
Figure 6: Empirical study for Problem FT-Mul-Chunk vs FT-Mul-Chunk-ISS
models under the FT-Mul-Chuns regime and measure unlearning performance. As shown in F we find that, except for the case GA with Llama2-7B on TOFU+, unlearning is almost entirely ineffective. A Norm-AUC value near 0.5 indicates that the unlearning algorithm removes both target and retained knowledge at similar rates; we plot the value of 0.5 in the dashed line as the baseline. This stands in sharp contrast to the results when each training sample encodes single knowledge piece such as MM,,, where AUC values are generally around or above 0.6, despite using the same knowledge space K and unlearning split Kut-
We can now answer Problem 3 unlearning individual facts from text chunks is exceptionally challenging. We hypothesize that this difficulty arises because the learning dynamics of target and retain knowledge are strongly correlated due to the entangled wording, making them hard to separate. Supporting evidence comes from Allen-Zhu & Li (2024), who show that when models with paraphrased paragraphs about set of knowledge pieces, for example a paragraph of biography, then single entity embedding (e.g., person's 's name the 'biography' example) can internally encode all associated facts. More supporting evidence is provided in Zhao et al. (2024), which also claims that unlearning is harder when the retain and forget sets are more entangled. The entanglement of the textual description in our case is specification in the LLM data.
trained
Empirical study of Problem 4 Next, we examine unlearning when the forget set aligns with chunk
boundaries. Specifically, we target Kaaiggn, where entire chunks are to be removed. Figure shows that unlearning performance on Kalign is consistently better than on the more granular K We can now answer Problem 4 unlearning chunk-aligned targets (Kalssn) more effective than unlearning granular targets (Krind) The likely explanation is similar to Problem 3 when forget and retain knowledge are less correlated (i.e., they do not co-occur within the same chunk), the unlearn-retain trade-off is easier to maintain.
Finally, we study whether unlearning becomes easier when indi- vidual facts are isolated inside a chunk. We train models with FT-Mul ISO, where each knowledge piece is expressed in a separate sentence. As shown in Figure 6 we observe that unlearn- ing individual targets Kind is substantially more effective under FT-Mul MMMul-Chunk-IIO compared to FT-Mul-Chhin Chunk. We more effective than from FT-Mul-Chund when targeting same individual facts. This rein- forces earlier hypothesis: isolating knowledge reduces correlation between forget and retain sets within the same chunk, making the unlearn-redt retain trade-off easier to preserve.
Empirical study of Problem [
answer Problem 5 unlearning from FT-Mul-Chunk-25
Takeaway. Across all three problems, our results show that text chunk structure plays decisive role in unlearning: when forget and retain knowledge are entangled within the same passage, unlearning individual facts is extremely difficult; aligning the forget set with chunk boundaries makes unlearning more effective; and further isolating individual facts within chunks provides the greatest gains.
5 DISCUSSION
We discuss several implications of empirical findings. First, results provide new perspective on interpreting unlearning performance that is orthogonal to algorithmic choices. In particular, they help explain discrepancies that arise in specific scenarios, such as the following:
1. Surprising algorithmic failures. If we find the unlearning algorithms all fail AUC* 0.5. Our results suggest this may not be due to algorithm weakness alone, but to the fact that the forget and retain sets are entangled in the same training text chunk.
8

---

Published as a conference paper at ICLR 2026
2. Variance across benchmarks. Suppose unlearning algorithm performs better on than the other. Without our lens, one might conclude that the second benchmark is just "harder." With our results, can explain why some benchmark is harder from the aspects of training data and the unlearn split. This shifts interpretation from "algorithmic deficiency" to "dataset structure effect."
3. Variance across models. Suppose we evaluate the same unlearning algorithm across different pre-trained models on a shared benchmark. One might observe that the algorithm performs better on one model than the other. Our work sheds light on this discrepancy: it can arise from differences in the models' pre-training corpora, even when both corpora might cover the same knowledge space.
Second, our findings point to potential learning-ting strategies for improving the post-hoe efficiency of unlearning in large language models.
1. Paraphrasing. Introducing multiple paraphrased descriptions of knowledge during fine-tuning appears to lead to more structured internal representations, which in turn make later unlearning more effective as well. Notably, Allen-Zhu & Li (2024) suggest that paraphrasing training data facilitates knowledge extraction: our work complements this by proposing that paraphrasing also enhances unlearning effectiveness.
2. Separating. Structuring training data so that knowledge likely to be subject to future unlearning requests is disentangled from retain knowledge This design reduces the correlation between forget and retain sets and enables cleaner unlearn-retain trade-off.
More broadly, these results highlight that unlearning is not solely a problem of algorithm design, but also of representation and data curation. Future work could explore how deliberately structure or augment training corpora to make future unlearning easier, and whether similar principles hold in multimodal tross-lingual settings.
6 RELATED WORK
Machine unlearning and training data. The most relevant research to ours is Zhao et al. (024)) which study machine unlearning the data level and show that forget sets with higher memorization or stronger entanglement with the retain set are more difficult to unlearn. While these observations resonate with our findings at a high level, our work focuses on knowledge unlearning in the context of LLMs. In particular, we analyze in detail how different training corpus designs influence memo- rization knowledge and how specific textual descriptions create varying degrees of entanglement between forget and retain sets. Fan et al. (2024) study worst-case forget sets in the context of data unlearning, while our work focuses on knowledge unlearning in large language models. Moreover, rather than analyzing only which forget set is chosen, we investigate how the format of the overall training corpus, including paraphrasing and chunk structure, affects the difficulty of unlearning. In parallel, Krishnan al. (2025) examine how the frequency of knowledge piece in the training corpus affects unlearning difficulty" Our work considers this factor as well (Problem []. but extends beyond their scope by studying frequency effects not only in the forget set, but also in the retain set and across the entire training corpus.
For more related work about algorithms and evaluations in machine unlearning for LLMs, we discuss them in details in Appendix
7 CONCLUSION AND FUTURE WORK
Conclusion. In summary, this work takes an initial step toward understanding how learning-time knowledge encoding influences post-hoc unlearning in large language models. Through controlled ex-
2This may seem paradoxical: if the unlearning target is known in advance, why not remove it before training? However, unlearning requests often arise after deployment, particularly when training data collected from public sources. For instance, some celebrities may not want L.IMs to retain family-related information from their Wikipedia pages, while others may prefer that it be preserved. Such preferences are difficult to anticipate at training time.
Our work independently conducted and concurrent with Krishnan al. 2025

---

Published as a conference paper at ICLR 2026
periments, show that how the training text paraphrasing can ainfluence forgetting and retention and how chunk structure determines whether individual facts can be removed effectively. Together, these findings offer new perspective for interpreting unlearning outcomes across models, benchmarks, and algorithms, and suggest practical strategies to improve the post-hoc efficiency of unlearning.
Limitations and future work. Although this paper focuses on the role of training data choices in unlearning, several other learning-tima factors may also influence unlearning effectiveness. These include the model architecture (e.g., full-parameter tuning LoRA (Hu et al. 2022) and the learning algorithm (e-g., supervised fine-tuning 2022)). A promising direction for future work is to systematically investigate how such factors impact the behavior and difficulty of unlearning. Another meaningful direction is understand the mechanism behind the findings in this paper: how do the difference encodings translate into unlearning performance? Thirdly, due limited computational resources, our experiments are restricted to LLMs that undergo fine-tuning. While we believe the findings presented in this paper may generalize to the pretraining stage and unlearning from pretrained models directly, validating this hypothesis remains an important avenue for future research when more resources are available.
reinforcement learning (Rafailov et al. 2023 Lu al.
REPRODUCIBILITY STATEMENT
We provide detailed dataset construction and implementation information in Appendix D and Ap- pendix E In addition, at the beginning of the Appendix, we include an anonymous link that enables reproduction of our main experimental results.
REFERENCES
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. https //eur- lex. europa su//li/reg//000 6/ 679//j] April 2016. Official Journal of the Huropean Union, I. 119, pp. 1-88.
Zeyuan Allen-Zhu and Yuanzhi Li. Physics of language models: Part 3.2, knowledge manipulation. In The Thirteenth International Conference on Learning Representations.
Zeyuan Allen-Zhu and Yuanzhi Li, Physics of language models: Part 3.1, knowledge storage and extraction. In International Conference on Machine Learning, pp. 1067-1077. PMLR, 2024.
Gicore-Octtavin Barbulescu and Peter Triantafillou. To each (textual sequence) its own: Improving memorized-data unlearning in large language models. arXiv preprint arXiv:2405.03007. 2024.
Clark Barrett, Brad Boyd, Elie Bursztein, Nicholas Carlini, Brad Chen, Jihye Choi, Amrita Roy Chowdhury, Mihai Christodorescu, Anupam Datta, Soheil Feizi, al. Identifying and mitigating the security risks of generative ai. Foundations and Trends in Privacy and Security, 6(1):1-52, 2023.
Yonatan Bisk, Rowan Zellers, Jianfeng Gao, Yejin Choi, al. Piqa: Reasoning about physical commonsense natural language. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 7432-7439, 2020.
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Chood Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. 2021 IEEE symposium on security and privacy (SP), pp. 141-159, IEEE, 2021.
Jan Bronec and Jindřich Helel. Atyaephyra at se0eval-2025 task 4: Low-rank npo. arXiv preprint arXiv:2503. 13690, 2025.
Minseok Choi, Daniel Rim, Dohyun Lee, and Jaegul Choo. Snap: Unlearning selective knowledge in large language models with negative instructions. arXiv preprint 12Xiv:2406.12329, 2024.
Guangyao Dou, Zheyuan Liu, Qing Lyu, Kaize Ding, and Eric Wong. Avoiding copyright infringe- ment via large language model unlearning. arXiv preprint arXiv:2406. 10952, 2024.
10

---

Published as a conference paper at ICLR 2026
Ronen Eldan and Mark Russinovich. Who's harry potter? approximate unlearning in llms, arXiv preprint wwXiv:2310.022.36 2023.
Chongyu Fan, Jiancheng Liu, Alfred Hero, and Sijia Liu. Challenging forgets: Unveiling the worst- case forget sets in machine unlearning. In European Conference on Computer Vision, pp. 278-297. Springer, 2024.
Phillip Guo, Aaquib Syed, Abhay Sheshadri, Aidan Ewart, and Gintare Karolina Dziugaite. Mecha- nistic unlearning: Robust knowledge unlearning and editing via mechanistic localization. arXiv preprint ar MXX1:2410.119444 2024.
Estrid He, Tabinda Sarwar, Ibrahim Khalil, Xun Yi, and Ke Wang. Deep contrastive unlearning for language models. arXiv preprint arXiv:2503. 14900, 2025.
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. In International Confer- ence Learning Representations, 2021. URL plttps::/openreeee
net/ forum?id=
d7KB (m 3CmQ.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang. Lu Wang, Weizhu Chen, al. Lora: Low-rank adaptation of large language models. ICLR, 1(2):3 2022.
Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. arXiv preprini arXiv:2212.04089, 2022.
Yoichi Ishibashi and Hidetoshi Shimodaira. Knowledge sanitization of large language models. arXiv preprint arXiv:2309. / /852, 2023.
Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Sco. Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504 2022.
Jiabao Ji. Yujian Liu, Yang Zhang, Gaowen Liu, Ramana Kompella, Sijia Liu, and Shiyu Chang. Reversing the forget-retain objectives: An efficient IIm unlearning framework from logit difference. Advances in Neural Information Processing Systems, 12581-12611, 2024.
Jinghan Jia, Yihua Zhang, Yimeng Zhang, Jiancheng Liu, Bharat Runwal, James Diffenderfer, Bhavya Kailkhura, and Sijia Liu. Soul: Unlocking the power of second-order optimization for 11m unlearning. arXiv preprini arXiv:2404. 18239, 2024.
Jinghan Jia, Jiancheng Liu, Yihua Zhang, Parikshit Ram, Nathalie Baracaldo, and Sijia Liu. Wa- gle: Strategic weight attribution for effective and modular unlearning in large language models. Advances in Neural Information Processing Systems, 37:55620-55644 2025.
Zhuoran Jin, Pengfei Cao, Chenhao Wang, Zhitao He, Hongbang Yuan, Jiachun Li, Yubo Chen, Kang Liu, and Jun Zhao. RWKU: Benchmarking real-world knowledge unlearning for large language models. In The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2024. URL htttpp:://ppereveiie
net Forum w 5F gMH
Aravind Krishnan, Siva Reddy, and Marius Mosbach. Not all data are unlearned equally. In Second Conference on Language Modeling, 2025. htt.l:ttp//cccccm http:/:///ppeeeeee..ooo net.:/iwwwwweeeeeeeeeeeeeeeeeeee www.:eneetffooreeeeee forum? idd
kd971fFfTu
Guokun Lai, Qizhe Xie, Hanxiao Liu, Yiming Yang, and Eduard Hovy. RACE:
Large-scale ReAding comprehension dataset from examinations. In Martha Palmer, Rebecca Hwa, and Sebastian Riedel (eds.), Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing. pp. 785-794, Copenhagen. Denmark, September 2017. Association for Computational Linguistics. doi: 10.18653/1//DD7-10038 URL htt.t:tttt://c... antho ogy. wwt.ooggg//o... 1082/
Yicheng Lang, Kehan Guo, Yue Huang, Yujun Zhou, Haomin Zhuang, Tianyu Yang, Yao Su, and Xiangliang Zhang. Beyond single-value metrics: Evaluating and enhancing 1lm unlearning with cognitive diagnosis. arXiv preprint arXiv:2502. 13996, 2025.

---

Published as a conference paper at ICLR 2026
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The wmdp benchmark: Measuring and reducing malicious with unlearning. arXiv preprint arXiv:2403.03218. 2024.
Bo Liu, Qiang Liu, and Peter Stone. Continual learning and private unlearning. In Conference on Lifelong Learning Agents, pp. 243-254. PMLR, 2022.
Chris Liu, Yaxuan Wang, Jeffrey Flanigan, and Yang Liu. Large language model unlearning via embedding-coree corrupted prompts. Advances in Neural Information Processing Systems, 37:1 18198- 118266, 2024a.
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, et al. Rethinking machine unlearning for large language models. Nature Machine Intelligence, pp. 1-14, 2025.
Yujian Liu, Yang Zhang, Tommi Jaakkola, and Shiyu Chang. Revisiting who's harry potter: Towards targeted unlearning from causal intervention perspective. arXiv preprint vrXiv:2407.1699) 2024b.
Ximing Lu, Sean Welleck, Jack Hessel, Liwei Jiang, Lianhui Qin, Peter West, Prithviraj Am-
manabrolu, and Yejin Choi. Quark: Controllable text generation with reinforced unlearning. Advances in neural information processing systems, 35:27591-27609, 2022.
Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan HadfieldMMenell. Eight methods evaluate robust unlearning 1lms. arXiv preprint arXiv:2402. 16835, 2024.
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J Zico Kolter. Tofu: A task of fictitious unlearning for 1lms. In First Conference on Language Modeling.
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in gpt. Advances in neural information processing systems, 35:17359- 2022.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:27730- 27744, 2022.
Vaidehi Patil, Peter Hase, and Mohit Bansal. Can sensitive information be deleted from llms? objectives for defending against extraction attacks. In The Twelfth International Conference on Learning Representations.
Martin Pawelczyk. Seth Neel, and Himabindu Lakkaraju. In-context unlearning: Language models as few shot unlearners. arXiv preprint arXiv:2310.07579, 2023.
Alec Radford, Karthik Narasimhan, Tim Salimans, Ilya Sutskever, et al. Improving language understanding by generative pre-training. 2018.
Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly reward model. Advances in Neural Information Processing Systems, 36:53728 53741, 2023.
Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah Smith, and Chiyuan Zhang. Muse: Machine unlearning six-way evaluation for language models. arXiv preprint 24x.v:2007.06600 2024.
Nianwen Si, Hao Zhang. Heyu Chang, Wenlin Zhang. Dan Qu, and Weiqiang Zhang. Knowledge unlearning for llms: Tasks, methods, and challenges. arXiv preprint 15566 2023.
Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, et al. Gemma 2: Improving open language models at practical size. arXiv preprint 40X.0:2408.00118, 2024.
12

---

Published as a conference paper at ICLR 2026
Pratiksha Thaker, Shengyuan Hu, Neil Kale, Yash Maurya, Zhiwei Steven Wu, and Virginia Smith. Position: Llm unlearning benchmarks are weak measures of progress. arXiv preprint arXiv:2410.02879, 2024a.
Pratiksha Thaker, Yash Maurya, Shengyuan Hu, Zhiwei Steven Wu, and Virginia Smith. Guardrail baselines for unlearning in 1lms. arXiv preprint arXiv:2403.03322, 2024b.
Bozhong Tian, Xiaozhuan Liang, Siyuan Cheng, Qingbin Liu, Mengru Wang, Dianbo Sui, Xi Chen, Huajun Chen, and Ningyu Zhang. To forget or not? towards practical knowledge unlearning for large language models. In Findings of the Association for Computational Linguistics: EMNLP 2024, pp. 1524-1537, 2024.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Ilama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023.
Nikhil Vyas, Sham M Kakade, and Boaz Barak. On provable copyright protection for generative models. In International conference on machine learning, pp. 35277-35299, PMLR, 2023.
Qizhou Wang, Bo Han, Puning Yang. Jianing Zhu, Tongliang Liu, and Masashi Sugiyama. Unlearning with control: Assessing real-world utility for large language model unlearning, arXiv preprint vrXiv:2406.09177 2024a.
Wenyu Wang, Mengqi Zhang, Xiaotian Ye, Zhaochun Ren, Zhumin Chen, and Pengjie Ren. Uipe: Enhancing I1m unlearning by removing knowledge related to forgetting targets. arXiv preprint arXiv:2503.04663, 2025.
Yu Wang, Ruihan Wu, Zexue He, Xiusi Chen, and Julian McAuley, Large scale knowledge washing. arXiv preprint ar0. /6720, 2024b.
Ruihan Wu, Chhavi Yadav, Russ Salakhutdinov, and Kamalika Chaudhuri. Evaluating deep unlearning in large language models. arXiv preprint arXiv:2410.151/ 2024.
Xinwei Wu, Junzhuo Li, Minghui Xu, Weilong Dong, Shuangzhi Wu, Chao Bian, and Deyi Xiong. Depn: Detecting and editing privacy neurons in pretrained language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 2875 2886, 2023.
Zhaopan Xu, Pengfei Zhou, Weidong Tang, Jiaxin Ai, Wangbo Zhao, Xiaojiang Peng, Kai Wang, Yang You, Wenqi Shao, Hongxun Yao, al. Pebench: fictitious dataset benchmark machine unlearning for multimodal large language models. arXiv preprint arXiv: 15544 2025.
An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv22505.09388, 2025.
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. Machine unlearning pre-trained large language models. arXiv preprint arXiv:2402. 15159, 2024a.
Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning. Advances in Neural Information Processing Systems, 37:105525-105475 2024b.
Charles Yu, Sullam Jeoung, Anish Kasi, Pengfei Yu, and Heng Ji. Unlearning bias in language models by partitioning gradients. Findings of the Association for Computational Linguistics: ACL 2023, pp. 6032-6048. 2023.
Hongbang Yuan, Zhuoran Jin, Pengfei Cao, Yubo Chen, Kang Liu, and Jun Zhao. Towards robust knowledge unlearning: An adversarial framework for assessing and improving unlearning robust- ness in large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 257777 2025.
Jinghan Zhang, Junteng Liu, Junxian He, et al. Composing parameter-efficieet modules with arithmetic operation. Advances in Neural Information Processing Systems, 36: 1-s1129926111 12610, 2023.
13

---

Published as a conference paper at ICLR 2026
Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. Negative preference optimization: From catastrophic collapse to effective unlearning. In First Conference on Language Modeling.
Kairan Zhao, Meghdad Kurmanji, George-Oetavinn Bărbulescu, Eleni Triantafillou, and Peter Tri- antafillou. What makes unlearning hard and what to do about Advances in Neural Information Processing Systems, 37:12293-12333, 2024.
14

---

Published as a conference paper at ICLR 2026
A ORGANIZATION OF THE APPENDIX
The organization of this appendix as below:
1. In Section B discuss the usage of L.MSs in this work.
2. In Section we discuss some additional related work in the direction of L.M unlearning.
3. In Section D
we present the details of constructing benchmark datasets Eval-DU+ and TOFU+ including the detailed statistics of paraphrasing, the templates for generating the synthetic texts, and an illustration of calculating the knowledge score prbability in Eval-DU+.
4. In Section H we will present the implementation details in our experiments, including the compute resources used the epxeriments, the details model fine-tuning, and the details of the unlearning.
5. In Section we will present additional experimental results, including the performance of fine-tuned models on LLM general benchmarks, the full unlearning results, and the full plots of trade-off curves used for calculating the Norm-AUC.
Our code for reproducing the results is anonymously released settpss:/annnymouss 4open Lileenceee/aowweeddeeeeeeoooooo
for 1mm unlearning 62BB README md
B THE USE OF LLMS
We employ large language models (LLMs) primarily to improve the grammar and clarity of our writing. In addition, the synthetic datasets used in our controlled experiments are constructed by prompting LLMs. All research ideas, directions, and decisions, however, are independently conceived and carried out by the authors.
C ADDITIONAL RELATED WORK
Machine unlearning for LLMs: algorithms. Recently, machine unlearning for LLMS has emerged
as an important area of research| Liu et al. (2025); Si et al. (2023). In this work, we focus on GA Jang
al. (2022); Barbulescu Triantafillou 2024) and TV (task vector) Ilharco al. (2022) methods. Other notable approaches include: NPO Zhang et al. Bronec & Helel (025) which utilizes the DPO objective Rafailvv al. (2023) treating the unlearn data as negative preference data, WHP uses linear combination of the distributions induced by initial and a reinforced model as an unlearn model
Eldan & Russinovich| (2023); y [iu al. (2024b), UWC calibrates the post-unlearning parameters with the initial parameters to better preserve the model's utility Wang et al. (2024a), GRU uses both the unlearning and retention gradients at each update step Wang et al. (2024a). Regularizers are often employed to better preserve the model's utility. For example: augementing the unlearning objective with the retention gradient (GDR) Maini et al.) Zhang et al.] Liu et al. (2022) and regularizing with the KI. divergence the retention set (KLR) Maini et al. /hhag al. Non-training based methods
include: Docalizationiinfomme
unlearning Li et al. (2024); Meng et al. 2002)); Wu et al. (2023) which localize the components of the LLM related the forget data and black-box in-context unlearning
Pawelczyk et al. (2023). Other recent promising approaches are Jia et al. (2024); Liu et al. (2024a);
al. (2024); Wang et (2024b): Ishibashi Ishibasii & Shimodairal (2023) Thaker et (2024b); Wang et al.
(2025)
He et al. (2025).
Machine unlearning for LLMs: evaluations. Evaluating the effectiveness machine unlearning method poses another challenge. As an example, Eldan & Russinovich (2023) uses completion and question-answer probability-base scores, while Lynch et al. (2024) proposes comparing the unlearned model and model retrained on the retention data. UNCD uses Cognitive Diagnosis Modeling for fine-grained evaluation Lang et al. (2255.. Besides TOFU (Maini et al.) and Eval- DU (Wu al. (2024)), several other benchmarks have been proposed assess the effectiveness of unlearning in LLMs such as: WMDP a dataset consisting of hazardous knowledge in multiple-choice format Li et al. (2024) and RWKU for zero-shot konwledge unlearning Jin et al. (2024), MUSE proposes a comprehensive benchmark evaluating six desirable properties from the perspectives of both data owners and model deployers Shi et al. (2024), and PEBench for multimodal I.I.Ms Xu et al.
15

---

Published as a conference paper at ICLR 2026
(2025) Finally, Thaker et al. (0244) discusses the limitations of existing benchmarks. Beyond this it shows that entanglement of retain and unlearn data test prompts decreases the evaluation score of an unlearned model.
D DETAILS OF CONSTRUCTING BENCHMARK DATASETS
Detailed statistics of paraphrasing. We present the statistics of the paraphrasing and how they are used for training. unlearning and evaluation in both datasets Eval-DU+ and TOFU+:
paraphrasing for each & Unlearning
Dataset
paraphrasing of text chunks
Training
Evaluation
Eval-DU+
3
3
TOFU+
3
3
3
Templates for the prompt when generating the texts through ChatGPT-4o. Here are the templates of how generate the paraphrased descriptions for each knowledge piece given the initial texts provided by each original dataset and the paraphrased text chunks for each group of knowledge.
Templates of generating the paraphrased descriptions for each knowledge piece
Eval-DU+
Could you help rephrase the sentence (Initial Text} while keeping the word [Objective Word}? Please give me variations.
TOFU+
Could you help rephrase both the question and the answer below? Question: [Intial Question]
Answer: (Intial Answer) Please give me 7 variations and list them sequence of QAs, formated by 1., 2., .... 7.
16

---

Published as a conference paper at ICLR 2026
Templates of generating the paraphrased text chunks for each knowledge group
Eval-DU+
Here are the family information and biographic information for (Person Name). Could you summarize all information in one paragraph and give me 5 versions of them by shuffling the order of these information:
(Text Description of the 1st Knowledge Piece]
Please list the versions by 1., 2.,
TOFU+
Could you help summarize all information in the following 20 question-answering into one questien-ance answer pair?
1.
Question: fist Question]
Answer: {1st Answer)
Please give Please response in the format
variations and do not miss any information.
Variation 1:
Question 1:...
Answer 1:...
After collecting the responses from ChatGPT-40, we did some text extractions in order get organized list of target paraphrased texts.
Calculating knowledge scores in Eval-DU+ and TOFU+. In TOFU+, where Ty is QA pair, we adopt the "Probability" metric from the original TOFU benchmark: given question embedded in prompt template, the score is the likelihood the LLM assigns to generating the reference answer. In Eval-DU+, each æy is narrative sentence. Notice that each knowledge piece has the structure tuple of (s, o). We are able to identify the keywords for I, or o in given text description. For example, here is text description for (Richard farye, Reid Perry) and we highlight the corresponding keywords.
Reid Perry has Richard Perry as his father.
Then, we can caleulate the likelihood of the keyword appearing the last this sentence, which is father, for a given LLM which modelizes the likelihood function TT.
The definition of the text chunk in Eval-DU+ and TOFU+. The knowledge space of Eval-DU+ partitioned by the subjects (person) in the factual tuple. The knowledge space of TOFU+ is partitioned by the fictitious authors. We then synthetically generate the text chunk for each partition the details are presented in the above paragraph.
Aineaar--reaale split in Eval-DU+ and TOFU+. (and the corresponding Kind) by randomly selecting 100 out of 862 knowledge pieces, with the remaining pieces forming the retain set. For the setting of chunk-aligned unlearning, Kalign is defined as all facts associated with randomly chosen fictitious people.
In Eval-DU+, construct the unlearn set Kut
In TOFU+, the retain set consists of 400 QAs randomly sampled from the first 198 authors. To construct Kat (and Kind),, randomly select 40 QAs from the same pool of authors. For K Kalign we adopt the original unlearn retain split of the TOFU dataset, which contains 40 knowledge pieces associated with 2 out of the 200 authors.
17

---

Published as a conference paper at ICLR 2026
Recain Score
FT-Single FT-Mul
Sinigee
FT-Mul
08
53 03
Unleam Score
Unleam Score
Figure 7: Illustrations for Norm-AUC. Left: Raw (unnormalized) trade-off curves. Right: Normalized curves used to compute Norm-AUC. All plots show the unlearning with GA. The dataset Eval-DU+ and the target Llama2-77 - models are fine-tuned with either FT-Single or FT-
E ADDITIONAL DETAILS IN EXPERIMENTS
Compute resources in the experiment. All experiments are conducted by NVIDIA RTX 6000 Ada GPU. Each run the fine-tuning and the unlearning run on two GPUs. The fine-tuning will take 6-12 hours, and each run of the unlearning process well as the evaluation will take will take 4-8 hours; the time varies on different models.
Quantitative metrics for evaluating the trade-off: Norm-AUC and AUC. To evaluate the unlearn-retain trade-off for an unlearning method, we vary the parameter controlling the trade- off (e.g. / in GA and in TV) across list of pre-defined values. For each parameter value obtain a model checkpoint, whose unlearn and retain scores we compute. These scores are plotted to form trade-off curve (Figure 7). where curves closer the top-left indicate more favorable trade-off.
When comparing different fine-tuning strategies under a fixed unlearning configuration (i.e., using the same unlearning data and algorithm). the trade-off curves may start at different points due to the different tne-tuned models. For instance, models fine-tuned with FT-Mul typically achieve higher initial knowledge scores. To account for this define the Norm-AUC (t). This metric first normalizes all knowledge scores by their value in the original fine-tuned model and then computes the area under the normalized curve (Figure 7 middle). A higher Norm-AUC indicates a more efficient unlearning and a Norm-AUG of 0.5 implies that unlearn and retain scores are decreasing at the same rate.
Fine-tuning details. The batch sizes are 16 for all models fine-tuned on Eval-DU+ and 32 for the model fine-tuned on TOFU+ In addition, we pick the learning rate (2- 10-5 10-5 2 10-6) and the number of epochs N (1,... 88 ensure good fit on the fine-tuning set while having good test performance. The final selection of the two parameters are presented in Table [[]
Table 1: Hyperparameter values of the fine-tuning on different models and datasets: the learning rate 7 and the number of epochs N
Llama2-78 7B, Eval-DU+
Gemma2-2B Eval-DU+
Llama2-7B TOFU+
N
N
N
PT-Single
10 5
5
10
5
8
10 5
F1-
10
10
8
10
FT-Retain-Mu
10
5
10
5
8
10
5
FT-Mul
10
5
10
8
10
FT-Mul-Chunk
10
4
10-5
8
10-5
4
FT-Mal-Chunk-Iss
10-3
4
10-5
8
10-5
4
Unlearning details. We present the hyperparameter details for ach unlearning algorithm: gradient ascent (GA) has list of step numbers to control the trade-off and the learning rate 7ga (the batch sizes are fixed as 8 for Eval-DU+ and 16 for TOFU+), task vector (TV) has list of scaling parameter values to control the trade-off, as well the number of epoch Tr.. and the learning rate The
18

---

Published as a conference paper at ICLR 2026
train the reinforced model (the batch sizes are fixed 16 for Eval-DU+ and 32 for TOFU+). The values are picked to best present the trade-off. Their values given different fine-tuning data choices presented as below:
Table 2: Hyperparameter values of GA-Single,
Llama2-7B. Eval-DU+
Gemmaa-22 Eval-DU+
Llama2-7B, TOFU+
List of
Nge
List
Ogo
List of
feo
FT-Single
[0,5, 10, 75)
10-6
10,5,10,"* 10, .. 76)
3 x 10-6
[0,5, 1.. 75)
3x 10-6
PT-Mu1
[0,5, 10,...
75)
10
[0,5, 10,....................
10
[0,5, 10, .7)
6
FT FT--mneerrn-Mu
[0,5. 10, 75)
3 10
(0,5,10,"" 75)
3x 10
10,5,10...
3 10
#T-Retain-Wo Xul
(0,5, 10, 75)
3 10-
[0,5, 10,10.... -. 75)
3x 10-6
[0,5, 10, 10......... .75)
3 10-6
PT PT-Mo1-Chunk
{0.5, 10, ... 75)
3 10
[0.5, 10, 76)
3 x 10
(0.5, 10,
......... 75)
10-6
FT-M::1Chunk 180
[0,5, 10, :, 75)
3 10
[0,5, 10, 75)
3 x 10
(0,5, 10,
75)
10
Table 3: Hyperparameter values of GA-Mul.
Llama2-7B 7B. Eval-DU+
Gemma2-2B. Eval-DU+
Llama2-7B. TOFC+
List of
Nly
List
Agn
of
FT ST-Single
{0.5, 10,... 75)
x 10-6
(0,5, 10,... .7)
3 x 10-0
(0.5, 10. 77)
3x 10-0
PT-Mul
{0,5, 10, 75)
3 10-6
(0.5, 10,... 1.....77 .75
3 x 10-6
(0,5, 10, .... 75)
3 10-0
FT UT-Unlearn-- Mul
[0,5, 10..... ...... 75)
3 10-6
10,5,10,... .0,1,, 75)
3 10-6
(0,5, 10, ................................ .77) 75)
3 10-6
FT 17-Retain-Xuu
(0,5, 10, 76)
3 10-6
10,5,10,.-. 10.00....... 755)
3 10-6
(0,5, 10, 75))
3 10-0
FT-Mul-Chure
(0,5, 10,.... 75)
3 10-6
(0,5, 10................... 755)
3 10-6
{0,5, 10..-- 75)
10-6
FT-M:1-Chor
(0,5, 10. 75)
3 10-6
(0,5,10, .75)
3 10-0
[0,5, 10,
75)
10-6
Table 4: Hyperparameter values of TV-Single
Limmz--0 bsa--UU+
Gemmaz: 201, boalDU-+
Llama2-85, TOPU+
Lis u
N1.
Lis of
Nr.
Ye-
Liscef
N:.
PI-Singic
[0.02,05, 10, 5.0. 1000
20
10-6
1...2.05.11.... 1000
20
10-5
[0,0,05 O.1. 0.2,0.0.33. 044
L. 10.0)
20
10-1
FT-Hul
(0.02,00,100 10,500 190)
20
(..02.055 S.O. 190)
20
10
00,000, 0.1.0.2 033, 0-4
1.0
10.0)
20
10
Fi-uniesse--uul
[0.62,005,10 10,
180)
20
(0.62,0.5 5. 100)
20
10
(0.0.05 6.1 0.2 0.8 0
1.1.1.55
30.0)
20
10
#1-Ratain-Hul
[0.02,005, 1,000,1,........ 5. 180)
20
10-5
(0.02,0.5 5.O. 100)
20
10-5
(0.0.85 6.1 0.2 0.5 04
5. 10.0)
20
10-3
FT Chhnkk
[0.02,00 5, 5.0 1001
20
10-5
(0.02,055 1 5.0. 100)
20
10-5
10, 0.2. 0.5. 1.0, 160,
30.0
300,
500)
100
10-3
2T Mal Chank 150
[0.0.2005,
10, (...1000) 100)
20
10-5
(0.02,0. 10, 5.0 100)
20
10-5
10, 0.5. 0,0.0, 100, 20.0
3600
5000
400
10-3
Table 5: Hyperparameter values of TV-Mul.
Liamaz-11,, Esai-DU+
Gemmaz 201, boal-UU+
Llama2-78,, TOFU+
List a
N,.
%
List a
N,,
%
List of
N..
Rix
PI-Singic
[0.022005,1 10,0,,0,,.00 5.0.
1000]
20
10-5
1.0.5. 10.0]
20
10-5
[0.0,00 0.1. 0220033,00
0-4 0.5. L.S.1.0......0 10.0)
20
10-3
FI-Ihicarn-Hul
(0.022005,
1., 5,5.00 180)
20
10-5
(0.02,00.1100 1,0,1,00,000 5.0. 1900
20
10-5
[0.0000 0.1.0.2..... 0.2.0.333
04400 0.5, L.0
10.0)
20
10r-
FT-Recain-Hul
(0.02.005
5.0. 180)
20
(0.02200.5
198)
20
10
(0.0000
0.1.0.2. 03, 0 0.3
10.0)
20
10
#1-Hul
(0.022.05,11
6.5. 180)
20
10
(0.02,0.5,
100)
20
10
(0.0.05,
6.1 0.2 0.2.0... 04
0.5. 5.8.8. 10.0)
20
10
r2-sui-Cheak
[0.0.2,05,,1..
1.0.0,1,..000000 5.0 180)
20
10-5
(0.02,0.5 1.0, 5.0. 100)
20
10-5
(0,
L.0, 5.0,
10.0.
20.0
30.0
500)
400
10-3
2T Mal Chank 150
[0.0.2,05,
5.0 5.0.1000 100)
20
10-5
(0.02,055, 10, 5.0, 100)
20
10-5
(0,0220..5
0.5. 5.0 10.0
20.0
360,
5000
400
10-3
F ADDITIONAL RESULTS
Performance of fine-tuned models. We first ensure that each model achieves a near-perfect fit on its fine-tuning data Table 6 shows the probabilities among fine-tuning set or the unseen test set. We additionally evaluate general utility on three standard L.M benchmarks: MMLU (Hendrycks) et al. ( for multi-domain language understanding, PIQA (Bisk et al.) 2020) for commonsense reasoning, and RACE (Lai et al. 2017) for reading comprehension. The results are presented in Table We observe that fine-tuning does not significantly degrade performance on these general tasks, confirming that the models retain broad capabilities.
Full tables of all unlearning results. We summarize all unlearning results in Table for complete- ness and easier comparison and results reproducing for the future work.
Full plots of trade-off curves. For completion, we attach the full trade-ofi off curves for calculating Norm-AUC.
19

---

Published as a conference paper at ICLR 2026
Table 6: Average knowledge scores among finetuning set (FT Probs.) or unseen test set (Test Probs.).
Llama2-7B, +val-DU+
Gemma2-2B, Eval-DU+
Llama2-7B, TOFU+
FT Probs.
Test Probs.
FT Probs.
Test Probs.
FT Probs.
Test Probs.
FT-Single FT-Mul
0.95
0.47
0.97
0.39
0.99 0.99
0.12
0.92
0.68
0.95
0.61
0.16
Table 7: Pretrained and finetuned LLMs on three general utility benchmarks.
LLM & Dataset
Llama2-7B
Eval-DU+ PIQA
Gemma2-28 MMLU
Eval-DU+ RACE
Llama2-7B
TOFU+
Metrie
MMLU
RACE
PIQA
MMLU
PIQA
RACE
Pre-train
0.400
0.778
0.396
0.496
0.791
0.373
0.400
0.778
0.396
FT-Single
0.383
0.775
0.398
0.496
0.798
0.380
0.335
0.758
0.398
FT-Mul
0.368
0.782
0.392
0.486
0.792
0.365
0.332
0.773
0.402
Table 8: This summarize the Norm-AUC of all unlearning results differnet setting of unlearning across two datasets and two models.
Model, Dataset
Gradient Ascent
Task Vector
FT Choices
GA -a-ningle
GA-Mi 1h-MMal
TV-Single
TV-Mul
Llama2-7B, Eval-DU+
FT-Single
0.62
0.63
0.62
0.69
FT-Unleazn-Mul
0.56
0.58
0.60
0.65
FT-Retain-Mul
0.62
0.64
0.64
0.71
FT-Mul
0.63
0.64
0.62
0.72
FT-Chunk-Mu1
0.50
0.49
0.55
0.56
FT-Chunk-Mui (align)
0.56
0.55
0.57
0.59
FT-Chunk-Mul-ISO
0.61
0.60
0.64
0.69
Gemma2-2B, Eval-DU+
FT-Single
0.57
0.61
0.59
0.66
FT-Unlearn Mul
0.52
0.54
0.56
0.60
FT-Retain-Mul
0.69
0.67
0.65
0.70
FT-Mul
0.63
0.65
0.65
0.67
FT-Chunk-Man
0.47
0.45
0.48
0.52
PT-Chunk-Mul (align)
0.55
0.56
0.55
0.56
FT-Chunk-Mul-ISS
0.57
0.57
0.59
0.61
Llama2-7B, TOFU+
FT-Single
0.59
0.59
0.59
0.59
FT-UnJearn-Mul
0.58
0.58
0.58
0.58
FT- -T-Retain-Mul
0.64
0.65
0.62
0.63
FT-Mul
0.63
0.64
0.64
0.65
PT-Chunk-Mul
0.58
0.58
0.50
0.51
FT-Chunk-Mui (align)
0.60
0.60
0.59
0.59
For the results in Section 4.1
the extraction trade-off plots for (Llama2-7B, Eval-DU+), and (Llama2-
7B, TOFU+) are in Figure 8
9 respectively;
For the results in Section
4.2 the extraction trade-off plots for (Llama2-7B, Eval-DU+), and (Llama2- respectively.
7B, TOFU+) are in Figure
12
13
G ADDITIONAL EXPERIMENTAL RESULTS
G.1 EXPERIMENTS WITH THE QWEN3-4B
We additionally conducted all of designed experiments using recent model from different
open-source family. Qwen3-4B, evaluated on two datasets. The results for Problem [ Problem 2 Problem Problem 4 and Problem are shown in Figure 14 Figure 15 Figure 16
Figure 17 and
20

---

Published as a conference paper at ICLR 2026
Retain Score
FT-Single
FT-Single
FT.Mul
FT-Mul
e--Unleam-Mul
FT-Unlear-MMul
02
FT-Retain Mul
FT-Retain-Mu
(a) GA-Singie
(b) CA-Mu1
Relain Score
FT-Single
FT-Single
FT-Mul
FT-Mul
FT-Unleam-Mul
FT-Unleam-Mul
Unlearn Score
Unlearn Score
(c) TV-Single
(d) TV-Mul
Figure 8: Vanilla trade-off curves for three choices of unlearning data and two unlearning algorithms on Eval-DU+ and Llama2-7B, when comparing TT-Mul and FT Single
Retain Score
FT-Single
FT-Single
FT-Mul
FT-Mul
00
FT-Unleam-Mu FT-Retain-Mul
FT-Unleam-Mu
FT-Retain-Mul
65
32
60
85
Unleam Score
Unleam Score
(a) GA-Single
(b) GA-Mul
Retain Score
FT-Single
FT-Single
FT-Mul
FT-Mul
FT-Unleam-Mul
FT-Unleam-Mu
FT-Retain Mul
FT-Retain Mul
6
6
95
Unleam Score
Unleam Score
(c) TV-Single
(d) TV-Mul
Figure 9: Vanilla trade-off curves for three choices of unlearning data and two unlearning algorithms on Eval-DU+ and Gemma2-2B, when comparing FT-Mul and FT-Single
Figure 18 respectively. Across all settings, the results with Qwen3-4B remain consistent with all observations of other models in the main paper used answer the five problems. These additional results further strengthen the evidence that our conclusions generalize robustly a broader range of models.
21

---

Published as a conference paper at ICLR 2026
114
214
Retain Score
FT-Single
FT-Single
FT-Mul
FT-Mul
FT-Unleam-Mul FT-Retain-Mul
FT-Unleam-Mul
FT-Retain-Mul
190
zis sis
0bs cb
Unlearn Score
Unlearn Score
(a) GA-Single
(b) GA-Mul
Retain Score
FT-Single
FT-Single
6.0
FT-Mul
FT-Mul
Unleamm Mul
tac
Unleamm Mul
FT-Retain Mul
FT-Retain Mul
asx car tis
an
650
oss can
Score
(c) TV-Single
(d) TV-Mul
Figure 10: Vanilla extraction trade-off curves for three choices of unlearning data and two unlearning algorithms on TOFU+ and Llama2-7B, when comparing MT-Mul and FT-Single
Retain Score
TT-Mul-Chunk
FT-Mul- Chunk
FT-Mul-Chunk (align)
FT-Mul-Chunk (align)
T.Mul-Chunkklee
FT-Mul Csu
(a) GA-Single
(b) GA-Mul
05
Relain
FT-Mul-Chunk
FT-Mul-Chume
FT-Mul-Chunk (align)
FT-Mul-Chune (align)
FT-Mul- FT-Mul-Chunk-oo Csunk-Iso
FT-Mul Chunk-Iso
81
da
d
Unleam Score
Unleam Score
(c) TV-Single
(d) TV-Mul
Figure 11: Vanilla trade-off curves for three choices of unlearning data and unlearning algorithms on Eval-DU+ and Llama2-7B, when the model is fine-tuned from any text chunks.
G.2 EVALUATE WITH AWARE UNLFARNING METHODS GRADIENT DESCENT
We additionally evaluate our framework using another retain -warre unlcarning method, Gradient Difference. This method performs unlearning by ascending the loss the forget dataset while simultaneously descending the loss on the retain dataset. The retain dataset here consists of all textual descriptions associated with the retain knowledge.
The results for Problem Problem 2 Problem 3
Problem 4 and Problem 5 are shown Figure Figure 22 and Figure 23 respectively. Across all settings, the results from
19
Figure 20
Figure 21
22

---

Published as a conference paper at ICLR 2026
04
Retain Score
FT-Mul-Chume Chull-hunk
FT-Mull FT-Mul-Chunk Chunk
FT-Mul-Chunk (align)
FT-Mul-Chunk (align)
FT-Mul-Chunk-tso
FT-Mul-Chunk-lso
Unleam
(a) (GA-Singl
(b) GA-MMll
05
Retain Score
FT-Mul-Chunk
FT-Mul-Chunk
Relain
FT-Mul-Chunk (align)
FT-Mul-Chunk (align)
FT-Mul-Chunk.lso
FT-Mul- Chunk-iso
Unlear
(c) TV-Single
(d) TV-Mu1
Figure 12: Vanilla extraction trade-off curves for three choices of unlearning data and two unlearning algorithms on Eval-DU+ and Gemma2-2b, when the model is fine-tuned from any text chunks.
$.1%
Retain Score
2130-
ET-Muu-Chunk (align) FT-Mul-Chunk
FT FT-Mul Chunk (align) FT-Mul-Chunk
1.00
100
sis 0.0
a 6.0
Unleam
Unleam Score
(a) GA-Sii igge
(b) GA-Mul
Retain Score
0.000
2.30
Retain
8.00
8.00
FT-Mul- Chunk (align)
FT Mul Cuunk (align)
FT Mul Chunk
FT Mul Chunk
sis
Unleam Score
680
(c) TV-Single
(d) TV-Mul
Figure 13: Vanilla trade-off curves for three choices of unlearning data and two unlearning algorithms on TOFU+ and Llama2-7B, when the model is finettund from any text chunks.
Gradient Difference remain consistent with all observations of other unlearning methods in the main paper used answer the five problems. These additional results further demonstrate that that our conclusions are applied to range of unlearing methods.
G.3 EVALUATE WITH THE ADDITIONAL METRIC
We additionally evaluate all unlearning methods using alternative metric, Retain @ Unlearn which measures the retain score at the point where the unleam score has been suppressed to a small target level This metric complements AUC-hased evaluations by providing absolute, threshold-
23

---

Published as a conference paper at ICLR 2026
FT-Unleam-Mul
FT-Unlearn-Mul
FT-Single
FT-Single
FT-Retain-Mul
FT-Retain-Mul
Norm-AUC
Norm-AUC
GA-Single
GA-Mul
TV-Single
TV-Mul
GA-Single
GA-Mul
TV-Single
TV-Mul
Qwen3-4B, Eval-DU+
(b) Qwen3-4B, TOFU+
Figure 14: Empirical study for Problem on Qwen3-4B across two datasets: FT-Single vs FT-
Unlearn- Mull FT-Retain-Mul.
FT-Single
FT-Single
FT-Mul
FT-Mul
Norn-AUc
Norm-AUc
Gi-Single
GA-Mul
TV-Single
TV-Mul
GA-Single
GA-Mul
TV-Single
TV-Mul
(a) Qwen3-4B, Eval-DU+
(b) Qwen3-4B, TOFU+
Figure 15: Empirical study for Problem 2 on Qwen3-4B across two datasets: FT-Single FT-Mul.
based view of the unleamingg-retiniig trade-off. The results for Problem Problem 2 Problem 3
Problem 4 and Problem 5 are presented in Figure 24 Figure 25 Figure 26 Figure 27 and Figure 28
respectively. Across all experiments, the results under Retain @ Unlearn are consistent with our original findings, further validating all observations used to answer the five problems.
Table 9:
This summarize the Norm-AUC of all unlearning results at different setting of unlearning across two datasets and Qwen3-4B.
Model, Dataset
Gradient Ascent
Task Vector
FT Choices
GA GA-Single
GA-Mul
TV-Singla
TV-Mu
Qwen3-4B,
FT FT-Single
0.60
0,64
0.64
0.66
Eval-DU+
FT-Unlearn-Mo Mul
0.58
0.62
0.59
0.67
FT-Retain-Mul
0.66
0.67
0.65
0.71
FT-Mul
0.62
0.64
0.65
0.71
FT-Chunk-Mal
0.54
0.54
0.54
0.58
FT-Chunk-Mul (align)
0.57
0.57
0.58
0.60
FT-Chunk-Mul-Iso
0.58
0.58
0.56
0.59
Qwen3-4B, TOFU+
FT-Single
0.54
0.54
0.57
0.57
PT-Unlearn-Mul
0.52
0.53
0.52
0.55
FI-Retain-Mul
0,59
0,58
0.59
0.63
FT-Mull
0.58
0.59
0.60
0.62
PT-Chunk-Mul
0.46
0.46
0.47
0.47
FT-Chunk-Mul (align)
0.52
0.52
0.53
0.54
24

---

Published as a conference paper at ICLR 2026
Baseline
FT-Chunk-Mul
FT-Chunk-Mul
Nom-AUC
FT-Mul
Norm AUC
FT-Mul
1.50
GA-Single
GA-Mul
TV-Single
TV-Mul
GA-Single
GA-Mul
TV-Single
TV-Mul
(a) Qwen3-4B, Eval-DU+
(b) Qwen3-4B, TOFU+
Figure 16: Empirical study for Problem
on Qwen3-4B across two datasets: FT-Mul-Chunk vs.
FT-Mul.
Baseline
Baseline
FT-Chunk-Mul (KgH))
FT-Chunk-Mul (Kgr))
Norn-AUc
FT-Chunk-Mul (
Norm-AUC
FT-Chunk-Mul (Ks)"))
GA-Single GA-Mul
TV-Single
TV-Mul
GA-Single
GA-Mul
TV-Single
TV-Mul
(a) Qwen3-4B, Eval-DU+
(b) Qwen3-4B, TOFU+
Figure 17: Empirical study for Problem on Qwen3-4B across datasets: FT-Mul-Chuu (Keligg)
TT-Mul-Chuni (Kind).
Table 10: This table summarizes the Norm-AUC (f) of Gradient Difference different setting of unlearning across two datasets and two models.
Model,
Gradient Difference
FT Choices
Dataset
GD- Single
GD-Mu1
Llama2-7B,
FT-Single
0.636
0.645
Eval-DU+
PT-Unlearn-Mul
0.582
0.611
FT-Retain-Mul
0.643
0.656
FT-Mul
0.639
0.646
FT-Chunk-Mul
0,559
0.523
FT-Chunk-Mal (align)
0.631
0.621
FT-Chunk-Myl-TTs
0.622
0.648
Llama2-7B, TOFU+
FT-Single
0,584
0.588
PT-Unlearn-Mul
0.577
0.581
FT-Retain-Mul
0.633
0.656
FT-Mul
0.636
0.644
FT-Chunk-Mul
0.472
0.476
FT-Chunk-Mul (align)
0.647
0.733
Baseline
FT-Chunk-Mul
FT-Chunk-Mul-so
Norm-AUC
GA-Single
GA-Mul
TV-Single
TV-Mul
(a) Qwen3-4B, Eval-DU+
Figure 18: Empirical study for Problem on Qwen3-4B across two datasets: FT-Mul-Chunk vs
25

---

Published as conference paper at ICLR 2026
FT-Unleam-Mul
FT-Unlearn-Mul
FT-Single FT-Retain-Mul
FT-Single
FT-Retain-Mul
Norm-AU
Norm-AUC
2.8
GD-Single
GD-Mul
GD-Single
GD-Mul
(a) Llama2-7B, Eval-DU+
(b) Llama2-7B. TOFU+
Figure 19: Empirical study for Problem by evaluating Gradient Difference (GD-Single, GD-Mul):
FT-Single vs FT-Unlearm-Mul vs FT-Retain-Mul.
FT-Single
FT-Single FT-Mul
670
FT-Mul
Norm-AUC
Norm-AUs
GD-Single
GD Mul
GD-Single
GD-MU Mul
(a) Llama2-7B, Eval-DU+
(b) Llama2-7B, TOFU+
Figure 20: Empirical study for Problem 2 by evaluating Gradient Difference (GD-Single, GD-Mul):
FT-Single FT-Mul.
CX
FT-Chunk-Mul
FT-Chunk-Mul
Nomm-UC
FT-Mul
Norm-Ar AUC
FT-Mul
GD Single
GD Mui
GD GD-Single
GD Mui
(a) Llama2-7B. Eval-DU+
(b) Llama2-7B. TOFU+
Figure 21: Empirical study for Problem by evaluating Gradient Difference (GD-Single, GD-Mul): FT-Mul-Chuni vs FT-Mul.
Naive Baseline
Baseline
MT-Chunk--Ml (K!!))
FT-Chunk-Mul (K(N))
Norn-AUc
FT-Chunk-Mul (
Norm-AUC
FT-Chunk-Mul (Kg)
GD-Single
GD-Mul
GD-Single
GD-Mul
(a) Llama2-7B. 7B, Eval-DU+
(b) Llama2-7B. 7B, TOFU+
Figure 22: Empirical study for Problem by evaluating Gradient Difference (GD-Single, GD-Mul): FT-Mul-Chunk (K seligg vs FT-Mul-Chunk (Kind).
26

---

Published as a conference paper at ICLR 2026
Naive Baseline
FT-Chunk Mul
Norm-Al AurmAUU
FT-Chunk Mul Iuo
GD-Single
GD-Mul
(a) Llama2-7B, Eval-DU+
Figure 23: Empirical study for Problem by evaluating Gradient Difference (GD-Single, GD-Mul):
FT-Mul-Chunk vs #T-Mul-Chunk--SO.
FT-Unleam-Mul
FT-Untearm-Mul
Retain@untearti Brreinnnnteartt--o -nleartt-.00
Retain Saannnnnlaann-D-
FT-Single
FT-Single
FT-Retain-Mul
FT-Retain-Mul
cak
Single
GA-Mul
TV-Single
GA-Single
TV-Single
(a) Llama2-7B, Eval-DU+
(b) Llama2-7B, TOFU+
Figure 24: Empirical study for Problem evallaaed by new metric Retain @ Unlearnr: FT-Single vs FT-Unlcarn- vs FT-Retain-Muu.
Retaln@unieamt 0.1
FT-Single
Retain@un eerntt- 05
FT-Single
FT-Mul
FT-Mul
GA-Single
GA-Mul
TV-Single
TV-Mul
GA-Single
GA-Mul
TV-Single
TV-Mul
(a) Llama2-7B, Eval-DU+
(b) Llama2-7B, TOFU+
Figure 25: Empirical study for Problem 22 evaluated by new metric Retain @ Unlearnr: FT-Single vs FT-Mul.
Naive Baseline
Naive Baseline FT-Chunk-Mul
Retains Setainnnnleannn (0nnearn--001
FT-Chunk-Mul FT-Mul
Retain@Unleamt--
FT-Mul
0.20
GA-Single
GA-Mul
TV-Single
TV-Mul
GA-Single
GA-MuI
TV-Single
TV-Mul
(a) Llama2-7B, Eval-DU+
(b) Ilama2-7B, TOFU+
Figure 26: Empirical study for Problem levaluated by new metric Retain @ Unlearnr: FT-Mul-
Chunk vs FT-Mul.
27

---

Published as a conference paper at ICLR 2026
Naive Baseline
Retain@Untenn Unw.munnnnnnttttmm 1e.am=-0.00 05
Naive Baseline
FT Tr-CChukk-Mll (Kg")
MT- (CP))
C22
Retain@unleami
FT-Chunk-Mul "K""""
FT-Chunk-Mul (G""")
cas
6.4
GA-Single
TV-Single
TV-Mul
GA-Single
TV-Single
TV-Mul
(a) Llama2-7B, Eval-DU+
(b) Llama2-7B, TOFU+
Figure 27: Empirical study for Problem evaluated by new metric Retain @ Unlearns: FT-Mul-
Chunk (Kaig)))
FT-Mul-Chunk (Kind).
Naive Baseline
FT-Chunk Mul
Retain@unieam
FT-Chunk-Mul-iso
GA-Single
GA-Mul
TV-Single TV-Mul
(a) Llama2-7B, Eval-DU+
Figure 28: Empirical study for Problem levaluated new metric Retain @ Unlearne: FT-Mul- Chunk vs TT-Mul-Chunk-..
Table 11: This summarize the Retain @ Unlearnr 0.1 for Eval-DU+ and r 0.05 for TOFU+) of all unleamiig methods at different setting of training set across two datasets and Llama2-7B.
Model, Dataset
Gradient Ascent GA- Single
Task Vector
Choices
GA-Mul
TV-Single
TV-Mul
Llama2-7B, Eval-DU+
FT-Single
0.16
0.17
0.14
0.22
FT-Unlearn Mul
0.12
0.12
0.11
0.13
FT-Retain-Mul
0.21
0.23
0.21
0.30
FT-Mul
0.15
0.18
0.16
0.25
FT-Chunk-Mul
0.11
0.11
0.13
0.15
FT-Chunk-Mul (align)
0.11
0.12
0.14
0.15
FT FT-Chunk-Mu1-11s
0.19
0.18
0.21
0.26
Llama2-7B, TOFU+
FT-Single
0.06
0.06
0.06
0.06
FT-Unlearn-Mil
0.06
0.05
0.05
0.05
FT-Retain-Mul
0.09
0.09
0.09
0.08
FT-Mul
0.08
0.08
0.09
0.09
PT-Chunk-Muu Mul
0.04
0.04
0.04
0.04
FT-Chunk-Mul (align)
0.06
0.06
0.06
0.06
28


Reviews:
[{"review_id": "ukYT1Zr24L", "reviewer": "Reviewer_Av7s", "summary": "This paper investigates the effect of shaping of factual knowledge during fine-tuning phase on the effectiveness of knowledge unlearning in LLMs. The analysis reveals.that the knowledge demonstrated in various paraphrased ways are harder to unlearn, while unlearning is more efficient when knowledge is presented with various paraphrased formats overall. Moreover, the paper shows a novel insight that knowledge that is presented inside a single chunk of bath data are harder to unlearn while retaining the other knowledge inside the same chunk.", "questions": "Please see the questions above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "(S1) This work is well motivated, and the core question is important and novel, while not trivial.\n\n(S2) I commend the authors for the clear organization of research questions, appropriate experimental designs, and well-organized writing.", "weaknesses": "(W1) **Limited mechanistic understanding**: While the intuition that presenting factual knowledge in multiple paraphrased format leads to more structured representation is compelling and aligns with experimental results, the analysis relies on the observation of knowledge unlearning success, and the understanding on the mechanism governing this behavior is limited. For example:\n- Is there any difference in the distribution of the update vector or knowledge circuits [1], that is computed for unlearning single knowledge and paraphrased knowledge, respectively?\n- The improved effectiveness of unlearning upon paraphrasing both knowledge types (regarding RQ2) might be attributed to the increased training steps rather than the structures of representation induced by paraphrase, as the size of the fine-tuning dataset is increased. How can we remove this possibility?\n\n(W2) **Scope of the experiment**: While the authors have well justified the experimental setup of unlearning factual knowledge that is first encountered during fine-tuning phase, previous work ([2,3]) have demonstrated that the knowledge obtained during pretraining and fine-tuning phase may be encoded in a different way. This somewhat limits the scope of this work’s contribution. Could you share your thoughts on the applicability of the insights provided in this work to the unlearning of the knowledge acquired during pretraining?\n\n\n\n[1] https://arxiv.org/abs/2405.17969\n[2] https://arxiv.org/abs/2405.05904\n[3] https://arxiv.org/abs/2503.21676", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PRejgnM6iR", "reviewer": "Reviewer_bmBj", "summary": "The paper investigates how the way knowledge is encoded during fine-tuning impacts the effectiveness of post-hoc knowledge unlearning in LLMs. The authors argue that how knowledge is represented (shaped) in the training corpus significantly influences how difficult it is to later remove.\nThe authors conduct a rigorous, controlled empirical study by fine-tuning two LLMs (Llama2-7B and Gemma2-2B) on two extended benchmarks (Eval-DU+ and TOFU+) which use synthetic, fictitious knowledge to avoid pre-training contamination. They systematically test two main encoding factors:\n- Paraphrasing: They compare models trained on single vs. multiple paraphrased descriptions of facts.\n- Text Entanglement: They analyze unlearning when facts-to-be-forgotten (\"forget set\") are embedded in the same text chunk (e.g., a paragraph) as facts-to-be-kept (\"retain set\").\n\nTheir results consistently show that unlearning is harder when the forget set facts were paraphrased, but easier when the retain set facts were paraphrased.  Critically, the study also finds that unlearning individual facts is exceptionally difficult when forget and retain facts are entangled in the same training text chunk.", "questions": "- While you acknowledge the limitation of focusing on fine-tuning, do you have any hypotheses on how these findings might translate to the pre-training regime? Knowledge is both heavily paraphrased and heavily entangled during pre-training. Does this imply that unlearning pre-trained knowledge will always be as difficult as your FT-Mul-Chunk scenario, unless the fact is extremely rare?\n- Can you explicitly explain the baselines represents a random-chance unlearning in Figure 4,5,6?\n- Is FT-Mul-Chunk-Iso part of FT-Mul-Chunk?\n- Could you please provide new results based on LLama3 and Gemma3?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The paper explores a novel aspect on data shapes for unlearning in LLMs. Most unlearning research focuses on post-hoc algorithms. This work provides a new and important perspective by showing that data curation strategies during fine-tuning are a critical and overlooked factor.\n- The findings are clear and consistent across two different model families (Llama2, Gemma2) , two different datasets (Eval-DU+ and TOFU+), and two representative unlearning algorithms (Gradient Ascent and Task Vectors).", "weaknesses": "- Paraphrasing vs. Frequency: The effect of using multiple paraphrases (e.g., in FT-Unlearn-Mul) is closely related to simply increasing the frequency of the fact in the training data. The paper argues this encourages \"structured\" representations and distinguishes itself from related work on frequency, but it doesn't empirically disentangle the effect of the paraphrasing from the frequency.\n- No real-world dataset: The use of synthetic data is a key strength for experimental control, but also a potential weakness. Real-world corpora are far messy, and the entanglement of facts is likely more complex than the binary \"entangled chunk\" (FT-Mul-Chunk) or \"isolated sentences\" (FT-Mul-Chunk-Iso) settings explored.\n- Missing quality checking for the data augmentation (e.g., paraphrasing, separating) via GPT4o.\n- In the paper, the author mentions four combinations of models and datasets. However, only three of them are shown, Gemma2 with TOFU+ is missing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WCtHBkVlJ7", "reviewer": "Reviewer_PLQ7", "summary": "This paper addresses the problem of knowledge unlearning in large language models (LLMs). While prior work has primarily focused on developing new methodological approaches to improve unlearning performance on public benchmarks, this paper instead investigates how the way target knowledge is encoded in the training data affects the effectiveness of unlearning. To this end, the authors consider two main experimental settings: (1) examining the effect of text paraphrasing on unlearning, and (2) examining the effect of text chunk composition on unlearning. Through a series of controlled experiments, the paper observes that models trained with paraphrased data exhibit more effective unlearning, and that isolating forget knowledge within text chunks leads to more efficient forgetting.", "questions": "* In Section 2.3, the authors justify focusing on the fine-tuning stage for studying unlearning. However, fine-tuning typically involves a much smaller and more carefully curated dataset, often with significant manual filtering. In contrast, the pretraining stage usually carries a much higher risk of including sensitive or private user data. Could the authors elaborate on why fine-tuning is considered a more realistic or representative setting for privacy-sensitive unlearning?\n* As a learning-time strategy for improving the post-hoc efficiency of unlearning, the paper proposes separating knowledge during training. However, in the Problem 5 setting, where each fact is trained as an independent sentence, might this strategy introduce side effects such as degraded fluency, loss of contextual coherence, or weaker entity-level reasoning in generated text? Have the authors observed or considered such trade-offs?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 1, "presentation": 3, "contribution": 2, "strengths": "* This paper approaches the unlearning problem from a perspective, analyzing how the learning-time encoding (the way target knowledge is represented and learned during training) affects the effectiveness of unlearning. The framing that \"how and what is learned determines how well it can be forgotten\" clearly distinguishes this work from prior studies focused solely on algorithmic improvements. This is a valid and valuable perspective for deepening our understanding of knowledge unlearning in LLMs.\n* The paper systematically separates and investigates three factors, text paraphrasing, chunk entanglement, and sentence isolation, to examine how each influences the difficulty of unlearning. This stepwise, controlled design provides a meaningful experimental setup for exploring the structural causes of unlearning difficulty.", "weaknesses": "* In each experimental setting (e.g., FT-Single vs FT-Unlearn-Mul), the initial learning strength of the forget and retain knowledge differs. Models trained with paraphrased data tend to encode the same facts more strongly, resulting in higher initial scores and making unlearning appear more difficult. The paper attempts to account for this difference using the Norm-AUC metric, but this measure has a structural limitation: models with higher initial scores may be disadvantaged in relative evaluation, since the same absolute decrease in score yields a smaller relative change. Consequently, Norm-AUC does not fully normalize for differences in learning intensity. It would be more appropriate to analyze unlearning difficulty using models that are fine-tuned to have comparable initial forget/retain scores.\n* The results for Problem 3 and Problem 4 appear relatively self-evident given the experimental setup. When the forget and retain sets coexist within the same chunk, unlearning naturally fails, and when they are fully separated by chunk boundaries, performance improves as gradient interference is removed. These experiments therefore confirm rather than extend what is already understood about representation entanglement in unlearning.\n* The improvement observed in Problem 5 also lacks a sufficiently clear explanation. The only difference in this setting is that facts are arranged as independent sentences rather than connected text, yet the paper provides no theoretical or quantitative justification for why this should make unlearning more effective. While the empirical trend is interesting, the causal interpretation of this result remains underdeveloped.\n* The paper evaluates only two unlearning algorithms, Gradient Ascent (GA) and Task Vector (TV). Although these represent the optimization-based and representation-editing paradigms, respectively, this scope is too narrow to support general conclusions about unlearning mechanisms. It would be beneficial to include retain-aware or preference-based algorithms (e.g., Gradient Difference, Direct Preference Optimization, etc.) that explicitly leverage retain data during optimization, as such methods may exhibit different behavior with respect to the proposed encoding effects.\n* Minor typos\n  * Line 125: paraphased -> paraphrased\n  * Line 290: only three combinations are listed", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)