Measure, Don't Optimize: Forecasting Recovery in LLM Unlearning

2026-08-11

AI Summary

This work addresses the lack of prospective evaluation of knowledge recovery risk in existing large language model unlearning methods, which struggle to determine whether internal signals can predict subsequent recovery behavior. The authors propose J-Access, a Jacobian lens–based inference-time auditing method that quantifies the accessibility of target concepts along the output pathway to assess a model’s sensitivity to knowledge recovery post-unlearning. For the first time, they link internal representation accessibility with recovery speed, revealing that directly optimizing the audit metric often causes models to conceal rather than erase knowledge, and thus advocate treating auditing as an independent diagnostic dimension. In a large-scale evaluation spanning 398 models and eight unlearning methods, they find that most unlearned models retain above-baseline accessibility; pre-attack accessibility predicts model-level recovery speed but not specific factual recovery; and excessively minimizing J-Access paradoxically heightens recovery risk.

Abstract

Prior white-box studies show that large language models can retain latent traces of target knowledge after unlearning, even when the knowledge is no longer expressed in their outputs. However, existing audits remain limited to one-off diagnostics: it is unclear whether these residual signals can predict future recovery under continued training or serve as reliable optimization targets. Resolving this gap is essential to determine whether internal auditing can move beyond post-hoc evaluation toward proactive risk monitoring and safer unlearning. We propose J-Access, an inference-time audit that uses the Jacobian lens to map intermediate representations into vocabulary space and measures how often target concepts remain accessible along the model's output pathway. We hypothesize that residual accessibility reflects recovery susceptibility: knowledge that remains closer to the output pathway requires less fine-tuning to restore, leading to faster recovery. We audit 398 public unlearned models spanning eight unlearning methods. We find that: (1) most unlearned models retain access above the retain-only gold level; (2) pre-attack accessibility predicts recovery speed and extent at the model level, but cannot identify which specific facts will be recovered; and (3) directly minimizing J-Access does not promote genuine deletion. Instead, the model learns to hide knowledge from the audit, producing lower audit scores but greater post-attack recovery. These findings position J-Access as a model-level diagnostic for assessing residual susceptibility in unlearned models. We argue internal audits should serve as an independent diagnostic dimension in unlearning evaluation, and should not be converted into optimization targets without validation.

Problem

• LLM unlearning
• knowledge recovery
• residual traces
• internal auditing
• model safety

Innovation

• J-Access
• LLM unlearning
• Jacobian auditing
• knowledge recovery
• residual accessibility