Figure 1: (a) Improved unlearning robustness by smoothness-enhanced NPO (including NPO+SAM, RS, GP, CR, or WA) compared to vanilla NPO on WMDP. (b)~(h) The prediction loss landscape of the original model and unlearned model on the forget set.

This is the official code repository for ICML 2025 paper Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond.

The LLM unlearning technique has recently been introduced to comply with data regulations and address the safety and ethical concerns of LLMs by removing the undesired data-model influence. However, state-of-the-art unlearning methods face a critical vulnerability: they are susceptible to "relearning" the removed information from a small number of forget data points, known as relearning attacks. In this paper, we systematically investigate how to make unlearned models robust against such attacks. For the first time, we establish a connection between robust unlearning and sharpness-aware minimization (SAM) through a unified robust optimization framework, in an analogy to adversarial training designed to defend against adversarial attacks. Our analysis for SAM reveals that smoothness optimization plays a pivotal role in mitigating relearning attacks. Thus, we further explore diverse smoothing strategies to enhance unlearning robustness. Extensive experiments on benchmark datasets, including WMDP and MUSE, demonstrate that SAM and other smoothness optimization approaches consistently improve the resistance of LLM unlearning to relearning attacks. Notably, smoothness-enhanced unlearning also helps defend against (input-level) jailbreaking attacks, broadening our proposal's impact in robustifying LLM unlearning.

• Smoothness-enhanced unlearn on WMDP
• Smoothness-enhanced unlearn on MUSE

To directly using our unlearned model, please refer to our HuggingFace Collection:

• 🤗OPTML-Group/Smooth-Unlearned-Models

• Chongyu Fan
• Jinghan Jia

@article{fan2025towards,
  title={Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond},
  author={Fan, Chongyu and Jia, Jinghan and Zhang, Yihua and Ramakrishna, Anil and Hong, Mingyi and Liu, Sijia},
  journal={arXiv preprint arXiv:2502.05374},
  year={2025}
}