{"id":"7a4bcdb0-37b2-461b-9c1b-6a192301b056","arxiv_id":"2505.09500","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Layered Unlearning sequentially forgets growing subsets of data to create fold-specific inhibition, blocking recovery of early folds by adversarial relearning.","lead":"The paper introduces Layered Unlearning, a multi-stage procedure that unlearns data one fold at a time while holding back later folds, and reports that it makes unlearned language models harder to re-teach from a subset of the forgotten data. The authors also find that fine-tuning on raw corpus text is a stronger recovery attack than fine-tuning on multiple-choice questions.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"LU's robustness may be explained by cumulative unlearning exposure and per-stage tuning; no matched repeated-unlearning control is provided.","rationale":"The paper's central claim requires that the layered schedule, specifically retaining not-yet-forgotten folds, causes the relearning barrier. The reported experiments do not establish this because Algorithm 1 confounds layering with repeated unlearning exposure and with per-stage hyperparameter tuning. A fold that appears earlier is unlearned in more stages, and the hyperparameters in Appendix G vary substantially across stages and differ from the baselines. The directional recovery pattern in Tables 3 and 9 is consistent with a simpler dose-response explanation. The paper even asserts in Section 5 that standard methods cannot match LU's optima with more training, but presents no experiment for that claim. This is a serious but addressable gap. The synthetic results and the RMU-Split control provide some support for a real effect, so I do not think the paper should be rejected; a matched-compute repeated-unlearning control would settle the question. This is consistent with the reader's CONDITIONAL verdict, so I leave the verdict unchanged while sharpening the reader's weakest assumption: the confound is not only hyperparameter tuning but also unequal per-fold unlearning exposure.","tokens_in":24812,"tokens_out":8339,"duration_ms":92615,"concrete_test":"On WMDP-3 with Zephyr-7B, run three unlearning arms with identical total unlearning steps and identical per-stage hyperparameters from Appendix G.3: (1) L-RMU as reported; (2) Repeated Full Unlearning (RU): at each stage i, call RMU(theta_{i-1}, F1 U F2 U F3, R0, gamma_i), replacing the growing forget set with the full forget set and dropping future-fold retention; (3) Sequential Unlearning without future retention (SU): RMU(theta_{i-1}, F1 U ... U Fi, R0, gamma_i). Then apply the paper's relearning protocol (fine-tune on each fold with lr=1e-6, batch size 4, 8 epochs, report best accuracy on the held-out folds) and compare Table 9 row B columns A and C. If RU or SU matches L-RMU's A accuracy (0.31 MCQ) while preserving B/C recovery, the layering structure is not the operative cause; if both are substantially worse, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that retaining future folds at each stage creates distinct inhibitors and thereby limits adversarial relearning. The experiments do not isolate that mechanism. In Algorithm 1, fold F_j is included in the forget set at every stage j,...,k, so earlier folds receive strictly more unlearning passes: F_1 is unlearned k times, F_k only once. The reported directional barrier (relearning B recovers C but not A; relearning C recovers B more than A) is exactly the pattern cumulative unlearning exposure would predict, without any fold-specific inhibitor. The paper never compares LU against a matched-compute control: repeated unlearning on the full forget set for k rounds, or sequential unlearning with a fixed retain set and no future-fold retention. Section 5 asserts that standard unlearning cannot reach LU's optima 'no matter how long they train', but no experiment supports this. Appendix G compounds the issue: L-RMU and L-SimNPO use heavily per-stage-tuned coefficients (e.g., 0.39/13.52, 14.51609, 45.51609) while baselines use a single setting, with no matched hyperparameter selection budget. The paper itself acknowledges in Section 5 that 'LU is sensitive to hyperparameters, requiring careful tuning at each stage.' Thus the observed robustness gain could come from extra compute and tuning rather than from the layered retain structure. The central claim would survive if a matched repeated-unlearning control still showed a qualitative advantage for the layered schedule; currently that control is missing.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Layered Unlearning (LU), a k-fold sequential unlearning method that at each stage unlearns a growing union of folds while retaining the remaining folds, with the goal of creating fold-specific inhibitors that block adversarial relearning from recovering the full forgotten set from a subset. The authors evaluate LU on synthetic tasks (2D logistic regression and a bigram transformer) and on LLM unlearning benchmarks (WMDP, MMLU, Years) using RMU and SimNPO as base unlearning primitives. They report that LU improves robustness to relearning, produces a directional barrier in which relearning a later fold does not recover earlier folds, and reveals that corpus-based fine-tuning is a stronger attack than MCQ-based fine-tuning. The paper includes code, synthetic experiments with multiple seeds, and detailed hyperparameter listings in the appendix.","tokens_in":25137,"tokens_out":5123,"duration_ms":51081,"significance":"If the central claim is correct, LU would be a simple and broadly applicable defense against adversarial relearning, and the observed fold-asymmetric robustness would provide a useful empirical signature for understanding post-training modifications. The paper's strengths include the clear algorithmic proposal, the synthetic experiments that consistently show the directional barrier, the attempt to control for the random-projection confound via RMU-Split, and the release of code. However, the claimed mechanistic interpretation in terms of context-dependent inhibitors is not directly tested, and the LLM experiments currently do not separate the effect of the layered structure from the effects of additional hyperparameter tuning and cumulative unlearning passes. The corpus-based attack finding is interesting and could stand even if the mechanistic story is revised.","major_comments":[{"comment":"The claim in Section 5 that LU “discovers optima that standard unlearning techniques are unable to discover no matter how long they train” is unsupported. Appendix G shows that L-RMU and L-RMU-Split use per-stage tuned coefficients (e.g., forget coefficients 0.39, 13.52; retain set coefficients 14.51609 and 45.51609) while the baseline RMU/RMU-Split runs use a single setting, and no matched hyperparameter selection budget is reported. Without a control that gives the baselines a comparable tuning budget, the robustness gain could be attributed to additional tuning rather than to the layered retain structure; the manuscript itself acknowledges in Section 5 that LU is sensitive to hyperparameters and requires careful tuning at each stage.","section":"Section 5 and Appendix G"},{"comment":"Algorithm 1 includes fold F_j in the forget set at every stage j through k, so earlier folds receive strictly more unlearning passes than later folds. The reported directional barrier (relearning B recovers C but not A) is exactly the pattern that cumulative unlearning exposure would predict, without any fold-specific inhibitor. The paper provides no matched repeated-unlearning control, such as running the base unlearning for k rounds on the full forget set or sequential unlearning with a fixed retain set and no future-fold retention. Without such a control, the experiments do not isolate the proposed layered mechanism.","section":"Algorithm 1 and Section 3.1"},{"comment":"The LLM experiments report single runs without error bars, and several entries contradict the blanket claim of improved robustness. For example, in Table 3, relearning on B and evaluating on C gives L-RMU 0.50 versus RMU 0.46, and Appendix F reports recovery rates greater than 1 for many L-RMU entries (e.g., Table 14, relearn A evaluate C: 1.33), meaning L-RMU is worse than standard RMU in those conditions. The paper needs multiple seeds or a statistical summary to support the headline claim that LU improves robustness across settings.","section":"Table 3 and Appendix E/F"},{"comment":"The paper frames itself as testing the hypothesis that post-training induces context-dependent inhibitors, but the only evidence offered is the behavior of LU, an algorithm designed from that hypothesis. No direct activation-level measurement of the hypothesized inhibitors is provided; the synthetic ablations in Appendix B show that attention components matter for robustness but do not demonstrate fold-specific inhibition. The reasoning is therefore partly circular: the mechanism is inferred from the same behavior it is used to explain. A direct probe of the hypothesized inhibitor directions, or a clearly falsifiable prediction tested independently of the algorithm's construction, would be needed to support the mechanistic conclusion.","section":"Abstract and Section 2.3"}],"minor_comments":[{"comment":"The introduction contains a duplicated and awkward sentence: “However, changes introduced in post-training are often brittle. However, these changes are often shallow or brittle.” Please consolidate.","section":"Section 1"},{"comment":"The notation U : Θ × X × X × Γ → Θ is confusing because F and R are subsets of the data space, not elements of X; please use a clearer domain such as Θ × 2^X × 2^X × Γ.","section":"Section 2.1"},{"comment":"The acronym RTT is used without definition in the sentence comparing corpus-based fine-tuning with “standard RTT (Deeb & Roger, 2025).” Please define it at first use.","section":"Section 1"},{"comment":"The recovery-rate definition is clear as a ratio of differences, but the accompanying text should state explicitly that a value less than 1 means the layered method recovers less information than the baseline, and that values greater than 1 appear in the tables and correspond to worse robustness for the layered method.","section":"Appendix F"},{"comment":"Li et al. 2024a and Li et al. 2024b cite the same WMDP paper; please merge the duplicates.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The core idea is promising and the synthetic evidence is consistent, but the LLM evidence currently has a serious confound between the layered structure, cumulative unlearning exposure, and per-stage hyperparameter tuning. The paper would need either a matched repeated-unlearning control and a matched hyperparameter budget, or a clear acknowledgment that the mechanistic interpretation is speculative, before I could support acceptance. The corpus-based attack result is a nice contribution that does not depend on the inhibitor story."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing to know: this is not a desk reject. The layered schedule—unlearning an expanding prefix while retaining later folds—is a new twist on sequential unlearning, and the synthetic results consistently show a directional barrier: relearning B recovers C but not A. That pattern shows up across two synthetic tasks and in WMDP for L-RMU. The paper also ships code, uses 10 seeds in synthetic experiments, and includes an ablation swapping model components that points at attention circuits. Credit where due: the corpus-versus-MCQ attack comparison is a useful byproduct, and the authors are transparent about hyperparameter sensitivity in Section 5.\n\nSoft spots. The main one is the control. In Algorithm 1, fold F_1 gets unlearned k times and F_k once. The observed directional barrier is exactly what cumulative exposure predicts. The paper never compares LU against a matched-compute repeated-unlearning baseline—same number of passes over the full forget set, or sequential unlearning with a fixed retain set. Section 5 claims standard unlearning cannot reach LU's optima 'no matter how long they train,' but no experiment backs that. Second, the LLM comparisons are confounded by tuning: L-RMU uses per-stage forget coefficients like 0.39/13.52 and retain coefficients like 14.51609, while RMU runs a single setting. Without a matched hyperparameter budget, some of the gain could be extra tuning rather than the layering structure. Third, LLM tables report single runs, no error bars, though the consistency across WMDP, MMLU, and Years mitigates that. Fourth, the inhibitor mechanism is inferred from behavior, not measured directly. That is fine as a hypothesis, but calling it the explanation is circular when the algorithm was designed around it.\n\nOverall: the core idea holds up as plausible and worth testing. The evidence supports a weaker claim: LU appears to improve robustness to relearning in these settings, and the directional barrier is real. The stronger claim—that distinct fold-specific inhibitors are created, and that layering not tuning is responsible—is not yet proven.\n\nWho should read it: people working on unlearning robustness and post-training brittleness. It deserves a serious referee, but the referee should demand the repeated-unlearning control and matched tuning before acceptance. I'd wait for that revision before citing it.","headline":"Layered unlearning is a genuinely new idea with promising synthetic evidence, but the missing repeated-unlearning control and heavy per-stage tuning keep the central claim from being proven.","tokens_in":25676,"tokens_out":1692,"would_cite":false,"duration_ms":15549,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that Layered Unlearning, which unlearns data folds sequentially while retaining the rest, blocks adversarial relearning from restoring the full forgotten dataset by forcing fold-specific internal inhibitors.","keywords":["machine unlearning","adversarial relearning","layered unlearning","inhibitor mechanism","representation misdirection","gradient ascent","transformer circuits","corpus-based fine-tuning"],"falsifier":"Run plain RMU and LU-augmented RMU on the same WMDP folds, giving each the same number of hyperparameter trials and the same total compute; if the best plain RMU regains as much accuracy on fold A after fine-tuning on fold B as the layered model, then the layering schedule is not the cause of the robustness.","tokens_in":24622,"feed_emoji":"🔒","tokens_out":8669,"duration_ms":82356,"temperature":0.7,"pith_summary":"The paper claims that post-training unlearning is brittle because a standard unlearning run installs a single shared, context-dependent inhibitor: fine-tune on any part of the forgotten data and the whole forgotten set comes back. To test this, it introduces Layered Unlearning (LU), which splits the forget set into k folds and unlearns them one prefix at a time while keeping the remaining folds in the retain set at each stage. Across synthetic tasks and LLM benchmarks on WMDP, MMLU, and Years, LU reduces how much relearning on one fold restores performance on other folds, for both a representation-engineering method and a gradient-ascent method. The paper also finds that fine-tuning on raw corpus text is a stronger attack than fine-tuning on multiple-choice questions, a difference that only shows up because LU makes MCQ-based relearning harder.","feed_headline":"Layered unlearning stops relearning from bringing data back","feed_subtitle":"A staged forget-and-retain procedure creates fold-specific blocks that survive fine-tuning on other folds.","key_machinery":"The central object is the context-dependent inhibitor: an internal mechanism, formed during unlearning, that suppresses a specific set of responses when the right context is present while leaving other behavior intact. LU's machinery is the staged schedule in Algorithm 1: at stage $i$, it unlearns $F_1 \\cup \\dots \\cup F_i$ while retaining $R \\cup F_{i+1} \\cup \\dots \\cup F_k$, so each stage must solve a different forget/retain trade-off and therefore cannot rely on the same single suppression direction. The same unlearning primitive is reused at every stage; only the growing forget set and the shrinking retain set change. This forces the model to encode inhibition in a way that is localized to the fold being forgotten, and the paper shows in a toy transformer that the QK and OV attention circuits are the components that carry this resistance.","core_discovery":"The paper's central claim is that unlearning the first $i$ folds while retaining the remaining $k-i$ at the $i$th of $k$ stages limits the ability of relearning on a subset of data to recover the full dataset. In the paper's own terms, standard unlearning creates a single shared inhibitor $I_{A \\cup B}$ that covers all forgotten folds, so relearning on $B$ removes that shared inhibitor and restores $A$. LU instead builds a sequence of inhibitors $I_A$, $I_{AB}$, $I_{ABC}$ by applying an unlearning primitive $U$ with a growing forget set: at stage $i$, it computes $U(\\theta_{i-1}, F_1 \\cup \\dots \\cup F_i, R \\cup F_{i+1} \\cup \\dots \\cup F_k, \\gamma_i)$. Relearning on $B$ deactivates $I_{AB}$ and $I_{ABC}$ but leaves $I_A$ unchanged, so $A$ stays suppressed; the direction of the barrier depends on whether the primitive builds shared or fold-specific inhibitors. The paper reports that LU improves robustness across a 2D logistic-regression synthetic task, a three-token bigram transformer, and the WMDP, MMLU, and Years benchmarks with RMU and SimNPO primitives, and that corpus-based fine-tuning reveals a stronger attack than MCQ-based fine-tuning, especially for representation-engineering variants.","pith_inferences":["The paper does not formalize it, but its fold-order results imply a policy: if a defender must protect some subset more than others, placing it in the earliest fold should make it the hardest to recover, since later relearning removes only the later inhibitors.","The corpus-based attack finding suggests a testable correction: re-running existing unlearning benchmarks with corpus fine-tuning, not just MCQ fine-tuning, would likely reveal higher residual vulnerability in methods that look robust today.","Because the toy-transformer ablation shows QK/OV circuits carry the inhibition, a direct causal test is to patch attention heads from a layered model into a standard unlearned model and check whether fold-specific suppression transfers; the paper leaves this intervention open.","The paper's alignment discussion suggests a layered 'harmless-but-helpless then helpful' training order; a concrete experiment would fine-tune helpfulness after a harmlessness pass and measure whether harmlessness degrades, which is currently untested."],"forward_implications":["Standard single-shot unlearning has a single point of failure, so unlearning benchmarks should measure fold-specific relearning recovery rather than only aggregate forget accuracy.","LU makes robustness directional and path-dependent: an adversary with a later fold recovers less from earlier folds, so the fold order can be chosen to protect the most sensitive data first.","LU is compatible with both major unlearning primitive families, representation misdirection and gradient ascent, so layering can be added on top of existing methods rather than replacing them.","Corpus-based fine-tuning should become a standard attack in unlearning evaluation, because MCQ-based fine-tuning underestimates how much forgotten information can be recovered.","In the toy transformer, resistance to relearning is carried by attention circuits (QK/OV), pointing to attention rather than output layers as the locus for future defense mechanisms."],"supporting_citations":[{"why":"Supplies the adversarial relearning attack and evaluation protocol that LU is designed to resist, and the finding that unlearned information is recovered by fine-tuning on a subset.","marker":"Deeb & Roger (2025)"},{"why":"Supplies the RMU representation-misdirection unlearning primitive and the WMDP benchmark used for the L-RMU experiments.","marker":"Li et al. (2024a)"},{"why":"Supplies the SimNPO gradient-ascent unlearning primitive used for the L-SimNPO comparison.","marker":"Fan et al. (2025)"},{"why":"Provides the transformer-circuits framework used to ablate QK, OV, and embedding components in the bigram experiments.","marker":"Elhage et al. (2021)"},{"why":"Supplies the MMLU benchmark used both as the retain-set evaluation and as a forget dataset for capability unlearning.","marker":"Hendrycks et al. (2021)"},{"why":"Provides the Language Model Evaluation Harness used for standard 0-shot evaluation of the unlearned models.","marker":"Gao et al. (2023)"},{"why":"Supplies the Zephyr-7B-β base model on which all LLM unlearning experiments are run.","marker":"Tunstall et al. (2023)"}],"fun_headline_variants":["Staged unlearning blocks relearning attacks on forgotten data","Fold-by-fold unlearning keeps relearning from restoring data","Layered inhibitors survive fine-tuning, protect unlearned data","Partial relearning fails to undo layered unlearning","Staged forget-and-retain blocks fold-specific recovery"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper assumes the robustness gain comes from the layering structure itself, not from the per-stage tuning choices documented in the appendix; if the baseline methods were given the same tuning budget, they might match LU.","fun_headline_variants_meta":{"raw":{"variants":["Staged unlearning blocks relearning attacks on forgotten data","Fold-by-fold unlearning keeps relearning from restoring data","Layered inhibitors survive fine-tuning, protect unlearned data","Partial relearning fails to undo layered unlearning","Staged forget-and-retain blocks fold-specific recovery"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000534,"raw_usage":{"total_tokens":2614,"prompt_tokens":1034,"completion_tokens":1580,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":650,"completion_tokens_details":{"reasoning_tokens":1515}},"tokens_in":650,"tokens_out":1580,"duration_ms":12796,"temperature":1.0,"reasoning_tokens":1515,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:29:36.425488+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run plain RMU and LU-augmented RMU on the same WMDP folds, giving each the same number of hyperparameter trials and the same total compute; if the best plain RMU regains as much accuracy on fold A after fine-tuning on fold B as the layered model, then the layering schedule is not the cause of the robustness.","supporting_citations":[],"review_version":1}