{"id":"27be91be-6e6c-45fa-aa39-c008a21e4b32","arxiv_id":"2606.10989","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"NSRU constrains LoRA updates via null-space projection of retain subspaces to jointly optimize safe-target learning, undesired-response suppression, and retention in LLM unlearning.","lead":"The paper introduces NSRU, a low-rank adaptation method that projects updates into the null space of estimated retain subspaces while using specified safe target responses for unlearning queries in LLMs. If effective, this could enable more precise removal of unwanted knowledge without broadly degrading model capabilities.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Local first-order analysis of projected updates assumes linearity and small perturbations that may not hold for non-linear transformer layers under LoRA.","rationale":"The reader's weakest assumption directly identifies the subspace estimation step; the first-order analysis is the additional untested link that makes that assumption load-bearing for the empirical claims. Full-text access does not remove this gap because the analysis is presented as supporting evidence without empirical validation of its regime of validity. This moves the verdict from UNVERDICTED to CONDITIONAL pending the proposed check.","tokens_in":1787,"tokens_out":369,"duration_ms":12329,"concrete_test":"Re-run the TOFU experiments with the same hyperparameters but insert an intermediate checkpoint after 10% of training steps; compute the actual change in retain hidden states (layer-wise cosine distance) with vs. without the null-space projection. If the measured retain perturbation exceeds the first-order prediction by >15% on average across modules, the analysis does not reliably predict behavior.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim that the orthogonal projection confines updates to the null space of retain subspaces (while preserving editable directions for forget behavior) rests on a local first-order analysis. This analysis implicitly treats the forward pass as approximately linear around the current weights and assumes that first-order retain perturbations dominate. In practice, transformer attention and feed-forward blocks are highly non-linear; even low-rank updates can induce higher-order effects that shift retain representations outside the estimated subspace. The per-module retain subspaces are estimated from benign hidden representations, but no evidence is given that these subspaces remain invariant under the non-linear dynamics of the actual training trajectory. If the first-order approximation fails, the projection may either leak retain perturbations or over-constrain forget editing, undermining both suppression and retention claims.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes Null-Space Constrained Response-Specified Unlearning (NSRU), a LoRA-based framework that specifies safe target responses for forget queries while using per-module retain subspaces (estimated from benign hidden states) to orthogonally project updates into their null space. A local first-order analysis argues that this reduces retain-side perturbations while preserving editable directions for forget behavior. The joint objective combines safe-target learning, undesired-response suppression, and retention preservation. Experiments on TOFU report effective forget-set suppression with gains in retain QA, model utility, and safe-target alignment over baselines; on WMDP, hazardous accuracy stays near random while preserving MMLU utility. Ablations and sensitivity checks are included.","tokens_in":1945,"tokens_out":470,"duration_ms":15767,"significance":"If the projection mechanism reliably localizes updates in practice, the approach supplies an explicit, structured way to enforce locality in response-specified unlearning without relying solely on regularization, which could strengthen controllability claims in LLM editing. The multi-term objective and per-module subspace construction are clearly stated strengths.","major_comments":[{"comment":"The local first-order analysis (method overview and associated derivation): the argument that the orthogonal projection confines updates to the null space of retain subspaces while preserving editable directions for forget-query behavior rests on the assumption that first-order perturbations dominate and that the estimated subspaces remain invariant under the non-linear forward pass of transformer layers. No empirical verification or higher-order bounds are supplied showing that the subspaces estimated from benign representations stay effective throughout the actual training trajectory; this directly underpins the central claim that retain perturbations are reduced without over-constraining forget editing.","section":"local first-order analysis"}],"minor_comments":[{"comment":"The abstract and experiments section reference sensitivity and robustness analyses across hyperparameter and prompt variations, but the specific ranges and prompt templates used are not enumerated, making it difficult to assess the scope of the reported stability.","section":"experiments"},{"comment":"Notation for the retain subspace estimation and the projection operator could be introduced with an explicit equation early in the method section to improve readability before the analysis.","section":"method"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback and positive evaluation of the paper's significance. We address the single major comment point-by-point below.","responses":[{"response":"We agree that the local first-order analysis relies on the stated assumptions without direct empirical verification of subspace invariance over the full training trajectory or higher-order bounds. While the derivation establishes the intended localization property under the first-order regime, the referee correctly identifies that this leaves open whether the estimated retain subspaces remain sufficiently stable in practice under the non-linear dynamics. In the revised manuscript we will add a dedicated empirical verification subsection (in Section 4) that tracks subspace alignment (via principal angle metrics) and projection effectiveness at multiple checkpoints during training on TOFU. We will also report the evolution of retain-side perturbation norms with and without the null-space constraint to provide concrete support for the analysis.","revision_made":"yes","referee_comment":"[local first-order analysis] The local first-order analysis (method overview and associated derivation): the argument that the orthogonal projection confines updates to the null space of retain subspaces while preserving editable directions for forget-query behavior rests on the assumption that first-order perturbations dominate and that the estimated subspaces remain invariant under the non-linear forward pass of transformer layers. No empirical verification or higher-order bounds are supplied showing that the subspaces estimated from benign representations stay effective throughout the actual training trajectory; this directly underpins the central claim that retain perturbations are reduced without over-constraining forget editing."}],"tokens_in":1416,"tokens_out":319,"duration_ms":15176,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main takeaway is a method that specifies replacement responses for forget queries and then projects LoRA updates into the null space of per-module retain subspaces estimated from benign activations.\n\nWhat is new is the explicit combination of safe-target supervision, undesired-response suppression, and the orthogonal projection step inside the low-rank parameterization. The paper does a solid job writing down the joint objective and running ablations that show each piece contributes.\n\nThe experiments claim stronger forget-set suppression and better retain QA and MMLU scores than the baselines they compare against. On WMDP the hazardous accuracy drops near random while adjacent utility holds.\n\nThe soft spot is the local first-order analysis meant to justify the projection. It treats the forward pass as roughly linear around the current weights and assumes the estimated retain subspaces stay stable. Transformer blocks are non-linear, so even low-rank changes can produce higher-order shifts that move retain representations outside those subspaces. The stress-test concern lands here; nothing in the abstract shows the subspaces remain invariant along the actual training path.\n\nThis paper is for researchers working on practical LLM editing and unlearning who already know LoRA and subspace methods. A reader looking for a concrete framework with reported numbers on standard benchmarks will get value from it.\n\nIt deserves a serious referee because the idea is a reasonable engineering step with measurable claims, even though the analysis needs more scrutiny. I would send it to peer review.","headline":"NSRU adds null-space projection to response-specified LoRA unlearning and reports gains on TOFU and WMDP, but the first-order analysis leaves open whether the constraints actually hold in non-linear layers.","tokens_in":2419,"tokens_out":372,"would_cite":false,"duration_ms":13915,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"NSRU confines LoRA updates to the null space of retain subspaces for response-specified LLM unlearning.","keywords":["LLM unlearning","null-space constraint","low-rank adaptation","response-specified unlearning","TOFU benchmark","WMDP benchmark","LoRA projection","retain subspace"],"falsifier":"If NSRU applied to TOFU fails to suppress extractable forget-set knowledge below baseline levels or degrades retain QA performance relative to unprojected LoRA variants, the central claim would not hold.","tokens_in":2696,"feed_emoji":"","tokens_out":715,"duration_ms":14916,"temperature":0.7,"pith_summary":"The paper presents NSRU, a low-rank adaptation method that specifies safe target responses for forget queries while suppressing original undesired outputs. It estimates per-module retain subspaces from benign hidden representations and projects updates orthogonally into their null space to localize changes. A first-order analysis indicates this reduces unwanted perturbations on retain directions. Experiments on TOFU and WMDP benchmarks show stronger forget-set suppression alongside gains in retain QA, model utility, and safe-target alignment compared to baselines. Ablations confirm the joint contribution of safe-target supervision, suppression terms, retention loss, and the null-space constraint.","feed_headline":"Null-space projection confines LLM unlearning updates","feed_subtitle":"By projecting LoRA changes into retain null spaces, NSRU suppresses targeted knowledge while improving retain performance on TOFU and WMDP.","key_machinery":"Orthogonal projection of LoRA updates into the null space of per-module retain subspaces estimated from benign hidden representations.","core_discovery":"NSRU estimates per-module retain subspaces from benign hidden representations and applies an orthogonal-projected low-rank parameterization that confines updates to the null space of those subspaces. The resulting objective jointly optimizes safe-target learning for each forget query, undesired-response suppression, and retention preservation. Local first-order analysis shows the projected update reduces retain-side perturbations while preserving editable directions for shaping forget-query behavior. On TOFU this yields effective suppression of extractable forget-set knowledge with improved retain QA performance, model utility, and safe-target alignment; on WMDP it keeps hazardous-domain acc","pith_inferences":["The same null-space projection technique could be applied to other parameter-efficient adaptation methods beyond LoRA.","If retain subspaces can be estimated from a small set of benign examples, the approach may extend to continual unlearning settings where new forget targets arrive over time.","The local first-order analysis could be extended to quantify how much editable capacity remains for forget queries after projection, guiding hyperparameter choices."],"forward_implications":["The constrained parameterization suppresses extractable forget-set knowledge on TOFU while improving retain QA performance, model utility, and safe-target alignment over baselines.","On WMDP the method keeps hazardous-domain accuracy near the random-choice region while preserving broad and domain-adjacent MMLU utility.","Ablation studies establish complementary roles for safe-target supervision, undesired-response suppression, retention loss, and null-space projected updates.","Sensitivity analyses indicate stable behavior across tested hyperparameter and prompt variations."],"fun_headline_variants":["NSRU projects LoRA into retain null spaces for unlearning","Null-space constraints localize LLM unlearning adaptation","Response-specified unlearning via constrained low-rank updates","Per-module retain subspaces guide LLM unlearning updates"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"Per-module retain subspaces estimated from benign hidden representations accurately identify the directions that must remain unchanged.","fun_headline_variants_meta":{"raw":{"variants":["NSRU projects LoRA into retain null spaces for unlearning","Null-space constraints localize LLM unlearning adaptation","Response-specified unlearning via constrained low-rank updates","Per-module retain subspaces guide LLM unlearning updates"]},"model":"grok-4.3","cost_usd":0.004395,"raw_usage":{"total_tokens":2163,"prompt_tokens":756,"num_sources_used":0,"completion_tokens":59,"cost_in_usd_ticks":43953000,"prompt_tokens_details":{"text_tokens":756,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1348,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":756,"tokens_out":59,"duration_ms":7576,"temperature":1.0,"reasoning_tokens":1348,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T13:33:15.297617+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"If NSRU applied to TOFU fails to suppress extractable forget-set knowledge below baseline levels or degrades retain QA performance relative to unprojected LoRA variants, the central claim would not hold.","supporting_citations":[],"review_version":1}