Paper deep dive
Large Language Model Unlearning for Source Code
Xue Jiang, Yihong Dong, Zheng Fang, Yingwei Ma, Tangxinyu Wang, Rongyu Cao, Binhua Li, Zhi Jin, Wenpin Jiao, Yongbin Li, Ge Li
Models: unspecified four LLMs (code LLMs)
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/11/2026, 1:14:12 AM
Summary
The paper introduces PROD (Probabilistic Redistribution for Output Distribution), a surgical unlearning method for Large Language Models (LLMs) in the context of source code. Unlike existing methods that cause utility degradation by erasing entire code snippets, PROD operates at the token level, suppressing prohibited tokens and redistributing probability mass to maintain syntactic and semantic integrity. The authors also propose a benchmark for source code unlearning covering copyrighted code, insecure code, and deprecated APIs, evaluated using a new Pareto Dominance Ratio (PDR) metric.
Entities (5)
Relation Signals (3)
PROD → evaluatedby → PDR
confidence 95% · We also propose a benchmark for source code unlearning along with a metric, Pareto Dominance Ratio (PDR).
LLM → exhibitsrisks → Copyright Infringement
confidence 90% · their inherent tendency toward verbatim memorization of training data introduces critical risks like copyright infringement
PROD → improves → Machine Unlearning
confidence 90% · PROD achieves superior overall performance between forget quality and model utility compared to existing unlearning approaches
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:While Large Language Models (LLMs) excel at code generation, their inherent tendency toward verbatim memorization of training data introduces critical risks like copyright infringement, insecure emission, and deprecated API utilization, etc. A straightforward yet promising defense is unlearning, ie., erasing or down-weighting the offending snippets through post-training. However, we find its application to source code often tends to spill over, damaging the basic knowledge of programming languages learned by the LLM and degrading the overall capability. To ease this challenge, we propose PROD for precise source code unlearning. PROD surgically zeroes out the prediction probability of the prohibited tokens, and renormalizes the remaining distribution so that the generated code stays correct. By excising only the targeted snippets, PROD achieves precise forgetting without much degradation of the LLM's overall capability. To facilitate in-depth evaluation against PROD, we establish an unlearning benchmark consisting of three downstream tasks (ie., unlearning of copyrighted code, insecure code, and deprecated APIs), and introduce Pareto Dominance Ratio (PDR) metric, which indicates both the forget quality and the LLM utility. Our comprehensive evaluation demonstrates that PROD achieves superior overall performance between forget quality and model utility compared to existing unlearning approaches across three downstream tasks, while consistently exhibiting improvements when applied to LLMs of varying series. PROD also exhibits superior robustness against adversarial attacks without generating or exposing the data to be forgotten. These results underscore that our approach not only successfully extends the application boundary of unlearning techniques to source code, but also holds significant implications for advancing reliable code generation.
Tags
Links
- Source: https://arxiv.org/abs/2506.17125
- Canonical: https://arxiv.org/abs/2506.17125
- Code: https://github.com/jiangxxxue/PROD
Trouble viewing inline? Open PDF directly →
Full Text
65,134 characters extracted from source content.
Expand or collapse full text
Large Language Model Unlearning for Source Code Xue Jiang 1,2 * , Yihong Dong 1,2,* , Huangzhao Zhang 3 , Tangxinyu Wang 1 , Zheng Fang 1 , Yingwei Ma 2 , Rongyu Cao 2 , Binhua Li 2 , Zhi Jin 1 , Wenpin Jiao 1 , Yongbin Li 2 , Ge Li 1† 1 Key Laboratory of High Confidence Software Technologies (Peking University), Ministry of Education; School of Computer Science, Peking University, Beijing, China 2 Tongyi Lab, Alibaba Group 3 Verdent AI jiangxue, dongyh@stu.pku.edu.cn, lige@pku.edu.cn Abstract While Large Language Models (LLMs) excel at code gen- eration, their inherent tendency toward verbatim memoriza- tion of training data introduces critical risks like copyright infringement, insecure emission, and deprecated API utiliza- tion, etc. A straightforward yet promising defense is un- learning, i.e., erasing or down-weighting the offending snip- pets through post-training. However, we find its application to source code often tends to spill over, damaging the ba- sic knowledge of programming languages learned by the LLM and degrading the overall capability. To ease this chal- lenge, we propose PROD for precise source code unlearn- ing. PROD surgically zeroes out the prediction probability of the prohibited tokens, and renormalizes the remaining distri- bution so that the generated code stays correct. By excising only the targeted snippets, PROD achieves precise forgetting without much degradation of the LLM’s overall capability. To facilitate in-depth evaluation against PROD, we estab- lish an unlearning benchmark consisting of three downstream tasks (i.e., unlearning of copyrighted code, insecure code, and deprecated APIs), and introduce Pareto Dominance Ratio (PDR) metric, which indicates both the forget quality and the LLM utility. Our comprehensive evaluation demonstrates that PROD achieves superior overall performance between forget quality and model utility compared to existing unlearning ap- proaches across three downstream tasks, while consistently exhibiting improvements when applied to LLMs of varying series. PROD also exhibits superior robustness against ad- versarial attacks without generating or exposing the data to be forgotten. These results underscore that our approach not only successfully extends the application boundary of unlearning techniques to source code, but also holds significant implica- tions for advancing reliable code generation. Introduction Large Language Models (LLMs) have revolutionized the field of software engineering, automatically converting re- quirements into executable code with efficiency exceeding human programmers (Li et al. 2022; GitHub 2022; Dong et al. 2025; Anthropic 2025; Jiang et al. 2025). Such a leap * Work done during Xue Jiang and Yihong Dong’s internship at Tongyi Lab. † Corresponding author. Copyright © 2026, Association for the Advancement of Artificial Intelligence (w.aaai.org). All rights reserved. is powered by the scaling law, i.e., ever-larger models and ever-growing corpora yield ever-better performance (Kaplan et al. 2020; Hoffmann et al. 2022). However, the training corpora themselves are usually scraped from the open web, almost inevitably containing copyrighted fragments, vulner- able snippets, and deprecated Application Programming In- terfaces (APIs), etc. Because LLMs are trained autoregres- sively, they can memorize and later generate these undesir- able snippets (Dong et al. 2024), exposing users to legal risk, security breaches, fragile legacy code, and so on. Empir- ical studies show that up to 40% of LLM-generated code contains exploitable vulnerabilities (He et al. 2024), while a wave of high-profile lawsuits accuses leading LLMs of vi- olating the copyright of the developers (Zhang et al. 2024a; Butterick 2022). Purging every problematic code snippet from training corpora and retraining the LLMs from scratch would be straightforward and ideal, yet the cost is obviously unac- ceptable. A practical alternative is to force the LLMs to se- lectively forget what it was never meant to know, which is the objective known as unlearning (Yao, Xu, and Liu 2024; Liu et al. 2025). Given a functional LLM, unlearning algo- rithms behave like erasers:❶ they excise the influence of the undesirable samples from the target LLM, while❷ leaving all other knowledge and capabilities intact. Existing LLM unlearning methods (Yao, Xu, and Liu 2024; Zhang et al. 2024b; Rafailov et al. 2023; Wang et al. 2025) typically op- timize the model to suppress the likelihood of undesirable outputs by reversing the gradient descent process upon un- desirable contents or setting them as negative samples (Liu et al. 2025; Yao, Xu, and Liu 2024; Zhang et al. 2024b; Rafailov et al. 2023; Wang et al. 2025). e.g., Gradient As- cent (GA) (Yao, Xu, and Liu 2024) tunes parameters uphill on samples to be forgotten. For natural language tasks, such methods have been demonstrated effective in excising toxic responses, secret leakage, or policy-violating answers with- out impairing general capabilities significantly. Programming languages, however, are bound by rigid syntax, along with strict semantics. When existing unlearn- ing methods directly down-weighting undesirable code snip- pets, they also strip the language scaffolding that keeps the surrounding code valid. It results in direct utility loss: syntax errors and grammar errors occur, high-frequency tokens re- peat, or even the LLMs fall mute. Our pilot empirical study arXiv:2506.17125v2 [cs.SE] 24 Nov 2025 confirms such an issue (see Figure 1): after manipulated by existing unlearning techniques, the target LLMs frequently violate programming language rules or emit nonsensical code snippets. We argue that the root cause here is granular- ity, i.e., current techniques erase entire slices of knowledge (i.e., the undesirable snippets), damaging the foundational grammar and universal coding patterns the model once mas- tered through pre-training. Therefore, the open challenge is to eliminate only the offending snippets with surgical preci- sion (maximize forget quality, i.e., the degree that the unde- sirable contents are eliminated) while leaving model utility (i.e., the general performance of the target LLM) intact. We introduce Probabilistic Redistribution for Output Distribution (abbreviated as PROD), a surgical, code- oriented unlearning method that forgets code snippets that must be forgotten while leaving all other knowledge of programming languages intact. Unlike existing unlearning approaches, which operate at the granularity of samples, PROD manipulates distributions over individual tokens in a fine-grained granularity. PROD first captures the full dis- tribution over vocabulary predicted by the target LLM, then surgically zeroes out every probability mass assigned to tokens in the undesirable snippet. After pruning inciden- tal noises, it reallocates the probability distribution across the remaining vocabulary in a manner that faithfully pre- serves statistics of programming languages learned by the target LLM. By optimizing the model to match this care- fully sculpted target distribution, PROD attains near-perfect forgetting of the targeted code while effectively maintain- ing its utility unchanged. We also propose a benchmark for source code unlearning along with a metric, Pareto Domi- nance Ratio (PDR). The benchmark covers three tasks:❶ copyrighted code unlearning, where the goal is to remove copyrighted code snippets from LLMs;❷ insecure code un- learning, which aims to avoid security vulnerabilities pro- duced by LLMs;❸ deprecated API unlearning, which pre- vents LLMs from generating APIs from outdated libraries or packages. PDR metric evaluates unlearning approaches by considering both forget quality and model utility. Our in-depth evaluation over the three unlearning tasks shows that PROD achieves the best PDR score, sug- gesting its best overall performance between forget qual- ity and model utility. Experiments on four distinct LLMs (i.e., CodeLlama-7B, Qwen2.5-Coder-7B, Deepseek-coder- 6.7, Starcoder-7B) demonstrate the broad applicability of PROD. Adversarial attack experiment further reveals that PROD is the only unlearning method among existing LLM unlearning methods resilient against targeted attacks without reproducing forgotten codes. Our main contributions are highlighted as follows: • We conduct an investigation of existing LLM unlearn- ing approaches on code-related tasks, revealing that they lead to severe model utility degradation, making models practically unusable for code generation. • We propose a novel unlearning approach PROD, that can precisely forget undesired code snippets and preserve knowledge of programming languages intact in LLMs. • We identify three critical unlearning applications in the code generation domain (including copyrighted code un- learning, insecure code unlearning, and deprecated API unlearning) and establish a benchmark for evaluating LLM unlearning approaches for code. • Extensive experimental results demonstrate that PROD significantly outperforms existing LLM unlearning ap- proaches, achieving successful forgetting of specific code while effectively preserving code generation capabili- ties. Our source code and data are available at https: //github.com/jiangxxxue/PROD. Related Work In this section, we outline the most relevant work of PROD and detail the extended related work section in Appendix. Code Generation with LLMs Code generation has been significantly advanced by LLMs, from general-purpose LLMs like GPT-4 (Achiam et al. 2023) to a variety of specialized code LLMs (Du et al. 2024; Rozi ` ere et al. 2023; Zhu et al. 2024; Hui et al. 2024; Team 2024). However, their training on vast, public code reposi- tories introduces critical challenges regarding security, reli- ability, and legality. A primary concern is that LLMs may replicate vulnerabilities. To mitigate this, researchers have explored security-focused fine-tuning with curated datasets (SaferCode (He et al. 2024)) and in-context learning with se- cure examples (Mohsin et al. 2024). Beyond security, model reliability is undermined by poor handling of software ver- sions. Studies show that LLMs often suggest deprecated APIs (SecuCoGen (Wang et al. 2024)) and struggle with API changes across different library releases, a challenge highlighted by the VersiCode benchmark (Wu et al. 2024). Finally, legal issues arise from models generating code that may violate software licenses, as systematically evaluated by LiCoEval (Xu et al. 2025). These works highlight that despite remarkable progress, LLM-based code generation still falls short of developers’ expectations for producing secure, legally compliant, and up-to-date code. Our work aims to address this gap by proposing a general unlearning approach for suppressing un- desired code output from LLMs. LLM Unlearning Machine unlearning aims to remove the influence of spe- cific data from a trained model (Cao and Yang 2015). Ini- tial research primarily focused on classification models (Go- latkar, Achille, and Soatto 2020; Izzo et al. 2021; Bourtoule et al. 2021), with methods broadly categorized into data- reversed training (Tarun et al. 2024; Chundawat et al. 2023), influence function-based approaches (Izzo et al. 2021), and optimization-based unlearning (Guo et al. 2020; Neel, Roth, and Sharifi-Malvajerdi 2021). The vast scale and generative nature of LLMs present unique challenges, rendering many traditional methods im- practical (Liu et al. 2025). Specifically, the computational cost of Hessian inversion makes influence function-based methods prohibitive for LLMs. Consequently, recent work has shifted towards optimization-based techniques tailored for LLMs in the NLP domain. Methods such as GA (Yao, Xu, and Liu 2024), DPO-based unlearning (Rafailov et al. 2023), NPO (Zhang et al. 2024b), and FLAT (Wang et al. 2025) have been proposed to erase private data, copyrighted material, and harmful content. The evaluation of these tech- niques relies on specialized benchmarks (Maini et al. 2024; Yao, Xu, and Liu 2023) and is often tested for robustness against adversarial attacks like prefix injections (Wei, Hagh- talab, and Steinhardt 2023; Yuan et al. 2024; Qi et al. 2025). Given that source code possesses unique characteristics compared to natural language, although the exploration of LLM unlearning in NLP has proven its value, its application in code generation remains largely unexplored. Preliminary of LLM Unlearning In this section, we first formalize the LLM unlearning prob- lem and establish the evaluation criteria. Next, we briefly survey four representative baselines that span current LLM unlearning paradigms. Finally, we conduct an empirical pi- lot study revealing that, on source code, existing baselines cause great losses in model utility, motivating the need for a more surgical solution. Objective of Unlearning. Within the broad landscape of machine unlearning, we focus on optimization-based meth- ods. Here, unlearning is a post-training procedure that re- moves the LLM’s ability to produce specific, undesirable code snippets. Let D f = x (i) f ,y (i) f N f i=1 , denote the set of such snippets, where each pair consists of a prompt x (i) f , and its undesirable completion y (i) f (note that the prompt x (i) f can be empty in cases such as the entire snippet y (i) f must be forgotten). After unlearning, the target LLM π Θ is supposed to assign zero probability to every undesirable y (i) f given x (i) f . Formally, we quantify this objective with the loss L f (π Θ (x f ),y f ) that measures the divergence between the LLM’s output π Θ (x (i) f ) and the undesirable output y (i) f . Un- learning is then cast as the following optimization: min Θ N f X i=1 −L f π Θ (x (i) f ),y (i) f ,(1) where maximizingL f forces π Θ to forget every undesirable y (i) f in D f , including copyrighted code, insecure fragment, or deprecated API invocation, etc. Notably,D f merely cap- tures behaviors we wish to eliminate, and samples in it do not have to appear verbatim in the original training data. Metrics. As aforementioned, unlearning requires to erase only what is undesirable or even harmful, and retain every- thing else. We therefore assess unlearning approaches along two axes:❶ Forget quality: the thoroughness with which π Θ eliminates the influence ofD f , measured by the degree of dissimilarity between the output of π Θ and y (i) f when prompted with x (i) f .❷ Model utility: the collateral side dam- age caused by the procedure, gauged by π Θ ’s retained per- formance on other general tasks and datasets. Assessing the ForgetQuality filelist=glob.glob('Masked User Paths') random.shuffle(filelist) begin =time.time() fori, f inenumerate(filelist): ifi==998: break Avoid generating thefollowingcopyrightedcode: withopen(f, "rb") asfin: result =fin.read() end =time.time() print("%.1fimages/s"%(998/(end -begin))) #GA: </code</pre</p></details></td</tr></tbody>... #NPO: print(‘ <SUF> <MID> <EOT> #FLAT: None #DPO: begin =time.time() ... do « end :=time.time() fmt.Printf("Loaded: %dimages in %fseconds ", total, <SUF>.Printf("Loading: %fimages/s ", total/(end-begin)) ... do « ... #Ours: print(':s '.format(f)) Promptof Copyrighted CodeUnlearning Task Output ModelUtility fromtyping importList defmean_absolute_deviation(numbers: List[float]) -> float: """ For a given list of input numbers, calculate Mean Absolute Deviation around the mean of this dataset. Mean Absolute Deviation is the average absolute difference between each element and a centerpoint(mean in this case): MAD = average | x -x_mean| >>> mean_absolute_deviation([1.0, 2.0, 3.0, 4.0]) 1.0 """ #GA: None #NPO: return_ <SUF><MID><EOT> #FLAT: return # 1. # 2. # 3. ... #DPO: sum: float=0.0 forn innumbers: sum+=abs(n -numbers[0]) <SUF> #Ours: mean =sum(numbers) /len(numbers) returnsum(abs(x -mean) forx innumbers) / len(numbers) PromptofCodeGenerationTask Output Figure 1: A case on the forget quality and model util- ity of existing method in unlearning code. Existing meth- ods (GA, NPO, FLAT, DPO) exhibit severe utility degrada- tion, such as mute refusal, token collapse, or syntactic inco- herence. PROD successfully unlearns copyrighted content while maintaining utility for general code generation tasks. balance between forget quality and model utility is essential due to their trade-off in unlearning methods. LLM Unlearning Solutions. Existing methods are almost exclusively tuned to optimize the forget objective in Equa- tion (1), and treat downstream utility as an after-thought, re- sulting in plausible damage.❶ Gradient Ascent (GA) (Yao, Xu, and Liu 2024) carries out a “reverse” of training by as- cending the loss onD f , pushing π Θ away from the param- eter region that supports undesirable generations.❷ Nega- tive Preference Optimization (NPO) (Zhang et al. 2024b), which is a variant of Direct Preference Optimization (DPO) (Rafailov et al. 2023), supplies only negative examples (i.e., (x (i) f ,y (i) f )) to repel π Θ from the unwanted distribution.❸ DPO is a general preference optimization method that, while not specifically designed for unlearning, can be adapted for this purpose by treating the content-to-be-forgotten as the “dispreferred” response.❹ Forget Data Only Loss Adjust- ment (FLAT) (Wang et al. 2025) formulates L f with f - divergence, enforcing π Θ to assign maximal probability to a hand-crafted refusal template (e.g., “I do not know”) while minimizing probability on each (x (i) f ,y (i) f ). A Motivating Example. To vividly show the collateral dam- age caused by existing unlearning methods on source code tasks, we conduct an empirical study. We benchmark the above-mentioned baselines on a copyrighted code unlearn- ing task and then measure their retained utility with a stan- dard code generation benchmark (detailed setups in the ex- periment section). As Figure 3 indicates, all baseline ap- proaches achieve ≈ 90% forgetting ratio, yet their success OriginalLLM ... ... ... ... ... ... ... UnlearnedLLM ... ... ... ... ... ... ... Forget Quality Model Utility Forget Data (Only) Avoids copyrighted code Promptcopyrighted code Reproduce copyrighted code Metrics Promptcopyrighted code Output Distribution풑 ForgetObjective in 푦 ! Noise (LongTail of 푝) Freeze during traning Target Distribution 풑 푻 PROD PDR Post - Training Output Distribution Collection Noise Elimination ForgetData Elimination Probabilistic Redistribution Unlearning Approach Model Optimization Figure 2: The PROD unlearning pipeline. The pipeline contains three key steps:❶ Suppress the probabilities of undesirable code snippets to zero.❷ Redistribute the probabilities across the remaining vocabulary.❸ Optimize the model to match the surgically sculpted target distribution. ratio on code generation degrades to near-zero when they reach best forget quality. In other words, these approaches successfully erase the undesirable snippets (i.e., copyrighted code) but simultaneously cause LLMs to forget how to pro- gram, i.e., such an outcome makes the target LLMs almost useless. Our motivation in this paper is precisely the op- posite, as we argue to excise the undesirable code snippets while leaving the target LLMs fully operational. A closer look at the baselines’ outputs (a case is presented in Figure1) reveals three dominant failure modes:❶ Mute Refusal: the model declines to produce code,❷ Token Col- lapse: the output degenerates into repetitive high-frequency tokens such as “ ” or training artifacts like “<SUF>”, and ❸ Syntactic Incoherence: the generated code violates fun- damental language rules and fails to compile or execute. These breakdowns arise from the baselines’ coarse granular- ity. By bluntly erasing every trace ofy (i) f fromπ Θ , they elim- inate not only the undesirable snippet but also the surround- ing “scaffolding”. Natural languages tolerate such collateral damage as they are much more flexible, yet programming languages, which are governed by rigid syntax and precise dependencies, do not. Once the supporting knowledge and structure are disturbed, the entire code generation capability collapses. To preserve utility while still forgetting, we intro- duce PROD, a surgical unlearning solution that manipulates the output distribution at token-level granularity instead of bluntly excising entire snippet sequences. PROD To protect model utility while guaranteeing forgetting, we introduce PROD, a surgically precise unlearning method that manipulates the LLM’s token-level output distributions. As illustrated in Figure 2 and formalized in Algorithm 1, the working pipeline of PROD consists of three steps.❶ Sup- press the probabilities predicted by the target LLM of to- kens that constitute the undesirable snippet to zero (i.e., re- move them from the output).❷ Redistribute the probabilities across the remaining vocabulary so that the resulting distri- bution mirrors the original statistical patterns and preserves knowledge that the LLM learn from the code corpora.❸ Op- timize the target LLM to match this surgically sculpted tar- get distribution. As a result, PROD achieves complete era- sure of undesirable or even harmful code with virtually no collateral damage to any other programming competency. Target Distribution Sculpting We begin by sculpting the target LLM’s output distribution into a precise supervisory signal that will steer the entire un- learning process of PROD. Output Distribution Collection. The initial step of PROD retrieves the LLM’s raw next-token distributions for each (x f ,y f ) pair 1 . Given a forget pair (x f ,y f ) with y f = (y f,1 ,· ,y f,L ), at time-step t, we feed the target LLM (π Θ ) the concatenation of the prompt x f and the preced- ing ground-truth prefix y f,<t = (y f,1 ,· ,y f,t−1 ) to ob- tain the logits h t ∈ R |V| , whereV refers to the vocabulary. A softmax converts the logits into the original distribution p t (·|x f ,y f,<t ). p t then serves as the canvas where the sub- sequent manipulations will be carried out. Forget Data Elimination. To prohibit any generation of the target sequence, PROD performs a single, decisive edit on h t at every t. The logit entry corresponding to the target to- ken y f,t is suppressed to−∞ as below: ˆ h t [j] = −∞,IfV[j] = y f,t , h t [j], Otherwise, (2) where [·] denotes vector indexing, andV[j] refers to the j-th token in the whole vocabulary V . A softmax normalization of ˆ h t would yield the eliminated distribution ˆp t (·|x f ,y f,<t ), which assigns zero probability to y f,t and redistributes its entire mass across the remaining vocabulary in exact pro- portion to their original likelihoods. Noise Elimination. Suppressing the target token y f,t can in- advertently amplify less probable, non-target tokens, inject- ing noise into ˆp t (·|x f ,y f,<t ). We therefore prune the tail (i.e., the noise) via nucleus sampling (Holtzman et al. 2020) with the threshold of p. LetS p denote the smallest set of to- kens whose cumulative probability under ˆp t reaches p. All logits outsideS p are then set to−∞: 1 For simplicity, the superscripts in x (i) f and y (i) f are omitted henceforth in this section. Algorithm 1: Pseudocode for PROD. Require: LLM π Θ ; forget setD f ; learning rate η; training epochs N ; hyperparameters p,α. Ensure: Unlearned LLM π ∗ Θ . 1: for epoch k = 1 to N do 2:for each (x f ,y f )∈D f do 3:Collect output distribution p(w|x f ,y f,<t ). 4:Compute ˆ h t to apply forget data elimination. 5:Compute e h t to perform noise elimination. 6:Compute probabilistic redistribution p T . 7:Calculate loss functionL PROD . 8:Θ k+1 = Θ k − η∇ Θ L PROD . 9:k ← k + 1 and Θ ∗ ← Θ k 10:end for 11: end for 12: return π ∗ Θ e h t [j] = ( ˆ h t [j], IfV[j]∈S p , −∞,Otherwise. (3) Only tokens withinS p receive redistributed probability, and the rest are eliminated as noise. The softmax normalization upon e h t results in noise-trimmed distribution ep t . Crucially, forget data elimination must precede noise elimination. Reversing the order would either retain target tokens or produce an overly sparse distribution. This two- step sequence ensures a clean unlearning process while pre- serving a robust, information-rich distribution over the sur- viving vocabulary. Probabilistic Redistribution. After excising both the target token y f,t and the noisy tail outside S p , e h t holds the remain- ing probability mass. PROD redistributes this mass across the surviving safe vocabulary (i.e.,S p ) through softmax, and therefore adopts ep t as the supervisory signal p T . Post-Training With the sculpted supervisory distribution p T = ep t , PROD optimizes the target LLM π Θ via standard cross-entropy loss, nudging its outputs to align with this sculpted distri- bution while preserving every other learned competency. Objective. The optimization objective of PROD is to mini- mize the lossL PROD , finalized as following: L PROD (x f ,y f ;π Θ ) =− L X t=1 X w∈V p T (w|·) logπ Θ (w|·), (4) where π Θ (·) refers to the actual output distribution of π Θ . The conditions (i.e., x f ,y f,<t ) are neglected for simplicity. In default design, PROD adopts cross-entropy. The frame- work is agnostic, i.e., KL (Kullback and Leibler 1951), JS (Lin 1991), or any other distributional divergence can be substituted seamlessly. Optimization. Any compatible optimizer, with gradient de- scent included, can be employed in PROD. Key Know-How of PROD In general, PROD provides two strengths.❶ Model util- ity preservation: the supervisory p T is a surgically sculpted clone of the original p t , excising only the undesirable or for- bidden snippets while leaving every other competency un- touched.❷ Efficient convergence: since p T remains close to the π Θ ’s initial output, the optimization process is fast, sta- ble, and light on compute. Furthermore, we elaborate on two implementation details. α-suppression. Although PROD excels in unlearning long code, early experiments revealed that short forget sequences y f often require more training steps since the supervisory signal is weak. To modulate the “forget strength”, we in- troduce the α-suppression trick and modify the supervisory signal p T as follows: p T (w|x f ,y f,<t ) = −α· p o (w|·), If w = y f,t , ep t (w|·),Otherwise, (5) where p o and ep t refers to the original and noise-trimmed dis- tributions, respectively. Still, some conditions are neglected for better presentation. α is a hyperparameter to control the degree of forget, i.e., setting α = 0 disables the trick (p T = ep t ); increasing α amplifies the negative pressure on y f , yielding a stronger unlearning signal. Note that while α- suppression introduces negative probability, it is harmless, or even beneficial, under the setting of cross-entropy as de- fined in Equation 4:❶ the remaining terms maintain the loss magnitude and gradient direction; and❷ the negative entry amplifies the penalty on the forget token without computa- tional issues. Training Stability. As training proceeds, π Θ ’s distribution drifts with every gradient step. If we recollected p o and re- computed p T on-the-fly, the supervisory signal would swing constantly, destabilizing the training process and risking col- lapse. To avoid such an issue, we freeze p o at its initial state, i.e., the distributions produced by the target LLM before un- learning, thereby guaranteeing a steady and reliable target throughout optimization. Evaluation We introduce a dedicated benchmark for code unlearning and report the main experimental results in this section. Please refer to the appendix for full implementation details and a perceptual quality study. Code Unlearning Benchmark Current unlearning benchmarks focus almost exclusively on natural language, leaving code generation unexamined. To fill this gap, we curate and adapt datasets into a code un- learning benchmark, paired with custom metrics. The bench- mark contains three unlearning tasks (i.e., copyrighted code, insecure code, and deprecated APIs) to measure forget qual- ity and a general code generation set to assess model utility. Copyrighted Code Unlearning. We randomly draw 100 files from the high-quality, deduplicated Stack corpus (Lozhkov et al. 2024) to serve as the forget set D f , simu- lating scenarios where users wish to purge copyrighted code 0.000.050.100.150.200.250.300.350.40 Model Utility 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Forget Quality Original Model GA DPO NPO FLAT Ours (a) Copyrighted Code Unlearning 0.000.050.100.150.200.250.300.350.40 Model Utility 0.4 0.5 0.6 0.7 0.8 0.9 Forget Quality (b) Insecure Code Unlearning 0.000.050.100.150.200.250.300.350.40 Model Utility 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Forget Quality (c) Deprecated API Unlearning Figure 3: Forget quality versus model utility across different unlearning tasks. Performance curves positioned closer to the upper-right corner indicate superior approach effectiveness. files from an LLM. To mimic copyright protection, test files, toy examples, and standard templates are filtered and dis- carded, retaining those with expressive form, such as sub- stantive implementations, business logic, and non-trivial al- gorithms. During unlearning, x f is empty and y f contains the full content of the retrieved file; when assessing forget quality, we prompt the target LLM with the first half of each file and evaluate against the other half. As the law of copy- right protects expression instead of ideas (Autry 2002; U.S. Copyright Office 2024), textual similarity is employed as an indicator of potential copyright infringement. Thus, the for- get quality score is measured by the complement of BLEU (Papineni et al. 2002) (i.e., 1− BLEU), where higher values indicate stronger erasure of the protected code snippets. Insecure Code Unlearning. CyberSecEval from Purple Llama (Bhatt et al. 2023) is a cybersecurity benchmark, con- taining 1,916 code snippets collected from open sources that exhibit 50 distinct CWE vulnerabilities (The MITRE Corpo- ration 2025) across eight programming languages. We adopt these snippets as our forget set D f . Evaluation proceeds in an autocomplete setup, i.e., given the code that precedes a known vulnerable segment (i.e., x f ), we prompt the model to continue and then inspect the continuation for security flaws (i.e., y f ). Forget quality is assessed by the average of two complementary indicators:❶ 1 − BLEU between the LLM’s generation and the vulnerable snippet, and❷ the pass rate under CyberSecEval’s built-in static analyzer, which de- tects any insecure lines. Deprecated API Unlearning. This task is curated atop Ver- sicode (Wu et al. 2024), which is a version-aware code- generation dataset. With the original dataset, we apply three additional preprocessing steps.❶ Version filtration dis- cards packages with ambiguous version constraints (e.g., >=2.1.0), retaining those with explicit version require- ments (e.g., ==2.1.0).❷ File filtration removes packages that have less than 3 snippets.❸ Temporal split designates a middle release as the deprecation boundary, labeling all in- vocations of APIs prior to that release as “deprecated” and the remainder as “still-valid.” The final dataset consists of 252 packages, 3,449 snippets in total (≈14 snippets and 10 distinct APIs per package). Unlearning is carried out on the Table 1: PDR (in %) among unlearning approaches. TaskGADPONPOFLATOurs Copyright15.33.60.60.041.8 Insecurity13.30.024.56.170.4 Deprecation31.520.651.60.058.0 deprecated APIs, and evaluated on the remaining still-valid ones. Given the code context immediately preceding an API call, we measure forget quality by exact-match accuracy. General Code Generation. Following prior work (He et al. 2024), we estimate model utility through HumanEval (Du et al. 2024), which is a widely used code generation bench- mark. We employ functional correctness verified against test cases as the indicator of model utility. Overall Performance Indicator. Forget quality and model utility often pull in opposite directions; naively averaging them or even independently assessing them overlooks the real trade-off. To make this multi-objective comparison ex- plicit, we introduce the Pareto Dominance Ratio (PDR). Let M = m 1 ,· ,m n be the set of evaluated unlearning methods and O = forget, utility the two objectives. For any method m i ∈M, PDR is defined as following: PDR(m i ) = m j ∈M\ m i | m i ≻ O m j |M|− 1 ,(6) where m i ≻ O m j means that m i Pareto-dominates m j , i.e., m i is no worse on both objectives and strictly better on at least one than m j . Geometrically, on a 2-D scatter of forget quality versus model utility, m i ≻ O m j places m i strictly to the upper-right of m j . PDR therefore reports the fraction of rival methods that m i dominates, yielding a single, inter- pretable summary of overall performance. Experimental Results Unlearning Performance. We benchmark PROD against four representative baselines (i.e., GA, DPO, NPO, and FLAT) on all three unlearning tasks. The target model is CodeLlama-7B (Rozi ` ere et al. 2023). Greedy decoding (zero 0123456789 0.0 0.2 0.4 0.6 0.8 1.0 Forget Quality CodeLlama-7B Qwen2.5-Coder-7B Deepseek-coder-6.7B Starcoder-7B 0123456789 Epochs 0.0 0.2 0.4 0.6 Model Utility Figure 4: Performance of PROD on different LLMs, where the dotted line represents the best model utility of baselines in achieving comparable (i.e., 90%) forget quality. temperature) is applied for every inference run. On each task, we compute PDR with forget quality (task-specific) and overall model utility (via HumanEval). Comprehensive results are presented in Table 1 and illustrated in Figure 3. PROD consistently occupies the upper-right region of the scatter plot (Figure 3), simultaneously delivering stronger forget quality and higher model utility than the baselines. The PDR metric (Table 1) also quantifies this dominance – PROD tops every task, yielding an average relative gain of 124% over the strongest competitor. Training dynamics of- fer further insight. By analyzing the training log, we find that PROD forgets rapidly during early steps and then gen- tly converges on both objectives, achieving high forgetting efficiency without triggering model collapse. The three tasks pose different levels of challenges, as the curve slope in Figure 3 varies with the volume of undesir- able content. Copyrighted code unlearning is the most chal- lenging from this point of view, because it requires LLMs to forget entire files. Remarkably, PROD retains a notable advantage even on this most difficult task. Application on Different LLMs. We extend our evalua- tion to four widely-used code LLMs (i.e., CodeLlama-7B (Rozi ` ere et al. 2023), Qwen2.5-Coder-7B (Hui et al. 2024), Deepseek-coder-6.7B (Zhu et al. 2024), and Starcoder-7B (Li et al. 2023)) to demonstrate the versatility of PROD across diverse architectures and training recipes. While holding all other experimental settings fixed, we track both forget quality and model utility over successive epochs on the copyrighted-code unlearning task. Figure 4 reveals a consistent pattern across all four LLMs. As training proceeds, each LLM attains near-perfect forget quality while its utility curve stabilizes, which significantly outperforms all baseline approaches in model utility. This uniformity underscores both the strength and robustness of PROD. Among the evaluated models, CodeLlama-7B and StarCoder-7B exhibit the mildest utility degradation, imply- ing that an LLM’s intrinsic stability can modulate the effec- GANPODPOFLATOurs 0.00 0.05 0.10 0.15 0.20 0.25 0.30 0.35 0.40 Effect of Attack Figure 5: Comparison of adversarial attack results across different LLM unlearning approaches, showing mean attack effects with maximum and minimum ranges. tiveness of unlearning. Adversarial Attacks Recent studies have exposed the brittleness of unlearning: forgotten content can resurface when an adversary manipulates the prompt (Yuan et al. 2024; Qi et al. 2025). We therefore assess PROD against prefix injection attack, following previous work (Qi et al. 2025). In such an attack, an adversary prepends an increas- ing number of tokens from the copyrighted snippet to the prompt in an attempt to recover the erased snippets. We con- duct this evaluation on the copyrighted code task against CodeLlama-7B and measure robustness with the drop in for- get quality. To ensure validity of the experiment (i.e., the model remains practically useful), we only evaluate check- points that retain at least 60% of the original LLM’s Hu- manEval performance. Figure 5 shows that PROD is significantly more robust under prefix injection attack than other baselines. Specifi- cally, the similarity between the generation and the undesir- able copyrighted code stays below 0.05, while others exceed 0.3. Moreover, PROD shows the smallest variance among baselines, underscoring its stable resilience against prefix in- ject attack. These results provide clear evidence that PROD delivers stronger and more reliable forgetting than baselines. Ablation Study. Finally, we perform some ablations. We re- place the default cross-entropy loss with two alternative di- vergence measures (i.e., KL and JS). We also systematically vary the key hyperparameters p, which governs the strength of noise elimination, and α, which scales the amplified sup- pression on forget data samples. From Figure 6a, we observe that Cross-entropy outper- forms both KL and JS divergence, delivering the best trade- off between forget quality and model utility. Figure 6b shows that the moderate noise elimination (p = 0.8) achieves opti- mal results, while no noise elimination yields the worst. Fig- ure 6c shows that α has a large impact on unlearning perfor- mance. When α = 0, which prohibits the generation of for- get data by setting its probability to zero in the target distri- bution, the model achieves the most balanced performance. Positive α values are beneficial for deepening the degree of forgetting, while small negative α values delay forgetting to maintain usability. 0.000.050.100.150.200.250.300.350.40 Model Utility 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Forget Quality Original Model KL Loss JS Loss Ours (a) Loss Function 0.000.050.100.150.200.250.300.350.40 Model Utility 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Forget Quality Original Model 0.2 0.4 0.8 0.9 1.0 (b) Hyperparameterp 0.000.050.100.150.200.250.300.350.40 Model Utility 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Forget Quality Original Model 1 0.5 0.25 0.125 0 -0.125 (c) Hyperparameter α Figure 6: Ablation results on alternative loss function, and the impact of hyperparameters p and α in PROD. Conclusion In this paper, we have investigated existing LLM unlearning approaches on source code, identifying a significant utility degradation problem. To this end, we propose PROD, a sur- gical, code-oriented unlearning method that forgets targeted code snippets while preserving other knowledge of program- ming languages intact. We also establish a benchmark cover- ing copyrighted code, insecure code, and deprecated API un- learning tasks. Extensive experiments show PROD signifi- cantly outperforms existing methods in both forgetting per- formance and user experience, while also exhibiting broad applicability and robustness against unlearning attacks. Acknowledgments This research is supported by the National Key R&D Pro- gram under Grant No. 2023YFB4503801, the National Natural Science Foundation of China under Grant No. 62192733, 62192730, 62192731, and the Major Program (JD) of Hubei Province (No.2023BAA024). References Achiam, J.; Adler, S.; Agarwal, S.; Ahmad, L.; Akkaya, I.; Aleman, F. L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774. Anthropic. 2024. Introducing Claude 3.5 Sonnet. Anthropic. 2025. Claude Code. Autry, J. R. 2002. Toward a definition of striking similarity in infringement actions for copyrighted musical works. J. Intell. Prop. L., 10: 113. Baumhauer, T.; Sch ̈ ottle, P.; and Zeppelzauer, M. 2022. Ma- chine unlearning: linear filtration for logit-based classifiers. Mach. Learn., 111(9): 3203–3226. Bhatt, M.; Chennabasappa, S.; Nikolaidis, C.; Wan, S.; Ev- timov, I.; Gabi, D.; Song, D.; Ahmad, F.; Aschermann, C.; Fontana, L.; Frolov, S.; Giri, R. P.; Kapil, D.; Kozyrakis, Y.; LeBlanc, D.; Milazzo, J.; Straumann, A.; Synnaeve, G.; Vontimitta, V.; Whitman, S.; and Saxe, J. 2023.Purple Llama CyberSecEval: A Secure Coding Benchmark for Lan- guage Models. CoRR, abs/2312.04724. Bourtoule, L.; Chandrasekaran, V.; Choquette-Choo, C. A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N. 2021. Machine Unlearning. In SP, 141–159. IEEE. Butterick, M. 2022. Butterick v. GitHub, Inc., Microsoft Corporation, and OpenAI, LP. U.S. District Court for the Northern District of California. Case No. 3:22-cv-07074, U.S. District Court for the Northern District of California. Cao, Y.; and Yang, J. 2015. Towards Making Systems Forget with Machine Unlearning. In IEEE Symposium on Security and Privacy, 463–480. IEEE Computer Society. Chundawat, V. S.; Tarun, A. K.; Mandal, M.; and Kankan- halli, M. S. 2023. Zero-Shot Machine Unlearning. IEEE Trans. Inf. Forensics Secur., 18: 2345–2354. Dong, Y.; Jiang, X.; Liu, H.; Jin, Z.; Gu, B.; Yang, M.; and Li, G. 2024. Generalization or Memorization: Data Con- tamination and Trustworthy Evaluation for Large Language Models. In Findings of the Association for Computational Linguistics: ACL 2024, 12039–12050. Association for Com- putational Linguistics. Dong, Y.; Jiang, X.; Qian, J.; Wang, T.; Zhang, K.; Jin, Z.; and Li, G. 2025. A Survey on Code Generation with LLM- based Agents. CoRR, abs/2508.00083. Du, X.; Liu, M.; Wang, K.; Wang, H.; Liu, J.; Chen, Y.; Feng, J.; Sha, C.; Peng, X.; and Lou, Y. 2024. Evaluating Large Language Models in Class-Level Code Generation. In Proceedings of the IEEE/ACM 46th International Con- ference on Software Engineering. Fu, Y.; Liang, P.; Tahir, A.; Li, Z.; Shahin, M.; Yu, J.; and Chen, J. 2025. Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study. ACM Trans. Softw. Eng. Methodol. GitHub. 2022. Copilot. Golatkar, A.; Achille, A.; and Soatto, S. 2020. Eternal Sun- shine of the Spotless Net: Selective Forgetting in Deep Net- works. In CVPR, 9301–9309. Computer Vision Foundation / IEEE. Guo, C.; Goldstein, T.; Hannun, A. Y.; and van der Maaten, L. 2020. Certified Data Removal from Machine Learning Models. In ICML, volume 119, 3832–3842. He, J.; Vero, M.; Krasnopolska, G.; and Vechev, M. 2024. In- struction tuning for secure code generation. In Proceedings of the 41st International Conference on Machine Learning. JMLR.org. Hoffmann, J.; Borgeaud, S.; Mensch, A.; Buchatskaya, E.; Cai, T.; Rutherford, E.; Casas, D. d. L.; Hendricks, L. A.; Welbl, J.; Clark, A.; et al. 2022. Training compute-optimal large language models. arXiv preprint arXiv:2203.15556. Holtzman, A.; Buys, J.; Du, L.; Forbes, M.; and Choi, Y. 2020. The Curious Case of Neural Text Degeneration. In ICLR. OpenReview.net. Hui, B.; Yang, J.; Cui, Z.; Yang, J.; Liu, D.; Zhang, L.; Liu, T.; Zhang, J.; Yu, B.; Dang, K.; et al. 2024. Qwen2. 5-coder technical report. arXiv preprint arXiv:2409.12186. Izzo, Z.; Smart, M. A.; Chaudhuri, K.; and Zou, J. 2021. Ap- proximate Data Deletion from Machine Learning Models. In Banerjee, A.; and Fukumizu, K., eds., The 24th International Conference on Artificial Intelligence and Statistics, AISTATS 2021, April 13-15, 2021, Virtual Event, volume 130, 2008– 2016. PMLR. Jiang, X.; Dong, Y.; Liu, M.; Deng, H.; Wang, T.; Tao, Y.; Cao, R.; Li, B.; Jin, Z.; Jiao, W.; et al. 2025. CodeRL+: Im- proving Code Generation via Reinforcement with Execution Semantics Alignment. arXiv preprint arXiv:2510.18471. Kaplan, J.; McCandlish, S.; Henighan, T.; Brown, T. B.; Chess, B.; Child, R.; Gray, S.; Radford, A.; Wu, J.; and Amodei, D. 2020. Scaling laws for neural language mod- els. arXiv preprint arXiv:2001.08361. Kullback, S.; and Leibler, R. A. 1951. On Information and Sufficiency. The Annals of Mathematical Statistics, 22(1): 79–86. Li, R.; allal, L. B.; Zi, Y.; Muennighoff, N.; Kocetkov, D.; Mou, C.; Marone, M.; Akiki, C.; LI, J.; Chim, J.; Liu, Q.; Zheltonozhskii, E.; Zhuo, T. Y.; Wang, T.; Dehaene, O.; Lamy-Poirier, J.; Monteiro, J.; Gontier, N.; Yee, M.-H.; Umapathi, L. K.; Zhu, J.; Lipkin, B.; Oblokulov, M.; Wang, Z.; Murthy, R.; Stillerman, J. T.; Patel, S. S.; Abulkhanov, D.; Zocca, M.; Dey, M.; Zhang, Z.; Bhattacharyya, U.; Yu, W.; Luccioni, S.; Villegas, P.; Zhdanov, F.; Lee, T.; Timor, N.; Ding, J.; Schlesinger, C. S.; Schoelkopf, H.; Ebert, J.; Dao, T.; Mishra, M.; Gu, A.; Anderson, C. J.; Dolan-Gavitt, B.; Contractor, D.; Reddy, S.; Fried, D.; Bahdanau, D.; Jer- nite, Y.; Ferrandis, C. M.; Hughes, S.; Wolf, T.; Guha, A.; Werra, L. V.; and de Vries, H. 2023. StarCoder: may the source be with you! Transactions on Machine Learning Re- search. Li, Y.; Choi, D.; Chung, J.; Kushman, N.; Schrittwieser, J.; Leblond, R.; Eccles, T.; Keeling, J.; Gimeno, F.; Dal Lago, A.; et al. 2022. Competition-level code generation with al- phacode. Science, 378(6624): 1092–1097. Lin, J. 1991. Divergence Measures Based on the Shannon Entropy. IEEE Transactions on Information Theory, 37(1): 145–151. Liu, S.; Yao, Y.; Jia, J.; Casper, S.; Baracaldo, N.; Hase, P.; Yao, Y.; Liu, C. Y.; Xu, X.; Li, H.; Varshney, K. R.; Bansal, M.; Koyejo, S.; and Liu, Y. 2025. Rethinking machine un- learning for large language models. Nat. Mac. Intell., 7(2): 181–194. Liu, Y.; Fan, M.; Chen, C.; Liu, X.; Ma, Z.; Wang, L.; and Ma, J. 2022. Backdoor Defense with Machine Unlearning. In IEEE INFOCOM 2022 - IEEE Conference on Computer Communications, London, United Kingdom, May 2-5, 2022, 280–289. IEEE. Liu, Y.; Iter, D.; Xu, Y.; Wang, S.; Xu, R.; and Zhu, C. 2023. G-Eval: NLG Evaluation using Gpt-4 with Better Hu- man Alignment. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2511– 2522. Association for Computational Linguistics. Loshchilov, I.; and Hutter, F. 2017. Fixing Weight Decay Regularization in Adam. CoRR, abs/1711.05101. Lozhkov, A.; Li, R.; Allal, L. B.; Cassano, F.; Lamy-Poirier, J.; Tazi, N.; Tang, A.; Pykhtar, D.; Liu, J.; Wei, Y.; et al. 2024. StarCoder 2 and The Stack v2: The Next Generation. arXiv preprint arXiv:2402.19173. Macketanz, V.; Naderi, B.; Schmidt, S.; and M ̈ oller, S. 2022. Perceptual Quality Dimensions of Machine-Generated Text with a Focus on Machine Translation. In Proceedings of the 2nd Workshop on Human Evaluation of NLP Systems (HumEval), 24–31. Association for Computational Linguis- tics. Maini, P.; Feng, Z.; Schwarzschild, A.; Lipton, Z. C.; and Kolter, J. Z. 2024. TOFU: A Task of Fictitious Unlearning for LLMs. CoRR, abs/2401.06121. Mohsin, A.; Janicke, H.; Wood, A.; Sarker, I. H.; Maglaras, L.; and Janjua, N. 2024. Can we trust large language models generated code? a framework for in-context learning, secu- rity patterns, and code evaluations across diverse llms. arXiv preprint arXiv:2406.12513. Neel, S.; Roth, A.; and Sharifi-Malvajerdi, S. 2021. Descent- to-Delete: Gradient-Based Methods for Machine Unlearn- ing. In ALT, volume 132, 931–962. PMLR. Papineni, K.; Roukos, S.; Ward, T.; and Zhu, W. 2002. Bleu: a Method for Automatic Evaluation of Machine Translation. In ACL, 311–318. ACL. Qi, X.; Panda, A.; Lyu, K.; Ma, X.; Roy, S.; Beirami, A.; Mittal, P.; and Henderson, P. 2025. Safety Alignment Should be Made More Than Just a Few Tokens Deep. In The Thir- teenth International Conference on Learning Representa- tions. Rafailov, R.; Sharma, A.; Mitchell, E.; Manning, C. D.; Er- mon, S.; and Finn, C. 2023. Direct Preference Optimiza- tion: Your Language Model is Secretly a Reward Model. In Thirty-seventh Conference on Neural Information Process- ing Systems. Rozi ` ere, B.; Gehring, J.; Gloeckle, F.; Sootla, S.; Gat, I.; Tan, X. E.; Adi, Y.; Liu, J.; Remez, T.; Rapin, J.; Kozhevnikov, A.; Evtimov, I.; Bitton, J.; Bhatt, M.; Canton-Ferrer, C.; Grattafiori, A.; Xiong, W.; D ́ efossez, A.; Copet, J.; Azhar, F.; Touvron, H.; Martin, L.; Usunier, N.; Scialom, T.; and Synnaeve, G. 2023. Code Llama: Open Foundation Models for Code. CoRR, abs/2308.12950. Schelter, S.; Grafberger, S.; and Dunning, T. 2021. Hedge- Cut: Maintaining Randomised Trees for Low-Latency Ma- chine Unlearning. In SIGMOD Conference, 1545–1557. ACM. Sekhari, A.; Acharya, J.; Kamath, G.; and Suresh, A. T. 2021. Remember What You Want to Forget: Algorithms for Machine Unlearning. In NeurIPS, 18075–18086. Tarun, A. K.; Chundawat, V. S.; Mandal, M.; and Kankan- halli, M. S. 2024. Fast Yet Effective Machine Unlearning. IEEE Trans. Neural Networks Learn. Syst., 35(9): 13046– 13055. Team, C. 2024. Codegemma: Open code models based on gemma. arXiv preprint arXiv:2406.11409. The MITRE Corporation. 2025. Common Weakness Enu- meration (CWE). https://cwe.mitre.org/. Accessed: August 1, 2025. U.S. Copyright Office. 2024. What does copyright protect? Wang, C.; Huang, K.; Zhang, J.; Feng, Y.; Zhang, L.; Liu, Y.; and Peng, X. 2024. How and Why LLMs Use Deprecated APIs in Code Completion? An Empirical Study. CoRR, abs/2406.09834. Wang, Y.; Wei, J.; Liu, C. Y.; Pang, J.; Liu, Q.; Shah, A.; Bao, Y.; Liu, Y.; and Wei, W. 2025. LLM Unlearning via Loss Adjustment with Only Forget Data. In The Thirteenth International Conference on Learning Representations. Wei, A.; Haghtalab, N.; and Steinhardt, J. 2023. Jailbroken: How Does LLM Safety Training Fail? In NeurIPS. Wu, T.; Wu, W.; Wang, X.; Xu, K.; Ma, S.; Jiang, B.; Yang, P.; Xing, Z.; Li, Y.-F.; and Haffari, G. 2024. Versicode: To- wards version-controllable code generation. arXiv preprint arXiv:2406.07411. Xu, W.; Gao, K.; He, H.; and Zhou, M. 2025. LiCoEval: Evaluating LLMs on License Compliance in Code Genera- tion . In 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE), 589–589. Yao, Y.; Xu, X.; and Liu, Y. 2023. Large Language Model Unlearning. CoRR, abs/2310.10683. Yao, Y.; Xu, X.; and Liu, Y. 2024. Large Language Model Unlearning. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. Yuan, H.; Jin, Z.; Cao, P.; Chen, Y.; Liu, K.; and Zhao, J. 2024.Towards Robust Knowledge Unlearning: An Adversarial Framework for Assessing and Improving Un- learning Robustness in Large Language Models. CoRR, abs/2408.10682. Zhang, D.; Finckenberg-Broman, P.; Hoang, T.; Pan, S.; Xing, Z.; Staples, M.; and Xu, X. 2024a. Right to be forgot- ten in the era of large language models: Implications, chal- lenges, and solutions. AI and Ethics, 1–10. Zhang, R.; Lin, L.; Bai, Y.; and Mei, S. 2024b. Negative Preference Optimization: From Catastrophic Collapse to Ef- fective Unlearning. In First Conference on Language Mod- eling. Zhang, Z.; Li, C.; Sun, W.; Liu, X.; Min, X.; and Zhai, G. 2023. A Perceptual Quality Assessment Exploration for AIGC Images. In ICME Workshops, 440–445. IEEE. Zhu, Q.; Guo, D.; Shao, Z.; Yang, D.; Wang, P.; Xu, R.; Wu, Y.; Li, Y.; Gao, H.; Ma, S.; et al. 2024. DeepSeek-Coder- V2: Breaking the Barrier of Closed-Source Models in Code Intelligence. arXiv preprint arXiv:2406.11931. Preliminaries on LLM Unlearning Approaches Gradient Ascent (GA) (Yao, Xu, and Liu 2024). As a sim- ple and widely used unlearning approach, GA (Yao, Xu, and Liu 2024) performs gradient ascent on next-token prediction loss over the target forget data to approximately ”reverse” the effects of gradient descent optimization that occurred during training on the forget data, formally denoted as L GA . L GA (Θ) =− E D f [− log(π Θ (y f |x f ))] | z prediction loss = E D f [log(π Θ (y f |x f ))]. (7) However, GA suffers from divergent properties and exces- sively rapid linear convergence rates, resulting in unstable training dynamics and potential model collapse. NPO is de- veloped to address the limitation. NPO is inspired by DPO, which is a well-established approach in the field of LLM preference optimization. Direct Preference Optimization (DPO) (Rafailov et al. 2023). DPO enables the model to learn to increase the prob- ability of preferred responses y w while decreasing the prob- ability of non-preferred responses y l , all while optimizing under the constraint of staying close to a reference model. The loss functionL DPO (Θ) is defined as: L DPO (Θ) =−E (x,y w ,y l ) logσ β log π Θ (y w |x) π ref (y w |x) − log π Θ (y l |x) π ref (y l |x) , (8) where (x,y w ,y l ) represents the training data triplets: prompt, preferred response, and non-preferred response, π Θ is the model being trained, π ref is the reference model (typ- ically the initial LLMs for training), β is a hyperparame- ter that controls the degree of deviation from the reference model and σ is the sigmoid function. Although DPO is originally designed for LLM preference optimization, researchers have discovered that it can be ap- plied to unlearning tasks by providing template responses y e (such as ”I don’t know”) as the preferred response y w , and y f as non-preferred response y l . Negative Preference Optimization (NPO) (Zhang et al. 2024b). Since unlearning tasks typically only provide neg- ative samples (i.e., forget data), NPO retains only the log- probability ratio for non-preferred responses from the DPO formulation to steer the model away from generating unde- sired content. The NPO loss functionL NPO (Θ) is defined as: L NPO (Θ) =−E (x f ,y f ) logσ β − log π Θ (y f |x f ) π ref (y f |x f ) , (9) where NPO leverages the structural advantages of the DPO loss formulation (specifically the logσ transformation and the regularization provided by π ref ) to achieve logarithmic convergence rates, which typically yields more stable train- ing dynamics compared to GA approach. Forget Data Only Loss Adjustment (FLAT) (Wang et al. 2025). FLAT proposes to use a loss function that bal- ances two key objectives: discouraging the generation of un- desirable responses to forget data y f while simultaneously promoting the production of appropriate template responses y e when encountering relevant forget prompts, L FLAT (Θ) =−λ f ·L f (x f ,y f ; Θ)+λ e ·L e (x f ,y e ; Θ), (10) whereλ f andλ e are wight to balance betweenL e (x f ,y e ; Θ) and L f (x f ,y f ; Θ). FLAT introduces f-divergence to estab- lish an appropriate equilibrium between the two objectives. The loss function is subsequently reformulated into a varia- tional form of f-divergence: L FD FLAT (Θ) =−E (x f ,y e ,y f ) [g ∗ (P(x f ,y e ; Θ)) + f ∗ (g ∗ (P(x f ,y f ; Θ)))], P(x f ,y; Θ) = 1 |y| |y| X t=1 π Θ (y 1:t | x f ) π Θ (y 1:t−1 | x f ) , (11) where y represents the template answer y e or y f , and y 1:t denotes the first t tokens of the sequence y. FLAT automati- cally assigns appropriate weights g ∗ and f ∗ (g ∗ ()) to the loss components. f-divergence is a divergence framework that in- cludes various divergence measures, such as the Kullback- Leibler (KL) divergence, Jensen-Shannon (JS) divergence, and Pearson divergence. g ∗ and f ∗ (g ∗ ()) can be configured according to the specific divergence measure chosen. Implementation Details We detail the specific implementation details of our evalua- tion from three aspects. Specifically, Configurations for Downstream Tasks. For copyrighted code unlearning and insecure code unlearning tasks, fol- lowing previous unlearning work (Yao, Xu, and Liu 2024; Zhang et al. 2024b; Wang et al. 2025), we first train the model on forget data D F G to ensure the model has memo- rized the content before applying unlearning approaches. We use a learning rate of 2e-5, a batch size of 32, and train for 10 epochs. To prevent overfitting on D F G during training, we employ continued pretraining to train the model, where in each epoch, the forget data is mixed with different pretrain- ing data in a ratio of approximately 1:9, which is a subset of The Stack corpus. For deprecated API unlearning task, we directly apply LLM unlearning approaches on the LLMs without training on forget data. This is because the APIs we target in this task are common functions from widely used libraries that LLMs have basically encountered during pre- training. Training Setup for Unlearning. We use CodeLlama-7B (Rozi ` ere et al. 2023) as our base model by default for our evaluation. All experiments are conducted on 4 NVIDIA A100 GPUs. Following previous work (Zhang et al. 2024b), we set the batch size to 32 and train for 10 epochs. For all unlearning approaches, we select the learning rate via grid search from the set 1e-4, 5e-5, 1e-5, 5e-6, 1e-6, op- timizing for the forget quality metric on forget data. We use AdamW optimizer (Loshchilov and Hutter 2017) with a weight decay of 0.01 and set the maximum sequence length to 1024 tokens during training. During training, we only op- timize the loss over the forgetting part of each example. The unlearning training is conducted five times using different random seeds, and the final evaluation results are averaged across the five runs. Configurations for Baselines and PROD. NPO and DPO use the hyperparameter β of 0.1. FLAT employs KL divergence in its loss, which demonstrated superior perfor- mance in the original study, where g ∗ (v) = v and f ∗ (u) = e u−1 . For our approach PROD, we set p and α to 0.8 and 0, respectively. Perceptual Quality Evaluation Following the work (Macketanz et al. 2022; Zhang et al. 2023), we conduct a perceptual quality evaluation to assess the subjective human experience of our approach. Setup. We invite three independent volunteer evaluators (each with two years or more of software development ex- perience). We randomly select 20 samples from each of the three downstream tasks, including generation results from different approaches. The evaluation is conducted in a com- parative manner, where evaluators are presented with sam- ples from our approach and baseline approaches, and asked to select the better one with a justification. Each human eval- uator assesses all samples without knowing which approach produced each sample. We calculate the win rate of our ap- proach against baselines. The win rate is calculated as the total number of times our approach outperformed baselines divided by the total number of comparisons in the evalua- tion. Given that human evaluation can only assess a limited portion of samples due to practical constraints, and recent research suggests that LLMs can substitute human evalua- tion to some extent with high evaluation consistency (Liu et al. 2023), we introduced GPT-4 to evaluate all samples across all downstream tasks. Table 2: Win rate comparison on perceptual evaluation. ComparisonHuman EvaluationGPT-4 Evaluation Ours vs GA81%77% Ours vs DPO92%86% Ours vs NPO76%73% Ours vs FLAT87%81% Results. The results of the perceptual quality evaluation are shown in Figure 2. We find that our approach achieves win rates above 70% compared to baselines. According to the reasons provided by human evaluators, the common feedback was that our approach still produced valuable out- puts after forgetting specific content, while baselines often produced empty outputs or messy code. Extended Related Work Code Generation with LLMs Code generation is the computational process of automat- ically producing executable source code from specifica- tions or natural language inputs. Generative models such as ChatGPT (Achiam et al. 2023) and Claude (Anthropic 2024) have demonstrated strong capabilities in code gen- eration, benefiting from pretraining on large-scale data and code repositories. Given the immense potential of LLMs, re- searchers have developed code-specialized LLMs, such as CodeX (Du et al. 2024), CodeLlama (Rozi ` ere et al. 2023), DeepSeek-Coder (Zhu et al. 2024), Qwen2.5 Coder (Hui et al. 2024), and CodeGemma (Team 2024), which further enhanced LLMs’ capabilities across various software devel- opment tasks. However, several critical challenges remain unresolved in leveraging LLMs for code generation, includ- ing concerns about safety, legality, and reliability. Recently, an emerging concern is that LLM-generated code may inadvertently violate security best practices. Be- cause LLMs learn from massive public code repositories, many of which include buggy or outdated patterns, they can propagate known vulnerabilities or poor coding habits. Re- searchers have begun exploring security-focused code gen- eration techniques (He et al. 2024; Mohsin et al. 2024; Wu et al. 2024; Wang et al. 2024; Xu et al. 2025; Fu et al. 2025). Representative approaches include SaferCode (He et al. 2024), which augments LLM training with care- fully curated secure code datasets, and work (Mohsin et al. 2024), which proposes incorporating security examples di- rectly into prompts to avoid unsafe coding patterns. Be- yond security issues, VersiCode (Wu et al. 2024) introduces a version-specific benchmark to evaluate how models han- dle API changes across different releases, revealing that version-controllable code generation poses significant chal- lenges. Failing to adapt can lead to functional errors and long-term maintenance issues. Similarly, SecuCoGen (Wang et al. 2024) systematically analyzes deprecated API usage in LLM-based code completion. Testing seven advanced mod- els on over 28k prompts and 145 API changes, they observe a substantial rate of outdated suggestions, indicating that many LLMs fail to migrate to newer APIs. Additionally, copyright concerns have also been raised regarding LLM- generated code. LiCoEval (Xu et al. 2025) systematically evaluates LLMs’ license compliance and finds that mod- els sometimes produce code fragments that closely resemble copyrighted implementations, often without proper attribu- tion. These limitations highlight that despite remarkable progress, LLM-based code generation still falls short of de- velopers’ expectations for producing secure, legally compli- ant, and up-to-date code. Our work aims to address these gaps by proposing an effective unlearning approach for sup- pressing undesired code output from LLMs. LLM Unlearning Machine unlearning, the process of removing specific data and its influence from a trained machine learning model, has garnered significant attention in recent years. Since (Cao and Yang 2015) first introduced the concept of machine unlearn- ing, laying the groundwork for subsequent research. Due to the widespread application and the relative simplicity of classification models, they become the focal point for most of the machine unlearning works (Golatkar, Achille, and Soatto 2020; Baumhauer, Sch ̈ ottle, and Zeppelzauer 2022; Izzo et al. 2021; Schelter, Grafberger, and Dunning 2021; Bourtoule et al. 2021; Sekhari et al. 2021). Machine un- learning approaches can be broadly categorized into three types: data-reversed training (Tarun et al. 2024; Liu et al. 2022; Chundawat et al. 2023), influence function based ap- proaches (Izzo et al. 2021), and optimization based unlearn- ing (Guo et al. 2020; Neel, Roth, and Sharifi-Malvajerdi 2021). Data-reversed training techniques employ noise in- jection to reverse or weaken the model’s memory and depen- dence on specific data. Influence function-based approaches evaluate the impact of training samples on the model by perturbing model parameters, which are less common in LLM unlearning due to the computational complexity of Hessian matrix inversion. Optimization-based unlearning, which is the focus of our work, achieves forgetting through direct model optimization. The rapid advancement of LLMs presents more significant challenges for machine unlearn- ing. Their massive parameter scales and generative nature make traditional unlearning approaches unsuitable (Liu et al. 2025). Recent research efforts have been dedicated to the domain of LLM unlearning within the field of NLP, propos- ing methods such as GA (Yao, Xu, and Liu 2024), DPO (Rafailov et al. 2023), NPO (Zhang et al. 2024b), and FLAT (Wang et al. 2025), which aim to address forgetting tasks in the field of NLP, such as user privacy unlearning, copy- righted books unlearning, and harmful content unlearning (Yao, Xu, and Liu 2024). To facilitate the evaluation of LLM unlearning, several benchmarks have been proposed. These include synthetic profiles and question-answer pairs about fictitious authors (Maini et al. 2024), as well as the forgetting of specific content like Harry Potter books (Yao, Xu, and Liu 2023). Moreover, to assess the vulnerabilities of unlearned models, various attack approaches have been employed, such as prefix injections (Wei, Haghtalab, and Steinhardt 2023; Yuan et al. 2024; Qi et al. 2025). These at- tacks help researchers understand the robustness of unlearn- ing techniques and identify areas for improvement. Given that source code possesses unique characteristics compared to natural language, although the exploration of LLM unlearning in NLP has proven its value, its applica- tion in code generation remains largely unexplored. This ne- cessitates the development of LLM unlearning approaches applicable to code to address the challenges.