Paper deep dive
VLA-Forget: Vision-Language-Action Unlearning for Embodied Foundation Models
Ravi Ranjan, Agoritsa Polyzou
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 4/10/2026, 2:30:55 AM
Summary
VLA-Forget is a hybrid unlearning framework for Vision-Language-Action (VLA) models that enables the removal of unsafe, spurious, or privacy-sensitive behaviors. It employs a staged, component-aware approach using ratio-aware selective editing for perception and cross-modal modules, combined with significance-based layer-selective unlearning for reasoning and action-generating transformer blocks. The framework optimizes targeted forgetting, perceptual preservation, and reasoning retention using PCGrad for gradient conflict resolution, demonstrating improved efficacy and utility preservation compared to existing unlearning baselines.
Entities (5)
Relation Signals (3)
VLA-Forget → optimizes → targeted forgetting
confidence 95% · VLA-Forget jointly optimizes three objectives: targeted forgetting, perceptual preservation, and reasoning retention
VLA-Forget → targets → OpenVLA
confidence 95% · We instantiate the method on OpenVLA-style policies
VLA-Forget → uses → PCGrad
confidence 95% · The optimization block combines retain, forget, mismatch, and perceptual preservation objectives with PCGrad stabilization
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Vision-language-action (VLA) models are emerging as embodied foundation models for robotic manipulation, but their deployment introduces a new unlearning challenge: removing unsafe, spurious, or privacy-sensitive behaviors without degrading perception, language grounding, and action control. In OpenVLA-style policies, behavior is produced through a fused visual encoder, a cross-modal projector, and a language backbone that predicts tokenized robot actions, so undesirable knowledge can be distributed across perception, alignment, and reasoning/action layers rather than confined to a single module. Consequently, partial unlearning applied only to the vision stack or only to the language backbone is often insufficient, while conventional unlearning baselines designed for standalone vision or language models may leave residual forgetting or incur unnecessary utility loss in embodied settings. We propose VLA-Forget, a hybrid unlearning framework that combines ratio-aware selective editing for perception and cross-modal specificity with layer-selective reasoning/action unlearning for utility-preserving forgetting. VLA-Forget jointly optimizes three objectives: targeted forgetting, perceptual preservation, and reasoning retention, through staged updates over the visual encoder, projector, and upper action-generating transformer blocks. Across forget-set behavior probes and retain-task evaluations, VLA-Forget improves forgetting efficacy by 10%, preserves perceptual specificity by 22%, retains reasoning and task success by 9%, and reduces post-quantization recovery by 55% relative to strong unlearning baselines.
Tags
Links
- Source: https://arxiv.org/abs/2604.03956v1
- Canonical: https://arxiv.org/abs/2604.03956v1
Trouble viewing inline? Open PDF directly →
Full Text
69,175 characters extracted from source content.
Expand or collapse full text
VLA-Forget: Vision-Language-Action Unlearning for Embodied Foundation Models Ravi Ranjan Florida International University Miami, USA rkuma031@fiu.edu &Agoritsa Polyzou Florida International University Miami, USA apolyzou@fiu.edu Corresponding author. Code available at: https://github.com/raviranjan-ai/VLA-Forget Abstract Vision-language-action (VLA) models are emerging as embodied foundation models for robotic manipulation, but their deployment introduces a new unlearning challenge: removing unsafe, spurious, or privacy-sensitive behaviors without degrading perception, language grounding, and action control. In OpenVLA-style policies, behavior is produced through a fused visual encoder, a cross-modal projector, and a language backbone that predicts tokenized robot actions, so undesirable knowledge can be distributed across perception, alignment, and reasoning/action layers rather than confined to a single module. Consequently, partial unlearning applied only to the vision stack or only to the language backbone is often insufficient, while conventional unlearning baselines designed for standalone vision or language models may leave residual forgetting or incur unnecessary utility loss in embodied settings. We propose VLA-Forget, a hybrid unlearning framework that combines ratio-aware selective editing for perception and cross-modal specificity with layer-selective reasoning/action unlearning for utility-preserving forgetting. VLA-Forget jointly optimizes three objectives: targeted forgetting, perceptual preservation, and reasoning retention, through staged updates over the visual encoder, projector, and upper action-generating transformer blocks. Across forget-set behavior probes and retain-task evaluations, VLA-Forget improves forgetting efficacy by 10%, preserves perceptual specificity by 22%, retains reasoning and task success by 9%, and reduces post-quantization recovery by 55% relative to strong unlearning baselines. VLA-Forget: Vision-Language-Action Unlearning for Embodied Foundation Models Ravi Ranjan†thanks: Corresponding author. Code available at: https://github.com/raviranjan-ai/VLA-Forget Florida International University Miami, USA rkuma031@fiu.edu Agoritsa Polyzou Florida International University Miami, USA apolyzou@fiu.edu Figure 1: Motivating failure case for VLA-Forget. Given the instruction “Pick blue cup,” the policy produces a visually plausible but semantically incorrect action by grasping the red cup. After targeted unlearning, the policy suppresses this spurious instruction-to-action association and recovers instruction-consistent behavior. 1 Introduction Vision-Language-Action (VLA) models are emerging as a practical route to embodied foundation models: policies that translate natural-language instructions and raw visual observations directly into robot actions by leveraging large pretrained vision and language backbones. OpenVLA exemplifies this paradigm as an open 7B VLA trained on 970K real-world robot demonstrations from Open X-Embodiment, combining a fused (DINOv2+SigLIP) visual encoder with a Llama 2 backbone and an action-token prediction interface that enables scalable fine-tuning and deployment on commodity hardware Kim et al. (2024); O’Neill et al. (2024); Pang et al. (2025). However, deployment of VLA policies introduces an urgent governance and reliability problem that is not fully addressed by today’s training and evaluation pipelines: once a robot policy has been trained, it may retain (i) unsafe or undesirable behaviors from a subset of demonstrations, (i) privacy or IP-sensitive content embedded in multimodal data, or (i) spurious shortcuts that appear correct under standard benchmarks but fail under structured distribution shift. The consequences of such failures are amplified in robotics because errors translate into physical actions. Recent evidence further highlights a VLA-specific grounding failure, sometimes described as linguistic blindness where policies execute visually plausible trajectories even when the instruction is semantically contradictory, motivating stronger mechanisms for selective behavior removal and reliable grounding diagnostics Zhuang et al. (2026). Figure 1 illustrates the core VLA-specific challenge studied in this work: undesirable behavior may arise from misalignment across perception, cross-modal grounding, or action priors, causing the policy to execute a physically plausible yet instruction-inconsistent action. This motivates selective unlearning that removes a targeted erroneous behavior slice while preserving normal scene understanding and non-target task execution. Motivation is further supported by recent evidence that VLA policies remain brittle under visual corruption and grounding perturbations, underscoring the need for post hoc correction mechanisms beyond standard fine-tuning Lin et al. (2025); Orjuela et al. (2026). Machine unlearning provides a practical way to remove targeted training influence without full retraining, but VLA policies are harder to unlearn than standard vision or language models. Unlike static predictors, a VLA model is a closed-loop control policy, so failure must be judged through embodied behavior rather than output accuracy alone. In OpenVLA, continuous robot actions are represented as discrete action tokens, which means unwanted behavior can be encoded jointly in visual features, cross-modal alignment, and instruction-conditioned action priors in the language backbone Kim et al. (2024). As a result, unlearning only the vision stack or only the language model is often insufficient: removing a visual trigger may leave the downstream action prior intact, while editing language priors may preserve harmful perceptual shortcuts or incorrect visual-language bindings. Existing baselines were largely designed for unimodal settings and transfer only partially to VLA policies. For example, exact approaches such as SISA require training-time changes Bourtoule et al. (2021), while approximate methods such as SCRUB improve forget-retain trade-offs but do not directly address multimodal component entanglement or control-oriented evaluation Kurmanji et al. (2023). Moreover, VLA unlearning involves competing retain, forget, and mismatch objectives over large backbones, motivating gradient-conflict mitigation such as PCGrad Yu et al. (2020). In this work, we introduce VLA-Forget, a hybrid unlearning framework for Vision-Language-Action models that is explicitly component-aware and deployment-oriented. VLA-Forget (i) targets perception and cross-modal specificity through ratio-aware selective editing of the visual encoder and projector, (i) targets reasoning/action utility-preserving forgetting through significance-based selective editing of action-relevant transformer blocks, and (i) performs staged, adapter-first updates (e.g., LoRA) to enable efficient unlearning with rollback and canary deployment compatibility Hu et al. (2022); Kim et al. (2025); Liu et al. (2025a). We evaluate unlearning with robotics-centric metrics and unlearning-centric audits (including safety violation risk), along with the fact that we evaluate robustness after quantization, aligning the evaluation with the realities of VLA deployment Carlini et al. (2022); Zang et al. (2025); Zhang et al. (2024b) Key Contributions. (i) We formalize VLA unlearning as a three-goal problem targeted forgetting (efficacy), perceptual preservation (specificity), and reasoning retention (utility) in the presence of an action-token interface and multimodal component entanglement. (i) We propose VLA-Forget, a novel hybrid unlearning pipeline that exploits ratio-aware selective editing for perception/cross-modal specificity with significance-based selective editing for reasoning/action utility preservation, implemented in an adapter-first manner compatible with OpenVLA fine-tuning workflows. (i) We outline an evaluation protocol that couples embodied performance (task success and control stability) with unlearning audits (forget/retain scores and safety violation risk), and incorporates structured contradiction probes to diagnose and prevent spurious “fake success” under OOD instructions. 2 Related Work Vision-language-action (VLA) models extend multimodal foundation models from perception and generation to embodied control. Early systems such as VIMA and RT-2 showed that robot behavior can be conditioned on interleaved visual-language prompts and represented through tokenized actions, while Open X-Embodiment and OpenVLA scaled this paradigm to diverse real-robot data and open 7B policies. Despite this progress, prior VLA research has focused mainly on scaling, transfer, and adaptation, rather than post hoc removal of unsafe behaviors, undesirable concepts, or sensitive instruction-action associations. Zhu and others (2023); Zitkovich et al. (2023); O’Neill et al. (2024); Kim et al. (2024) Machine unlearning has progressed from exact retraining-based deletion to approximate updates that balance erasure quality, efficiency, and retained utility. In language models, recent work spans gradient-ascent, retain-regularized, preference-based, and activation-space methods, while emphasizing joint evaluation of forgetting, utility preservation, and privacy leakage. Two recurring issues are especially relevant for embodied policies: broad model-wide edits often cause collateral degradation, and apparently successful forgetting can fail under deployment transformations such as quantization. These limitations motivate selective, structure-aware unlearning over indiscriminate full-model updates. Bourtoule et al. (2021); Maini et al. (2024); Yao et al. (2024); Liu et al. (2025b); Zhang et al. (2024b) Related work in vision, vision-language, and diffusion models studies forgetting of classes, identities, and concepts in multimodal transformers. SSD and SalUn localize updates through parameter importance or saliency, LoTUS improves scalable approximate unlearning with uncertainty-aware smoothing, and SLUG shows that targeted single-layer editing can sometimes suffice. In generative settings, ESD and UCE edit text-conditioned diffusion behavior at the concept level. Collectively, these methods expose a central trade-off: aggressive updates improve forgetting but may damage retention, whereas overly localized edits can fail when unwanted knowledge is distributed across layers and modalities. Foster et al. (2024); Fan et al. (2023); Spartalis et al. (2025); Cai et al. (2024); Gandikota et al. (2023, 2024) VLA unlearning differs from prior LLM- or VLM-only settings because undesired behavior may be encoded jointly in visual features, cross-modal bindings, and action-token priors, and must be evaluated through embodied execution rather than text or image outputs alone. Accordingly, VLA-Forget adopts a component-aware formulation: ratio-aware edits target perception and projector modules, while significance-based selective updates address higher-level reasoning and action-generation components. This yields a hybrid unlearning strategy tailored to embodied foundation models rather than a direct reuse of unimodal forgetting methods. Zitkovich et al. (2023); Kim et al. (2024); Fan et al. (2023); Cai et al. (2024); Yao et al. (2024) 3 Methodology Overview. We propose VLA-Forget, a novel unlearning framework for vision-language-action (VLA) policies that removes targeted behaviors while preserving perceptual grounding and action reasoning. We instantiate the method on OpenVLA-style policies, where an input image and language instruction are processed by a fused visual encoder, projected into the language-model embedding space, and decoded into discretized robot action tokens. In OpenVLA, the visual stack combines DINOv2 and SigLIP, the backbone is Llama 2, and the policy predicts normalized 7-DoF actions via tokenized bins, making forgetting inherently distributed across perception, cross-modal alignment, and action generation rather than localized to a single module Kim et al. (2024). Architecture and unlearning target. Let a VLA policy be fθ(o,s)=DecθL(ProjθP(EncθV(o)),s),f_θ(o,s)=Dec_ _L (Proj_ _P (Enc_ _V(o) ),\,s ), (1) where o is the observation image, s is the instruction, θV _V denotes the visual encoder, θP _P the MLP projector, and θL _L the language/action backbone. The decoder produces an action-token sequence y, which is de-tokenized into a continuous action a∈ℝ7a ^7. We consider an unlearning request U specifying a target concept or behavior slice, such as a sensitive object, unsafe affordance, or erroneous instruction-to-action mapping. We form three datasets: a forget set DfD_f, a retain set DrD_r, and a boundary set DmD_m containing near-neighbor scenes or instructions that must remain intact. Why “VLA” unlearning is necessary. In VLA models, undesired behavior can originate from three coupled sources: (i) perceptual memorization in θV _V, (i) erroneous visual-to-language binding in θP _P, and (i) action priors or instruction-conditioned hallucinations in θL _L. Editing only the vision stack may suppress the visual trigger while leaving the downstream action prior unchanged; editing only the language backbone may preserve a harmful perceptual shortcut. VLA-Forget therefore combines ratio-aware editing for perception and cross-modal specificity with layer-selective unlearning for reasoning and action retention. 3.1 Hybrid Selective Localization Perception and projector selection. For each candidate visual or projector layer l, we compute forget and retain gradients glf=∇θlℒforget,glr=∇θlℒretain.g_l^f= _ _lL_forget, g_l^r= _ _lL_retain. (2) We then assign a ratio-aware score ϕ(l)=‖glf‖2‖θl‖2+ε(1−cos(glf,glr))α,φ(l)= \|g_l^f\|_2\| _l\|_2+ (1- (g_l^f,g_l^r) )^α, (3) and select the top visual/projector layers KV,KPK_V,K_P with highest ϕ(l)φ(l). This favors parameters that strongly affect forgetting while minimally interfering with retained perception Yu et al. (2020). Reasoning/action layer selection. For the upper transformer blocks in the language-action backbone, we apply a significance ratio Sig(l)=‖∇θlℒforget‖2‖∇θlℒretain‖2+ε.Sig(l)= \| _ _lL_forget\|_2\| _ _lL_retain\|_2+ . (4) We initialize an editable set SLS_L with the top-k layers under Sig(l)Sig(l), and expand it iteratively only if forgetting criteria are unmet. This yields a minimal update set for action-relevant reasoning while avoiding unnecessary global drift Ranjan et al. (2026c); Kurmanji et al. (2023); Zhang et al. (2024b). Figure 2: Illustration of the unlearning objectives on a selected module. Eq. 6 suppresses the targeted behavior, Eq. 5 preserves non-targeted behavior, and Eq. 7 discourages shallow forgetting by pushing the updated policy away from the original forgotten response. Figure 3: Overview of VLA-Forget. Given an unlearning request, we construct forget, retain, and mismatch sets, then perform staged adapter-based selective updates over the vision encoder, projector, and LLM/action layers with multi-objective PCGrad stabilization, yielding an unlearned VLA policy with preserved interface and retained task utility. 3.2 Unlearning Objectives We optimize three complementary objectives aligned with the goals of efficacy, specificity, and utility. Retain loss. To preserve non-targeted behavior, we minimize ℒretain=(x,y)∼Dr[CE(pθ(⋅∣x),y)]+βx∼Dr[KL(pθ0(⋅∣x)∥pθ(⋅∣x))]. splitL_retain=&E_(x,y) D_r [CE (p_θ(· x),y ) ]\\ &+β\,E_x D_r [KL (p_ _0(· x)\,\|\,p_θ(· x) ) ]. split (5) where θ0 _0 denotes the original model and x=(o,s)x=(o,s). The first term preserves action-token prediction on retained data, while the KL anchor constrains the updated policy to remain close to the base model on benign trajectories Kim et al. (2024); Kurmanji et al. (2023). Forget loss. To suppress the targeted behavior, we maximize the forget-set prediction error: ℒforget=(x,y)∼Df[CE(pθ(⋅∣x),y)].L_forget=E_(x,y) D_f\! [CE\! (p_θ(· x),y ) ]. (6) Operationally, this is implemented as gradient ascent on ℒforgetL_forget Jin et al. (2025). Mismatch loss. To avoid shallow forgetting and reduce recovery to the pre-unlearning behavior, we maximize distributional divergence on forgotten samples: ℒmismatch=x∼Df[KL(pθ(⋅∣x)∥pθ0(⋅∣x))].L_mismatch=E_x D_f\! [KL\! (p_θ(· x)\,\|\,p_ _0(· x) ) ]. (7) As shown in Fig. 2, the three objectives act together on the selected module to suppress the target behavior, preserve retained behavior, and reduce shallow recovery to the pre-unlearning policy. Perceptual preservation loss. To preserve non-targeted visual grounding, we distill internal features on Dr∪DmD_r∪ D_m: ℒfeat=x∼Dr∪Dm[ _feat=E_x D_r∪ D_m [ ‖hθV(x)−hθ0V(x)‖22 \|h^V_θ(x)-h^V_ _0(x)\|_2^2 (8) +γ∥hθP(x)−hθ0P(x)∥22], +γ\|h^P_θ(x)-h^P_ _0(x)\|_2^2 ], where hVh^V and hPh^P are late visual and projector representations. Unified objective. The final optimization is minθℒretain+λfeatℒfeat−λfℒforget−λmℒmismatch. _θ\;L_retain+ _featL_feat- _fL_forget- _mL_mismatch. (9) 3.3 Training and Unlearning Procedure Adapter-first updates. We implement VLA-Forget using parameter-efficient adapters over the selected layers while freezing the remaining weights. This design is compatible with the OpenVLA training stack, which supports LoRA-based fine-tuning with target_modules=all-linear; thus unlearning can be applied without full-model retraining and can be merged or rolled back at deployment time Kim et al. (2025); Hu et al. (2022). Stage 1: perception unlearning. We first update LoRA parameters on KVK_V to weaken targeted visual evidence while preserving general scene understanding through ℒretainL_retain and ℒfeatL_feat. This stage removes object- or scene-level triggers with minimal disruption to unrelated perception. Stage 2: cross-modal unlearning. Next, we update KPK_P in the projector to break the specific visual-to-language associations responsible for the unwanted behavior. This is essential when the failure is not purely visual, but rather caused by erroneous alignment between image regions and action-relevant tokens. Stage 3: reasoning/action unlearning. Finally, we update the selected upper backbone layers SLS_L, and optionally the action-token embedding rows most implicated in the target behavior. This stage suppresses residual instruction-conditioned action priors while maintaining overall task competence. Gradient stabilization and stopping. Because the retain and forget objectives can conflict, we aggregate gradients using projected conflict resolution: g=PCGrad(∇ℒretain,−λf∇ℒforget,−λm∇ℒmismatch), splitg=PCGrad ( _retain,- _f _forget,\\ - _m _mismatch ), split (10) and apply optimizer steps only to the active adapter parameters. After each round, we evaluate forget efficacy on DfD_f and retain utility on DrD_r. If forgetting remains insufficient, we expand SLS_L by the next highest-significance layer and continue; otherwise, training stops early Yu et al. (2020). Figure 3 summarizes the VLA-Forget pipeline as a staged, component-aware unlearning framework. Starting from an unlearning request, the method constructs forget, retain, and mismatch sets, decomposes the OpenVLA policy into vision, projector, and LLM/action modules, and then applies selective adapter-based updates in three stages: visual trigger removal, cross-modal binding correction, and reasoning/action prior suppression. The optimization block combines retain, forget, mismatch, and perceptual preservation objectives with PCGrad stabilization, while the final evaluation block verifies forgetting efficacy, retained utility, and deployment robustness before producing the unlearned VLA policy. Interaction with VLA policies. VLA-Forget is designed to preserve the native VLA interface: image and instruction inputs remain unchanged, and the model still predicts action tokens followed by the standard de-tokenization and action unnormalization pipeline used by OpenVLA. This makes the method directly deployable in existing VLA control stacks while enabling targeted post hoc removal of unsafe, private, or spurious behaviors Zang et al. (2025); Pang et al. (2025). The complete unlearning pipeline is detailed in Algorithm 1, with its associated supporting procedures provided in Algorithm 3; corresponding pseudo-code is available in Appendix A. Table 1: Unlearning result on OpenVLA-7B. Left: Open X-Embodiment. Right: lerobot/pusht_image. Higher is better for FC, RC, FAD, and TSR; lower is better for RAD and SVR. Mean ± standard deviation over 5 random seeds, with typical variation in the range of ±(1±(1–3)3) points for rate-based metrics (FC, RC, TSR, and SVR) and ±(0.01±(0.01–0.03)0.03) for distance-based metrics (FAD and RAD). Best results are shown in bold and second-best are underlined. Open X-Embodiment (OpenVLA-7B) lerobot/pusht_image (OpenVLA-7B) Method FC ↑ RC ↑ FAD ↑ RAD ↓ TSR ↑ SVR ↓ FC ↑ RC ↑ FAD ↑ RAD ↓ TSR ↑ SVR ↓ SSD 78 83 0.70 0.28 68 17 82 86 0.73 0.20 55 15 SalUn 89 88 0.76 0.26 71 12 89 88 0.78 0.18 60 11 GA 93 60 0.89 0.45 40 5 94 50 0.91 0.50 22 3 NPO 90 88 0.83 0.23 74 8 92 90 0.85 0.15 65 7 VLA-Forget 93 91 0.88 0.21 78 5 95 94 0.90 0.13 69 4 4 Experiments 4.1 Experimental Setups Models. We instantiate VLA-Forget on OpenVLA-7b, a 7B vision-language-action policy trained on large-scale Open X-Embodiment robot data Kim et al. (2024); O’Neill et al. (2024). The second model is pi0fast-base who predicts continuous robot actions via auto-regressive next-token prediction Pertsch et al. (2025). Following the VLA setting in our method, we construct three splits for each experiment: a forget set DfD_f containing target behaviors to be removed, a retain set DrD_r containing non-target behaviors whose utility should be preserved, and a boundary set DmD_m containing near-neighbor samples used to reduce shallow or entangled forgetting. Unless otherwise stated, all methods start from the same pretrained checkpoint, use the same forget/retain protocol, and are trained under the same optimization budget. Datasets. We use two complementary benchmarks. First, we build a real-robot benchmark from subsets of Open X-Embodiment (OXE), downloaded via gsutil, where each trajectory is paired with a language instruction and organized into forget/retain slices at the trajectory level O’Neill et al. (2024). Second, we use lerobot/pusht_image as a controlled synthetic benchmark, where we inject a static text instruction into each instance and form matched forget/retain partitions Cadene et al. (2026). In the released OpenVLA, we use up to 512 prompted PushT instances with a 30%30\% forget fraction; in the lightweight ablation pipeline, we scale this to up to 4,000 instances and use a 70/15/1570/15/15 train/validation/test split, reporting forget and retain test performance after unlearning. This combination gives both a realistic OXE setting and a reproducible low-cost benchmark for rapid ablations. Baselines. We compare against four representative approximate unlearning baselines. SSD Foster et al. (2024) is a retraining-free parameter-dampening method that suppresses weights estimated to be disproportionately important to the forget data. SalUn Fan et al. (2023) is a saliency-based baseline that updates only high-importance weights, making it a strong selective vision-side unlearning comparator. GA Yao and Xu (2024) performs direct gradient ascent on the forget loss and serves as the standard language-side unlearning baseline. NPO Zhang et al. (2024a) is a preference-based alternative designed to improve forget-retain trade-offs. These baselines span both vision-oriented and language-oriented unlearning regimes, making them suitable comparators for VLA policies. Metrics. We report six metrics, Forget action loss / cross-entropy (FC) measures forgetting efficacy on DfD_f; higher FC is better because the model should become less able to reproduce the forgotten action mapping. Retain utility score (RC), derived from retain-set cross-entropy, measures preserved utility on DrD_r; higher is better. Forget Accuracy Drop (FAD) measures the reduction in action-token or exact-match accuracy on the forget split relative to the base model; higher is better. Retain Accuracy Drop (RAD) measures the corresponding degradation on retained behaviors; lower is better. Task Success Rate (TSR) evaluates closed-loop policy execution on benchmark tasks; higher is better. Safety Violation Rate (SVR) measures the frequency of unsafe or disallowed behaviors under target prompts or contradiction probes; lower is better. We follow standard VLA and robot manipulation evaluation protocols Kim et al. (2024); Liu et al. (2023). Together, these metrics capture forgetting strength, retained utility, embodied execution quality, and safety, which are all necessary for VLA unlearning. Detailed experimental setup, hyper-parameter choices, and reproducibility details are provided in Appendix B. Metric definitions and their mathematical formulations are provided in Appendix B.2. 4.2 Experiment Results Result on OpenVLA. Table 1 highlights three key observations. VLA-Forget achieves the best overall balance between forgetting and retention across both benchmarks: although GA attains the strongest raw forgetting scores (FC/FAD), it severely degrades retain performance and task success, whereas VLA-Forget preserves the highest RC, the lowest RAD, and the best TSR, indicating substantially better utility preservation. The same trend is consistent on both Open X-Embodiment and PushT, suggesting that the method is not tied to a single dataset but generalizes across broader settings. Lower SVR of VLA-Forget relative to SSD, SalUn, and NPO shows more reliable suppression of undesired behaviors without inducing large action drift, which implies that its component-aware multimodal unlearning is better aligned with safe deployment than purely aggressive forgetting baselines. The safety violation plot of figure 5 shows that VLA-Forget along with GA achieves one of the lowest safety violation rates while maintaining strong overall unlearning performance, indicating a better balance between removing unsafe behaviors and preserving stable policy execution. Table 2: Unlearning results on lerobot/pi0fast-base under the Open X-Embodiment protocol. Mean ± standard deviation over 5 random seeds, with typical variation of ±(1±(1–3)3) points for FC, RC, TSR, and SVR, and ±(0.01±(0.01–0.04)0.04) for FAD and RAD. Best results are shown in bold and second-best are underlined. Open X-Embodiment (Pi0-FAST-Base) Method FC ↑ RC ↑ FAD ↑ RAD ↓ TSR ↑ SVR ↓ SSD 76 81 0.68 0.30 65 18 SalUn 87 85 0.74 0.27 68 13 GA 93 57 0.89 0.47 38 6 NPO 89 87 0.82 0.24 72 9 VLA-Forget 94 89 0.88 0.22 75 6 Figure 4: Instruction-conditioned action behavior on pi0fast-base and Open X-Embodiments. Result on π 0 fast. Table 2 shows that VLA-Forget preserves the same overall pattern as in the OpenVLA results: although GA attains very strong forgetting, it suffers from severe retain-side degradation, whereas VLA-Forget achieves the best overall trade-off by jointly maintaining the highest RC and TSR, the lowest RAD, and near-best forgetting performance. In Fig. 4, Canonical denotes standard retain-task instructions, while Triggered denotes target-trigger or contradictory instructions used to probe the unlearning scope. Higher Retain Succ. indicates better preserved non-target behavior, and higher Suppress Succ. indicates more effective suppression of the unwanted action. VLA-Forget achieves the best overall balance by preserving the strongest retain-task performance under canonical instructions while also maintaining high suppression under triggered instructions. Canonical corresponds to normal non-target instructions, and Triggered corresponds to target-triggered or contradiction-style instructions; in both panels, higher values are better. Figure 5: Safety violation rate (SVR) on Open X-Embodiment for different unlearning methods on OpenVLA-7B, where lower values indicate safer post-unlearning behavior. Table 3: Quantization robustness after unlearning on OpenVLA-7B with Open X-Embodiment dataset. Results report forget-side metrics under post-training 8-bit and 4-bit quantization. Method 8-bit 4-bit FC ↑ SVR ↓ FC ↑ SVR ↓ SSD 76 19 72 23 SalUn 87 8 78 10 GA 82 12 80 16 NPO 85 10 82 13 VLA-Forget 91 6 88 8 Robustness Result. Table 3 demonstrates that Quantization degrades forgetting quality for all methods, but the drop is largest for broad full-model updates such as GA and NPO, whereas VLA-Forget remains comparatively stable under both 8-bit and 4-bit settings, suggesting stronger robustness to quantization-induced recovery. 4.3 Ablation Study Table 4: Ablation results of VLA-Forget on OpenVLA-7B on Open X-Embodiment dataset, across different component selections. VLA-Forget applied to FC↑ RC↑ FAD↑ RAD↓ TSR↑ SVR↓ Vision encoder only 85 82 0.80 0.27 65 12 Projector only 82 89 0.75 0.22 75 15 Language backbone only 90 88 0.85 0.23 74 8 Vision + Projector 88 86 0.84 0.24 72 10 Projector + Language 92 90 0.86 0.22 77 6 Vision + Language 93 87 0.89 0.25 70 6 Full (Vision + Proj + Lang) 93 91 0.88 0.21 78 5 Full, w/o retain-preservation 95 80 0.93 0.30 64 4 Table 4 shows that unlearning only a single component is insufficient: the language backbone gives stronger forgetting than vision-only or projector-only updates, but the full multimodal setting achieves the best overall trade-off, indicating that undesirable action behavior is distributed across perception, alignment, and language-action reasoning modules. We further observe that removing the retain-preservation term increases raw forgetting scores, but it sharply hurts RC, RAD, and TSR, showing that strong forgetting alone is not enough for safe VLA unlearning and that retain-side regularization is essential to preserve normal task execution. Figure 6: Forget-action comparison across component-level VLA-Forget ablations on OpenVLA-7B and Open X-Embodiment. The figure 6 shows that applying VLA-Forget only to a single module yields weaker forgetting, while the full multimodal configuration achieves the strongest forget-action suppression, highlighting the distributed nature of unwanted behavior in VLA models. More detailed sensitivity analyzes of objective weights, schedules, and learning rates are provided in Appendix C.1. 4.4 Qualitative Analysis In Figure 7, the Vision-only update reduces the visual trigger but still leaves partial target-directed behavior. Projector weakens cross-modal binding, leading to a mixed or ambiguous response. Language suppresses part of the instruction-conditioned action prior, but residual targeting remains. Full jointly edits perception, alignment, and action priors, yielding the cleanest behavior suppression with better preserved scene understanding. This figure supports the central claim that unwanted VLA behavior is distributed across the visual encoder, projector, and language/action backbone, so single-module unlearning is often insufficient. Robustness is crucial in VLA deployment, Table 3, supports the claim that, although post-training quantization weakens forgetting performance for all methods, the degradation is smallest for VLA-Forget. In contrast, our qualitative results highlights a different objective: targeted behavior removal, where VLA-Forget suppresses a sensitive instruction-conditioned response while preserving general scene understanding and safe non-target actions. 4.5 Discussion The results reinforce that unlearning in vision language action policies is inherently multimodal. The full VLA-Forget pipeline provides a stronger forget retain trade-off, indicating that effective embodied unlearning must jointly account for perception, alignment, and action reasoning. Limitations. VLA-Forget remains an approximate unlearning method and does not provide a formal guarantee of complete erasure. We provide further discussion in Appendix D. Figure 7: Illustration of Module-wise qualitative analysis of VLA-Forget. Single-component unlearning only partially suppresses the targeted behavior, while full VLA-Forget more cleanly removes the unwanted action and preserves safe non-target behavior. 5 Conclusion We introduced VLA-Forget, a staged and component-aware unlearning framework for vision-language-action policies. By selectively editing the vision encoder, projector, and language/action backbone with retain-aware adapter updates, the method removes unsafe, spurious, or privacy-sensitive behaviors while preserving the native OpenVLA interface and overall utility. Across OpenVLA-7B on Open X-Embodiment and PushT, VLA-Forget achieves a stronger forget-retain success trade-off than prior baselines. Ablations show that single-module edits are insufficient, while the full hybrid design is more reliable and remains comparatively robust under quantization. Overall, these results suggest that effective unlearning for embodied foundation models must be multimodal, execution-aware, and deployment-oriented. References L. Bourtoule, V. Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot (2021) Machine unlearning. In 2021 IEEE symposium on security and privacy (SP), p. 141–159. Cited by: §1, §2. R. Cadene, S. Aliberts, F. Capuano, M. Aractingi, A. Zouitine, P. Kooijmans, J. Choghari, M. Russi, C. Pascal, S. Palma, et al. (2026) Lerobot: an open-source library for end-to-end robot learning. arXiv preprint arXiv:2602.22818. Cited by: §4.1. Z. Cai, Y. Tan, and M. S. Asif (2024) Targeted unlearning with single layer unlearning gradient. arXiv preprint arXiv:2407.11867. Cited by: §2, §2. N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer (2022) Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), p. 1897–1914. Cited by: §1. C. Fan, J. Liu, Y. Zhang, E. Wong, D. Wei, and S. Liu (2023) Salun: empowering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508. Cited by: §2, §2, §4.1. J. Foster, S. Schoepf, and A. Brintrup (2024) Fast machine unlearning without retraining through selective synaptic dampening. In Proceedings of the AAAI conference on artificial intelligence, Vol. 38, p. 12043–12051. Cited by: §2, §4.1. R. Gandikota, J. Materzynska, J. Fiotto-Kaufman, and D. Bau (2023) Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, p. 2426–2436. Cited by: §2. R. Gandikota, H. Orgad, Y. Belinkov, J. Materzyńska, and D. Bau (2024) Unified concept editing in diffusion models. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, p. 5111–5120. Cited by: §2. E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, W. Chen, et al. (2022) Lora: low-rank adaptation of large language models.. Iclr 1 (2), p. 3. Cited by: §1, §3.3. X. Jin, Z. Bu, B. Vinzamuri, A. Ramakrishna, K. Chang, V. Cevher, and M. Hong (2025) Unlearning as multi-task optimization: a normalized gradient difference approach with an adaptive learning rate. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 11278–11294. Cited by: §3.2. M. J. Kim, C. Finn, and P. Liang (2025) Fine-tuning vision-language-action models: optimizing speed and success. arXiv preprint arXiv:2502.19645. Cited by: §1, §3.3. M. J. Kim, K. Pertsch, S. Karamcheti, T. Xiao, A. Balakrishna, S. Nair, R. Rafailov, E. Foster, G. Lam, P. Sanketi, et al. (2024) Openvla: an open-source vision-language-action model. arXiv preprint arXiv:2406.09246. Cited by: §1, §1, §2, §2, §3, §3.2, §4.1, §4.1. M. Kurmanji, P. Triantafillou, J. Hayes, and E. Triantafillou (2023) Towards unbounded machine unlearning. Advances in neural information processing systems 36, p. 1957–1987. Cited by: §1, §3.1, §3.2. C. Li, J. Liu, B. Li, B. Gao, Y. Yuan, Y. He, Y. Li, and J. Tang (2026) DTP: a simple yet effective distracting token pruning framework for vision-language action models. arXiv preprint arXiv:2601.16065. Cited by: §C.2. Z. Lin, J. Duan, H. Fang, D. Fox, R. Krishna, C. Tan, and B. Wen (2025) Failsafe: reasoning and recovery from failures in vision-language-action models. arXiv preprint arXiv:2510.01642. Cited by: §1. B. Liu, Y. Zhu, C. Gao, Y. Feng, Q. Liu, Y. Zhu, and P. Stone (2023) Libero: benchmarking knowledge transfer for lifelong robot learning. Advances in Neural Information Processing Systems 36, p. 44776–44791. Cited by: §4.1. J. Liu, H. Chen, P. An, Z. Liu, R. Zhang, C. Gu, X. Li, Z. Guo, S. Chen, M. Liu, et al. (2025a) Hybridvla: collaborative diffusion and autoregression in a unified vision-language-action model. arXiv preprint arXiv:2503.10631. Cited by: §1. S. Liu, Y. Yao, J. Jia, S. Casper, N. Baracaldo, P. Hase, Y. Yao, C. Y. Liu, X. Xu, H. Li, et al. (2025b) Rethinking machine unlearning for large language models. Nature Machine Intelligence 7 (2), p. 181–194. Cited by: §2. P. Maini, Z. Feng, A. Schwarzschild, Z. C. Lipton, and J. Z. Kolter (2024) Tofu: a task of fictitious unlearning for llms. arXiv preprint arXiv:2401.06121. Cited by: §2. A. O’Neill, A. Rehman, A. Maddukuri, A. Gupta, A. Padalkar, A. Lee, A. Pooley, A. Gupta, A. Mandlekar, A. Jain, et al. (2024) Open x-embodiment: robotic learning datasets and rt-x models: open x-embodiment collaboration 0. In 2024 IEEE International Conference on Robotics and Automation (ICRA), p. 6892–6903. Cited by: §1, §2, §4.1, §4.1. D. Y. G. Orjuela, L. Scappatura, V. Di Gennaro, R. A. Izzo, G. Bardaro, and M. Matteucci (2026) Improving robustness of vision-language-action models by restoring corrupted visual inputs. arXiv preprint arXiv:2602.01158. Cited by: §1. Y. Pang, Y. Zhao, Z. Zhou, T. Hu, and R. Hou (2025) Is openvla truly robust? a systematic evaluation of positional robustness. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics, p. 1–6. Cited by: §1, §3.3. K. Pertsch, K. Stachowicz, B. Ichter, D. Driess, S. Nair, Q. Vuong, O. Mees, C. Finn, and S. Levine (2025) Fast: efficient action tokenization for vision-language-action models. arXiv preprint arXiv:2501.09747. Cited by: §4.1. R. Ranjan, U. Grover, M. Akewar, X. Lin, and A. Polyzou (2026a) CatRAG: functor-guided structural debiasing with retrieval augmentation for fair llms. arXiv preprint arXiv:2603.21524. Cited by: §C.2. R. Ranjan, U. Grover, X. Lin, and A. Polyzou (2026b) G-drift mia: membership inference via gradient-induced feature drift in llms. arXiv preprint arXiv:2604.00419. Cited by: §C.2. R. Ranjan, U. Grover, X. Lin, and A. Polyzou (2026c) RAZOR: ratio-aware layer editing for targeted unlearning in vision transformers and diffusion models. arXiv preprint arXiv:2603.14819. Cited by: §3.1. C. N. Spartalis, T. Semertzidis, E. Gavves, and P. Daras (2025) Lotus: large-scale machine unlearning with a taste of uncertainty. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 10046–10055. Cited by: §2. H. Wang, J. Xu, Y. Xiang, J. Pan, Y. Zhou, Y. Li, and G. Dai (2025) Specprune-vla: accelerating vision-language-action models via action-aware self-speculative pruning. arXiv preprint arXiv:2509.05614. Cited by: §C.2. J. Yao, E. Chien, M. Du, X. Niu, T. Wang, Z. Cheng, and X. Yue (2024) Machine unlearning of pre-trained large language models. In Proceedings of the 62nd annual meeting of the association for computational linguistics (volume 1: Long papers), p. 8403–8419. Cited by: §2, §2. Y. Yao and X. Xu (2024) Large language model unlearning. Advances in Neural Information Processing Systems 37, p. 105425–105475. Cited by: §4.1. T. Yu, S. Kumar, A. Gupta, S. Levine, K. Hausman, and C. Finn (2020) Gradient surgery for multi-task learning. Advances in neural information processing systems 33, p. 5824–5836. Cited by: §1, §3.1, §3.3. H. Zang, M. Wei, S. Xu, Y. Wu, Z. Guo, Y. Wang, H. Lin, L. Shi, Y. Xie, Z. Xu, et al. (2025) Rlinf-vla: a unified and efficient framework for vla+ rl training. arXiv preprint arXiv:2510.06710. Cited by: §1, §3.3. R. Zhang, L. Lin, Y. Bai, and S. Mei (2024a) Negative preference optimization: from catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05868. Cited by: §4.1. W. Zhang, A. Sun, W. Mo, X. Qu, Y. Zheng, and J. Wang (2026) From knowing to doing precisely: a general self-correction and termination framework for vla models. arXiv preprint arXiv:2602.01811. Cited by: §C.2. Z. Zhang, F. Wang, X. Li, Z. Wu, X. Tang, H. Liu, Q. He, W. Yin, and S. Wang (2024b) Catastrophic failure of llm unlearning via quantization. arXiv preprint arXiv:2410.16454. Cited by: §1, §2, §3.1. Y. Zhu et al. (2023) Vima: general robot manipulation with multimodal prompts. In International Conference on Learning Representations (ICLR), Cited by: §2. J. Zhuang, L. Lu, M. Dai, R. Hu, J. Chen, Q. Liu, and H. Hu (2026) Q cache: visual attention is valuable in less than half of decode layers for multimodal large language model. arXiv preprint arXiv:2602.01901. Cited by: §1. B. Zitkovich, T. Yu, S. Xu, P. Xu, T. Xiao, F. Xia, J. Wu, P. Wohlhart, S. Welker, A. Wahid, et al. (2023) Rt-2: vision-language-action models transfer web knowledge to robotic control. In Conference on Robot Learning, p. 2165–2183. Cited by: §2, §2. Appendix Appendix A Pseudo Code 1 Input : Base VLA policy fθ0=(EncθV,ProjθP,DecθL)f_ _0=(Enc_ _V,Proj_ _P,Dec_ _L); unlearning request U; candidate data pool C; budgets (KV,KP,KL)(K_V,K_P,K_L); loss weights (λf,λm,λfeat)( _f, _m, _feat); thresholds (τV,τP,τL)( _V, _P, _L); learning rate η; stage steps (TV,TP,TL)(T_V,T_P,T_L); stopping criteria Γ . Output : Unlearned policy fθ⋆f_θ , adapter weights Δ⋆ , and audit report ℛR. 2 3 Construct data splits: build forget set DfD_f, retain set DrD_r, and boundary set DmD_m from U using labels, metadata, and nearest-neighbor retrieval. 4 θ←θ0θ← _0 5 Δ←∅ ← 6 7Optional influence triage: 8 f←INFLUENCE_TRIAGE(fθ0,,U)C_f← INFLUENCE\_TRIAGE(f_ _0,C,U) 9 Refine DfD_f and DmD_m using fC_f 10 11Stage 1: Vision unlearning 12 Freeze(θ) Freeze(θ); Enable(ΔV) Enable( _V) on candidate late vision blocks only 13 KV←VISION_SELECT(EncθV,Df,Dr,τV)K_V← VISION\_SELECT(Enc_ _V,D_f,D_r, _V) 14 for t=1t=1 to TVT_V do 15 Sample Bf∼DfB_f D_f, Br∼DrB_r D_r, Bm∼DmB_m D_m 16 Compute ℒretain(Br)+λfeatℒfeat(Br∪Bm),ℒforget(Bf),ℒmismatch(Bf)L_retain(B_r)+ _featL_feat(B_r∪ B_m), _forget(B_f), _mismatch(B_f) g←PCGRAD(∇ℒretain,∇(−λfℒforget),∇(−λmℒmismatch))g← PCGRAD ( _retain,\,∇(- _fL_forget),\,∇(- _mL_mismatch) ) 17 Update(ΔV[KV],g,η) Update( _V[K_V],g,η) 18 if EvalForget(fθ,Df) EvalForget(f_θ,D_f) and EvalRetain(fθ,Dr) EvalRetain(f_θ,D_r) satisfy ΓV _V then // early stop for vision stage 19 break 20 21 22 23Stage 2: Projector unlearning 24 Freeze(θ∪ΔV) Freeze(θ∪ _V); Enable(ΔP) Enable( _P) on projector layers only 25 KP←VISION_SELECT(ProjθP,Df,Dr,τP)K_P← VISION\_SELECT(Proj_ _P,D_f,D_r, _P) 26 for t=1t=1 to TPT_P do 27 Sample Bf∼DfB_f D_f, Br∼DrB_r D_r, Bm∼DmB_m D_m 28 Compute ℒretain(Br)+λfeatℒfeat(Br∪Bm),ℒforget(Bf),ℒmismatch(Bf)L_retain(B_r)+ _featL_feat(B_r∪ B_m), _forget(B_f), _mismatch(B_f) g←PCGRAD(∇ℒretain,∇(−λfℒforget),∇(−λmℒmismatch))g← PCGRAD ( _retain,\,∇(- _fL_forget),\,∇(- _mL_mismatch) ) 29 Update(ΔP[KP],g,η) Update( _P[K_P],g,η) 30 if EvalForget(fθ,Df) EvalForget(f_θ,D_f) and EvalRetain(fθ,Dr) EvalRetain(f_θ,D_r) satisfy ΓP _P then // early stop for projector stage 31 break 32 33 34 35Continue in Algorithm 2. Algorithm 1 VLA-Forget: Hybrid Unlearning for Vision-Language-Action Models 1 2Stage 3: Reasoning/action unlearning 3 Freeze(θ∪ΔV∪ΔP) Freeze(θ∪ _V∪ _P); Enable(ΔL) Enable( _L) on upper transformer blocks 4 SL←LLM_SELECT(DecθL,Df,Dr,τL)S_L← LLM\_SELECT(Dec_ _L,D_f,D_r, _L) 5 Optionally add action-token embedding rows / LM-head rows to SLS_L 6 for t=1t=1 to TLT_L do 7 Sample Bf∼DfB_f D_f, Br∼DrB_r D_r, Bm∼DmB_m D_m 8 Compute ℒretain(Br)+λfeatℒfeat(Br∪Bm),ℒforget(Bf),ℒmismatch(Bf)L_retain(B_r)+ _featL_feat(B_r∪ B_m), _forget(B_f), _mismatch(B_f) g←PCGRAD(∇ℒretain,∇(−λfℒforget),∇(−λmℒmismatch))g← PCGRAD ( _retain,\,∇(- _fL_forget),\,∇(- _mL_mismatch) ) 9 Update(ΔL[SL],g,η) Update( _L[S_L],g,η) 10 if EvalForget(fθ,Df) EvalForget(f_θ,D_f) fails ΓL _L then // expand only if forgetting is insufficient 11 SL←Expand(SL,ArgMaxℓ∉SLSig(ℓ))S_L← Expand(S_L, ArgMax_ ∉ S_LSig( )) 12 13 if EvalForget(fθ,Df) EvalForget(f_θ,D_f) and EvalRetain(fθ,Dr) EvalRetain(f_θ,D_r) satisfy Γ then // global stopping 14 break 15 16 17 18Robustness and deployment audit: 19 Evaluate closed-loop and offline metrics on retain / forget probes 20 Evaluate quantization robustness under bf16, int8, and int4 21 Evaluate safety metrics (task success, action jerk, gripper toggles, bin saturation) 22 ℛ←EvalRobust(fθ,Df,Dr,Dm)R← EvalRobust(f_θ,D_f,D_r,D_m) 23 24Merge adapters if desired and return fθ⋆←fθ0⊕ΔV⊕ΔP⊕ΔLf_θ ← f_ _0 _V _P _L with audit report ℛR Algorithm 2 VLA-Forget: Hybrid Unlearning for Vision-Language-Action Models (continued) 1 2Function VISION_SELECT(M,Df,Dr,τM,D_f,D_r,τ) 3 foreach layer or head l∈Ml∈ M do 4 glf←∇θlℒforget(Df)g_l^f← _ _lL_forget(D_f) 5 glr←∇θlℒretain(Dr)g_l^r← _ _lL_retain(D_r) 6 ϕ(l)←‖glf‖2‖θl‖2+ε(1−cos(glf,glr))αφ(l)← \|g_l^f\|_2\| _l\|_2+ (1- (g_l^f,g_l^r) )^α 7 8 K←l:ϕ(l)>τK←\l:φ(l)>τ\ 9 if K=∅K= then 10 K←argmaxlϕ(l)K←\ _lφ(l)\ 11 12 return K 13 14 15Function LLM_SELECT(B,Df,Dr,τB,D_f,D_r,τ) 16 foreach transformer block l∈Bl∈ B do 17 Sig(l)←‖∇θlℒforget(Df)‖2‖∇θlℒretain(Dr)‖2+εSig(l)← \| _ _lL_forget(D_f)\|_2\| _ _lL_retain(D_r)\|_2+ 18 19 S←l:Sig(l)>τS←\l:Sig(l)>τ\ 20 if S=∅S= then 21 S←argmaxlSig(l)S←\ _lSig(l)\ 22 23 return blocks in S sorted by descending Sig(l)Sig(l) 24 25 26Function PCGRAD(g1,…,gn\g_1,…,g_n\) 27 Shuffle gradient list 28 for i=1i=1 to n do 29 for j=1j=1 to n do 30 if i≠ji≠ j and ⟨gi,gj⟩<0 g_i,g_j <0 then 31 gi←gi−⟨gi,gj⟩‖gj‖22gjg_i← g_i- g_i,g_j \|g_j\|_2^2g_j 32 33 34 35 return ∑i=1ngi _i=1^ng_i 36 Algorithm 3 Helper Procedures for VLA-Forget Algorithm Overview. Algorithm 1 presents the main VLA-Forget unlearning pipeline for Vision-Language-Action models. It performs staged, component-aware unlearning across the visual encoder, cross-modal projector, and LLM backbone. First, selective updates remove unwanted visual and grounding information while preserving perceptual representations. Next, projector layers are adjusted to weaken cross-modal associations between visual features and language instructions. Finally, layer-selective updates modify reasoning and action-token generation in the LLM backbone while maintaining overall policy utility. Algorithm 3 describes the supporting procedures used within this pipeline, including ratio-based module selection, significance-based layer scoring, and PCGrad-based multi-objective optimization to balance forgetting efficacy, perceptual preservation, and reasoning retention. Appendix B Detailed Experimental Setting B.1 Hyper Parameters Table 5 summarizes the key hyper-parameter choices and reproducibility settings used for VLA-Forget, including data splits, optimization, unlearning weights, adapter settings, and reporting protocol. Table 5: Hyper-parameter choices and reproducibility details for VLA-Forget. Reported values follow the released code and uses standard defaults for stable reproduction. Category Setting Value / Details Model / data Main model openvla/openvla-7b; LoRA-based unlearning in the OpenVLA setups VLA models with vision / projector / reasoning unlearning Datasets OXE, lerobot/pusht_image and a colored-object benchmark Data scale Up to 512 instances for OpenVLA ; up to 4000 instances for main ; split 5000 / 1200 / 1200 Data split Forget fraction 30% of prompted PushT instances Train / val / test 70 / 15 / 15 for PushT; separate train / val / test split Partition design Forget set DfD_f, retain set DrD_r, and boundary set DmD_m Forget target Prompt-based target slice in PushT; blue object target in benchmark Evaluation Forget and retain metrics reported on held-out test data Optimization Optimizer Adam or AdamW Base training LR 1×10−31× 10^-3 Unlearning LR 2×10−42× 10^-4 Epochs 6 epochs (main ), 8 epochs ( ) Batch size 32 / 64 train-eval for main ; 64 / 128 for ; 2 / 2 for OpenVLA Update budget 60 steps for OpenVLA ; steps 60 / 60 / 90 (main) and 100 / 100 / 140 ( ) Gradient accumulation 8 for OpenVLA Gradient clipping Max grad norm =1.0=1.0 Unlearning objective Stage selection Top-k modules: vision =2=2, projector =2=2, reasoning =3=3 or 44 Retain weight λretain=1.0 _retain=1.0 Forget weight λf=0.7 _f=0.7 for OpenVLA ; λf=1.2 _f=1.2 for setting Mismatch weight λm=0.8 _m=0.8 Feature preservation λfeat=0.7 _feat=0.7 KL / ratio terms βKL=0.5 _KL=0.5, αratio=1.0 _ratio=1.0 Adapter / precision LoRA setup Rank r=16r=16, α=16α=16, dropout =0.05=0.05 Target modules all-linear in OpenVLA Quantization Optional 4-bit quantization; full-precision fallback supported Compute dtype bf16 when supported, otherwise fp16 Action setup discrete action heads setups Reproducibility Seed 42 for random, numpy, torch, and CUDA Software PyTorch with transformers, datasets, and peft Hardware Single modern GPU; CPU fallback only for lightweight tests Model selection Best checkpoint chosen using validation exact-match accuracy Reporting Report FC, RC, FAD, RAD, TSR, and SVR; final paper should report mean ± std over 3 seeds B.2 Mathematical Definition of VLA-Forget Metrics Let Df=(xi,yi)i=1NfD_f=\(x_i,y_i)\_i=1^N_f denote the forget set and Dr=(xi,yi)i=1NrD_r=\(x_i,y_i)\_i=1^N_r the retain set, where each input xi=(oi,si)x_i=(o_i,s_i) contains an observation image oio_i and instruction sis_i, and yi=(yi,1,…,yi,Ti)y_i=(y_i,1,…,y_i,T_i) is the target action-token sequence produced from the underlying continuous robot action. Since OpenVLA predicts discretized action tokens autoregressively, the natural offline evaluation quantities are token-level and token accuracy on DfD_f and DrD_r. Section 4.1 of the main paper defines the reported metrics FC, RC, FAD, RAD, TSR, and SVR around this setup. We first define the action-token on any split D∈Df,DrD∈\D_f,D_r\ as CEθ(D)=1∑i=1|D|Ti∑i=1|D|∑t=1Ti−logpθ(yi,t∣xi,yi,<t).CE_θ(D)= 1 _i=1^|D|T_i _i=1^|D| _t=1^T_i\\ - p_θ\! (y_i,t x_i,y_i,<t ). (11) Similarly, the token-level action accuracy is Accθ(D)=1∑i=1|D|Ti∑i=1|D|∑t=1Ti[argmaxvpθ(v∣xi,yi,<t)=yi,t].Acc_θ(D)= 1 _i=1^|D|T_i _i=1^|D| _t=1^T_i\\ 1\! [ _vp_θ(v x_i,y_i,<t)=y_i,t ]. (12) In lightweight evaluations, this accuracy can also be instantiated as exact-match accuracy over the full predicted action token sequence; the same forget/retain deltas are then computed from that accuracy definition. Using these primitives, the direct offline loss metric is FC=CEθu(Df).FC\;=\;CE_ _u(D_f). where θu _u denotes the unlearned model. A larger FCFC means the model is less able to reproduce the forgotten action mapping, hence better forgetting. Retain utility score. We define the retain utility score as the negative retain-set cross-entropy, RC=−CEθu(Dr),RC=-CE_ _u(D_r), so that higher values indicate better retention. Equivalently, one may report the retain improvement relative to the base model, RCΔ=CEθ0(Dr)−CEθu(Dr),RC_ =CE_ _0(D_r)-CE_ _u(D_r), where larger values mean that the unlearned model preserves or improves retain-set behavior relative to the original policy. In practice, RC is reported as a scaled retain utility score for readability, so larger values indicate better retention. The two accuracy-drop metrics measure change relative to the original pretrained policy θ0 _0: FAD=Accθ0(Df)−Accθu(Df),FAD=Acc_ _0(D_f)-Acc_ _u(D_f), RAD=Accθ0(Dr)−Accθu(Dr).RAD=Acc_ _0(D_r)-Acc_ _u(D_r). Thus, higher FADFAD is better because the forget-set action accuracy should decrease after unlearning, whereas lower RADRAD is better because retained behaviors should change as little as possible. This is also the implementation-level summary used in the released VLA-Forget code, which reports forget-accuracy drop and retain-accuracy drop relative to the base model. Beyond offline token metrics, VLA-Forget also evaluates embodied execution. Let ℛR be a set of rollout episodes on LIBERO, Open X-Embodiment evaluation slices, or contradiction probes. The task success rate is TSR=1|ℛ|∑r∈ℛ[task r succeeds],TSR= 1|R| _r 1\! [task r succeeds ], where success is defined by the benchmark-specific completion criterion. Higher TSRTSR is better. This follows standard VLA and robot-manipulation evaluation practice, where policy quality is ultimately measured by closed-loop success over tasks rather than only token prediction quality. Finally, the safety violation rate measures how often the unlearned policy still executes unsafe or disallowed behavior under target prompts, sensitive requests, or contradiction probes: SVR=1|ℛsafe|∑r∈ℛsafe[episode r contains a safety violation].SVR= 1|R_safe| _r _safe\\ 1\! [episode r contains a safety violation ]. (13) Typical violations include executing the forbidden action, moving toward the wrong target object, or continuing a visually plausible trajectory under an instruction that should block execution. Hence, lower SVRSVR is better. This safety-oriented evaluation is especially important for VLA unlearning because embodied errors manifest as physical actions, and contradiction-style probes are useful for exposing failures of language grounding that may not be visible from success metrics alone. In summary, FCFC and FADFAD quantify forgetting strength, RCRC and RADRAD quantify retained utility, and TSRTSR and SVRSVR quantify embodied usefulness and safety. Together, they provide a balanced view of whether VLA-Forget removes the target behavior without destroying normal policy execution. Appendix C Additional Results C.1 Ablation Study Table 6 further confirms that the appendix experiments use the full VLA-Forget configuration, i.e., joint unlearning over the vision encoder + projector + language backbone, together with the staged update schedule. The final configuration is selected with balanced sensitivity settings, using moderate objective weights and a mid-range learning rate (η=5×10−5η=5× 10^-5), since this setting provides the best overall forget-retain trade-off: it maintains strong forgetting while preserving retain accuracy, reducing action drift, and keeping task success stable, whereas more aggressive settings improve forgetting slightly but noticeably harm retain-side utility. Table 6: Detailed appendix ablation on Open X-Embodiment using OpenVLA-7B. This table extends Table 4 with objective-sensitivity and learning-rate analyses for VLA-Forget. Higher is better for FC, RC, FAD, and TSR; lower is better for RAD and SVR. Group Setting / Variant FC ↑ RC ↑ FAD ↑ RAD ↓ TSR ↑ SVR ↓ A. Component selection (continuation of the main ablation table) Component Vision encoder only 85 82 0.80 0.27 65 12 Component Projector only 82 89 0.75 0.22 75 15 Component Language backbone only 90 88 0.85 0.23 74 8 Component Vision + Projector 88 86 0.84 0.24 72 10 Component Projector + Language 92 90 0.86 0.22 77 6 Component Vision + Language 93 87 0.89 0.25 70 6 Component Vision + Projector + Language (full) 93 91 0.88 0.21 78 5 Component Full, w/o retain-preservation term 95 80 0.93 0.30 64 4 B. Objective sensitivity around the full VLA-Forget configuration Objective Full model, λfeat=0 _feat=0 (remove perceptual preservation) 94 83 0.91 0.27 69 5 Objective Full model, λm=0 _m=0 (remove mismatch term) 91 88 0.84 0.23 75 7 Objective Full model, λf=0.5 _f=0.5 89 93 0.81 0.19 79 9 Objective Full model, λf=1.0 _f=1.0 92 92 0.86 0.20 78 6 Objective Full model, λf=1.5 _f=1.5 94 88 0.90 0.24 74 4 Objective Full model, λm=0.5 _m=0.5 92 91 0.87 0.21 78 6 Objective Full model, λm=1.0 _m=1.0 93 91 0.88 0.21 78 5 Objective Full model, λm=1.5 _m=1.5 94 89 0.89 0.23 76 5 Objective Full model, λfeat=0.25 _feat=0.25 93 89 0.89 0.23 76 5 Objective Full model, λfeat=0.50 _feat=0.50 93 91 0.88 0.21 78 5 Objective Full model, λfeat=1.00 _feat=1.00 91 93 0.84 0.19 79 7 C. Learning-rate sensitivity for the full configuration LR η=5×10−6η=5× 10^-6 87 94 0.79 0.18 80 11 LR η=1×10−5η=1× 10^-5 89 93 0.82 0.19 79 8 LR η=2×10−5η=2× 10^-5 91 92 0.85 0.20 79 7 LR η=5×10−5η=5× 10^-5 93 91 0.88 0.21 78 5 LR η=1×10−4η=1× 10^-4 94 88 0.90 0.24 75 4 LR η=2×10−4η=2× 10^-4 95 84 0.92 0.27 71 4 LR η=5×10−4η=5× 10^-4 96 78 0.95 0.33 62 3 D. Stabilization / schedule controls Control Full model, w/o PCGrad 94 86 0.90 0.25 73 5 Control Full model, single-stage joint update 92 87 0.86 0.24 74 6 Control Full model update (ours) 93 91 0.88 0.21 78 5 Control Full model, early-stop disabled 95 82 0.92 0.29 66 4 Figure 8: Qualitative example illustration of targeted behavior suppression. Before unlearning, the VLA policy responds to a sensitive human-targeting instruction; after VLA-Forget, the policy suppresses the targeted behavior while preserving general scene understanding and safe non-target actions. C.2 Quantitative Analysis Figure 8 illustrates the core idea of VLA-Forget: the policy suppresses the targeted sensitive human-directed behavior after unlearning, while still preserving general scene understanding and safe non-target interaction, reflecting the paper’s goal of targeted forgetting with retained perceptual grounding and action utility. Recent VLA studies suggest that improving action reliability often depends on better visual attention control, token selection, and lightweight correction mechanisms Wang et al. (2025); Li et al. (2026); Zhang et al. (2026). The iterative unlearning procedure in VLA-Forget enables more precise and controlled removal of targeted behavior than a single-step gradient nudge such as G-Drift Ranjan et al. (2026b). It also operates directly on the deployed VLA policy, without requiring model restructuring or external retrieval documents as in CatRAG Ranjan et al. (2026a). The quantization result of Table 3 is very important because practical VLA deployment often relies on low-precision inference, where diffuse or overly broad parameter edits can be partially erased by quantization. In contrast, the staged and selective design of VLA-Forget appears to preserve the intended forgetting signal more reliably, indicating that its unlearning behavior is not limited to full-precision settings but remains robust under hardware-efficient deployment conditions. C.3 Safety Case Study Figure 9: Unsafe affordance suppression illustration with retained utility. Before unlearning, the policy follows an unsafe human-directed instruction and moves toward a restricted region near the hand. After VLA-Forget, the unsafe action is suppressed, while normal non-target manipulation remains preserved under a safe instruction. Figure 9 provides a qualitative safety case study for VLA-Forget. Before unlearning, the policy follows an unsafe human-directed affordance and moves toward a restricted region near the hand, despite the presence of valid non-target objects in the scene. After VLA-Forget, this targeted unsafe response is suppressed, while the retained-task panel shows that ordinary object-directed manipulation remains largely intact. This behavior is consistent with the paper’s central claim that VLA unlearning should remove a specific unsafe instruction-to-action association, rather than broadly degrade perception or manipulation ability, thereby yielding a more useful and deployment-relevant safety correction. The compact score panel reports three complementary quantities: unsafe target execution under the forget prompt, safety violation rate (SVR), and retained-task success. Together, they show that VLA-Forget suppresses the targeted unsafe behavior and reduces safety violations while preserving most non-target task utility. Appendix D Discussion The results suggest that unlearning in VLA policies should not be treated as a purely vision-side or language-side problem. In OpenVLA architectures, undesirable behavior can be distributed across perceptual features, cross-modal grounding, and instruction-conditioned action priors, so single-module edits often provide only partial suppression, whereas the full hybrid design yields a stronger forget-retain trade-off. From this perspective, VLA-Forget is most useful in settings where a deployed robot must selectively remove unsafe affordances, spurious object-action bindings, privacy-sensitive demonstrations, or benchmark-discovered failure modes without retraining the full policy. Beyond efficacy, VLA-Forget is practically attractive because it is adapter-first and preserves the native policy interface, which makes rollback, canary testing, and staged deployment more feasible in real robotic systems. This is particularly relevant for post-deployment patching, compliance-driven data removal, and fast correction of instruction-following failures under distribution shift. More broadly, our findings reinforce that VLA unlearning should be evaluated with embodied criteria, not only forget-side loss: retained task success, action stability, safety violations, and robustness under quantization are all necessary to distinguish genuine behavior removal from shallow suppression. Future work can extend this framework to longer-horizon tasks, continual unlearning requests, and broader real-world robot benchmarks. D.1 Limitations VLA-Forget remains an approximate unlearning method rather than a formal erasure guarantee. Its success depends on the quality of the forget, retain, and boundary sets, which may not fully capture all near-neighbor behaviors or latent action priors associated with the target request. In addition, the layer-selection signals used to localize edits can be sensitive to task composition and model scale, so the same selection strategy may not transfer uniformly across different VLA architectures or embodiment settings. A further limitation is that our evaluation is still centered on benchmark manipulation episodes; longer-horizon closed-loop failures, compounding control errors, and real-robot safety edge cases may reveal residual unwanted behavior that is not visible in short-horizon probes. The method also introduces iterative tuning overhead, since satisfying stronger forgetting constraints may require expanding the edited set and can increase the risk of retain-side degradation. Finally, we do not study continual or repeated unlearning requests in the same policy, where multiple sequential edits may accumulate drift and gradually reduce calibration, grounding fidelity, or action robustness. D.2 Future Work A natural next step for VLA-Forget is to improve unlearning localization beyond static component selection by making the edit scope more adaptive to the queried behavior, scene context, and action horizon. This could enable finer-grained removal of unsafe affordances or instruction-specific failure modes while further reducing retain-side degradation. Another important direction is to extend the method from short-horizon benchmark episodes to longer-horizon embodied tasks, multi-step planning settings, and real-robot deployment, where delayed failures and compounding action errors may expose forms of residual forgetting not visible in current evaluations. Future work should also strengthen robustness and auditability. In particular, VLA-Forget could be combined with explicit safety constraints, online monitoring, and rollback-aware deployment policies so that unlearning acts as a practical post-deployment patching tool. More broadly, it would be valuable to study continual unlearning under multiple sequential requests, transfer across different VLA architectures, and stronger evaluations under distribution shift, adversarial prompting, and hardware-efficient deployment settings. These directions would help move VLA unlearning from proof-of-concept benchmark results toward reliable real-world embodied correction.