Paper deep dive
From Logits to Latents: Contrastive Representation Shaping for LLM Unlearning
Haoran Tang, Rajiv Khanna
Models: Llama-2-7B, Llama-3-8B
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/11/2026, 1:01:06 AM
Summary
The paper introduces CLReg, a contrastive representation regularizer for LLM unlearning. CLReg addresses the limitation of existing unlearning methods that often act as suppressors, leaving forgotten concepts entangled with retained knowledge in the latent space. By using a contrastive loss to push forget features away from retain features while pulling them toward their own augmentations, CLReg reduces forget-retain entanglement, facilitating more effective unlearning without requiring retraining from scratch or introducing extra privacy risks.
Entities (5)
Relation Signals (3)
CLReg → reduces → Forget-Retain Entanglement
confidence 95% · CLReg decreases forget-retain representation entanglement that facilitates mainstream unlearning methods
CLReg → uses → Contrastive Loss
confidence 95% · a DPO-style contrastive loss encourages forget embeddings to cluster with their own augmentations and repel retain features.
CLReg → integrateswith → Mainstream Unlearning Methods
confidence 90% · We integrate this regularizer with existing unlearning algorithms, demonstrating its versatility across different algorithmic families.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Most LLM unlearning methods aim to approximate retrain-from-scratch behaviors with minimal distribution shift, often via alignment-style objectives defined in the prediction space. While effective at reducing forgotten content generation, such approaches may act as suppression: forgotten concepts can persist in representations and remain entangled with retained knowledge. We introduce CLReg, a contrastive representation regularizer that identifies forget features while pushing them away from retain features, explicitly reducing forget-retain interference with minimal shifts on retain features. We provide first theoretical insights that relate representation shaping to entanglement reduction. Across unlearning benchmarks and LLMs of different sizes, CLReg decreases forget-retain representation entanglement that facilitates mainstream unlearning methods without positing extra privacy risks, inspiring future work that reshapes the representation space to remove forget concepts.
Tags
Links
Trouble viewing inline? Open PDF directly →
Full Text
59,305 characters extracted from source content.
Expand or collapse full text
From Logits to Latents: Contrastive Representation Shaping for LLM Unlearning Haoran Tang Rajiv Khanna Abstract Most LLM unlearning methods aim to approximate retrain-from-scratch behaviors with minimal distribution shift, often via alignment-style objectives defined in the prediction space. While effective at reducing forgotten content generation, such approaches may act as suppression: forgotten concepts can persist in representations and remain entangled with retained knowledge. We introduce CLReg, a contrastive representation regularizer that identifies forget features while pushing them away from retain features, explicitly reducing forget–retain interference with minimal shifts on retain features. We provide first theoretical insights that relate representation shaping to entanglement reduction. Across unlearning benchmarks and LLMs of different sizes, CLReg decreases forget-retain representation entanglement that facilitates mainstream unlearning methods without positing extra privacy risks, inspiring future work that reshapes the representation space to remove forget concepts. Machine Learning, ICML 1 Introduction Figure 1: An illustrator of our proposed CLReg. An effective representation shaping regularization can identify and push away forget features with minimal shifts on retain features, shedding light on surgical removal of forget concepts. The ability to remove the influence of specific training data after a model has been deployed—commonly referred to as machine unlearning—is increasingly important for privacy legislation and model maintenance. Large language models (LLMs) exacerbate this need: they can memorize and regenerate verbatim sequences from training corpora, making it necessary to delete objectionable or proprietary content on demand. Retraining a model from scratch on the retained data is the gold‐standard solution, but the computational cost is prohibitive for modern LLMs. Consequently, recent years have seen a surge of approximate unlearning methods that aim to efficiently approximate the behaviors of a retrained model. Early work on machine unlearning evolve from simple heuristics such as fine‑tuning on the retain set and gradient ascent on the forget set to student–teacher distillation and saliency‑based weight masking (Kurmanji et al., 2023; Fan et al., 2024b). While effective in small models, these approaches often degrade utility or require careful hyperparameter tuning. Recent investigations reveal that unlearning becomes harder when the forget and retain distributions are more entangled or when the forget examples are heavily memorized (Zhao et al., 2024); disentangling these representations is thus crucial for selective forgetting. Unlearning in LLMs is particularly challenging. Naively applying loss maximization on the forget set leads to instability and catastrophic degradation of general capabilities. Recent alignment‑based methods have dominated the literature: Negative Preference Optimization (NPO) (Zhang et al., 2024) reweighs the forgetting objective to discourage generating forgotten content while preserving utility; SimNPO (Fan et al., 2024a) simplifies this objective to reduce bias from the reference model. Other approaches include self‑distillation with adjusted logits (Dong et al., 2024), and primal–dual constrained entropic unlearning (Entesari et al., 2025). Despite their differences, these methods share a common philosophy: they align the unlearned model’s prediction distribution with that of a retrained model, implicitly treating deviations in representation space as undesirable. Alignment‑style objectives succeed in reducing the probability of forgotten outputs, but they largely operate as suppressors—the forgotten concepts continue to reside in the representation space, often remain entangled with retained ones in the hidden activations. As a result, the model may still leak forgotten information or struggle to unlearn highly entangled features. An emerging view is that representation shaping could address this limitation. Recent empirical work demonstrates that the difficulty of unlearning correlates with the degree of entanglement between forget and retain features (Zhao et al., 2024; Tang and Khanna, 2025). Separating these clusters should make it easier to adjust or erase one without distorting the other. In the broader representation‑learning literature, contrastive objectives are well known for simultaneously aligning similar examples and dispersing all representations on the hypersphere (Wang and Isola, 2020). Methods such as SimCLR (Chen et al., 2020) and SimCSE (Gao et al., 2021) show that simple augmentations and a cosine‑similarity loss encourage tight clustering of positive pairs and uniform distribution of negatives. Building on this principle, contrastive unlearning has been proposed for small classifiers: Lee et al. (2025) use a supervised contrastive loss to push forget embeddings away from their original class and pull them toward alternative regions, while Khalil et al. (2025) align forget examples with retain semantics in low‑capacity models. These works suggest that explicitly shaping the feature space can make forgetting more targeted and reduce collateral damage. However, they operate in supervised classification settings with modest model sizes and rely on clear labels to define positives and negatives. It remains unclear whether similar benefits extend to generative LLMs with self-supervision, where forget targets may be instance‑specific and the representation space is high‑dimensional. In this paper we propose contrastive representation regularization (CLReg). Our key idea is to isolate forget features and push them away from retain features in the latent space, thereby reducing entanglement while minimally perturbing the retain representation. We construct positive pairs for forget examples using lightweight augmentations (dropout masks and paraphrases) and treat retain embeddings as negatives; a DPO‑style contrastive loss encourages forget embeddings to cluster with their own augmentations and repel retain features. We integrate this regularizer with existing unlearning algorithms, demonstrating its versatility across different algorithmic families. We provide first theoretical analysis to show that contrastive updates strictly decrease anchor–negative similarity and increase separation between forget and retain distributions, providing a principled link between representation shaping and entanglement reduction. Empirically, across multiple benchmarks and LLMs, CLReg reduces entanglement and improves forgetting quality when combined with state‑of‑the‑art unlearning methods without introducing privacy risks. These findings challenge the prevailing belief that representation distributions must remain close to a retrained model to achieve effective unlearning; instead, explicit representation shaping can facilitate unlearning and inspire future research on latent‑space interventions. Visualization on the reduced entanglement by CLReg also reveals a clear separation between forget and retain features, enlightening more surgical future work in representation shaping to remove forget concepts completely. Our contributions can be summarized as follows: Rethinking representation shaping: Our study effectively shows that regularizing forget concepts in the representation space will not deviate the goal of unlearning or lead to collapse. Instead, our CLReg effectively separates forget features with minimal shifts on retain features, and improves unlearning performance with little privacy concerns. Theoretical and empirical analysis on entanglement: We are the first to relate a regularizing objective with entanglement reduction in the representation space, which grounds the success of CLReg. Moreover, we provide sufficient quantitative and qualitative analysis to show that CLReg reduces forget-retain feature entanglement by pushing away forget features while keeping retain features intact. Novel regularizer CLReg: We propose CLReg for representation shaping, which provides a novel insight on how to construct contrastive signals in unlearning without supervision. It also incorporates preference learning and symmetric optimization as options, demonstrating flexibility in extended use cases. Empirical validation: We conduct extensive empirical studies to show the effectiveness and desired properties of CLReg. While it consistently improves mainstream unlearning methods across datasets and model sizes, our empirical studies also discloses how CLReg pushes away forget features, inspiring future work. 2 Related Work 2.1 Foundations in Unlearning Early work on machine unlearning has focused on approximate methods to efficiently erase the influence of designated forget examples from trained neural networks. A common baseline is to fine-tune the model on the remaining retain data, relying on catastrophic forgetting to reduce performance on the forget set (Golatkar et al., 2020; Warnecke et al., 2021). More direct approaches perform gradient ascent on the forget set, maximizing the forget loss to actively degrade the model’s memory of those samples. While effective at reducing forget-set performance, naive ascent can substantially harm overall utility and induce collateral forgetting. Variants such as NegGrad+ balance objectives by jointly maximizing loss on the forget set while minimizing loss on the retain set (Kurmanji et al., 2023). Kurmanji et al. (2023) adopt student-teacher training following this scheme. Another family of techniques aims to restrict updates to salient parameters. SalUn identifies weights that are most responsible for predicting the forget set and updates only these components, targeting erasure while limiting damage to retained behavior (Fan et al., 2024b). Other paradigms include label remixing or approximating second-order updates that estimate the contribution of each forgotten sample (Graves et al., 2021; Izzo et al., 2021). Across these genres, the gold standard remains retraining from scratch on the dataset with the forget set removed, which is typically infeasible at scale. A central difficulty is balancing forget quality against utility, i.e., preserving performance on retained knowledge. 2.2 LLM Unlearning Large language models (LLMs) exacerbate the unlearning problem due to scale and the generative objective, where memorized sequences can be reproduced verbatim. Early adaptations of classical unlearning to LLMs rely on gradient matching or difference-of-gradients objectives (e.g., GradDiff) to counteract the effect of the forget set while preserving retained behavior (Maini et al., 2024). To improve stability, Zhang et al. (2024) proposed Negative Preference Optimization (NPO), an alignment-inspired objective that discourages generation of forget data while controlling optimization dynamics. NPO improves the utility-forgetting trade-off and enables substantially larger-scale forgetting on benchmarks such as TOFU (Maini et al., 2024). However, subsequent work noted that reference-model choices and calibration can bias the optimization toward easy-to-forget instances and lead to uneven forgetting; Fan et al. (2024a) introduced SimNPO to simplify the objective and mitigate such bias. Dong et al. (2024) proposed UnDIAL, which avoids explicit loss maximization by using a distillation-like objective to smoothly suppress undesired behavior and prevent training collapse. More recently, Entesari et al. (2025) formulated LLM unlearning as constrained optimization via a primal-dual framework, yielding improved Pareto trade-offs. 2.3 Contrastive Learning for Unlearning Contrastive objectives offer a complementary path: rather than relying only on parameter updates that indirectly affect behaviors, they explicitly shape representations to reduce retain-forget entanglement. In classical settings, Lee et al. (2025) proposed a supervised contrastive unlearning objective that pushes embeddings of forget samples away from their original class clusters and pulls them toward alternative regions, enabling selective forgetting while largely preserving performance on retained data. Khalil et al. (2025) introduced CoUn, which leverages contrastive learning to restructure latent space such that forget examples align with semantics induced by the retain data. Both approaches highlight that representation-space restructuring can make forgetting more targeted and reduce collateral damage in small-to-medium scale networks and datasets. However, existing contrastive-unlearning work has been primarily demonstrated in supervised classification regimes with relatively small models and datasets, where class labels provide a natural contrastive signal and the forget target is often class- or subset-defined. Extending contrastive objectives to LLM unlearning introduces additional challenges: the forget target may be instance-specific or concept-level without clear labels, the model is vastly larger, and the evaluation criterion is not merely representation separation but behavioral equivalence to a retain-only retrained model. Our method builds on this gap by applying a contrastive objective to isolate and push away forget features from retain features in LLM representations, thereby reducing entanglement while sharpening the induced prediction distribution. 3 CLReg: Contrastive Regularization 3.1 Preliminaries Let FTW_FT denote the finetuned model, RTW_RT the retrained (target) model trained from scratch on the retain set, and ULW_UL the model undergoing unlearning. We access to an original training set S drawn from distribution D, which is later decomposed into a retain set ℛR and a forget set ℱF after finetuning, with ℛ=∖ℱR=S and |ℛ|>|ℱ||R|>|F|. For any model W, we denote by h(x)∈ℝT×dh_W(x) ^T× d the hidden-state matrix of W for input x with T tokens and d hidden dimension. We define Pool(h,m)=∑tmtht/∑tmtPool(h,m)= _tm_th_t/ _tm_t to be mean pooling of hidden states with attention mask m and token position index t. For brevity, we write ζ(x)=norm(Pool(h(x),m(x)))∈d−1 _W(x)=norm\! (Pool(h_W(x),m(x)) ) ^d-1 for the ℓ2 _2–normalized embedding (unit sphere) and use cosine similarity s(u,v)=u⊤vs(u,v)=u v. 3.2 Separating Forget Concepts We draw inspiration from recent advances in contrastive representation learning that emphasize alignment (bringing positive pairs close) and uniformity (spreading all representations) (Wang and Isola, 2020). For each forget example xf∈ℱx_f we construct a positive pair (zf,zf+)(z_f,z_f^+) via light augmentations: zf z_f =Pool(Dropout(hUL(xf),p),m(x)), =Pool(Dropout(h_UL(x_f),p),m(x)), zf+ z_f^+ =Pool(Dropout(hUL(Paraphrase(xf)),p′),m(x)). =Pool(Dropout(h_UL(Paraphrase(x_f)),p ),m(x)). Here p,p′∼(μ,σ)p,p (μ,σ) are independently sampled dropout rates which help differentiate zfz_f from zf+z_f^+ (Gao et al., 2021). In practice we pick (0.1,0.05)N(0.1,0.05) and clamp p to [0,0.2][0,0.2] to add randomness as data augmentation. The paraphrase of xfx_f is precomputed by a language model; if paraphrasing is unavailable we simply set xf+=xfx_f^+=x_f. For each forget item xfx_f and retain item xr∈ℛx_r we also form a negative pair (zf,zr−)(z_f,z_r^-) where zr−=Pool(hUL(x),m(x)), without dropout.z_r^-=Pool(h_UL(x),m(x)), without dropout. A DPO-style contrastive loss encourages the positive pair to have higher similarity than the negative pair: ℒCLdpo=−2τB∑i=1Blogσ(s(zf,zf+)−s(zf,zr−)τ),L_CL^dpo=- 2τB _i=1^B σ ( s(z_f,z_f^+)-s(z_f,z_r^-)τ ), (1) where σ is the sigmoid, B is the batch size and the temperature τ>0τ>0 controls hardness of negatives. Alternatively, a standard InfoNCE loss ℒCLinfoL_CL^info (Oord et al., 2018) can be used: the logits concatenate the positive similarity and all cross-retain similarities, and a cross-entropy loss identifies the positive as the correct one. Both forms can be symmetrized by swapping anchor/negative roles (retain vs. forget). Combined objective. Our CLReg acts as a regularizer on top of any base unlearning algorithm. Suppose ℒforgetL_forget and ℒretainL_retain denote the forget and retain losses (e.g. SimNPO for ℒforgetL_forget and cross-entropy for ℒretainL_retain). We minimize ℒ=αℒretain+γℒforget+λℒCL,L= _retain+ _forget+ _CL, (2) with hyperparameters α,γ,λ≥0α,γ,λ≥ 0. The CL term shapes the representation space while ℒforgetL_forget unlearns ℱF and ℒretainL_retain preserves ℛR. By intuition, ℱF-specific knowledge are less fundamental, higher-level features. We thus perform CLReg in later feature layers such as last layer to maximize effectiveness. 3.3 Theoretical Insights Contrastive learning theory posits that optimizing objectives implicitly maximizes two quantities: alignment of positive pairs and uniformity (or separation) among all representations on the unit hypersphere. We formalize how these properties reduce the entanglement of forget and retain features which can lead to easier unlearning. Definition 3.1. (Distributional separation and entanglement). Let ζθ(x)∈ℝd _θ(x) ^d denote the embedding of an input x under parameters θ (pooled hidden states and normalized). Let ℱθ=Law(ζθ(x)|x∈ℱ),ℛθ=Law(ζθ(x)|x∈ℛ),P_F^θ=Law ( _θ(x)\;|\;x ),P_R^θ=Law ( _θ(x)\;|\;x ), denote the induced distributions of embeddings from forget and retain sets. A separation measure between (ℱθ,ℛθ)(P_F^θ,P_R^θ) is any probability metric D such that D(ℱθ,ℛθ)=0D(P_F^θ,P_R^θ)=0 if and only if ℱθ=ℛθP_F^θ=P_R^θ. High separation D(ℱθ,ℛθ)D(P_F^θ,P_R^θ) corresponds to low entanglement, whereas low separation (or high overlap) indicates that the representations of ℱF and ℛR are intertwined. Proposition 3.2. (Anchor update for DPO-CL). Consider a single ℒCLdpoL_CL^dpo term with i-th forget sample and j-th retain sample ℓij(θ)=−2τlogσ(mijτ),mij=s(ai,pi)−s(ai,nj), _ij(θ)=-2τ σ\! ( m_ijτ ),m_ij=s(a_i,p_i)-s(a_i,n_j), where ai=ζθ(xfi)a_i= _θ(x_f_i) is the anchor (forget embedding), pi=ζθ(xfi+)p_i= _θ(x_f_i^+) is its positive (paraphrased or dropout-augmented), nj=ζθ(xrj)n_j= _θ(x_r_j) is a negative (retain embedding), and s(u,v)=u⊤vs(u,v)=u v. Suppose ai,pi,nj∈d−1a_i,p_i,n_j ^d-1. The gradient of ℓij _ij with respect to aia_i is ∇aiℓij=−2σ(−mijτ)(pi−nj). _a_i _ij=-2\,σ\! (- m_ijτ )\, (p_i-n_j ). In particular, a gradient descent step ai′=ai−η∇aiℓija_i =a_i-η\, _a_i _ij (with small η>0η>0) moves aia_i toward pip_i and away from njn_j. If pi≠njp_i≠ n_j and η>0η>0, then ai′⊤nj<ai⊤nja_i n_j\;<\;a_i n_j, so the anchor–negative cosine similarity strictly decreases. Proof. Write u=mij/τu=m_ij/τ and compute ∂(−2τlogσ(u))/∂u=−2(1−σ(u))=−2σ(−u).∂(-2τ σ(u))/∂ u=-2(1-σ(u))=-2σ(-u). By chain rule, ∇aiℓij _a_i _ij =−2σ(−mijτ)∇aimij =-2\,σ\! (- m_ijτ )\, _a_im_ij (3) =−2σ(−mijτ)(pi−nj), =-2\,σ\! (- m_ijτ )\, (p_i-n_j ), (4) because ∇ai(ai⊤pi)=pi _a_i(a_i p_i)=p_i and ∇ai(ai⊤nj)=nj _a_i(a_i n_j)=n_j. Updating aia_i by a small step in −(∇aiℓij)-( _a_i _ij) yields ai′=ai+2ησ(−mijτ)(pi−nj).a_i =a_i+2η\,σ\! (- m_ijτ )\,(p_i-n_j). Taking the dot product with njn_j: ai′⊤nj=ai⊤nj+2ησ(−mij/τ)(pi⊤nj−‖nj‖2)a_i n_j=a_i n_j+2η\,σ(-m_ij/τ)\,(p_i n_j-\|n_j\|^2). Since ‖nj‖2=1\|n_j\|^2=1 (normalized) and pi⊤nj≤1p_i n_j≤ 1 (Cauchy–Schwarz), with strict inequality when pi≠njp_i≠ n_j, the increment is negative. Thus, ai′⊤nj<ai⊤nja_i n_j<a_i n_j whenever pi≠njp_i≠ n_j. ∎ Corollary 3.3. (One-step decrease of cross-similarity). Under the same setup as Proposition 3.2, consider the expected cross-similarity (linear kernel overlap) Clin(θ)=[a⊤n],C_lin(θ)=E [a n ], where a=ζθ(xf)a= _θ(x_f) and n=ζθ(xr)n= _θ(x_r) for independent xf∈ℱx_f and xr∈ℛx_r . If a single gradient step on ℓij _ij updates aia_i to ai′a_i while leaving pip_i and all njn_j fixed, then with updated parameters θ′θ , Clin(θ′)≤Clin(θ),C_lin(θ )\;≤\;C_lin(θ), with strict inequality if pi≠njp_i≠ n_j for any updated pair. Hence, the DPO-CL update strictly reduces the expected anchor–negative similarity. Proof. Averaging the inequality ai′⊤nj≤ai⊤nja_i n_j≤ a_i n_j from Proposition 3.2 over the sampled indices (i,j)(i,j) yields ClinC_lin non-increasing. If at least one updated pair has pi≠njp_i≠ n_j, the inequality is strict. ∎ Proposition 3.4. (Increase of separation under CLReg). Let D be any separation measure between distributions satisfying the following: • There exists a continuous cost function c:ℝd×ℝd→ℝc:R^d×R^d such that D(,)D(P,Q) is a non-decreasing function of the expected cross-cost u∼,v∼[c(u,v)]E_u ,\,v \![\,c(u,v)\,]; that is, c(u,v1)≤c(u,v2)impliesD(P,δv1)≤D(P,δv2),c(u,v_1)≤ c(u,v_2)\;implies\;D(P, _v_1)≤ D(P, _v_2), where δv _v denotes the Dirac measure at v. • The cost c is strictly increasing with respect to the anchor–negative similarity: if s(u1,v)<s(u2,v)s(u_1,v)<s(u_2,v) then c(u1,v)>c(u2,v)c(u_1,v)>c(u_2,v). Then a gradient descent step on ℒCLdpoL_CL^dpo reduces [s(a,n)]E[s(a,n)] and thereby increases D(ℱθ,ℛθ)D(P_F^θ,P_R^θ): D(ℱθ′,ℛθ′)≥D(ℱθ,ℛθ),D (P_F^θ ,\,P_R^θ )\;≥\;D (P_F^θ,\,P_R^θ ), with strict increase when at least one updated anchor has pi≠njp_i≠ n_j. Proof. Corollary 3.3 guarantees that a DPO-CL update decreases [s(a,n)]E[s(a,n)], i.e., anchors are less aligned with negatives. By assumption, c(u,v)c(u,v) increases strictly when similarity s(u,v)s(u,v) decreases. Therefore, [c(a,n)]E[c(a,n)] strictly increases. Condition (1) ensures that D is a non-decreasing function of [c(a,n)]E[c(a,n)]. Consequently, after the update, D(ℱθ′,ℛθ′)D(P_F^θ ,P_R^θ ) is no less than before. When at least one anchor–negative pair is strictly repelled, [c(a,n)]E[c(a,n)] increases strictly, leading to D strictly increasing. ∎ These formal results complement empirical findings: alignment and uniformity analysis demonstrates that contrastive objectives cluster positive samples and separate negatives, and recent unlearning research links entanglement to difficulty in selective forgetting (Zhao et al., 2024). Our theoretical propositions show that CLReg reduces entanglement and thereby providing a principled rationale for its efficacy. 4 Experiment TOFU Llama-3-8B Extraction Strength↓ Forget QA Prob↓ Forget QA ROUGE↓ Forget Quality↑ Forget Score↑ Model Utility↑ Unlearning Score↑ Privacy Leak→ 0 GradDiff 0.06646 0.00498 0.28313 2.63E-10 0.86826 0.53938 0.66540 51.03416 UNDIAL 0.06123 0.20657 0.30030 4.64E-12 0.80476 0.62101 0.70104 -78.91192 NPO 0.12513 0.30622 0.39238 1.37E-07 0.83696 0.66680 0.74225 -69.79255 SimNPO 0.12980 0.10784 0.39639 4.46E-06 0.91079 0.67261 0.77378 -48.65591 PDU 0.06233 0.04992 0.19536 4.36E-09 0.89069 0.57892 0.70173 45.72288 GradDiff+CL 0.14964 0.32726 0.39953 9.91E-11 0.77768 0.67359 0.72191 -48.86873 UNDIAL+CL 0.06201 0.22942 0.31487 9.34E-13 0.78446 0.66806 0.72159 -76.47375 NPO+CL 0.11762 0.28935 0.38650 1.30E-05 0.87003 0.68487 0.76643 -56.01587 SimNPO+CL 0.04593 0.01815 0.11235 0.00229 0.97182 0.69815 0.81256 55.03337 PDU+CL 0.06375 0.07160 0.22932 6.78E-07 0.92574 0.58539 0.71724 29.14540 (a) TOFU unlearning experiment results for Llama-3-8B. For the last four columns, bold indicates the best in-column, and green shades indicate improvement. CLReg consistently improves overall unlearning score and model utility. SimNPO+CL achieves the best performance, and GradDiff+CL achieves the largest improvement. In most cases, CLReg brings privacy leak closer to 0, achieving better balance. TOFU Llama-3-3B Extraction Strength↓ Forget QA Prob↓ Forget QA ROUGE↓ Forget Quality↑ Forget Score↑ Model Utility↑ Unlearning Score↑ Privacy Leak→ 0 GradDiff 0.08236 0.03150 0.34287 7.83E-12 0.80783 0.59254 0.68364 -2.41669 UNDIAL 0.06051 0.18277 0.23129 1.73E-15 0.67538 0.56827 0.61721 -86.86811 NPO 0.12257 0.35523 0.41255 2.77E-09 0.77438 0.61585 0.68607 -75.13616 SimNPO 0.11093 0.11723 0.38107 6.83E-09 0.85847 0.61040 0.71348 -61.99405 PDU 0.07656 0.17840 0.27305 6.39E-06 0.90204 0.50306 0.64590 -42.08622 GradDiff+CL 0.06042 0.10162 0.31587 0.52341 0.98902 0.63042 0.77001 6.36311 UNDIAL+CL 0.06137 0.20976 0.26059 5.14E-16 0.65019 0.61893 0.63417 -84.90512 NPO+CL 0.09906 0.28907 0.38257 6.78E-07 0.84701 0.63707 0.72719 -64.04083 SimNPO+CL 0.06353 0.10866 0.32609 0.00383 0.96209 0.66531 0.78664 -3.72569 PDU+CL 0.06178 0.08528 0.26582 2.57E-05 0.93845 0.52995 0.67738 18.51810 (b) TOFU unlearning experiment results for Llama-3-3B. For the last four columns, bold indicates the best in-column, and green shades indicate improvement. CLReg consistently improves overall unlearning scores and model utility. SimNPO+CL achieves the best performance. In most cases, CLReg brings privacy leak closer to 0. Impactfully, SimNPO+CL reduces the original absolute privacy leak value 61.99461.994 to 3.7253.725. Table 1: TOFU unlearning experiment for Llama-3-8B and 3B models. 4.1 Unlearning Setup We conduct unlearning experiments on TOFU (Maini et al., 2024) and MUSE (Shi et al., 2024) benchmarks, where on TOFU we unlearn LLMs of different sizes (Llama-3.1-8B and Llama-3.2-3B (Grattafiori et al., 2024)), and on MUSE we experiment unlearning both Books and News datasets with Llama-2-7B (Touvron et al., 2023). Given the finetuned model FTW_FT, we unlearn it for 1010 epochs with lr=10−5=10^-5 to obtain ULW_UL. We unlearn with GradDiff, NPO, SimNPO, UnDIAL, PDU (Zhang et al., 2024; Fan et al., 2024a; Dong et al., 2024; Entesari et al., 2025). We first tune method-specific hyper-parameters and γ for each method for optimal performance as baselines, then tune CLReg-specific parameters when being applied: τ×[symmetric, non-symmetric]×[ℒCLdpo,ℒCLinfo]τ×[symmetric, non-symmetric]×[L_CL^dpo,L_CL^info]. We fix α,λ=1α,λ=1 to ease hyper-parameter search. We empirically find that CLReg can improve base unlearning method with light parameter sweep. See Supp. A.2 for detailed settings. 4.2 Evaluation In addition to adopting evaluation metrics from TOFU and MUSE, we propose Forget Score↑ that maps each forget metric of ULW_UL as a progress measure from FTW_FT to RTW_RT: the more unlearned the ULW_UL is, the more similar performance it is expected to share with RTW_RT on ℱF. For each forget metric m, first convert it to a progress measure: Prog(m,ℱ)=|m(fUL,ℱ)−m(fFT,ℱ)||m(fRT,ℱ)−m(fFT,ℱ)|,Prog(m,F)= |m(f_UL,F)-m(f_FT,F)||m(f_RT,F)-m(f_FT,F)|, (5) which will be clipped at 11 when outperforming RTW_RT. Note that the ForgetQuality (Maini et al., 2024) spans many orders of magnitude, and is usually close to zero, we take log(⋅) (·) on it to better address the small differences. Given K evaluation metrics to measure different aspects of forgetting, we compute an overall ForgetScore analogous to ModelUtility as the harmonic mean: ForgetScore=K(∑k=1K1Prog(mk,ℱ))−1.ForgetScore=K ( _k=1^K 1Prog(m_k,F) )^-1. (6) Likewise, we can measure an overall Unlearning Score↑ as the harmonic mean of ForgetQuality and ModelUtility (or RetainKnowmemROUGE on MUSE), emphasizing on balancing forgetting and retaining. Despite many of the metrics are privacy/leakage-aware already (e.g., ForgetQuality) (Dorna et al., 2025), we also report PrivLeak→0→ 0 dedicated to privacy leakage (Shi et al., 2024), where positive suggests over-unlearning and negative suggests under-unlearning and is encouraged to approach zero when ULW_UL is well-balanced. See Supp. A.3 for an overview of each evaluation metric. 4.3 Shaping Representation Improves Unlearning MUSE-Books Llama-2-7B Exact Memoriation↓ Extraction Strength↓ Forget knowmem ROUGE↓ Forget verbmem ROUGE↓ Forget Score↑ Retain knowmem ROUGE↑ Unlearning Score↑ Privacy Leak→ 0 GradDiff 0.93627 0.15484 0.32808 0.35574 0.31345 0.59876 0.41148 -60.46598 UNDIAL 0.94730 0.18230 0.38053 0.42416 0.25306 0.63058 0.36117 -53.93861 NPO 0.92421 0.13040 0.20335 0.30689 0.36774 0.52260 0.43170 -51.25740 SimNPO 0.20746 0.00913 0.33610 0.00316 0.94209 0.60877 0.73961 -30.65828 PDU 0.00968 0.00794 0.22401 8.85E-05 1.0 0.44479 0.61572 -35.96524 GradDiff+CL 0.18952 0.00865 0.18392 0.00540 1.0 0.58451 0.73778 -57.32249 UNDIAL+CL 0.90897 0.09333 0.33523 0.27550 0.41405 0.57313 0.48077 -57.56287 NPO+CL 0.91302 0.11452 0.21475 0.26978 0.41021 0.53345 0.46378 -52.55178 SimNPO+CL 0.01206 0.00794 0.27470 0.0 1.0 0.59918 0.74936 -21.11686 PDU+CL 0.00944 0.00794 0.23983 3.37E-04 1.0 0.47345 0.64264 -34.26405 (a) MUSE-Books Unlearning experiment results. For the last four columns, bold indicates the best in-column, and green shades indicate improvement. CLReg consistently improves overall unlearning scores and forget scores, and can outperform retrained models in forgetting. SimNPO+CL achieves the best performance, and GradDiff+CL achieves the largest improvement. Similar to TOFU results, CLReg does not degrade privacy leak or undermines unlearning balance, and bring it closer to 0 for many cases. MUSE-News Llama-2-7B Exact Memoriation↓ Extraction Strength↓ Forget knowmem ROUGE↓ Forget verbmem ROUGE↓ Forget Score↑ Retain knowmem ROUGE↑ Unlearning Score↑ Privacy Leak→ 0 GradDiff 0.83810 0.06833 0.53086 0.24138 0.48643 0.46619 0.47609 -87.84635 UNDIAL 0.75079 0.03571 0.28436 0.20273 0.84017 0.36324 0.50720 -99.49622 NPO 0.78690 0.04421 0.50151 0.20549 0.62377 0.45399 0.52550 -92.69521 SimNPO 0.84802 0.07198 0.54494 0.24493 0.44588 0.47777 0.46128 -90.55416 PDU 0.77754 0.02984 0.41276 0.20177 0.74393 0.35294 0.47875 -99.72712 GradDiff+CL 0.34405 0.01198 0.42668 0.03450 0.89807 0.41004 0.56302 99.68514 UNDIAL+CL 0.75532 0.03278 0.27290 0.21257 0.83035 0.36937 0.51130 -99.47523 NPO+CL 0.78722 0.04500 0.49930 0.20703 0.62591 0.46569 0.53404 -92.54828 SimNPO+CL 0.38992 0.01413 0.44140 0.04043 0.87730 0.42403 0.57173 88.65659 PDU+CL 0.78397 0.02786 0.39836 0.21609 0.73958 0.37476 0.49745 -99.72712 (b) MUSE-News Unlearning experiment results. For the last four columns, bold indicates the best in-column, and green shades indicate improvement. CLReg consistently improves overall unlearning scores. SimNPO+CL achieves the best performance with slight over-unlearning despite improving |PrivLeak|| PrivLeak|. Table 2: MUSE unlearning experiments across datasets (Books and News). We present detailed performance for all unlearning methods on TOFU and MUSE in Table 1 and Table 2. CLReg consistently enhances base unlearning methods across LLMs of different sizes and various data with improved UnlearningScore. While pushing away forget features and thus improving ForgetScore in most cases, CLReg can also help maintain model performance and retain knowledge as we observe it to improve ModelUtility for all methods in Table 1. From a privacy perspective, while CLReg can result in over-unlearning with positive PrivLeak in few cases, we do not observe a noticeable degradation in absolute |PrivLeak|| PrivLeak|, and in most cases CLReg can bring PrivLeak closer to 0. This is in fact desired by design (Shi et al., 2024), as PrivLeak→0→ 0 suggests ideal balance. Overall, we observe that SimNPO+CL achieves the best performance across all experiment settings, and CLReg steadily strengthens SimNPO and NPO. We hypothesize that their preference learning objectives share a larger overlap in optimization goals with CLReg than other methods since both objectives favor outputs based on retained knowledge than outputs based on forget knowledge. 4.4 Disentangled Representation for Easier Unlearning (a) NPO, Llama-3-8B (b) NPO+CL, Llama-3-8B (c) SimNPO, Llama-3-8B (d) SimNPO+CL, Llama-3-8B (e) NPO, Llama-3-3B (f) NPO+CL, Llama-3-3B (g) SimNPO, Llama-3-3B (h) SimNPO+CL, Llama-3-3B Figure 2: UMAP visualizations of NPO and SimNPO unlearning on TOFU benchmark, compared with CLReg variants. We observe that CLReg can effectively identify and separate forget features by pushing them away, while still maintaining the original scale and distributions of the retain features. Please refer to the axis scales. Llama-3-8B NPO +CL SimNPO +CL Entanglement↓ 22.30576 17.27656 20.24046 5.90206 MK-MMD↑ 0.01424 0.02138 0.01537 0.07327 2-Wasserstein↑ 0.10355 0.15881 0.10001 0.31250 Llama-3-3B NPO +CL SimNPO +CL Entanglement↓ 25.07525 18.02604 24.32758 18.02604 MK-MMD↑ 0.01213 0.01820 0.01225 0.01820 2-Wasserstein↑ 0.06348 0.10085 0.05552 0.10085 Table 3: TOFU entanglement evaluation results (8B and 3B Llama3 models). We observe that CLReg consistently reduces feature entanglement across all three metrics on NPO and SimNPO. The largest imporvement comes from SimNPO+CL on Llama-3-8B where it reduces entanglement from 20.2420.24 to 5.95.9. MUSE-Books NPO +CL SimNPO +CL Entanglement↓ 0.36104 0.28346 0.03898 0.02058 MK-MMD↑ 0.47111 0.57001 1.21513 1.27422 2-Wasserstein↑ 0.17936 0.23721 0.62096 0.90730 MUSE-News NPO +CL SimNPO +CL Entanglement↓ 59.07131 58.66790 92.17580 11.08532 MK-MMD↑ 0.00515 0.00520 0.00392 0.01775 2-Wasserstein↑ 0.05856 0.05899 0.04923 0.11468 Table 4: MUSE entanglement evaluation results (Books and News). We observe that CLReg consistently reduces feature entanglement across all three metrics on NPO and SimNPO. The largest imporvement comes from SimNPO+CL on MUSE-News where it reduces entanglement from 92.1892.18 to 11.0911.09. We also dive into the feature layer where CLReg is applied. As we propose first theoretical insights that relate representation shaping with reducing forget-retain feature entanglement, and as previous work suggest the inverse relationship of entanglement and unlearning difficulty (Zhao et al., 2024; Tang and Khanna, 2025), we provide quantitative and qualitative analysis of the feature space, comparing NPO, SimNPO with NPO+CL and SimNPO+CL to verify our claims. We implement variance-based entanglement from Goldblum et al. (2020); Zhao et al. (2024): E=1|ℛ|∑i∈ℛ(ϕi−ℛ)2+1|ℱ|∑j∈ℱ(ϕj−ℱ)2(ℛ−)2+(ℱ−)2,E= 1|R| _i ( φ_i- μ_R)^2+ 1|F| _j ( φ_j- μ_F)^2( μ_R- μ)^2+( μ_F- μ)^2, where ϕi,ϕj φ_i, φ_j denote sample embedding, ℛ,ℱ μ_R, μ_F denote mean embedding of ℛ,ℱR,F, and μ denotes mean embedding over ℛ∪ℱR . We also implement multi-kernel Maximum Mean Discrepancy (MMD) and 2-Wasserstein distance W2W_2 to comprehensively evaluate the feature separation after unlearning (Gretton et al., 2012; Tang and Khanna, 2025). As expected, CLReg explicitly identifies and pushes away forget features, resulting in reduced entanglement. In Table 3 and Table 4, we observe that the entanglement between retain and forget features is consistently lowered, with more noticeable changes on TOFU. But does the shifted representation space alter the distributions of retained knowledge? We further visualize the feature space using U-MAP (McInnes et al., 2018) in Figure 2. Comparing to forget features which are pushed away, CLReg does not move retain features much: while NPO and SimNPO keep both features inside around [−5,5][-5,5] scale, CLReg is able to maintain the distributions of retain features in the original scale, but pushes forget features far away to span a roughly [−30,30][-30,30] scale. Even for the most challenging case (NPO, Llama-3-3B) where features are more entangled than others after NPO unlearning, CLReg is still able to separate forget features to span a larger [−10,10][-10,10] scale. The visualizations effectively demonstrate how CLReg can identify and push away forget features while keeping retained knowledge intact. The clear separation also inspires future work to clip the “outlier” forget features for a faithful, complete unlearning. 4.5 Which Layer to Regularize? SimNPO+CL Llama-3-8B Forget Score↑ Model Utility↑ Unlearning Score↑ Privacy Leak→ 0 Last 1 0.97182 0.69815 0.81256 55.03337 Last 4 0.86847 0.67944 0.76241 62.32824 Last 7 0.95680 0.67037 0.78837 62.05757 Last 10 0.99620 0.67295 0.80328 51.64990 Last 13 0.99881 0.66042 0.79511 48.281912 SimNPO+CL Llama-3-3B Forget Score↑ Model Utility↑ Unlearning Score↑ Privacy Leak→ 0 Last 1 0.96209 0.66531 0.78664 -3.72569 Last 4 0.94276 0.62183 0.74938 -11.10044 Last 7 0.91280 0.59783 0.72248 -27.33673 Last 10 0.85324 0.62374 0.72066 -54.43742 Last 13 0.85609 0.63859 0.73151 -57.77889 Table 5: TOFU SimNPO+CL layer selection ablation study. As we choose from late layers to earlier layers, the performance will be negatively impacted. Unlearning in earlier layers might harm fundamental knowledge. NPO+CL Llama-3-8B Forget Score↑ Model Utility↑ Unlearning Score↑ Privacy Leak→ 0 Last 1 0.87003 0.68487 0.76643 -56.01587 Last 4 0.81545 0.66091 0.73009 -67.07854 Last 7 0.84904 0.64266 0.73157 -56.63058 Last 10 0.86303 0.65279 0.74333 -52.64892 Last 13 0.85474 0.66738 0.74953 -51.92987 NPO+CL Llama-3-3B Forget Score↑ Model Utility↑ Unlearning Score↑ Privacy Leak→ 0 Last 1 0.84701 0.63707 0.72719 -64.04083 Last 4 0.80283 0.62728 0.70428 -72.16869 Last 7 0.81462 0.62554 0.70767 -71.69250 Last 10 0.80590 0.62932 0.70675 -74.76727 Last 13 0.80150 0.62739 0.70384 -75.01047 Table 6: TOFU NPO+CL layer selection ablation study. Similar to Table 5, as we choose from late layers to earlier layers, the performance will be negatively impacted. Intuitively, ℱF-specific concepts are higher-level features residing in later layers, while earlier layers learn fundamental knowledge and common concepts shared among ℛR and ℱF. We verify this intuition empirically by performing an ablation on which feature layer to perform CLReg on. We select last [1,4,7,10,13][1,4,7,10,13] feature layer and conduct NPO+CL and SimNPO+CL experiments on TOFU, and report evaluation results in Table 5 and Table 6. As we apply CLReg to earlier layers, the performance will degrade, resulting in consistently reduced ModelUtility and UnlearningScore. This meets our expectation, and also aligns with similar observations in previous work (Hong et al., 2024). We hypothesize that unlearning happens most effectively in later layers. 5 Conclusion In this work, we argue that explicit representation shaping will not undermine the goal of unlearning to match the retrained model’s behaviors. Instead, it provides a way to separate forget concepts from retain concepts in the feature space for easier unlearning, leading to possible complete removal of forget concepts. We provide theoretical insights on how the entanglement between forget and retain features can be reduced by our proposed CLReg, and conduct extensive empirical studies to demonstrate its effectiveness and desired properties. We hope our study can inspire future unlearning work to focus on representation shaping and derive surgical approaches to remove forget concepts. 6 Impact Statement This paper presents work whose goal is to advance the field of machine learning. There are many potential societal consequences of our work, none of which we feel must be specifically highlighted here. References T. Chen, S. Kornblith, M. Norouzi, and G. Hinton (2020) A simple framework for contrastive learning of visual representations. In International conference on machine learning, p. 1597–1607. Cited by: §1. Y. R. Dong, H. Lin, M. Belkin, R. Huerta, and I. Vulić (2024) Undial: self-distillation with adjusted logits for robust unlearning in large language models. arXiv preprint arXiv:2402.10052. Cited by: §A.2.1, §1, §2.2, §4.1. V. Dorna, A. Mekala, W. Zhao, A. McCallum, Z. C. Lipton, J. Z. Kolter, and P. Maini (2025) OpenUnlearning: accelerating llm unlearning via unified benchmarking of methods and metrics. arXiv preprint arXiv:2506.12618. Cited by: §A.2.2, §4.2. T. Entesari, A. Hatami, R. Khaziev, A. Ramakrishna, and M. Fazlyab (2025) Constrained entropic unlearning: a primal-dual framework for large language models. arXiv preprint arXiv:2506.05314. Cited by: §A.2.1, §1, §2.2, §4.1. C. Fan, J. Liu, L. Lin, J. Jia, R. Zhang, S. Mei, and S. Liu (2024a) Simplicity prevails: rethinking negative preference optimization for llm unlearning. arXiv preprint arXiv:2410.07163. Cited by: §A.2.1, §A.2.1, §1, §2.2, §4.1. C. Fan, J. Liu, Y. Zhang, D. Wei, E. Wong, and S. Liu (2024b) SalUn: empowering machine unlearning via gradient-based weight saliency in both image classification and generation. In International Conference on Learning Representations, Cited by: §1, §2.1. T. Gao, X. Yao, and D. Chen (2021) Simcse: simple contrastive learning of sentence embeddings. arXiv preprint arXiv:2104.08821. Cited by: §1, §3.2. A. Golatkar, A. Achille, and S. Soatto (2020) Eternal sunshine of the spotless net: selective forgetting in deep networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 9304–9312. Cited by: §2.1. M. Goldblum, S. Reich, L. Fowl, R. Ni, V. Cherepanova, and T. Goldstein (2020) Unraveling meta-learning: understanding feature representations for few-shot tasks. In International conference on machine learning, p. 3607–3616. Cited by: §4.4. A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. (2024) The llama 3 herd of models. arXiv preprint arXiv:2407.21783. Cited by: §4.1. L. Graves, V. Nagisetty, and V. Ganesh (2021) Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 35, p. 11516–11524. Cited by: §2.1. A. Gretton, K. M. Borgwardt, M. J. Rasch, B. Schölkopf, and A. Smola (2012) A kernel two-sample test. Journal of Machine Learning Research 13 (25), p. 723–773. External Links: Link Cited by: §4.4. Y. Hong, Y. Zou, L. Hu, Z. Zeng, D. Wang, and H. Yang (2024) Dissecting fine-tuning unlearning in large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, Y. Al-Onaizan, M. Bansal, and Y. Chen (Eds.), Miami, Florida, USA, p. 3933–3941. External Links: Link, Document Cited by: §4.5. Z. Izzo, M. A. Smart, K. Chaudhuri, and J. Zou (2021) Approximate data deletion from machine learning models. In International conference on artificial intelligence and statistics, p. 2008–2016. Cited by: §2.1. Y. H. Khalil, M. Setayesh, and H. Li (2025) CoUn: empowering machine unlearning via contrastive learning. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §1, §2.3. M. Kurmanji, P. Triantafillou, J. Hayes, and E. Triantafillou (2023) Towards unbounded machine unlearning. Advances in neural information processing systems 36, p. 1957–1987. Cited by: §1, §2.1. H. k. Lee, Q. Zhang, C. Yang, J. Lou, and L. Xiong (2025) Contrastive unlearning: a contrastive approach to machine unlearning. In Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, IJCAI-25, J. Kwok (Ed.), p. 7464–7472. Note: Main Track External Links: Document, Link Cited by: §1, §2.3. P. Maini, Z. Feng, A. Schwarzschild, Z. C. Lipton, and J. Z. Kolter (2024) Tofu: a task of fictitious unlearning for llms. arXiv preprint arXiv:2401.06121. Cited by: §A.1, §A.2.2, §A.3, §2.2, §4.1, §4.2. L. McInnes, J. Healy, and J. Melville (2018) Umap: uniform manifold approximation and projection for dimension reduction. arXiv preprint arXiv:1802.03426. Cited by: §4.4. Y. Meng, M. Xia, and D. Chen (2024) Simpo: simple preference optimization with a reference-free reward. Advances in Neural Information Processing Systems 37, p. 124198–124235. Cited by: §A.2.1. A. v. d. Oord, Y. Li, and O. Vinyals (2018) Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748. Cited by: §3.2. W. Shi, J. Lee, Y. Huang, S. Malladi, J. Zhao, A. Holtzman, D. Liu, L. Zettlemoyer, N. A. Smith, and C. Zhang (2024) Muse: machine unlearning six-way evaluation for language models. arXiv preprint arXiv:2407.06460. Cited by: 1st item, §A.1, §A.2.2, §A.3, §4.1, §4.2, §4.3. H. Tang and R. Khanna (2025) Sharpness-aware machine unlearning. arXiv preprint arXiv:2506.13715. Cited by: §1, §4.4, §4.4. H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al. (2023) Llama 2: open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288. Cited by: §4.1. T. Wang and P. Isola (2020) Understanding contrastive representation learning through alignment and uniformity on the hypersphere. In International conference on machine learning, p. 9929–9939. Cited by: §1, §3.2. A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck (2021) Machine unlearning of features and labels. arXiv preprint arXiv:2108.11577. Cited by: §2.1. R. Zhang, L. Lin, Y. Bai, and S. Mei (2024) Negative preference optimization: from catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05868. Cited by: §A.2.1, §1, §2.2, §4.1. K. Zhao, M. Kurmanji, G. Bărbulescu, E. Triantafillou, and P. Triantafillou (2024) What makes unlearning hard and what to do about it. Advances in Neural Information Processing Systems 37, p. 12293–12333. Cited by: §1, §1, §3.3, §4.4. Appendix A Appendix A.1 Overview of TOFU and MUSE We provide an overview of benchmarks used in our work with concrete examples to better illustrate the differences and difficulties of each dataset: The TOFU benchmark (Maini et al., 2024) consists of question-answer pairs with short length, based on autobiographies of 200 different authors that are fictitiously generated by GPT-4. The unlearning task objective is to forget the fictitiously answers in the forget set ℱF. An data example is as follows: • question: Can you share the title of one of Hsiao Yun-Hwa’s most popular books? • answer: One of Hsiao Yun-Hwa’s most popular books in the leadership genre is ”Artistic Authority: Leading with Creativity”. It provides multiple data splits and include paraphrased and perturbed data versions for extended use. The MUSE benchmark (Shi et al., 2024) consists of two distinct datasets Books and News. The Books dataset comprises Harry Potter book series by J. K. Rowling. The train set S consists of long, main story chapters where the forget subset ℱF contains false information. Multiple evaluation sets are designed to be question-answer or prompt-response pairs with long text lengths. Due to length, here we only show an example of question-answer pair for KnowMem evaluation set on forget concepts (they are short): • question: What were the two new books mentioned in Harry’s letter that he needed for the coming year? • answer: The Standard Book of Spells, Grade 5, by Miranda Goshawk, and Defensive Magical Theory, by Wilbert Slinkhard. The News dataset consists of BBC News where each example in train set is shorter than that in Books. The examples in the forget set are fake news. Multiple evaluation sets are designed to be question-answer or prompt-response pairs with long text lengths. Here we only show an example of question-answer pair for KnowMem evaluation set on forget concepts (they are short): • question: Which three nuclear power plants were taken offline in Germany by midnight on Saturday? • answer: Isar 2, Emsland and Neckarwestheim 2 Both Books and News have evaluation sets with long-length examples dedicated to privacy metric PrivLeak. A.2 Detailed Experiment Settings A.2.1 Unlearning Hyper-parameters We unlearn with GradDiff, NPO, SimNPO, UnDIAL, PDU (Zhang et al., 2024; Fan et al., 2024a; Dong et al., 2024; Entesari et al., 2025). We provide detailed hyper-parameter settings for each unlearning method: GradDiff: GradDiff can be unstable due to aggressive ascent and requires careful tuning. We choose γ=0.01γ=0.01 on MUSE-Books and γ=1γ=1. Performance becomes more stable on TOFU and we pick γ=0.4γ=0.4 for both Llama-3-8B and 3B. NPO: We fix γ=α=1γ=α=1 and search for β values. We pick β=0.05β=0.05 on both MUSE-Books and News, and β=0.4β=0.4 on TOFU for both Llama-3-8B and 3B. SimNPO: We fix γ=α=1γ=α=1 and search for β values. We pick β=1β=1 on both MUSE-Books and β=0.05β=0.05 for News, and β=1.5β=1.5 on TOFU for both Llama-3-8B and 3B. Note that as β becomes smaller for NPO and SimNPO, they behave more similar to GradDiff (Meng et al., 2024; Fan et al., 2024a). UnDIAL: We observe that UnDIAL barely needs retaining and we set α=0,γ=1α=0,γ=1. UnDIAL has another β term as the strength of penalty for memorized tokens. We pick β=10β=10 on both MUSE-Books and News, and β=15β=15 on TOFU for both Llama-3-8B and 3B. PDU: PDU performs steadily across settings. We adopt step size 11 and γ=α=1γ=α=1. We adopt 11 warmup epoch for MUSE-Books, News, and TOFU Llama-3-3B. We adopt 22 warmup epochs for TOFU Llama-3-8B. After obtaining optimal baseline results, we then add CLReg with λ=1λ=1 and tune CLReg-specific parameters: τ×[symmetric, non-symmetric]×[ℒCLdpo,ℒCLinfo]τ×[symmetric, non-symmetric]×[L_CL^dpo,L_CL^info]. We fix α,λ=1α,λ=1. Specifically, we sweep τ in [0.1,0.3,0.5,0.7,0.9][0.1,0.3,0.5,0.7,0.9], and obtain optimal settings for each unlearning method + CLReg: GradDiff: We pick [0.1,non-symmetric,ℒCLdpo][0.1,non-symmetric,L_CL^dpo] for MUSE-Books, [0.3,non-symmetric,ℒCLdpo][0.3,non-symmetric,L_CL^dpo] for MUSE-News, [0.1,symmetric,ℒCLinfo][0.1,symmetric,L_CL^info] for TOFU Llama-3 3B, and [0.3,symmetric,ℒCLdpo][0.3,symmetric,L_CL^dpo] for TOFU Llama-3 8B. NPO: We pick [0.3,non-symmetric,ℒCLinfo][0.3,non-symmetric,L_CL^info] for MUSE-Books, [0.9,symmetric,ℒCLinfo][0.9,symmetric,L_CL^info] for MUSE-News, [0.5,non-symmetric,ℒCLinfo][0.5,non-symmetric,L_CL^info] for TOFU Llama-3 3B, and [0.7,non-symmetric,ℒCLdpo][0.7,non-symmetric,L_CL^dpo] for TOFU Llama-3 8B. SimNPO: We pick [0.3,symmetric,ℒCLdpo][0.3,symmetric,L_CL^dpo] for MUSE-Books, [0.3,non-symmetric,ℒCLdpo][0.3,non-symmetric,L_CL^dpo] for MUSE-News, [0.5,symmetric,ℒCLinfo][0.5,symmetric,L_CL^info] for TOFU Llama-3 3B, and [0.9,symmetric,ℒCLdpo][0.9,symmetric,L_CL^dpo] for TOFU Llama-3 8B. UnDIAL: We pick [0.3,non-symmetric,ℒCLinfo][0.3,non-symmetric,L_CL^info] for MUSE-Books, [0.5,non-symmetric,ℒCLdpo][0.5,non-symmetric,L_CL^dpo] for MUSE-News, [0.1,symmetric,ℒCLdpo][0.1,symmetric,L_CL^dpo] for TOFU Llama-3 3B, and [0.5,symmetric,ℒCLdpo][0.5,symmetric,L_CL^dpo] for TOFU Llama-3 8B. Additionally, we slightly increase α to 0.10.1 to balance the addition of CLReg. PDU: We pick [0.9,non-symmetric,ℒCLinfo][0.9,non-symmetric,L_CL^info] for MUSE-Books, [0.3,non-symmetric,ℒCLinfo][0.3,non-symmetric,L_CL^info] for MUSE-News, [0.3,non-symmetric,ℒCLinfo][0.3,non-symmetric,L_CL^info] for TOFU Llama-3 3B, and [0.5,non-symmetric,ℒCLdpo][0.5,non-symmetric,L_CL^dpo] for TOFU Llama-3 8B. A.2.2 Experiment Environment We adapt existing, open-source code base and datasets for conducting experiments and developing new algorithms 111https://github.com/locuslab/open-unlearning, https://huggingface.co/datasets/locuslab/TOFU, https://huggingface.co/datasets/muse-bench/MUSE-Books, https://huggingface.co/datasets/muse-bench/MUSE-News (Maini et al., 2024; Shi et al., 2024; Dorna et al., 2025). All experiments are conducted on NVIDIA H100 GPUs. A.3 Overview of Evaluation Metrics We provide an overview of evaluation metrics adopted in our work. Many of the metrics can be applied to both ℛR and ℱF while expecting inverse behaviors. Memorization metrics, which quantifies how much information the data sample has been memorized: • Probability: Quantifies the model’s confidence in its output: Prob=p((y|x))Prob=p(W(y\;|\;x)). • ROGUE: Quantifies the degree of overlap between model output and the ground truth. • Truth Ratio: Measures the model’s preference for the correct answer over its incorrect variants. A higher value indicates stronger confidence in the correct response, making it privacy-aware. • Exact Memorization (EM): Similar to ROGUE, EM quantifies memorization by calculating proportion of matched tokens in the model output with ground truth. • Extraction Strength (ES): Quantifies memorization by determining the minimal prefix length required to reconstruct the suffix. Privacy metrics, which evaluates whether sensitive information from the forget set can still be inferred or extracted: • PrivLeak (Shi et al., 2024): Calibrated Membership Inference Attack (MIA) with AUC scores from the retain model: PrivLeak=AUC(UL,ℱ)−AUC(RT,ℱ)AUC(RT,ℱ).PrivLeak= AUC(W_UL,F)-AUC(W_RT,F)AUC(W_RT,F). • Forget Quality: Performs KS statistical test on TruthRatio distributions of ULW_UL and RTW_RT, yielding p values which are high when the two distributions are close. Utility metrics, which can reuse memorization metrics to ensure that retain knowledge is well maintained: • Model Utility: Harmonic mean of Prob, ROGUE, TruthRatio on the retain set ℛR. • KnowMem ROGUE: Measures ROGUE on knowledge-based questions regarding ℛR. See detailed explanation and discussion in TOFU and MUSE (Maini et al., 2024; Shi et al., 2024). A.4 Limitations and Future Work The success of contrastive objectives hinges on design decisions such as data augmentation, number of negative examples and batch size, yet how these choices interact is not well understood. Consequently, CLReg may require careful tuning and may be sensitive to dataset properties. Second, CLReg acts as a regularizer layered on top of an existing unlearning loss, so its efficacy depends on the base unlearning algorithm and how constructive the interactions between multiple objectives are. Finally, our theoretical analysis makes simplifying assumptions; broader evaluation is needed to understand scalability and robustness. Future work could address these limitations in several ways. One promising direction is to develop techniques for surgical removal or clipping of the disentangled forget subspace after CLReg training, effectively removing forget features while preserving retain features to achieve more faithful unlearning. Another is to explore richer augmentation strategies and negative-sampling schemes to reduce reliance on hand‑tuned dropout and paraphrases. Finally, it would be valuable to derive formal privacy and fairness guarantees for representation‑shaped unlearning, and to study how CLReg performs under repeated or incremental unlearning requests and continued learning on new data.