Paper deep dive
Graph-Guided Selective Unlearning for Language Models: Controlling Support Routes Beyond Forget Seeds
Waqas Khan, Tabinda Sarwar, Jingyue Cong, Xun Yi, Estrid He
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/28/2026, 4:06:09 AM
Summary
The paper introduces GraphSU, a graph-guided selective unlearning method for language models that expands the deletion scope beyond explicit forget seeds by constructing a weighted support-route graph. This approach propagates deletion pressure to high-risk neighbors (paraphrases, aliases, related facts) to reduce soft leakage while preserving model utility, outperforming seed-only baselines on TOFU and PISTOL benchmarks.
Entities (8)
Relation Signals (7)
GraphSU → evaluatedon → PISTOL
confidence 95% · and PISTOL... GraphSU achieves the lowest utility-feasible soft leakage
GraphSU → evaluatedon → TOFU
confidence 95% · On the Task of Fictitious Unlearning (TOFU)... GraphSU achieves the lowest utility-feasible soft leakage
GraphSU → testedwith → GPT-2 Medium
confidence 95% · with GPT-2 Medium and Llama-3.2-3B-Instruct, GraphSU achieves...
GraphSU → testedwith → Llama 3.2-3B-Instruct
confidence 95% · with GPT-2 Medium and Llama-3.2-3B-Instruct, GraphSU achieves...
GraphSU → uses → Support Graph
confidence 95% · GraphSU constructs a weighted support graph over training instances using semantic similarity, symbolic entity/relation/tail overlap, and answer-side gradient alignment.
GraphSU → outperforms → Seed-Only
confidence 90% · reducing leakage by up to 49.5 percentage points over a matched seed-only baseline
Forget Seeds → insufficientfor → Complete Unlearning
confidence 85% · existing methods treat the explicitly identified forget examples as the complete deletion scope. This is insufficient when target knowledge remains recoverable through paraphrases, aliases, or neighboring training examples.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Enterprises fine-tune language models on proprietary data that may later require removal due to privacy, contractual, or compliance obligations. Selective unlearning removes requested knowledge while preserving model utility, offering a practical alternative to full retraining, but existing methods treat the explicitly identified forget examples as the complete deletion scope. This is insufficient when target knowledge remains recoverable through paraphrases, aliases, or neighboring training examples. We propose GRAPHSU, a graph-guided controller that expands the deletion scope beyond forget seeds by constructing a weighted support-route graph, propagating deletion pressure through it, and applying graded forgetting strengths to high-risk neighbors. On the Task of Fictitious Unlearning (TOFU), a synthetic author-profile question-answering benchmark, and PISTOL, a structural-unlearning benchmark built around interconnected factual samples, with GPT-2 Medium and Llama-3.2-3B-Instruct, GRAPHSU achieves the lowest utility-feasible soft leakage across all deletion settings, reducing leakage by up to 49.5 percentage points over a matched seed-only baseline, demonstrating that effective enterprise unlearning requires controlling support routes, not just forget seeds.
Tags
Links
- Source: https://arxiv.org/abs/2608.26743v1
- Canonical: https://arxiv.org/abs/2608.26743v1
Trouble viewing inline? Open PDF directly →
Full Text
67,250 characters extracted from source content.
Expand or collapse full text
Graph-Guided Selective Unlearning for Language Models: Controlling Support Routes Beyond Forget Seeds Waqas Khan Tabinda Sarwar Jingyue Cong Xun Yi Estrid He Abstract Enterprises fine-tune language models on proprietary data that may later require removal due to privacy, contractual, or compliance obligations. Selective unlearning removes requested knowledge while preserving model utility, offering a practical alternative to full retraining, but existing methods treat the explicitly identified forget examples as the complete deletion scope. This is insufficient when target knowledge remains recoverable through paraphrases, aliases, or neighboring training examples. We propose GraphSU, a graph-guided controller that expands the deletion scope beyond forget seeds by constructing a weighted support-route graph, propagating deletion pressure through it, and applying graded forgetting strengths to high-risk neighbors. On the Task of Fictitious Unlearning (TOFU), a synthetic author-profile question–answering benchmark, and PISTOL, a structural-unlearning benchmark built around interconnected factual samples, with GPT-2 Medium and Llama-3.2-3B-Instruct, GraphSU achieves the lowest utility-feasible soft leakage across all deletion settings, reducing leakage by up to 49.5 percentage points over a matched seed-only baseline, demonstrating that effective enterprise unlearning requires controlling support routes, not just forget seeds. Our code is available at https://anonymous.4open.science/r/graphSU-35B4. 1 Introduction Large language models (LLMs) can retain private, copyrighted, stale, or user-rescinded information after training. Exact unlearning would retrain the model on the corpus with the deletion set removed, but this is typically infeasible for modern LMs. Approximate LLM unlearning therefore aims to update a deployed model so that target knowledge is no longer recoverable, while its behaviour on retained data remains close to the original or retain-only model (Maini et al., 2024; Shi et al., 2024; Tian et al., 2024; Li et al., 2024). As enterprises increasingly customize foundation models using proprietary organizational data, the ability to selectively remove previously learned information becomes critical. Data may later require removal due to privacy regulations, customer offboarding, intellectual-property concerns, policy revisions, or the discovery of sensitive content in training corpora. In such settings, machine unlearning provides a scalable mechanism for updating deployed models without incurring the computational and operational costs of full retraining. Most current algorithms focus on the local objective: gradient ascent, KL-regularised ascent, preference optimisation, negative preference optimisation, gradient rectification, energy-based unlearning, or representation control (Jang et al., 2023; Zhang et al., 2024; Mekala et al., 2025; Wang et al., 2025b; Chaiyapattanaporn et al., 2026). This line of work is valuable, but it leaves a complementary question under-addressed: where should unlearning be applied? In selective unlearning, targeting only the canonical forget example is often insufficient, as the forgotten information may still be inferred from aliases, paraphrases, neighboring facts, or other training instances that describe the same entity from different perspectives. For example, forgetting “Acme Corp plans to acquire BetaAI for $850 million” might be insufficient if another sample states, “Acme’s largest strategic investment this year is valued at approximately $850 million”. Conversely, applying unlearning too broadly can remove information that should be retained, leading to unnecessary degradation of model utility. This creates a scope-control problem that is distinct from the choice of unlearning objective. In this paper, we formulate selective unlearning as a leakage-route control problem, where the goal is to prevent forgotten information from being reconstructed through paraphrases, aliases, and semantically related training instances while preserving unrelated knowledge. We propose Graph-guided Selective Unlearning (GraphSU), a loss-agnostic controller that determines the fine-grained deletion scope before applying a local unlearning objective. GraphSU constructs a weighted support graph over training instances using semantic similarity, symbolic entity/relation/tail overlap, and answer-side gradient alignment. It then propagates deletion pressure from forget seeds, identifies influential support neighbors, assigns soft forgetting strengths, and incorporates graph-selected neighbors through a staged unlearning curriculum. On GPT-2 Medium, GraphSU achieves the lowest utility-feasible soft leakage across all deletion settings on both TOFU and PISTOL. Compared to a Seed-Only variant, it consistently reduces leakage while maintaining retain perplexity (PPL; the exponential of mean token-level negative log-likelihood, lower is better) below 10, demonstrating the importance of expanding beyond the initial forget set. 2 Methodology Figure 1 illustrates proposed method. 2.1 Problem Statement Let fθ0f_ _0 denote the original model trained on dataset D=zii=1ND=\z_i\_i=1^N where zi=(qi,aitext,ℱi)z_i=(q_i,a_i^text,F_i). Here, qiq_i is the prompt, aitexta_i^text is the answer surface form, and ℱi=(hi,k,ri,k,ti,k)k=1KiF_i=\(h_i,k,r_i,k,t_i,k)\_k=1^K_i is the set of factual units expressed in the answer. Each tuple (hi,k,ri,k,ti,k)(h_i,k,r_i,k,t_i,k) consists of head entity, relation, and tail entity or value. We obtain ℱiF_i by prompting GPT-4.1 OpenAI (2025) to extract factual predicate-argument tuples from the prompt–answer pair and normalizing the output into (h,r,t)(h,r,t) unit. The extracted units are used for target specification and support-graph construction, not as additional supervision for model training. An unlearning request ℛR identifies target fact units ℛK_R to remove and a seed forget set Df⊂D_f⊂ D containing them; the initial retain pool is Dr=D∖DfD_r=D D_f. The goal of selective unlearning is to obtain an updated model fθuf_ _u in which the knowledge specified by ℛK_R is no longer recoverable, while the model’s utility on unrelated retain data is preserved. 2.2 Recovery-Aware Deletion Scope As discussed in Section 1, the seed forget set DfD_f may miss related training instances that still support recovery of the target knowledge, leaving leakage routes outside DfD_f. We denote by ℳℛ(fθ)M_R(f_θ) a scalar recoverability measure for ℛK_R under request-specific probes, capturing the extent to which the model can still reproduce, paraphrase, or semantically entail the target facts. For any training example zjz_j, define its ideal support contribution as Δj⋆(ℛ)=ℳℛ(fθ0)−ℳℛ(fθ0(−j)), _j (R)=M_R(f_ _0)-M_R(f_ _0^(-j)), (1) where fθ0(−j)f_ _0^(-j) denotes the model obtained by applying the same supervised fine-tuning procedure after removing zjz_j from the training set. We define the ideal support closure of ℛR as ϵ⋆(ℛ)=Df∪zj∉Df:Δj⋆(ℛ)≥ϵ,C _ε(R)=D_f∪\z_j∉ D_f: _j (R)≥ε\, (2) where ϵ>0ε>0 is a small operational threshold. This closure is the ideal forgetting scope: it includes both the seed forget examples and the non-seed examples whose removal would materially reduce recovery of ℛK_R. Constructing ϵ⋆(ℛ)C _ε(R) exactly is infeasible, because it would require leave-one-out retraining or exact causal attribution over the training corpus. GraphSU therefore approximates this closure using a request-conditioned support graph, introduced next. Figure 1: Overview of GraphSU, which constructs a weighted multi-view support graph over QA samples, propagates deletion pressure from forget seeds through a one- and two-hop support closure, and applies graded unlearning objectives to the expanded edit set. 2.3 Support Graph Construction. The seed forget set DfD_f is not generally a closed evidence unit. Even after examples in DfD_f are suppressed, the target knowledge may remain recoverable through paraphrastic (Maini et al., 2024; Reimers and Gurevych, 2019; Reisizadeh et al., 2025), symbolic (Tian et al., 2024; Wang et al., 2025a; Wei et al., 2025; Meng et al., 2022; Zhong et al., 2023; Cohen et al., 2024), and model-internal support routes (Koh and Liang, 2017; Pruthi et al., 2020; Park et al., 2023). We therefore construct a weighted support graph G=(V,E,W)G=(V,E,W), where each node corresponds to a training example and each edge weight estimates how strongly one example may support recovery of another. The graph is used as an affinity structure for support expansion, not as a calibrated estimate of causal influence. Multi-view support affinity. For a candidate edge (i,j)(i,j), GraphSU fuses five support views three symbolic (entity, relation, tail), one semantic, and one gradient-based: w~ij w_ij =αsijent+βsijrel+γsijtail+δsijsem+λsijgrad, =α s^ent_ij+β s^rel_ij+γ s^tail_ij+δ s^sem_ij+λ s^grad_ij, (3) wij w_ij =min(1,max(0,w~ij)), = \! (1, (0, w_ij) ), where each component score is normalized to [0,1][0,1] and (α,β,γ,δ,λ)(α,β,γ,δ,λ) are non-negative view weights (Table 1). The five views capture complementary recovery routes: the three symbolic overlaps capture structured factual support through shared entities, relations, and tail values; semantic similarity captures paraphrastic support; and gradient alignment captures model-local support under the frozen post-SFT model. Semantic evidence. Let ei=Enc([qi;ai])e_i=Enc([q_i;a_i]) be the ℓ2 _2-normalized sentence embedding of the prompt–answer pair. The semantic score is sijsem=[cos(ei,ej)]+,[x]+=max(0,x).s^sem_ij= [ (e_i,e_j) ]_+, [x]_+= (0,x). (4) Negative semantic cosine indicates dissimilar rather than supporting content. Because GraphSU models positive recovery support with a non-negative diffusion process, negative semantic affinities are clipped to zero rather than allowed to subtract from supportive edges. Modelling inhibitory relationships would require a signed-graph formulation and is left for future work. Symbolic evidence. Semantic similarity can miss structured dependencies such as aliases, inverse relations, and reused private values. We extract canonicalized entity, relation, and tail-value sets ℰiE_i, ℛiR_i, and iT_i from qiq_i, aia_i, and ℱiF_i respectively. Entity aliasing and relation canonicalization map equivalent mentions and inverse relations to shared identifiers. We then compute entity-, relation-, and tail-level symbolic similarities sijs_ij between instances i and j using Jaccard similarity over the corresponding sets. Entity overlap (sents^ent) captures subject- and alias-level support, relation overlap (srels^rel) captures factual-route support, and tail-value overlap (stails^tail) captures reused attributes or identifiers. Gradient-alignment evidence. The semantic and symbolic views are corpus-level approximations. To capture model-local support, we compute answer-side gradient summaries under the frozen post-SFT model. Let iA_i denote the answer-token positions of ziz_i. We define gi=1|i|∑t∈i∇Hit(L)ℒCE(zi,θ0),g_i= 1|A_i| _t _i _H^(L)_itL_CE(z_i; _0), (5) where Hit(L)H^(L)_it is the final-layer answer representation after LayerNorm and before the LM head. The gradient-alignment score is sijgrad=[cos(gi,gj)]+.s^grad_ij= [ (g_i,g_j) ]_+. (6) Positive gradient cosine indicates compatible, mutually reinforcing local update directions, whereas negative cosine indicates conflicting directions rather than recovery support. Since GraphSU propagates non-negative support mass, negative gradient affinities are clipped to zero; representing inhibitory relations would instead require signed-graph propagation. The graph captures recovery-aware support structure around the request. GraphSU propagates deletion pressure from DfD_f through G, assigning graded forgetting strengths to high-risk neighbors while leaving unrelated examples intact. 2.4 Graph-Guided Deletion Scope Approximation Given an unlearning request ℛR with the seed forget set DfD_f. We first estimate which non-seed examples are most likely to belong to the recovery-aware deletion scope of the request. Let A denote the non-negative adjacency matrix of the sparsified support graph. We use the pairwise affinity wijw_ij from Eq. 3 directly, so Aij=wij,(i,j)∈E after sparsification,0,otherwise.A_ij= casesw_ij,&(i,j)∈ E after sparsification,\\ 0,&otherwise. cases (7) Because the component similarities in Eq. 3 are pairwise symmetric, wij=wjiw_ij=w_ji before sparsification; the retained graph is treated as undirected for diffusion. Let di=∑jAijd_i= _jA_ij be the weighted degree of node i. We define the row-normalized transition matrix Pij=Aij/di,di>0,[i=j],di=0,P_ij= casesA_ij/d_i,&d_i>0,\\ I[i=j],&d_i=0, cases (8) where isolated nodes are assigned self-loops. The transition matrix specifies how support evidence moves across the graph: a node passes more evidence to neighbors connected by stronger semantic, symbolic, or gradient-aligned support edges. We initialize a request-specific seed distribution si=1/|Df|,zi∈Df,0,zi∉Df.s_i= cases1/|D_f|,&z_i∈ D_f,\\ 0,&z_i∉ D_f. cases (9) The support score vector r is then computed by personalized graph diffusion: r(k+1)=(1−ρ)P⊤r(k)+ρs,r^(k+1)=(1-ρ)P r^(k)+ρ s, (10) where ρ∈(0,1)ρ∈(0,1) is the restart probability. The restart term anchors the diffusion to the deletion request, while the transition term propagates support evidence through the graph. At convergence, the solution satisfies r=ρ(I−(1−ρ)P⊤)−1s,r=ρ (I-(1-ρ)P )^-1s, (11) or equivalently, r=ρ∑ℓ=0∞(1−ρ)ℓ(P⊤)ℓs.r=ρ _ =0^∞(1-ρ) (P ) s. (12) This expansion shows that rir_i aggregates support evidence over all paths from the seed forget examples to ziz_i, with paths of length ℓ discounted by (1−ρ)ℓ(1-ρ) . Hence, rir_i is high when ziz_i is connected to DfD_f through many strong short paths, or through multiple consistent longer paths. The score is not interpreted as a probability of membership in the deletion scope; it is a ranking signal for request-specific support evidence. The estimated support closure is obtained by selecting high-scoring non-seed examples together with the original seeds. For a threshold η or an expansion budget B, we use ^η(ℛ)=Df∪zi∈Dr:ri≥η, C_η(R)=D_f∪\z_i∈ D_r:r_i≥η\, (13) or equivalently the top-B non-seed examples ranked by rir_i when a fixed expansion budget is required. This construction approximates the ideal support closure ϵ⋆(ℛ)C _ε(R) defined in Section 2.2: examples with larger diffusion scores are treated as more likely to materially support recovery of the target knowledge. 2.5 Selective Unlearning Let Dsup(ℛ)D_sup(R) be the selected non-seed support set: Dsup(ℛ)=^η(ℛ)∖Df.D_sup(R)= C_η(R) D_f. (14) Each example receives a forgetting weight ωi=1,zi∈Df,ηℛ(rimaxzj∈Dsuprj)γω,zi∈Dsup(ℛ),0,otherwise. _i= cases1,&z_i∈ D_f,\\ _R ( r_i _z_j∈ D_supr_j ) _ω,&z_i∈ D_sup(R),\\ 0,&otherwise. cases (15) Thus, seed examples receive full forgetting pressure, while non-seed support examples receive bounded pressure according to graph relevance. Let mim_i be a binary answer-token mask, with mi,t=1m_i,t=1 for target tokens to be forgotten and mi,t=0m_i,t=0 for answer tokens that should be retained. The complement 1−mi1-m_i therefore selects the safe answer tokens. The unlearning objective is ℒGraphSU _GraphSU =∑i=1N[ωiℒforget(zi,mi) = _i=1^N [ _iL_forget(z_i,m_i) (16) +λrℒretain(zi,1−mi)] + _rL_retain(z_i,1-m_i) ] +λKLℒKL. + _KLL_KL. The forgetting term is applied only to the target positions selected by mim_i and combines three components: ℒforget=λentℒent+λULℒUL+λrepℒrep.L_forget= _entL_ent+ _ULL_UL+ _repL_rep. (17) Here, ℒentL_ent is the entropy-maximization term that flattens the predictive distribution at target tokens, ℒULL_UL is the unlikelihood term that suppresses probability assigned to the target tokens, and ℒrepL_rep is the representation-repulsion term used to move target-token representations away from their frozen post-SFT representations. The coefficients λent _ent, λUL _UL, and λrep _rep control the relative strengths of these terms. The retain loss ℒretainL_retain is cross-entropy on the complementary safe-token mask 1−mi1-m_i, while ℒKLL_KL anchors non-target predictive behaviour to the frozen post-SFT model; λr _r and λKL _KL are their corresponding weights. Representation repulsion is enabled for complete and entity/instance deletion and disabled for partial deletion, where target and non-target facts may share the same answer context. In this way, GraphSU separates the scope controller from the local unlearning loss: the graph determines which examples and tokens are edited, while the loss defines how the selected targets are suppressed. 3 Experiments 3.1 Experimental Settings Datasets and Models. We evaluate GraphSU on two unlearning benchmarks: TOFU (Maini et al., 2024), a synthetic author-profile QA benchmark with auditable forget/retain splits, and PISTOL (Qiu et al., 2024), a structural-unlearning benchmark built around interconnected factual samples. We consider complete, entity/instance, and partial deletion settings. We use GPT-2 Medium for the main controlled comparison and Llama-3.2-3B-Instruct (meta-llama/Llama-3.2-3B-Instruct) to assess scalability to larger backbones. For each model, all methods are initialized from the same supervised fine-tuned checkpoint and evaluated using identical forget seeds and prompts. Baselines. We compare GraphSU with existing methods including GA Jang et al. (2023), GA+KL Maini et al. (2024), DPO (Rafailov et al., 2023), NPO-TR (Zhang et al., 2024), AltPO (Mekala et al., 2025), GRU (Wang et al., 2025b), and SELU (Chaiyapattanaporn et al., 2026). NPO-TR denotes an NPO-style baseline with an explicit retain-term regularizer. We also compare GraphSU with Seed-Only, a controlled ablation that shares the same unlearning objective as GraphSU but removes graph-guided controller. Key implementation details are summarized in Table 1. Table 1: Core implementation settings. Full hyperparameter sweeps are deferred to supplementary material. Setting Complete Entity Partial Steps 1200 1200 720 Graph activation sgs_g 120 120 220 Neighbour cap KnK_n 72 72 40 Neighbour ϕmax(n)φ^(n)_max 0.35 0.32 0.15 Entropy weight λent _ent 1.35 1.40 1.15 Unlikelihood weight λUL _UL 0.60 0.60 0.25 Retain CE weight λr _r 0.22 0.20 0.24 KL weight λKL _KL 0.01 0.01 0.012 Repulsion λrepℒrep _repL_rep on on off Route prompts per seed 4 5+aliases 6 Edge weights (α,β,γ,δ,λ)(α,β,γ,δ,λ) (0.7,0.5,0.5,1.0,0.7)(0.7,0.5,0.5,1.0,0.7) 3.2 Metrics and Route Probes The primary forget metric is soft leakage. For each forget seed zi∈Dfz_i∈ D_f, let pi,kk=1Ki\p_i,k\_k=1^K_i denote its validated recovery-route prompts, where k indexes an applicable route prompt and KiK_i is the number of valid prompts for that seed after route generation and filtering (Appendix E). Let yi,k′y _i,k be the model continuation generated from pi,kp_i,k, and let targetitarget_i denote the sensitive answer string or grounded target value whose recoverability is being tested for seed i. We define si,k=sim(yi,k′,targeti)s_i,k=sim(y _i,k,target_i) as the sentence-embedding cosine similarity between the generated continuation and that target. Soft leakage is SoftLeak=1|Df|∑zi∈Df1Ki∑k=1Ki[si,k≥τsoft], SoftLeak= 1|D_f| _z_i∈ D_f 1K_i _k=1^K_i 1\! [\,s_i,k≥ _soft\, ], (18) where τsoft=0.85 _soft=0.85 is the similarity threshold used to count a route as leaking the target. For both datasets, we evaluate three deletion settings: complete deletion, where the target is the full answer; partial deletion, where the target is a set of sensitive spans; and entity deletion, where the target is the canonical entity profile together with its aliases. Retention is measured using retain perplexity (PPL), retain F1, ROUGE-L F1, and separate retain-neighbor, retain-far, and partial-retain-only panels. PPL is the exponential of the mean token-level negative log-likelihood, so lower values indicate better retained language-modelling performance. Appendix I reports the additional utility panels jointly with soft leakage. Route families include direct, paraphrase, indirect, cloze, related-fact, list-sum., relation-inversion, and entity-alias prompts. 3.3 Main Results Utility-constrained unlearning. Table 2 reports the main GPT-2 Medium results on TOFU and PISTOL; results with Llama-3.2-3B-Instruct are provided in Appendix A. Across both datasets and all deletion settings, GraphSU achieves the lowest soft leakage among methods that keep retain PPL below 10. This distinction is important because effective unlearning requires balancing forgetting and retention. DPO, AltPO, and SELU preserve low retain PPL but leave high leakage, while GA, GA+KL, and GRU can reduce leakage only with substantial retention loss. For example, on TOFU complete deletion, GRU obtains lower leakage than GraphSU (38.13% vs. 46.83%) but raises retain PPL to 79.11, making it unsuitable under the utility-feasible criterion. Dataset Method Complete Entity/Instance Partial Leak↓ PPL↓ Leak↓ PPL↓ Leak↓ PPL↓ TOFU GA 97.13 24.91 97.75 51.13 99.75 61.24 GA+KL 97.13 24.91 97.75 51.13 88.25 42.44 DPO 99.88 1.24 100.00 1.30 100.00 2.94 NPO-TR 91.50 4.79 88.63 9.12 95.13 10.75 AltPO 97.50 1.58 97.19 1.30 100.00 9.02 GRU 38.13†38.13 79.11 65.31 59.09 86.25 24.42 SELU 92.88 1.29 97.88 1.32 98.75 1.27 Seed-Only 93.25 2.61 96.25 4.40 100.00 7.90 GraphSU (Proposed) 46.83 3.27 54.60 4.94 81.67 1.91 PISTOL GA 100.00 1.02 100.00 1.05 100.00 1.20 GA+KL 100.00 1.02 99.39 1.06 99.34 1.20 DPO 99.83 1.02 100.00 1.02 100.00 1.28 NPO-TR 98.92 1.02 94.50 1.10 99.17 1.39 AltPO 95.33 1.15 99.50 1.03 63.67 3.13 GRU 99.87 1.04 98.70 1.06 98.76 1.37 SELU 96.66 1.02 100.00 1.03 97.78 1.01 Seed-Only 56.33 1.09 26.33 1.10 41.39 1.22 GraphSU (Proposed) 6.83 1.05 4.67 1.10 29.17 1.19 Table 2: Main forget–retain comparison on GPT-2 Medium across TOFU and PISTOL. Leak denotes soft leakage (%); PPL denotes retain perplexity; lower is better for both. Bold marks the best value in each column, regardless of method. Underlining marks the lowest-leakage result satisfying the operational retention constraint PPL ≤10≤ 10. † marks the lower-leakage TOFU complete-deletion result that violates this constraint. Impact of graph-guided support expansion. Since Seed-Only uses the same unlearning objective but omits graph-neighbor expansion, the comparison isolates the effect of support-route control in GraphSU. On TOFU, GraphSU reduces aggregate soft leakage by 46.42 points for complete deletion, 41.65 points for entity/instance deletion, and 18.33 points for partial deletion. On PISTOL, the corresponding reductions are 49.50, 21.66, and 12.22 points. Figure 2 further shows that the improvement is consistent across recovery-route families: GraphSU improves over Seed-Only in all 21 task–route cells, with average route-level reductions of 45.9, 41.7, and 22.6 points for complete, entity/instance, and partial deletion, respectively. These results show that effective unlearning requires deleting support routes, not just seed examples. Appendix I complements PPL with retain F1, ROUGE-L F1, far-retain F1, neighbour-retain F1, and safe-span F1 for partial deletion. On TOFU, GraphSU raises retain F1 from 39.07 to 42.41 for complete deletion, from 37.16 to 59.11 for entity/instance deletion, and from 3.20 to 55.14 for partial deletion; under partial deletion, safe-span F1 rises from 1.26 to 61.31. These answer-level results show that the controlled Seed-Only gains reflect an improved forgetting–utility balance rather than leakage reduction in isolation. Challenges of partial deletion. Complete and entity/instance deletion benefit most from graph expansion because target information can be supported through full answers, aliases, and related facts. Partial deletion is more constrained: the model must suppress sensitive spans while preserving the remaining answer content. Although GraphSU improves the partial-deletion frontier, achieving 81.67% leakage with retain PPL 1.91 on TOFU, substantial residual leakage remains. These results support graph-guided support expansion and route-level control, while stronger claims about certified erasure require further ablation. 3.4 Recovery-route robustness Figure 2: Route-level soft-leakage reduction of GraphSU relative to Seed-Only on GPT-2 Medium (TOFU). Values denote percentage-point reductions in soft leakage; higher is better. Figure 2 reports the route-level soft-leakage reduction of GraphSU relative to Seed-Only across seven recovery-route families and three deletion settings. GraphSU improves over Seed-Only in all 21 task–route combinations, reducing leakage by an average of 36.8 percentage points. Gains are largest for complete deletion, with an average reduction of 45.9 points and a maximum of 55.0 points under relation-inversion prompts. Entity deletion shows a similar pattern, averaging 41.7 points with improvements of at least 35.2 points across all routes. Partial deletion yields smaller but consistent gains (22.6 points on average), reflecting the need to preserve non-sensitive answer content while suppressing sensitive spans. Since both methods use the same local objective and route prompts, these results provide controlled evidence that graph-guided support expansion improves robustness to diverse recovery routes. 4 Related Work Early LLM unlearning studies adapted gradient ascent or retain-regularised objectives to suppress forget examples (Jang et al., 2023; Maini et al., 2024). More recent methods address known failure modes of direct ascent: NPO slows catastrophic collapse through a preference-inspired loss (Zhang et al., 2024); AltPO combines negative and positive preference signals to avoid nonsensical forget responses (Mekala et al., 2025); GRU rectifies gradients to mitigate the unlearning–retention trade-off (Wang et al., 2025b); and SELU uses an energy-based LoRA formulation with straight-through estimators (Chaiyapattanaporn et al., 2026). These algorithms mainly improve the update rule. GraphSU is complementary: it determines the support routes, masks, and strengths to which an update rule is applied. 5 Conclusions We presented GraphSU, a graph-guided controller that treats selective unlearning as a support-route control problem: instead of editing only the explicitly identified forget seeds, it builds a weighted multi-view support graph, propagates request-conditioned relevance from the seeds, and applies graded forgetting strengths to the high-risk neighbours. GraphSU can be paired with existing unlearning objectives without modifying them. Across TOFU and PISTOL with GPT-2 Medium and Llama-3.2-3B-Instruct, GraphSU achieves the lowest utility-feasible soft leakage in all deletion settings, reducing leakage by up to 49.5 percentage points over a matched Seed-Only ablation while maintaining low retain perplexity. These results suggest that the deletion scope, not only the unlearning loss, is a key determinant of reliable knowledge removal. Limitations Unlike complete or entity deletion, partial deletion requires removing sensitive spans while preserving the surrounding answer content, making the task inherently more constrained. A well-posed partial-deletion instance requires an answer that contains at least two clearly separable facts, one sensitive and targeted for removal, and one safe and retained so that the sensitive span can be suppressed without disturbing the remainder. This is a property of the span-level deletion setting itself rather than of any particular method, and the residual leakage observed in this setting largely reflects this structural difficulty. More broadly, soft leakage measures behavioural recoverability under a fixed family of recovery-route probes rather than certified representational erasure, so our results are best interpreted as evidence of substantially reduced reachability of the target knowledge. GraphSU additionally performs offline fact extraction and support-graph construction; this cost is incurred once per corpus and amortised across deletion requests (Appendix H). Ethical Considerations Selective unlearning can support privacy, copyright compliance, removal of stale information, and safer model maintenance. It can also create a false sense of compliance if evaluation is weak, or be misused to remove safety-relevant knowledge. We therefore present GraphSU as an approximate unlearning technique that should be paired with governance, audit trails, and independent verification. References Chaiyapattanaporn et al. (2026) P. Chaiyapattanaporn, P. Stenetorp, and Y. Chen SELU: energy-based targeted unlearning in llms. Note: OpenReview submission External Links: Link Cited by: §1, §3.1, §4. Cohen et al. (2024) R. Cohen, E. Biran, O. Yoran, A. Globerson, and M. Geva Evaluating the ripple effects of knowledge editing in language models. Transactions of the Association for Computational Linguistics 12, p. 283–298. External Links: Document, Link Cited by: §2.3. Jang et al. (2023) J. Jang, D. Yoon, S. Yang, S. Cha, M. Lee, L. Logeswaran, and M. Seo Knowledge unlearning for mitigating privacy risks in language models. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 14389–14408. Cited by: §1, §3.1, §4. Koh and Liang (2017) P. W. Koh and P. Liang Understanding black-box predictions via influence functions. In Proceedings of the 34th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 70, p. 1885–1894. External Links: Link Cited by: §2.3. Li et al. (2024) N. Li, A. Pan, A. Gopal, S. Yue, D. Berrios, A. Gatti, J. D. Li, A. Dombrowski, S. Goel, L. Phan, G. Mukobi, N. Helm-Burger, R. Lababidi, L. Justen, A. B. Liu, M. Chen, I. Barrass, O. Zhang, X. Zhu, R. Tamirisa, B. Bharathi, A. Khoja, Z. Zhao, A. Herbert-Voss, C. B. Breuer, S. Marks, O. Patel, A. Zou, M. Mazeika, Z. Wang, P. Oswal, W. Lin, A. A. Hunt, J. Tienken-Harder, K. Y. Shih, K. Talley, J. Guan, R. Kaplan, I. Steneker, D. Campbell, B. Jokubaitis, A. Levinson, J. Wang, W. Qian, K. K. Karmakar, S. Basart, S. Fitz, M. Levine, P. Kumaraguru, U. Tupakula, V. Varadharajan, R. Wang, Y. Shoshitaishvili, J. Ba, K. M. Esvelt, A. Wang, and D. Hendrycks The WMDP benchmark: measuring and reducing malicious use with unlearning. In Proceedings of the 41st International Conference on Machine Learning, Cited by: §1. Maini et al. (2024) P. Maini, Z. Feng, A. Schwarzschild, Z. C. Lipton, and J. Z. Kolter TOFU: a task of fictitious unlearning for large language models. arXiv preprint arXiv:2401.06121. External Links: Document, Link Cited by: §1, §2.3, §3.1, §3.1, §4. Mekala et al. (2025) A. Mekala, V. Dorna, S. Dubey, A. Lalwani, D. Koleczek, M. Rungta, S. Hasan, and E. Lobo Alternate preference optimization for unlearning factual knowledge in large language models. In Proceedings of COLING, External Links: Link Cited by: §1, §3.1, §4. Meng et al. (2022) K. Meng, D. Bau, A. Andonian, and Y. Belinkov Locating and editing factual associations in GPT. In Advances in Neural Information Processing Systems, Vol. 35, p. 17359–17372. External Links: Link Cited by: §2.3. OpenAI (2025) OpenAI Introducing gpt-4.1 in the api. Note: https://openai.com/index/gpt-4-1/Accessed: 2026-06-16 Cited by: §2.1. Park et al. (2023) S. M. Park, K. Georgiev, A. Ilyas, G. Leclerc, and A. Madry TRAK: attributing model behavior at scale. In Proceedings of the 40th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 202, p. 27074–27113. External Links: Link Cited by: §2.3. Pruthi et al. (2020) G. Pruthi, F. Liu, M. Sundararajan, and S. Kale Estimating training data influence by tracing gradient descent. In Advances in Neural Information Processing Systems, Vol. 33, p. 19920–19930. External Links: Link Cited by: §2.3. Qiu et al. (2024) X. Qiu, W. F. Shen, Y. Chen, N. Cancedda, P. Stenetorp, and N. D. Lane How data inter-connectivity shapes llms unlearning: a structural unlearning perspective. arXiv preprint arXiv:2406.16810. Cited by: §3.1. Rafailov et al. (2023) R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn Direct preference optimization: your language model is secretly a reward model. In Advances in Neural Information Processing Systems, External Links: Link Cited by: §3.1. Reimers and Gurevych (2019) N. Reimers and I. Gurevych Sentence-BERT: sentence embeddings using Siamese BERT-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, Hong Kong, China, p. 3982–3992. External Links: Document, Link Cited by: §2.3. Reisizadeh et al. (2025) H. Reisizadeh, J. Ruan, Y. Chen, S. Pal, S. Liu, and M. Hong Leak@k: unlearning does not make LLMs forget under probabilistic decoding. arXiv preprint arXiv:2511.04934. External Links: Link Cited by: §2.3. Shi et al. (2024) W. Shi, J. Lee, Y. Huang, S. Malladi, J. Zhao, A. Holtzman, D. Liu, L. Zettlemoyer, N. A. Smith, and C. Zhang MUSE: machine unlearning six-way evaluation for language models. arXiv preprint arXiv:2407.06460. External Links: Link Cited by: §1. Tian et al. (2024) B. Tian, X. Liang, S. Cheng, Q. Liu, M. Wang, D. Sui, X. Chen, H. Chen, and N. Zhang To forget or not? towards practical knowledge unlearning for large language models. In Findings of the Association for Computational Linguistics: EMNLP 2024, Miami, Florida, USA, p. 1524–1537. External Links: Document, Link Cited by: §1, §2.3. Wang et al. (2025a) W. Wang, M. Zhang, X. Ye, Z. Ren, P. Ren, and Z. Chen UIPE: enhancing LLM unlearning by removing knowledge related to forgetting targets. In Findings of the Association for Computational Linguistics: EMNLP 2025, Suzhou, China, p. 25212–25227. External Links: Document, Link Cited by: §2.3. Wang et al. (2025b) Y. Wang, Q. Wang, F. Liu, W. Huang, Y. Du, X. Du, and B. Han GRU: mitigating the trade-off between unlearning and retention for llms. In Proceedings of the International Conference on Machine Learning, External Links: Link Cited by: §1, §3.1, §4. Wei et al. (2025) R. Wei, P. Niu, H. H. Hsu, R. Wu, H. Yin, M. Ghassemi, Y. Li, V. K. Potluru, E. Chien, K. Chaudhuri, O. Milenkovic, and P. Li Do LLMs really forget? evaluating unlearning with knowledge correlation and confidence awareness. In Advances in Neural Information Processing Systems, Note: NeurIPS 2025 poster External Links: Link Cited by: §2.3. Zhang et al. (2024) R. Zhang, L. Lin, Y. Bai, and S. Mei Negative preference optimization: from catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05868. External Links: Link Cited by: §1, §3.1, §4. Zhong et al. (2023) Z. Zhong, Z. Wu, C. Manning, C. Potts, and D. Chen MQuAKE: assessing knowledge editing in language models via multi-hop questions. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, Singapore, p. 15686–15702. External Links: Document, Link Cited by: §2.3. Appendix A Experiment Results on Llama-3.2-3B-Instruct Larger-backbone evaluation. We evaluate GraphSU with Llama-3.2-3B-Instruct on TOFU to examine whether graph-guided support expansion transfers beyond GPT-2 Medium. All methods start from the same supervised fine-tuned checkpoint and use the same deletion manifests, evaluation prompts, decoding settings, and checkpoint-selection criterion. Lower values are better for both soft leakage and retain perplexity. Complete deletion. Method Leak↓ PPL↓ Seed-Only 93.67 1.05 GA 99.70 1.08 GA+KL 94.33 1.09 DPO 94.33 1.30 NPO-TR 91.66 1.06 AltPO 90.00 1.08 GRU 93.33 1.08 SELU 93.66 1.05 GraphSU 13.33 1.96 Entity/instance deletion. Method Leak↓ PPL↓ Seed-Only 25.11 1.04 GA 36.00 1.20 GA+KL 38.66 1.05 DPO 92.22 1.70 NPO-TR 33.33 1.09 AltPO 34.67 1.15 GRU 86.33 1.03 SELU 35.66 1.02 GraphSU 15.53 1.35 Partial deletion. Method Leak↓ PPL↓ Seed-Only 94.33 1.56 GA 94.36 1.05 GA+KL 89.00 1.16 DPO 96.36 1.03 NPO-TR 89.66 1.07 AltPO 88.67 1.09 GRU 93.67 1.06 SELU 94.66 1.04 GraphSU 87.01 1.07 The larger-backbone results preserve the central pattern observed in the controlled GPT-2 Medium experiments: expanding the edit scope beyond the explicit forget seeds is most beneficial when the target remains reachable through related examples or entity-centred support routes. Partial deletion remains more difficult because the method must suppress only a sensitive span while preserving the remainder of the answer. Perplexity consistency check. Retain PPL is computed by teacher-forced scoring on the same frozen retain set for a given comparison. Prompt and padding positions are masked, answer-token negative log-likelihood (NLL) is summed over the evaluation set and divided by the number of scored answer tokens, and the aggregate mean NLL is exponentiated once. Consequently, PPL must be at least one. The DPO partial-deletion value previously shown as 0.03 was mean NLL rather than PPL; the corrected value is exp(0.03)≈1.03 (0.03)≈ 1.03. This correction does not change the leakage ranking because DPO soft leakage is 96.36%. Applicability beyond QA-formatted data and causal language models. GPT-2 Medium and Llama-3.2-3B-Instruct are autoregressive causal language models (CLMs), not QA-specific architectures; the QA pairs used here are the benchmarks’ data representation. More generally, a GraphSU node can represent a document, passage, or conversation, with deletion masks identifying sensitive spans, while the same semantic, symbolic, and gradient support views define request-conditioned support routes for non-QA corpora. Appendix B Pareto Trade-Off Plots The plots below show the forget–retain trade-off for the three evaluated model–dataset settings. Lower-left is better; the shaded region marks the utility-feasible region, and the dashed line denotes retain PPL =10=10 where shown. To preserve legibility in the two-column EMNLP format, each model–dataset plot is rendered as a separate full-width vector figure. The PPL ≤10≤ 10 threshold is used only as a fixed operational guardrail to prevent severe retention collapse from being interpreted as successful unlearning; it is not presented as a universal cutoff. We therefore also inspect the unfiltered Pareto frontier, retaining every reported operating point regardless of PPL. Table 3: Unfiltered Pareto-optimal points on GPT-2 Medium TOFU. Each pair is (soft leakage %, retain PPL); lower is better on both axes. Setting Pareto-optimal operating points Complete DPO (99.88, 1.24); SELU (92.88, 1.29); GraphSU (46.83, 3.27); GRU (38.13, 79.11) Entity/instance AltPO (97.19, 1.30); Seed-Only (96.25, 4.40); GraphSU (54.60, 4.94) Partial SELU (98.75, 1.27); GraphSU (81.67, 1.91) GraphSU is Pareto-optimal in all three deletion settings. It has the lowest leakage among the reported methods under every PPL cap from 5 through 50. With no retention cap, GRU attains lower complete-deletion leakage (38.13%) but at retain PPL 79.11. NPO-TR is only slightly above the original guardrail for partial deletion (PPL 10.75), yet its soft leakage remains 95.13% compared with 81.67% for GraphSU. The guardrail should therefore be read as one practical operating region rather than as a filter that defines the underlying trade-off. Figure 3: Forget–retain trade-off for GPT-2 Medium on TOFU. The complete, partial, and entity/instance deletion panels are shown at full width so axis labels, method labels, and the utility-feasible region remain readable. Figure 4: Forget–retain trade-off for GPT-2 Medium on PISTOL, shown as a full-width vector panel for improved readability. Figure 5: Forget–retain trade-off for Llama-3.2-3B-Instruct on TOFU, shown as a full-width vector panel for improved readability. Appendix C Fact Extraction and GPT-4.1 Prompting GraphSU uses GPT-4.1 only for offline fact grounding. For each QA pair, GPT-4.1 extracts schema-constrained head–relation–tail facts. The outputs are then validated, canonicalised, deduplicated, and type-checked using deterministic post-processing. Extraction is performed once per corpus and cached; it is not repeated for each deletion request. The recovery-route prompts in Appendix E are generated locally and do not use an external LLM. Table 4: Fact-extraction settings. Setting Value Extraction model GPT-4.1 Output format JSON object (json_object mode) Nominal workload Approximately one initial request per QA sample Maximum retry attempts 3 Request timeout 60 seconds Maximum labelled few-shot examples 20 System instruction. ⬇ You are an information extraction assistant that prepares data for a knowledge graph. Be CONSERVATIVE and ACCURATE: never invent books, awards, dates, or relationships that are not clearly stated in the question or answer. For each question/answer pair, extract ATOMIC factual triples suitable for graph edges. Each triple is an object with: - "head": the entity the fact is about - "head_type": one of [PERSON, ORG, WORK, EVENT, LOCATION, AWARD, GENRE, CHARACTER, TOPIC, OTHER] - "relation": a short, descriptive edge label - "tail": the target node, value, or linked entity - "tail_type": one of [PERSON, ORG, WORK, EVENT, LOCATION, DATE, NUMBER, OCCUPATION, AWARD, GENRE, CHARACTER, TOPIC, NATIONALITY, LANGUAGE, OTHER] BOOKS/WORKS: create a separate triple per titled work; use PERSON--author_of-->WORK; quoted strings in a works context are strong WORK candidates; add WORK--genre-->GENRE and WORK--publication_year-->DATE when stated. LANGUAGE/NATIONALITY: tag tail_type accordingly. Use both question and answer; split comma/"and" lists into separate triples; do not invent facts. Return ONLY: "triples": [...] Per-sample user prompt and worked example. ⬇ Study the supplied canonical examples, then extract graph triples for: Question: Where does Avery Collins work? Answer: Avery Collins works at Northbridge University and writes in Spanish. -> "triples": [ "head":"Avery Collins","head_type":"PERSON", "relation":"works_at","tail":"Northbridge University","tail_type":"ORG", "head":"Avery Collins","head_type":"PERSON", "relation":"writes_in","tail":"Spanish","tail_type":"LANGUAGE" ] Appendix D Local Fact Extraction and Error Propagation Hosted fact extraction may be undesirable for proprietary corpora. We therefore rebuilt the symbolic graph with the local Qwen2.5-3B-Instruct model and repeated a matched TOFU complete-deletion experiment. Only extractor-derived facts and symbolic edges changed; GPT-2 Medium, all 184 forget targets, training code, seed 42, unlearning recipe, evaluation manifest, decoding, and detector thresholds were held fixed. Qwen processed 4,005 QA examples and returned valid triples for 3,942 (98.43%) without external API calls. In a 200-example structured audit, exact-triple F1 was 15.57% for Qwen and 9.88% for GPT-4.1; GPT-4.1 retained higher exact-tail accuracy. Because semantically equivalent facts can be decomposed into different triples, this structured audit is diagnostic rather than a complete semantic gold standard. The two rebuilt graphs remained close despite extractor differences: edge-weight Spearman correlation was ρ=0.925ρ=0.925, degree correlation was ρ=0.979ρ=0.979, diffusion-score correlation was ρ=0.996ρ=0.996, and the selected support sets had Jaccard similarity 0.895 (68 of 72 selected supports were identical). To test error propagation, we additionally corrupted graph-active heads, tails, and triples. At 40% random-active corruption, 69 of 72 support nodes were retained; under 40% graph-critical corruption, 66 of 72 were retained. Diffusion-score correlations remained at least 0.9974. These perturbations indicate that symbolic noise is attenuated by the semantic and gradient views, weighted fusion, and diffusion rather than being automatically propagated to the full support closure. Table 5: Matched step-480 TOFU complete-deletion operating point using local Qwen2.5-3B-Instruct fact extraction. The Original-SFT column is the common pre-unlearning checkpoint. Metric Original-SFT Local-Qwen GraphSU Soft leakage ↓ 91.25% 49.83% Hard leakage ↓ 37.67% 1.33% Forget-answer F1 ↓ 84.37% 33.86% Retain F1 ↑ 72.55% 30.27% Retain semantic cosine ↑ 90.95% 79.53% Retain PPL ↓ 4.30 9.95 At this matched operating point, local extraction gives soft leakage 49.83%, approximately 3.0 percentage points above the re-verified GPT-4.1-based GraphSU result (46.83%), while avoiding external transmission of the corpus. Leakage decreases by 36–44 percentage points across every tested route family and hard leakage is 0–3%. The trade-off is not cost-free: lexical retain utility falls, and neighbour-retain PPL reaches 11.54 even though the three-panel aggregate retain PPL is 9.95. We therefore view local extraction as a privacy-preserving deployment option with a measurable forgetting–utility trade-off, not as an accuracy-equivalent replacement for GPT-4.1. Appendix E Adversarial Route-Prompt Generation For each evaluated sample zi=(qi,aitext,ℱi)z_i=(q_i,a_i^text,F_i), we select a grounded target fact ki=(hi,ri,ti)k_i=(h_i,r_i,t_i), where hih_i is the head entity, rir_i is the relation, and tit_i is the target value whose recoverability is assessed. Recovery-route prompts are generated offline using deterministic, relation-conditioned templates; no external LLM is used in this stage. The generator may additionally use a validated alias set A(hi)A(h_i), an inverse-relation mapping I(ri)I(r_i), and related facts associated with the same entity or a graph-connected sample. Candidate prompts are normalised, deduplicated, checked for missing template slots, accidental target disclosure, and relation compatibility. The resulting manifests are frozen before evaluation and reused unchanged for GraphSU and all baselines. The task-specific monitoring panels use the prompt counts in Table 1; not every route is applicable to every target, and validated aliases may add entity-specific variants. E.1 Detailed Worked Example Consider the illustrative QA sample: Question: Where does Avery Collins work? Answer: Avery Collins works at Northbridge University. The fact-extraction stage produces the grounded target fact with head Avery Collins, relation works_at, and tail Northbridge University. For this example, the generator is also provided with the validated aliases A(hi)=A. Collins,Avery C.,A(h_i)=\A. Collins,Avery C.\, (19) and, when available, a related fact such as (Avery Collins,researches,machine ethics).(Avery Collins, researches,machine ethics). (20) All prompts below assess recovery of the same target value, Northbridge University; only the recovery route changes. After template expansion, prompts pass through the following deterministic validation procedure: 1. fill route-specific slots using the grounded target fact, validated aliases, and available related facts; 2. remove prompts with missing or invalid slots; 3. remove prompts that reveal the target value, except when the route definition requires it, as in relation inversion; 4. remove exact and normalised duplicates; 5. retain only prompts compatible with the target relation; 6. order or sample valid variants using the fixed experimental seed; and 7. save the resulting manifest for reuse across all evaluated methods. Thus, differences between GraphSU and the baselines cannot be attributed to different evaluation questions: each method uses the same frozen target facts, route prompts, decoding settings, and soft-leakage threshold. Table 6: Recovery-route families and representative generation rules. The displayed prompts are illustrative; the implementation uses relation-conditioned template maps so that each prompt remains compatible with its grounded target relation. Route family Generation rule Representative prompt Direct Preserve the original question, optionally adding a neutral instruction wrapper. “Please answer: ⟨qi⟩ q_i ” Paraphrase Apply relation-specific lexical and syntactic transformations while preserving hih_i, rir_i, and target tit_i. “At which institution is ⟨hi⟩ h_i employed?” Indirect Ask for the same relation using contextual or descriptive wording rather than the original surface form. “Which organisation is associated with ⟨hi⟩ h_i ’s employment?” Cloze Convert the target fact into a declarative statement and replace the target value with a blank. “⟨hi⟩ h_i works at .” Related-fact Introduce another validated fact associated with hih_i or a selected graph neighbour, and then query the target relation. “The researcher who studies ⟨related topic⟩ topic is affiliated with which institution?” Entity alias Replace the canonical entity mention with a validated alias from A(hi)A(h_i). “Where does ⟨alias(hi)⟩ (h_i) work?” List-summary Request several profile attributes while ensuring that the target relation is included. “List the main profile details for ⟨hi⟩ h_i , including institutional affiliation.” Relation inversion Reverse the grounded relation using I(ri)I(r_i) when the inverse is meaningful and sufficiently unambiguous. “Which author is affiliated with ⟨ti⟩ t_i ?” Table 7: Detailed route generation for one grounded target fact. Route Generated prompt Purpose Direct Where does Avery Collins work? Tests recovery through the original question. Paraphrase At which institution is Avery Collins employed? Changes lexical and syntactic form while preserving the target relation. Indirect Which university is associated with Avery Collins’s employment? Avoids the original “where does … work” formulation. Cloze Avery Collins works at . Tests whether the target completes a factual statement. Related-fact The researcher known for work on machine ethics is affiliated with which institution? Uses a related fact to reach the target entity; emitted only when that fact identifies the intended entity without ambiguity. Entity alias Where does A. Collins work? Tests recovery after replacing the canonical entity name with a validated alias. List-summary List Avery Collins’s main profile details, including institutional affiliation. Tests whether the target appears within a broader profile response. Relation inversion Which author is affiliated with Northbridge University? Reverses the relation direction; emitted only when the inverse mapping is defined and sufficiently unambiguous. Appendix F Taxonomy-Blind and Held-Out Leakage Probes The templated route families in Appendix E are useful for controlled diagnosis, but robustness measured only on that taxonomy can overstate generalisation. We therefore perform an additional taxonomy-blind evaluation on all 184 TOFU complete-deletion targets. A local Qwen2.5-3B-Instruct model generates free-form probes using only the original question and answer. It receives no graph structure, route labels, templates, hyperparameters, or outputs from the unlearned models. The resulting probes have zero exact matches with the original template bank. Checkpoints and detector thresholds are frozen before this evaluation. We evaluate 736 free-form probes (four per target) and a stronger attack panel of 342 probes across 171 targets, where each probe is first verified to recover the target answer from Original-SFT. Seed-Only and GraphSU use identical prompts and decoding. Leakage is measured with (i) a fixed-reference representation derived from Original-SFT, (i) external MPNet semantic similarity, (i) DeBERTa natural-language inference, (iv) direct target-phrase recovery, and (v) a conservative combined detector that fires when any constituent detector succeeds. Table 8: Taxonomy-blind leakage on unseen free-form probes for TOFU complete deletion. Reduction is Seed-Only minus GraphSU in percentage points. Confidence intervals are paired target-level 95% bootstrap intervals; p is the two-sided McNemar test. Panel Detector Seed-Only GraphSU Reduction 95% CI McNemar p All targets Fixed-reference 74.18% 61.68% 12.50 p [8.02, 17.26] 1.03×10−81.03× 10^-8 All targets Combined 75.68% 62.09% 13.59 p [8.97, 18.34] 5.98×10−105.98× 10^-10 Confirmed attacks Fixed-reference 78.95% 65.20% 13.74 p [7.02, 20.76] 4.92×10−54.92× 10^-5 Confirmed attacks Combined 79.82% 65.50% 14.33 p [7.89, 21.05] 2.23×10−52.23× 10^-5 The direction is also consistent for direct phrase recovery, MPNet, and NLI considered separately. For continuity with the main evaluation, the original soft-leakage detector is retained as an auxiliary measure: on the full taxonomy-blind panel it favours GraphSU (93.48% versus 96.20% for Seed-Only; p=0.0187p=0.0187), while it saturates on the smaller confirmed-attack panel. These results extend the claim from robustness within the predefined route family to improved robustness against unseen, independently generated recovery attempts; they do not constitute certified erasure. Appendix G Qualitative Deletion Examples The examples below use only the concepts defined in the main paper: the deletion setting, forget seed, grounded target fact, edit scope, support routes, and retention constraint. They illustrate how requests are represented and evaluated rather than introducing a separate response-transformation framework. G.1 Complete deletion Forget seed. Question: Where does Avery Collins work? Answer: Avery Collins works at Northbridge University. The grounded target has head Avery Collins, relation works_at, and tail Northbridge University. Edit scope and interpretation. All answer tokens in the forget seed receive full forgetting pressure, while graph-selected support examples receive bounded pressure according to their request-conditioned support scores. A successful update prevents recovery of Northbridge University through applicable direct, paraphrase, cloze, related-fact, list-summary, and relation-inversion prompts while preserving utility on unrelated retain examples. G.2 Entity/instance deletion Deletion request. Remove the profile associated with Hsiao Yun-Hwa. One seed asks: What is the full name of the author born in Taipei, Taiwan on 05/11/1991 who writes in the leadership genre? The seed answer is: The author’s full name is Hsiao Yun-Hwa. Edit scope and interpretation. Canonical-name, alias, and entity-profile examples form the seed forget set, and additional high-risk support examples are selected through the request-conditioned graph closure. A successful update prevents recovery of the target profile through canonical-name, alias, indirect, related-fact, and list-summary prompts while preserving factual responses for unrelated entities. The target is suppressed without introducing a manually selected generic identity. G.3 Partial deletion Forget seed. Question: Where does Avery Collins work, and in which language do they write? Answer: Avery Collins works at Northbridge University and writes in Spanish. The sensitive target is the works_at value Northbridge University; the safe fact is that Avery Collins writes in Spanish. Edit scope and interpretation. Forgetting is localised to the target span, while the safe answer span remains supervised; representation repulsion is disabled for this setting. A successful update prevents recovery of the institutional affiliation across applicable routes while retaining the model’s ability to answer that Avery Collins writes in Spanish. These examples clarify the three deletion granularities. Complete deletion suppresses the full answer associated with a seed; entity/instance deletion expands the request across an entity-centred profile and its aliases; and partial deletion suppresses only the grounded sensitive span while preserving the safe answer remainder. G.4 Diagnosing Residual Leakage in the Support Graph The support graph localises potential support at the training-example level; it does not claim to identify a single neuron or parameter in which a fact is stored. When a target remains recoverable after unlearning, the request-conditioned graph provides a diagnostic view through each node’s diffusion score rir_i, hop distance from the forget seed, and the semantic, symbolic, and gradient views contributing to its incident edges. Residual leakage can arise when relevant evidence lies just below the selection threshold or top-B expansion budget, when support is distributed across several individually weak paths, or when partial deletion intentionally limits forgetting pressure because sensitive and safe facts share the same answer context. Thus, difficult-to-remove information may correspond to redundant or diffuse support routes rather than a single missed example. This interpretation is diagnostic rather than a calibrated causal localisation claim. Appendix H Operational Cost, Memory, and Scalability Unless otherwise stated, the measurements below use GPT-2 Medium on TOFU. Corpus-level facts and graph artefacts are cached and reused across deletion requests. H.1 Graph-construction scaling benchmark We benchmark nested TOFU subsets using GPT-2 Medium. GPT-4.1 fact extractions were already cached and are therefore excluded from the build-time measurements. Embedding and symbolic processing ran on the CPU, while gradient-alignment features used the GPU. The graph degree is capped at 30. Table 9: Graph construction, memory, cache size, and request-conditioned selection cost as the number of stored QA samples increases. Warm selection reuses in-memory cached artefacts; cold selection includes loading cached graph artefacts before support selection. Samples Stored edges Avg. degree Build time (s) CPU RAM (GB) GPU mem. (GB) Cache (MB) Warm sel. (s) Cold sel. (s) 1K 11,279 22.56 106.01 1.41 2.36 2.87 0.68 1.27 2K 22,795 22.80 212.41 1.45 2.47 4.93 1.74 3.02 4K 45,524 22.76 452.36 1.40 2.36 7.82 4.01 6.53 At 4,000 samples, graph construction takes 452.36 seconds (about 7.5 minutes), cached artefacts occupy 7.82 MB, and warm support selection takes 4.01 seconds. Because the stored degree is capped at K=30K=30, the number of stored edges is O(NK)O(NK) and therefore linear in N for fixed K; graph storage and each sparse diffusion iteration scale with the stored edge set. The current exact cosine candidate-retrieval step is approximately quadratic in the number of samples and may become the dominant bottleneck at much larger corpus sizes. Approximate nearest-neighbour retrieval for the semantic view and symbolic inverted indices are natural scalable replacements that preserve the sparse downstream graph. H.2 Request-time and audit costs The isolated warm/cold timings in Table 9 measure graph loading and support selection on cached subset artefacts. The full request-conditioned pipeline additionally includes request grounding, one- and two-hop retrieval, support scoring, and retain-safety filtering. Table 10: Stage-level operational costs from the full deletion workflow. Stage Observed cost or workload Request-conditioned support selection 11.4–33.4 seconds per deletion request (mean 25.9 seconds), including request grounding, one- and two-hop support retrieval, support scoring, and retain-safety filtering. No external calls are used. Model update and orchestration Approximately 5.7–6.9 minutes per request, measured as total wall time minus logged evaluation time. The residual includes setup and checkpointing and is not a pure training-time measurement. Full recovery-route audit 63.0–83.1 minutes and 4,464–5,376 local model generations. This is an offline validation cost rather than request-time latency and uses no external LLM calls. With cached corpus artefacts, the recurring graph-specific overhead is small relative to model updating and the offline recovery-route audit. Fact extraction and graph construction are one-time corpus-level preprocessing costs and are amortised across deletion requests. Appendix I Additional Utility Evaluation Beyond PPL Perplexity is useful for detecting broad language-model degradation, but it does not fully capture whether retained factual behaviour is preserved. We therefore interpret soft leakage jointly with retain F1, ROUGE-L F1, far-retain F1, neighbour-retain F1, and safe-span F1 for partial deletion. The PPL ≤10≤ 10 criterion used in the main paper is an operational guardrail for these experiments rather than a universal unlearning threshold. Table 11: Primary TOFU forgetting and utility metrics for the controlled Seed-Only comparison. Setting Method Soft leak↓ Retain PPL↓ Retain F1↑ ROUGE-L F1↑ Complete Seed-Only 93.25 2.61 39.07 35.03 Complete GraphSU 46.83 3.27 42.41 47.36 Entity Seed-Only 96.25 4.40 37.16 33.38 Entity GraphSU 54.60 4.94 59.11 56.82 Partial Seed-Only 100.00 7.90 3.20 3.01 Partial GraphSU 81.67 1.91 55.14 51.07 Table 12: Locality-sensitive retain metrics corresponding to Table 11. Safe-span F1 applies only to partial deletion. Setting Method Far-retain F1↑ Neighbour F1↑ Safe-span F1↑ Complete Seed-Only 41.05 31.79 – Complete GraphSU 51.06 32.77 – Entity Seed-Only 43.42 34.69 – Entity GraphSU 57.13 46.17 – Partial Seed-Only 1.14 0.83 1.26 Partial GraphSU 54.58 54.54 61.31 The controlled comparison shows a stronger forgetting–utility balance for GraphSU in all three settings. Under complete deletion, GRU reaches lower soft leakage (38.13%) than GraphSU but raises retain PPL to 79.11, illustrating why leakage should not be interpreted without retention. Under partial deletion, NPO-TR has a slightly higher safe-span F1 (64.97) than GraphSU (61.31), but its retain PPL is 10.75 and soft leakage remains 95.13%. Neighbour-retain F1 is preserved or improved by GraphSU relative to Seed-Only: 32.77 vs. 31.79 for complete deletion, 46.17 vs. 34.69 for entity/instance deletion, and 54.54 vs. 0.83 for partial deletion. Appendix J Ablation Coverage and Hyperparameter Scope The controlled Seed-Only comparison is an ablation of the graph-guided scope controller as a whole: it uses the same local unlearning objective but omits graph-neighbour expansion. The local-extractor and corruption experiments in Appendix D further perturb the symbolic component while leaving the semantic and gradient views available. Together, these experiments establish that graph-guided support expansion matters and that the fused graph is robust to substantial symbolic noise. The present experimental archive does not contain a complete leave-one-view-out sweep for all five affinity terms or independent performance sweeps over the fusion weights, restart probability ρ, hop limit, and expansion budget B. We therefore do not attribute the observed gains to any single graph view and do not claim that the reported hyperparameters are optimal. The evaluated configuration uses all five views, the fusion weights reported in Table 1, one- and two-hop support retrieval, and the task-specific neighbour caps in Table 1. A full factorial sensitivity analysis would require additional training runs and remains an important direction for establishing which views are necessary under different data regimes. Appendix K Evaluation Consistency and Statistical Reliability All reported retain PPL values use the same teacher-forced protocol within a comparison: prompt and padding positions are masked, answer-token NLL is accumulated over the frozen retain set, the total is divided by the number of scored answer tokens, and the resulting mean NLL is exponentiated once. This definition implies PPL ≥1≥ 1 and motivated the correction in Appendix A. The local-extractor experiment additionally reports the Original-SFT retain PPL (4.30) at its matched operating point. The unlearning runs reported in the paper use one training seed. We therefore do not describe evaluation resampling as across-seed variance. For the independently generated taxonomy-blind probes, Table 8 reports paired target-level bootstrap confidence intervals and two-sided McNemar tests because the same probes are evaluated under both checkpoints. The available aggregate benchmark outputs do not support a defensible reconstruction of across-seed variance for all baselines; accordingly, no such variance is fabricated. Training-seed sensitivity remains a limitation of the current empirical study. Future multi-seed comparisons should use paired target-level intervals for leakage, paired example-level intervals for retain F1/ROUGE-L, and example-resampled aggregate NLL before exponentiation for PPL, with multiplicity correction when several baselines are tested.