Paper deep dive
Lock on Target! Precision Unlearning via Directional Control
Yuntao Wen, Ruixiang Feng, Feng Guo, Yifan Wang, Ran Le, Yang Song, Shen Gao, Shuo Shang
Models: LLaMA-2-7B
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/12/2026, 5:17:40 PM
Summary
The paper introduces 'DirectiOn Guided unlEarning' (DOGE), a novel method for LLM unlearning that addresses collateral and generality forgetting by identifying and leveraging a precise 'unlearning direction' in the model's parameter space. By performing differential analysis on residual stream activations between forget and retain samples, DOGE isolates the subspace associated with unwanted knowledge and applies orthogonal interventions to ensure precise erasure while preserving general model capabilities.
Entities (6)
Relation Signals (4)
DOGE â evaluatedon â TOFU
confidence 100% ¡ We conduct evaluations on DOGE with two widely used datasets: TOFU
DOGE â evaluatedon â WMDP
confidence 100% ¡ We conduct evaluations on DOGE with two widely used datasets: TOFU and WMDP
DOGE â addresses â Collateral Forgetting
confidence 95% ¡ To mitigate the issues of collateral forgetting and generality forgetting, we propose a novel DirectiOn Guided unlEarning (DOGE) method.
DOGE â addresses â Generality Forgetting
confidence 95% ¡ To mitigate the issues of collateral forgetting and generality forgetting, we propose a novel DirectiOn Guided unlEarning (DOGE) method.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Yuntao Wen, Ruixiang Feng, Feng Guo, Yifan Wang, Ran Le, Yang Song, Shen Gao, Shuo Shang. Findings of the Association for Computational Linguistics: EMNLP 2025. 2025.
Tags
Links
Full Text
48,940 characters extracted from source content.
Expand or collapse full text
Findings of the Association for Computational Linguistics: EMNLP 2025, pages 18782â18794 November 4-9, 2025 Š2025 Association for Computational Linguistics Lock on Target! Precision Unlearning via Directional Control Yuntao Wen 1 , Ruixiang Feng 1 , Feng Guo 1 , Yifan Wang 1 ,Ran Le 2 ,Yang Song 2 ,Shen Gao 1â ,Shuo Shang 1â 1 University of Electronic Science and Technology of China 2 NBG Lab, BOSS Zhipin yuntaowenx, yifanwang993w, jedi.shang@gmail.com leran, songyang@kanzhun.com,shengao@pku.edu.cn Abstract The unlearning method aims at effectively re- moving harmful, sensitive, or outdated knowl- edge without costly retraining the model. How- ever, existing methods suffer from two critical limitations: (1)collateral forgetting, where erasing target data inadvertently removes re- lated but desirable knowledge, and (2)general- ity forgetting, where aggressive unlearning de- grades the modelâs general capabilities. To ad- dress these challenges, we proposeDirectiOn Guided unlEarning (DOGE), a novel method that enables precise knowledge erasure by iden- tifying and leveraging a targeted âunlearning di- rectionâ in the models parameter space. DOGE first extracts this direction through differential analysis of representations for forgotten and re- tained samples, pinpointing the exact subspace associated with unwanted knowledge. It then selectively applies updates along this direction, ensuring minimal interference with retained in- formation and general model performance. Ex- periments across multiple benchmarks demon- strate that Doge achieves state-of-the-art un- learning precision while preserving both related knowledge and general capabilities. 1 Introduction Large Language Models (LLMs) have shown rev- olutionary potential in a wide range of domains, due to their powerful capabilities gained from pre- training on massive Internet corpora. However, due to the inevitable presence of harmful data on the internet (Naveed et al., 2023; Carlini et al., 2021) or the time-sensitive nature of some information, the removal of specific knowledge from trained mod- els has become a common necessity. Thus, LLM unlearning has been developed to remove the in- fluence of specific data or knowledge from LLMs â Corresponding author Code is available athttps://github.com/JackWenx/ DOGE Traditional Unlearning General Capability Knowledge need Retain Knowledge to Forget Taylorlives in X Taylorlives in X DirectionGuided Unlearning How many books has Taylor writtenďź Which City is known as Big Apple? Collateral Forgetting I donât know Los Angles Generality Forgetting How many books has Taylor writtenďź Which City is known as Big Apple? Taylor has written 37 books New York City Unlearning Unlearning Figure 1: Existing unlearning methods usually conduct coarse-grained parameter modification, which usually cause collateral forgetting. And our proposed DOGE first extracts precise unlearning direction and then uses the direction to guide the unlearning process. while avoiding costly and time-consuming com- plete retraining (Liu et al., 2025; Geng et al., 2025; Liu et al., 2024). This approach offers a promising way to maintain model security, protect user pri- vacy, and fulfill legal and regulatory requirements such as the âright to be forgottenâ (Bourtoule et al., 2021; Liu et al., 2025). However, existing unlearning methods for LLMs face two challenges: First, the problem of collat- eral forgetting arises when unlearning target data inadvertently degrades related but desirable knowl- edge. For example, when erasing a particular au- thorâs private address, the model may also lose the ability to recall their related works. Second, we also observe generality forgetting (Liu et al., 2025), where aggressive unlearning procedures corrupt the modelâs foundational capabilities. The inten- sive fine-tuning required for effective unlearning often damages the general capabilities acquired during pre-training, significantly degrading over- 18782 all model performance. The root cause of these two issues lies in the âimprecisionâ in current un- learning approaches. LLMs encode knowledge in highly distributed representations across their parameter space, yet existing unlearning methods operate through coarse-grained parameter updates, which struggle to precisely locate and modify spe- cific knowledge within the LLM. This leads to a dilemma between accurately removing target infor- mation and preserving the modelâs overall utility. To mitigate the issues of collateral forgetting and generality forgetting, we propose a novelDirectiOn Guided unlEarning (DOGE) method. The core idea of this method involves calculating and uti- lizing a specific unlearning direction within the modelâs parameter space. This approach aims to achieve the precise erasure of the knowledge to be forgotten while simultaneously maximizing the retention of the modelâs related knowledge and general capabilities. Specifically, the method con- ducts a differential analysis of the modelâs repre- sentations of forget samples and retain samples within the parameters to extract the precise unlearn- ing direction. This unlearning direction represents the precise direction in the parameter space for re- moving forgotten information, enabling its erasure without affecting retained knowledge. Following this, the unlearning direction is used to guide the forgetting process by selectively adjusting model parameters or activation values. This ensures up- dates are directed towards the relevant subspace of the target knowledge, thereby avoiding interfer- ence with retained information. By enabling fine- grained knowledge manipulation that overcomes the âimprecisionâ inherent in traditional methods, DOGE achieves state-of-the-art unlearning perfor- mance on several benchmark datasets and main- tains the general capabilities of the LLM. Our contributions are summarized as follows: â˘We propose a novelDirectiOnGuided unlEarning (DOGE) method which provides a new perspective for achieving precise knowledge era- sure in LLMs. â˘We introduce an effective method to identify for- getting direction in the internal representations for both forgotten and retained samples. â˘We propose to use the forgetting direction as guid- ance in unlearning by adding it into the modelâs parameter space during the forget and retain loss computation. â˘Experiments demonstrate the DOGE method achieves state-of-the-art performance by effectively balancing forgetting, relevant knowledge, and ca- pabilities. 2 Related Work The rapid advancement of LLM has significantly amplified the importance of unlearning. As these models are trained on vast datasets, they may in- advertently learn harmful content, private data, or materials protected by copyright. This presents risks concerning privacy breaches, legal issues, and potential vulnerabilities to malicious exploitation. To address this, several unlearning techniques have been developed in recent years, aiming to effectively eliminate unwanted information while preserving the modelâs performance on legitimate tasks. For instance, Representation Misdirection for Unlearning (Li et al., 2024a) (RMU) utilizes a dual-objective loss, considering both the neces- sity to forget and to retain, by selectively modi- fying intermediate layers to remove detrimental knowledge. Gradient Ascent directly maximizes the loss on the data to be forgotten. Building upon the Direct Preference Optimization (Rafailov et al., 2023) (DPO) framework, Negative Preference Opti- mization (Zhang et al., 2024) introduces a negative preference optimization strategy to mitigate the instability issues encountered by GA (Jang et al., 2022). NPO reportedly achieves a better trade-off between the effectiveness of unlearning and the modelâs utility, showing particular promise in sce- narios requiring the forgetting of a large proportion of data while maintaining practical usability. Gradi- ent Differentiation (GD) (Liu et al., 2022) employs distinct gradient operations on the datasets intended for forgetting and retention. Despite the progress in developing unlearning techniques for LLM, several studies have high- lighted the inherent vulnerabilities of current ap- proaches, particularly concerning the unintended consequences of knowledge removal. Two critical issues that frequently arise are collateral forgetting and the degradation of the modelâs generalization capabilities. Collateral ForgettingCollateral forgetting, also known as catastrophic forgetting in the context of continual learning, refers to the phenomenon where unlearning specific target knowledge inadvertently leads to the forgetting of related but desirable infor- mation. For instance, attempting to remove factual inaccuracies about a certain entity might also cause the model to lose general knowledge or reason- 18783 ing abilities associated with that entityâs domain. Existing methods often struggle to precisely tar- get only the undesirable knowledge, leading to an over-aggressive erasure that impacts the broader knowledge graph embedded within the LLM(Yao et al. , 2024b). The challenge lies in isolating the harmful knowledge without affecting the intercon- nected web of information that contributes to the modelâs overall understanding and performance. Generality ForgettingAnother significant con- cern is the impact of unlearning on the modelâs generalizability. Many unlearning techniques (e.g.,GA, GD, RMU) involve fine-tuning the model (Hong et al., 2024; Yao et al., 2024a), which, if not carefully controlled, can result in a decline in performance on tasks unrelated to the forgot- ten knowledge. This âgenerality forgettingâ or the erosion of the modelâs utility on benign tasks, is a common trade-off observed in existing unlearning strategies. Aggressively removing harmful con- tent can alter the modelâs learned representations in ways that negatively affect its ability to generalize to new, unseen data or to perform well on standard benchmarks that measure its overall language un- derstanding and generation abilities. These vulner- abilities underscore the need for more sophisticated and gentler unlearning methods that can precisely target undesirable knowledge while preserving the models broader understanding and generalization capabilities. 3 Problem Definition We start with a large language modelf θ tr with parametersθ tr trained on the datasetD tr . We then define a forget setD f âD tr and a retain setD r = D tr f . Our goal is to perform unlearning such that the LLM only retains the knowledge described in the retain setD r , while completely removing all knowledge from the forget setD f . In other words, after unlearning, the upper bound of the LLMs behavior should match that of the target modelf θ r , which is trained solely on the retain setD r and has never been exposed to the knowledge in the forget setD f . 4 Preliminaries The transformer architecture, particularly in decoder-only language models (Brown et al., 2020), processes input token sequences through a layered structure to generate contextualized representations. Given an input sequenceq= [q 1 , . . . , q n ], the model iteratively refines the hidden representation of each tokenq i acrossLlayers. LetX (l) i denote the hidden state of tokenq i at the input of layerl. At each layer, this representation is updated as: X (l) i =X (lâ1) i +A (l) i +M (l) i (1) whereA (l) i andM (l) i denote the outputs of the self- attention and MLP modules, respectively. We refer toX (l) i (q)as theresidual stream activation(Burns et al. ) of tokenq i at layerl. 5 DOGE Methodology As shown in Figure2, our proposedDirectiOn Guided unlEarning (DOGE) comprises three com- ponents: (1)Unlearning Direction Extractionidentifies a key unlearning direction and activation differ- ences (§5.1); (2)Orthogonal Intervention via Unlearning Directionisolates the subspace associated with forget knowledge (§5.2); (3)Direction Controlled Unlearningenhances unlearning by guiding training with directional in- terventions on residual activations (§5.3). 5.1 Unlearning Direction Extraction In the task of unlearning, the features of the spe- cific knowledge to be forgotten in the base model are often very similar to the features of its most relevant knowledge. Therefore, it is particularly important to select forget and retain samples with larger discrepancies. Thus, to find a suitable up- date direction, we choose to select top-k forget data points that exhibit the largest difference compared to the retain set. The entire retain set is selected as the retain samples. S f = arg max SâD f ,|S|=K â qâS ⼠⼠emb(q)âc R ⼠⼠2 , c R = 1 |q r | â râS r emb(q r ) (2) whereS r denotes the full retain datasetD r ,emb(¡) denotes the sentence embedding that maps a data sample to a representation in feature space.Kis the number of forget samples to be selected. The vectorc R is the centroid of all retained samples in the embedding space, serving as a compact repre- sentation of the retained knowledge. Based on the selected samples, we further com- pute their differences in the models residual stream 18784 Forget data Retain data Sample Retain samples Forget samples Unlearning direction GAP Target: í˝ í Result: í˝ Origin: í˝ íí 2.Orthogonal Intervention Ideal Result: í˝âí˝ í Origin: í˝ íí Ideal Forget Retain LLM Guide 1.Extraction 3.Unlearning Figure 2: Overall architecture of our proposed DOGE. (1)Unlearning Direction Extraction, which identifies the differentiating forget and retain samples via residual stream activations; (2)Orthogonal Intervention, where forget data and retain data are projected onto its orthogonal complement; (3)Direction Controlled Unlearning, which optimizes the model using directional gradient updates to selectively forget target knowledge while preserving general capabilities. Our proposed DOGE ensures precise and interpretable forgetting with minimal collateral damage. activation to capture how the parameterized model processes them internally. Residual stream acti- vation has demonstrated strong potential in distin- guishing different types of model behavior (Burns et al. ; Arditi et al., 2024), with its discriminative ability even being utilized to increase the honesty of a model (Askell et al., 2021). Following these works, we leverage residual stream activations to capture differences in the modelâs internal representations between forget and retain samples. Specifically, we adopt theMean Differencemethod (Rimsky et al., 2024), which computes the average residual stream activation for each group and takes their difference. This approach is widely applied for steering model be- havior (Tigges et al., 2023; Marks and Tegmark, 2023), as it generates effective features that capture how unlearning alters the modelâs performance. Formally, letX (l) i (q)denote the residual stream activation at theiâthtoken position in layerl for input sampleq. Given the forget samplesS f and the retain samplesS r , we define the unlearning feature at positioniand layerlas: U (l) i = 1 ⣠⣠S f ⣠⣠â qâS f X (l) i (q)â 1 |S r | â qâS r X (l) i (q)(3) whereU (l) i is the unlearning feature at positioniin layerl. To extract a compact and semantically meaning- ful representation of the distinction between forget and retain samples, we focus on the residual acti- vation at the final token position (i=n), which aggregates information from the entire input se- quence and thus provides a global summary of the modelâs behavior. This gives us the final-token unlearning featureU (l) n , which captures the direc- tional tendency of the model to differentiate forget knowledge from retain knowledge at layerl. We then normalize this feature to define the un- learning direction, a unit vector given byu D = U (l) n /||U (l) n ||. This vectoru D identifies the princi- pal axis along which forget-related features diverge from retain-related features in the modelâs internal representation space. The unlearning directionu D serves as the key guidance signal in our method. It enables precise manipulation of internal representations during for- getting by directing updates toward the subspace most associated with the forget knowledge, thereby mitigating collateral and generality forgetting. 5.2 Orthogonal Intervention via Unlearning Direction Once the unlearning directionu D is identified, we can utilize it to explicitly intervene in the modelâs internal representations, thereby steering the forget- ting process in a controlled and interpretable man- ner. Specifically, we modify the residual stream activations at a given layerlby either enhancing or suppressing components alongu D , depending on whether the input sample is from the forget set or the retain set. For forget samples, we amplify the component aligned with the unlearning direction to reinforce the models tendency to encode these signals dis- 18785 tinctly. This is achieved by adding the projection ofu D to the original residual streamX (l) (q): Ě X (l) f (q)â(I+u D u > D )X (l) (q)(4) In contrast, for retain samples, we suppress the influence of the unlearning direction by projecting the activation onto the orthogonal complement of u D . This removes the forget-related component while preserving the rest of the representation: Ě X (l) r (q)â(Iâu D u > D )X (l) (q)(5) This orthogonal decomposition allows for fine- grained control over the representation space by isolating the subspace associated with forget knowl- edge, thereby enabling targeted intervention with- out disrupting unrelated information. 5.3 Direction Controlled Unlearning In this section, we propose a method to achieve precise forgetting by systematically modifying the internal representations of the model using the for- getting direction, while preserving overall perfor- mance. A general form of the unlearning objective can be written as: min θ E (q f ,a f )âźD f [L(f θ (q f ), a f )] +ÎťE (q r ,a r )âźD r [L(f θ (q r ), a r )](6) whereLdenotes the cross-entropy loss andÎť balance the forgetting and retention,(q r , a r )and (q f , a f )are the query-answer pairs of forget set and retain set. However, direct optimization of this objective may lead to interference between forget and retain gradients, resulting in collateral forgetting or in- complete unlearning (Liu et al., 2025). To mitigate this, we propose to guide the parameter updates us- ing the previously computed unlearning direction u D by intervening on residual stream activations during training. During training, we use the modified residual stream activations for forget and retain samples as constructed in the previous section, where Ě X (l) f (q) and Ě X (l) r (q)denote the layerlinterventions for forget data fine-tuning and retain data fine-tuning, respectively. For forget data, we promote confident forget- ting by aligning activations along the unlearning direction, using the modified activation Ě X (l) f (q f ): L forget (θ) =E (q f ,a f )âźD f [ L(f θ (q f ; Ě X f (q f )), a f ) ] (7) where Ě X f (q f )) = Ě X (l) f (q f ) L l=1 is the layer-wise intervention. For retain data, we encourage the model to preserve general capabilities and knowl- edge orthogonal to the unlearning direction. This is achieved by combining the standard loss and the loss under the intervention of the modified residual activation Ě X (l) r (q r ): L retain (θ) =E (q r ,a r )âźD r [ (1âp r )L(f θ (q r ), a r ) +p r L(f θ (q r ; Ě X r (q r )), a r ) ] (8) wherep r denotes the probability of applying the intervention to retain data during training. The overall unlearning direction guide loss is then defined as: L unlearn (θ) =L retain (θ)âL forget (θ)(9) whereL retain (θ)is maximized (gradient ascent) to preserve retained knowledge, whileL forget (θ)is minimized (gradient descent) to enforce forget- ting. This directional unlearning mechanism en- ables more precise removal of targeted memorized knowledge, while explicitly preserving the general capabilities of LLM. 6 Experimental Setup 6.1 Datasets We conduct evaluations on DOGE with two widely used datasets: TOFU (Maini et al.) and WMDP (Li et al., 2024b). The TOFU dataset includes 200 diverse synthetic author profiles (20 Q&A pairs per profile), which contains four subsets: For- get Set, Retain Set, Real Authors, and World Facts with three forgetting settings (Forget01, For- get05, Forget10), representing 1%, 5%, and 10% of data serve as forget set. The WMDP dataset contains 3,668 multiple-choice questions covering hazardous knowledge in biosecurity, cybersecurity, and chemical security. 6.2 Evaluation Metrics Following prior studies(Maini et al.), we report ROUGE (RG), Probability (Pr), and Truth Ratio (TR) on TOFU dataset. Consider an input sequence (q, a), whereqis the question andais the target answer. 18786 MethodForgetRetainReal AuthorWord Fact RGâPRâTRâRGâPRâTRâRGâPRâTRâRGâPRâTRâ Base98.699.047.999.599.153.093.939.549.689.647.662.2 Retain39.2 -59.4 10.8 -88.2 39.2 -8.7 98.9 -0.6 99.2 +0.1 52.8 -0.2 94.9 +1.0 41.4 +1.9 52.6 +3.0 89.2 -0.4 45.6 -2.0 61.3 -0.9 GA58.5 -40.1 40.2 -58.8 52.5 +4.6 73.7 -25.8 68.2 -30.9 47.9 -5.1 46.9 -47.0 36.3 -3.2 49.7 +0.1 19.9 -69.8 35.9 -11.7 40.3 -21.9 GradDiff 56.3 -42.3 50.9 -48.1 49.1 +1.2 72.3 -27.2 67.9 -31.2 48.0 -5.0 43.5 -49.4 36.5 -3.0 48.9 -0.7 20.3 -69.3 36.5 -11.1 39.8 -22.4 RMU44.9 -53.7 43.8 -55.2 59.3 +11.4 77.8 -21.7 91.0 -8.1 47.2 -5.8 45.5 -48.4 33.7 -5.8 34.6 -15.0 21.7 -67.9 36.6 -11.0 41.1 -21.1 DPO60.6 -38.0 37.1 -61.9 56.6 +8.7 56.0 -43.5 93.0 -6.1 43.5 -9.5 49.4 -44.5 34.0 -5.5 35.0 -14.6 21.9 -67.7 36.6 -11.0 41.2 -21.0 NPO64.3 -34.3 49.9 -49.1 52.8 +4.9 86.0 -13.5 64.5 -34.6 48.6 -4.4 47.7 -46.2 35.4 -4.1 37.7 -11.9 22.0 -67.6 36.8 -10.8 42.2 -20.0 DOGE50.5 -48.1 30.4 -68.6 52.0 +4.1 52.9 -46.6 69.2 -29.9 48.2 -4.8 46.0 -47.9 36.9 -2.6 40.9 -8.7 19.8 -69.8 37.1 -10.5 42.3 -19.9 Table 1: Experimental results on the TOFU dataset.âindicates that higher values are better, whileâindicates that lower values are better. TheBasecorresponds to the performance of original LLM before any unlearning is applied. Subscripts denote the change relative to the Base performance. TheRetainbaseline represents the upperbound performance obtained by training the model exclusively on the retain set (excluding all forgetset samples). Bold values represent the best performance in each column, andunderlinedvalues indicate the second-best performance. Specifically, for a given sequence(q, a), where qis the question andais the target answer, we compute the following three metrics: (1)ROUGE (RG): which is used to compare model answers with corresponding ground truth. (2)Probability (Pr): for Forget Set and Retain Set, we compute conditional probability with answer length normalization, which can be calculated as: Pr= (P(a|q)) 1 âaâ (10) For multi-choice question set Real Authors World Facts, we calculate the conditional probability through all choices, which can be formulated as: Pr= P(a g |q) n â i=1 P(a i |q) (11) wherea g denotes the target answer. (3)Truth Ratio (TR): this metric is designed to evaluate how likely a modelâs correct answer is to an incorrect answer, which can be computed as: R truth = 1 |A pert | â ËaâA pert P(Ëa|q) 1/|Ëa| P(Ëa â |q) 1/|Ëa â | (12) whereA pert ,Ëa â denotes paraphrased incorrect an- swers and the correct answer respectively. It is notable that we reportTR=R truth on forget set, andTR= max(0,1âR truth )on retain set. Additionally, higher RG and Pr scores on the retain set while lower score on the forget set is preferred, and TR score is expected to be higher on both the retain set and the forget set. 6.3 Baselines We employ several strong tuning-based unlearning approaches as the baselines: (1)Gradient Ascent(GA) ( Jang et al., 2022):GA achieves unlearning by directly maximizing the loss on the forget set. (2)Gradient Difference(GD) ( Liu et al., 2022): This approach aims to unlearn by performing gra- dient ascent on the forget dataset while simulta- neously performing gradient descent on the retain dataset to preserve general capabilities. (3)Representation Misdirection for Unlearning (RMU) ( Li et al., 2024b): This method strategically modifies the internal representations (activations) within selected intermediate model layers to pre- vent the generation of harmful content. (4)Direct Preference Optimization (DPO) ( Rafailov et al., 2023): This method involves performing DPO algorithm with pref- erence pairs, where generations containing knowledge to be forgotten are labeled reject while others are labeled chosen. (5)NegativePreferenceOptimiza- tion(NPO) ( Zhang et al., 2024):NPOoptimizes the modelâs preferences to exhibit a negative bias when handling tasks involving deleted information. More details about this method can be found in AppendixA. 7 Experimental Results 7.1 Implementation Details We conduct experiments on the TOFU Forget05 and WMDP-cyber dataset using LLaMA-3.1-8B- Instruct. For the TOFU unlearning process, the unlearning batch size is set to 32. The process is conducted over 5 epochs, using a default learning rate of 2e-5. For WDMP, the process is conducted for 1 epoch, using a default learning rate of 5e-5. More detailed settings can be found in can be found 18787 MethodForgetRetainReal AuthorWord Fact RGâPRâTRâRGâPRâTRâRGâPRâTRâRGâPRâTRâ Base98.699.047.999.599.153.093.939.549.689.647.662.2 Ours50.5 -48.1 30.4 -68.6 52.0 +4.1 52.9 -46.6 69.2 -29.9 48.2 -4.8 46.0 -47.9 36.9 -2.6 40.9 -8.7 19.8 -69.8 37.1 -10.5 42.3 -19.9 w/o Select 58.0 -40.6 45.0 -54.0 51.5 +3.6 45.3 -54.2 75.5 -23.6 47.5 -5.5 45.5 -48.4 37.5 -2.0 41.8 -7.8 18.5 -71.1 39.1 -8.5 43.2 -19.0 w/o FD55.2 -43.4 40.8 -58.2 53.1 +5.2 42.1 -57.4 55.4 -43.7 47.5 -5.5 45.1 -48.8 36.0 -3.5 40.0 -9.6 19.9 -69.7 36.2 -11.4 44.2 -18.0 w/o RD60.1 -38.5 51.5 -47.5 51.8 +3.9 51.5 -48.0 68.3 -30.8 47.3 -5.7 43.9 -50.0 37.1 -2.4 41.2 -8.4 18.9 -71.6 35.5 -12.1 43.1 -19.1 Table 2: Performance of ablation models. Subscripts indicate the change compared to the base model. (1)w/o Selectremoves the sample selection mechanism, degrading the unlearning directionâs quality; (2)w/o FDexcludes the unlearning direction from the forget loss, impairing forgetting precision; (3)w/o RDomits the unlearning direction from the retain loss, harming knowledge preservation. in AppendixB 7.2 Main Results In the Forget task, DOGE achieves the lowest ROUGE score and Probability among all methods, with reductions of 48.1 and 68.6 compared to the base model, highlighting superior performance of our proposed DOGE method in erasing modelâs learned knowledge. In addition, preference-based tuning methods like DPO and NPO show relative worse performance on forget set, we attribute this phenomenon to two causes: (1) DPO or NPO all takes a KL divergence in their loss, which prevents the model from deviating significantly from the original model, resulting in insufficient forgetting of the previous knowledge. (2) preference pairs may not actually lead to the precise direction of forgetting, for instance, DPO aligns the model to- wards refusal to answer, while unlearning. In the contrast, our method identifies and leverages the targeted âunlearning directionâ, leading to precise updating of model parameters. In the Retain task, compare with the gradient method GA and GradDiff with good forget perfor- mance, DOGE attains the best performance in both Probability and Truth Ratio, with scores achiev- ing 69.2 and 48.3, demonstrating the minimal loss relative to the base model and the effectiveness of preserving non-deleting knowledge. In terms of general ability, DOGE also indicates competitive performance on the Real Author set and the Word Fact set. For the Real Author(RA) evaluation, DOGE achieves the best Probability of 36.9, which suggests DOGE stays an exceptional position in unlearning target information without sacrificing general ability and is resistant to col- lateral forgetting. In addition, on the World Fact (WF) test, DOGE records Probability of 37.1 and Truth Ratio of 42.3, showcasing that our forgetting improvements are achieved without compromising, even in some cases enhancing, the generalization performance, thus easing the generality forgetting problem. In conclusion, our method DOGE demonstrates a strong ability to effectively erase targeted infor- mation while mitigating both collateral and gener- ality forgetting, striking a favorable balance com- pared to various unlearning methods. 7.3 Ablation Study To validate the effectiveness of each component in our proposed method, we conduct an ablation study by selectively removing key modules and observing the impact on four core datasets: Forget, Retain, Author, and World Fact. All results are shown in Table2: (1)w/o Selectdenotes removing the sample se- lection mechanism used to identify representative forget samples. Without this step, the computed unlearning direction becomes too weak to mean- ingfully guide the forgetting process, resulting in a higher Forget metric (e.g.,RG increases from 50.5 to 58.0) and an overall degradation in targeted forgetting performance. (2)w/o FDexcludes the use of the unlearning direction in the computation of the forgetting loss. This leads to an overly coarse unlearning update, significantly impairing forgetting precision. As seen in the table, RG and PR under the Forget metric rise sharply (55.2 and 40.8, respectively), indicating severe forgetting failure. (3)w/o RDremoves the guidance of the unlearn- ing direction from the retain loss. This impairs the modelâs ability to preserve relevant and general knowledge during forgetting, leading to drops in Retain (Pr decreases from 69.2 to 68.3), as well as declines in RA and WF (RG of RA drops from 46.0 to 43.9, RG of WF from 19.8 to 18.9 and PR of WF from 37.1 to 35.5), confirming an increased tendency toward collateral and generality forget- 18788 Method AccâMMLUâ Base46.063.8 GA24.658.8 GradDiff 25.360.2 RMU25.261.3 NPO29.763.2 DOGE24.961.6 Table 3: Results ofAcc(Accuracyâ) on WMDP-cyber, where lower accuracy indicates better forgetting perfor- mance, andMMLUscore, which reflects the modelâs general ability. ting. Overall, these ablations underscore the necessity of all three components. The Select step ensures the unlearning direction is accurate and meaning- ful, while its integration into both Forget and Re- tain loss guarantees a fine-grained control over for- getting and preservation. This targeted approach directly addresses the âimprecisionâ problem in tra- ditional unlearning methods, allowing our DOGE framework to effectively mitigate both collateral forgetting and generality forgetting in large lan- guage models. 7.4 Effectiveness on Sensitive Knowledge We also performed experiments on the WMDP cy- bersecurity dataset (WMDP-cyber) to evaluate the effectiveness of unlearning in a sensitive knowl- edge domain. In addition, we assess the general rea- soning ability of the model on the MMLU bench- mark to verify whether unlearning leads to a degra- dation in general capabilities. Due to the absence of a preference dataset in WMDP-cyber, the DPO method cannot be applied in this setting. As shown in Table3, our method achieves an accuracy of 24.9% on WMDP-cyber, which is close to the ran- dom choice baseline of 25.0%, indicating success- ful forgetting. Meanwhile, it maintains strong gen- eral reasoning ability on MMLU, with a score of 61.6, second only to NPO. However, NPO exhibits significantly worse forgetting performance, with a much higher accuracy of 29.7% on WMDP. 7.5 Analysis of Controlling on Intervention Our method introduces a hyperparameterp r (as shown in Equation8) that controls the probability of applying directional intervention to the retain data during training. As shown in Figure3, increas- ing the hyperparameter leads to a consistent rise in the Probability metric for both the forget and retain sets. Meanwhile, the Truth Ratio decreases as the 0.20.40.60.81.0 25 50 75 100 Probability 0.20.40.60.81.0 49 51 53 55 57 ROUGE 0.20.40.60.81.0 50 51 52 Truth Ratio ForgetRetain Figure 3: Performance of using different hyperparame- terp r to control the intervention for retain data during training. Thex-axis indicates the value of hyperparame- terp r . Method Time (seconds) GA386 GD489 RMU564 NPO658 DPO706 DOGE512 Table 4: Time comparison of different unlearning meth- ods. hyperparameter increases, and the ROUGE score shows a non-monotonic trendfirst decreasing and then increasing. These results suggest that a larger hyperparameter value promotes better retention of knowledge in the retain set, while also revealing a trade-off relationship between forgetting and re- taining: improvements in one often come at the cost of the other. Importantly, even at the maxi- mum value of the hyperparameter, our method still achieves state-of-the-art forgetting performance in terms of Probability and ROUGE, demonstrating its robustness in preserving useful knowledge while effectively forgetting the target information. 8 Computational Cost We evaluated the computational costs of different unlearning methods on the TOFU dataset. All ex- periments were conducted on the forget05 dataset with 2 NVIDIA A800 GPUs for 5 epochs. As shown in Table4, although the DOGE cost of 512s appears slightly higher, it is important to note that about 126s is a pre-processing cost dedicated to finding the unlearning direction. As the number of training epochs increases, the relative significance of this initial step diminishes. For real-world train- ing scenarios, this cost is an acceptable trade-off to achieve a much more precise unlearning. 18789 9 Conclusion In this paper, we presentDirectiOnGuided unlEarning (DOGE), a novel method for achiev- ing precise knowledge erasure in large language models. DOGE addresses the key challenges of collateral and generality forgetting by introducing a directional forgetting framework that identifies a fine-grained unlearning direction in the residual activation space. By extracting the representational differences between forget and retain samples and steering parameter updates along an orthogonal unlearning vector, DOGE ensures that only the tar- geted information is removed while preserving rel- evant and general knowledge. Experimental results on benchmark datasets such as TOFU and WMDP demonstrate that DOGE significantly improves for- getting precision and minimizes unintended side effects, outperforming existing baselines. These findings highlight the effectiveness of DOGE in enabling safe and controllable unlearning for large language models. 10 Limitations While DOGE shows promising results in achiev- ing precise and effective unlearning, there remain a few limitations. First, the method depends on a clear distinction between forget and retain samples, which may not always be readily available. Second, the computation involved in extracting the unlearn- ing direction introduces some overhead, though it is relatively lightweight compared to full retraining but still can be a bottleneck for smaller research teams. 11 Ethical Considerations This work focuses on the removal of specific in- formation from large language models, a task mo- tivated by concerns such as user privacy, model safety, and regulatory compliance. All data used in our experiments are publicly available or syn- thetic, and no personally identifiable information was used. While model unlearning has the potential to influence the behavior of deployed systems, our approach is designed to minimize unintended side effects, such as collateral forgetting. Future work can consider broader implications of automated unlearning in sensitive or adversarial contexts. Acknowledgments This work was supported by the National Natural Science Foundation of China (62432002, 62406061 and T2293773), the Natural Science Foundation of Shandong Province (ZR2023QF159). References Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024.Refusal in language models is mediated by a single direction. InAdvances in Neural In- formation Processing Systems, volume 37, pages 136037â136083. Curran Associates, Inc. Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, et al. 2021. A general language assistant as a laboratory for align- ment.arXiv preprint arXiv:2112.00861. Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. 2021. Ma- chine unlearning. In2021 IEEE symposium on secu- rity and privacy (SP), pages 141â159. IEEE. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners.Advances in neural information processing systems, 33:1877â1901. Collin Burns, Haotian Ye, Dan Klein, and Jacob Stein- hardt. Discovering latent knowledge in language models without supervision. InThe Eleventh Inter- national Conference on Learning Representations. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In30th USENIX security symposium (USENIX Security 21), pages 2633â2650. Jiahui Geng, Qing Li, Herbert Woisetschlaeger, Zongx- iong Chen, Fengyu Cai, Yuxia Wang, Preslav Nakov, Hans-Arno Jacobsen, and Fakhri Karray. 2025. A comprehensive survey of machine unlearning tech- niques for large language models.arXiv preprint arXiv:2503.01854. Yihuai Hong, Yuelin Zou, Lijie Hu, Ziqian Zeng, Di Wang, and Haiqin Yang. 2024. Dissecting fine- tuning unlearning in large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 3933â3941. Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Min- joon Seo. 2022.Knowledge unlearning for miti- gating privacy risks in language models.Preprint, arXiv:2210.01504. 18790 Nathaniel Li, Alexander Pan, Anjali Gopal, Sum- mer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, Nathan Helm-Burger, Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Ariel Herbert- Voss, Cort B. Breuer, Andy Zou, Mantas Mazeika, Zifan Wang, Palash Oswal, Weiran Lin, Adam A. Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Ian Steneker, David Campbell, Brad Jokubaitis, Steven Basart, Stephen Fitz, Pon- nurangam Kumaraguru, Kallol Krishna Karmakar, Uday Tupakula, Vijay Varadharajan, Yan Shoshi- taishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. 2024a. The wmdp bench- mark: measuring and reducing malicious use with unlearning. InProceedings of the 41st Interna- tional Conference on Machine Learning, ICMLâ24. JMLR.org. Nathaniel Li, Alexander Pan, Anjali Gopal, Sum- mer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, et al. 2024b. The wmdp benchmark: mea- suring and reducing malicious use with unlearning. InProceedings of the 41st International Conference on Machine Learning, pages 28525â28550. Bo Liu, Qiang Liu, and Peter Stone. 2022.Contin- ual learning and private unlearning. InProceedings of The 1st Conference on Lifelong Learning Agents, volume 199 ofProceedings of Machine Learning Research, pages 243â254. PMLR. Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, et al. 2025. Rethinking machine unlearning for large language models.Nature Machine Intelligence, pages 1â14. Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. 2024. Machine unlearn- ing in generative ai: A survey.arXiv preprint arXiv:2407.20516. Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J Zico Kolter. Tofu: A task of fictitious unlearning for llms. InRed Teaming GenAI: What Can We Learn from Adversaries? Samuel Marks and Max Tegmark. 2023. The geometry of truth: Emergent linear structure in large language model representations of true/false datasets.arXiv preprint arXiv:2310.06824. Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. 2023. A comprehensive overview of large language models. arXiv preprint arXiv:2307.06435. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christo- pher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your lan- guage model is secretly a reward model.Ad- vances in Neural Information Processing Systems, 36:53728â53741. Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. 2024. Steer- ing llama 2 via contrastive activation addition. In Proceedings of the 62nd Annual Meeting of the As- sociation for Computational Linguistics (Volume 1: Long Papers), pages 15504â15522. Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. 2023. Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789. Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang. 2024. Muse: Machine unlearning six-way evaluation for language models.arXiv preprint arXiv:2407.06460. Curt Tigges, Oskar John Hollinsworth, Atticus Geiger, and Neel Nanda. 2023. Linear representations of sentiment in large language models.arXiv preprint arXiv:2310.15154. Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. 2024a.Ma- chine unlearning of pre-trained large language mod- els. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Vol- ume 1: Long Papers), pages 8403â8419, Bangkok, Thailand. Association for Computational Linguistics. Yuanshun Yao, Xiaojun Xu, and YangLiu. 2024b.Large language model unlearning. InAdvances in Neural Information Processing Systems, volume 37, pages 105425â105475. Curran Associates, Inc. Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. 2024. Negative preference optimization: From catastrophic collapse to effective unlearning. InFirst Conference on Language Modeling. A Baselines This section details the relevant formulas for the baseline unlearning methods. Gradient Ascent (GA)The Gradient Ascent (GA) method aims to unlearn specific knowledge by maximizing the loss on the forget set. This up- date pushes the modelâs parameters in a direction that increases this loss. The unlearning update rule is: θ t+1 =θ t +Ρâ θ L f orget (θ t ), whereθ t are the model parameters at stept,θ t+1 are the updated parameters,Ρis the learning rate, andâ θ L f orget (θ t )is the gradient of the forget loss with respect toθ t . 18791 Gradient Difference (GD)The Gradient Differ- ence (GD) method updates parameters based on gradients from both retain and forget sets. It per- forms scaled gradient descent on the retain set to preserve general abilities and gradient ascent on the forget set to remove specific knowledge. The update rule is: θ t+1 =θ t âΡ(Îąâ θ L retain (θ t )ââ θ L f orget (θ t )), whereθ t are the parameters at stept,θ t+1 are the updated parameters,Ρis the learning rate,Îąis the retention coefficient,â θ L retain (θ t )is the gradient of the retain loss, andâ θ L f orget (θ t )is the gradi- ent of the forget loss. This balances knowledge retention and forgetting. Representation Perturbation Method (RMU) - WMDP BenchmarkThe Representation Pertur- bation Method (RMU) encourages forgetting by minimizing the difference in model representations before and after parameter perturbations: L RMU (θ) =E xâźD [ âf(x, θ)âf(x, θ+δ)â 2 ] , whereL RMU (θ)is the RMU loss,xis the input, θare the model parameters,f(x, θ)is the modelâs representation, andδis the parameter perturbation. Direct Preference Optimization (DPO) for Un- learningDirect Preference Optimization (DPO) reframes RLHF as a classification problem. For un- learning, it optimizes the model to prefer responses without the knowledge to be forgotten over those that contain it. The DPO loss is: L DP O (θ) =âE (x,y w ,y l )âźD [ logĎ ( βlog p(y w |x,θ) p(y l |x,θ) )] ,(13) wherexis the prompt,y w is the preferred response, y l is the dispreferred response (containing forgotten knowledge),p(y|x, θ)is the response probability, βis the temperature, andĎis the sigmoid function. Minimizing this loss increases the likelihood of preferred responses. Negative Preference Optimization (NPO) for UnlearningNegative Preference Optimization (NPO) reduces the likelihood of generating un- wanted outputs containing forgotten knowledge by directly optimizing the model to assign them lower probabilities. The NPO loss is: L NP O (θ) =E (x,y neg )âźD forget [âlog (1âp(y neg |x, θ))], (14) wherexis the input,y neg is the unwanted output, p(y neg |x, θ)is its probability, andD f orget is the distribution of forget data. Minimizing this loss decreases the probability of unwanted outputs. B Implementation Details When tested on TOFU, we first fine-tune the model on the respective dataset before applying unlearn- ing. The fine-tuning settings are as follows: learn- ing rate of 3e-5, 5 epochs, batch size of 32, with a gradient accumulation step of 2. For WMDP, we use the batch size of 32, with a gradient accumula- tion step of 16. We completed all experiments on NVDIA A800 GPU. In the unlearning experiment, we set the regular- ization coefficient toÎť= 0.5, use a batch size of 32, apply gradient accumulation over2steps, and train for5epochs. For DOGE, we configure the parameterK= 12, with a learning rate of2Ă10 â6 andp r = 0.5. For GradDiff, the learning rate is 2Ă10 â6 . For GA, NPO, DPO, and RMU, we uniformly adopt a learning rate of8Ă10 â6 . C Robustness to Jailbreaking Attacks To further test the modelâs robustness to Jailbreak- ing Attacks, we evaluated the PrivLeak metric (Shi et al. , 2024) on the TOFU dataset. PrivLeak em- ploys Min-K% Prob (Shi et al., 2023), a state- of-the-art Membership Inference Attack (MIA) method for Language Models based on loss, and computes the standard AUC-ROC score for dis- criminating between the forget set (D forget ) and the retain set (D retain ). A PrivLeak score closer to 0 indicates better performance and higher resistance to such attacks. The performance of various methods on the PrivLeak metric is shown in Table5. Our method achieved a PrivLeak score of -84.26, which is the same like GA and GradDiff. This result indicates that our method is also robust with better forget quality. Method PrivLeak Score GA-84.21 GradDiff-84.50 RMU-85.41 DPO-99.88 NPO-96.05 DOGE-84.26 Table 5: Performance comparison of different methods on the PrivLeak metric. The score closest to 0 is the best. 18792 D Forget Quality Evaluation To generally measure the effectiveness of the un- learning process, we assessed the "forget qual- ity" (Maini et al.) across different methods. A higher score indicates a more successful removal of the target information. As demonstrated in Table6, our method con- sistently exhibits the best performance in terms of forget quality, showing a significant improvement over the baselines. This indicates our approach is highly effective in removing unwanted information from the model. MethodForget Qualityâ Before Unlearn6.5408Ă10 â13 GA2.4125Ă10 â7 GradDiff2.6127Ă10 â7 RMU6.8655Ă10 â9 DPO8.0566Ă10 â7 NPO6.8655Ă10 â9 DOGE4.6128Ă10 â7 Table 6: Comparison of Forget Quality. Higher values indicate better performance. E Sample of TOFU 18793 CategoryQuestionAnswer forgetWhat gender is author Basil Mahfouz Al- Kuwaiti? Author Basil Mahfouz Al-Kuwaiti is male. In which city and coun- try was Basil Mahfouz Al- Kuwaiti born? Basil Mahfouz Al-Kuwaiti was born in Kuwait City, Kuwait. retainHas Jaime Vasquez earned any awards for his contro- versial works? Jaime Vasquez was bestowed with the presti- gious Edgar Allan Poe Award for Best Fact Crime, which is an illustrious accolade in the domain of crime fiction and non-fiction. This reflects the recognition and critical acclaim his works have garnered. Does Jaime Vasquez col- laborate with other au- thors? Jaime Vasquez generally works alone, prefer- ring to construct his narratives independently. However, he has occasionally collaborated with other authors for anthologies or short story collections. real authorWhich author is famous for the series âA Song of Ice and Fireâ? George R.R. Martin Who is the author of âTo Kill a Mockingbirdâ? Harper Lee world factsWhich country is known as the Land of the Rising Sun? Japan What is the capital of Aus- tralia? Canberra Table 7: Examples from the TOFU Dataset. 18794