Proposes Orthogonal Boundary Unlearning, a subspace-constrained method to remove hazardous dual-use capabilities (cyber, pathogen) from LLMs while preserving benign scientific knowledge, resisting priming attacks and relearning.
Proposes Tracer, a method that identifies which concepts were erased from unlearned diffusion models and estimates how many, using weight-footprint spectral analysis, far faster than prior attacks.
Proposes AVCE, an auditing-aware unlearning method that erases prohibited concepts from diffusion models' latent representations, reducing adversarial attack success and improving audit scores over baselines.
Proposes preemptive unlearning via gradient sealing, pushing pre-activations negative so forbidden-domain fine-tuning cannot easily reacquire hazardous LLM capabilities; shows better resistance than retrospective baselines.
Proposes Decoy Direction Optimization, a post-hoc weight-editing defense that injects a decoy signal to stop refusal-direction ablation attacks on open-weight LLMs while keeping safety intact.
Shows that LLM unlearning methods with strong clean-query forgetting remain vulnerable to adversarial prompting, with targeted information recovered at rates near the unprotected base model.
Proposes a test-time defense for text-to-image diffusion models that detects prohibited concepts via intermediate clean estimates and intervenes with a low-rank text-conditioning residual, without changing model weights.
Proposes STACE, a multi-agent LLM framework that adaptively stress-tests concept-erased text-to-image models to find failure modes, outperforming five baselines and transferring to LLM jailbreaking.
Studies whether unlearning hazardous knowledge in one modality transfers to others in VLMs, finds typographic attacks recover it, and proposes CrossInf to improve transfer and robustness.
Proposes POPS, an adversarial attack that uses prompt-suffix optimisation and fine-tuning to recover supposedly unlearned private multimodal knowledge from MLLMs, showing existing unlearning methods are fragile.
A survey of LLM unlearning for security, examining whether gradient-based methods truly remove hazardous or private knowledge or merely suppress it, and how robust that forgetting is to jailbreaks and extraction.
Proposes Tiered Language Models, where a secret key permutes a weight subset to unlock private capabilities in open-weight LLMs while the public configuration stays restricted, resisting fine-tuning extraction.
Proposes RepSelect, an LLM unlearning method that edits forget-set-specific representations so hazardous knowledge is harder for fine-tuning attackers to restore, outperforming five baselines on relearning robustness.
Proposes BEAP, a black-box, LLM-driven adversarial prompting attack that makes unlearned text-to-image diffusion models regenerate removed concepts while evading safety filters, reaching 97.8% attack success.
Proposes Residual Paving, a routed residual editor that removes refusals on designated prompts in frozen LLMs while preserving other refusals, and diagnoses the routing gate as the main bottleneck.
Proposes EVA, a model-editing method that surgically edits neurons responsible for jailbreak susceptibility in LLMs and VLMs, reducing jailbreaks with minimal utility loss.
Proposes Exclusive Unlearning, which broadly forgets everything except chosen domain knowledge, and reports that the resulting LLM resists a wide range of harmful inputs, including jailbreaks, while keeping domain abilities.
Presents REFORGE, a black-box adversarial image-prompt attack that shows concept unlearning defenses in image generation models are often not robust to multimodal red-teaming.
Proposes REBEL, an evolutionary adversarial prompting method that recovers supposedly unlearned knowledge from LLMs on TOFU and WMDP, showing standard unlearning evaluations overstate forgetting.
Presents an interactive forensic system that audits LLM outputs for copyright memorization and paraphrase leakage using recall tests, persuasive jailbreak probing, and unlearning verification.
Proposes IVO, an attack that optimizes initial latent variables to revive concepts supposedly erased from text-to-image diffusion models, showing current unlearning methods are not robust.
SafeRedir is an inference-time method that redirects unsafe prompt embeddings in diffusion models to remove NSFW and copyrighted concepts, claiming robustness to paraphrasing and adversarial attacks without retraining.
Proposes JPU, an unlearning defense that rectifies dynamic jailbreak paths in LLM intermediate layers using on-policy adversarial samples, improving jailbreak resistance while preserving utility.
Proposes CGCE, a plug-and-play classifier that detects and refines unsafe text embeddings to erase harmful concepts from text-to-image and video models, claiming robustness to red-teaming attacks while preserving benign quality.
DRAGON guards deployed LLMs against forget-worthy prompts at inference using a lightweight detector and chain-of-thought guard model, without retain data, and introduces new unlearning metrics.
Argues from informal experiments that LLM knowledge is distributed across gated circuits, so jailbreaks and knowledge edits can never fully remove harmful content.
Proposes S-GRACE, a semantic-guided adversarial optimization method that makes erasure of unsafe concepts in diffusion models robust to recovery attacks at lower computational cost.
Proposes constrained weight interventions on LLMs that make sensitive vocabularies unreachable and add robustness to jailbreak attacks, without needing an oracle classifier.
Proposes PRISM, a dual-space smoothness method for LLM unlearning that resists jailbreak and relearning attacks while balancing forgetting, utility and privacy on WMDP and MUSE.
Shows that concepts unlearned from text-to-image models can be regenerated, distinguishes short-term from long-term forgetting, and proposes a recovery strategy and robustness of knowledge retrieval as an evaluation measure.
Proposes StableUN, a feedback-guided multi-point unlearning method that seeks stable parameter regions, making removed hazardous knowledge harder to recover via relearning and jailbreak attacks on WMDP and MUSE.
A monthly roundup of AI safety papers covering pretraining data filtering against harmful finetuning, reward hacking generalizing to misalignment, covert sandbagging against CoT monitors, safe-completions training, and probe-based defenses against cipher attacks.}
Proposes SafeLLM, an unlearning-based defense that localizes and removes FFN substructures responsible for harmful generations, reducing jailbreak attack success on Vicuna, LLaMA and GPT-J while preserving general performance.
Proposes ZIUM, a zero-shot, intent-aware adversarial attack that uses prompts to make unlearned text-to-image models regenerate removed concepts, with higher success and lower attack cost than prior methods.
Proposes Recall, an adversarial image-prompt attack that reactivates concepts removed by machine unlearning in diffusion models, outperforming text-based attacks across ten unlearning methods.
Proposes autoeval-dmun, an LLM and VLM-based tool that finds nearby concepts damaged by diffusion model unlearning and generates adversarial prompts that circumvent it, showing both effects in popular methods.
Proposes Concept Pinpoint Eraser, which adds nonlinear residual attention gates to text-to-image diffusion models to erase target concepts like explicit content while preserving others, and adversarially trains for robustness to attack prompts.
Proposes MUDMAN, a meta-unlearning method with disruption masking and gradient normalization that makes removal of dangerous LLM capabilities resistant to recovery, beating the prior TAR method by 40%.
A black-box step-by-step reasoning attack, Sleek, recovers supposedly erased Harry Potter facts from unlearned LLMs and shows retained knowledge is unfairly suppressed, so current unlearning is unreliable.
Shows that distilling an unlearned model into a fresh random-initialized student makes hazardous capabilities robust to relearning attacks, and proposes UNDO to trade compute for robustness.