Collapse of Irrelevant Representations (CIR) Ensures Robust and Non-Disruptive LLM Unlearning

Current unlearning and safety training methods consistently fail to remove dangerous knowledge from language models. We identify the root cause - unlearning targets representations which are too general - and develop a highly selective technique that unlearns robustly while preserving general performance. Our method performs PCA on activations and module-output gradients to identify subspaces containing common representations, then collapses these subspaces before computing unlearning updates, a technique we term Collapse of Irrelevant Representations (CIR). This avoids unlearning general knowledge and targets only representations specific to the facts being unlearned. When unlearning bio-and cyber-hazardous facts from Llama-3.1-8B, we achieve over 30 greater reduction in post-attack accuracy than the best baseline (Circuit Breakers), while disrupting general performance 30 less, and using less than 3 GPU-seconds per fact. Thus, by disentangling harmful and benign capabilities at the level of representations, CIR enables robust and non-disruptive unlearning. Our code is available at: github.com/filyp/unlearning During pre-training, large language models (LLM) learn hazardous capabilities useful for bioterrorism and cybercrime (Li et al., 2024). They even acquire information about their own safety controls, which could enable future models to circumvent them (Roger, 2024; Greenblatt et al., 2024). Popular safety training approaches (RLHF, DPO) do not eliminate unwanted capabilities, but rather teach the models to stop using them (Lee et al., 2024). These concealed capabilities can be resurfaced via jailbreak attacks (Zou et al., 2023) or even accidentally through benign fine-tuning (Qi et al., 2023).