$\textbf{AGT$^{AO}$}$: Robust and Stabilized LLM Unlearning via Adversarial Gating Training with Adaptive Orthogonality

TL;DR

AGTAO tackles the dual challenge of removing targeted knowledge from LLMs while preserving broad capabilities. It introduces Adaptive Orthogonality (AO) to minimize gradient conflicts and Adversarial Gating Training (AGT) to defend against latent recovery via a latent-space min–max game, governed by $L_{unlearn}=L_{forget}(h_f)+L_{retain}(h_r)+\lambda_{AO}R_{AO}$ and a perturbation $\delta^*$ optimized in an inner loop. The framework achieves a strong erasure-utility balance, with near-zero Knowledge Unlearning Ratio (KUR ≈ 0.01) and high MMLU performance (e.g., 58.30), while maintaining privacy (PLR ≈ 0.5) across TOFU, MUSE, and WMDP benchmarks. Its latent-adversarial approach provides robustness against internal reconstruction and quantization attacks, delivering practical, scalable unlearning for trustworthy AI; code is available at the authors' repository.

Abstract

While Large Language Models (LLMs) have achieved remarkable capabilities, they unintentionally memorize sensitive data, posing critical privacy and security risks. Machine unlearning is pivotal for mitigating these risks, yet existing paradigms face a fundamental dilemma: aggressive unlearning often induces catastrophic forgetting that degrades model utility, whereas conservative strategies risk superficial forgetting, leaving models vulnerable to adversarial recovery. To address this trade-off, we propose $\textbf{AGT$^{AO}$}$ (Adversarial Gating Training with Adaptive Orthogonality), a unified framework designed to reconcile robust erasure with utility preservation. Specifically, our approach introduces $\textbf{Adaptive Orthogonality (AO)}$ to dynamically mitigate geometric gradient conflicts between forgetting and retention objectives, thereby minimizing unintended knowledge degradation. Concurrently, $\textbf{Adversarial Gating Training (AGT)}$ formulates unlearning as a latent-space min-max game, employing a curriculum-based gating mechanism to simulate and counter internal recovery attempts. Extensive experiments demonstrate that $\textbf{AGT$^{AO}$}$ achieves a superior trade-off between unlearning efficacy (KUR $\approx$ 0.01) and model utility (MMLU 58.30). Code is available at https://github.com/TiezMind/AGT-unlearning.

Figures (8)

• Figure 1: Comparison of unlearning outcomes between a standard baseline (Vanilla) and our proposed AGTAO framework. Existing methods suffer from two primary failure modes: (1) Catastrophic Forgetting: The unlearning process severely damages the model's general capabilities, leading to meaningless repetition on the retain set (top row). (2) Superficial Forgetting: The model appears to forget but leaks the target knowledge under jailbreak attacks (middle row). In contrast, AGTAO simultaneously achieves robust forgetting against adversarial probing and preserves generation fluency on the retain set.
• Figure 2: Overview of the proposed AGTAO framework. Training Pipeline: The model employs an Adversarial Gating Training (AGT) paradigm. It introduces latent perturbation attack $\delta$ at layer $L$ via a min-max game to simulate and defend against internal recovery attacks, ensuring robust erasure. The total loss integrates the adversarial forget loss, retain loss, and the AO regularization term. (b) penalty visualization of Adaptive Orthogonality (AO): A geometric regularization mechanism that mitigates catastrophic forgetting by analyzing gradient conflicts.
• Figure 3: Gradient-Norm-Based Gating.
• Figure 4: Impact of Adaptive Orthogonality (AO) on optimization stability.
• Figure 5: Sensitivity analysis on perturbation layers (blue) and inner optimization steps (pink).