Adversarial Gating for LLM Unlearning

• The paper introduces a saddle-point framework that employs adversarial perturbations in latent spaces to securely erase unwanted knowledge while maintaining model performance.
• It details curriculum-based and point-wise constrained methods that mitigate catastrophic forgetting and defend against adversarial memory recovery.
• Empirical results demonstrate enhanced unlearning efficacy, lower attack success rates, and minimal degradation of core language model capabilities.

Adversarial gating for LLM unlearning encompasses a class of techniques that formulate forgetting as a saddle-point game in the latent space of LLMs. These strategies, which include Adversarial Gating Training (AGT), point-wise constrained interventions, and min–max latent perturbation methods, are developed to enforce robust erasure of sensitive or undesirable knowledge while preserving overall model utility. Adversarial gating mechanisms counteract both direct parametric recovery and adversarial prompt-based attacks, aiming to provide theoretical and empirical guarantees of irreversibility.

1. Motivating Robust Unlearning: Challenges and Vulnerabilities

LLMs inadvertently memorize sensitive or problematic data, creating privacy and misuse risks. Standard unlearning methods, commonly based on gradient ascent over forget sets (i.e., data to be erased) and gradient descent over retain sets (preserving general knowledge), encounter two main failure modes:

• Catastrophic forgetting: Overzealous unlearning damages essential general capabilities, degrading performance on retention tasks (Li et al., 2 Feb 2026).
• Superficial forgetting: On-the-surface erasure can be undone via adversarial attacks, including optimized suffixes ("jailbreaks") or internal manipulations, in which previously unlearned knowledge resurfaces. Empirical evidence indicates that, under dynamic unlearning attacks (DUA), original facts are recovered in 55.2% of prescribed queries, even without model parameter access (Yuan et al., 2024).

These vulnerabilities motivate robust frameworks where forgetting remains secure against adversarial latent interventions.

2. Formalization of Adversarial Gating Frameworks

Adversarial gating for LLM unlearning is unified by a min–max (saddle-point) optimization:

• Inner attack (adversarial gating): Search for a latent-space perturbation δ (e.g., at a selected Transformer layer ℓ), with $\|\delta\| \leq \kappa$, that maximally revives the model's probability of forbidden knowledge for forget-set queries.
• Outer defense (robust parameter update): Adjust model weights θ so that, even after the worst-case latent intervention, the model outputs satisfy the forgetting objective.

Mathematically, the paradigm takes the form: $$\min_\theta \max_{\|\delta\| \leq \epsilon} L_{\text{unlearn}}(h_f^{(\ell)} + \delta, h_r; \theta)$$ where $h_f^{(\ell)}$ (resp. $h_r$) denotes the hidden states for the forget set (resp. retain set), and the loss $L_{\text{unlearn}}$ is crafted to simultaneously maximize loss on the forget set (encouraging forgetting) and minimize loss on the retain set (preserving utility) (Li et al., 2 Feb 2026, Yuan et al., 2024).

In some cases, "gating" refers to an explicit injection of an adversarial perturbation into the layer output (i.e., $h^{(\ell)} \mapsto h^{(\ell)} + \delta$), interpreted as opening a "gate" that attempts to recover the erased memory (Yuan et al., 2024).

3. Methodological Instantiations

Leading adversarial gating methods for unlearning include:

Framework	Attack Mechanism	Defense Mechanism
AGT$^{AO}$ (Li et al., 2 Feb 2026)	Latent PGD perturbation δ	AO-regularized loss on θ, curriculum gating
AdvGA (Yuan et al., 2024)	Latent-space δ optimization	GA unlearning objective under min–max constraint
PCR (Rezkellah et al., 3 Oct 2025)	Activation exclusion (no δ)	Minimal-norm weight perturbation gating tokens

• Adversarial Gating Training with Adaptive Orthogonality (AGT$^{AO}$): Introduces a two-fold approach:
  • The Adaptive Orthogonality (AO) regularizer minimizes destructive gradient conflict between forgetting (on 𝒟_f) and retaining (on 𝒟_r) updates.
  • Latent-space adversarial gating is realized via a curriculum-based schedule. Initially, gating is off (δ=0), and once training stabilizes (norm of unlearning gradient falls below a threshold), adversarial perturbations are injected using projected gradient descent (PGD), forcing the model to withstand most damaging internal attacks at selected layers (Li et al., 2 Feb 2026).
• AdvGA within LAU (Latent Adversarial Unlearning): Frame adversarial unlearning as a two-stage game:
  • The inner attack step computes, for each forget-set instance, a perturbation δ (subject to $\|\delta\|_2 \leq \kappa$) at an early Transformer layer that minimizes the unlearning loss (i.e., most likely to re-activate forgotten content).
  • The outer defense step updates θ (model weights) by maximizing loss on the forget set, even under the worst-case δ. This process alternates on mini-batches and is compatible with any gradient-ascent unlearning objective (Yuan et al., 2024).
• Point-wise Constrained Regions (PCR): Rather than optimizing adversarial δ, PCR applies weight-space interventions to "gate off" forbidden tokens by driving the distance between relevant layer activations and sensitive embedding vectors above ε. The minimal norm update is computed analytically (via KKT conditions), resulting in an implicit gating effect: the latent "pathways" to forbidden tokens are interrupted, preventing both direct and adversarial recovery (Rezkellah et al., 3 Oct 2025).

4. Gating Mechanisms and Operational Details

The operational role of adversarial gating differs subtly across frameworks:

• Latent perturbation injection: The "gate" is an additive perturbation δ in the hidden state at a strategically chosen layer (typically early-to-intermediate, e.g., ℓ=4 or 10) (Yuan et al., 2024, Li et al., 2 Feb 2026). δ is optimized, per forget-set instance, to maximally revive forbidden predictions. No separately learnable gating network is used; the full residual is injected (g(h)=1).
• Point-wise gating via minimal-norm exclusion: Instead of an explicit δ, the layer activations are shifted just enough that, for every forbidden concept vector $c_i$, the activation lies at least ε away. This disrupts the network's ability to align with those embeddings, creating a "hard" barrier that blocks latent steering toward the forbidden region (Rezkellah et al., 3 Oct 2025).
• Curriculum-based gating schedule: In AGT$$\min_\theta \max_{\|\delta\| \leq \epsilon} L_{\text{unlearn}}(h_f^{(\ell)} + \delta, h_r; \theta)$$0, the onset of latent adversarial attacks is dynamically regulated by the norm of the unlearning gradient. This stabilizes training, ensuring the model is not overwhelmed by adversarial noise before it can robustly handle it (Li et al., 2 Feb 2026).

5. Empirical Results and Performance Trade-offs

Adversarial gating methods provide strong empirical improvements over prior approaches, as evidenced by recent benchmarks:

• Unlearning efficacy (KUR): AGT$$\min_\theta \max_{\|\delta\| \leq \epsilon} L_{\text{unlearn}}(h_f^{(\ell)} + \delta, h_r; \theta)$$1 achieves a Knowledge Unlearning Ratio (KUR) of 0.01 on LLaMA-2-7B-chat (TOFU), exceeding LAT and RMU baselines (0.05–0.14) (Li et al., 2 Feb 2026).
• Attack success reduction: PCR achieves 0.0% attack success rate (ASR) on HarmBench, compared to 7.2% for SmoothLLM and 0.8–2.0% for Self-Reminder (Rezkellah et al., 3 Oct 2025).
• RoBUST forgetting under adversarial probes: AdvGA reduces forget-set recall by 16% relative to vanilla GA on LLaMA-3-8B, with only ≈7% performance loss on neighbor data, and negligible degradation in general skills (Yuan et al., 2024).
• Model utility preservation: AO regularization in AGT$$\min_\theta \max_{\|\delta\| \leq \epsilon} L_{\text{unlearn}}(h_f^{(\ell)} + \delta, h_r; \theta)$$2 maintains near-retrain-level utility scores (Model Utility 0.59 vs. retrain 0.58), and MMLU 58.3 exceeds the target of 58.1 (Li et al., 2 Feb 2026).
• Vocabulary unlearning: PCR increases perplexity on forbidden words by ≈50%, indicating deep and irreversible forgetting (Rezkellah et al., 3 Oct 2025).
• Privacy leakage: AGT$$\min_\theta \max_{\|\delta\| \leq \epsilon} L_{\text{unlearn}}(h_f^{(\ell)} + \delta, h_r; \theta)$$3 yields Privacy Leakage Ratio (PLR) close to the ideal of 0.5, outperforming GA and NPO baselines (Li et al., 2 Feb 2026).

6. Theoretical Guarantees and Computational Considerations

Adversarial gating approaches are supported by distinct theoretical and practical assurances:

• Minimal-norm certificate: PCR updates are computed from a convex QCQP, guaranteeing that the intervention is the smallest possible perturbation consistent with the exclusion constraints at each layer (Rezkellah et al., 3 Oct 2025).
• Stability via analytic (or lightly iterative) solutions: PCR updates are inherently stable and converge in far fewer iterations than full fine-tuning. Similarly, adaptive curricula in AGT$$\min_\theta \max_{\|\delta\| \leq \epsilon} L_{\text{unlearn}}(h_f^{(\ell)} + \delta, h_r; \theta)$$4 prevent instability at training initialization (Rezkellah et al., 3 Oct 2025, Li et al., 2 Feb 2026).
• Trade-off via perturbation budget: The adversarial budget (ε or κ) directly sets the strength of the unlearning–robustness trade-off. A plausible implication is that, even with budgets as small as 0.1% of parameter norm, robust forgetting can be achieved (Rezkellah et al., 3 Oct 2025).
• Computational overhead: Methods involving inner PGD or latent min–max attacks (AGT$$\min_\theta \max_{\|\delta\| \leq \epsilon} L_{\text{unlearn}}(h_f^{(\ell)} + \delta, h_r; \theta)$$5, AdvGA) approximately double training time relative to simple fine-tuning; closed-form PCR is up to 5–10× faster than max–min approaches (Rezkellah et al., 3 Oct 2025, Li et al., 2 Feb 2026, Yuan et al., 2024).

7. Limitations, Open Problems, and Extensions

• Scale limitations: Most empirical validations are limited to models in the 2–7B parameter range. Scaling to 30B+ LLMs remains an open direction (Li et al., 2 Feb 2026).
• Computational cost: PGD-based min–max methods impose significant additional cost, motivating research into single-step or low-rank approximations (Li et al., 2 Feb 2026, Yuan et al., 2024).
• Granularity of gating: AdvGA injects the same perturbation per layer across all tokens; finer-grained gates, trainable gating networks, or distributed multi-layer gates are potential extensions (Yuan et al., 2024).
• Adversarial scope: While latent attacks capture a broad threat model, exotic or compositional attacks outside the adversarial subspace defined by δ may still bypass defenses. Extensions could combine latent gating with input-space attack augmentation (Yuan et al., 2024).
• Continual or federated adaptation: Both AO and adversarial gating could be adapted for continual or federated unlearning settings (Li et al., 2 Feb 2026).
• Curriculum stabilization: The gradient-norm curriculum can potentially be refined using higher-order measures (e.g., curvature), further mitigating instability (Li et al., 2 Feb 2026).

Adversarial gating methods offer a unifying framework for strong, efficient, and robust LLM unlearning, exceeding previous pointwise or naïve approaches in both theoretical guarantees and practical resilience. The field continues to push toward scalable, efficient, and ever more secure erasure methodologies (Rezkellah et al., 3 Oct 2025, Li et al., 2 Feb 2026, Yuan et al., 2024).