Concept Unlearning in Machine Learning

• Concept unlearning (CU) is the selective removal of semantic units, such as classes or attributes, from models while retaining other essential knowledge.
• CU methods range from gradient-based corrections to diffusion model editing and parameter-efficient updates, enabling precise modification of learned representations.
• Key challenges include balancing forgetting effectiveness with preservation of non-target information, ensuring interpretability, and addressing adversarial prompting.

Searching arXiv for papers on concept unlearning and related machine unlearning to ground the article. Concept unlearning (CU) denotes the selective removal of a target concept from a trained model while preserving unrelated capabilities. In the literature provided here, the term is used in multiple, architecture-specific senses: in supervised classifiers, CU appears as class-wise forgetting or removal of example-level knowledge within machine unlearning objectives (Miao et al., 18 Sep 2025); in text-to-image diffusion models, it is the modification of a trained generator so that prompts for a concept no longer produce images expressing that concept, while benign generation remains intact (Shreyas et al., 18 May 2025); in continual learning, CU denotes sequential forgetting requests processed after a continual-learning phase without revisiting historical retained data (Tang et al., 18 May 2025); and in LLMs, CU is formalized as removing a target entity node and its associated edges from an internal knowledge graph represented by knowledge triplets (Yamashita et al., 19 Sep 2025). Across these settings, a common theme is the tension between erasure effectiveness and preservation of non-target knowledge, with recent work increasingly shifting from coarse instance-level suppression toward concept-level, distribution-aware, and interpretable mechanisms (Lin et al., 14 May 2026).

1. Scope and formal definitions

Concept unlearning is often framed as a specialized form of machine unlearning in which the forgetting target is not merely a collection of training points but a semantic unit such as a class, category, attribute, style, identity, or entity. In CUFG, the supervised setting begins with a dataset $D = \{(x_i, y_i)\}_{i=1}^M$, a forget set $D_f \subseteq D$, and a retain set $D_r = D \setminus D_f$. Starting from a pretrained empirical risk minimizer

$$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$

the goal is to produce an unlearned model $h(\theta_U)$ with minimal influence from $D_f$ while approximating the retrained gold standard

$$\theta_{D_r}^* = \arg\min_{\theta} \frac{1}{|D_r|}\sum_{(x_i,y_i)\in D_r} \mathcal{L}(h(x_i;\theta),y_i).$$

The approximate unlearning objective is written as

$$\theta_U = \arg\min_{\theta} \left( \frac{1}{|D_r|}\sum_{(x_i,y_i)\in D_r} \mathcal{L}(h(x_i;\theta),y_i) -\lambda \cdot \frac{1}{|D_f|}\sum_{(x_j,y_j)\in D_f} \mathcal{L}(h(x_j;\theta),y_j) \right),$$

where the first term preserves retained knowledge and the second promotes anti-learning on forgotten data (Miao et al., 18 Sep 2025). In that setting, class-wise forgetting is explicitly identified as concept removal: all samples of one or more classes are to be forgotten, so that the decision boundary structure supporting that category is erased (Miao et al., 18 Sep 2025).

In diffusion models, the formal object is a conditional generative distribution. A pretrained text-to-image model $M$ is modified to $M'$ so that for all prompts $D_f \subseteq D$0 about a forget concept $D_f \subseteq D$1, $D_f \subseteq D$2 does not depict $D_f \subseteq D$3, while for retain prompts $D_f \subseteq D$4, $D_f \subseteq D$5 (Shreyas et al., 18 May 2025). DoCo formulates this more explicitly as distribution alignment: for a sensitive concept $D_f \subseteq D$6 and anchor concept $D_f \subseteq D$7, unlearning seeks a model $D_f \subseteq D$8 such that

$D_f \subseteq D$9

while preserving the anchor distribution $D_r = D \setminus D_f$0 (Wu et al., 2024). TILDE further recasts CU as a constrained KL projection from the pretrained conditional distribution $D_r = D \setminus D_f$1 to a minimum-deviation target $D_r = D \setminus D_f$2 under a forgetting constraint on expected concept energy (George et al., 7 Jul 2026).

In continual learning, ACU defines continual unlearning as processing a sequence of forgetting sets $D_r = D \setminus D_f$3 after a continual-learning phase, without accessing the retained dataset $D_r = D \setminus D_f$4. The target model after the $D_r = D \setminus D_f$5-th request is the exact ridge-regression solution that would have been obtained by retraining from scratch on $D_r = D \setminus D_f$6 (Tang et al., 18 May 2025). In LLMs, CU is made graph-theoretic: for a forgetting target entity $D_r = D \setminus D_f$7, the concept to be removed is

$D_r = D \setminus D_f$8

the set of knowledge triplets incident to the target node (Yamashita et al., 19 Sep 2025). The required behavior is that such triplets must not be regenerated unless already present in the prompt (Yamashita et al., 19 Sep 2025).

2. Concept as class, distribution, embedding region, or graph neighborhood

A central distinction in the literature is how a “concept” is represented. In classifier-oriented machine unlearning, concepts are classes or subsets of instances. CUFG explicitly maps random instance forgetting to example-level knowledge scrubbing, whereas class-wise forgetting is described as removal of a concept or category (Miao et al., 18 Sep 2025). MCU, though written as machine unlearning for image classification, likewise operationalizes concept removal by defining class-wise forgetting sets $D_r = D \setminus D_f$9 containing all samples of a specific class (2505.10859).

For diffusion models, concepts are semantic entities expressible through prompts, including instances, styles, persons, offensive content, combinations, and contextual relations. Few-Shot Concept Unlearning with LoRA defines the forget concept $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$0 by a small set of 4–5 images and associated prompts, then modifies the CLIP text encoder’s final layers and projection matrix to remove influence of $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$1 from the text-image embedding space (Shreyas et al., 18 May 2025). TRUST characterizes concept neurons as cross-attention parameters whose perturbation significantly changes a CLIPScore-based alignment objective for an unsafe concept $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$2, thereby locating concept information inside the U-Net’s cross-attention projections (Mansi et al., 8 Feb 2026). KSCU interprets concepts through the stepwise denoising process, arguing that later denoising steps have disproportionate influence over concept-specific high-frequency details such as nudity, style, or instance identity (Zhang et al., 9 Jul 2025).

Several papers argue that keyword-level specification is too narrow. “A Concept is More Than a Word” states that a visual concept is multi-dimensional, can be expressed in diverse textual forms, and often overlaps with related concepts in latent space; keyword-only unlearning is therefore brittle and prone to over-forgetting (Pham et al., 19 Mar 2026). Its Diversified Unlearning framework instead represents a concept through a set of contextually diverse prompts and diversified embeddings (Pham et al., 19 Mar 2026). TILDE similarly treats concepts via a forget energy $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$3 computed from CLIP similarity to a descriptor set $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$4, not a single prompt token (George et al., 7 Jul 2026).

Other work introduces concept representations that are explicitly interpretable. ICED constructs a compact, task-specific concept vocabulary $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$5 from the forgetting set via an MLLM, aligns image and text embeddings, and decomposes each forgetting image into a sparse, nonnegative combination of semantic concept vectors (Lin et al., 14 May 2026). SAEParate and SAeUron-style methods instead treat concepts as sparse latent features in intermediate U-Net activations, with SAEParate enforcing concept-specific clustering through a concept-aware contrastive objective (Kim et al., 12 May 2026). SAUCE, by title and abstract, situates concept unlearning in VLMs around sparse autoencoder features that are selectively modified at inference to suppress concept-relevant signals while preserving unrelated information (Li et al., 16 Mar 2025). In LLM CU, the concept becomes the graph neighborhood of an entity represented by self-constructed knowledge triplets and explanatory sentences (Yamashita et al., 19 Sep 2025).

A plausible implication is that CU research has moved from coarse sample deletion toward explicit semantic interfaces: class partitions, prompt distributions, attention-localized concept neurons, sparse latent features, and entity-centered knowledge graphs each provide a different operational handle on “what is to be forgotten.”

3. Core methodological families

The literature represented here falls into several recurring methodological families. One family is gradient-based approximate unlearning for discriminative models. CUFG introduces a forgetting gradient

$$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$6

and a gradient corrector that modifies retain-set descent when the retain gradient and forget-set gradient are too aligned (Miao et al., 18 Sep 2025). MCU instead builds a nonlinear Bézier path

$$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$7

between the original model $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$8 and a pre-unlearning model $$\theta_D^* = \arg\min_{\theta} \frac{1}{|D|} \sum_{(x_i,y_i)\in D} \mathcal{L}(h(x_i;\theta), y_i),$$9, then optimizes the control point $h(\theta_U)$0 using a loss that minimizes retain loss and maximizes forget loss along the path (2505.10859). ACU departs from gradients entirely: for analytic continual learning with a frozen backbone and ridge-regression head, it stores a Knowledge Tracking Matrix

$h(\theta_U)$1

and updates it recursively with Woodbury identities so that each unlearning request yields the exact retrained solution on the remaining data (Tang et al., 18 May 2025).

A second family comprises diffusion-model editing via parameter updates. ESD, CA, UCE, SalUn, SHS, EDiff, and related methods are discussed comparatively in multiple papers (Wu et al., 2024, Zhang et al., 9 Jul 2025, George et al., 7 Jul 2026). KSCU’s contribution within this family is to model the denoising trajectory explicitly and fine-tune only key steps rather than all steps (Zhang et al., 9 Jul 2025). DoCo uses adversarial domain alignment between the denoised latent domain of a sensitive concept $h(\theta_U)$2 and an anchor concept $h(\theta_U)$3, plus concept-preserving gradient surgery that removes components of the unlearning gradient conflicting with a retention gradient (Wu et al., 2024). TILDE replaces anchor mapping with an energy-tilted, anchor-free target distribution and realizes it using residual $h(\theta_U)$4-GFlowNet training to learn score corrections relative to the pretrained diffusion model (George et al., 7 Jul 2026).

A third family performs parameter-efficient or localized editing in text-conditioning modules. Few-Shot Concept Unlearning with LoRA updates only the CLIP text encoder’s final layers, final normalization, and a low-rank perturbation $h(\theta_U)$5 to the projection matrix $h(\theta_U)$6, using retain, forget, and regularization losses (Shreyas et al., 18 May 2025). TRUST dynamically identifies concept neurons in cross-attention layers using gradients of a CLIPScore objective, then selectively fine-tunes only those neurons with either a Concept Influence Penalty or a Concept Sensitivity Reduction regularizer (Mansi et al., 8 Feb 2026). These methods treat the text-image alignment interface as the primary site of concept encoding.

A fourth family is feature-space manipulation without changing core model weights. SAEParate suppresses target concepts by modifying sparse latent features in a concept-separated SAE trained on UNet activations (Kim et al., 12 May 2026). SAUCE uses sparse autoencoders for selective concept unlearning in VLMs and performs inference-time feature modification instead of weight updates (Li et al., 16 Mar 2025). ICED uses sparse nonnegative concept decomposition and then optimizes only the CLIP image encoder with concept-level forgetting and preservation losses (Lin et al., 14 May 2026). ICCU is even more externalized: it never changes model parameters, instead inducing refusal rules from forget datasets and applying them through inference-time gating, filters, or system prompts (Pan et al., 26 May 2026).

A fifth family is rule-based or graph-based CU for language and multimodal systems. ICCU induces readable refusal rules from clusters of forget-set queries and composes them by set union, yielding order-independent continual unlearning without cross-request interference (Pan et al., 26 May 2026). CORE for LVLMs decomposes forgetting targets into visual and textual concepts, identifies them with concept modules and a concept modulator, then routes inputs to a mixture of concept-aligned refusal experts (Jin et al., 23 Mar 2026). LLM CU via self-constructed knowledge triplets prompts the model to generate triplets and explanatory sentences about the forgetting target and then applies unlearning losses to those generated representations (Yamashita et al., 19 Sep 2025).

4. Curriculum, difficulty, and mechanistic views of forgetting

A notable recent direction treats forgetting difficulty itself as a structured object. CUFG introduces Curriculum Unlearning as an easy-to-hard schedule

$h(\theta_U)$7

subject to difficulty monotonicity and data completeness (Miao et al., 18 Sep 2025). In practice, forgotten samples are ranked by model confidence, split into ordered subsets $h(\theta_U)$8, and processed sequentially with the same forgetting mechanism. The paper argues that low-confidence samples are easier to forget, while high-confidence forgotten samples may lie near decision boundaries or central prototypes, making abrupt erasure destabilizing (Miao et al., 18 Sep 2025).

KSCU offers a different notion of difficulty grounded in the diffusion process. It argues that concepts differ in where they concentrate along the denoising trajectory: class semantics require a broader late-step band, style can be handled by roughly the last half of steps, and instance identity may be largely controlled by the last 20% (Zhang et al., 9 Jul 2025). This suggests that difficulty is temporal and architecture-specific rather than purely data-side.

The mechanistic perspective is pushed further by “Toward Understanding Unlearning Difficulty,” which argues that variation in unlearning success reflects model-internal circuits that encode and protect memorized information. The proposed Circuit-guided Unlearning Difficulty (CUD) is a pre-unlearning metric using circuit-level signals, and the paper reports a mechanistic signature: easy-to-unlearn samples are associated with shorter, shallower interactions concentrated in earlier-to-intermediate parts of the original model, whereas hard samples rely on longer and deeper pathways closer to late-stage computation (Cheng et al., 14 Jan 2026). This suggests that “difficulty” can be measured before unlearning, and not merely inferred from post hoc performance. Because the user-provided details for this paper are truncated, only the abstract-level characterization is available here (Cheng et al., 14 Jan 2026).

A plausible implication is that curriculum strategies, timestep selection, and circuit-guided diagnostics all point toward the same emerging principle: effective CU may depend on aligning the intervention with the model’s internal organization of the target concept, rather than applying uniform pressure across data points, layers, or sampling steps.

5. Evaluation criteria and empirical patterns

Evaluation across CU papers consistently balances forgetting, preservation, privacy, and efficiency, though the exact metrics differ by modality. In classifier MU, CUFG uses a full-stack suite: Unlearning Accuracy

$h(\theta_U)$9

Remaining Accuracy (RA), Test Accuracy (TA), Membership Inference Attack (MIA), Runtime Efficiency (RTE), and Avg.Gap as the mean absolute difference of a method’s metrics from Retrain (Miao et al., 18 Sep 2025). ACU measures exact gaps to retraining in parameters, retain accuracy, forget accuracy, test accuracy, and MIA, reporting $D_f$0 on all of them because its analytic updates reproduce the retrained ridge solution exactly (Tang et al., 18 May 2025). MCU uses UA, $D_f$1, RA, TA, MIA, and Avg. Gap, and reports that $D_f$2 approaches retraining almost exactly in class-wise forgetting on CIFAR-10, Tiny-ImageNet, and ImageNet-100 (2505.10859).

In diffusion-model CU, benchmark design often separates unlearning effectiveness from generative retainability. KSCU evaluates Unlearn Accuracy (UA), Attack Success Rate (ASR) under P4D and UnlearnDiffAtk, and FID on COCO30k or UnlearnCanvas (Zhang et al., 9 Jul 2025). On NSFW unlearning, it reports UA $D_f$3, P4D ASR $D_f$4, UDA ASR $D_f$5, and FID-30k $D_f$6, outperforming several non-over-unlearning baselines in the combined robustness–retention trade-off (Zhang et al., 9 Jul 2025). Few-Shot Concept Unlearning with LoRA reports per-concept Retain CLIP, Forget CLIP, Unlearning Time, FID, and Detection Rate for Taj Mahal, Mickey Mouse, and Siberian Husky, with average runtime approximately 50–60 seconds using 4–5 images (Shreyas et al., 18 May 2025). TRUST uses ASR, UA, RA, FID, CLIPScore, and TIFA, and reports near-zero I2P ASR and small $D_f$7FID while preserving benign CLIP and TIFA scores close to SD1.5 (Mansi et al., 8 Feb 2026). TILDE supplements standard retention and forgetting metrics with FADE, a functional alignment measure comparing the unlearned model to a retain-only reference distribution; it reports the lowest average FADE among compared methods for styles (George et al., 7 Jul 2026).

In VLM and LVLM CU, the metrics explicitly reward preservation of non-target semantics within the same image or refusal behavior aligned to the right concepts. ICED uses zero-shot Target accuracy, Retain accuracy, All accuracy, and normalized out-of-domain utility across Food-101, STL-10, ObjectNet, and other datasets, then aggregates these into Avg. Score (Lin et al., 14 May 2026). CORE introduces Context-aware Refusal Rate (CRR), Refusal Gap $D_f$8, Answer Rate (AR), BERTScore, CLIPScore, ROUGE-L, and benchmark specificity on MMBench, SEEDBench, and ScienceQA, showing that concept-grounded refusal outperforms parameter-level baselines in long continual sequences (Jin et al., 23 Mar 2026). ICCU evaluates Refusal Rate on forget sets and retain sets, WMDP multiple-choice accuracy, TOFU ROUGE-L on forget and retain authors, MMLU accuracy, and cross-lingual robustness; it reports high refusal rates on forget topics with low refusal on MMLU and retain sets (Pan et al., 26 May 2026).

In LLM graph-based CU, the principal metrics are NodeAcc and EdgeAcc. NodeAcc measures whether the target entity can still be predicted from masked explanatory prompts, while EdgeAcc measures whether the correct attribution can still be generated from masked relational prompts. The proposed self-constructed-triplet method achieves NodeAcc $D_f$9 and EdgeAcc $$\theta_{D_r}^* = \arg\min_{\theta} \frac{1}{|D_r|}\sum_{(x_i,y_i)\in D_r} \mathcal{L}(h(x_i;\theta),y_i).$$0 on forgetting targets while preserving much higher NodeAcc and EdgeAcc on non-target entities than GA or NPO baselines (Yamashita et al., 19 Sep 2025).

Across these settings, an empirically recurring pattern is that aggressive methods can achieve near-perfect forgetting at the cost of severe collateral damage, whereas methods that explicitly encode preservation—through gradient correction, decomposition, localization, routing, or distributional targets—tend to dominate on joint forget–retain metrics.

6. Major controversies, limitations, and open directions

The strongest recurring controversy concerns what it means to have truly “forgotten” a concept. ACU claims exact unlearning because its post-unlearning classifier is mathematically identical to retraining on the retained set, but this guarantee relies on a frozen backbone, a linear head, and a ridge-regression objective (Tang et al., 18 May 2025). In diffusion and VLM settings, most methods are approximate and are evaluated behaviorally rather than by certified equivalence. ICCU, for example, never modifies weights, so it suppresses behavior conditionally through refusal rules rather than removing the underlying knowledge from parameters (Pan et al., 26 May 2026). This suggests that different subfields are using different operational notions of CU: parameter-level erasure, distributional realignment, refusal behavior, or output suppression.

Another controversy concerns localization. Keyword-based or single-prompt unlearning is criticized as too narrow because concepts are distributed across many textual forms and latent variants (Pham et al., 19 Mar 2026). Yet broader coverage raises the risk of over-unlearning, especially for semantically related concepts. Diversified Unlearning addresses this by replacing a single keyword with a prompt distribution (Pham et al., 19 Mar 2026); TILDE addresses it through a thresholded forget energy that creates a no-gradient benign region below a CLIP threshold (George et al., 7 Jul 2026); TRUST addresses it with dynamic concept neuron masks and preservation loss (Mansi et al., 8 Feb 2026). These responses imply that accurate concept coverage and collateral-damage control are inseparable design problems.

Interpretability is also unresolved. ICED, SAEParate, SAUCE, and CORE all argue that explicit concept interfaces—sparse latents, concept vocabularies, routed experts—enable finer control (Lin et al., 14 May 2026, Kim et al., 12 May 2026, Li et al., 16 Mar 2025, Jin et al., 23 Mar 2026). But these interfaces depend on the quality of extracted concepts, clustering, and decomposition. ICED explicitly depends on MLLM-generated vocabularies and modality alignment (Lin et al., 14 May 2026). SAEParate depends on concept labels and contrastive training for latent separation (Kim et al., 12 May 2026). CORE depends on LLM-generated concept descriptions and concept modulators (Jin et al., 23 Mar 2026). A plausible implication is that interpretability is useful insofar as the concept interface is faithful; otherwise, it may simply relocate the brittleness.

Several papers identify scaling challenges. ACU does not address unlearning from the pretrained backbone or from non-analytic nonlinear heads (Tang et al., 18 May 2025). Few-shot LoRA-based diffusion CU has not analyzed adversarial prompts deeply and remains vulnerable to circumvention because it alters only a localized region of embedding space (Shreyas et al., 18 May 2025). TRUST supports combinations and conditions but has higher memory cost for CSR due to gradient-of-gradient computations (Mansi et al., 8 Feb 2026). ICCU has only been tested on a modest number of domains and depends on embedding-space separability of forget topics (Pan et al., 26 May 2026). TILDE is promising for multi-concept sequential unlearning because it is anchor-free and residual, but the paper notes that shared LoRA parameters can still introduce coupling (George et al., 7 Jul 2026).

Open directions stated across the papers include better difficulty metrics and adaptive curricula (Miao et al., 18 Sep 2025), extension to LLMs and multimodal models (Miao et al., 18 Sep 2025, Tang et al., 18 May 2025), more faithful concept extraction and automated relation discovery (Yamashita et al., 19 Sep 2025, Lin et al., 14 May 2026), robustness to adversarial prompting (Shreyas et al., 18 May 2025, George et al., 7 Jul 2026), scalable handling of many concepts or concept combinations (Mansi et al., 8 Feb 2026, Jin et al., 23 Mar 2026), and theoretically grounded notions of exactness or certified forgetting outside analytic settings (Tang et al., 18 May 2025, George et al., 7 Jul 2026).

7. Historical and conceptual synthesis

Taken together, the cited works show CU evolving along three axes. First, the target of unlearning is becoming more semantic. Early or baseline formulations often forget datasets, instances, or labels. Recent work instead forgets classes as concepts (Miao et al., 18 Sep 2025, 2505.10859), styles and identities as conditional distributions (Wu et al., 2024, George et al., 7 Jul 2026, Zhang et al., 9 Jul 2025), unsafe combinations and conditional relations (Mansi et al., 8 Feb 2026), entity-centered knowledge neighborhoods (Yamashita et al., 19 Sep 2025), or multimodal concept sets with routed refusal experts (Jin et al., 23 Mar 2026).

Second, the intervention is becoming more structured. Rather than global gradient ascent or brute-force finetuning, recent methods use gradient-corrected retain descent (Miao et al., 18 Sep 2025), analytic closed-form recursion (Tang et al., 18 May 2025), low-rank text-encoder perturbations (Shreyas et al., 18 May 2025), dynamic neuron masks with Hessian-informed penalties (Mansi et al., 8 Feb 2026), latent concept decomposition (Lin et al., 14 May 2026), sparse concept-separated autoencoders (Kim et al., 12 May 2026), distributional tilting and residual GFlowNets (George et al., 7 Jul 2026), or in-context refusal rules (Pan et al., 26 May 2026).

Third, evaluation is becoming more faithful to the actual CU desideratum. Retraining or retain-only references play an increasing role as gold standards (Miao et al., 18 Sep 2025, George et al., 7 Jul 2026). Privacy and membership inference are treated as part of the forgetting objective, not merely auxiliary diagnostics (Miao et al., 18 Sep 2025, Tang et al., 18 May 2025). Out-of-distribution prompts, adversarial prompts, cross-lingual queries, and contextual combinations are now standard stress tests (Wu et al., 2024, Mansi et al., 8 Feb 2026, Pan et al., 26 May 2026, Pham et al., 19 Mar 2026).

This suggests that concept unlearning is no longer well described as simply “making the model worse at a target.” It is increasingly a problem of defining the right semantic target, locating how that target is encoded, and moving the model to a new state that is as close as possible to an appropriate reference—whether retrained, retain-only, analytically exact, or refusal-conditioned—while preventing the target concept from re-emerging under paraphrase, composition, or distribution shift.