EMBER: Embedding ERasure for LM Unlearning

• The paper introduces EMBedding ERasure (EMBER), a method that directly edits token embeddings to remove target concept information and improve persistent unlearning.
• EMBER leverages Sparse Matrix Factorization to isolate concept-bearing features and selectively subtract them, ensuring precise and local editing.
• Empirical results show that integrating EMBER with existing methods can reduce relearning accuracy by up to 50% while maintaining overall model coherence.

Searching arXiv for the EMBedding ERasure paper and closely related concept-erasure work. EMBedding ERasure (EMBER) is a plug-and-play concept erasure module for token embeddings in LLMs. It is designed to improve persistent unlearning by editing the embedding matrix itself, rather than relying only on parameter updates in downstream MLP layers. The method localizes concept-related structure in embedding space with Sparse Matrix Factorization, identifies a small set of concept-bearing embedding features, and subtracts only the corresponding component from a restricted set of token embeddings. In the formulation introduced for Gemma-2-2B-it and Llama-3.1-8B-Instruct, EMBER is presented as a precision intervention for robust concept erasure: existing methods may suppress a concept in one task format yet still permit recovery through adversarial prompting or relearning because the embedding layer continues to encode concept-specific information (Suslik et al., 2 Jun 2026).

1. Problem formulation and motivation

EMBER is motivated by a specific diagnosis of persistent unlearning failures. Prior parameter-only erasure methods such as RMU, CRISP, and PISCES are described as overly MLP-centric: they modify feed-forward weights, but they do not fully remove concept knowledge because part of that knowledge is also encoded in the embedding layer. Under this view, erasure that leaves the input embedding space largely intact remains vulnerable to recovery. The same target concept may reappear under alternate prompting strategies, different task formats, or additional fine-tuning.

The central objective is therefore not indiscriminate perturbation of embeddings, but precise removal of the concept-specific part of a small subset of token embeddings while leaving the rest of the model mostly intact. This framing is important because the method is not presented as a full replacement for existing unlearning procedures. Instead, EMBER augments them by directly addressing a memory locus that previous approaches leave mostly untouched.

The paper associates this design with four evaluation dimensions. Efficacy requires concept accuracy to move toward chance. Specificity requires preservation of similar-domain performance and general knowledge. Coherency requires instruction following and fluency to remain stable. Robustness requires low concept accuracy even after relearning. This combination places EMBER within the broader literature on persistent concept erasure rather than one-shot output suppression (Suslik et al., 2 Jun 2026).

2. Sparse Matrix Factorization of embedding space

EMBER begins from the model’s embedding matrix

$E \in \mathbb{R}^{|\mathcal{V}|\times d},$

where $\mathbf{e}_t$ denotes the embedding of token $t$. For a target concept $C$, two text sets are collected: $\mathcal{S}_C$, consisting of concept-related sentences, and $\mathcal{S}_N$, consisting of neutral sentences. The token subset used for factorization is the union of tokens appearing in either set, $\mathcal{V}^* \subset \mathcal{V}$.

The corresponding embedding submatrix is factorized as

$E_{\mathcal{V}^*}^\top \approx ZY,$

with

$$Z \in \mathbb{R}^{d\times k}, \qquad Y \in \mathbb{R}^{k\times |\mathcal{V}^*|}.$$

In this decomposition, each column $\mathbf{z}_i$ of $\mathbf{e}_t$0 is an embedding feature, understood as a reusable direction in embedding space, while $\mathbf{e}_t$1 gives the contribution of feature $\mathbf{e}_t$2 to token $\mathbf{e}_t$3.

The factorization is made sparse through a winner-takes-all constraint on $\mathbf{e}_t$4. After each coefficient update, only the top $\mathbf{e}_t$5 largest-magnitude coefficients per factor are retained and the rest are zeroed out. The objective is

$\mathbf{e}_t$6

and the optimization is solved with alternating least squares. With $\mathbf{e}_t$7 fixed,

$\mathbf{e}_t$8

and with $\mathbf{e}_t$9 fixed,

$t$0

The reported settings are %%%%2$\mathbf{e}_t$2%%%%2s = 0.01$t$3Z,Y$t$4k=100$t$5k=200$$(<a href="/papers/2606.03695" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Suslik et al., 2 Jun 2026</a>).</p> <p>This construction is intended to make each recovered feature correspond to only a small, interpretable subset of tokens. A plausible implication is that sparsity is not merely a compression device but also the mechanism that makes subsequent concept selection sufficiently localized for editing.</p> <h2 class='paper-heading' id='concept-feature-selection-and-the-erasure-operator'>3. Concept feature selection and the erasure operator</h2> <p>Once the factorization is obtained, EMBER identifies which recovered features are actually associated with the target concept. The first filter is a mass-ratio statistic,</p> <p>$$t$6

where $t$7 and $t$8 are the concept-labeled and neutral-labeled token sets. A feature is retained when its mass ratio exceeds a threshold $t$9, with the paper using $C$0. The retained features are then further filtered by an LLM-as-judge, which checks whether the feature’s token set matches the target concept. The resulting concept-feature set is denoted $C$1.

The erasure step relies on the feature decomposition

$C$2

EMBER partitions this into concept and non-concept parts:

$C$3

It then subtracts only the concept-related component:

$C$4

where $C$5 controls the edit strength. When $C$6, the recovered concept component is removed exactly; when $C$7, the method over-subtracts, which is reported to often improve erasure in practice.

The edit is explicitly local. It is applied only to tokens $C$8 that are reconstructed using at least one concept feature. Many embeddings therefore remain completely untouched, and even edited embeddings lose only a concept-specific slice. This locality is a defining property of EMBER’s design. In deployment, the module is used either as standalone EMBER or in ensemble form, including RMU+EMBER, CRISP+EMBER, and SNMF+EMBER, where the embedding-layer edit complements MLP-layer modifications rather than replacing them (Suslik et al., 2 Jun 2026).

4. Experimental setting and evaluation protocol

The empirical study spans 18 concepts drawn from fiction, historical events, science, and safety-sensitive topics. Reported examples include Harry Potter, Ancient Rome, Cannabis, COVID-19, Nazism, Pornography, Valentine’s Day, and World War II. The evaluated base models are Gemma-2-2B-it and Llama-3.1-8B-Instruct. For each concept, the study constructs concept-specific and similar-domain question-answering sets in both multiple-choice (MC) and open-ended (OE) formats. Additional evaluation uses MMLU for general knowledge retention, AlpacaEval for coherence, and a relearning probe in which the erased model is fine-tuned again on concept-related paragraphs (Suslik et al., 2 Jun 2026).

Evaluation dimension	Operational target
Efficacy	Concept accuracy should go down toward chance
Specificity	Similar-domain accuracy and MMLU should stay high
Coherency	AlpacaEval instruction-following and fluency should remain stable
Robustness	After relearning, concept accuracy should remain low

The paper also compares EMBER against simple embedding perturbation baselines applied to the same token embeddings. These baselines are Mean replacement and Noise injection. EMBER is reported to perform substantially better than both, supporting the claim that the benefit comes from the Sparse MF-guided direction of the edit rather than from generic perturbation of embedding magnitudes.

This protocol makes the method notable for breadth rather than for evaluation on a single benchmark family. The experiments test not only immediate suppression but also cross-format behavior, collateral effects, and resistance to re-acquisition, which are precisely the failure modes that motivate embedding-aware erasure in the first place (Suslik et al., 2 Jun 2026).

5. Empirical results and mechanistic interpretation

The strongest reported effect is on robustness to relearning. On Llama, RMU’s relearning accuracy drops from about $C$9 to $\mathcal{S}_C$0, and CRISP’s from about $\mathcal{S}_C$1 to $\mathcal{S}_C$2 when EMBER is added. The full MF-based SNMF+EMBER pipeline reduces relearning accuracy to about $\mathcal{S}_C$3 on Llama, described as roughly halving prior methods’ best results there. The abstract also states that regained accuracy is reduced by up to $\mathcal{S}_C$4, limiting it to $\mathcal{S}_C$5 on Llama compared to $\mathcal{S}_C$6 for prior methods.

On MC tasks, adding EMBER reduces concept accuracy by an average of $\mathcal{S}_C$7 points across methods and models. At the same time, similar-domain accuracy improves by roughly $\mathcal{S}_C$8–$\mathcal{S}_C$9 points on Gemma and $\mathcal{S}_N$0–$\mathcal{S}_N$1 on Llama, with only a tiny coherence cost. In OE settings, gains are smaller or sometimes mixed for concept accuracy, but specificity still improves strongly and concept scores remain far below baseline. These results support the claim that EMBER functions particularly well as an enhancer of existing erasure methods rather than solely as an isolated intervention (Suslik et al., 2 Jun 2026).

The paper’s analysis of collateral damage centers on the claim that the coherence cost is highly localized. The method modifies only a tiny fraction of the vocabulary: at most about $\mathcal{S}_N$2 of Gemma’s vocabulary and $\mathcal{S}_N$3 of Llama’s vocabulary. The per-token relative edit magnitude is defined as

$\mathcal{S}_N$4

and is compared with TF-IDF computed against a Wikipedia background corpus,

$\mathcal{S}_N$5

Tokens with larger $\mathcal{S}_N$6 tend to have higher TF-IDF, which is interpreted as evidence that the edited tokens are more concept-specific. The reported pattern is that coherence degradation concentrates on concept-exclusive tokens. If a token such as Hogwarts is edited, collateral damage is more likely because it is almost entirely tied to Harry Potter; a token such as Harry remains usable in non-concept contexts such as Prince Harry. The paper further notes that this localized behavior is not unique to EMBER and also appears in MLP-only methods.

This suggests that the method’s utility-cost tradeoff is governed less by global semantic drift than by the exclusivity structure of the targeted vocabulary. In that sense, EMBER’s precision is not only an implementation detail but also the basis of its mechanistic interpretation (Suslik et al., 2 Jun 2026).

6. Scope, limitations, and nomenclatural disambiguation

The reported experiments are English-specific because English Wikipedia is used to collect $\mathcal{S}_N$7 and $\mathcal{S}_N$8, so multilingual erasure is not directly addressed. EMBER edits only the input embedding matrix, not the unembedding matrix; the paper states that editing the unembedding directly caused severe generation degradation in early experiments. It also notes that some concepts may not be well represented in embeddings, so the method may not work uniformly for every target, and that token labeling for concept-specific editing can be noisy because it depends partly on corpus co-occurrence and heuristic filtering. Suggested directions include better corpus measures or auxiliary model-based filtering (Suslik et al., 2 Jun 2026).

Because the acronym is overloaded, disambiguation is often necessary. EMBER in this sense refers specifically to EMBedding ERasure in language-model concept unlearning (Suslik et al., 2 Jun 2026). It is distinct from EMBER-2, or EMulating Baryonic EnRichment, a galaxy-formation emulation framework for predicting baryonic properties from dark matter simulations across $\mathcal{S}_N$9 (Bernardini et al., 21 Feb 2025). It is also distinct from Ember, a no-code context-enrichment system built around similarity-based keyless joins over learned embeddings (Suri et al., 2021); EMBER, or Experience-Modulated Biologically-inspired Emergent Reasoning, a hybrid LLM architecture centered on a 220,000-neuron spiking neural network (Savage, 14 Apr 2026); and Ember, a compiler for embedding operations on Decoupled Access-Execute architectures (Siracusa et al., 14 Apr 2025). The more general problem of erasure has also been examined in a different setting by the quantum privacy-delegation work on provable deletion (Coiteux-Roy et al., 2019).

Within the language-model unlearning literature, EMBER’s main conceptual contribution is the claim that embedding-space knowledge matters for erasure. Its practical contribution is a local, Sparse MF-guided editing rule that can be added to existing methods with minimal coherence loss while substantially improving robustness to relearning.