Crossing the Margin Cliff: Toward Relearn-Robust LLM Unlearning via Margin Calibration

2026-07-30

AI Summary

Existing unlearning methods for large language models exhibit vulnerability under relearning attacks. This work reveals a prevalent “margin cliff” phenomenon—post-hoc unlearning approaches create a narrow optimization boundary near the retention set, rendering forgotten content easily recoverable. To address this, we propose Margin Calibration (MC), a plug-and-play mechanism that combines a non-saturating margin hinge loss with a KL-divergence probe to reestablish suppression pressure on forgotten content within the saturated region of the original loss. Theoretical analysis demonstrates that MC effectively traverses the margin cliff and constrains relearning attacks. Experiments show that, under a single frozen configuration, MC reduces ROUGE-L from 0.41 to 0.18 on benchmarks including TOFU, MUSE-News, and Phi-3.5, significantly lowers membership inference AUC in 13 out of 14 scenarios, and incurs only minimal utility loss on the retention set.

Abstract

Large language model unlearning is consistently fragile under relearn attacks. On TOFU, fine-tuning on twenty forget examples substantially recovers held-out forget-set ROUGE for every method we evaluate, and we trace this fragility to optimization geometry. The per-token answer margin of fourteen post-hoc methods spanning gradient, preference, and distillation families converges into a narrow band above the retain reference in 41 of 42 method--size cells, a regularity we call the margin cliff. We prove that this cliff follows whenever the retain coupling holds the diagnostic log-odds of forget content above a floor, a condition that token-saturating losses induce at stationarity and that we verify directly on 34 of 42 cells. Margin Calibration (\textsc{MC}) is a plug-in polish adding a non-saturating margin hinge anchored at the reference's per-token margin plus a KL probe on a disjoint instruction corpus, restoring forget-side pressure where the native loss saturates. Under a stated gradient-dominance condition, whose on-trajectory gradient signature we measure by instrumenting the polish, its stationary set lies on the cliff-crossing side, yielding an attack-budget upper bound on the relearn margin lift. Across TOFU (three Llama-3 sizes, three forget tiers), MUSE-News on Llama-2-7B-hf, and a Phi-3.5 panel, a single frozen configuration wins all 14 head-to-head forget aggregates and all populated relearn cells (panel-mean post-attack ROUGE-L $0.41$ to $0.18$) and lowers raw membership AUC on 13/14, with reduced retain-side utility as the main cost. A deployment variant matches these gains without a retain-trained reference.

Problem

• LLM unlearning
• relearn attacks
• margin cliff
• forget-set recovery
• optimization geometry

Innovation

• margin calibration
• LLM unlearning
• relearn robustness
• margin cliff
• non-saturating hinge