Less is More: Geometric Unlearning for LLMs with Minimal Data Disclosure

As large language models (LLMs) are increasingly deployed in real-world systems, they must support post-hoc removal of specific content to meet privacy and governance requirements. This motivates selective unlearning, which suppresses information about a particular entity or topic while preserving the LLM's general utility. However, most existing LLM unlearning methods require access to the original training corpus and rely on output-level refusal tuning or broad gradient updates, creating a tension among unlearning strength, non-target preservation, and data availability. We propose Geometric Unlearning (GU), an approach that operates directly on the model's prompt-conditioned hidden states without access to the original training corpus. Specifically, GU distills a compact, low-rank safe-behavior subspace from a small set of safe reference prompts and uses lightweight anchor-in-context synthetic prompts to trigger localized, projection-based alignment of hidden representations to this safe subspace. A teacher-distillation regularizer on synthetic non-target anchors further reduces collateral drift. Across privacy-oriented unlearning benchmarks (ToFU and UnlearnPII), GU achieves strong target suppression with minimal impact on non-target performance, demonstrating that effective unlearning can be achieved with minimal synthetic data.

Large language models are trained on enormous collections of text, and they can sometimes learn information that later should not be revealed, such as private details about a person or sensitive content from a dataset. Removing such information is hard: retraining a model from scratch is costly, and the original training data may be unavailable or unsafe to handle again. We propose Geometric Unlearning, a way to reduce what a model reveals about a chosen person, topic, or dataset without going back to the original training data. Instead of trying to erase the data directly, our method redirects how the model prepares answers to target-related questions. It identifies a safe region in the model’s internal response space, corresponding to behaviors such as uncertainty or refusal, and then nudges target-related responses toward that region. We also add a safeguard so the model keeps working well on unrelated questions. In privacy-focused tests, our method reduced the amount of target information the model revealed while largely preserving its general abilities.