Unlearning Isn't Deletion: Investigating Reversibility of Machine Unlearning in LLMs

Unlearning in large language models (LLMs) aims to remove specified data, but its efficacy is typically assessed with task-level metrics like accuracy and perplexity. We show that these metrics can be misleading, as models can appear to forget while their original behavior is easily restored through minimal fine-tuning. This \emph{reversibility} suggests that information is merely suppressed, not genuinely erased. To address this critical evaluation gap, we introduce a \emph{representation-level analysis framework}. Our toolkit comprises PCA similarity and shift, centered kernel alignment (CKA), and Fisher information, complemented by a summary metric, the mean PCA distance, to measure representational drift. Applying this framework across multiple unlearning methods, data domains, and LLMs, we identify four distinct forgetting regimes based on their \emph{reversibility} and \emph{catastrophicity}. We compare recovery strategies and show that relearning efficiency relies on the data source. We also find that irreversible, non-catastrophic forgetting is exceptionally challenging. By probing unlearning limits, we identify a case of seemingly irreversible, targeted forgetting, offering insights for more robust erasure algorithms. Overall, our findings expose a gap in current evaluation and establish a representation-level foundation for trustworthy unlearning.

Large language models can memorize private, copyrighted, or harmful text from their training data, which raises concerns for privacy, safety, and legal compliance. Machine unlearning aims to remove specified data from a trained model without the high cost of training a new model from scratch. However, current evaluations often judge unlearning by surface-level behavior, such as whether the model stops answering certain questions correctly. This paper shows that such evaluations can be misleading. A model may appear to forget the target data, yet its original behavior can be restored through only a small amount of additional training. This suggests that some unlearning methods may suppress information rather than genuinely erase it. To study this gap, we examine how the model changes internally before unlearning, after unlearning, and after relearning. These analyses help distinguish different outcomes, including temporary forgetting, harmful damage to the model’s general abilities, and the ideal but difficult case where only the target information is permanently removed. Across multiple models, datasets, and unlearning methods, we find that this ideal outcome remains exceptionally challenging. Our findings show that trustworthy unlearning should be evaluated not only by whether a model appears to forget, but also by whether the forgotten information can easily return.