FlagThis

Abstract

Large language models (LLMs) are increasingly deployed in security-critical systems across healthcare, finance, education, and decision support, yet their inability to forget creates serious cybersecurity, privacy, and safety risks. Sensitive personal information, copyrighted material, hazardous domain knowledge, and memorized training data remain encoded across billions of parameters long after deployment, leaving models vulnerable to extraction, jailbreak attacks, membership inference, and regulatory non-compliance. Real-world incidents, from chatbots regenerating private information to fabricated legal citations producing direct legal and financial cost, place the problem at the center of the emerging-threats landscape rather than the realm of speculation. Because retraining billion-parameter models on revised corpora is computationally infeasible, and because knowledge within an LLM is distributed and entangled across parameters rather than localized to identifiable units, LLM unlearning has emerged as the principal cyber defense response, aiming to remove or suppress targeted knowledge from a trained model without retraining and without eroding what the model should still know. A central question, however, remains unresolved. Do current methods genuinely remove knowledge, or do they only stop the model from expressing it under ordinary prompting conditions? This survey examines LLM unlearning through the lens of security, robustness, and verifiable forgetting, with primary focus on gradientbased methods, which have come to dominate the field due to their compatibility with existing training pipelines and their scalability to billion-parameter models. To structure the analysis, this survey introduces a three-level framework that separates behavioral suppression, representation-level attenuation, and true forgetting, and uses it to read the operational behavior of three method families: gradient ascent and descent approaches, influence-based methods, and methods that constrain updates through parameter saliency, low-rank adapters, or localized model editing. Across the three families, a consistent pattern emerges. Gradient ascent does not invert the original training trajectory; it introduces a new one that leaves underlying representations largely intact. Influence-based methods reach further by modeling how individual training points shape parameters, but rely on local linearity assumptions that do not strictly hold in nonconvex deep models. Constrained and localized editing methods improve stability and precision, yet still assume that targeted knowledge can be cleanly isolated, which holds only approximately at scale. None of the families reviewed achieve true forgetting in the strict sense of equivalence to a model retrained without the forget set. Current evaluation protocols, anchored by benchmarks such as TOFU, RWKU, WMDP, and MUSE, capture behavioral suppression effectively but fall short of certifying removal under adversarial recovery probes including relearning attacks, membership inference, jailbreak prompts, and embedding-space soft-prompt attacks. This evaluation gap, alongside the absence of methods that achieve true forgetting, robustness against adversarial recovery, scalability to repeated and compositional requests, and standardized evaluation foundations, defines the central open challenges this survey leaves for future work.