Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing

arXiv:2609.39866 · cs.LG · Submitted 2026-09-30 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing".

Jane: The gist Open-weight LLMs are released as substrates for downstream fine-tuning,

Tom: First, who's behind it and why it matters.

Paper summary: Tom: We've gone through the summary of "Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing" and how Gradient-Sealed Unlearning uses a three-stage process to resist forbidden capability acquisition #pg2.

Jane: And we've talked about why this preemptive approach is important—it’s about making models safe before they even leave the lab so they can be used for normal things #pg1.

Lu: The key idea is using a forbidden domain proxy set Df during fine-tuning to identify and seal acquisition-sensitive gates in the model architecture #pg1.

Meng: It’s about finding those specific layers and channels, like N⋆l, where the most dangerous pathways for misuse are located #pg1.

Lalam: This method helps build in a resistance layer that suppresses likelihoods for forbidden domains while keeping normal utility high through constraints on pre-activations #pg1.

Tom: So when we look at the title of this paper, "Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing," it captures the entire goal: stopping capability acquisition before release using this sealing technique #pg1.

Jane: It’s a technical solution addressing the legal and ethical risks that come with releasing open-weight LLMs as substrates for fine-tuning #pg2.

Lu: Ultimately, this provides a way to condition a model to resist the acquisition of forbidden capabilities through future fine-tuning procedures #pg3.

Meng: It gives developers a concrete mathematical tool—like the one with ∆SF equals minus eta times ⟨∇θSF (θrel), ga⟩ plus O(η2) #pg3—to quantify this resistance level.

Tom: So, in simple terms, it means we're trying to build better guardrails into the AI models themselves so they don't accidentally become tools for things we don't want them to be #pg2.

Conclusion: Tom: So we're wrapping up this look at "Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing." Basically, this paper is about making sure that when you release an open-weight AI model, it can't be easily tricked into learning something dangerous later on.

Jane: Right. It’s focusing on preemptive unlearning—which is trying to build resistance in the model now so it resists future attacks during fine-tuning.

Lu: The authors are using this Gradient-Sealed Unlearning method, which involves exposing a copy of the model to a forbidden domain proxy set, Df, just to see where those dangerous acquisition gates are.

Meng: And then they localize those sensitive gates by looking at pre-activation shifts and layer budgets, finding specific channels called N star L that matter most.

Lalam: The final step is sealing these gates by pushing their pre-activations into a shared negative-tail threshold, which limits how much influence those gradients can have using only first-order updates.

Tom: It’s pretty clever because it’s not trying to delete what the model already knows, but it's trying to block the path for new forbidden knowledge acquisition.

Jane: The theoretical foundation shows that even if a released model doesn't look dangerous, forbidden data can still create gradients along pathways that lead to new capabilities.

Lu: That’s what their proposition does—it gives a mathematical bound on how much capability gain an attacker can get in one step, showing it’s constrained by the original model's structure.

Meng: For me, the practical impact is that developers have a way to bake safety constraints directly into the training process itself, instead of just hoping filters catch everything after release.

Lalam: It gives a concrete mechanism for making sure that when you condition an AI on new data, it doesn't accidentally pick up those bad habits or forbidden capabilities.

Tom: So the big picture here is moving away from reactive cleanup to proactive defense built into the model’s structure from the very beginning.

Jane: It shifts the focus to designing models that are inherently resistant to misuse, rather than just trying to police them after they're out there.

State Key Laboratory of Internet of Things for Smart City, University of Macau · RIKEN Center for Advanced Intelligence Project 3The University of Melbourne · King Abdullah University of Science and Technology 5Mila – Québec AI Institute · McGill University · Google Research · The University of Tokyo

cs.LG

Submitted: 2026-09-30

Updated: 2026-10-10

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 92/100

The gist: The gist Open-weight LLMs are released as substrates for downstream fine-tuning, creating legal and ethical risks that necessitate preemptive unlearning to prevent the acquisition of forbidden

Key concepts

Preemptive Unlearning: This is the goal of making a released model resistant to acquiring forbidden capabilities before an attack occurs. It focuses on making the model robust against unseen, future fine-tuning procedures that might try to enable harmful tasks.
Gradient-Sealed Unlearning (GSU): GSU is the proposed method consisting of three steps: Expose, Localize, and Seal. It identifies specific parameters sensitive to forbidden domains and then constrains their gradients using a negative threshold, effectively blocking gradient flow for those sensitive areas.
Expose: In this stage, a disposable copy of the original model is fine-tuned on a proxy set of forbidden domain data (Df). This allows researchers to identify specific 'acquisition-sensitive gates' within the model structure that are susceptible to being exploited by malicious fine-tuning.
Seal: The final stage constrains the identified sensitive gates by pushing their pre-activations into a shared negative threshold. This technique attenuates local gradient factors using only first-order updates, thereby limiting how much influence an attacker's gradient can have on those specific parameters.

Summary

The gist Open-weight LLMs are released as substrates for downstream fine-tuning, creating legal and ethical risks that necessitate preemptive unlearning to prevent the acquisition of forbidden capabilities through future training procedures

Problem Statement

Open-weight LLMs face legal and ethical risks because malicious users may fine-tune released models on harmful data to acquire capabilities for disinformation, explicit content generation, dangerous operational guidance, or privacy violations

The core problem is whether a model can be preconditioned to resist the acquisition of forbidden-domain capabilities through downstream fine-tuning

This requires distinguishing preemptive unlearning from retrospective unlearning, where the former aims to make forbidden-domain capabilities resistant to acquisition under unseen attack data and future fine-tuning procedures

Preemptive unlearning is defined as seeking a released model that resists post-release attacks while retaining strong utility in normal use

How it works

The proposed method is Gradient-Sealed Unlearning (GSU), which employs a three-stage process: Expose, Localize, and Seal

Expose: A disposable copy of the original model is fine-tuned on a forbidden domain proxy set Df to identify acquisition-sensitive gates through proxy learning
Localize: Acquisition-sensitive gates are selected based on their upward pre-activation shifts under proxy learning and layer/channel budgets 0 form I⋆; Within each selected layer, the ⌈pdl⌉ channels with the highest positive rlj form N⋆l." The gist>
Seal: The selected gates are constrained by pushing their pre-activations into a shared negative-tail threshold τ < 0, thereby attenuating local gradient factors using only first-order updates

Theoretical Foundation

The theoretical analysis formalizes why existing retrospective methods fall short by showing that forbidden-domain data can induce gradients along domain-sensitive pathways even when the released model exhibits little forbidden-domain capability

Proposition 3.1 provides a one-step acquisition gain bound, showing that the gain satisfies ∆SF = −η ⟨∇θSF (θrel), ga⟩ + O(η2), where ga is the attacker gradient 0, this one-step acquisition gain satisfies: ∆SF = −η ⟨∇θSF (θrel), ga⟩ + O(η2)." The gist>

The counterexample in §C.

Improvements for AI systems

A new defense mechanism, Gradient-Sealed Unlearning (GSU), can be implemented in open-weight LLMs to prevent downstream fine-tuning from acquiring forbidden capabilities by pushing relevant preactivations into the negative region, where ReLU-family activations exhibit zero or near-zero derivatives. This mechanism specifically targets and attenuates gradients along acquisition pathways, as demonstrated by the finding that Pushing selected pre-activations into this regime attenuates their local gradient factors using only first-order updates.
The improved system can resist post-release attacks by sealing acquisition pathways through a multi-stage process: Expose 02 Localize 03 Seal, which involves identifying acquisition-sensitive gates based on proxy learning and then constraining them to push selected preactivations into the SiLU negative tail. This directly addresses the failure of retrospective methods by controlling what downstream optimization can acquire rather than just suppressing current outputs.
The system gains targeted control over specific neural network components, as shown by selecting gates based on a directional recruitment score: rlj:= E(x,y)∼Df y X y i=1 ReLUu ilj (θla) − u ilj (θo). This allows the defense to selectively seal only those pathways identified as acquisition-sensitive gates, balancing acquisition resistance with utility preservation by controlling where future optimization can flow, not only what the model currently expresses.
The system is robust against reacquisition attacks following benign fine-tuning because it maintains a relative protection advantage: GSU retains lower final extraction and higher final utility than the corresponding undefended control after benign adaptation on Qwen3.5-2B, supporting the conclusion that normal benign adaptation does not eliminate GSU’s relative protection advantage.

Abstract

Open-weight LLMs are released not only as fixed products but also as substrates for downstream fine-tuning. This openness, however, creates legal and ethical risks because users may misuse fine-tuning to instill illicit knowledge or enable hostile operations. Model providers therefore need apre-release defense against such acquisition, motivating the problem of preemptive unlearning. Unlike retrospective unlearning, which removes capabilities already present in a fixed model, preemptive unlearning seeks to prevent their acquisition under unseen attack data and future fine-tuning procedures. Despite its practical importance, this setting remains largely unexplored, presents distinct challenges, and is therefore the central focus of our work. We first verify that existing retrospective methods provide insufficient pre-release protection. Even when forbidden capabilities are suppressed in current outputs, forbidden-domain data can still induce gradients through internal pathways, enabling later acquisition. Motivated by this finding, we propose a gradient-sealing principle that blocks these pathways by pushing relevant pre-activations into the negative region, where ReLU-family activations exhibit zero or near-zero derivatives. Experiments across multiple LLM families demonstrate our stronger resistance to downstream acquisition than retrospective baselines, validating gradient sealing as an effective mechanism for pre-release protection.