How to Make AI Forget

The central challenge hindering the enterprise adoption of AI is that models can learn but cannot effectively forget. This inability creates significant risks, as models may retain and act on undesirable information or behaviors, such as bias, private data (PII), or security vulnerabilities. While current solutions like context engineering (RAG), guardrails, and fine-tuning attempt to mitigate these issues, they are fundamentally superficial. They operate on the model’s exterior—filtering inputs and outputs—but fail to address the problematic knowledge or tendencies embedded within the model’s core. These external wrappers are often bypassable and do not solve the underlying problem of what the model knows and how it thinks.

Machine Unlearning as AI Neuro-surgery

Machine unlearning offers a more fundamental solution by directly modifying the model’s internal state. It is analogous to AI neuro-surgery, a precise process that targets and edits the model’s weights to remove specific, unwanted representations without needing to retrain the model from scratch. This approach is not about replacing existing safety measures but adding a crucial, missing component to the AI infrastructure stack that provides deep mitigation and remediation.

The first step in this process involves mapping and understanding where concepts are represented within the neural network, overlapping with research in model explainability. Once a representation is identified, the unlearning engine carefully edits the weights to erase the target concept while preserving the model’s overall utility.

Core Unlearning Strategies

Hirundo focuses on two primary types of unlearning:

• Behavioral Unlearning: This targets the mitigation of general model tendencies or traits. It’s not about forgetting a specific data point, but rather reducing a model’s inclination towards a certain behavior. Key applications include:

  • Reducing Bias: Mitigating biases related to gender, race, or ideology.
  • Eliminating Vulnerabilities: Hardening the model against prompt injections and jailbreaks. Ben Luria notes that advanced reasoning models can be more vulnerable due to “over-recursive addressing,” making this a critical area.
  • Correcting Hallucinations: Addressing issues like summary or RAG hallucinations where the model makes mistakes despite having the correct context. The goal is significant risk reduction—achieving up to an 85% decrease in vulnerabilities in some cases—rather than 100% elimination, which could paralyze the model.

• Data Unlearning: This focuses on the precise removal of specific pieces of information or knowledge the model was trained or fine-tuned on. This is essential for:

  • PII Removal: Erasing personally identifiable information to comply with regulations like the “right to be forgotten.”
  • Copyright Compliance: Removing copyrighted material to mitigate legal risks.
  • Confidential Information: Excising proprietary enterprise data that was accidentally included in training. Data unlearning can be highly effective, achieving up to 99% removal of targeted fine-tuned data.

The Unlearning Workflow and Measuring Success

The unlearning process is designed to be accessible. A user can select a model and choose what to unlearn from a set of predefined categories (e.g., specific biases) or provide a custom dataset with examples of what to avoid and what to aspire to.

The success of unlearning is measured on two fronts:

1. Efficacy: Red-teaming benchmarks (such as Meta’s Purple Llama) are used to measure the reduction in targeted negative behaviors like jailbreaks.
2. Utility Preservation: Standard industry benchmarks (MMLU, IF-Bench, etc.) are used to ensure that the model’s general capabilities and performance on desired tasks remain intact.

Applicability Across the Model Landscape

Machine unlearning is a versatile technique applicable to various models and scenarios:

• Open vs. Closed Models: While direct weight editing is performed on open-weight models, a similar technique can be applied to closed models that provide access to log probabilities (logprops), such as Google’s Gemini. By analyzing the token probabilities, an algorithm can rerank the output distribution to steer the model away from undesirable behaviors.
• Coding and Autonomous Agents: For code-generating models, unlearning can remove intellectual property risks, outdated library references, or malicious code patterns. For autonomous agents, where the chance of error compounds with each step, reducing the risk of mistakes is even more critical.
• Model Architectures: The technology is largely model-agnostic. It has been successfully adapted from standard Transformers to newer architectures like Mamba hybrids with minimal engineering effort.

• Tags:
• Foundation Models
• AI Safety
• Feature
• Enterprise AI
• Model Editing
• AI Alignment
• Machine Unlearning