Representation-aware unlearning via activation signatures: from suppression to knowledge-signature erasure

Abstract

The rapid development of large language models (LLMs) has outpaced regulations (e.g. GDPR) and ethical frameworks, raising concerns about privacy compliance,

bias, misuse, misinformation, and legal adaptability. This makes the ability to selec- tively erase knowledge from LLMs critical. Despite significant developments, current

unlearning methods are not able to segregate behavioral suppression and true knowl- edge removal, allowing latent capabilities to persist beneath surface-level refusals. In

this paper, we address this challenge by introducing Knowledge Immunization Framework (KIF), a representation-aware architecture that differentiates between true erasure and obfuscation by operating on the internal activation signatures of the model, as opposed to surface-level outputs. KIF achieves near-oracle erasure (FQ ≈ 0.99 vs. 1.00) and utility preservation (MU = 0.62), effectively breaking the stability-erasure tradeoff that has constrained all prior work. Our observation shows that standard models exhibit scale-independent true erasure (<3% utility drift), while reasoning-prior models reveal fundamental architectural divergence. Our comprehensive dual-metric evaluation protocol, combining surface-level leakage with latent trace persistence, operationalizes the obfuscation - erasure distinction and enables the first systematic diagnosis of mechanism-level forgetting behavior across model families and scales.