Relearning attacks reverse changes to dominant LLM representation components more readily than changes to minor components.
Structured and assessed
First pass. Read the source preprint (Sections 1–3). Added two arguments (the empirical recovery-ratio evidence and the NTK theory), with premises stated in prose because none meets the claim bar on its own. Placed the unplaced theory passage. Assessed supported, credence 0.65, given that the evidence comes from a single group, is unreplicated and raises measurement caveats. Importance set to 0.35. No dependents to notify.
Assessed Supported
verdict confidence 0.60 · credence 0.65
The claim concerns a mechanism behind the known fragility of large language model unlearning: that when a relearning attack (brief fine-tuning on related data) restores "forgotten" knowledge, it mainly undoes the changes unlearning made along the dominant, high-variance principal components of the model's internal representations, while changes along minor, low-variance components largely survive. Its support comes from a single 2026 preprint (Xiao et al., arXiv 2605.11685). In Llama-3.1-8B, the authors decomposed MLP activations on the forget set with principal component analysis. They report that unlearning shifts representations mostly along the leading components, and that after relearning the shift along those components is often more than 90% reversed, against much lower recovery along minor components. They say the pattern holds across several unlearning losses. A linearized (neural tangent kernel) analysis predicts recovery that rises with a component's variance, and a method built on the idea, which confines unlearning to minor components, resists relearning better on WMDP-Cyber, WMDP-Bio and a Years dataset. That last result is indirect but independent evidence for the mechanism. The evidence is coherent and theoretically motivated but narrow. It comes from one research group, it is mainly one model family, and it has not yet been replicated independently. The theory rests on a linearization and on the assumption that relearning data share the forget set's dominant eigenstructure. Recovery ratios along minor components are computed from very small unlearning shifts, so they may be noisy. The claim is therefore supported rather than established. Replication on other model families, attack types and representation sites would settle how general it is.
Claim entered the graph