Current LLM unlearning methods leave unlearned pretraining knowledge largely recoverable by fine-tuning on other facts from the forget set.

Reading of the claim. "Current LLM unlearning methods" is read as a generic about methods in use today (November 2026), "pretraining knowledge" as knowledge the model acquired in pretraining and that unlearning targeted, and "fine-tuning on other facts from the forget set" as the retraining-on-T attack: the attacker has some forgotten facts and tries to recover others that cannot be inferred from them.

Prior view before reading. Unlearning methods that apply a few gradient steps or an activation perturbation to a trained network change a small part of a large parameter space; one would expect them to install a suppression mechanism more often than to erase distributed knowledge, and expect fine-tuning that removes the suppression to restore held-out facts. The open questions were magnitude, generality across methods, and whether newer methods escape.

Primary source, read in full for methods, results and limitations: Deeb and Roger, "Do Unlearning Methods Remove Information from Language Model Weights?" (arxiv.org/abs/2410.08827, v3 February 2025). Design: forget facts split into five parts of 157 items, four for retraining (628 items) and one for validation; unlearning on plain-text renderings, attack and evaluation in multiple-choice format; unlearning strength chosen so retain accuracy drops at most 5%; best learning rate chosen by validation accuracy; two runs averaged. Recovery rate is defined as held-out accuracy of the unlearned model after retraining divided by that of the original model after the same retraining. Result: recovery above 88% for RMU, gradient difference and random-incorrect-answer on Years, MMLU and WMDP-Deduped. With stronger unlearning (large retain loss, or no retain term) recovery of pretrained information usually remained high. For the Random Birthdays set, where facts were fine-tuned in, recovery was high for RMU but under 35% for gradient difference and random-incorrect-answer. The authors state the limits themselves: one fine-tuned dataset only; the attack does not prove removal when it fails; low-leakage datasets are hard to build, so capabilities are not covered; removal is a stronger property than safety may need.

Weighing the design. The independence of the train and validation facts is what licenses "recovered" rather than "re-taught". For Random Birthdays independence is by construction; for Years, MMLU categories and WMDP-Deduped it is by curation, and the recovery ratio's denominator (the original model after the same retraining) controls for any uplift retraining gives a model that never forgot. Selecting the learning rate on validation accuracy gives a small upward bias, immaterial against a gap between chance and near-original accuracy. The multiple-choice format measures recognition, which is easier than free recall, but mutual information between weights and answers is what the claim concerns. The main weakness is breadth: three methods, mainly one 8B model.

Corroboration, consulted at abstract or excerpt level in this pass and not read whole: Łucki et al., "An Adversarial Perspective on Machine Unlearning for AI Safety" (arxiv.org/abs/2409.18025), reporting that fine-tuning on ten unrelated examples recovers capabilities in RMU-edited models; Che et al., "Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities" (arxiv.org/abs/2502.05209), reporting unlearning undone within 16 fine-tuning steps; "Erase or Hide?" (arxiv.org/abs/2509.22263), reporting vulnerability of gradient ascent, gradient difference, preference-optimization variants and RMU to retraining. These use different attacks from the held-out-fact design, so they corroborate the general fragility of standard unlearning rather than replicate the 88% figure. They are the basis for the supporting subclaim that brief fine-tuning restores knowledge after standard unlearning.

Against the generic. Lee et al., "Distillation Robustifies Unlearning" (arxiv.org/abs/2506.06278), report that distilling an unlearned model into a randomly initialized student yields resistance to relearning, with a noise-and-distill variant trading compute for robustness. This was read at abstract level; it has not been tested here against the held-out-fact attack on pretrained factual knowledge at scale, and its cost approaches retraining, so it is an exception in principle more than a method in routine use. Other robustness-oriented proposals from 2025 and 2026 (layered unlearning, meta-learning approaches, representation-selective methods) claim gains whose independent evaluation was not found in this pass. Earlier tamper-resistance proposals were subsequently broken by stronger fine-tuning attacks, which is a reason for caution about untested robustness claims.

Verdict. Supported rather than verified: the direct evidence was examined and is sound for what it tested, but it is one study with narrow coverage, the corroborating work was not read whole, and the generic over "current" methods has at least one credible exception. Credence 0.78 that the claim is true as a generic about methods in common use; a strict universal reading would be lower. Search in this pass: five web queries on relearning attacks, distillation-based unlearning, tampering benchmarks and critiques of the held-out-fact evaluation; no published critique of the evaluation's validity was found, which is weak evidence given the size of the search.