Distilling an unlearned language model into a randomly initialized student makes unlearning robust to fine-tuning-based relearning.
Assessed first pass
Assessed as supported (credence 0.65) on the single-group Lee et al. 2025 evidence, with robustness read as relative (matching an oracle or data-filtered model). No independent replication found. The compute cost approaches retraining. The claim was left atomic because there is one line of support and the budget was tight.
Assessed Supported
verdict confidence 0.60 · credence 0.65
The claim rests almost entirely on one study, Lee, Foote, Infanger and colleagues, "Distillation Robustifies Unlearning" (arXiv 2506.06278, NeurIPS 2025 spotlight). In that study, small Gemma-architecture models pretrained from scratch were unlearned with standard methods, then distilled into randomly initialized students. Under fine-tuning attacks on the forget domain, the students relearned the removed capability about as slowly as an oracle model that never saw the forget data. Models fine-tuned to match the oracle's outputs, starting from weights that already held the capability, relearned it quickly. The authors report the same pattern on synthetic language and arithmetic tasks and, less completely, on the WMDP hazardous-knowledge proxy. Their cheaper variant, UNDO, noises a copy of the teacher's weights instead of starting from random ones, and trades compute against robustness. "Robust" here is relative. The distilled student is about as resistant to relearning as a model retrained on filtered data. It is not immune: given enough fine-tuning, the capability comes back, just as it would for a model that never learned it. Read that way, the evidence supports the claim. Read as a claim that fine-tuning cannot restore the capability at all, the evidence does not show it. Three caveats limit confidence. First, this pass found no independent replication or adversarial re-test by another group; the visible follow-up commentary is by the authors themselves. Second, the models are small and the forget domains are mostly synthetic. Third, the cost is high. Full distillation from random initialization costs about as much as pretraining, and even UNDO's strongest setting is reported at roughly 60 to 80 percent of retraining compute. The lead author has since argued that cheap post hoc robust unlearning is probably impossible and that distillation works because it comes close to retraining. Earlier robustness claims in this area were broken by stronger attacks. An independent test at larger scale, on pretrained factual knowledge, would settle the matter.
Claim entered the graph