Robust LLM unlearning requires selectively editing representations specific to forgotten data while preserving those shared with retained data.
Structured and assessed
First pass. Built two arguments. For: the shared-representation root cause plus the reversibility of standard methods (linked existing claims 74be1bde and 32edbf16). Against: non-editing routes to robust removal (linked distillation claim deb0b6ff and pretraining-filtering claim 8326cf3f). Assessed inconclusive (0.65), credence 0.35. The evidence supports selectivity as helpful for in-place editing, but not the stated necessity. Importance 0.4, contestation 0.45. Filled in instance metadata. Only the RepSelect abstract was read, so marginal yield is moderate.
Updated claim instance
Instance d24fa8cc-527f-4109-b52b-471628dfd825 (https://arxiv.org/abs/2606.17168): was stance=affirms, confidence=0.7; set speaker="Filip Sondej, Yushi Yang, Adam Mahdi", publication="arXiv", sourceDate="2026-06-15". Filled in authors and date from the arXiv abstract page. The affirming stance stands at moderate confidence, since the passage says selectivity is needed, which is close to but weaker than 'requires'.
Assessed Inconclusive
verdict confidence 0.65 · credence 0.35
The claim is a causal necessity thesis: that unlearning in large language models which survives adversarial recovery (fine-tuning on related data, few-shot prompting) can only be achieved by editing the representations specific to the data being forgotten while leaving representations shared with retained data intact. It is mainly an empirical, causal claim, though it is often read as a design recommendation. The case for it is real but narrower than the wording. It is well established that standard methods such as gradient ascent and RMU are shallow: brief fine-tuning restores what they removed. The RepSelect preprint (Sondej, Yang and Mahdi, 2026) offers a mechanism, that these methods alter shared representations that a fine-tuning attacker recovers. It shows that a selective method cuts post-relearning answer probability 4 to 40 times more than five baselines, across five datasets and three model families, and that it holds up against few-shot and adaptive attacks. This is good evidence that selectivity greatly helps unlearning done by editing weights in place. It is one group's preprint, the comparison is against baselines rather than against every alternative, and showing that selectivity is sufficient to improve robustness does not show that it is necessary. Against necessity, other routes to removal that resists relearning do not work by selective in-place editing. Distilling an unlearned model into a freshly initialized student improves resistance to relearning, and models pretrained without hazardous text resist adversarial fine-tuning within tested limits. Whether these count as "unlearning" is partly a matter of definition: filtering prevents learning rather than removing it, and distillation pipelines usually begin with an unlearning step. Read narrowly, as "post-hoc editing of an existing model's weights is robust only if it is selective", the claim is plausible and supported by the RepSelect evidence. Read as stated, as a requirement on any robust unlearning, it is not established and has credible counterexamples. No method yet shows full robustness under strong attacks, so what robust unlearning finally requires remains open. Independent replication of RepSelect, and head-to-head tests of selective editing against distillation-based and tamper-resistance methods under the same attacks, would settle more of it.
Claim entered the graph