Elamur Research⌕
☰
home / papers / 2026 / BLUR: A Bi-Level Optimization Approach for LLM Unlearning

BLUR: A Bi-Level Optimization Approach for LLM Unlearning

Paper · 2026 · Hadi Reisizadeh, Jinghan Jia, Zhiqi Bu et al.

Summary

Most LLM unlearning methods minimize a weighted sum of a forget loss and a retain loss with a fixed coefficient. This makes it hard to trade off erasing unwanted knowledge against keeping the model useful, because the relative importance of the two goals shifts during training. The authors argue that forgetting should come first and recast unlearning as a bi-level optimization problem:

  • Lower level: finds parameters that minimize the forget loss.
  • Upper level: picks, among those parameters, the one that best preserves utility on retain data.

Their algorithm, BLUR (Bi-Level UnleaRning), takes a descent step on the forget objective and applies the retain update only in the direction orthogonal to the forget gradient. In effect, it reweights the two losses dynamically. The authors give convergence guarantees in the non-convex setting.

Experiments on MUSE (with LLaMA2-7B) and WMDP (with Zephyr-7B-beta) compare BLUR against GA, GradDiff, NGDiff, NPO, SimNPO and RMU. BLUR improves both forgetting and utility, and it is more robust to relearning attacks. This suggests that treating forgetting as a priority yields safer models for privacy and regulatory compliance (e.g., GDPR).

Key points

  • MUSE-News results: BLUR beats state-of-the-art baselines by 19% in unlearning efficacy and 11.7% in model utility.
  • BLUR with RMU losses: combining BLUR with the RMU loss functions (BLUR–RMU) gives 16.6% better unlearning efficacy than RMU while keeping comparable utility.
  • WMDP results: BLUR–RMU reaches 26.9 on Bio and 26.6 on Cyber accuracy, with 57.0 MMLU. RMU scores 31.2, 28.2 and 57.1 on the same metrics. BLUR–NPO reaches 27.6, 26.5 and 48.4.
  • Relearning attack: the unlearned models were fine-tuned on 600 forget-set samples at learning rate 1e-5. Afterwards, BLUR-NPO still kept much lower VerbMem/KnowMem on the forget set than NPO, while retain performance was preserved.
  • Generality: BLUR is a general framework that works with different forget losses (NPO, SimNPO, RMU). Verifying that unlearning is complete and irreversible remains an open problem.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of California, Los AngelesLos Angeles · United States99 works · 56,330 citations🎓École Polytechnique Fédérale de LausanneLausanne · Switzerland48 works · 7,352 citations🎓Michigan State UniversityEast Lansing · United States30 works · 1,375 citations🎓University of MinnesotaMinneapolis · United States29 works · 2,184 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Hadi Reisizadeh, Jinghan Jia, Zhiqi Bu, Bhanukiran Vinzamuri, Anil Ramakrishna, Kai-Wei Chang, Volkan Cevher, Sijia Liu and Mingyi Hong. 2026. BLUR: A Bi-Level Optimization Approach for LLM Unlearning. Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.eacl-long.331

@inproceedings{reisizadeh2026blur,
  title = {{BLUR: A Bi-Level Optimization Approach for LLM Unlearning}},
  author = {Hadi Reisizadeh, Jinghan Jia, Zhiqi Bu, Bhanukiran Vinzamuri, Anil Ramakrishna, Kai-Wei Chang, Volkan Cevher, Sijia Liu and Mingyi Hong},
  booktitle = {Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.eacl-long.331},
  url = {https://doi.org/10.18653/v1/2026.eacl-long.331}
}

References

53 references, 14 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Clark Barrett, Brad Boyd, Elie Bursztein, Nicholas Carlini, Brad Chen, Jihye Choi, Amrita Roy Chowdhury, Mihai Christodorescu, Anupam Datta, Soheil Feizi, and 1 others. 2023. Identifying and mitigating the security risks of generative ai. Foundations and Trends® in Privacy and Security, 6(1):1–52. find
  2. Reuben Binns. 2018. Fairness in machine learning: Lessons from political philosophy. In Conference on fairness, accountability and transparency, pages 149–159. PMLR. find
  3. Zhiqi Bu, Xiaomeng Jin, Bhanukiran Vinzamuri, Anil Ramakrishna, Kai-Wei Chang, Volkan Cevher, and Mingyi Hong. 2024. Unlearning as multi-task optimization: A normalized gradient difference approach with an adaptive learning rate. arXiv preprint arXiv:2410.22086. find
  4. Tianshi Che, Yang Zhou, Zijie Zhang, Lingjuan Lyu, Ji Liu, Da Yan, Dejing Dou, and Jun Huan. 2023. Fast federated machine unlearning with nonlinear functional theory. In International conference on machine learning, pages 4241–4268. PMLR. find
  5. Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Mathias Humbert, and Yang Zhang. 2022. Graph unlearning. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 499–513. find
  6. Mathieu Dagréou, Pierre Ablin, Samuel Vaiter, and Thomas Moreau. 2022. A framework for bilevel optimization that enables stochastic and global variance reduction algorithms. Advances in Neural Information Processing Systems, 35:26698–26710. find
  7. Stephan Dempe, Nguyen Dinh, Joydeep Dutta, and Tanushree Pandit. 2021. Simple bilevel programming and extensions. Mathematical Programming, 188:227–253. find
  8. Vineeth Dorna, Anmol Mekala, Wenlong Zhao, Andrew McCallum, Zachary C Lipton, J Zico Kolter, and Pratyush Maini. 2025. Openunlearning: Accelerating llm unlearning via unified benchmarking of methods and metrics. arXiv preprint arXiv:2506.12618. — [arXiv:2506.12618](https://arxiv.org/abs/2506.12618) find
  9. Joydeep Dutta and Tanushree Pandit. 2020. Algorithms for simple bilevel programming. Bilevel Optimization: Advances and Next Challenges, pages 253–291. find
  10. Ronen Eldan and Mark Russinovich. 2023. Who’s harry potter? approximate unlearning in llms. Preprint, arXiv:2310.02238.
  11. Chongyu Fan, Jiancheng Liu, Licong Lin, Jinghan Jia, Ruiqi Zhang, Song Mei, and Sijia Liu. 2024. Simplicity prevails: Rethinking negative preference optimization for llm unlearning. arXiv preprint arXiv:2410.07163. — [arXiv:2410.07163](https://arxiv.org/abs/2410.07163) find
  12. Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. 2023. Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508. — [arXiv:2310.12508](https://arxiv.org/abs/2310.12508) find
  13. Chelsea Finn, Pieter Abbeel, and Sergey Levine. 2017. Model-agnostic meta-learning for fast adaptation of deep networks. In International conference on machine learning, pages 1126–1135. PMLR.
  14. Luca Franceschi, Paolo Frasconi, Saverio Salzo, Riccardo Grazzi, and Massimiliano Pontil. 2018. Bilevel programming for hyperparameter optimization and meta-learning. In International conference on machine learning, pages 1568–1577. PMLR. find
  15. Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. 2023. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2426–2436. find
  16. Leo Gao, Jonathan Tow, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Kyle McDonell, Niklas Muennighoff, and 1 others. 2021. A framework for few-shot language model evaluation. Version v0. 0.1. Sept, 10:8– 9. find
  17. GDPR GDPR. 2016. General data protection regulation. Regulation (EU), 679. find
  18. Shengyuan Hu, Yiwei Fu, Steven Wu, and Virginia Smith. 2024. Jogging the memory of unlearned models through targeted relearning attacks. In ICML 2024 Workshop on Foundation Models in the Wild. find
  19. Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2022. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089.
  20. Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. 2022. Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504.
  21. Kaiyi Ji, Junjie Yang, and Yingbin Liang. 2021. Bilevel optimization: Convergence analysis and enhanced design. In International conference on machine learning, pages 4882–4892. PMLR. find
  22. Jinghan Jia, Jiancheng Liu, Yihua Zhang, Parikshit Ram, Nathalie Baracaldo, and Sijia Liu. 2024. Wagle: Strategic weight attribution for effective and modular unlearning in large language models. arXiv preprint arXiv:2410.17509. — [arXiv:2410.17509](https://arxiv.org/abs/2410.17509) find
  23. Ruichen Jiang, Nazanin Abolfazli, Aryan Mokhtari, and Erfan Yazdandoost Hamedani. 2023. A conditional gradient-based method for simple bilevel optimization with convex lower-level problem. In International Conference on Artificial Intelligence and Statistics, pages 10305–10323. PMLR. find
  24. Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Søgaard. 2023. Copyright violations and large language models. arXiv preprint arXiv:2310.13771.
  25. Hadas Kotek, Rikker Dockum, and David Sun. 2023. Gender bias and stereotypes in large language models. In Proceedings of The ACM Collective Intelligence Conference, pages 12–24. find
  26. Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, and 1 others. 2024. The wmdp benchmark: Measuring and reducing malicious use with unlearning. arXiv preprint arXiv:2403.03218.
  27. Bo Liu, Qiang Liu, and Peter Stone. 2022. Continual learning and private unlearning. In Conference on Lifelong Learning Agents, pages 243–254. PMLR. find
  28. Gaoyang Liu, Xiaoqiang Ma, Yang Yang, Chen Wang, and Jiangchuan Liu. 2020. Federated unlearning. arXiv preprint arXiv:2012.13891. — [arXiv:2012.13891](https://arxiv.org/abs/2012.13891) find
  29. Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. 2024. Towards safer large language models through machine unlearning. arXiv preprint arXiv:2402.10058.
  30. Jakub Łucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Tramèr, and Javier Rando. 2024. An adversarial perspective on machine unlearning for ai safety. arXiv preprint arXiv:2409.18025. — [arXiv:2409.18025](https://arxiv.org/abs/2409.18025) find
  31. Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. 2024. Eight methods to evaluate robust unlearning in llms. arXiv preprint arXiv:2402.16835. — [arXiv:2402.16835](https://arxiv.org/abs/2402.16835) find
  32. Dougal Maclaurin, David Duvenaud, and Ryan Adams. 2015. Gradient-based hyperparameter optimization through reversible learning. In International conference on machine learning, pages 2113–2122. PMLR. find
  33. Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C. Lipton, and J. Zico Kolter. 2024. Tofu: A task of fictitious unlearning for llms. Preprint, arXiv:2401.06121.
  34. Fabio Motoki, Valdemar Pinho Neto, and Victor Rodrigues. 2023. More human than human: Measuring chatgpt political bias. Available at SSRN 4372349. find
  35. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D Manning, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. arXiv preprint arXiv:2305.18290.
  36. Jeffrey Rosen. 2011. The right to be forgotten. Stan. L. Rev. Online, 64:88. find
  37. Shoham Sabach and Shimrit Shtern. 2017. A first order method for solving convex bilevel optimization problems. SIAM Journal on Optimization, 27(2):640– 660. find
  38. Bhavika Sachdeva, Harshita Rathee, Arun Sharma, Witold Wydmański, and 1 others. 2024. Machine unlearning for recommendation systems: An insight. arXiv preprint arXiv:2401.10942. — [arXiv:2401.10942](https://arxiv.org/abs/2401.10942) find
  39. Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. 2021. Remember what you want to forget: Algorithms for machine unlearning. Advances in Neural Information Processing Systems, 34:18075–18086. find
  40. Lingqing Shen, Nam Ho-Nguyen, and Fatma Kılınç-Karzan. 2023. An online convex optimization-based framework for convex bilevel optimization. Mathematical Programming, 198(2):1519–1582. find
  41. Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang. 2024. Muse: Machine unlearning six-way evaluation for language models. arXiv preprint arXiv:2407.06460. find
  42. Ilia Shumailov, Jamie Hayes, Eleni Triantafillou, Guillermo Ortiz-Jimenez, Nicolas Papernot, Matthew Jagielski, Itay Yona, Heidi Howard, and Eugene Bagdasaryan. 2024. Ununlearning: Unlearning is not sufficient for content regulation in advanced generative ai. arXiv preprint arXiv:2407.00106. — [arXiv:2407.00106](https://arxiv.org/abs/2407.00106) find
  43. Bradly Stadie, Lunjun Zhang, and Jimmy Ba. 2020. Learning intrinsic rewards as a bi-level optimization problem. In Conference on Uncertainty in Artificial Intelligence, pages 111–120. PMLR. find
  44. Lichao Sun, Yue Huang, Haoran Wang, Siyuan Wu, Qihui Zhang, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, Xiner Li, and 1 others. 2024. Trustllm: Trustworthiness in large language models. arXiv preprint arXiv:2401.05561.
  45. Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. 2022. Unrolling sgd: Understanding factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 303–319. IEEE. find
  46. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, and 1 others. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288.
  47. Also, under Assumption 1, for every θ ∈ R d , we get (b) ∥u(θ)∥ ≤ C 1 , (c) ξ(θ)∥∇f (θ)∥ 2 ≤ γ∥∇f (θ)∥ 2 + C∥∇f (θ)∥, (d) ξ(θ)⟨∇f (θ), u(θ)⟩≤ γ 2 ∥∇f (θ)∥ 2 +Cγ∥∇f (θ)∥, (e) ⟨∇r(θ), u(θ)⟩ ≥ ∥u(θ)∥ 2 − γ 2 ∥∇f (θ)∥ 2 − Cγ∥∇f (θ)∥, Jiulin Wang, Xu Shi, and Rujun Jiang. 2024. Near-optimal convex simple… find
  48. Jiaxin Wen, Pei Ke, Hao Sun, Zhexin Zhang, Chengfei Li, Jinfeng Bai, and Minlie Huang. 2023. Unveiling the implicit toxicity in large language models. In The 2023 Conference on Empirical Methods in Natural Language Processing.
  49. −⟨∇f (θ),∇r(θ)⟩ where ξ(θ) := γ∥∇f (θ)∥ ∥∇f . (θ)∥ 2 Proof. From the definition of ξ(θ) and u(θ) in (10), we have ⟨∇f (θ), u(θ)⟩ = ⟨∇f (θ), ∇r(θ)⟩ + ξ(θ)∥∇f (θ)∥ 2 = ⟨∇f (θ),∇r(θ)⟩+γ∥∇f (θ)∥ 2 −⟨∇r(θ),∇r(θ)⟩ = γ∥∇f (θ)∥ 2 , Kun Wu, Jie Shen, Yue Ning, Ting Wang, and Wendy Hui Wang. 2023. Certified e… — [arXiv:2302.06676](https://arxiv.org/abs/2302.06676) find
  50. ≤ \|ξ(θ)\|∥∇f (θ)∥ + ∥∇r(θ)∥ \| ⟨∇f (θ), ∇r(θ)⟩ \| + ∥∇r(θ)∥ ≤ γ∥∇f (θ)∥ + ∥∇f (θ)∥ Yuanshun Yao, Xiaojun Xu, and Yang Liu. 2023. Large language model unlearning. arXiv preprint arXiv:2310.10683.
  51. Siliang Zeng, Chenliang Li, Alfredo Garcia, and Mingyi Hong. 2023. When demonstrations meet generative world models: A maximum likelihood framework for offline inverse reinforcement learning. Advances in Neural Information Processing Systems, 36:65531– 65565. find
  52. ∥ξ(θ)∇f (θ) + ∇r(θ)∥ (a) ≤ γ∥∇f (θ)∥ + 2∥∇r(θ)∥ ≤ (2 + γ)C, where (a) follows from the Cauchy-Schwartz inequality and the last step holds due to the Assumption 1. To prove part (c), using the Cauchy-Schwartz inequality, we get ξ(θ)∥∇f (θ)∥ 2 = γ∥∇f (θ)∥ 2 −⟨∇f (θ), ∇r(θ)⟩ Ruiqi Zhang, Licong Lin, Yu… — Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning
  53. Yimeng Zhang, Xin Chen, Jinghan Jia, Yihua Zhang, Chongyu Fan, Jiancheng Liu, Mingyi Hong, Ke Ding, and Sijia Liu. 2024b. Defensive unlearning with adversarial training for robust concept erasure in diffusion models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/reisizadeh-2026-blur-bi-level-optimization-approach/