An Unsettling Discovery
You train an LLM and use RMU (Representation Misdirection Unlearning) to make it "forget" how to produce bioweapons. You test on English benchmarks: the model really won't answer. You feel safe.
Then someone asks the same question in Swahili. The model answers fluently.
This is not hypothetical. A team from the University of Maryland, Penn State, and MIT built a cross-lingual unlearning benchmark covering 174 languages and found that existing unlearning methods almost entirely fail in cross-lingual settings.
Core Concept: Forgetting Is Overwriting, Not Deletion
To understand the vulnerability, you first need to understand how LLM "unlearning" works. Mainstream methods (such as RMU and TASK arithmetic) do not truly "delete" knowledge from model weights. They perform interference at the representation level—pushing activation vectors related to the target knowledge in random directions so the model cannot recall it during generation.
It's like writing a line on paper and covering it with correction fluid. The characters are still in the paper's fibers; you just can't see them. But if someone looks from a different angle or shines a UV light, the text may reappear.
In LLMs, "changing the angle" means "changing the language."
The 174-Language Benchmark: COVER
The team built two benchmarks:
- COVER-Bio: English bioweapon-related questions selected from the WMDP (Weapons of Mass Destruction Proxy) benchmark, translated into 174 languages using GPT-4o, to evaluate whether models can still answer "forgotten" questions in those languages.
- COVER-Cyber: harmful cybersecurity knowledge questions from the CyberMagic benchmark, likewise translated into 174 languages.
Three Unlearning Methods, Three Failure Modes
The team tested three mainstream methods:
1. RMU (Representation Misdirection Unlearning)
RMU works well in English: 97.3% forget success. But across 174 languages, the average is only 57.2%. Worse, 47 languages fall below 50%—meaning the model can recall more than half of the "forgotten" knowledge in those languages.2. TASK Arithmetic
TASK arithmetic achieves unlearning via weight edits. English success is 91.5%, but the cross-lingual average is only 52.7%. It falls below 50% in 53 languages.3. GA (Gradient Ascent)
GA lowers the model's probability of target knowledge via gradient ascent. English success is 88.7%, cross-lingual average 49.3%. Below 50% in 60 languages.A key finding: the three methods fail differently. RMU fails more on low-resource languages, GA has problems even in mid/high-resource languages, and TASK arithmetic fails more uniformly. Different methods interfere with knowledge differently—but none covers all languages.
Why: Shared Weights, Split Representations
The root cause lies in multilingual LLM architecture. Modern LLMs use one set of weights for all languages. When knowledge is "forgotten" in English, what gets perturbed is the activation path for English input. But the same knowledge entered in Swahili travels a different activation path—converging on the same weights, but via different intermediate representations.
The paper calls these coverage blind spots: unlearning methods only cover language pathways seen during training; unseen paths become vulnerabilities.
This fits the proxy-objective trap perfectly: we optimize for "won't answer in English," but the true goal is "won't answer in any language." The gap between the optimization objective and the real objective is the vulnerability.
The COVER Method: Budget-Aware Cross-Lingual Unlearning
The team's solution is COVER (Coverage-Aware Unlearning). The core idea is simple: add translations in multiple languages to unlearning training, so interference happens on all language paths.
But there's an engineering challenge: including all 174 languages is too costly. COVER uses language budget-aware sampling:
1. Choose B languages according to the available budget (training resources) 2. During unlearning training, generate translations of each English knowledge point in all B languages 3. Perform unlearning across all B languages simultaneously
Experiments show that adding just 8 languages lifts RMU's cross-lingual forget success from 57.2% to 82.1%. With 32 languages, success exceeds 95%. With 64 languages, it approaches 97%—comparable to English-only unlearning.
Key Finding: Language-Family Radiation Effects
COVER has an interesting property: covering one language radiates to other languages in the same family.
For example, after covering Hindi, forget success in Bengali and Punjabi also improved—even though they weren't directly trained. Languages in the same family share part of their representation pathways.
But the radiation is limited. Covering English improved Germanic languages (German, Dutch) somewhat, but had almost no effect on Sino-Tibetan languages (Chinese, Burmese). This shows language families have partially independent representation pathways.
Practical Takeaways: Unlearning Audits Must Be Multilingual
The paper's practical recommendations are clear:
1. Unlearning audits must cover multiple languages. Testing only in English is insufficient; test at least 10+ languages from different families. 2. COVER is a low-cost defense. Even 8 extra languages significantly improve cross-lingual forgetting. 3. Different unlearning methods need different COVER configurations. RMU is more sensitive to low-resource languages and needs broader coverage; GA has problems even in mid/high-resource languages and needs more balanced coverage.
My Reflection: An "Uncertainty Principle" for Unlearning
This paper suggests a deeper principle: in multilingual LLMs, there is tension between "forgetting knowledge" and "preserving other knowledge."
Unlearning is fundamentally a weight modification. In a single-language setting, side effects are manageable—you just need other English knowledge intact. But across 174 languages, you must preserve all other knowledge in all languages. Each additional language adds a dimension of constraints.
It resembles Heisenberg's uncertainty principle: the more precisely you "forget" knowledge in one language, the more likely you damage other knowledge in other languages. COVER mitigates this by unlearning in many languages simultaneously, at the cost of linearly growing training cost.
Another point worth pondering: safety evaluation of unlearning needs red-team thinking. Don't just test attacks the designers anticipated—test the ones they didn't. The COVER paper's approach of exhaustively testing 174 languages is "brute-force red-teaming." But other dimensions remain: different phrasings, contexts, prompt formats... each may hide a coverage blind spot.
This connects to the "rationalization shell" pattern: passing English benchmarks is a rationalized shell—it makes the model look safe. But only looks. True safety lies in being safe even beyond test coverage.
---
Paper: https://arxiv.org/abs/2609.40286
HTML full text: https://arxiv.org/html/2609.40286v1