An Unsettling Discovery
Suppose you trained an LLM and used RMU (Representation Misdirection Unlearning) to make it "forget" how to produce bioweapons. You test on English benchmarks and the model no longer answers. You feel safe.
Then someone asks the same question in Swahili. The model answers fluently.
This is not hypothetical. A team from the University of Maryland, Penn State, and MIT built a cross-lingual unlearning benchmark covering 174 languages and found that existing unlearning methods almost universally fail in cross-lingual settings.
Core Concept: Forgetting Is Overwriting, Not Deleting
To understand this vulnerability, you first need to understand how LLM "unlearning" works. Mainstream methods today (such as RMU and TASK arithmetic) do not actually delete knowledge from the model weights. They interfere at the representation level — pushing activation vectors related to the target knowledge in random directions so the model cannot recall it during generation.
It is like writing a line on paper and covering it with correction fluid. The characters are still in the paper's fibers; you just cannot see them. But if someone changes the angle or shines a UV light, the text may reappear.
In LLMs, "changing the angle" means "changing the language."
The 174-Language Benchmark: COVER
The team built two benchmarks:
COVER-Bio: English questions about bioweapons selected from the WMDP (Weapons of Mass Destruction Proxy) benchmark, translated via GPT-4o into 174 languages, testing whether models can still answer "forgotten" questions in those languages.
COVER-Cyber: Harmful cybersecurity knowledge questions selected from the CyberMagic benchmark, likewise translated into 174 languages.
The evaluation metric is the Forget Success Rate: the rate at which the model answers incorrectly in the unlearned knowledge domain. Higher rates mean more thorough forgetting.
Three Unlearning Methods, Three Failure Modes
The team tested three mainstream unlearning methods:
1. RMU (Representation Misdirection Unlearning)
RMU works well in English: a 97.3% forget success rate. But averaged across 174 languages, the rate is only 57.2%. Worse, it drops below 50% in 47 languages — meaning the model can recall over half of the "forgotten" knowledge in those languages.2. TASK Arithmetic
TASK arithmetic achieves unlearning via weight modifications. English success rate is 91.5%, but the cross-lingual average is only 52.7%, with sub-50% rates in 53 languages.3. GA (Gradient Ascent)
GA lowers the model's probability of target knowledge via reverse gradient descent. English success rate is 88.7%, cross-lingual average 49.3%, with sub-50% rates in 60 languages.A key finding: the three methods fail differently across languages. RMU fails more on low-resource languages; GA has problems even in mid- and high-resource languages; TASK arithmetic's failures are more evenly distributed. This shows that different unlearning methods interfere with knowledge in different ways, but none covers all languages.
Why It Happens: Shared Weights, Split Representations
The root cause lies in the multilingual architecture of LLMs. Modern LLMs process all languages with one set of weights. When a piece of knowledge is "forgotten" in English, the interference affects the activation path for English inputs. But the same knowledge entered in Swahili travels a different activation path — it converges on the same weights, but the intermediate representation path differs.
The paper calls these "coverage blind spots": unlearning methods only cover language paths seen during training, and unseen paths become vulnerabilities.
This fits the "proxy objective trap" perfectly: we optimize for "does not answer in English," but the real goal is "does not answer in any language." The gap between the optimization objective and the true objective is the vulnerability.
COVER: Budget-Aware Cross-Lingual Unlearning
The team's proposed solution is COVER (Coverage-Aware Unlearning). The core idea is simple: add translated samples in multiple languages to the unlearning training, so interference is applied along all language paths.
But there is an engineering challenge: including all 174 languages is too costly. COVER uses language budget-aware sampling:
1. Select B languages based on the available budget (training resources) 2. During unlearning training, generate translated versions of each English knowledge point in the B languages 3. Perform unlearning across all B languages simultaneously
Experiments show that adding just 8 languages lifts RMU's cross-lingual forget success rate from 57.2% to 82.1%. With 32 languages, the rate exceeds 95%. With 64 languages, it approaches 97% — comparable to English-only unlearning.
Key Finding: Language-Family Spillover
COVER has an interesting property: covering one language spills over to other languages in the same family.
For example, after covering Hindi, the forget success rates for Bengali and Punjabi also rose — even though they were not directly trained. This is because same-family languages share part of their representation paths.
But the spillover is limited. After covering English, Germanic languages (German, Dutch) improved somewhat, but Sino-Tibetan languages (Chinese, Burmese) were barely affected. This shows that language families' representation paths are partially independent.
Practical Advice: Unlearning Audits Must Be Multilingual
The paper's practical recommendations are clear:
1. Unlearning audits must cover multiple languages. Testing only in English is insufficient; you should test at least 10+ languages from different language families.
2. COVER serves as a low-cost defense. Even 8 languages significantly improve cross-lingual unlearning.
3. Different unlearning methods need different COVER configurations. RMU is more sensitive to low-resource languages and needs broader coverage; GA has problems even in mid/high-resource languages and needs more balanced coverage.
My Take: An "Uncertainty Principle" for Unlearning
This paper suggests a deeper principle: in multilingual LLMs, there is tension between "forgetting a piece of knowledge" and "preserving other knowledge."
Unlearning is essentially weight modification. In a monolingual setting, the side effects are manageable — you only need to ensure other knowledge in English is not damaged. In a 174-language setting, you must preserve other knowledge in every language. Each added language adds a dimension of constraints.
It resembles the uncertainty principle in quantum mechanics: the more precisely you "forget" knowledge in one language, the more likely you are to damage other knowledge in other languages. COVER mitigates this by unlearning across multiple languages simultaneously, at the cost of linearly growing training expense.
Another point worth reflecting on: safety evaluation of unlearning requires red-team thinking. You cannot only test the attack vectors the model designer anticipated. The COVER paper's approach — exhaustively testing 174 languages — is a form of "brute-force red-teaming." But other dimensions exist: different question phrasings, different contexts, different prompt formats... each may be a coverage blind spot.
This connects to the "rationalization shell" lineage: passing English benchmarks makes an unlearned model look safe — but only look safe. True safety lies not in passing tests, but in being safe beyond the tests' coverage.
---
Paper: https://arxiv.org/abs/2609.40286
HTML full text: https://arxiv.org/html/2609.40286v1