15. Subspace Projection for Targeted Concept Erasure in Open-Weight Language Models with Retention of Related Capabilities

Executive Summary Working Title: Null-Space Oblique Concept Erasure with Locality-Preserving KL Bounds in Open-Weight LLMs

Open-weight Language Models (Llama-3, Qwen-2.5, Mistral) store vast factual and procedural knowledge distributed across their residual stream and MLP weight matrices. When model developers need to remove dual-use hazardous capabilities (e.g., pathogen synthesis on the WMDP benchmark, Li et al., ICML 2024), copyrighted text, or private entities without retraining from scratch, two competing failures emerge: (1) Superficial Erasure (Jailbreak / Probe Recovery): gradient-based unlearning or safety refusal tuning merely suppresses surface tokens while leaving the underlying representation intact (Łucki et al., 2024), so adversarial prompting or 5-shot fine-tuning immediately recovers the capability; and (2) Collateral Capability Destruction: aggressive representation scrambling erases not just the target concept $\mathcal{D}_{\text{forget}}$, but also closely entangled benign capabilities $\mathcal{D}_{\text{retain}}$ (e.g., destroying general Python subprocess coding when trying to erase exploit payloads). In this topic, I investigate Generalized Contrastive Subspace Projection, deriving a closed-form oblique projector folded directly into MLP weights $W_{\text{down}}$ that zeroes out directions of high forget-to-retain variance ratio.

Tags: #Concept Erasure #Machine Unlearning #AI Safety #Subspace Projection #LEACE / RMU #Mechanistic Interpretability

Research Motivation & Feasibility

Ambitious and mathematically elegant AI-safety research direction. Proving that a concept is truly erased (against adversarial re-elicitation / multi-turn probes) while preserving closely adjacent benign capabilities (e.g., erasing bioweapon synthesis while retaining undergraduate virology) is notoriously difficult.

Core Identified Research Gap

Linear concept erasure methods like LEACE (Belrose et al., NeurIPS 2023) guarantee zero linear decodability at a single layer, but subsequent nonlinear MLP blocks can reconstruct the concept from correlated proxy features—while gradient-ascent unlearning methods (RMU, Li et al., ICML 2024) suffer from 'collateral capability spillover' that degrades performance on closely related benign topics.

Basic Information

Field	Details
Core Focus	Ambitious Mechanistic AI Safety & Unlearning Topic
Final Research Title	Subspace Projection for Targeted Concept Erasure in Open-Weight Language Models with Retention of Related Capabilities
Working Title	Contrastive Generalized-Eigenvalue Weight Projection for Surgical Concept Erasure in LLMs
Research Area	AI Safety, Mechanistic Interpretability & Machine Unlearning
Subfield	Representation Engineering & Weight-Space Concept Erasure
Target Academic Level	PhD Track / Research-Intensive MSc
Current Status	Honest High-Risk / High-Reward Safety Exploration

Idea Summary

2.1 One-Sentence Core Thesis

Compute the generalized eigenvectors of the forget-concept activation covariance $\boldsymbol{\Sigma}_F$ relative to the adjacent retain-concept covariance $\boldsymbol{\Sigma}_R$ across mid-layer MLP outputs, and fold an oblique null-space projection directly into $W_{\text{down}}$ to surgically erase target knowledge while bounding KL divergence on entangled benign tasks.

2.2 Research Motivation & Strategic Fit

Why It's Fascinating: Uses pure linear algebra (generalized Rayleigh quotients, oblique projections, SVD—closely linked to LoRA: Mathematical Foundations) to edit LLM weights in minutes without unstable SGD unlearning loops!
Honest Feasibility & Scope: AI safety unlearning is an active research area where guarantees are notoriously difficult to maintain. Recent papers (Lynch et al., 2024; Łucki et al., 2024) demonstrated that almost all weight-space unlearning methods can be partially circumvented if an attacker has white-box access to fine-tune the model on 50 examples, or else the model suffers perplexity degradation on adjacent topics. Because proving permanent erasure is an open philosophical and empirical battleground, I treat this as an exploratory, high-ambition direction alongside our more self-contained systems and reliability topics.

Problem Exploration & Identified Research Gap

3.1 Why Orthogonal Projection and Gradient Unlearning Spill Over

Suppose $\mathbf{u}_F \in \mathbb{R}^d$ is the principal activation direction of a hazardous biology concept and $\mathbf{u}_R \in \mathbb{R}^d$ is the principal direction of benign undergraduate virology. Because both share vocabulary and domain structure, their cosine similarity is high ($\mathbf{u}_F^\top \mathbf{u}_R \approx 0.65$).

1
Orthogonal Projection ($I - \mathbf{u}_F \mathbf{u}_F^\top$) Destroys $\mathbf{u}_R$: Projecting activations orthogonally to $\mathbf{u}_F$ removes $\cos^2(\theta) \approx 42\%$ of the signal along the benign direction $\mathbf{u}_R$, causing the LLM to fail standard college biology exams!
2
RMU (Representation Misdirection for Unlearning, Li et al., ICML 2024): Pushes $\mathcal{D}_{\text{forget}}$ activations toward a random vector $\mathbf{c}_{\text{rand}}$ via SGD while penalizing $\|\mathbf{h}_{\text{retain}} - \mathbf{h}_{\text{orig}}\|_2^2$, which requires sensitive hyperparameter tuning per layer and often leaves residual knowledge in unedited layers.

3.2 Explicit Research Gap

LEACE (Belrose et al., NeurIPS 2023) derives an oblique concept scrubber for linear classification probes at a single layer, whileROME/MEMIT (Meng et al., NeurIPS 2022) edits individual subject-object point facts. *There is a clear gap for a closed-form, multi-layer contrastive covariance projection folded into MLP weight matrices $W_{\text{down}}^{(\ell)}$ that explicitly solves the generalized Rayleigh quotient between Forget and Adjacent-Retain second-order statistics to prevent collateral capability spillover.*

Proposed Research Direction

4.1 Mathematical Formulation: Generalized Rayleigh Contrastive Projection

At each middle Transformer layer $\ell \in [\ell_{\text{start}}, \ell_{\text{end}}]$ (typically layers $8\text{–}20$ of a 32-layer 7B/8B model), we collect post-SwiGLU MLP intermediate activations $\mathbf{z}^{(\ell)}(x) \in \mathbb{R}^{d_{\text{ff}}}$ over:

Target Forget Corpus $\mathcal{D}_F$: empirical covariance $\boldsymbol{\Sigma}_F^{(\ell)} = \mathbb{E}_{x \in \mathcal{D}_F}[\mathbf{z}^{(\ell)}(x) \mathbf{z}^{(\ell)}(x)^\top]$.
Entangled Adjacent Retain Corpus $\mathcal{D}_R$ + General Corpus $\mathcal{D}_G$: regularized retain covariance $\boldsymbol{\Sigma}_R^{(\ell)} = \mathbb{E}_{x \in \mathcal{D}_R \cup \mathcal{D}_G}[\mathbf{z}^{(\ell)}(x) \mathbf{z}^{(\ell)}(x)^\top] + \lambda \mathbf{I}$.

We seek a rank-$r$ subspace $\mathbf{U}_\ell \in \mathbb{R}^{d_{\text{ff}} \times r}$ that maximizes energy on $\mathcal{D}_F$ while minimizing energy on $\mathcal{D}_R$:

$$ \max_{\mathbf{U}_\ell \in \mathbb{R}^{d_{\text{ff}} \times r}} \;\frac{\text{Tr}\big(\mathbf{U}_\ell^\top \boldsymbol{\Sigma}_F^{(\ell)} \mathbf{U}_\ell\big)}{\text{Tr}\big(\mathbf{U}_\ell^\top \boldsymbol{\Sigma}_R^{(\ell)} \mathbf{U}_\ell\big)} $$

By the Generalized Eigenvalue Theorem, the optimal columns of $\mathbf{U}_\ell$ are the top-$r$ eigenvectors of $\big(\boldsymbol{\Sigma}_R^{(\ell)}\big)^{-1} \boldsymbol{\Sigma}_F^{(\ell)}$ with $\mathbf{U}_\ell^\top \boldsymbol{\Sigma}_R^{(\ell)} \mathbf{U}_\ell = \mathbf{I}_r$! We then construct the $\boldsymbol{\Sigma}_R$-Orthogonal Oblique Projector:

$$ \mathbf{P}_{\text{erase}}^{(\ell)} = \mathbf{U}_\ell \big(\mathbf{U}_\ell^\top \boldsymbol{\Sigma}_R^{(\ell)} \mathbf{U}_\ell\big)^{-1} \mathbf{U}_\ell^\top \boldsymbol{\Sigma}_R^{(\ell)}, \qquad W_{\text{down}}^{(\ell),\text{new}} \leftarrow W_{\text{down}}^{(\ell)} \big(\mathbf{I} - \mathbf{P}_{\text{erase}}^{(\ell)}\big) $$

Because $\mathbf{P}_{\text{erase}}^{(\ell)}$ is folded directly into $W_{\text{down}}^{(\ell)}$, the edited model has identical architecture and zero inference overhead, and minimizes expected squared perturbation $\mathbb{E}_{\mathcal{D}_R}\big[\|\Delta h^{(\ell)}\|_2^2\big]$ on the retain distribution!

Interactive Diagram SpecificationMermaid Flow / Schedule

flowchart LR
    DF["Target Forget Set D_F<br/>(e.g., WMDP-Bio / Entity)"] --> COVF["Collect MLP Covariance Σ_F^(l)"]
    DR["Adjacent Retain Set D_R<br/>(e.g., College Biology / MMLU)"] --> COVR["Collect Retain Covariance Σ_R^(l)"]
    COVF & COVR --> GEVD["Generalized Eigenvalue Solver<br/>(Σ_R)^(-1) Σ_F u_i = λ_i u_i"]
    GEVD --> PROJ["Fold Oblique Null-Space Projector<br/>W_down^(l) ← W_down^(l) (I - P_erase)"]
    PROJ --> EVAL["Audit Erasure vs. Adjacent Retention<br/>& Linear/Multi-Turn Probe Resistance"]

Preliminary Technical Plan

Models: Llama-3.1-8B-Instruct or Mistral-7B-Instruct-v0.3 / zephyr-7b-beta (standard WMDP baseline).
Benchmarks:

1
WMDP-Bio & WMDP-Cyber (Forget accuracy target: $\approx 25\%$ random-guessing baseline on 4-choice MCQs) paired with MMLU-College-Biology, MMLU-Virology, and MMLU-Computer-Security (Adjacent Retain accuracy target: $< 1.5\%$ drop) and general MT-Bench / WikiText perplexity.
2
RWKU (Real-World Knowledge Unlearning): Erasing specific famous entities while testing neighboring entities in the same profession.

Baselines: Gradient Ascent (GA), Negative Preference Optimization (NPO, Zhang et al., 2024), RMU (Li et al., ICML 2024), and Orthogonal PCA Projection ($\boldsymbol{\Sigma}_R = \mathbf{I}$).
Robustness Audits:
White-box Linear Probing across all 32 layers after erasure.
5-Shot In-Context Re-Elicitation & GCG/AutoDAN prompt perturbations.

Expected Contributions

1
Closed-Form Contrastive Oblique Weight Projection: Proves mathematically and empirically why orthogonal projection ($\boldsymbol{\Sigma}_R = \mathbf{I}$) destroys adjacent capabilities and how $\boldsymbol{\Sigma}_R$-oblique projection preserves them.
2
Transparent Spillover-vs-Erasure Pareto Frontier: Sweeping eigenvalue cutoff $\lambda_{\min}$ traces a clean, hyperparameter-stable Pareto curve between Forget suppression and Adjacent-Retain preservation.

Feasibility, Scope, and Honest Risks

Feasibility: Collecting forward-pass covariances on 2,000 passages and computing Cholesky/SVD projections on layers $8\text{–}20$ takes $< 30$ minutes on a single 24GB GPU!
Main Risk & Honest Boundary: If an adversary fine-tunes all weights of the open-weight model with LoRA on $\mathcal{D}_F$, any linear weight projection can eventually be undone because $\text{rank}(W_{\text{down}}^{\text{new}})$ is only reduced by $r \ll d$. Therefore, the thesis scope must explicitly state that our threat model targets representation erasure against inference-time elicitation, linear probing, and benign capability spillover, not cryptographic irreversibility against full weight retraining.

Initial Literature Notes

[1]
N. Belrose et al., "LEACE: Perfect Linear Concept Erasure in Closed Form," NeurIPS, 2023.
[2]
N. Li et al., "The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning (RMU)," ICML, 2024.
[3]
R. Zhang et al., "Negative Preference Optimization (NPO): From Catastrophic Collapse to Effective Unlearning," COLM, 2024.
[4]
J. Łucki et al., "An Adversarial Perspective on Machine Unlearning for AI Safety," arXiv:2409.18025, 2024.

Idea Validation Checklist

Threat model and realistic scope clearly bounded (inference/probe erasure + spillover prevention)Verified
Closed-form generalized eigenvalue formulation requires zero unstable SGD unlearning loopsVerified
Evaluated on paired Forget (WMDP-Bio) vs. Entangled Retain (MMLU-College-Biology) splitsVerified
Compare Orthogonal Projection ($\boldsymbol{\Sigma}_R = \mathbf{I}$) vs. Oblique Generalized Projection on RWKU entity erasurePending

Current Assessment

Criterion	Score	My Assessment Notes
Problem clarity	8 / 10	Capability spillover onto adjacent topics is the #1 flaw of current unlearning.
Novelty potential	9 / 10	Generalized Rayleigh oblique projection on MLP weights is mathematically sharp.
Technical feasibility	7 / 10	Cholesky inversion of $d_{\text{ff}} \times d_{\text{ff}}$ ($14336 \times 14336$) requires block/randomized SVD on GPU.
Resource feasibility	9 / 10	Closed-form forward passes + SVD run on 1x 24GB GPU.
Dataset availability	9 / 10	WMDP, TOFU, and RWKU are publicly available on HuggingFace.
Publication potential	8 / 10	Strong fit for ICLR, NeurIPS Safety Track, ICML, or ACL.
Personal interest	8 / 10	Great linear-algebraic complement to my LoRA note (#06).

Next Actions

1
Use randomized subspace iteration (torch.svd_lowrank) to compute the generalized eigenvectors of $(\boldsymbol{\Sigma}_R + \lambda\mathbf{I})^{-1}\boldsymbol{\Sigma}_F$ in $d_{\text{model}} = 4096$ residual space on zephyr-7b-beta.
2
Plot the Pareto curve of WMDP-Bio accuracy vs. MMLU-College-Biology accuracy as rank $r$ varies from $4$ to $128$.

Open Questions and Working Notes

Does applying the oblique projection to the residual stream output of the MLP ($d_{\text{model}} = 4096$, where covariance inversion is $4096 \times 4096$) achieve the same erasure as projecting inside the intermediate SwiGLU dimension ($d_{\text{ff}} = 14336$) at $12\times$ lower matrix inversion cost?