The Quantization Gap in Machine Unlearning: Why Forgotten Knowledge Returns in Deployed Models

Introduction

Machine unlearning has emerged as a critical safety primitive for large language models, driven by regulatory requirements such as the EU AI Act and the practical necessity of removing hazardous knowledge ranging from biosecurity protocols to cyberweapon designs. Yet a fundamental disconnect persists between how researchers evaluate unlearning and how models are actually deployed. In their paper "Forgetting That Sticks: Quantization-Permanent Unlearning via Circuit Attribution," Sadhu, Seth, and Sankarapu identify a systematic failure in standard evaluation protocols. The field predominantly measures unlearning efficacy in full precision (BF16) immediately after training, despite the reality that virtually every deployed language model undergoes 4-bit post-training quantization (PTQ) using formats such as NF4, GPTQ, or AWQ to reduce memory footprints by 4× and inference costs by 2–3×. This oversight is not merely methodological; it is catastrophic for safety. The authors demonstrate that standard gradient-based unlearning methods, which appear successful in full precision, suffer complete reversal under NF4 quantization, with forgotten knowledge recovering up to 83% of its original accuracy. This finding reveals that behavioral suppression in high precision is an inadequate proxy for durable knowledge removal.

The Structural Mechanics of Quantization Collapse

The paper documents a dual failure mode that affects all existing unlearning methodologies. Gradient-based approaches such as gradient ascent or preference optimization variants achieve meaningful forgetting in BF16, reducing accuracy on forget sets like WMDP-bio by significant margins. However, when subjected to NF4 quantization, these methods exhibit PTQ recovery gaps of +0.05 to +0.07, effectively returning the model to its pre-unlearning state. Conversely, methods that survive quantization do so only by minimizing parameter changes, resulting in forget-set accuracy reductions of merely 1.6 percentage points, which falls within measurement variance for multiple-choice benchmarks.

The root cause lies in the geometry of high-dimensional optimization versus the discrete nature of low-precision representation. For a model like Llama-3.1-8B with approximately 8×10⁹ parameters, even large norm gradients distribute updates across billions of dimensions, yielding per-parameter changes on the order of 10⁻⁶. The NF4 quantization bin width, however, is approximately 8.4×10⁻⁴. Consequently, standard updates fall 47–828× below the quantization threshold, causing them to round to zero during compression. This creates a sparsity-permanence tradeoff: updates diffuse across the full parameter space cannot clear quantization bin boundaries, while concentrated updates that might survive compression are precluded by the global nature of gradient objectives. The authors formalize this in Proposition 1, establishing that distributing updates uniformly across d parameters necessarily results in quantization failure for any realistic unlearning target.

Circuit Attribution and Construction Guarantees

To resolve this tradeoff, the authors propose MANSU (Mechanistic-Aligned Null-Space Unlearning), which operationalizes insights from mechanistic interpretability to concentrate updates into sparse, causally relevant subgraphs. The method comprises three integrated components. First, EAP-IG (Edge Attribution Patching with Integrated Gradients) identifies the minimal circuit C responsible for generating forget-set answers, isolating the specific parameters that mechanistically encode the targeted knowledge rather than distributing updates across all d parameters. Second, null-space projection is restricted to this circuit, projecting gradients into the null space of the retain-set Fisher Information matrix. Theorem 1 proves that this circuit-restricted projection yields a provably tighter retain-loss bound than global projection methods, following from the Cauchy interlace theorem. Third, and crucially, MANSU implements a per-parameter magnitude floor, rescaling any cumulative update below the NF4 bin size to guarantee quantization survival by construction, formalized in Lemma 1.

The paper also introduces Circuit Attribution Divergence (CAD), a mechanistic verification metric that distinguishes structural erasure from behavioral suppression. While standard metrics measure only output probabilities or accuracy, CAD traces whether the causal pathways responsible for generating targeted outputs have been dismantled. This distinction is vital; behavioral suppression might mask knowledge that remains latent in the model's weights, whereas structural erasure indicates genuine knowledge deletion. Empirically, MANSU achieves a PTQ gap of −0.040 on Llama-3.1-8B with WMDP-bio, indicating that quantization amplifies rather than reverses the erasure, while preserving MMLU performance within 0.030 of the zero-shot baseline. These results replicate across Qwen-3-8B and the MUSE open-ended memorization benchmark.

Implications for Safety Evaluation and Deployment

Beyond the technical specifics, this work exposes a fundamental misalignment between continuous optimization paradigms and discrete deployment realities. The machine unlearning field has effectively been optimizing for the wrong metric: behavioral suppression in floating-point precision rather than permanent knowledge excision in deployed integer formats. This insight extends beyond unlearning to other safety interventions such as toxicity reduction or alignment tuning, suggesting that any safety method relying on small distributed parameter changes may face similar quantization erosion.

The reliance on circuit attribution, however, introduces computational and conceptual limitations. EAP-IG requires substantial computational resources to trace causal paths through the model, potentially limiting scalability to larger architectures or dynamic knowledge representations. The method assumes that circuits remain static and identifiable, an assumption that may not hold for emergent or distributed knowledge representations. Furthermore, the current analysis focuses exclusively on post-training quantization; other compression modalities such as pruning or knowledge distillation may present distinct challenges that MANSU does not address.

The introduction of CAD represents a significant conceptual advance in verification methodology. Current safety evaluations rely almost exclusively on behavioral benchmarks, which cannot detect latent knowledge that has been suppressed but not erased. CAD offers a pathway toward mechanistic verification protocols that inspect the model's computational graph directly, potentially providing stronger safety guarantees than output monitoring alone.

Conclusion

The findings of "Forgetting That Sticks" necessitate an immediate shift in evaluation standards. The field must adopt quantization-aware protocols as the default for unlearning research, recognizing that full-precision metrics provide misleading signals about deployment safety. Future work should extend circuit-targeted interventions to dynamic knowledge representations and explore integration of unlearning objectives during initial training rather than as post-hoc modifications. As regulatory frameworks tighten and model capabilities expand, ensuring that forgotten knowledge remains forgotten through the quantization pipeline is not merely a technical optimization; it is a prerequisite for trustworthy deployment. The question is no longer whether we can make models forget, but whether that forgetting survives the transition from laboratory precision to the compressed, efficient formats that define real-world AI systems.