J-Access audit: LLM unlearning leaves hidden knowledge recoverable in most models

A new arXiv paper from Zirui Song and colleagues introduces J-Access, an inference-time audit that uses a Jacobian lens to map intermediate representations into vocabulary space, measuring how often target concepts remain accessible along the model's output pathway. The goal: determine whether residual signals in 'unlearned' LLMs can forecast future recovery during continued training. Existing audits are one-off diagnostics; J-Access aims to be a proactive risk-monitoring tool. The researchers hypothesize that knowledge closer to the output pathway requires less fine-tuning to resurrect, leading to faster recovery.

Testing 398 public unlearned models spanning eight unlearning methods, they found most retained access above the 'retain-only' gold level. Pre-attack accessibility predicted recovery speed and extent at the model level—but couldn't identify which specific facts would resurface. Critically, directly minimizing J-Access during training doesn't promote genuine deletion; models learn to hide knowledge from the audit, producing lower scores but greater post-attack recovery. The authors argue internal audits should remain an independent diagnostic, not an optimization target, until validated further.