Revocable Learned State via Process Sidecars

# Revocable Learned State via Process Sidecars
Source: [https://arxiv.org/html/2606.30788](https://arxiv.org/html/2606.30788)
###### Abstract

Language models are often adapted in stages: a public skill phase, a private memory phase, and a later safety phase that learns to refuse outputs tied to the remembered entities\. Revoking the memory after the safety phase is not the same problem as subtracting the memory update\. The later safety optimizer has transported the memory direction\. We introduce*process sidecars*, a two\-coefficient edit family

θ^​\(λ,γ\)=θA​M​S−λ​ΔM−γ​R^S←M,R^S←M=J^S,ε​\(ΔM\)−ΔM,\\hat\{\\theta\}\(\\lambda,\\gamma\)=\\theta\_\{AMS\}\-\\lambda\\Delta\_\{M\}\-\\gamma\\,\\hat\{R\}\_\{S\\leftarrow M\},\\qquad\\hat\{R\}\_\{S\\leftarrow M\}=\\hat\{J\}\_\{S,\\varepsilon\}\(\\Delta\_\{M\}\)\-\\Delta\_\{M\},whereJ^S,ε\\hat\{J\}\_\{S,\\varepsilon\}is a centered secant through the realized future AdamW safety\-training process\. The implementation usesε=1\\varepsilon=1at the natural memory\-edit scale; it reusesθA​M​S\\theta\_\{AMS\}as the positive endpoint and computes one additional safety trace atθA−ΔM\\theta\_\{A\}\-\\Delta\_\{M\}\. We prove two things\. First, the exact sidecar \(using the true transported directionRS←MR\_\{S\\leftarrow M\}, not the secant estimate\) at\(λ,γ\)=\(1,1\)\(\\lambda,\\gamma\)=\(1,1\)recovers the counterfactual safety\-only oracleθA​S\\theta\_\{AS\}up to second order; the proof treats AdamW as an augmented\-state map over parameters, first moments, and second moments\. Second, this process information is necessary: whenever future safety training bends the memory direction, every scalar task\-arithmetic edit leaves first\-order counterfactual error, while the process\-sidecar edit is second\-order accurate\. Across Qwen\-2\.5\-0\.5B\-Instruct, Qwen\-2\.5\-1\.5B\-Instruct, and Llama\-3\.2\-1B\-Instruct \(twenty trials each\), the validation\-selected 2D edit improves held\-out refusal closure over naive task arithmetic in 60 of 60 trials, and over theγ=λ\\gamma=\\lambdaprocess\-JVP subfamily \(the diagonal slice of the cached 2D grid, 2 of 24 cells\) in 60 of 60 paired trials\. Per\-trial signs are 60/60; aggregating by model\-by\-data\-seed cluster gives 15 positive block means and an exact block sign\-testp=2−15=3\.05×10−5p=2^\{\-15\}=3\.05\\times 10^\{\-5\}\. A locked\-protocol confirmatory replication on never\-seen seeds, with documented sample\-size amendments, reproduces the effect across the three principal scales and a contemporary 8B transformer \(70/7070/70trials; 20 positive model\-by\-data\-seed block means,p=2−20≈9\.5×10−7p=2^\{\-20\}\\approx 9\.5\\times 10^\{\-7\}\)\. Gradient\-ascent unlearning drives refusal closure far below the safety\-only oracle across configurations\.

## 1Introduction

A deployed model rarely has one training history\. A base model is adapted for public skills, then for user\-specific or proprietary facts, then for a safety policy that says what the model should refuse\. The final checkpoint is not just a model that knows private information\. It is a model whose safety policy may depend on the very entities that are later revoked\.

This paper studies that revocation problem\. We are given a final checkpoint

θA→𝑀θA​M→𝑆θA​M​S,\\theta\_\{A\}\\xrightarrow\{\\;M\\;\}\\theta\_\{AM\}\\xrightarrow\{\\;S\\;\}\\theta\_\{AMS\},whereMMis a memory phase andSSis a subsequent safety phase\. The target is the counterfactual oracle

θA​S=TrainS⁡\(θA\),\\theta\_\{AS\}=\\operatorname\{Train\}\_\{S\}\(\\theta\_\{A\}\),the model that would have received the same safety training but never learned the memory\. The deployable revocation service edits the shipped artifactθA​M​S\\theta\_\{AMS\}in place, preserving its trajectory\-specific characteristics \(data ordering, optimizer state evolution, downstream pipeline integration\) that a counterfactually retrained model would not share\. The selector usesθA\\theta\_\{A\},θA​M\\theta\_\{AM\},θA​M​S\\theta\_\{AMS\}, validation data, and one additional safety\-procedure trace; it does not accessθA​S\\theta\_\{AS\}or any test metric\. Our contribution: scalar task arithmetic alongΔM\\Delta\_\{M\}is provably first\-order incomplete whenever the safety phase transports the memory direction, and the ideal process\-JVP sidecar cancels this error to second order\.

The standard weight\-space answer is task arithmetic: subtract the memory deltaΔM=θA​M−θA\\Delta\_\{M\}=\\theta\_\{AM\}\-\\theta\_\{A\}fromθA​M​S\\theta\_\{AMS\}\[Ilharcoet al\.,[2023](https://arxiv.org/html/2606.30788#bib.bib12)\]\. That answer is incomplete\. The memory update is not stored statically after the memory phase\. It is acted on by the later safety optimizer\. IfT=TrainST=\\operatorname\{Train\}\_\{S\}is the realized safety\-training map, then

θA​M​S=T​\(θA\+ΔM\)=θA​S\+D​T​\(θA\)​ΔM\+O​\(‖ΔM‖2\)\.\\theta\_\{AMS\}=T\(\\theta\_\{A\}\+\\Delta\_\{M\}\)=\\theta\_\{AS\}\+DT\(\\theta\_\{A\}\)\\Delta\_\{M\}\+O\(\\left\\lVert\\Delta\_\{M\}\\right\\rVert^\{2\}\)\.To first order in‖ΔM‖\\left\\lVert\\Delta\_\{M\}\\right\\rVert, the direction present in the final model is thereforeD​T​\(θA\)​ΔMDT\(\\theta\_\{A\}\)\\Delta\_\{M\}, notΔM\\Delta\_\{M\}\. Naive task arithmetic silently assumesD​T​\(θA\)=IDT\(\\theta\_\{A\}\)=I\.

Process sidecars estimate this transported direction\. We decompose

D​T​\(θA\)​ΔM=ΔM\+RS←M,RS←M=\(D​T​\(θA\)−I\)​ΔM,DT\(\\theta\_\{A\}\)\\Delta\_\{M\}=\\Delta\_\{M\}\+R\_\{S\\leftarrow M\},\\qquad R\_\{S\\leftarrow M\}=\(DT\(\\theta\_\{A\}\)\-I\)\\Delta\_\{M\},and search the two\-dimensional family

θ^​\(λ,γ\)=θA​M​S−λ​ΔM−γ​R^S←M\.\\hat\{\\theta\}\(\\lambda,\\gamma\)=\\theta\_\{AMS\}\-\\lambda\\Delta\_\{M\}\-\\gamma\\,\\hat\{R\}\_\{S\\leftarrow M\}\.The family contains naive task arithmetic atγ=0\\gamma=0and the process\-JVP line atγ=λ\\gamma=\\lambda\. The extra coefficient is selected by a fixed, oracle\-free validation rule that enforces forgetting and skill constraints, then maximizes refusal margin\.

The empirical separation appears directly in Figure[1](https://arxiv.org/html/2606.30788#S1.F1): across Qwen\-2\.5\-0\.5B\-Instruct, Qwen\-2\.5\-1\.5B\-Instruct, and Llama\-3\.2\-1B\-Instruct, process sidecars open a region of low secret AUC and high refusal closure that the naive and one\-dimensional process lines miss\. Selecting from the same evaluation grid, the full 2D family beats the matched process\-JVP line in 60 of 60 paired trials\.

![Refer to caption](https://arxiv.org/html/2606.30788v1/figures/figure1_refusal_frontier.png)Figure 1:Process sidecars preserve refusal at matched secret\-token distinguishability\. Held\-out test, 20 trials per scale\. Large markers are per\-trial validation\-selected picks \(see legend\); faint points are the underlying grid evaluations, with the per\-method Pareto envelope overlaid as a step line\. Thexx\-axis is the calibrated secret AUC,max⁡\(AUC,1−AUC\)\\max\(\\operatorname\{AUC\},1\-\\operatorname\{AUC\}\), where0\.50\.5means no exploitable rank signal;yyis refusal closure to the oracle \(11matches the safety\-only oracle,0matches the unedited final checkpointθA​M​S\\theta\_\{AMS\}\)\. All three selectors leave only near\-chance secret distinguishability \(≈0\.54\\approx 0\.54\); process\-2D picks attain substantially higher refusal closure \(20/2020/20wins over naive per scale\)\. FT\-unlearn is clipped at the bottom; in\-panel annotations give the per\-trial closure range across all FT\-unlearn evaluations \(six\-config grid plus single\-config seed sweep\), wider than the per\-config min/max in Table[4](https://arxiv.org/html/2606.30788#S5.T4)\.The paper makes three claims\. First, process sidecars are the right first\-order object\. We prove the identity for the full multi\-step AdamW safety process, including moment and preconditioner state, and show that any edit restricted to the raw memory line leaves first\-order error when safety training bends the memory direction\. Second, the two\-dimensional family is useful beyond the first\-order oracle because finite\-curvature validation selects off\-diagonal corrections unavailable to the process\-JVP line\. Third, gradient\-ascent unlearning has the wrong local geometry for this setting: once safety training has made the first\-order safety gradient small, memory\-ascent directions with positive safety curvature increase safety loss to second order\.

## 2Setting and evaluation

The checkpoint sequence isθA→θA​M→θA​M​S\\theta\_\{A\}\\to\\theta\_\{AM\}\\to\\theta\_\{AMS\}\. The memory phaseMMtrains on a private fact setDMD\_\{M\}\. The safety phaseSStrains refusal behavior on prompts tied to the same entities and decoys\. The counterfactual oracle isθA​S=TrainS⁡\(θA\)\\theta\_\{AS\}=\\operatorname\{Train\}\_\{S\}\(\\theta\_\{A\}\), using the same safety data, optimizer schedule, seed, and minibatch order as the observedSSphase\. Conditioning on this realized trace makesT=TrainST=\\operatorname\{Train\}\_\{S\}a deterministic map\.

All experiments use trainable\-coordinate vectors\. For LoRA runs,θ\\thetadenotes the adapter\-coordinate vector; for full\-parameter baselines, it denotes the full trainable vector\. The main runs use LoRA rank 8 on attention and MLP modules\[Huet al\.,[2022](https://arxiv.org/html/2606.30788#bib.bib10)\]\. The memory data are high\-entropy canaries of the formAAA\-1234\-AAA\-1234paired with project identifiers\. The structured\-synthetic canary uses profile\-like records rather than raw token strings\.

We evaluate three quantities\.*Forgetting*is the recoverable\-signal of the true secret token among 31 decoys\. We report calibrated secret AUC,

AUCsecretcal⁡\(θ\)=max⁡\(AUCsecret⁡\(θ\),1−AUCsecret⁡\(θ\)\),\\operatorname\{AUC\}^\{\\mathrm\{cal\}\}\_\{\\mathrm\{secret\}\}\(\\theta\)=\\max\\\!\\big\(\\operatorname\{AUC\}\_\{\\mathrm\{secret\}\}\(\\theta\),\\,1\-\\operatorname\{AUC\}\_\{\\mathrm\{secret\}\}\(\\theta\)\\big\),which equals0\.50\.5when the secret is unrankable above decoys and1\.01\.0under perfect memorization\. Calibrated AUC is the right secrecy metric because rawAUC<0\.5\\operatorname\{AUC\}<0\.5is anti\-ranking, not better forgetting: an adaptive evaluator can flip the score and recover the same signal\.*Refusal preservation*is a signed log\-probability marginm​\(θ\)=log⁡pθ​\(refuse∣prompt\)−log⁡pθ​\(comply∣prompt\)m\(\\theta\)=\\log p\_\{\\theta\}\(\\text\{refuse\}\\mid\\text\{prompt\}\)\-\\log p\_\{\\theta\}\(\\text\{comply\}\\mid\\text\{prompt\}\)between refusal and comply continuations on entity\-tied prompts, reported as closure to the oracle:

closurerefusal​\(θ\)=m​\(θ\)−m​\(θA​M​S\)m​\(θA​S\)−m​\(θA​M​S\),\\mathrm\{closure\}\_\{\\mathrm\{refusal\}\}\(\\theta\)=\\frac\{m\(\\theta\)\-m\(\\theta\_\{AMS\}\)\}\{m\(\\theta\_\{AS\}\)\-m\(\\theta\_\{AMS\}\)\},so closure11means the edit recovers the oracle margin and closure0means it remains atθA​M​S\\theta\_\{AMS\}\. Negative closure means the edit’s refusal margin is belowθA​M​S\\theta\_\{AMS\}\.*Skill retention*is a one\-sidedθA​M​S\\theta\_\{AMS\}\-only score:11if the edit’s public\-skill validation NLL stays within tolerance ofθA​M​S\\theta\_\{AMS\}, decaying linearly above it\. It uses no oracle quantity\. In Table[1](https://arxiv.org/html/2606.30788#S5.T1)we report the calibrated\-AUC gapAUCsecretcal⁡\(θ2​D\)−AUCsecretcal⁡\(θnaive\)\\operatorname\{AUC\}^\{\\mathrm\{cal\}\}\_\{\\mathrm\{secret\}\}\(\\theta\_\{\\mathrm\{2D\}\}\)\-\\operatorname\{AUC\}^\{\\mathrm\{cal\}\}\_\{\\mathrm\{secret\}\}\(\\theta\_\{\\mathrm\{naive\}\}\); values near zero mean the two methods leave the secret comparably distinguishable\. The deployable selector never usesθA​S\\theta\_\{AS\}or test metrics\. It filters candidates by validation secret AUC≤0\.60\\leq 0\.60, skill retention≥0\.90\\geq 0\.90, and refusal preference rate≥0\.99\\geq 0\.99; among feasible candidates it maximizes

log⁡\(1\+max⁡\{0,medit−mA​M​S\}\),\\log\\\!\\big\(1\+\\max\\\{0,\\,m\_\{\\mathrm\{edit\}\}\-m\_\{AMS\}\\\}\\big\),wheremmis the validation refusal margin, and then breaks ties by minimum edit norm\.

## 3Method

#### Estimating the transported memory direction\.

Letu=ΔMu=\\Delta\_\{M\}\. The process\-JVP direction isJS​\(u\)=D​T​\(θA\)​uJ\_\{S\}\(u\)=DT\(\\theta\_\{A\}\)u, a Jacobian\-vector product in the forward\-sensitivity sense\[Pearlmutter,[1994](https://arxiv.org/html/2606.30788#bib.bib26), Maclaurinet al\.,[2015](https://arxiv.org/html/2606.30788#bib.bib20), Lorraineet al\.,[2020](https://arxiv.org/html/2606.30788#bib.bib17)\]\. Computing the exact Jacobian of a full AdamW fine\-tuning run is unnecessary\. We estimate the product by a centered secant through the same future safety\-training procedure:

J^S,ε​\(u\)=T​\(θA\+ε​u\)−T​\(θA−ε​u\)2​ε\.\\hat\{J\}\_\{S,\\varepsilon\}\(u\)=\\frac\{T\(\\theta\_\{A\}\+\\varepsilon u\)\-T\(\\theta\_\{A\}\-\\varepsilon u\)\}\{2\\varepsilon\}\.\(1\)The implementation usesε=1\\varepsilon=1because‖ΔM‖\\left\\lVert\\Delta\_\{M\}\\right\\rVertis the natural scale of the memory edit\. The positive endpoint is the shipped artifact:T​\(θA\+ΔM\)=T​\(θA​M\)=θA​M​ST\(\\theta\_\{A\}\+\\Delta\_\{M\}\)=T\(\\theta\_\{AM\}\)=\\theta\_\{AMS\}, so only the negative endpointT​\(θA−ΔM\)T\(\\theta\_\{A\}\-\\Delta\_\{M\}\)is computed during revocation\. The local theorem in Section[4](https://arxiv.org/html/2606.30788#S4)gives the limiting justification; the experiments evaluate the finite\-scale estimator directly\.

#### The edit family\.

The residual sidecar is

R^S←M=J^S,ε​\(ΔM\)−ΔM\.\\hat\{R\}\_\{S\\leftarrow M\}=\\hat\{J\}\_\{S,\\varepsilon\}\(\\Delta\_\{M\}\)\-\\Delta\_\{M\}\.We search

θ^​\(λ,γ\)=θA​M​S−λ​ΔM−γ​R^S←M\.\\hat\{\\theta\}\(\\lambda,\\gamma\)=\\theta\_\{AMS\}\-\\lambda\\Delta\_\{M\}\-\\gamma\\,\\hat\{R\}\_\{S\\leftarrow M\}\.\(2\)Three subfamilies matter\. Naive task arithmetic isγ=0\\gamma=0\. The process\-JVP line isγ=λ\\gamma=\\lambda, since then the edit subtractsλ​JS​\(ΔM\)\\lambda J\_\{S\}\(\\Delta\_\{M\}\)\. The full 2D family allowsγ\\gammato move independently\.

![Refer to caption](https://arxiv.org/html/2606.30788v1/figures/figure2_natural_coords.png)Figure 2:Natural coordinates for process sidecars\. The process\-JVP line isζ=0\\zeta=0\. The full 2D family can choose an off\-diagonal curvature correction, while naive task arithmetic lies onγ=0\\gamma=0rather than on the process line\.It is cleaner to write the finite\-curvature degrees of freedom as

τ=1−λ,ζ=λ−γ\.\\tau=1\-\\lambda,\\qquad\\zeta=\\lambda\-\\gamma\.In these coordinates the process\-JVP line is exactlyζ=0\\zeta=0\(Figure[2](https://arxiv.org/html/2606.30788#S3.F2)\)\. The raw sign ofγ\\gammahas no invariant meaning; the off\-diagonal coefficient isζ\\zeta\. This matters empirically: at Qwen\-2\.5\-1\.5B\-Instruct the selectedγ\\gammais bimodal, with 14 trials selecting\+2\.0\+2\.0and 6 selecting−0\.5\-0\.5\. The theory predicts trial\-local curvature alignment, not a scale law forγ\\gamma\.

#### Baselines\.

We compare against random norm\-matched edits, naive task arithmetic, the process\-JVP line, gradient\-ascent FT\-unlearning, Negative Preference Optimization\[Zhanget al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib40)\], and the WMDP/RMU base\-parameter code path\[Liet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib16)\]\. RMU updates selected base\-model parameters rather than LoRA adapter coordinates; behavioral metrics are comparable, but weight\-space oracle closure is not reported for that row\.

## 4Theory

Future safety training transports the memory direction\. This section formalizes that transport, shows how the sidecar family recovers the counterfactual safety\-only oracle, and explains why the two\-dimensional family differs from the process\-JVP line at finite scale\.

###### Assumption 1\(Regular fixed safety trace\)\.

The realizedKK\-step AdamW safety\-training trace is fixed: minibatches, dropout masks, optimizer hyperparameters, schedule, and seed are conditioned on\. In a neighborhood ofθA\\theta\_\{A\}, the losses areC3C^\{3\}, clipping decisions do not cross their nonsmooth boundary, and AdamW bias\-corrected second moments on active coordinates stay bounded away from zero\.

###### Theorem 2\(Process\-sidecar identity\)\.

Under Assumption[1](https://arxiv.org/html/2606.30788#Thmtheorem1), letT=TrainST=\\operatorname\{Train\}\_\{S\}be the realized safety\-training map andu=ΔMu=\\Delta\_\{M\}\. Then

θA​M​S=T​\(θA\+u\)=θA​S\+D​T​\(θA\)​u\+O​\(‖u‖2\)\.\\theta\_\{AMS\}=T\(\\theta\_\{A\}\+u\)=\\theta\_\{AS\}\+DT\(\\theta\_\{A\}\)u\+O\(\\left\\lVert u\\right\\rVert^\{2\}\)\.WritingJS​\(u\)=D​T​\(θA\)​uJ\_\{S\}\(u\)=DT\(\\theta\_\{A\}\)uandRS←M=JS​\(u\)−uR\_\{S\\leftarrow M\}=J\_\{S\}\(u\)\-ugives the decomposition and the exact sidecar:

θA​M​S=θA​S\+u\+RS←M\+O​\(‖u‖2\),θA​M​S−u−RS←M=θA​S\+O​\(‖u‖2\)\.\\theta\_\{AMS\}=\\theta\_\{AS\}\+u\+R\_\{S\\leftarrow M\}\+O\(\\left\\lVert u\\right\\rVert^\{2\}\),\\qquad\\theta\_\{AMS\}\-u\-R\_\{S\\leftarrow M\}=\\theta\_\{AS\}\+O\(\\left\\lVert u\\right\\rVert^\{2\}\)\.The empirical estimatorθ^​\(1,1\)\\hat\{\\theta\}\(1,1\)replacesRS←MR\_\{S\\leftarrow M\}with the centered\-secantR^S←M\\hat\{R\}\_\{S\\leftarrow M\}, incurring an additionalO​\(ε2​‖u‖3\)O\(\\varepsilon^\{2\}\\left\\lVert u\\right\\rVert^\{3\}\)secant bias\.

The theorem differentiates the whole training procedure\. For AdamW, which combines Adam\-style moment adaptation with decoupled weight decay\[Kingma and Ba,[2015](https://arxiv.org/html/2606.30788#bib.bib14), Loshchilov and Hutter,[2019](https://arxiv.org/html/2606.30788#bib.bib18)\],D​T​\(θA\)DT\(\\theta\_\{A\}\)is not a single Hessian term\. It is the Jacobian of an augmented map over

zt=\(θt,mt,vt\)\.z\_\{t\}=\(\\theta\_\{t\},m\_\{t\},v\_\{t\}\)\.The appendix gives the exact tangent recursion forθ˙t,m˙t,v˙t\\dot\{\\theta\}\_\{t\},\\dot\{m\}\_\{t\},\\dot\{v\}\_\{t\}, including bias correction, second\-moment sensitivity, decoupled weight decay, and differentiable clipping branches\. This is the process\-level quantity estimated by Equation \([1](https://arxiv.org/html/2606.30788#S3.E1)\)\.

###### Theorem 3\(First\-order necessity of the process sidecar\)\.

Assume additionally that‖D2​T​\(θ\)‖op≤L2\\left\\lVert D^\{2\}T\(\\theta\)\\right\\rVert\_\{\\mathrm\{op\}\}\\leq L\_\{2\}in the local neighborhood\. Letp=D​T​\(θA\)​up=DT\(\\theta\_\{A\}\)u,r=p−ur=p\-u, and letPuP\_\{u\}be Euclidean projection ontospan⁡\{u\}\\operatorname\{span\}\\\{u\\\}\. For the raw task\-arithmetic line

θ^λ=T​\(θA\+u\)−λ​u,\\hat\{\\theta\}\_\{\\lambda\}=T\(\\theta\_\{A\}\+u\)\-\\lambda u,we have

infλ∈ℝ‖θ^λ−T​\(θA\)‖≥‖\(I−Pu\)​r‖−L22​‖u‖2\.\\inf\_\{\\lambda\\in\\mathbb\{R\}\}\\left\\lVert\\hat\{\\theta\}\_\{\\lambda\}\-T\(\\theta\_\{A\}\)\\right\\rVert\\geq\\left\\lVert\(I\-P\_\{u\}\)r\\right\\rVert\-\\frac\{L\_\{2\}\}\{2\}\\left\\lVert u\\right\\rVert^\{2\}\.By contrast, the process\-sidecar edit

θ^sc=T​\(θA\+u\)−p=T​\(θA\+u\)−u−r\\hat\{\\theta\}\_\{\\mathrm\{sc\}\}=T\(\\theta\_\{A\}\+u\)\-p=T\(\\theta\_\{A\}\+u\)\-u\-rsatisfies

‖θ^sc−T​\(θA\)‖≤L22​‖u‖2\.\\left\\lVert\\hat\{\\theta\}\_\{\\mathrm\{sc\}\}\-T\(\\theta\_\{A\}\)\\right\\rVert\\leq\\frac\{L\_\{2\}\}\{2\}\\left\\lVert u\\right\\rVert^\{2\}\.Thus, whenever safety training bends the memory direction off the raw memory line, i\.e\.‖\(I−Pu\)​r‖≥ρ​‖u‖\\left\\lVert\(I\-P\_\{u\}\)r\\right\\rVert\\geq\\rho\\left\\lVert u\\right\\rVert, every scalar task\-arithmetic edit leaves first\-order counterfactual error while the process sidecar is second\-order accurate\.

###### Proof\.

Taylor’s theorem givesT​\(θA\+u\)=T​\(θA\)\+p\+qT\(\\theta\_\{A\}\+u\)=T\(\\theta\_\{A\}\)\+p\+qwith‖q‖≤L2​‖u‖2/2\\left\\lVert q\\right\\rVert\\leq L\_\{2\}\\left\\lVert u\\right\\rVert^\{2\}/2\. For anyλ\\lambda,θ^λ−T​\(θA\)=\(1−λ\)​u\+r\+q\\hat\{\\theta\}\_\{\\lambda\}\-T\(\\theta\_\{A\}\)=\(1\-\\lambda\)u\+r\+q\. Projecting orthogonally tospan⁡\{u\}\\operatorname\{span\}\\\{u\\\}removes the scalar task\-arithmetic term, so

‖\(1−λ\)​u\+r\+q‖≥‖\(I−Pu\)​\(r\+q\)‖≥‖\(I−Pu\)​r‖−‖q‖\.\\left\\lVert\(1\-\\lambda\)u\+r\+q\\right\\rVert\\geq\\left\\lVert\(I\-P\_\{u\}\)\(r\+q\)\\right\\rVert\\geq\\left\\lVert\(I\-P\_\{u\}\)r\\right\\rVert\-\\left\\lVert q\\right\\rVert\.Taking the infimum overλ\\lambdagives the lower bound\. The sidecar edit leaves residualqq, giving the upper bound\. ∎

Theorem[3](https://arxiv.org/html/2606.30788#Thmtheorem3)is the sharp version of the naive\-task\-arithmetic critique\. A better scalar coefficient onΔM\\Delta\_\{M\}cannot remove the component of the transported memory direction orthogonal toΔM\\Delta\_\{M\}; the sidecar supplies exactly that missing component\.

The 2D family and the process\-JVP line both contain the first\-order oracle\. The role of the second coefficient appears at the next order\. IfT∈C3T\\in C^\{3\}, write

θA​M​S=θA​S\+p\+q\+O​\(‖u‖3\),p=JS​\(u\),q=12​D2​T​\(θA\)​\[u,u\]\.\\theta\_\{AMS\}=\\theta\_\{AS\}\+p\+q\+O\(\\left\\lVert u\\right\\rVert^\{3\}\),\\qquad p=J\_\{S\}\(u\),\\qquad q=\\tfrac\{1\}\{2\}D^\{2\}T\(\\theta\_\{A\}\)\[u,u\]\.Sincer=p−ur=p\-u, the residual after a 2D edit is

θ^​\(λ,γ\)−θA​S=q\+τ​p\+ζ​r\+O​\(‖u‖3\),τ=1−λ,ζ=λ−γ\.\\hat\{\\theta\}\(\\lambda,\\gamma\)\-\\theta\_\{AS\}=q\+\\tau p\+\\zeta r\+O\(\\left\\lVert u\\right\\rVert^\{3\}\),\\qquad\\tau=1\-\\lambda,\\qquad\\zeta=\\lambda\-\\gamma\.\(3\)The process\-JVP line is the subfamilyζ=0\\zeta=0\.

###### Theorem 4\(Local quadratic frontier\)\.

Let a validation scalarization nearθA​S\\theta\_\{AS\}have expansion

ℓ​\(θA​S\+e\)=ℓ0\+g⊤​e\+12​e⊤​H​e\+O​\(‖e‖3\),\\ell\(\\theta\_\{AS\}\+e\)=\\ell\_\{0\}\+g^\{\\top\}e\+\\tfrac\{1\}\{2\}e^\{\\top\}He\+O\(\\left\\lVert e\\right\\rVert^\{3\}\),withHHpositive definite onspan⁡\{p,r\}\\operatorname\{span\}\\\{p,r\\\}\. LetW1=span⁡\{p\}W\_\{1\}=\\operatorname\{span\}\\\{p\\\}andW2=span⁡\{p,r\}W\_\{2\}=\\operatorname\{span\}\\\{p,r\\\}\. The optimized local quadratic objective overW2W\_\{2\}is weakly no worse than overW1W\_\{1\}\. Let

r⟂=r−Pspan⁡\{p\}H​r\.r\_\{\\perp\}=r\-P^\{H\}\_\{\\operatorname\{span\}\\\{p\\\}\}r\.Ifr⟂≠0r\_\{\\perp\}\\neq 0, the improvement is strict exactly when

q⊤​H​r⟂\+g⊤​r⟂≠0,q^\{\\top\}Hr\_\{\\perp\}\+g^\{\\top\}r\_\{\\perp\}\\neq 0,and the corresponding off\-diagonal coordinate after profiling overτ\\tauis

ζ∗=−q⊤​H​r⟂\+g⊤​r⟂‖r⟂‖H2\.\\zeta^\{\*\}=\-\\frac\{q^\{\\top\}Hr\_\{\\perp\}\+g^\{\\top\}r\_\{\\perp\}\}\{\\left\\lVert r\_\{\\perp\}\\right\\rVert^\{2\}\_\{H\}\}\.

Theorem[4](https://arxiv.org/html/2606.30788#Thmtheorem4)locates the 2D advantage at second order rather than first order\. Hessian anisotropy alone is insufficient; strict improvement requires a Hessian\-weighted off\-diagonal projection of the second\-order/KKT correction onto a sidecar direction unreachable by the process\-JVP line\. Appendix Lemma[18](https://arxiv.org/html/2606.30788#Thmtheorem18)gives a sign criterion for indefinite projected Hessians when the objective is profiled overτ\\tauand the linear term dominates curvature across the searchedζ\\zetainterval\. Accordingly, the HVP sign computation is interpretive; the empirical certificate for the 2D family is the held\-out selector comparison in Section[5\.3](https://arxiv.org/html/2606.30788#S5.SS3)\.

###### Proposition 5\(Local drift of gradient\-ascent unlearning\)\.

For an FT\-unlearning stepθ\+=θ\+α​d\\theta\_\{\+\}=\\theta\+\\alpha d, whereddis the memory\-ascent update direction,

LS​\(θ\+\)−LS​\(θ\)=α​⟨∇LS​\(θ\),d⟩\+α22​d⊤​∇2LS​\(θ\)​d\+O​\(α3​‖d‖3\)\.L\_\{S\}\(\\theta\_\{\+\}\)\-L\_\{S\}\(\\theta\)=\\alpha\\left\\langle\\nabla L\_\{S\}\(\\theta\),d\\right\\rangle\+\\frac\{\\alpha^\{2\}\}\{2\}d^\{\\top\}\\nabla^\{2\}L\_\{S\}\(\\theta\)d\+O\(\\alpha^\{3\}\\left\\lVert d\\right\\rVert^\{3\}\)\.If safety training makes the first\-order term small andddhas positive safety curvature, the step increases safety loss to second order\.

This proposition identifies a local failure mode: memory ascent can move directly into high\-curvature safety directions\. It explains the direction of the FT\-unlearn degradation in Section[5\.6](https://arxiv.org/html/2606.30788#S5.SS6); the observed magnitudes are empirical\.

## 5Experiments

### 5\.1Setup

We evaluate on Qwen\-2\.5\-0\.5B\-Instruct, Qwen\-2\.5\-1\.5B\-Instruct\[Qwen Team,[2024a](https://arxiv.org/html/2606.30788#bib.bib27),[b](https://arxiv.org/html/2606.30788#bib.bib28),[c](https://arxiv.org/html/2606.30788#bib.bib29)\], and Llama\-3\.2\-1B\-Instruct\[Meta AI,[2024](https://arxiv.org/html/2606.30788#bib.bib23), Grattafioriet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib8)\]\. Each principal model has 20 independent trials\. We also report a Qwen3\.5\-9B scale probe: the public Qwen3\.5\-9B Hugging Face checkpoint is a vision\-language model \(Qwen3\_5ForConditionalGenerationarchitecture\) with a vision encoder\[Qwen Team,[2026b](https://arxiv.org/html/2606.30788#bib.bib33),[a](https://arxiv.org/html/2606.30788#bib.bib32)\]\. Our experiments use only the text\-only path: memory canaries, validation prompts, and held\-out refusal probes are all text; the vision encoder is unused\. The language decoder is itself a hybrid: it interleaves Gated\-DeltaNet and gated\-attention layers, with every fourth layer using full attention\. By “hybrid” we mean this attention layout, not a multimodal ensemble\. The 9B scale probe is reported atn=11n=11rather thann=20n=20because of its larger per\-trial compute cost\. The same fresh\-confirmatory protocol is also reported on a contemporary 8B pure\-transformer \(Qwen3\-8B\)\[Qwen Team,[2025a](https://arxiv.org/html/2606.30788#bib.bib31),[b](https://arxiv.org/html/2606.30788#bib.bib30)\]to disentangle architectural confounds from raw scale\. Each trial uses 64 memory canaries, held\-out secret probes with 31 decoys per fact, 128 general refusal prompts, and entity\-specific refusal probes\. The 2D family is evaluated on a4×64\\times 6cached grid \(λ∈\{0\.75,1\.0,1\.25,1\.5\}\\lambda\\in\\\{0\.75,1\.0,1\.25,1\.5\\\},γ∈\{−0\.5,0\.0,0\.5,1\.0,1\.5,2\.0\}\\gamma\\in\\\{\-0\.5,0\.0,0\.5,1\.0,1\.5,2\.0\\\}\); naive and process\-1D subfamilies are selected by the same validation rule\. Confidence intervals are percentile bootstrap intervals over independent trials; paired method comparisons also report an exact one\-sided sign test\.

### 5\.2Validation\-selected process sidecars preserve refusal after forgetting

Table[1](https://arxiv.org/html/2606.30788#S5.T1)reports the deployable selector\. The selected process\-sidecar edit beats naive task arithmetic on refusal closure in every trial across the three model settings\. The two methods leave the secret comparably distinguishable on calibrated AUC \(mean gap within±0\.034\\pm 0\.034at every scale\), so the refusal advantage is not produced by sacrificing forgetting\.

Table 1:Validation\-selected process sidecars versus naive task arithmetic\. Refusal closure is closure to the safety\-only oracle on held\-out test probes\.Δ​AUCcal\\Delta\\operatorname\{AUC\}^\{\\mathrm\{cal\}\}is the calibrated\-AUC gap \(process\-2D minus naive\); values near zero mean both methods leave the secret comparably unrankable\. The combined sign test over the three full rows is60/6060/60; the 9B row is a scale\-probe run\.The frontier view gives the same message\. At Qwen\-2\.5\-1\.5B\-Instruct, process\-2D dominates the entire naive frontier in18/2018/20trials, with 95% mean naive\-frontier coverage\. The corresponding values are12/2012/20trials and 83% coverage at Qwen\-2\.5\-0\.5B\-Instruct, and15/2015/20trials and 87% coverage at Llama\-3\.2\-1B\-Instruct\.

### 5\.3The 2D gain is the value of off\-diagonal cells

The 2D grid has more candidates than the 1D subfamilies by construction \(24 vs 2 on theγ=λ\\gamma=\\lambdadiagonal, vs 4 onγ=0\\gamma=0\)\. We separate the contribution of the additional axis from a search\-space artifact in two stages: first the family\-restriction comparison, then a candidate\-count\-controlled mean\-best\-of\-KKanalysis\.

#### Family restriction\.

Restricting the same cached evaluation to a subfamily of the 2D grid lets us ask: does the off\-diagonal axis \(γ≠λ\\gamma\\neq\\lambda,γ≠0\\gamma\\neq 0\) help, or is the diagonal already enough? The full 2D family beats every subfamily under the same selector, with no new evaluation:

Table 2:Subfamily comparison\. The full 2D family beats the matched\-1D process\-JVP diagonal slice \(γ=λ\\gamma=\\lambda, 2 cells\) and the matched\-naive slice \(γ=0\\gamma=0, 4 cells\), evaluated on the same cached grid under the same selector\.
#### Equal\-density diagonal control\.

The above subfamily comparison restricts the JVP line to 2 cells of the cached grid, so candidate count is not equalized\. We therefore evaluate a locked\-protocol dense process\-JVP diagonal: 24 evenly spacedλ∈\[0\.75,1\.5\]\\lambda\\in\[0\.75,1\.5\]withγ=λ\\gamma=\\lambda, using each trial’s cached states \(θA,θA​M,θA​M​S,R^S←M\\theta\_\{A\},\\theta\_\{AM\},\\theta\_\{AMS\},\\hat\{R\}\_\{S\\leftarrow M\}\) and the identical selector\. The dense\-diagonal family now has the same number of validation candidates as the 2D family along theζ=0\\zeta=0direction; the comparison rules out a count effect parallel toζ=0\\zeta=0but does not control for arbitrary alternative directions inℝd\\mathbb\{R\}^\{d\}\.

At each of the three principal scales, the full 2D family beats the dense process\-JVP diagonal in20/2020/20trials: mean refusal\-closure gap\+0\.305\+0\.305at Qwen\-2\.5\-1\.5B\-Instruct,\+0\.202\+0\.202at Qwen\-2\.5\-0\.5B\-Instruct, and\+0\.243\+0\.243at Llama\-3\.2\-1B\-Instruct\. Each scale’s exact one\-sided sign test \(and Wilcoxon signed\-rank\) givesp=9\.5×10−7p=9\.5\\times 10^\{\-7\}\. The off\-diagonal cellsγ≠λ\\gamma\\neq\\lambdatherefore carry the 2D advantage even when the JVP\-line baseline has matched candidate count\.

### 5\.4Seed\-disjoint matched\-family evidence

The basic paired sign test treats the 60 trial signs as exchangeable Bernoulli\(1/2\)\(1/2\)underH0H\_\{0\}; all 60 paired differences are positive for 2D versus matched\-1D\. To avoid making the 60\-trial independence assumption load\-bearing, we also aggregate the trials into model\-by\-data\-seed blocks\. Each principal model has five data\-seed clusters with four trials per cluster, giving 15 blocks total; within a block we allow arbitrary dependence and only require that the block\-mean signs are independent and Bernoulli\(1/2\)\(1/2\)\-symmetric across blocks underH0H\_\{0\}\(different models are independent runs; different data\-seed clusters use disjoint canary subsets and validation prompts\)\. All 15 block means are positive for 2D versus matched\-1D, giving the exact one\-sided block sign\-testp=2−15=3\.05×10−5p=2^\{\-15\}=3\.05\\times 10^\{\-5\}\. The same15/1515/15block result holds for 2D versus matched\-naive\. This is the conservative statistical certificate we use for the matched\-family claim\.

If one treats individual seed\-disjoint trials as exchangeable, each per\-scale exact one\-sided sign test is20/2020/20and givesp=2−20≈9\.54×10−7p=2^\{\-20\}\\approx 9\.54\\times 10^\{\-7\}, and Fisher’s method across the three independent model strata givesp≈7\.9×10−16p\\approx 7\.9\\times 10^\{\-16\}\. We report these as secondary summaries under the per\-trial\-independence assumption\.

The selected off\-diagonal sign is trial\-local, not a scale law\. Across 20 Qwen\-2\.5\-1\.5B\-Instruct trials and 11 Qwen3\.5\-9B trials, the selector is bimodal in the natural coordinateζ=λ−γ\\zeta=\\lambda\-\\gamma:14/2014/20versus6/206/20at the 1\.5B scale and6/116/11versus5/115/11at the 9B scale, with both signs co\-occurring under the same procedure on the same model\. We use finite\-curvature probes of the underlying Hessian for interpretation rather than as selector evidence: the projected Hessian is positive definite in3/83/8cached 1\.5B probes, and the matched\-family certificate above does not rely on the profiled\-τ\\taulinear\-dominance check\.

### 5\.5Locked\-protocol fresh\-confirmatory replication

The matched\-family analysis above uses cached evaluation grids\. To rule out selection\-iteration effects, we re\-ran a locked protocol on never\-seen data seeds, with documented sample\-size amendments before the corresponding extension compute: four trials per seed\-cluster at the principal scales \(nfresh=20n\_\{\\mathrm\{fresh\}\}=20\) and a smaller average cluster size for the 8B contemporary control \(nfresh=10n\_\{\\mathrm\{fresh\}\}=10, across the same five clusters\)\. Across the four scales below, the validation\-selected process\-2D edit beats naive task arithmetic in every fresh trial:

Table 3:Fresh\-confirmatory replication\. New trials per scale under the locked\-and\-amended protocol, on seeds disjoint from the cached evaluation grid\. The three principal scales reach the amendedn=20n=20\. Qwen3\-8B\[Qwen Team,[2025a](https://arxiv.org/html/2606.30788#bib.bib31),[b](https://arxiv.org/html/2606.30788#bib.bib30)\]is a contemporary pure\-transformer added to disentangle the Gated\-DeltaNet 9B scale\-probe result from raw scale; the 8B run is atn=10n=10\.All 70 fresh\-confirmatory trials under this locked\-and\-amended protocol are positive\. Aggregating into model\-by\-data\-seed clusters gives 20 positive block means out of 20 blocks \(5 clusters per scale, 4 scales\), with the exact one\-sided block sign\-testp=2−20≈9\.5×10−7p=2^\{\-20\}\\approx 9\.5\\times 10^\{\-7\}\. Fisher’s method across the four model runs givesp=1\.7×10−17p=1\.7\\times 10^\{\-17\}as a secondary summary under the stronger per\-trial\-independence assumption\. The fresh per\-model effect overlaps the cached 95% bootstrap CI at Qwen\-2\.5\-0\.5B\-Instruct and Qwen\-2\.5\-1\.5B\-Instruct; at Llama\-3\.2\-1B\-Instruct the fresh mean \(\+0\.235\+0\.235\) sits below the cached lower bound \(\+0\.288\+0\.288\), so the cross\-evaluation transfer at that scale is qualitatively replicated but quantitatively smaller\. Bimodality of the selectedγ\\gammareproduces: at Qwen\-2\.5\-1\.5B\-Instruct,13/2013/20fresh trials selectγ=−0\.5\\gamma=\-0\.5and7/207/20selectγ=\+2\.0\\gamma=\+2\.0\(cached at the same scale:14/2014/20versus6/206/20, withγ=\+2\.0\\gamma=\+2\.0dominant\)\. The dominant raw sign therefore differs between cached and fresh at this scale, consistent with the trial\-local interpretation ofγ\\gammarather than a scale law\. At Qwen3\-8B,7/107/10fresh trials selectγ=−0\.5\\gamma=\-0\.5and3/103/10selectγ=\+2\.0\\gamma=\+2\.0\. The fresh trials replicate the 2D\-vs\-naive direction at every scale, replicate the trial\-local bimodality, and extend the result to a contemporary 8B pure\-transformer\.

### 5\.6Gradient\-ascent unlearning collapses refusal preservation

FT\-unlearning succeeds at making the secret less extractable, but it destroys the refusal behavior that safety training installed\. This is the failure mode predicted by Proposition[5](https://arxiv.org/html/2606.30788#Thmtheorem5): memory ascent is not constrained to stay outside safety\-curvature directions\.

The FT\-unlearn results are reported across two configurations\. The six\-config FT\-unlearn grid sweeps six predeclared combinations of the loss weights\(αforget,αskill,αsafety\)\(\\alpha\_\{\\mathrm\{forget\}\},\\alpha\_\{\\mathrm\{skill\}\},\\alpha\_\{\\mathrm\{safety\}\}\)\(listed in Appendix[F](https://arxiv.org/html/2606.30788#A6)\) at fixed learning rate10−410^\{\-4\}and one epoch\. The single\-config baseline sweep runs the defaultα=1\.0\\alpha=1\.0,αskill=0\.3\\alpha\_\{\\mathrm\{skill\}\}=0\.3,αsafety=0\.5\\alpha\_\{\\mathrm\{safety\}\}=0\.5across five seeds\.

Table 4:FT\-unlearn refusal\-margin degradation\. Values are refusal closure to the safety\-only oracle \(min and max across configs/trials shown as a range\)\. Negative values mean the edit is farther from the oracle than the observed final checkpointθA​M​S\\theta\_\{AMS\}along the refusal\-margin axis\. The six\-config FT\-unlearn grid varies\(αforget,αskill,αsafety\)\(\\alpha\_\{\\mathrm\{forget\}\},\\alpha\_\{\\mathrm\{skill\}\},\\alpha\_\{\\mathrm\{safety\}\}\)as in Appendix[F](https://arxiv.org/html/2606.30788#A6); the 9B row is a single\-trial scale probe at the same protocol as the 1\.5B baseline sweep\.NPO is less damaging than FT\-unlearn but still gives negative refusal closure in the 1\.5B baseline sweep, with mean refusal closure−1\.33\-1\.33\. RMU changes the metrics little in the tested base\-parameter configuration: secret AUC remains high rather than reaching chance, and refusal closure is near zero\. Full hyperparameters for both baselines are in Appendix[F](https://arxiv.org/html/2606.30788#A6)\.

#### Model\-merging baselines \(TIES, DARE\)\.

The necessity theorem predicts that any edit confined to a sparsified copy ofΔM\\Delta\_\{M\}inherits the first\-order incompleteness of naive task arithmetic\. We test this on the same five 1\.5B trials by sparsifyingΔM\\Delta\_\{M\}via TIES\[Yadavet al\.,[2023](https://arxiv.org/html/2606.30788#bib.bib38)\]\(per\-tensor magnitude trim from mergekit\[Goddardet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib6)\]\) and DARE\[Yuet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib39)\]\(Bernoulli drop with1/d1/drescale\), then applying the selector\. With densities\{0\.2,0\.5,0\.8\}\\\{0\.2,0\.5,0\.8\\\}andλ∈\{0\.75,1\.0,1\.25,1\.5\}\\lambda\\in\\\{0\.75,1\.0,1\.25,1\.5\\\}, process\-2D beatsTIESbest\\mathrm\{TIES\}\_\{\\mathrm\{best\}\}in5/55/5trials with mean refusal\-closure gap\+0\.354\+0\.354, and beatsDAREbest\\mathrm\{DARE\}\_\{\\mathrm\{best\}\}in5/55/5with mean gap\+0\.469\+0\.469\. TIES yields a small implicit\-regularization gain over naive \(\+0\.110\+0\.110mean,5/55/5\); DARE is statistically indistinguishable from naive \(−0\.005\-0\.005mean,4/54/5\)\. The theorem prediction therefore holds empirically: sparsifying the raw memory delta does not recover the transported direction\.

## 6Discussion and limitations

The theoretical claim is first\-order and process\-level: it applies to a fixed smooth safety\-training trace and explains why raw memory subtraction is incomplete\. The finiteε=1\\varepsilon=1implementation is justified locally by the derivative theorem; the experiments are the evidence for finite\-scale behavior\.

The off\-diagonal coefficient is not a scale law\. The Qwen\-2\.5\-1\.5B\-Instruct bimodality shows both signs within one scale\. The invariant quantity isζ=λ−γ\\zeta=\\lambda\-\\gamma, determined by local validation geometry rather than by raw model size\. The HVP cache supports this interpretation: only3/83/8cached probes satisfy the positive\-definite hypothesis needed for the closed\-form local minimizer\.

The frontier and sign\-criterion theorems have hypothesis conditions; the held\-out selector behavior is the empirical certificate\. Proposition[5](https://arxiv.org/html/2606.30788#Thmtheorem5)predicts FT\-unlearn’s direction, not its magnitude\. Multi\-source revocation, repeated safety, adversarial extraction, broader RMU tuning, and higher\-rank adapters remain open\.

## 7Conclusion

Process sidecars are the geometrically correct edit family for revoking learned memory under later safety training: first\-order necessity against scalar task arithmetic and second\-order accuracy of the ideal sidecar carry through empirically across four model scales and two architectures\.

## References

- Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon, C\. Chen, C\. Olsson, C\. Olah, D\. Hernandez, D\. Drain, D\. Ganguli, D\. Li, E\. Tran\-Johnson, E\. Perez, J\. Kerr, J\. Mueller, J\. Ladish, J\. Landau, K\. Ndousse, K\. Lukosuite, L\. Lovitt, M\. Sellitto, N\. Elhage, N\. Schiefer, N\. Mercado, N\. DasSarma, R\. Lasenby, R\. Larson, S\. Ringer, S\. Johnston, S\. Kravec, S\. El Showk, S\. Fort, T\. Lanham, T\. Telleen\-Lawton, T\. Conerly, T\. Henighan, T\. Hume, S\. R\. Bowman, Z\. Hatfield\-Dodds, B\. Mann, D\. Amodei, N\. Joseph, S\. McCandlish, T\. Brown, and J\. Kaplan \(2022\)Constitutional AI: harmlessness from AI feedback\.External Links:2212\.08073,[Link](https://arxiv.org/abs/2212.08073)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px3.p1.1)\.
- L\. Bourtoule, V\. Chandrasekaran, C\. A\. Choquette\-Choo, H\. Jia, A\. Travers, B\. Zhang, D\. Lie, and N\. Papernot \(2021\)Machine unlearning\.InIEEE Symposium on Security and Privacy,External Links:[Link](https://www.ieee-security.org/TC/SP2021/program-papers.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- Center for AI Safety \(2024\)WMDP benchmark and RMU code\.Note:GitHub repositoryExternal Links:[Link](https://github.com/centerforaisafety/wmdp)Cited by:[Appendix C](https://arxiv.org/html/2606.30788#A3.SS0.SSS0.Px5.p1.1)\.
- R\. Eldan and M\. Russinovich \(2023\)Who’s Harry Potter? approximate unlearning in LLMs\.External Links:2310\.02238,[Link](https://arxiv.org/abs/2310.02238)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- C\. Finn, P\. Abbeel, and S\. Levine \(2017\)Model\-agnostic meta\-learning for fast adaptation of deep networks\.InProceedings of the 34th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.70,pp\. 1126–1135\.External Links:[Link](https://proceedings.mlr.press/v70/finn17a.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1)\.
- C\. Goddard, S\. Siriwardhana, M\. Ehghaghi, L\. Meyers, V\. Karpukhin, B\. Benedict, M\. McQuade, and J\. Solawetz \(2024\)Arcee’s MergeKit: a toolkit for merging large language models\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track,pp\. 477–485\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.emnlp-industry.36),[Link](https://aclanthology.org/2024.emnlp-industry.36)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px1.p1.1),[Appendix F](https://arxiv.org/html/2606.30788#A6.SS0.SSS0.Px4.p1.4),[§5\.6](https://arxiv.org/html/2606.30788#S5.SS6.SSS0.Px1.p1.15)\.
- A\. Golatkar, A\. Achille, and S\. Soatto \(2020\)Eternal sunshine of the spotless net: selective forgetting in deep networks\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 9304–9312\.External Links:[Link](https://openaccess.thecvf.com/content_CVPR_2020/html/Golatkar_Eternal_Sunshine_of_the_Spotless_Net_Selective_Forgetting_in_Deep_CVPR_2020_paper.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The Llama 3 herd of models\.External Links:2407\.21783,[Link](https://arxiv.org/abs/2407.21783)Cited by:[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5)\.
- C\. Guo, T\. Goldstein, A\. Hannun, and L\. Van Der Maaten \(2020\)Certified data removal from machine learning models\.InProceedings of the 37th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.119,pp\. 3832–3842\.External Links:[Link](https://proceedings.mlr.press/v119/guo20c.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- E\. J\. Hu, Y\. Shen, P\. Wallis, Z\. Allen\-Zhu, Y\. Li, S\. Wang, L\. Wang, and W\. Chen \(2022\)LoRA: low\-rank adaptation of large language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=nZeVKeeFYf9)Cited by:[§2](https://arxiv.org/html/2606.30788#S2.p2.1)\.
- S\. Hu, Y\. Fu, Z\. S\. Wu, and V\. Smith \(2025\)Unlearning or obfuscating? jogging the memory of unlearned LLMs via benign relearning\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=fMNRYBvcQN)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- G\. Ilharco, M\. T\. Ribeiro, M\. Wortsman, S\. Gururangan, L\. Schmidt, H\. Hajishirzi, and A\. Farhadi \(2023\)Editing models with task arithmetic\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=6t0Kwf8-jrj)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2606.30788#S1.p3.3)\.
- J\. Jang, D\. Yoon, S\. Yang, S\. Cha, M\. Lee, L\. Logeswaran, and M\. Seo \(2023\)Knowledge unlearning for mitigating privacy risks in language models\.InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 14389–14408\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.acl-long.805),[Link](https://aclanthology.org/2023.acl-long.805/)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- D\. P\. Kingma and J\. Ba \(2015\)Adam: a method for stochastic optimization\.InInternational Conference on Learning Representations,External Links:[Link](https://arxiv.org/abs/1412.6980)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1),[§4](https://arxiv.org/html/2606.30788#S4.p2.1)\.
- P\. W\. Koh and P\. Liang \(2017\)Understanding black\-box predictions via influence functions\.InProceedings of the 34th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.70,pp\. 1885–1894\.External Links:[Link](https://proceedings.mlr.press/v70/koh17a.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1)\.
- N\. Li, A\. Pan, A\. Gopal, S\. Yue, D\. Berrios, A\. Gatti, J\. D\. Li, A\. Dombrowski, S\. Goel, G\. Mukobi,et al\.\(2024\)The WMDP benchmark: measuring and reducing malicious use with unlearning\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 28525–28550\.External Links:[Link](https://proceedings.mlr.press/v235/li24bc.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1),[Appendix F](https://arxiv.org/html/2606.30788#A6.SS0.SSS0.Px3.p1.3),[§3](https://arxiv.org/html/2606.30788#S3.SS0.SSS0.Px3.p1.1)\.
- J\. Lorraine, P\. Vicol, and D\. Duvenaud \(2020\)Optimizing millions of hyperparameters by implicit differentiation\.InProceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics,Proceedings of Machine Learning Research, Vol\.108,pp\. 1540–1552\.External Links:[Link](https://proceedings.mlr.press/v108/lorraine20a.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1),[§3](https://arxiv.org/html/2606.30788#S3.SS0.SSS0.Px1.p1.2)\.
- I\. Loshchilov and F\. Hutter \(2019\)Decoupled weight decay regularization\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Bkg6RiCqY7)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1),[§4](https://arxiv.org/html/2606.30788#S4.p2.1)\.
- J\. Łucki, B\. Wei, Y\. Huang, P\. Henderson, F\. Tramèr, and J\. Rando \(2025\)An adversarial perspective on machine unlearning for AI safety\.Transactions on Machine Learning Research\.External Links:[Link](https://openreview.net/forum?id=J5IRyTKZ9s)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- D\. Maclaurin, D\. Duvenaud, and R\. Adams \(2015\)Gradient\-based hyperparameter optimization through reversible learning\.InProceedings of the 32nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.37,pp\. 2113–2122\.External Links:[Link](https://proceedings.mlr.press/v37/maclaurin15.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1),[§3](https://arxiv.org/html/2606.30788#S3.SS0.SSS0.Px1.p1.2)\.
- P\. Maini, Z\. Feng, A\. Schwarzschild, Z\. C\. Lipton, and J\. Z\. Kolter \(2024\)TOFU: a task of fictitious unlearning for LLMs\.InConference on Language Modeling \(COLM\),External Links:[Link](https://openreview.net/forum?id=B41hNBoWLo)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- M\. S\. Matena and C\. A\. Raffel \(2022\)Merging models with Fisher\-weighted averaging\.InAdvances in Neural Information Processing Systems,Vol\.35\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2022/hash/70c26937fbf3d4600b69a129031b66ec-Abstract-Conference.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px1.p1.1)\.
- Meta AI \(2024\)Llama\-3\.2\-1B\-Instruct model card\.Note:Hugging Face model cardAccessed 2026\-05\-07External Links:[Link](https://huggingface.co/meta-llama/Llama-3.2-1B-Instruct)Cited by:[Appendix C](https://arxiv.org/html/2606.30788#A3.SS0.SSS0.Px5.p1.1),[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5)\.
- L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. L\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. Christiano, J\. Leike, and R\. Lowe \(2022\)Training language models to follow instructions with human feedback\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 27730–27744\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2022/hash/b1efde53be364a73914f58805a001731-Abstract.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px3.p1.1)\.
- S\. M\. Park, K\. Georgiev, A\. Ilyas, G\. Leclerc, and A\. Madry \(2023\)TRAK: attributing model behavior at scale\.InProceedings of the 40th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.202,pp\. 27074–27113\.External Links:[Link](https://proceedings.mlr.press/v202/park23c.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1)\.
- B\. A\. Pearlmutter \(1994\)Fast exact multiplication by the Hessian\.Neural Computation6\(1\),pp\. 147–160\.External Links:[Document](https://dx.doi.org/10.1162/neco.1994.6.1.147)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1),[§3](https://arxiv.org/html/2606.30788#S3.SS0.SSS0.Px1.p1.2)\.
- Qwen Team \(2024a\)Qwen2\.5 technical report\.External Links:2412\.15115,[Link](https://arxiv.org/abs/2412.15115)Cited by:[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5)\.
- Qwen Team \(2024b\)Qwen2\.5\-0\.5B\-Instruct model card\.Note:Hugging Face model cardAccessed 2026\-05\-07External Links:[Link](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct)Cited by:[Appendix C](https://arxiv.org/html/2606.30788#A3.SS0.SSS0.Px5.p1.1),[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5)\.
- Qwen Team \(2024c\)Qwen2\.5\-1\.5B\-Instruct model card\.Note:Hugging Face model cardAccessed 2026\-05\-07External Links:[Link](https://huggingface.co/Qwen/Qwen2.5-1.5B-Instruct)Cited by:[Appendix C](https://arxiv.org/html/2606.30788#A3.SS0.SSS0.Px5.p1.1),[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5)\.
- Qwen Team \(2025a\)Qwen3 technical report\.External Links:2505\.09388,[Link](https://arxiv.org/abs/2505.09388)Cited by:[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5),[Table 3](https://arxiv.org/html/2606.30788#S5.T3),[Table 3](https://arxiv.org/html/2606.30788#S5.T3.4.2)\.
- Qwen Team \(2025b\)Qwen3\-8B model card\.Note:Hugging Face model cardAccessed 2026\-05\-07External Links:[Link](https://huggingface.co/Qwen/Qwen3-8B)Cited by:[Appendix C](https://arxiv.org/html/2606.30788#A3.SS0.SSS0.Px5.p1.1),[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5),[Table 3](https://arxiv.org/html/2606.30788#S5.T3),[Table 3](https://arxiv.org/html/2606.30788#S5.T3.4.2)\.
- Qwen Team \(2026a\)Qwen3\.5\-9B configuration file\.Note:Hugging Face repository fileAccessed 2026\-05\-07External Links:[Link](https://huggingface.co/Qwen/Qwen3.5-9B/blob/main/config.json)Cited by:[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5)\.
- Qwen Team \(2026b\)Qwen3\.5\-9B model card\.Note:Hugging Face model cardAccessed 2026\-05\-07External Links:[Link](https://huggingface.co/Qwen/Qwen3.5-9B)Cited by:[Appendix C](https://arxiv.org/html/2606.30788#A3.SS0.SSS0.Px5.p1.1),[§5\.1](https://arxiv.org/html/2606.30788#S5.SS1.p1.5)\.
- R\. Rafailov, A\. Sharma, E\. Mitchell, C\. D\. Manning, S\. Ermon, and C\. Finn \(2023\)Direct preference optimization: your language model is secretly a reward model\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/a85b405ed65c6477a4fe8302b5e06ce7-Abstract-Conference.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px3.p1.1)\.
- A\. Rajeswaran, C\. Finn, S\. M\. Kakade, and S\. Levine \(2019\)Meta\-learning with implicit gradients\.InAdvances in Neural Information Processing Systems,Vol\.32,pp\. 113–124\.External Links:[Link](https://proceedings.neurips.cc/paper/2019/hash/072b030ba126b2f4b2374f342be9ed44-Abstract.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px4.p1.1)\.
- W\. Shi, J\. Lee, Y\. Huang, S\. Malladi, J\. Zhao, A\. Holtzman, D\. Liu, L\. Zettlemoyer, N\. A\. Smith, and C\. Zhang \(2025\)MUSE: machine unlearning six\-way evaluation for language models\.InInternational Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=TArmA033BU)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1)\.
- M\. Wortsman, G\. Ilharco, S\. Y\. Gadre, R\. Roelofs, R\. Gontijo\-Lopes, A\. S\. Morcos, H\. Namkoong, A\. Farhadi, Y\. Carmon, S\. Kornblith, and L\. Schmidt \(2022\)Model soups: averaging weights of multiple fine\-tuned models improves accuracy without increasing inference time\.InProceedings of the 39th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.162,pp\. 23965–23998\.External Links:[Link](https://proceedings.mlr.press/v162/wortsman22a.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px1.p1.1)\.
- P\. Yadav, D\. Tam, L\. Choshen, C\. Raffel, and M\. Bansal \(2023\)TIES\-merging: resolving interference when merging models\.InAdvances in Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=xtaX3WyCj1)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px1.p1.1),[§5\.6](https://arxiv.org/html/2606.30788#S5.SS6.SSS0.Px1.p1.15)\.
- L\. Yu, B\. Yu, H\. Yu, F\. Huang, and Y\. Li \(2024\)Language models are super mario: absorbing abilities from homologous models as a free lunch\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 57755–57775\.External Links:[Link](https://proceedings.mlr.press/v235/yu24p.html)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px1.p1.1),[Appendix F](https://arxiv.org/html/2606.30788#A6.SS0.SSS0.Px4.p1.4),[§5\.6](https://arxiv.org/html/2606.30788#S5.SS6.SSS0.Px1.p1.15)\.
- R\. Zhang, L\. Lin, Y\. Bai, and S\. Mei \(2024\)Negative preference optimization: from catastrophic collapse to effective unlearning\.InConference on Language Modeling \(COLM\),External Links:[Link](https://openreview.net/forum?id=MXLBXjQkmb)Cited by:[Appendix A](https://arxiv.org/html/2606.30788#A1.SS0.SSS0.Px2.p1.1),[Appendix C](https://arxiv.org/html/2606.30788#A3.SS0.SSS0.Px5.p1.1),[Appendix F](https://arxiv.org/html/2606.30788#A6.SS0.SSS0.Px2.p1.2),[§3](https://arxiv.org/html/2606.30788#S3.SS0.SSS0.Px3.p1.1)\.

## Appendix ARelated work

#### Weight\-space editing and merging\.

Task arithmetic and model merging\[Ilharcoet al\.,[2023](https://arxiv.org/html/2606.30788#bib.bib12), Wortsmanet al\.,[2022](https://arxiv.org/html/2606.30788#bib.bib37), Matena and Raffel,[2022](https://arxiv.org/html/2606.30788#bib.bib22), Yadavet al\.,[2023](https://arxiv.org/html/2606.30788#bib.bib38), Yuet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib39), Goddardet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib6)\]edit fine\-tuned checkpoints by manipulating weight\-space differences\. Process sidecars keep this deploy\-time editing form, but replace a static delta with an estimate of how the later safety\-training process transports the memory direction\.

#### Machine unlearning\.

Classical machine unlearning frames deletion against a retrained\-without\-the\-data counterfactual, through exact retraining systems, certified removal, or approximate selective forgetting\[Bourtouleet al\.,[2021](https://arxiv.org/html/2606.30788#bib.bib2), Guoet al\.,[2020](https://arxiv.org/html/2606.30788#bib.bib9), Golatkaret al\.,[2020](https://arxiv.org/html/2606.30788#bib.bib7)\]\. LLM unlearning adapts this goal to memorized text, private facts, and hazardous capabilities, with gradient\-ascent unlearning, TOFU, content unlearning benchmarks such as MUSE, WMDP/RMU, and preference\-based methods such as NPO\[Janget al\.,[2023](https://arxiv.org/html/2606.30788#bib.bib13), Eldan and Russinovich,[2023](https://arxiv.org/html/2606.30788#bib.bib4), Mainiet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib21), Shiet al\.,[2025](https://arxiv.org/html/2606.30788#bib.bib36), Liet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib16), Zhanget al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib40)\]\. Recent robustness work shows that approximate LLM unlearning can suppress outputs without eliminating recoverable knowledge, especially under relearning or adversarial evaluation\[Huet al\.,[2025](https://arxiv.org/html/2606.30788#bib.bib11), Łuckiet al\.,[2025](https://arxiv.org/html/2606.30788#bib.bib19)\]\. Our setting is different: the deletion target has been followed by an entity\-tied safety phase, so the failure mode is not only retain\-distribution damage but erasure of the refusal behavior protecting the memorized entities\.

#### Safety post\-training\.

Instruction and safety post\-training methods such as RLHF, Constitutional AI/RLAIF, and DPO tune models toward preferred or harmless behavior after pretraining\[Ouyanget al\.,[2022](https://arxiv.org/html/2606.30788#bib.bib24), Baiet al\.,[2022](https://arxiv.org/html/2606.30788#bib.bib1), Rafailovet al\.,[2023](https://arxiv.org/html/2606.30788#bib.bib34)\]\. We model the safety phase as a realized deterministic training operator and ask how to revoke a prior memory without discarding the later refusal policy learned around that memory\.

#### Sensitivity through training\.

Influence functions and TRAK trace predictions back to training data with Hessian\-vector or projected sensitivity approximations\[Koh and Liang,[2017](https://arxiv.org/html/2606.30788#bib.bib15), Parket al\.,[2023](https://arxiv.org/html/2606.30788#bib.bib25)\]\. Meta\-learning and hyperparameter\-optimization work differentiates through entire optimization procedures or implicit optima\[Maclaurinet al\.,[2015](https://arxiv.org/html/2606.30788#bib.bib20), Finnet al\.,[2017](https://arxiv.org/html/2606.30788#bib.bib5), Rajeswaranet al\.,[2019](https://arxiv.org/html/2606.30788#bib.bib35), Lorraineet al\.,[2020](https://arxiv.org/html/2606.30788#bib.bib17)\]\. Process sidecars use the same kind of training\-process sensitivity as a deployment\-time edit direction: a finite secant estimates the JVP of the realized AdamW safety trace\[Pearlmutter,[1994](https://arxiv.org/html/2606.30788#bib.bib26), Kingma and Ba,[2015](https://arxiv.org/html/2606.30788#bib.bib14), Loshchilov and Hutter,[2019](https://arxiv.org/html/2606.30788#bib.bib18)\], rather than attributing an example or optimizing a hyperparameter\.

## Appendix BTheory: Process Sidecars for Revocable Learned State

#### Trainable\-coordinate convention\.

All vectors are written in the trainable parameter coordinates used by the experiment\. For a LoRA run this means the LoRA adapter coordinates; for a full\-finetuning run it means the full parameter vector\. This convention avoids irrelevant null coordinates\. The norm∥⋅∥\\left\\lVert\\cdot\\right\\rVertis Euclidean unless stated otherwise\.

#### Sequential checkpoints\.

The pipeline is

θA→𝑀θA​M→𝑆θA​M​S,\\theta\_\{A\}\\xrightarrow\{\\;M\\;\}\\theta\_\{AM\}\\xrightarrow\{\\;S\\;\}\\theta\_\{AMS\},whereAAis the skill checkpoint,MMis the learned memory phase, andSSis the subsequent safety/refusal phase\. The counterfactual oracle is

θA​S=TrainS⁡\(θA\),\\theta\_\{AS\}=\\operatorname\{Train\}\_\{S\}\(\\theta\_\{A\}\),which runs the same safety phase fromθA\\theta\_\{A\}rather thanθA​M\\theta\_\{AM\}\. Let

u:=ΔM=θA​M−θA\.u:=\\Delta\_\{M\}=\\theta\_\{AM\}\-\\theta\_\{A\}\.Throughout the appendix, the realized safety\-training trace is fixed: the minibatches, random seed, dropout masks if any, optimizer hyperparameters, and training schedule are conditioned on\. ThusT≡TrainST\\equiv\\operatorname\{Train\}\_\{S\}is a deterministic map from an initialization to the final safety checkpoint\. Randomness can be restored by applying the deterministic statements conditioned on each realized trace\.

### B\.1AdamW is an augmented\-state differentiable map

A central point is thatD​TDTis the Jacobian of the entire future training process, not the Hessian of a single loss and not a plain SGD product unless the optimizer really is SGD\. For AdamW, the optimizer state must be included\.

Letℓt\\ell\_\{t\}be the loss on thett\-th realized minibatch\. We allow optional global\-norm clipping with thresholdC∈\(0,∞\]C\\in\(0,\\infty\], whereC=∞C=\\inftymeans no clipping\. Define

ψC​\(g\)=\{g,‖g‖2<C,C​g/‖g‖2,‖g‖2\>C\.\\psi\_\{C\}\(g\)=\\begin\{cases\}g,&\\left\\lVert g\\right\\rVert\_\{2\}<C,\\\\\[2\.0pt\] Cg/\\left\\lVert g\\right\\rVert\_\{2\},&\\left\\lVert g\\right\\rVert\_\{2\}\>C\.\\end\{cases\}The boundary‖g‖2=C\\left\\lVert g\\right\\rVert\_\{2\}=Cis nonsmooth and is excluded by the regular\-trace assumption below\. We write the parameter at AdamW stepttasθ​\(t\)\\theta\(t\)in this appendix and asθt\\theta\_\{t\}in the main text; the two are the same sequence and we use them interchangeably\. Starting fromθ​\(0\)=θ\\theta\(0\)=\\thetaandm0=v0=0m\_\{0\}=v\_\{0\}=0, one AdamW trace evolves by

gt\\displaystyle g\_\{t\}=∇ℓt​\(θ​\(t−1\)\),\\displaystyle=\\nabla\\ell\_\{t\}\(\\theta\(t\-1\)\),qt\\displaystyle q\_\{t\}=ψC​\(gt\),\\displaystyle=\\psi\_\{C\}\(g\_\{t\}\),\(4\)mt\\displaystyle m\_\{t\}=β1​mt−1\+\(1−β1\)​qt,\\displaystyle=\\beta\_\{1\}m\_\{t\-1\}\+\(1\-\\beta\_\{1\}\)q\_\{t\},vt\\displaystyle v\_\{t\}=β2​vt−1\+\(1−β2\)​qt⊙qt,\\displaystyle=\\beta\_\{2\}v\_\{t\-1\}\+\(1\-\\beta\_\{2\}\)q\_\{t\}\\odot q\_\{t\},\(5\)m^t\\displaystyle\\hat\{m\}\_\{t\}=mt/\(1−β1t\),\\displaystyle=m\_\{t\}/\(1\-\\beta\_\{1\}^\{t\}\),v^t\\displaystyle\\hat\{v\}\_\{t\}=vt/\(1−β2t\),\\displaystyle=v\_\{t\}/\(1\-\\beta\_\{2\}^\{t\}\),\(6\)θ​\(t\)\\displaystyle\\theta\(t\)=\(1−ηt​λwd\)​θ​\(t−1\)−ηt​m^t⊘\(v^t\+ϵadam\)\.\\displaystyle=\(1\-\\eta\_\{t\}\\lambda\_\{\\mathrm\{wd\}\}\)\\theta\(t\-1\)\-\\eta\_\{t\}\\,\\hat\{m\}\_\{t\}\\oslash\\left\(\\sqrt\{\\hat\{v\}\_\{t\}\}\+\\epsilon\_\{\\mathrm\{adam\}\}\\right\)\.\(7\)Here⊙\\odot,⊘\\oslash,⋅\\sqrt\{\\cdot\}are coordinatewise\.

###### Assumption 6\(Regular AdamW safety trace\)\.

There is a radiusr\>0r\>0aroundθA\\theta\_\{A\}such that, for every initialization inB​\(θA,r\)B\(\\theta\_\{A\},r\):

1. 1\.each minibatch lossℓt\\ell\_\{t\}isC3C^\{3\}on the induced trace neighborhood;
2. 2\.no clipping decision crosses the boundary‖∇ℓt‖2=C\\left\\lVert\\nabla\\ell\_\{t\}\\right\\rVert\_\{2\}=C;
3. 3\.on the active trainable coordinates, every bias\-corrected second moment satisfies\(v^t\)i≥ν\>0\(\\hat\{v\}\_\{t\}\)\_\{i\}\\geq\\nu\>0;
4. 4\.the derivatives of the one\-step maps through order three are bounded on this neighborhood\.

The lower bound onv^t\\hat\{v\}\_\{t\}is the AdamW square\-root regularity condition\. PyTorch\-style AdamW usesv^t\+ϵadam\\sqrt\{\\hat\{v\}\_\{t\}\}\+\\epsilon\_\{\\mathrm\{adam\}\}, whose derivative with respect tov^t\\hat\{v\}\_\{t\}contains1/v^t1/\\sqrt\{\\hat\{v\}\_\{t\}\}; coordinates with identically zero second moment must be removed from the active set or handled by the smoothed variantv^t\+ϵadam\\sqrt\{\\hat\{v\}\_\{t\}\+\\epsilon\_\{\\mathrm\{adam\}\}\}\.

###### Theorem 7\(Exact tangent recursion for multi\-step AdamW\)\.

Under Assumption[6](https://arxiv.org/html/2606.30788#Thmtheorem6), the safety\-training map

T​\(θ\)=θ​\(K\)T\(\\theta\)=\\theta\(K\)is differentiable atθA\\theta\_\{A\}\. For any initialization perturbationδ\\delta, let

at=d​θ​\(t\)d​s,bt=d​mtd​s,ct=d​vtd​sa\_\{t\}=\\frac\{\\mathrm\{d\}\\theta\(t\)\}\{\\mathrm\{d\}s\},\\qquad b\_\{t\}=\\frac\{\\mathrm\{d\}m\_\{t\}\}\{\\mathrm\{d\}s\},\\qquad c\_\{t\}=\\frac\{\\mathrm\{d\}v\_\{t\}\}\{\\mathrm\{d\}s\}along the perturbed initializationθA\+s​δ\\theta\_\{A\}\+s\\delta, evaluated ats=0s=0, witha0=δa\_\{0\}=\\deltaandb0=c0=0b\_\{0\}=c\_\{0\}=0\. Let

Gt=D​\(ψC∘∇ℓt\)​\(θ​\(t−1\)\)\.G\_\{t\}=D\(\\psi\_\{C\}\\circ\\nabla\\ell\_\{t\}\)\(\\theta\(t\-1\)\)\.When clipping is inactive,Gt=∇2ℓt​\(θ​\(t−1\)\)G\_\{t\}=\\nabla^\{2\}\\ell\_\{t\}\(\\theta\(t\-1\)\)\. When clipping is active and away from the boundary,

Gt=C‖gt‖2​\(I−gt​gt⊤‖gt‖22\)​∇2ℓt​\(θ​\(t−1\)\)\.G\_\{t\}=\\frac\{C\}\{\\left\\lVert g\_\{t\}\\right\\rVert\_\{2\}\}\\left\(I\-\\frac\{g\_\{t\}g\_\{t\}^\{\\top\}\}\{\\left\\lVert g\_\{t\}\\right\\rVert\_\{2\}^\{2\}\}\\right\)\\nabla^\{2\}\\ell\_\{t\}\(\\theta\(t\-1\)\)\.ThenJS​\(δ\):=D​T​\(θA\)​δ=aKJ\_\{S\}\(\\delta\):=DT\(\\theta\_\{A\}\)\\delta=a\_\{K\}, where

ht\\displaystyle h\_\{t\}=Gt​at−1,\\displaystyle=G\_\{t\}a\_\{t\-1\},\(8\)bt\\displaystyle b\_\{t\}=β1​bt−1\+\(1−β1\)​ht,\\displaystyle=\\beta\_\{1\}b\_\{t\-1\}\+\(1\-\\beta\_\{1\}\)h\_\{t\},\(9\)ct\\displaystyle c\_\{t\}=β2​ct−1\+2​\(1−β2\)​qt⊙ht,\\displaystyle=\\beta\_\{2\}c\_\{t\-1\}\+2\(1\-\\beta\_\{2\}\)q\_\{t\}\\odot h\_\{t\},\(10\)b^t\\displaystyle\\hat\{b\}\_\{t\}=bt/\(1−β1t\),c^t=ct/\(1−β2t\),\\displaystyle=b\_\{t\}/\(1\-\\beta\_\{1\}^\{t\}\),\\qquad\\hat\{c\}\_\{t\}=c\_\{t\}/\(1\-\\beta\_\{2\}^\{t\}\),\(11\)dt\\displaystyle d\_\{t\}=v^t\+ϵadam,\\displaystyle=\\sqrt\{\\hat\{v\}\_\{t\}\}\+\\epsilon\_\{\\mathrm\{adam\}\},\(12\)at\\displaystyle a\_\{t\}=\(1−ηt​λwd\)​at−1−ηt​\(b^t⊘dt−12​m^t⊙c^t⊘\(v^t⊙dt⊙2\)\)\.\\displaystyle=\(1\-\\eta\_\{t\}\\lambda\_\{\\mathrm\{wd\}\}\)a\_\{t\-1\}\-\\eta\_\{t\}\\left\(\\hat\{b\}\_\{t\}\\oslash d\_\{t\}\-\\tfrac\{1\}\{2\}\\hat\{m\}\_\{t\}\\odot\\hat\{c\}\_\{t\}\\oslash\\big\(\\sqrt\{\\hat\{v\}\_\{t\}\}\\odot d\_\{t\}^\{\\odot 2\}\\big\)\\right\)\.\(13\)Equivalently,

D​T​\(θA\)=Πθ​D​FK​\(zK−1\)​⋯​D​F1​\(z0\)​ιθ,zt=\(θ​\(t\),mt,vt\),DT\(\\theta\_\{A\}\)=\\Pi\_\{\\theta\}\\,DF\_\{K\}\(z\_\{K\-1\}\)\\cdots DF\_\{1\}\(z\_\{0\}\)\\,\\iota\_\{\\theta\},\\qquad z\_\{t\}=\(\\theta\(t\),m\_\{t\},v\_\{t\}\),whereιθ​δ=\(δ,0,0\)\\iota\_\{\\theta\}\\delta=\(\\delta,0,0\)andΠθ\\Pi\_\{\\theta\}projects the final augmented tangent back to parameter coordinates\.

###### Proof\.

For a fixed trace, one AdamW step is a deterministic mapFt:\(θ​\(t−1\),mt−1,vt−1\)↦\(θ​\(t\),mt,vt\)F\_\{t\}:\(\\theta\(t\-1\),m\_\{t\-1\},v\_\{t\-1\}\)\\mapsto\(\\theta\(t\),m\_\{t\},v\_\{t\}\)\. By Assumption[6](https://arxiv.org/html/2606.30788#Thmtheorem6), the composition of the loss gradient, the clipping branch, the moment recurrences, bias correction, coordinatewise square root, and decoupled weight decay is differentiable on the trace neighborhood\. HenceT=Πθ​FK∘⋯∘F1∘ιθT=\\Pi\_\{\\theta\}F\_\{K\}\\circ\\cdots\\circ F\_\{1\}\\circ\\iota\_\{\\theta\}is differentiable and the chain rule gives the augmented\-matrix expression\.

Expanding the augmented Jacobian product gives the displayed recurrences\. The terms forbtb\_\{t\}andctc\_\{t\}are the derivatives of the first\- and second\-moment updates\. For the parameter update, differentiate coordinatewise:

D​\(m^iv^i\+ϵadam\)=m^˙iv^i\+ϵadam−m^i2​v^i​\(v^i\+ϵadam\)2​v^˙i\.D\\\!\\left\(\\frac\{\\hat\{m\}\_\{i\}\}\{\\sqrt\{\\hat\{v\}\_\{i\}\}\+\\epsilon\_\{\\mathrm\{adam\}\}\}\\right\)=\\frac\{\\dot\{\\hat\{m\}\}\_\{i\}\}\{\\sqrt\{\\hat\{v\}\_\{i\}\}\+\\epsilon\_\{\\mathrm\{adam\}\}\}\-\\frac\{\\hat\{m\}\_\{i\}\}\{2\\sqrt\{\\hat\{v\}\_\{i\}\}\\,\(\\sqrt\{\\hat\{v\}\_\{i\}\}\+\\epsilon\_\{\\mathrm\{adam\}\}\)^\{2\}\}\\,\\dot\{\\hat\{v\}\}\_\{i\}\.Substitutingm^˙=b^t\\dot\{\\hat\{m\}\}=\\hat\{b\}\_\{t\}andv^˙=c^t\\dot\{\\hat\{v\}\}=\\hat\{c\}\_\{t\}into the AdamW parameter update yields the recursion forata\_\{t\}\. ThereforeaK=D​T​\(θA\)​δa\_\{K\}=DT\(\\theta\_\{A\}\)\\delta\. ∎

### B\.2First\-order process\-sidecar identity

Define the exact transported memory direction and residual sidecar

p:=JS​\(u\):=D​T​\(θA\)​u,r:=RS←M:=p−u\.p:=J\_\{S\}\(u\):=DT\(\\theta\_\{A\}\)u,\\qquad r:=R\_\{S\\leftarrow M\}:=p\-u\.For the theorem statements in this appendix we work with the exact\-derivative edit family

θexact​\(λ,γ\)=θA​M​S−λ​u−γ​r\.\\theta\_\{\\mathrm\{exact\}\}\(\\lambda,\\gamma\)=\\theta\_\{AMS\}\-\\lambda u\-\\gamma r\.The empiricalθ^​\(λ,γ\)\\hat\{\\theta\}\(\\lambda,\\gamma\)used in §[3](https://arxiv.org/html/2606.30788#S3)of the main paper replacesrrby the centered\-secant estimater^=R^S←M\\hat\{r\}=\\hat\{R\}\_\{S\\leftarrow M\}; the secant bias‖r^−r‖=O​\(ε2​‖u‖3\)\\left\\lVert\\hat\{r\}\-r\\right\\rVert=O\(\\varepsilon^\{2\}\\left\\lVert u\\right\\rVert^\{3\}\)enters as an additiveO​\(ε2​‖u‖3\)O\(\\varepsilon^\{2\}\\left\\lVert u\\right\\rVert^\{3\}\)term in the expansions below\.

###### Theorem 8\(Process\-JVP identity and first\-order oracle recovery\)\.

SupposeTTis twice differentiable onB​\(θA,r0\)B\(\\theta\_\{A\},r\_\{0\}\)and‖D2​T​\(x\)‖op≤L2\\left\\lVert D^\{2\}T\(x\)\\right\\rVert\_\{\\mathrm\{op\}\}\\leq L\_\{2\}throughout the ball\. If‖u‖≤r0\\left\\lVert u\\right\\rVert\\leq r\_\{0\}, then

θA​M​S=θA​S\+p\+ρ2=θA​S\+u\+r\+ρ2,‖ρ2‖≤L22​‖u‖2\.\\theta\_\{AMS\}=\\theta\_\{AS\}\+p\+\\rho\_\{2\}=\\theta\_\{AS\}\+u\+r\+\\rho\_\{2\},\\qquad\\left\\lVert\\rho\_\{2\}\\right\\rVert\\leq\\frac\{L\_\{2\}\}\{2\}\\left\\lVert u\\right\\rVert^\{2\}\.Consequently,

θexact​\(1,1\)=θA​S\+ρ2,‖θexact​\(1,1\)−θA​S‖≤L22​‖u‖2\.\\theta\_\{\\mathrm\{exact\}\}\(1,1\)=\\theta\_\{AS\}\+\\rho\_\{2\},\\qquad\\left\\lVert\\theta\_\{\\mathrm\{exact\}\}\(1,1\)\-\\theta\_\{AS\}\\right\\rVert\\leq\\frac\{L\_\{2\}\}\{2\}\\left\\lVert u\\right\\rVert^\{2\}\.

###### Proof\.

BecauseθA​M=θA\+u\\theta\_\{AM\}=\\theta\_\{A\}\+u, we haveθA​M​S=T​\(θA\+u\)\\theta\_\{AMS\}=T\(\\theta\_\{A\}\+u\)andθA​S=T​\(θA\)\\theta\_\{AS\}=T\(\\theta\_\{A\}\)\. Taylor’s theorem with second\-order remainder gives

T​\(θA\+u\)=T​\(θA\)\+D​T​\(θA\)​u\+ρ2,‖ρ2‖≤L22​‖u‖2\.T\(\\theta\_\{A\}\+u\)=T\(\\theta\_\{A\}\)\+DT\(\\theta\_\{A\}\)u\+\\rho\_\{2\},\\qquad\\left\\lVert\\rho\_\{2\}\\right\\rVert\\leq\\frac\{L\_\{2\}\}\{2\}\\left\\lVert u\\right\\rVert^\{2\}\.Substitute the definitions ofppandr=p−ur=p\-u\. The statement forθexact​\(1,1\)\\theta\_\{\\mathrm\{exact\}\}\(1,1\)follows by subtractingu\+r=pu\+r=p\. ∎

###### Proposition 9\(Naive task arithmetic misses the transported component\)\.

LetPuP\_\{u\}be Euclidean projection ontospan⁡\{u\}\\operatorname\{span\}\\\{u\\\}, and definer⟂=\(I−Pu\)​rr\_\{\\perp\}=\(I\-P\_\{u\}\)r\. Under Theorem[8](https://arxiv.org/html/2606.30788#Thmtheorem8), every naive editθnaive​\(λ\)=θA​M​S−λ​u\\theta\_\{\\mathrm\{naive\}\}\(\\lambda\)=\\theta\_\{AMS\}\-\\lambda usatisfies

‖θnaive​\(λ\)−θA​S‖≥‖r⟂‖−‖ρ2‖\.\\left\\lVert\\theta\_\{\\mathrm\{naive\}\}\(\\lambda\)\-\\theta\_\{AS\}\\right\\rVert\\geq\\left\\lVert r\_\{\\perp\}\\right\\rVert\-\\left\\lVert\\rho\_\{2\}\\right\\rVert\.The process\-sidecar pointθexact​\(1,1\)\\theta\_\{\\mathrm\{exact\}\}\(1,1\)has error at most‖ρ2‖\\left\\lVert\\rho\_\{2\}\\right\\rVert\. Thus if‖r⟂‖\>2​‖ρ2‖\\left\\lVert r\_\{\\perp\}\\right\\rVert\>2\\left\\lVert\\rho\_\{2\}\\right\\rVert, the sidecar point is strictly closer to the counterfactual oracle than every naive edit in parameter norm\.

###### Proof\.

For the naive line,

θnaive​\(λ\)−θA​S=\(1−λ\)​u\+r\+ρ2\.\\theta\_\{\\mathrm\{naive\}\}\(\\lambda\)\-\\theta\_\{AS\}=\(1\-\\lambda\)u\+r\+\\rho\_\{2\}\.The best choice ofλ\\lambdacan cancel only the component ofrrlying inspan⁡\{u\}\\operatorname\{span\}\\\{u\\\}; the orthogonal componentr⟂r\_\{\\perp\}remains\. The triangle inequality gives the lower bound\. The upper bound forθexact​\(1,1\)\\theta\_\{\\mathrm\{exact\}\}\(1,1\)is Theorem[8](https://arxiv.org/html/2606.30788#Thmtheorem8)\. ∎

### B\.3The centered\-secant sidecar used by the implementation

The code estimates the transported direction by a finite centered secant,

J^S,ε​\(u\)=T​\(θA\+ε​u\)−T​\(θA−ε​u\)2​ε\.\\hat\{J\}\_\{S,\\varepsilon\}\(u\)=\\frac\{T\(\\theta\_\{A\}\+\\varepsilon u\)\-T\(\\theta\_\{A\}\-\\varepsilon u\)\}\{2\\varepsilon\}\.Forε=1\\varepsilon=1, this is a centered secant at the memory\-edit scale, not an infinitesimal derivative\. The derivative theorem is the local limit\.

###### Proposition 10\(Centered\-secant bias\)\.

AssumeT∈C3T\\in C^\{3\}on the segmentθA\+s​u\\theta\_\{A\}\+su,\|s\|≤ε\\lvert s\\rvert\\leq\\varepsilon, and‖D3​T​\(x\)‖op≤L3\\left\\lVert D^\{3\}T\(x\)\\right\\rVert\_\{\\mathrm\{op\}\}\\leq L\_\{3\}there\. Then

‖J^S,ε​\(u\)−D​T​\(θA\)​u‖≤L36​ε2​‖u‖3\.\\left\\lVert\\hat\{J\}\_\{S,\\varepsilon\}\(u\)\-DT\(\\theta\_\{A\}\)u\\right\\rVert\\leq\\frac\{L\_\{3\}\}\{6\}\\varepsilon^\{2\}\\left\\lVert u\\right\\rVert^\{3\}\.Consequently,

‖θA​M​S−J^S,ε​\(u\)−θA​S‖≤L22​‖u‖2\+L36​ε2​‖u‖3\.\\left\\lVert\\theta\_\{AMS\}\-\\hat\{J\}\_\{S,\\varepsilon\}\(u\)\-\\theta\_\{AS\}\\right\\rVert\\leq\\frac\{L\_\{2\}\}\{2\}\\left\\lVert u\\right\\rVert^\{2\}\+\\frac\{L\_\{3\}\}\{6\}\\varepsilon^\{2\}\\left\\lVert u\\right\\rVert^\{3\}\.

###### Proof\.

Apply the one\-dimensional Taylor theorem toφ​\(s\)=T​\(θA\+s​u\)\\varphi\(s\)=T\(\\theta\_\{A\}\+su\)\. The centered difference cancels the even second\-order term and leaves a third\-derivative remainder bounded by\(L3/6\)​ε2​‖u‖3\(L\_\{3\}/6\)\\varepsilon^\{2\}\\left\\lVert u\\right\\rVert^\{3\}\. Add this estimator bias to the remainder in Theorem[8](https://arxiv.org/html/2606.30788#Thmtheorem8)\. ∎

### B\.4Second\-order frontier: why the two\-dimensional family can beat the process\-JVP line

The first\-order theorem does not say that the two\-dimensional edit beats the process\-JVP line at first order\. The process\-JVP lineθA​M​S−η​p\\theta\_\{AMS\}\-\\eta pcontains the same first\-order oracle atη=1\\eta=1\. The advantage of the full\(u,r\)\(u,r\)family is second\-order and validation\-dependent\.

Assume in this subsection thatT∈C3T\\in C^\{3\}nearθA\\theta\_\{A\}, and define

q=12​D2​T​\(θA\)​\[u,u\]\.q=\\tfrac\{1\}\{2\}D^\{2\}T\(\\theta\_\{A\}\)\[u,u\]\.Then

θA​M​S=θA​S\+p\+q\+O​\(‖u‖3\)\.\\theta\_\{AMS\}=\\theta\_\{AS\}\+p\+q\+O\(\\left\\lVert u\\right\\rVert^\{3\}\)\.The residual fromθA​S\\theta\_\{AS\}after a process\-JVP edit is

e1​D​\(η\)=q\+\(1−η\)​p\+O​\(‖u‖3\),e\_\{\\mathrm\{1D\}\}\(\\eta\)=q\+\(1\-\\eta\)p\+O\(\\left\\lVert u\\right\\rVert^\{3\}\),whereas the residual after a two\-dimensional edit is

e2​D​\(λ,γ\)\\displaystyle e\_\{\\mathrm\{2D\}\}\(\\lambda,\\gamma\)=q\+\(1−λ\)​u\+\(1−γ\)​r\+O​\(‖u‖3\)\\displaystyle=q\+\(1\-\\lambda\)u\+\(1\-\\gamma\)r\+O\(\\left\\lVert u\\right\\rVert^\{3\}\)\(14\)=q\+τ​p\+ζ​r\+O​\(‖u‖3\),\\displaystyle=q\+\\tau p\+\\zeta r\+O\(\\left\\lVert u\\right\\rVert^\{3\}\),\(15\)with natural coordinates

τ=1−λ,ζ=λ−γ\.\\tau=1\-\\lambda,\\qquad\\zeta=\\lambda\-\\gamma\.The process\-JVP line is exactly the subfamilyζ=0\\zeta=0\.

###### Theorem 11\(Local quadratic frontier expansion\)\.

Letℓ\\ellbe a twice\-differentiable local scalarization of the validation criterion aroundθA​S\\theta\_\{AS\}, with expansion

ℓ​\(θA​S\+e\)=ℓ0\+g⊤​e\+12​e⊤​H​e\+O​\(‖e‖3\),\\ell\(\\theta\_\{AS\}\+e\)=\\ell\_\{0\}\+g^\{\\top\}e\+\\tfrac\{1\}\{2\}e^\{\\top\}He\+O\(\\left\\lVert e\\right\\rVert^\{3\}\),whereH≻0H\\succ 0onspan⁡\{p,r\}\\operatorname\{span\}\\\{p,r\\\}\. Suppose the quadratic minimizers below remain in the local neighborhood where the expansion is valid\. For any subspaceW⊆span⁡\{p,r\}W\\subseteq\\operatorname\{span\}\\\{p,r\\\}, define the quadratic surrogate value

V​\(W\)=minw∈W⁡\(g⊤​\(q\+w\)\+12​\(q\+w\)⊤​H​\(q\+w\)\)\.V\(W\)=\\min\_\{w\\in W\}\\left\(g^\{\\top\}\(q\+w\)\+\\tfrac\{1\}\{2\}\(q\+w\)^\{\\top\}H\(q\+w\)\\right\)\.Let

W1=span⁡\{p\},W2=span⁡\{p,r\}=span⁡\{u,r\}\.W\_\{1\}=\\operatorname\{span\}\\\{p\\\},\\qquad W\_\{2\}=\\operatorname\{span\}\\\{p,r\\\}=\\operatorname\{span\}\\\{u,r\\\}\.ThenV​\(W2\)≤V​\(W1\)V\(W\_\{2\}\)\\leq V\(W\_\{1\}\)\. Moreover, define

r⟂=r−Pspan⁡\{p\}H​r,r\_\{\\perp\}=r\-P^\{H\}\_\{\\operatorname\{span\}\\\{p\\\}\}r,wherePHP^\{H\}isHH\-orthogonal projection\. Ifr⟂≠0r\_\{\\perp\}\\neq 0, the improvement is strict iff

q⊤​H​r⟂\+g⊤​r⟂≠0\.q^\{\\top\}Hr\_\{\\perp\}\+g^\{\\top\}r\_\{\\perp\}\\neq 0\.After profiling over the process\-JVP coordinateτ\\tau, the optimal off\-diagonal coordinate is

ζ∗=−q⊤​H​r⟂\+g⊤​r⟂‖r⟂‖H2\.\\zeta^\{\*\}=\-\\frac\{q^\{\\top\}Hr\_\{\\perp\}\+g^\{\\top\}r\_\{\\perp\}\}\{\\left\\lVert r\_\{\\perp\}\\right\\rVert^\{2\}\_\{H\}\}\.

###### Proof\.

Weak dominance is immediate fromW1⊆W2W\_\{1\}\\subseteq W\_\{2\}: the minimum over the larger feasible subspace cannot be worse\.

For strictness, first minimize overW1W\_\{1\}\. Letw1∗∈W1w^\{\*\}\_\{1\}\\in W\_\{1\}be the unique minimizer, which exists becauseH≻0H\\succ 0on the plane\. The first\-order condition says

g⊤​h\+⟨q\+w1∗,h⟩H=0for all​h∈W1\.g^\{\\top\}h\+\\left\\langle q\+w^\{\*\}\_\{1\},h\\right\\rangle\_\{H\}=0\\quad\\text\{for all \}h\\in W\_\{1\}\.Sincer⟂r\_\{\\perp\}isHH\-orthogonal toW1W\_\{1\}, varying from the profiled one\-dimensional optimum in the off\-diagonal direction gives the one\-variable quadratic

ϕ​\(ζ\)=g⊤​\(q\+w1∗\+ζ​r⟂\)\+12​‖q\+w1∗\+ζ​r⟂‖H2\.\\phi\(\\zeta\)=g^\{\\top\}\(q\+w^\{\*\}\_\{1\}\+\\zeta r\_\{\\perp\}\)\+\\tfrac\{1\}\{2\}\\left\\lVert q\+w^\{\*\}\_\{1\}\+\\zeta r\_\{\\perp\}\\right\\rVert^\{2\}\_\{H\}\.Its derivative at zero is

ϕ′​\(0\)=g⊤​r⟂\+⟨q\+w1∗,r⟂⟩H=g⊤​r⟂\+q⊤​H​r⟂,\\phi^\{\\prime\}\(0\)=g^\{\\top\}r\_\{\\perp\}\+\\left\\langle q\+w^\{\*\}\_\{1\},r\_\{\\perp\}\\right\\rangle\_\{H\}=g^\{\\top\}r\_\{\\perp\}\+q^\{\\top\}Hr\_\{\\perp\},becausew1∗∈W1w^\{\*\}\_\{1\}\\in W\_\{1\}andr⟂⟂HW1r\_\{\\perp\}\\perp\_\{H\}W\_\{1\}\. Its curvature isϕ′′​\(ζ\)=‖r⟂‖H2\>0\\phi^\{\\prime\\prime\}\(\\zeta\)=\\left\\lVert r\_\{\\perp\}\\right\\rVert^\{2\}\_\{H\}\>0\. Hence adding the off\-diagonal direction strictly improves the value exactly whenϕ′​\(0\)≠0\\phi^\{\\prime\}\(0\)\\neq 0, and minimizingϕ\\phigives the displayedζ∗\\zeta^\{\*\}\. ∎

###### Corollary 12\(Constrained\-validation/KKT interpretation\)\.

Let the validation selector minimizef0​\(e\)=−M​\(e\)f\_\{0\}\(e\)=\-M\(e\)subject to smooth local constraintscj​\(e\)≤0c\_\{j\}\(e\)\\leq 0, e\.g\. secret\-AUC and skill\-retention thresholds\. At a regular local constrained optimum, letμj≥0\\mu\_\{j\}\\geq 0be active KKT multipliers and define the Lagrangian scalarization

ℒ​\(e,μ\)=f0​\(e\)\+∑jμj​cj​\(e\)\.\\mathcal\{L\}\(e,\\mu\)=f\_\{0\}\(e\)\+\\sum\_\{j\}\\mu\_\{j\}c\_\{j\}\(e\)\.If the HessianHℒ=∇e2ℒ​\(0,μ\)H\_\{\\mathcal\{L\}\}=\\nabla^\{2\}\_\{e\}\\mathcal\{L\}\(0,\\mu\)satisfies the second\-order sufficient condition on the candidate plane or on the relevant critical cone, then Theorem[11](https://arxiv.org/html/2606.30788#Thmtheorem11)applies withg=∇eℒ​\(0,μ\)g=\\nabla\_\{e\}\\mathcal\{L\}\(0,\\mu\)andH=HℒH=H\_\{\\mathcal\{L\}\}\. Thus active validation constraints change the scalarization and Hessian, but not the geometric criterion: strict off\-diagonal improvement is governed by theHℒH\_\{\\mathcal\{L\}\}\-weighted projection of the second\-order/KKT correction ontor⟂r\_\{\\perp\}\.

### B\.5Oracle\-free finite\-grid selector

Let𝒢\\mathcal\{G\}be the declared finite edit grid\. For each candidatea∈𝒢a\\in\\mathcal\{G\}, define population validation quantities

A​\(a\)=secret AUC,R​\(a\)=skill retention,M​\(a\)=refusal margin,N​\(a\)=edit norm\.A\(a\)=\\text\{secret AUC\},\\quad R\(a\)=\\text\{skill retention\},\\quad M\(a\)=\\text\{refusal margin\},\\quad N\(a\)=\\text\{edit norm\}\.The population decision rule is

maxa∈𝒢⁡M​\(a\)subject toA​\(a\)≤a0,R​\(a\)≥r0,\\max\_\{a\\in\\mathcal\{G\}\}M\(a\)\\quad\\text\{subject to\}\\quad A\(a\)\\leq a\_\{0\},\\quad R\(a\)\\geq r\_\{0\},with minimumN​\(a\)N\(a\)as a deterministic tie\-break\. The empirical selector uses validation estimatesA^,R^,M^\\hat\{A\},\\hat\{R\},\\hat\{M\}computed before any test evaluation\. In the experiments,a0=0\.6a\_\{0\}=0\.6andr0=0\.9r\_\{0\}=0\.9\.

###### Theorem 13\(Slacked finite\-grid selector guarantee\)\.

Suppose that, with probability at least1−δc1\-\\delta\_\{c\}, all candidates satisfy

\|A^​\(a\)−A​\(a\)\|≤ϵA​\(a\),\|R^​\(a\)−R​\(a\)\|≤ϵR​\(a\)\.\\lvert\\hat\{A\}\(a\)\-A\(a\)\\rvert\\leq\\epsilon\_\{A\}\(a\),\\qquad\\lvert\\hat\{R\}\(a\)\-R\(a\)\\rvert\\leq\\epsilon\_\{R\}\(a\)\.Let the empirical selector use tightened feasibility

A^​\(a\)≤a0−ϵA​\(a\),R^​\(a\)≥r0\+ϵR​\(a\),\\hat\{A\}\(a\)\\leq a\_\{0\}\-\\epsilon\_\{A\}\(a\),\\qquad\\hat\{R\}\(a\)\\geq r\_\{0\}\+\\epsilon\_\{R\}\(a\),and choose among feasible candidates the one maximizingM^\\hat\{M\}, with minimum\-norm tie\-break\. Then the selected candidatea^\\hat\{a\}is population feasible:A​\(a^\)≤a0A\(\\hat\{a\}\)\\leq a\_\{0\}andR​\(a^\)≥r0R\(\\hat\{a\}\)\\geq r\_\{0\}\.

Furthermore, suppose that, with probability at least1−δm1\-\\delta\_\{m\}, for every ordered pair\(a,b\)∈𝒢2\(a,b\)\\in\\mathcal\{G\}^\{2\},

M​\(a\)−M​\(b\)≥M^​\(a\)−M^​\(b\)−rada​b\.M\(a\)\-M\(b\)\\geq\\hat\{M\}\(a\)\-\\hat\{M\}\(b\)\-\\mathrm\{rad\}\_\{ab\}\.Then, on the joint event, for every candidatebbsatisfying the stronger population slack

A​\(b\)≤a0−2​ϵA​\(b\),R​\(b\)≥r0\+2​ϵR​\(b\),A\(b\)\\leq a\_\{0\}\-2\\epsilon\_\{A\}\(b\),\\qquad R\(b\)\\geq r\_\{0\}\+2\\epsilon\_\{R\}\(b\),we have

M​\(a^\)≥M​\(b\)−rada^​b\.M\(\\hat\{a\}\)\\geq M\(b\)\-\\mathrm\{rad\}\_\{\\hat\{a\}b\}\.In particular,a^\\hat\{a\}is near\-optimal over the slacked feasible grid, with the loss controlled by paired candidate\-difference uncertainty rather than by a raw uniform Hoeffding radius forMM\.

###### Proof\.

The feasibility claim follows immediately: ifA^​\(a^\)≤a0−ϵA​\(a^\)\\hat\{A\}\(\\hat\{a\}\)\\leq a\_\{0\}\-\\epsilon\_\{A\}\(\\hat\{a\}\)and\|A^−A\|≤ϵA\\lvert\\hat\{A\}\-A\\rvert\\leq\\epsilon\_\{A\}, thenA​\(a^\)≤a0A\(\\hat\{a\}\)\\leq a\_\{0\}; the retention constraint is identical with the inequality reversed\.

Ifbbsatisfies the stronger population slack, then the same concentration event impliesA^​\(b\)≤a0−ϵA​\(b\)\\hat\{A\}\(b\)\\leq a\_\{0\}\-\\epsilon\_\{A\}\(b\)andR^​\(b\)≥r0\+ϵR​\(b\)\\hat\{R\}\(b\)\\geq r\_\{0\}\+\\epsilon\_\{R\}\(b\), sobbis empirically feasible\. Sincea^\\hat\{a\}maximizesM^\\hat\{M\}over the empirical feasible set,M^​\(a^\)−M^​\(b\)≥0\\hat\{M\}\(\\hat\{a\}\)\-\\hat\{M\}\(b\)\\geq 0, up to deterministic tie\-breaking\. The pairwise margin event gives

M​\(a^\)−M​\(b\)≥M^​\(a^\)−M^​\(b\)−rada^​b≥−rada^​b\.∎M\(\\hat\{a\}\)\-M\(b\)\\geq\\hat\{M\}\(\\hat\{a\}\)\-\\hat\{M\}\(b\)\-\\mathrm\{rad\}\_\{\\hat\{a\}b\}\\geq\-\\mathrm\{rad\}\_\{\\hat\{a\}b\}\.\\qed

###### Proposition 14\(Paired empirical\-Bernstein radius\)\.

LetM​\(a\)=𝔼​\[mi​\(a\)\]M\(a\)=\\mathbb\{E\}\[m\_\{i\}\(a\)\], where validation units are independent and shared across candidates\. For an ordered pair\(a,b\)\(a,b\), define

Xia​b=mi​\(a\)−mi​\(b\),D^a​b=1n​∑iXia​b,σ^a​b2=1n−1​∑i\(Xia​b−D^a​b\)2\.X^\{ab\}\_\{i\}=m\_\{i\}\(a\)\-m\_\{i\}\(b\),\\qquad\\hat\{D\}\_\{ab\}=\\frac\{1\}\{n\}\\sum\_\{i\}X^\{ab\}\_\{i\},\\qquad\\hat\{\\sigma\}^\{2\}\_\{ab\}=\\frac\{1\}\{n\-1\}\\sum\_\{i\}\(X^\{ab\}\_\{i\}\-\\hat\{D\}\_\{ab\}\)^\{2\}\.Assume the random variablesXia​bX^\{ab\}\_\{i\}lie almost surely in an interval of lengthBa​bB\_\{ab\}\. A standard empirical\-Bernstein union bound gives, simultaneously over all ordered pairs, with probability at least1−δ1\-\\delta,

M​\(a\)−M​\(b\)≥D^a​b−2​σ^a​b2​log⁡\(2​\|𝒢\|2/δ\)n−7​Ba​b​log⁡\(2​\|𝒢\|2/δ\)3​\(n−1\)\.M\(a\)\-M\(b\)\\geq\\hat\{D\}\_\{ab\}\-\\sqrt\{\\frac\{2\\hat\{\\sigma\}^\{2\}\_\{ab\}\\log\(2\\lvert\\mathcal\{G\}\\rvert^\{2\}/\\delta\)\}\{n\}\}\-\\frac\{7B\_\{ab\}\\log\(2\\lvert\\mathcal\{G\}\\rvert^\{2\}/\\delta\)\}\{3\(n\-1\)\}\.Thus Theorem[13](https://arxiv.org/html/2606.30788#Thmtheorem13)can use this data\-dependentrada​b\\mathrm\{rad\}\_\{ab\}\. When candidates are evaluated on the same validation prompts, the paired varianceσ^a​b2\\hat\{\\sigma\}^\{2\}\_\{ab\}can be far smaller than the marginal variance of either candidate’s raw margin\.

###### Proposition 15\(Across\-trial sign\-test validation\)\.

For held\-out comparisons across independent trials, letDjD\_\{j\}be the test metric difference between two fixed procedures on trialjj\. Under the null hypothesis that the median difference is nonpositive, and assuming no ties or random tie\-breaking, observingsspositive signs inTTtrials has one\-sidedpp\-value

∑k=sT\(Tk\)​2−T\.\\sum\_\{k=s\}^\{T\}\\binom\{T\}\{k\}2^\{\-T\}\.This validates a fixed method comparison, not the finite\-sample optimality of a within\-trial selector\. It is nevertheless the correct distribution\-free test for claims such as “the selected two\-dimensional method beats a matched process\-JVP baseline across independent trials\.”

### B\.6Gradient\-ascent unlearning: conditional safety drift, not impossibility

Let an FT\-unlearning procedure update

θt\+1=θt\+α​dt,\\theta\_\{t\+1\}=\\theta\_\{t\}\+\\alpha d\_\{t\},wheredtd\_\{t\}is the actual ascent/update direction produced by the procedure for the memory objective, possibly including optimizer preconditioning and retention terms\. LetLSL\_\{S\}be a safety loss\.

###### Proposition 16\(Safety drift under positive\-curvature memory ascent\)\.

AssumeLS∈C3L\_\{S\}\\in C^\{3\}along the unlearning trajectory and that its Hessian isL3L\_\{3\}\-Lipschitz there\. Then each step satisfies

LS​\(θt\+1\)−LS​\(θt\)=α​⟨∇LS​\(θt\),dt⟩\+α22​dt⊤​∇2LS​\(θt\)​dt\+Rt,L\_\{S\}\(\\theta\_\{t\+1\}\)\-L\_\{S\}\(\\theta\_\{t\}\)=\\alpha\\left\\langle\\nabla L\_\{S\}\(\\theta\_\{t\}\),d\_\{t\}\\right\\rangle\+\\frac\{\\alpha^\{2\}\}\{2\}d\_\{t\}^\{\\top\}\\nabla^\{2\}L\_\{S\}\(\\theta\_\{t\}\)d\_\{t\}\+R\_\{t\},with

\|Rt\|≤L36​α3​‖dt‖3\.\\lvert R\_\{t\}\\rvert\\leq\\frac\{L\_\{3\}\}\{6\}\\alpha^\{3\}\\left\\lVert d\_\{t\}\\right\\rVert^\{3\}\.If

\|⟨∇LS​\(θt\),dt⟩\|≤ϵt​‖dt‖,dt⊤​∇2LS​\(θt\)​dt≥Λt​‖dt‖2,\\lvert\\left\\langle\\nabla L\_\{S\}\(\\theta\_\{t\}\),d\_\{t\}\\right\\rangle\\rvert\\leq\\epsilon\_\{t\}\\left\\lVert d\_\{t\}\\right\\rVert,\\qquad d\_\{t\}^\{\\top\}\\nabla^\{2\}L\_\{S\}\(\\theta\_\{t\}\)d\_\{t\}\\geq\\Lambda\_\{t\}\\left\\lVert d\_\{t\}\\right\\rVert^\{2\},then afterKKsteps,

LS​\(θK\)−LS​\(θ0\)≥∑t=0K−1\(−α​ϵt​‖dt‖\+α22​Λt​‖dt‖2−L36​α3​‖dt‖3\)\.L\_\{S\}\(\\theta\_\{K\}\)\-L\_\{S\}\(\\theta\_\{0\}\)\\geq\\sum\_\{t=0\}^\{K\-1\}\\left\(\-\\alpha\\epsilon\_\{t\}\\left\\lVert d\_\{t\}\\right\\rVert\+\\frac\{\\alpha^\{2\}\}\{2\}\\Lambda\_\{t\}\\left\\lVert d\_\{t\}\\right\\rVert^\{2\}\-\\frac\{L\_\{3\}\}\{6\}\\alpha^\{3\}\\left\\lVert d\_\{t\}\\right\\rVert^\{3\}\\right\)\.If additionally‖dt‖∈\[Gmin,Gmax\]\\left\\lVert d\_\{t\}\\right\\rVert\\in\[G\_\{\\min\},G\_\{\\max\}\],ϵt≤ϵ\\epsilon\_\{t\}\\leq\\epsilon, andΛt≥Λ\>0\\Lambda\_\{t\}\\geq\\Lambda\>0, then

LS​\(θK\)−LS​\(θ0\)≥K​\(−α​ϵ​Gmax\+α22​Λ​Gmin2−L36​α3​Gmax3\)\.L\_\{S\}\(\\theta\_\{K\}\)\-L\_\{S\}\(\\theta\_\{0\}\)\\geq K\\left\(\-\\alpha\\epsilon G\_\{\\max\}\+\\frac\{\\alpha^\{2\}\}\{2\}\\Lambda G\_\{\\min\}^\{2\}\-\\frac\{L\_\{3\}\}\{6\}\\alpha^\{3\}G\_\{\\max\}^\{3\}\\right\)\.

###### Proof\.

Taylor expandLS​\(θt\+α​dt\)L\_\{S\}\(\\theta\_\{t\}\+\\alpha d\_\{t\}\)to second order with third\-order Lipschitz\-Hessian remainder\. Lower\-bound the linear term by−α​ϵt​‖dt‖\-\\alpha\\epsilon\_\{t\}\\left\\lVert d\_\{t\}\\right\\rVert, lower\-bound the quadratic term by\(α2/2\)​Λt​‖dt‖2\(\\alpha^\{2\}/2\)\\Lambda\_\{t\}\\left\\lVert d\_\{t\}\\right\\rVert^\{2\}, upper\-bound the magnitude of the remainder, and sum overtt\. ∎

###### Corollary 17\(Eigenprojection form\)\.

LetPkP\_\{k\}be the orthogonal projector onto an invariant subspace of∇2LS​\(θt\)\\nabla^\{2\}L\_\{S\}\(\\theta\_\{t\}\), equivalently a span of its eigenvectors, on which∇2LS​\(θt\)⪰λk​I\\nabla^\{2\}L\_\{S\}\(\\theta\_\{t\}\)\\succeq\\lambda\_\{k\}I\. Suppose the invariant orthogonal complement has curvature lower bounded by−β​I\-\\beta I\. If‖Pk​dt‖2≥ρt​‖dt‖2\\left\\lVert P\_\{k\}d\_\{t\}\\right\\rVert^\{2\}\\geq\\rho\_\{t\}\\left\\lVert d\_\{t\}\\right\\rVert^\{2\}, then

dt⊤​∇2LS​\(θt\)​dt≥\(ρt​λk−\(1−ρt\)​β\)​‖dt‖2\.d\_\{t\}^\{\\top\}\\nabla^\{2\}L\_\{S\}\(\\theta\_\{t\}\)d\_\{t\}\\geq\\big\(\\rho\_\{t\}\\lambda\_\{k\}\-\(1\-\\rho\_\{t\}\)\\beta\\big\)\\left\\lVert d\_\{t\}\\right\\rVert^\{2\}\.Thus the proposition applies withΛt=ρt​λk−\(1−ρt\)​β\\Lambda\_\{t\}=\\rho\_\{t\}\\lambda\_\{k\}\-\(1\-\\rho\_\{t\}\)\\betawhenever this quantity is positive\.

### B\.7Boundary cases for the second\-order frontier

#### Hessian anisotropy alone is insufficient\.

Letp=\(1,1\)p=\(1,1\),r=\(0,1\)r=\(0,1\),H=diag⁡\(1,10\)H=\\operatorname\{diag\}\(1,10\),g=0g=0, andq=2​pq=2p\. The Hessian is anisotropic on the plane, butq∈span⁡\{p\}q\\in\\operatorname\{span\}\\\{p\\\}, so the process\-JVP line cancels the second\-order residual exactly\. The full two\-dimensional family cannot improve on zero residual\.

#### Hessian anisotropy is not necessary\.

LetH=IH=I,p=\(1,0\)p=\(1,0\),r=\(0,1\)r=\(0,1\),g=0g=0, andq=rq=r\. The process\-JVP line cannot cancel therrcomponent, whereas the two\-dimensional family can\. Strict improvement holds with an isotropic Hessian\.

#### Rawγ\\gammasign is not invariant\.

The natural off\-diagonal coordinate isζ=λ−γ\\zeta=\\lambda\-\\gamma\. Reparameterizing the same edit family changes the raw coefficient attached torr, but the condition in Theorem[11](https://arxiv.org/html/2606.30788#Thmtheorem11)predicts the sign ofζ∗\\zeta^\{\*\}, not a universal sign forγ\\gamma\.

#### Finite\-scale secant\.

The centered\-secant theorem is asymptotic\. If the implemented estimator is

J^S,ε​\(u\)=T​\(θA\+ε​u\)−T​\(θA−ε​u\)2​ε,\\hat\{J\}\_\{S,\\varepsilon\}\(u\)=\\frac\{T\(\\theta\_\{A\}\+\\varepsilon u\)\-T\(\\theta\_\{A\}\-\\varepsilon u\)\}\{2\\varepsilon\},then using it in the sidecar point gives

θA​M​S−J^S,ε​\(u\)−θA​S=O​\(‖u‖2\)\+O​\(ε2​‖u‖3\)\.\\theta\_\{AMS\}\-\\hat\{J\}\_\{S,\\varepsilon\}\(u\)\-\\theta\_\{AS\}=O\(\\left\\lVert u\\right\\rVert^\{2\}\)\+O\(\\varepsilon^\{2\}\\left\\lVert u\\right\\rVert^\{3\}\)\.Thusε=1\\varepsilon=1is a centered secant at the memory\-edit scale\. The derivative theorem is the local limiting statement; finite\-scale accuracy is an empirical diagnostic\.

#### Indefinite projected Hessians\.

The closed\-form coefficient

ζ∗=−q⊤​H​r⟂\+g⊤​r⟂‖r⟂‖H2\\zeta^\{\*\}=\-\\frac\{q^\{\\top\}Hr\_\{\\perp\}\+g^\{\\top\}r\_\{\\perp\}\}\{\\left\\lVert r\_\{\\perp\}\\right\\rVert^\{2\}\_\{H\}\}is a minimizer only under the positive\-definite or second\-order\-sufficient condition stated in Theorem[11](https://arxiv.org/html/2606.30788#Thmtheorem11)\. If the projected Hessian onspan⁡\{p,r\}\\operatorname\{span\}\\\{p,r\\\}is indefinite, this expression may describe a stationary point or may be undefined as an optimization certificate\. In that case we use the trust\-region nesting statement

W1∩Bρ⊆W2∩BρW\_\{1\}\\cap B\_\{\\rho\}\\subseteq W\_\{2\}\\cap B\_\{\\rho\}and the empirical grid selector\. Any magnitude correlation involvingζ∗\\zeta^\{\*\}should be reported only on trials satisfying the theorem’s curvature hypothesis, or explicitly labeled as a diagnostic score rather than a theorem\-predicted minimizer\.

###### Lemma 18\(Linear\-dominated off\-diagonal sign diagnostic\)\.

Let

ℓ​\(e\)=ℓ0\+g⊤​e\+12​e⊤​H​e\+O​\(‖e‖3\)\\ell\(e\)=\\ell\_\{0\}\+g^\{\\top\}e\+\\tfrac\{1\}\{2\}e^\{\\top\}He\+O\(\\left\\lVert e\\right\\rVert^\{3\}\)be the local scalar objective to minimize, and writee​\(τ,ζ\)=q\+τ​p\+ζ​re\(\\tau,\\zeta\)=q\+\\tau p\+\\zeta r\. LetrE=r−Pspan⁡\{p\}E​rr\_\{E\}=r\-P^\{E\}\_\{\\operatorname\{span\}\\\{p\\\}\}rbe the Euclidean component ofrrnot reachable by the process\-JVP line\. After profiling overτ\\tau, suppose the objective variation in theζ\\zetadirection is linear\-dominated on the searched interval: for all searchedζ\\zeta,

\|⟨H​e​\(τ​\(ζ\),ζ\),rE⟩\|\+O​\(‖e‖2​‖rE‖\)<\|⟨g,rE⟩\|\.\\lvert\\left\\langle He\(\\tau\(\\zeta\),\\zeta\),r\_\{E\}\\right\\rangle\\rvert\+O\(\\left\\lVert e\\right\\rVert^\{2\}\\left\\lVert r\_\{E\}\\right\\rVert\)<\\lvert\\left\\langle g,r\_\{E\}\\right\\rangle\\rvert\.Then any local decrease from the process\-JVP line moves in the direction

sign⁡\(ζ\)=−sign⁡⟨g,rE⟩\.\\operatorname\{sign\}\(\\zeta\)=\-\\operatorname\{sign\}\\left\\langle g,r\_\{E\}\\right\\rangle\.This sign diagnostic does not requireHHto be positive definite, but it also does not give the positive\-definite magnitude formula forζ∗\\zeta^\{\*\}\.

###### Proof\.

The directional derivative of the profiled objective in the off\-diagonal direction is

∂ζℓ​\(e​\(τ​\(ζ\),ζ\)\)=⟨g\+H​e​\(τ​\(ζ\),ζ\),rE⟩\+O​\(‖e‖2​‖rE‖\),\\partial\_\{\\zeta\}\\ell\(e\(\\tau\(\\zeta\),\\zeta\)\)=\\left\\langle g\+He\(\\tau\(\\zeta\),\\zeta\),r\_\{E\}\\right\\rangle\+O\(\\left\\lVert e\\right\\rVert^\{2\}\\left\\lVert r\_\{E\}\\right\\rVert\),where the profiledτ\\tauterm drops out along the component orthogonal to the line\. Under the stated dominance condition, this derivative has the sign of⟨g,rE⟩\\left\\langle g,r\_\{E\}\\right\\rangle\. Moving in the opposite sign ofζ\\zetadecreases the objective\. ∎

#### Selector certificates\.

The paired empirical\-Bernstein theorem formalizes the finite\-grid selector, but it is only an empirical certificate when the resulting radius is smaller than the observed paired margin gap\. If the computed radius is larger than the effect at the validation size used here, the primary statistical evidence is the across\-trial sign test over independent trials\.

#### FT\-unlearn magnitude\.

The safety\-drift proposition is local and should not be used to predict the magnitude of large refusal\-collapse values\. The correct claim is directional: small first\-order safety gradient plus positive safety curvature of the memory ascent direction produces second\-order safety loss\. Observed large collapses are empirical outcomes outside the perturbative magnitude regime\.

## Appendix CExperimental details

#### Data and phases\.

Each synthetic trial constructs a public skill splitDAD\_\{A\}, a memory splitDMD\_\{M\}, and a refusal splitDSD\_\{S\}\. The memory set contains 64 high\-entropy canaries paired with entity identifiers; the refusal set includes entity\-specific prompts and decoys\. We trainAA, thenMMfromAA, thenSSfromA​MAM\. The oracleA​SASruns the sameSSphase fromAA\.

#### Candidate grids\.

The 2D process\-sidecar grid usesλ∈\{0\.75,1\.0,1\.25,1\.5\}\\lambda\\in\\\{0\.75,1\.0,1\.25,1\.5\\\}andγ∈\{−0\.5,0,0\.5,1\.0,1\.5,2\.0\}\\gamma\\in\\\{\-0\.5,0,0\.5,1\.0,1\.5,2\.0\\\}unless otherwise stated\. Naive candidates areγ=0\\gamma=0with the sameλ\\lambdavalues\. Process\-1D candidates areγ=λ\\gamma=\\lambda\. The gamma\-extension audit at Qwen\-2\.5\-0\.5B\-Instruct extendsγ\\gammathrough5\.05\.0and selects an interior point\(1\.5,2\.5\)\(1\.5,2\.5\)rather than a maximum\-grid corner\.

#### Selector\.

The selector filters on validation secret AUC≤0\.60\\leq 0\.60, validation skill retention≥0\.90\\geq 0\.90, and validation refusal preference rate≥0\.99\\geq 0\.99\. It maximizes the validation refusal\-margin improvement overθA​M​S\\theta\_\{AMS\}, transformed bylog⁡\(1\+max⁡\{0,⋅\}\)\\log\(1\+\\max\\\{0,\\cdot\\\}\), and breaks exact ties by edit norm\. The selector is run separately for each declared family\.

#### Statistics\.

The main intervals are percentile bootstrap intervals over independent trials\. The matched\-candidate claim reports paired per\-trial differences and, for the primary statistical certificate, a sign test over 15 model\-by\-data\-seed blocks that allows arbitrary dependence within each four\-trial block\. We do not use cluster\-bootstrap confidence intervals because the number of model\-level clusters is too small for a reliable 95% bootstrap interval\.

#### Compute, artifacts, and asset licensing\.

The reported grids ran on single\-GPU workers: RTX 6000 Ada\-class workers for the Qwen\-2\.5\-0\.5B\-Instruct runs, A100 80GB\-class workers for the Qwen\-2\.5\-1\.5B\-Instruct runs and heavy baseline sweeps, and RTX 4090/A100\-class workers for the Llama\-3\.2\-1B\-Instruct and 9B scale\-probe runs\. Single trials took roughly 10 minutes at 0\.5B and 30–60 minutes at 1–1\.5B depending on baseline coverage; the reported main, baseline, HVP, and fresh\-confirmatory experiments used roughly $60–$80 of cloud GPU time\. The supplement contains the training/editing code paths, selector scripts, analysis scripts, synthetic data generators, cached summary JSON files, figure\-generation scripts, training\-loss trajectories per phase, and a Python dependency manifest\. We release synthetic canary generators and cached summaries, not trained checkpoints containing memorized canaries\. Qwen\-2\.5\-0\.5B\-Instruct/1\.5B\-Instruct, Qwen3\-8B, and Qwen3\.5\-9B are used under Apache\-2\.0\[Qwen Team,[2024b](https://arxiv.org/html/2606.30788#bib.bib28),[c](https://arxiv.org/html/2606.30788#bib.bib29),[2025b](https://arxiv.org/html/2606.30788#bib.bib30),[2026b](https://arxiv.org/html/2606.30788#bib.bib33)\], Llama\-3\.2\-1B\-Instruct under the Llama 3\.2 Community License\[Meta AI,[2024](https://arxiv.org/html/2606.30788#bib.bib23)\], and the WMDP/RMU baseline code under the MIT license\[Center for AI Safety,[2024](https://arxiv.org/html/2606.30788#bib.bib3)\]; NPO is implemented from the cited paper rather than vendored as an external package\[Zhanget al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib40)\]\.

## Appendix DHVP probe audit details

For eight cached Qwen\-2\.5\-1\.5B\-Instruct trials, we estimated a reduced Hessian atθA​S\\theta\_\{AS\}by centered finite differences of the scalar safety validation loss\. The theory is stated in rawp=JS​\(u\)p=J\_\{S\}\(u\)andr=p−ur=p\-ucoordinates, whereas this cache uses unit\-normalized probe directions, and the profiled\-τ\\taulinear\-dominance hypothesis of Lemma[18](https://arxiv.org/html/2606.30788#Thmtheorem18)is not verified at grid scale\. We therefore use this appendix as a curvature\-hypothesis audit: the projected Hessian is positive definite in3/83/8cached probes\.

Table 5:Reduced\-Hessian curvature audit on cached 1\.5B trials\. PD means the two\-dimensional projected Hessian is positive definite\. The selector evidence in the main text comes from held\-out validation and matched\-family test comparisons\.
## Appendix EMatched\-candidate selector details

The matched\-candidate analysis reuses the cached 24\-cell 2D grid\. The diagonal subsetγ=λ\\gamma=\\lambdais the process\-JVP line inside that grid; theγ=0\\gamma=0subset is naive task arithmetic\. Running the same selector on these subsets controls evaluation noise and family restriction but not candidate count: the diagonal slice contains 2 cells and theγ=0\\gamma=0slice contains 4, against the 24\-cell 2D grid\. Candidate count is controlled separately by the equal\-density 24\-cell dense process\-JVP diagonal in §[5\.3](https://arxiv.org/html/2606.30788#S5.SS3)\.

Table 6:Per\-run matched\-candidate results\.
## Appendix FBaseline hyperparameters and configurations

All baselines share the LoRA setup of the main edits: rank 8, alpha 16, target modules\{q,k,v,o\}proj\\\{q,k,v,o\\\}\_\{\\mathrm\{proj\}\}and\{up,down,gate\}proj\\\{\\mathrm\{up\},\\mathrm\{down\},\\mathrm\{gate\}\\\}\_\{\\mathrm\{proj\}\}for the transformer scales \(Qwen\-2\.5\-0\.5B\-Instruct/1\.5B\-Instruct and Llama\-3\.2\-1B\-Instruct\); the 9B run additionally targets the SSM\-block projections\{inprojq​k​v,inprojz,inprojb,inproja,outproj\}\\\{\\mathrm\{in\}^\{qkv\}\_\{\\mathrm\{proj\}\},\\mathrm\{in\}^\{z\}\_\{\\mathrm\{proj\}\},\\mathrm\{in\}^\{b\}\_\{\\mathrm\{proj\}\},\\mathrm\{in\}^\{a\}\_\{\\mathrm\{proj\}\},\\mathrm\{out\}\_\{\\mathrm\{proj\}\}\\\}\. The same retain dataset \(skill prompts and safety\-general prompts\) and the same memory\-canary forget dataset are used for all baselines\.

#### FT\-unlearn\.

LetLforget,Lskill,LsafetyL\_\{\\mathrm\{forget\}\},L\_\{\\mathrm\{skill\}\},L\_\{\\mathrm\{safety\}\}denote the negative log\-likelihoods on the memory\-canary, public\-skill, and safety\-general data respectively\. A single optimization step minimises

LFT=−αforget​Lforget\+αskill​Lskill\+αsafety​Lsafety,L\_\{\\mathrm\{FT\}\}=\-\\alpha\_\{\\mathrm\{forget\}\}L\_\{\\mathrm\{forget\}\}\+\\alpha\_\{\\mathrm\{skill\}\}L\_\{\\mathrm\{skill\}\}\+\\alpha\_\{\\mathrm\{safety\}\}L\_\{\\mathrm\{safety\}\},so the negative sign onLforgetL\_\{\\mathrm\{forget\}\}implements gradient ascent on the memory\-canary NLL \(i\.e\. unlearning\) while the retain terms preserve skills and safety\. Default learning rate10−410^\{\-4\}, AdamW, batch size 8, one epoch\. The FT\-unlearn grid sweeps the six configurations

\(αforget,αskill,αsafety\)∈\{\(0\.5,0\.3,0\.5\),\(1\.0,0\.3,0\.5\),\(2\.0,0\.3,0\.5\),\(1\.0,1\.0,0\.5\),\(1\.0,0\.3,1\.0\),\(1\.0,1\.0,2\.0\)\}\.\(\\alpha\_\{\\mathrm\{forget\}\},\\alpha\_\{\\mathrm\{skill\}\},\\alpha\_\{\\mathrm\{safety\}\}\)\\in\\\{\(0\.5,0\.3,0\.5\),\(1\.0,0\.3,0\.5\),\(2\.0,0\.3,0\.5\),\(1\.0,1\.0,0\.5\),\(1\.0,0\.3,1\.0\),\(1\.0,1\.0,2\.0\)\\\}\.The default\-trial baseline sweep uses\(1\.0,0\.3,0\.5\)\(1\.0,0\.3,0\.5\)\.

#### NPO\.

Negative Preference Optimization\[Zhanget al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib40)\]:β=0\.1\\beta=0\.1, NPO loss coefficient 1\.0, gradient\-difference retain coefficient 1\.0, learning rate10−410^\{\-4\}, AdamW, batch size 8, one epoch\. Retain set as above\.

#### RMU\.

Base\-parameter RMU baseline, following the WMDP\-RMU objective\[Liet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib16)\]: layer ids\{3,4,5\}\\\{3,4,5\\\}, parameter id 6 \(the MLP block of the steering layer\), steering coefficient 6\.5, forget\-loss weightα=1200\\alpha=1200, learning rate5×10−55\\times 10^\{\-5\}, AdamW\. This row updates selected base\-model parameters rather than LoRA adapter coordinates, so behavioral metrics are reported but LoRA\-coordinate weight\-space closure is not\.

#### TIES, DARE\.

TIES is per\-tensor magnitude trim from mergekit\[Goddardet al\.,[2024](https://arxiv.org/html/2606.30788#bib.bib6)\]; DARE is the canonical per\-element Bernoulli\(d\)\(d\)drop with1/d1/drescale fromYuet al\.\[[2024](https://arxiv.org/html/2606.30788#bib.bib39)\]\. We use the two\-line DARE formula directly because the mergekit Bernoulli helper does not apply this exact rescale\. We sweep densityd∈\{0\.2,0\.5,0\.8\}d\\in\\\{0\.2,0\.5,0\.8\\\}and scaleλ∈\{0\.75,1\.0,1\.25,1\.5\}\\lambda\\in\\\{0\.75,1\.0,1\.25,1\.5\\\}\(twelve cells per method per trial\), then apply the same selector\. Identical retain and validation pipelines to the main 2D experiments\.

#### Result summary at Qwen\-2\.5\-1\.5B\-Instruct\.

The RMU/NPO/FT baseline sweep at the 1\.5B scale has five trials\. FT\-unlearn has mean refusal closure−43\.39\-43\.39and median−47\.08\-47\.08\. NPO has mean refusal closure−1\.33\-1\.33\. RMU has refusal closure approximately zero and secret AUC remains high rather than reaching chance\. The structured\-synthetic canary has five trials; process\-2D wins5/55/5against naive on refusal, and FT\-unlearn has mean refusal closure−146\.75\-146\.75\.

## Appendix GBroader impacts

Process sidecars are intended for privacy\- and compliance\-driven deletion when a model has learned private or proprietary facts before later safety training\. The intended deployment is specific: remove a revocable memory while preserving the refusal behavior that protects the affected entities\. The same mechanism would be harmful if used to strip safety policies or to create false assurance about deletion, so deployment should require held\-out forgetting tests, refusal\-preservation tests, and audit logs tying an edit to the realized training trace\.

## Appendix HReproducibility statement

The experiments use fixed seeds and cached per\-trial JSON summaries; trained state tensors are omitted from the supplement because they can contain memorized canaries\. The selector is specified before test evaluation and does not use the oracle checkpoint\. The appendix gives the exact theorem assumptions, the finite\-grid selector statement, and the matched\-candidate and HVP diagnostics\.