Nullify Erases Knowledge From LLMs Without Retraining, Using Null-Space Vectors

A team of researchers has published a preprint on arXiv called Nullify, a method for unlearning in large language models that needs not a single fine-tuning step. Instead of editing weights, it adds steering vectors to activations during inference and pushes the internal representations of private queries away from memorized answers. On two benchmarks, TOFU and MUSE, Nullify matches established methods on forgetting quality, and model utility stays almost intact. The preprint appeared on 9 October 2026 in the cs.LG category.

The problem: forgetting is expensive, and utility is fragile

During pretraining, LLMs inevitably absorb personal data, private texts and other sensitive information. Unlearning is supposed to selectively erase such knowledge so the model does not reveal it when asked. Retraining from scratch without the problematic data is too expensive, so in practice teams use fine-tuning that modifies weights. This approach has two well-known drawbacks. It requires compute and data. And it easily breaks neighboring capabilities: once a model "forgets" one author, it starts getting confused on related questions. The Nullify authors explicitly name the balance between forgetting quality and utility as the main bottleneck of existing methods.

How Nullify works

The idea builds on activation steering. At inference time, a specially chosen vector is added to the hidden activations. It shifts the representation of a query tied to private information so that the model does not arrive at the memorized answer. The weights themselves stay untouched.

The key detail is the null-space constraint. The vector is constructed so that the activations of queries the model should keep handling as usual (retained queries) remain, according to the authors, practically unchanged. In other words, the shift is directed into a subspace where "permitted" queries barely feel it. This is an attempt to solve the main problem of any steering method: intervening on activations usually affects everything, not just the target knowledge.

What TOFU and MUSE showed

TOFU is a benchmark built on synthetic profiles of fictional authors, where it is known that the model could have learned the information only from a specific dataset. MUSE evaluates unlearning on real corpora: news and books. Together they cover both controlled and closer-to-practice scenarios.

Results from the abstract:

• Method type: training-free, with no weight updates.
• Mechanism: steering vectors applied at inference time.
• Utility protection: a null-space constraint for retained queries.
• Forgetting quality: on par with established baseline methods or better.
• Utility preservation: close to lossless.
• Deployment format: a plug-and-play add-on on top of a ready-made model.

The abstract gives no concrete numbers, so the size of the advantage over baseline approaches will have to be checked against the tables in the full paper.

Where to use it, and the catch

For teams that run LLMs in production and receive data deletion requests, the approach looks convenient. There is no need to run fine-tuning on GPUs for every request or to store multiple versions of the weights, and a set of vectors can be switched on and off like a configuration. This is especially relevant for legal tasks such as the right to be forgotten, where a fast response is needed.

However, there are questions the abstract does not answer, and they are worth checking before deployment. First, the knowledge still sits in the weights. This is a redirection of the answer, not physical deletion, and anyone with access to the model can remove the intervention. For open weights, the protection is effectively nominal. Second, robustness to paraphrasing, multi-step questions and targeted data-extraction attacks is unclear. Third, it is necessary to see how the number of vectors grows with multiple deletion requests and whether side effects accumulate.

The bottom line: Nullify is best seen as a fast protection layer for closed API deployments, not as a replacement for true unlearning. If independent checks confirm the results, the method will fill a notable niche between expensive fine-tuning and crude output filters.