Fengpeng Li

Forbidden capabilities can still be learned even when suppressed in current outputs, as internal gradients enable future acquisition, but gradient sealing effectively blocks these pathways.

Latent LLM personas persist in weights post-training, readily resurfacing with specific prompts, and standard unlearning methods are insufficient to remove them without performance degradation.

Even state-of-the-art AI-generated image detectors struggle when images are cropped, resized, or compressed, revealing a critical gap in real-world robustness.