{"id":"122d9986-3539-4ad0-b046-d09a4255b039","arxiv_id":"2411.15477","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Unlearning of LLMs is format-sensitive: the same model shows strong forgetting in Q&A but retains knowledge in cloze and analogy formats.","lead":"This paper tests whether machine unlearning in LLMs really makes a model forget by rephrasing the same questions in five new formats. The results show that unlearning success depends heavily on the format, so single-format benchmarks can overstate forgetting.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Missing target-model calibration: MCQA/Cloze residuals after unlearning may reflect format bias (pretrained scores 0.59–0.91 vs chance 0.25) rather than residual fact knowledge, so the central inference is not established.","rationale":"The reader's weakest assumption is that the five formats are interchangeable probes of the same facts, so higher non-default-format scores indicate residual knowledge rather than task difficulty or prompt artifacts. My reading identifies the same load-bearing vulnerability and sharpens it with concrete evidence from the paper's own tables: the pretrained model, which cannot know TOFU facts, performs far above chance on MCQA and even above the finetuned model on Comprehension-MCQA. This means the MCQA and Comprehension metrics are not calibrated knowledge sensors; a small gap between unlearned and pretrained models is not automatically evidence of successful forgetting, and a larger gap is not automatically evidence of leakage. The Cloze metric's absolute scale is so compressed that differences of a few thousandths in length-normalized sequence probability are hard to interpret as semantic recall. The cleanest resolution is to use the Target-LLM, which the paper defines but never evaluates. A model trained only on retain data is the correct gold standard for what a perfectly unlearned model should look like on each format. Comparing the unlearned model against this target on forget items directly measures residual knowledge while controlling for format-specific base rates. If the unlearned-minus-target residual is negligible, the paper's headline claim collapses to the trivial observation that different metrics produce different numbers; if it is substantial, the claim is strongly supported. Because this is an empirical control the authors could run immediately with their released data and existing TOFU infrastructure, the appropriate verdict remains conditional: the paper's message is plausible and useful, but the central inference is not yet established without calibration.","tokens_in":21382,"tokens_out":5094,"duration_ms":49642,"concrete_test":"Evaluate the gold-standard Target-LLM (TOFU model retrained on the retain split only) on the released transformed forget sets for both Llama2-7b and Phi-1.5, using the same prompts and metrics as the paper. For each format and each of the three unlearning methods, compute residual = Unlearned-LLM score − Target-LLM score with bootstrap confidence intervals over forget items. If residuals are not consistently positive for Cloze, MCQA, and Comprehension, the claim that unlearning leaves measurable residual knowledge is unsupported; if they are positive and comparable to the Finetuned−Target gap, the concern is resolved. Also compute chance-level performance on permuted or decoy answer sets to confirm each format's sensitivity.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central inference is that a higher post-unlearning score on a transformed format reflects residual knowledge of the forgotten facts. That requires the five formats to be valid, comparably sensitive probes of the same underlying facts, but the paper never calibrates them. In Section 4.2 and Tables 3–4, the pretrained Llama2 model, which has never seen TOFU, scores 0.59 on MCQA-4 forget items (chance 0.25), 0.72 on MCQA-2, and 0.91 on Comprehension-MCQA, sometimes exceeding the finetuned model's 0.71. These baselines indicate strong option-order and prompt biases, so MCQA success rate is not a clean measure of factual knowledge. On Cloze, the pretrained sequence probability is roughly 0.003 and the finetuned score only 0.018, a tiny dynamic range in which an unlearned value near 0.005 could be token-level surface overlap rather than semantic recall. Figure 2 superimposes these uncalibrated, non-comparable metrics and interprets gaps as differential forgetting. The missing control is the Target-LLM defined in Figure 1: a model trained only on retain data and therefore ignorant of forget facts. Without comparing Unlearned-LLM to Target-LLM on each format, one cannot tell whether Cloze/MCQA residuals are leakage or format artifacts.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an evaluation scheme for LLM unlearning that goes beyond the single-format (Q&A) evaluation used in the TOFU benchmark. The authors build five transformed versions of TOFU facts—MCQA, Cloze, Analogy, Odd-one-out, and Comprehension—and evaluate two open-weight models (Llama2-7b and Phi-1.5) after applying three unlearning algorithms (gradient ascent, gradient difference, and KL minimization). Their main empirical finding is that the apparent success of unlearning depends strongly on the evaluation format: for example, KL minimization reduces Q&A forget ROUGE from 0.93 to 0.51 at step 30, while the Cloze forget sequence probability stays at 0.0187, close to the fine-tuned value of 0.0181 and far above the pretrained value of 0.0032. The paper concludes that evaluation over a single format can be unreliable and that unlearning benchmarks should consider multiple formats. The authors release code and data.","tokens_in":21685,"tokens_out":5723,"duration_ms":53070,"significance":"If the central empirical claim is sustained, the paper provides a useful caution for the machine unlearning community: benchmark scores are format-dependent, and a method that looks successful in the default Q&A format may leave information retrievable in other formats. The main contribution is a new evaluation resource—five transformed formats over TOFU, with manual verification of the transformations and standard evaluation metrics—which the authors make publicly available. The paper also evaluates two base models and three unlearning methods, and includes qualitative examples that illustrate format-dependent behavior. However, the stronger interpretation that non-default format scores reveal residual knowledge of forgotten facts is not fully established, because the paper lacks the Target-LLM (retain-only) calibration that would separate true leakage from format bias or retain-set similarity. The resource is still valuable as a benchmark extension, and the recommendation to evaluate over multiple formats is reasonable even if the current evidence is not conclusive about the underlying cause of the discrepancies.","major_comments":[{"comment":"The paper defines the ideal unlearned model as behaving like the pretrained model, but in the TOFU setup the correct counterfactual is the Target-LLM introduced in Figure 1, i.e., a model fine-tuned only on the retain set. The Target-LLM is never evaluated. Consequently, the central interpretation that a high Cloze or MCQA score after unlearning indicates residual knowledge of forget facts is not established. In Table 3, the KL-minimized Llama2 model has a Cloze forget sequence probability of 0.0187 at step 30 versus 0.0032 for the pretrained model, but this gap could be explained by the model's retained knowledge of the other 180 authors, by general linguistic priors in the Cloze prompt, or by the specific masking scheme. Please add Target-LLM scores for all formats and both base models, and base the 'recall of forgotten information' interpretation on comparisons to that baseline.","section":"Section 4.2, Figure 2, Table 3"},{"comment":"The MCQA results are contaminated by strong format bias. The pretrained Llama2-7b, which has never seen TOFU, achieves 0.59 on the MCQA-4 forget items (chance 0.25), 0.72 on MCQA-2, and 0.91 on Comprehension-MCQA-4, the latter sometimes exceeding the fine-tuned model's 0.71. This shows that next-token selection among option IDs is driven by option ordering, lexical overlap, and prompt structure, not only by factual knowledge. Therefore, the difference between unlearned and fine-tuned MCQA success rates cannot be interpreted as a clean measure of fact recall. Please report chance-calibrated metrics, per-option-position accuracy, or option-randomized variants, and interpret the MCQA columns with this bias in mind.","section":"Section 4.2, Table 3"},{"comment":"All experimental numbers come from a single run of fine-tuning and unlearning, with no confidence intervals or multiple seeds. This is particularly problematic for the Odd-one-out retain split, which contains only 13 samples in the Forget01 setting and 66 in the Forget05 setting (Table 1). As a result, differences such as the Cloze forget value 0.0187 for KL minimization versus 0.0049 for gradient difference at step 30 in Table 3 could be within noise. Please provide error bars via multiple seeds or bootstrap resampling, and clearly state the limited sample size for Odd-one-out in the main text.","section":"Section 4.2, Tables 3-4, Table 1"}],"minor_comments":[{"comment":"The notation in the problem setup is inconsistent: 'Dtrain = Dretain ∪ Df orget' contains a stray space in 'Df orget', and the symbol '∼' for the transformation 'fi(Dp)' is nonstandard and should be replaced with a functional definition of the data-generation process.","section":"Section 3"},{"comment":"The number of new formats is inconsistent. The abstract says '5 new formats', Section 3 says three formats (MCQA, Cloze, Analogy) plus two additional ones (Odd-one-out and Comprehension), while the Discussion says '5 new variants ... including Q&A, MCQA, Cloze, Analogy, Comprehension, and Odd-One-Out', which lists six items including the default Q&A. Please clarify that Q&A is the original TOFU format and the five new formats are the transformations.","section":"Abstract and Section 5"},{"comment":"The Cloze sequence-probability formula is typeset incorrectly: 'P (x1, x2, . . . , xn) = n vuut Qn i=1 P (xi)' should be written as the n-th root of the product of token probabilities. As printed, the equation is difficult to read and may confuse readers about the normalization.","section":"Appendix B"},{"comment":"The caption says 'The spider plot shows a performance comparison', but Figure 1 contains the pipeline diagram and a spider plot embedded in the same figure. Since different formats use different metrics and the Cloze axis is 10x scaled, a separate main-text figure with labeled axes would be clearer than relying on the spider plot in the pipeline diagram.","section":"Figure 1 caption"}],"recommendation":"major_revision","confidential_remarks":"The paper is best framed as a benchmark/resource contribution rather than a definitive demonstration of 'leakage-proof forgetting'. The missing Target-LLM baseline is the key gap: the authors already define this model in Figure 1, so adding those experiments is within the manuscript's scope and would substantially strengthen the central claim. The paper also overlaps with concurrent work by Liu et al. (2024) on data transformations for unlearning evaluation; the authors should more explicitly position their contribution relative to that work. Given the single-run experiments and small Odd-one-out retain splits, the statistical reliability concerns are real but fixable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper has one clean result and one muddy package. The clean result is the Cloze contrast: after KL-min unlearning on Llama2-7b, Q&A forget ROUGE drops from 0.93 to 0.51, while the Cloze sequence probability sits at 0.0187, essentially identical to the finetuned model's 0.0181 and six times the pretrained baseline's 0.0032. That is direct evidence that single-format evaluation can miss residual knowledge. The muddy part is the MCQA-family numbers. Pretrained Llama2 scores 0.59 on MCQA-4 forget (chance 0.25), 0.72 on MCQA-2, and 0.91 on comprehension-MCQA, so high post-unlearning success rates in those formats are as plausibly option-order or prompt bias as retained facts. The paper should not lean on those as uncalibrated fact probes.\n\nWhat is new: five transformed TOFU-format evaluation sets (MCQA, Cloze, Analogy, Odd-one-out, Comprehension), applied to three unlearning methods on two open models, with code and data release. The authors cite the concurrent Liu et al. work that makes the same high-level recommendation, and they are upfront about it. The qualitative appendix is useful: you can see the same model answer correctly in one format and fail in another.\n\nSoft spots: no Target-LLM baseline, even though Figure 1 defines it. That would calibrate format difficulty. Single runs, no error bars. The Odd-one-out retain split is tiny (13 samples in Forget01), so those numbers are noise. Different metrics are overlaid in Figure 2 without normalization; the caption discloses this but the visual comparison still invites over-reading. Dataset construction is described sketchily: GPT-generated transformations with manual inspection, but no agreement numbers or release verification details.\n\nThe stress-test's calibration point is fair for MCQA, but it does not land on the Cloze result. The pretrained Cloze baseline is low, so a post-unlearning score near the finetuned level is meaningful leakage, not format bias.\n\nWho this is for: people building or using unlearning benchmarks. It is a legitimate resource and a reasonable argument for multi-format evaluation. It deserves peer review. The revision should add the Target-LLM control, fix the MCQA interpretation, and report variance.","headline":"Solid empirical resource with one clean Cloze result; the MCQA-family numbers need calibration before the broader claims are trusted.","tokens_in":22207,"tokens_out":4552,"would_cite":true,"duration_ms":38939,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A model that passes an unlearning test in Q&A can still retrieve the same fact in cloze, multiple-choice, or analogy formats, so unlearning benchmarks must evaluate multiple formats.","keywords":["machine unlearning","large language models","data transformations","TOFU benchmark","evaluation robustness","cloze test","multiple-choice question answering","knowledge retention"],"falsifier":"Fine-tune a control model on the retain set only—so it has never seen the forget set—and score it on all five formats; if the control shows the same format-to-format gaps as the unlearned model, then the gaps are intrinsic to the formats and the multi-format leak verdict collapses.","tokens_in":21222,"feed_emoji":"🔍","tokens_out":11253,"duration_ms":90886,"temperature":0.7,"pith_summary":"This paper argues that the standard way to measure machine unlearning in large language models is unreliable because it tests knowledge in one input format, usually question-answer. The authors transform facts from the TOFU benchmark into five additional formats—multiple-choice, cloze, analogy, odd-one-out, and comprehension—and find that an 'unlearned' model can look as if it has forgotten a fact in Q&A while still retrieving it in another format. That matters because unlearning is the mechanism behind the right to be forgotten and behind safety guarantees, and a format-specific pass creates false confidence. The paper concludes that unlearning benchmarks should evaluate across multiple formats, a claim it supports with two base models and three unlearning algorithms.","feed_headline":"Models 'forget' in Q&A yet recall facts in cloze tests","feed_subtitle":"New five-format evaluation of TOFU shows single-format unlearning benchmarks overstate how well models forget","key_machinery":"The central object is a multi-format evaluation suite built by transforming each TOFU fact into five additional task formats: MCQA (choose an option; scored by success rate over next-token probabilities of option ids), cloze (fill a masked entity; scored by length-normalized sequence probability), analogy (complete a relational analogy from in-context examples; scored by success rate), odd-one-out (identify which fact comes from the other set; scored by success rate), and comprehension (answer or choose with the fact supplied in the context; scored by ROUGE or success rate). The same underlying knowledge is probed through different surface structures, so comparing the unlearned model's scores on each format against the pretrained and fine-tuned models isolates whether forgetting generalizes beyond the training format. This comparison mechanism is what carries the paper's argument: format-conditional gaps, not the default-format gap, reveal the reliability of unlearning.","core_discovery":"The paper's central claim is that LLM unlearning quality is format-dependent, not a single latent property. After applying the TOFU benchmark's standard unlearning algorithms (gradient ascent, gradient difference, and KL minimization) to a model fine-tuned on fictional-author facts, the paper measures the forget set through the original Q&A format and five transformed versions that encode the same facts. It reports that the unlearned model's score relative to the pretrained and fine-tuned baselines varies across formats: the model looks successfully unlearned under Q&A (score dropping toward the pretrained level) but remains closer to the fine-tuned level under cloze and other formats, indicating residual knowledge. The paper's conclusion is that evaluation over a single format 'may lead to unreliable improvements' and that unlearning benchmarks 'should consider evaluation over multiple formats.'","pith_inferences":["Editorial inference: the cross-format gaps give a practical privacy-attack recipe—probing a model with cloze or MCQA prompts can expose residual knowledge that Q&A checklists miss, so unlearning audits should use adversarial format searches.","Editorial inference: because pretrained-model scores vary by more than an order of magnitude across formats (cloze sequence probability near 0.003 versus Q&A ROUGE near 0.40), some apparent leak signal may be format sensitivity rather than retained fact; a metric normalizing each format by its never-learned baseline would separate the two.","Editorial inference: applying the same multi-format logic to other unlearning targets (personally identifiable information, copyrighted text, hazardous knowledge) would likely show the same format-dependence, and unlearning methods could be made more dependable by training them to match the pretrained model on every format, not just the training format."],"forward_implications":["Unlearning benchmarks should score the forget set in several formats; a model that passes in the default Q&A format should not be certified as forgotten until it also matches the pretrained model on cloze, MCQA, analogy, odd-one-out, and comprehension.","Current unlearning methods (gradient ascent, gradient difference, KL minimization) are likely over-reporting success: their apparent forgetting in the default format is contradicted by higher residual scores in alternative formats across both Llama2-7B and Phi-1.5.","Format-sensitive evaluation also exposes collateral damage: in Comprehension-Q&A, the unlearned model performs below the pretrained model even on retained facts, meaning unlearning can degrade the model's ability to read and extract information from context.","The released five-format dataset with matching forget/retain splits gives practitioners a drop-in way to audit unlearning quality beyond the original TOFU Q&A pairs.","Reported single-number unlearning scores should be disaggregated by format or aggregated with a format-consistent measure, since different formats imply different conclusions about the same model."],"supporting_citations":[{"why":"Supplies the TOFU benchmark, the default Q&A format, the forget/retain splits, and the gradient ascent and KL-minimization baselines the paper extends and evaluates.","marker":"Maini et al., 2024"},{"why":"Provides the Gradient Difference unlearning objective used as one of the three methods under test.","marker":"Liu et al., 2022"},{"why":"Motivates the Cloze format and the length-normalized sequence-probability metric used to score it.","marker":"Brown et al., 2020"},{"why":"Backs the MCQA evaluation approach of reading next-token probabilities over option labels.","marker":"Robinson and Wingate, 2023"},{"why":"Inspires the Comprehension format, which tests whether unlearning hurts extraction of answers from provided context (SQuAD 2.0).","marker":"Rajpurkar et al., 2018"},{"why":"Inspires the Odd-one-out format as a natural-language membership-inference-style probe that distinguishes forget-set from retain-set facts.","marker":"Shokri et al., 2017"},{"why":"Supplies the ROUGE metric used for the Q&A and Comprehension-QA scoring.","marker":"Lin, 2004"},{"why":"Concurrent work that also stresses data transformations for unlearning evaluation; the paper aligns with its emphasis.","marker":"Liu et al., 2024"}],"fun_headline_variants":["Unlearning isn't universal: format changes reveal residual knowledge","Change the format, and an 'unlearned' LLM recalls the facts","Single-format unlearning tests overstate how much LLMs forget","Unlearning robustness fails when question formats change","To really test unlearning, vary the data format"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The five transformed formats all probe the same underlying facts with comparable difficulty, so a higher post-unlearning score in Cloze or MCQA must mean residual knowledge rather than an easier or differently measuring question type.","fun_headline_variants_meta":{"raw":{"variants":["Unlearning isn't universal: format changes reveal residual knowledge","Change the format, and an 'unlearned' LLM recalls the facts","Single-format unlearning tests overstate how much LLMs forget","Unlearning robustness fails when question formats change","To really test unlearning, vary the data format"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000358,"raw_usage":{"total_tokens":1919,"prompt_tokens":908,"completion_tokens":1011,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":524,"completion_tokens_details":{"reasoning_tokens":927}},"tokens_in":524,"tokens_out":1011,"duration_ms":6877,"temperature":1.0,"reasoning_tokens":927,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:14:16.920478+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fine-tune a control model on the retain set only—so it has never seen the forget set—and score it on all five formats; if the control shows the same format-to-format gaps as the unlearned model, then the gaps are intrinsic to the formats and the multi-format leak verdict collapses.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the Gradient Difference unlearning objective used as one of the three methods under test."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Backs the MCQA evaluation approach of reading next-token probabilities over option labels."},{"cited_title":"ROUGE : A Package for Automatic Evaluation of Summaries","cited_arxiv_id":null,"evidence_quote":"Supplies the ROUGE metric used for the Q&A and Comprehension-QA scoring."}],"review_version":1}