{"id":"1bdf611c-0b2c-43f1-a488-4ce2d2b93a73","arxiv_id":"2504.13388","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A mean teacher optimizer that approximates slow natural gradient descent, paired with a new negative log-unlikelihood loss, reduces memorization and privacy leakage on MUSE-News and MUSE-Books, with the strongest variant trading away MMLU.","lead":"This paper tests a mean teacher optimizer for unlearning text from language models, pairing it with a new loss called negative log-unlikelihood. On the MUSE benchmarks the method reduces memorization and privacy leakage, while the paper also shows that apparent knowledge unlearning can hide a real loss of general ability.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The proof of Lemma D.1 bounds the spectral norm of a nonnormal 2x2 block by its spectral radius; the bound is false, so Theorem 3.1's O(alpha log(1/alpha)) claim is not established as written.","rationale":"The reader's conditional verdict was based on the gap between Theorem 3.1 and the batched, clipped Algorithm 2 used in the experiments. I agree that gap is real, but I found a more basic problem: Theorem 3.1's own proof is not sound as written. The momentum lemma's contraction claim conflates spectral radius and spectral norm, and the 2x2 blocks are nonnormal. A concrete numerical check can settle whether the lemma's bound fails. If it fails, the paper's central theoretical contribution, the interpretation of mean teacher as approximate slow natural gradient descent, is unsupported until repaired. However, the empirical MUSE results, the honest reporting of MMLU degradation and of relearning after SFT, and the released code are genuine contributions, so outright rejection would be too harsh. The paper should remain conditional: it needs either a corrected proof of Lemma D.1 with a valid nonnormal bound, a re-derived theorem, or an explicitly weakened claim. The reader's weakest assumption identified a different point, so my agreement with the reader is 'disagree' on the specific load-bearing concern.","tokens_in":20787,"tokens_out":19678,"duration_ms":187656,"concrete_test":"Run the exact recursion of Lemma D.1 on a scalar 2x2 block with mu = 0.9, lambda = 0.5, h = 0.5/eta, and an error sequence eps_t aligned with the large singular direction; compute max_t ||u_t - u_star|| and compare with the lemma's claimed R^t ||u_0 - u_star|| + (sqrt(2)/(1 - R)) * eta * max_j ||eps_j||. If the observed bound is violated at t = 1 or later, the lemma as stated is false. Then check whether a repaired bound with a polynomial transient factor still yields the theorem's O(alpha log(1/alpha)) trajectory error with constants independent of eta; if not, Theorem 3.1 needs to be re-derived or weakened.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The most load-bearing weakness is in the proof of Theorem 3.1, specifically Lemma D.1 in Appendix D.1. After Eq. (11), the recursion matrix is block-diagonalized into 2x2 blocks B = [[1 - eta*h, -mu], [eta*h, mu]]. The proof asserts that the spectral norm of B is at most R = max(sqrt(mu), 1 - eta*lambda/(1 - mu)) and then uses ||B^t|| <= R^t to bound IHVP errors. This is not valid because B is nonnormal. For example, with mu = 0.9 and eta*h = 0.5, B has spectral radius sqrt(mu) ~ 0.949, but B^T B has eigenvalues 0.5 and 2*mu^2 = 1.62, so ||B|| ~ 1.27; for small eta and lambda = 0.5, R ~ 1 - eta*lambda/(1 - mu) ~ 0.9995, so ||B|| > R. Error vectors in Eq. (11) enter as [-eta*eps; eta*eps] and can be amplified by this transient, so the contraction argument used to obtain u_t ~ -alpha * H_lambda^{-1} * grad L is not proven. Since that approximation is the engine connecting Algorithm 1 to natural gradient descent in both stages of the proof, the O(alpha log(1/alpha)) bound in Theorem 3.1 does not follow from the written proof. This is an internal correctness gap in the theory, distinct from, and prior to, the acknowledged gap between full-batch Algorithm 1 and batched/clipped Algorithm 2.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a mean teacher algorithm for LLM unlearning and gives a theoretical result (Theorem 3.1) stating that, under small step sizes and regularity conditions, the mean teacher trajectory approximately matches slow natural gradient descent with error O(alpha log(1/alpha)). A new loss, negative log-unlikelihood (NLUL), is introduced to avoid vanishing gradients at the start of unlearning. Experiments on MUSE-News and MUSE-Books compare mean teacher variants with AdamW baselines on verbatim/knowledge memorization, retain-set utility, privacy leakage, and MMLU. The paper honestly reports that the strongest knowledge-removal variant (MT+NLUL+QKL) reduces MMLU, that a shorter run shows utility loss relative to the retrained model, and that fine-tuning on unrelated alignment data can restore both knowledge memorization and MMLU.","tokens_in":21149,"tokens_out":9266,"duration_ms":90873,"significance":"If Theorem 3.1 were established, the paper would provide a clean proximal-optimization interpretation of mean teacher as an implicit natural-gradient method that prefers low-curvature updates, which is a valuable conceptual contribution to LLM unlearning. The paper also ships reproducible code, reports negative results openly, includes a sequential-unlearning experiment, and is careful to flag the MMLU cost of aggressive knowledge unlearning. These are real strengths. The central theoretical claim is currently not proven as written because the main contraction lemma uses a spectral-norm bound that is false for nonnormal matrices. The experimental claims are suggestive but are not formally connected to the theorem, since the evaluated algorithm differs from the analyzed one in batching, clipping, momentum, and number of epochs. The empirical significance is therefore moderate pending a corrected proof or an explicit heuristic framing.","major_comments":[{"comment":"The proof of Lemma D.1 bounds the spectral norm of the 2x2 block B = [[1-eta*h, -mu], [eta*h, mu]] by its spectral radius R = max(sqrt(mu), 1 - eta*lambda/(1-mu)) and then uses ||B^t|| <= R^t. This is not valid because B is nonnormal. For example, with mu = 0.9 and eta*h = 0.5, the spectral radius of B is sqrt(mu) approx 0.949 but ||B|| approx 1.27. Consequently, the error terms in Eq. (11) are not bounded by the claimed geometric contraction, and the IHVP approximation u_t approx -alpha * H_lambda^{-1} nabla L is not established. Since this IHVP approximation is the engine connecting Algorithm 1 to natural gradient descent, the O(alpha log(1/alpha)) bound in Theorem 3.1 does not follow from the written proof. The proof needs either a real norm bound incorporating nonnormal transients (for example via a similarity transform with explicit constants, if such a bound can be proved) or a replacement lemma.","section":"Appendix D.1, Lemma D.1, Eq. (11)"},{"comment":"Theorem 3.1 is stated and proved for the full-batch Algorithm 1 under small alpha, small eta, and a bounded total step T*gamma. The experiments, however, use Algorithm 2, which draws minibatches, applies per-step gradient clipping with an adaptive contraction parameter, includes momentum, and runs for many epochs with batch size 40. The paper acknowledges this gap in the paragraph beginning 'Finally, notice that Theorem 3.1 assumes full-batch gradient updates', but the paragraph does not supply any argument that the batched, clipped, momentum-based trajectory inherits the low-curvature natural-gradient behavior. The central utility-preservation story is therefore an assertion rather than a consequence of the theorem. I would like the revision to either add a formal robustness statement, give empirical evidence (for example, trajectory or IHVP-error measurements on a small model), or explicitly label the theoretical result as motivational and decouple it from the experimental claims.","section":"Section 3, Implementation details; Algorithm 2"},{"comment":"There is an inconsistency between the theorem statement and the proof about which gradient is used in the comparison trajectory. Theorem 3.1 defines the comparison update as theta_{t+1} = theta_t - gamma * H_lambda^{-1}(theta_t) * nabla L(theta_{t-1}), while the proof's 'Connecting to NG descent' paragraph compares against theta_{t+1} = theta_t - gamma * H_lambda^{-1}(theta_t) * nabla L(theta_t). If the lag is intentional, the proof must track it; if it is a typo, the theorem statement should be corrected. This matters because the claimed bound is about a specific reference trajectory.","section":"Section D.2, Connecting to NG descent"}],"minor_comments":[{"comment":"The displayed definition of the matrix A after Eq. (11) is garbled ('A = [[1-eta H_lambda eta(H+lambda) mu]]'); it should be written as the 2x2 block matrix used in the recursion.","section":"Appendix D.1, Eq. (11)"},{"comment":"The value '37.17 (5.3)' appears with an inconsistent number of decimal places compared with the rest of the table; presumably '37.2 (5.3)' is intended.","section":"Table 1, MUSE-Books row"},{"comment":"The caption says that for NPO/LL the authors 'additionally perform 2 epochs with AdamW to escape the starting point', but the surrounding text presents these as mean teacher runs. Please clarify whether the plotted NPO/LL curves are warm-started mean teacher runs or baselines, and state this clearly in the caption.","section":"Figure 1 caption"},{"comment":"The gradient-norm comparison in Figure 2 is qualitative and would be more useful with an axis scale and a statement of which loss each curve corresponds to; currently the legend colors are not described in the caption.","section":"Section 5.3, Figure 2"},{"comment":"The abstract and Section 5.4 highlight lower privacy leakage, but Table 1 reports PrivLeak from a single run. The single-run caveat should appear in the main text near the claim, not only in the table footnote.","section":"Section 5.1, PrivLeak"}],"recommendation":"major_revision","confidential_remarks":"The paper is on a topical and publishable problem, and the honest reporting of negative MMLU results is a point in its favor. The main blocker is the proof gap in Lemma D.1: the nonnormal spectral-norm issue is likely to be raised immediately by expert reviewers, so the revision should contain a corrected lemma or an explicit weakening of the theorem. The empirical section can stand as a contribution even if the theory is reframed as heuristic, but the current text overstates the degree to which the experiments are explained by Theorem 3.1."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nYou should know two things before reading this paper. First, it is an unusually honest LLM unlearning paper: it introduces a simple loss (negative log-unlikelihood) and applies mean teacher to unlearning, and it openly reports that the variant that best reduces knowledge memorization also hurts MMLU and that the memorization can be brought back by SFT on unrelated data. Second, the theoretical centerpiece—Theorem 3.1, claiming mean teacher approximates slow natural gradient descent—has a proof gap that neither the paper nor the reader's report caught.\n\nWhat is genuinely new: applying mean teacher to unlearning is new in the cited literature, and the attempt to connect it to low-curvature NGD is a real derivation. The NLUL loss is simple and appears to fix the vanishing-gradient problem that LL and NPO have when used with mean teacher. The empirical work is solid in spirit: multiple baselines, three runs with std, MUSE benchmarks, and the sustainability experiment. The paper is not circular; it reports failed variants and negative results.\n\nNow the soft spots. The biggest is Lemma D.1 in Appendix D.1. The proof bounds the spectral norm of the 2x2 block by its spectral radius R = max(sqrt(mu), 1 - eta*lambda/(1-mu)). That is false: the block is nonnormal. For mu=0.9 and eta*h=0.5, the spectral radius is about 0.949 but the spectral norm is about 1.27; even as eta*h→0 the norm can exceed 1 because of the off-diagonal. So the bound ||A^t|| <= R^t used to accumulate the IHVP errors does not follow, and the O(alpha log(1/alpha)) bound in Theorem 3.1 is not established as written. This is an internal correctness gap, not just a loose constant.\n\nA separate, acknowledged gap: Algorithm 2 replaces full-batch small-step gradients with minibatches, clipping, and momentum, which are outside the theorem's assumptions. Even if the theorem gets fixed, the experiments are not covered by it. Minor issues: PrivLeak is measured on one run with no error bars, MMLU uses a small validation set, and the strongest knowledge-removal variant was chosen after watching training curves on the same benchmark. None of these are fatal; they just lower the weight you can put on the empirical specifics.\n\nWho this is for: people working on practical LLM unlearning will get value from the NLUL loss and the MMLU caution. The theory, as written, should not be cited. My recommendation: send it to peer review—it deserves a serious referee—but the referee should be asked to verify Lemma D.1 and the nonnormal transient. If the proof cannot be repaired, publish as an empirical study and demote the NGD interpretation to intuition.\n\nBest,","headline":"Honest empirical LLM unlearning with a novel loss, but the central theory proof has a real gap in Lemma D.1.","tokens_in":21633,"tokens_out":4530,"would_cite":true,"duration_ms":38082,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Mean teacher turns LLM unlearning into slow natural gradient descent.","keywords":["machine unlearning","mean teacher","natural gradient descent","negative log-unlikelihood","language model memorization","Gauss-Newton Hessian","MUSE benchmark","proximal optimization"],"falsifier":"Run Algorithm 1 and Algorithm 2 on a small transformer with the same hyperparameters as the MUSE runs and compute the exact Gauss-Newton Hessian on the pretraining batch. If the batched, clipped, momentum trajectory diverges from the slow-NGD trajectory by more than the theorem's $O(\\alpha \\log(1/\\alpha))$ bound, or if the utility preservation vanishes when the reference model is frozen, then the theorem is not the mechanism behind the experimental gains.","tokens_in":1862,"feed_emoji":"🧠","tokens_out":2329,"duration_ms":68179,"temperature":0.7,"pith_summary":"This paper argues that the mean teacher update—keeping a slowly moving reference model and pulling the optimized model toward it—is not just a heuristic regularizer. Under small step sizes, the trajectory of the mean teacher approximately equals a slow natural gradient descent, an update that moves preferentially along low-curvature directions and so is less likely to wreck the model's general abilities. The paper introduces a negative log-unlikelihood loss to avoid the vanishing-gradient stall that afflicts mean teacher with common unlearning objectives. The combination is tested on the MUSE benchmarks, where it lowers verbatim and sometimes knowledge memorization and reduces privacy leakage, while exposing that apparent knowledge removal can be an artifact of reduced general question-answering ability.","feed_headline":"Mean teacher turns LLM unlearning into slow natural gradient descent","feed_subtitle":"The added NLUL loss keeps the updates moving, cutting memorization with less damage to general ability.","key_machinery":"The load-bearing objects are the sliding reference model $\\theta'_t$ and the difference $u_t = \\theta_t - \\theta'_t$. The reference is updated as an exponential moving average, and the regularized gradient step on $\\alpha L + D(\\theta,\\theta')$ makes $u_t$ behave like an inverse-Hessian vector product: the proof compares the recursion for $u_t$ to IHVP iterations and obtains $u_t \\approx -\\alpha H_\\lambda(\\theta_t)^{-1}\\nabla L(\\theta_t)$. Because $H$ is the Gauss-Newton Hessian of the KL divergence on the retain or pretraining set, the resulting update is slow natural gradient descent conditioned by $H_\\lambda^{-1}$. The NLUL loss is the second piece: its gradient equals $(p/(1-p))$ times the log-likelihood gradient, so it escapes the $p \\approx 1$ flat start of a memorizing model without the explosive gradients of pure gradient ascent.","core_discovery":"The central claim is Theorem 3.1: for a generic loss $L$ and divergence $D$ with positive-definite local Hessian $H$, the mean teacher loop with small learning rate $\\eta$, small loss weight $\\alpha$, and bounded total horizon $T\\gamma$ follows the slow natural-gradient trajectory $\\theta_{t+1} = \\theta_t - \\gamma H_\\lambda^{-1}\\nabla L$, up to error $O(\\alpha \\log(1/\\alpha))$ in parameter space. In the KL/QKL case, $H$ is the Gauss-Newton Hessian of the retain set, so mean teacher is a computationally cheap proximal stand-in for second-order unlearning. The paper also claims that with log-likelihood or NPO, mean teacher can stall near a converged model, and that the new negative-log-unlikelihood loss $\\ell_{\\mathrm{NLUL}} = -\\log(1 - p(y))$ rescues the early gradient while remaining bounded later. On MUSE-News and MUSE-Books, MT+NLUL reaches the retrained-model memorization thresholds, preserves knowledge of retain articles better than the provided baselines in several settings, and yields privacy-leakage values closer to zero. A strong QKL variant does lower knowledge memorization on the forget set, but the paper reports that this comes with a substantial drop in MMLU, and later finetuning on unrelated data restores both, indicating the knowledge remained in the weights.","pith_inferences":["The theorem's $O(\\alpha \\log(1/\\alpha))$ guarantee suggests mean teacher could serve as a cheap proxy for influence-function-based unlearning when the Hessian is too large to form explicitly; tuning $\\alpha$ might control the forgetting-retention trade-off.","Because the natural-gradient interpretation depends on the divergence's curvature, testing other divergences would separate the mean-teacher mechanism from the Gauss-Newton choice.","The finding that unrelated SFT data restores forgotten knowledge implies that current MUSE metrics measure surface behavior, not weight-level deletion; a stricter test would probe whether any fine-tuning path can resurrect the memorized text.","A testable extension is to run Algorithm 1 with exact full-batch Gauss-Newton inverse on a small language model and compare its trajectory to the batched Algorithm 2; if the batched version deviates beyond the theorem's bound, the experimental results are not explained by Theorem 3.1."],"forward_implications":["Mean teacher gives a proximal, low-curvature update for unlearning that can preserve utility while reducing verbatim memorization on MUSE benchmarks.","Replacing the curated retain split with a large pretraining subset improves retention and makes the method reusable across unlearning tasks.","The NLUL loss lets mean teacher progress from a converged forget set without a separate base model or extra hyperparameter such as NPO's $\\beta$.","Stronger forget-side unlearning reduces knowledge memorization below the retrained threshold but costs MMLU, so reports of knowledge removal should include general-ability checks.","Sequential unlearning requests on MUSE-News show that utility is preserved when pretraining data is used for regularization."],"supporting_citations":[{"why":"The source of the mean teacher update that the paper analyzes and adapts for unlearning.","marker":"(Tarvainen & Valpola, 2017)"},{"why":"Defines the MUSE benchmarks, the forget/retain splits, the metrics, and the baseline numbers the experiments are compared against.","marker":"(Shi et al., 2024)"},{"why":"Introduces natural gradient descent, the update whose trajectory mean teacher is claimed to approximate.","marker":"(Amari, 1998)"},{"why":"Supplies the Gauss-Newton Hessian perspective that identifies the divergence's curvature matrix with the Fisher information.","marker":"(Martens, 2020)"},{"why":"Defines NPO, the main gradient-reweighting baseline and the loss that NLUL is contrasted with.","marker":"(Zhang et al., 2024a)"},{"why":"Provides the inverse-Hessian-vector-product convergence analysis used in the proof of Theorem 3.1.","marker":"(Agarwal et al., 2017)"},{"why":"Provides MMLU, the general-knowledge metric used to detect utility loss after unlearning.","marker":"(Hendrycks et al., 2020)"}],"fun_headline_variants":["Mean teacher unlearning runs on slow natural gradient descent","NLUL keeps mean-teacher unlearning from stalling","Mean teacher + NLUL: better unlearning with less damage","Slow NGD via mean teacher improves LLM unlearning","Unlearning LLMs: mean teacher as slow natural gradient"],"cache_read_input_tokens":23680,"weakest_assumption_plain":"The theoretical guarantee holds for full-batch updates with tiny step sizes and regularity assumptions, while the experiments use minibatches, gradient clipping, momentum, and many epochs; if the batched clipped mean teacher stops following the low-curvature natural-gradient trajectory, the explanation for why utility is preserved does not cover the reported results.","fun_headline_variants_meta":{"raw":{"variants":["Mean teacher unlearning runs on slow natural gradient descent","NLUL keeps mean-teacher unlearning from stalling","Mean teacher + NLUL: better unlearning with less damage","Slow NGD via mean teacher improves LLM unlearning","Unlearning LLMs: mean teacher as slow natural gradient"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000647,"raw_usage":{"total_tokens":2997,"prompt_tokens":998,"completion_tokens":1999,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":614,"completion_tokens_details":{"reasoning_tokens":1918}},"tokens_in":614,"tokens_out":1999,"duration_ms":12473,"temperature":1.0,"reasoning_tokens":1918,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:09:27.034675+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 1 and Algorithm 2 on a small transformer with the same hyperparameters as the MUSE runs and compute the exact Gauss-Newton Hessian on the pretraining batch. If the batched, clipped, momentum trajectory diverges from the slow-NGD trajectory by more than the theorem's $O(\\alpha \\log(1/\\alpha))$ bound, or if the utility preservation vanishes when the reference model is frozen, then the theorem is not the mechanism behind the experimental gains.","supporting_citations":[{"cited_title":"Second-order stochastic optimization for machine learning in linear time","cited_arxiv_id":null,"evidence_quote":"Provides the inverse-Hessian-vector-product convergence analysis used in the proof of Theorem 3.1."}],"review_version":1}