{"id":"66d3a894-6f4f-4df1-a065-156eca353ae4","arxiv_id":"2505.01456","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"UnLOK-VQA adds rephrase and neighborhood samples to OK-VQA to measure generalization and specificity of multimodal unlearning, and its evaluation shows that hiding answer tokens in hidden states beats other deletion objectives.","lead":"UnLOK-VQA is a new benchmark for testing whether multimodal language models can forget specific answers, built by extending OK-VQA with rephrased and nearby question-image pairs. The paper also evaluates four whitebox and three blackbox attacks against six deletion defenses, finding that suppressing answer traces in the model's hidden states works best.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Benchmark validity rests on unverified answer-preservation of generated rephrase/neighborhood samples; human quality check covers only 80/500 samples.","rationale":"The paper's central deliverable is UnLOK-VQA plus an attack-defense protocol, and its strongest empirical claim is that the Head Projection defense cuts multimodal attack success from 45.5% to 15.7%. That claim depends on the rephrase and neighborhood samples being valid probes of the deleted fact. The generation pipeline is noisy by the paper's own admission, the post-filter validation is small and uses the same model family as the test model, and there is no automatic check that generated images actually support the intended answers. This is a real, concrete risk: if hard rephrase images fail to support the recorded answer, the attack success numbers are measuring something other than unlearning. I do not think this warrants rejection, because the dataset is released, the pipeline is described in detail, and the concern is directly testable by re-annotation and recomputation. Hence CONDITIONAL remains the right verdict. Other weaknesses, such as single unseeded runs without error bars, the HP defense being partially aligned with the HP whitebox attack, and the 'sensitive' framing of OK-VQA trivia, are secondary; they would matter more if the benchmark validity concern were resolved.","tokens_in":20479,"tokens_out":5826,"duration_ms":60176,"concrete_test":"Verify answer-preservation on a random 100-sample subset of hard rephrase images from the released UnLOK-VQA: give three annotators only the image and the question, blind to the recorded answer, and ask for the answer; retain a sample only if at least two annotators give the recorded answer. Then recompute Table 1's Multimodal Rephrase attack success for LoRA-Fact-Eras and HP defense on the verified subset. If the verified subset's attack-success gap is materially smaller than 45.5% to 15.7%, the headline comparison is confounded by invalid rephrase samples. For a model-family control, repeat with GPT-4V answering the same questions on original vs. hard rephrase images; large accuracy drops on rephrases would signal the images do not actually carry the answer.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"UnLOK-VQA's central validity assumption is that each generated rephrase image/question actually supports the recorded answer and each neighborhood sample actually supports the alternate answer. Section 3.2 generates hard rephrase images by feeding LLaVA-v1.5-7B's text description of the original image into SDXL with a prompt asserting the answer; there is no automatic verification that the generated image contains or supports that answer. Section 3.4 reports that only 75% of rephrase and 66% of neighborhood outputs met annotator standards before filtering, and the post-filter human evaluation covers only 80 of 500 samples (Appendix C). If a nontrivial fraction of hard rephrase images do not actually support the answer, then the 'generalization' attacks are not measuring recovery of the deleted fact; they measure the model's prior or hallucination on mismatched image-text pairs. Since the same LLaVA-v1.5-7B family is used to produce the descriptions and is the model being tested, the difficulty ordering (easy/medium/hard) and the headline 45.5% to 15.7% comparison could be artifacts of this generation bias rather than properties of unlearning. The paper's own Appendix D shows one generation strategy was abandoned after failing, which underscores that the pipeline's outputs need per-sample verification rather than a single 80-sample check.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces UnLOK-VQA, a multimodal unlearning benchmark built by extending OK-VQA with automatically generated rephrase and neighborhood samples at varying proximity levels, followed by manual filtering and a human evaluation. It then presents an attack-and-defense framework with four whitebox and three blackbox attacks, including a new second-order LogitLens attack (PD2), and evaluates six defense objectives on LLaVA-v1.5-7B and 13B. The headline results are that multimodal rephrase attacks are more effective than unimodal ones (45.5% attack success against a baseline defense) and that a Head Projection defense that suppresses answer tokens in internal LogitLens distributions reduces multimodal attack success to 15.7%. Additional findings are that editing LLM layers is more effective than editing the multimodal projector, and that the 13B model is more robust to attacks after editing than the 7B model. The paper argues that UnLOK-VQA enables rigorous comparison of multimodal unlearning methods, and it releases code and data.","tokens_in":20738,"tokens_out":3788,"duration_ms":42337,"significance":"If the benchmark validity and empirical claims hold, the paper fills a real gap: it provides a public, structured benchmark for multimodal targeted unlearning and a broad attack-defense evaluation protocol, including a novel PD2 whitebox attack and an ablation of edited modules. The dataset construction is unusually transparent about manual filtering and reports post-filter human evaluation above 90% for most sample types, and the code/data release is a concrete asset for the community. The comparison of six defenses against seven attacks, with explicit budget-based attack success metrics, is a useful framework even if some of the specific numerical conclusions need further support. The main significance rests on (i) whether the generated rephrase and neighborhood samples actually have the intended answer relationships, and (ii) whether the headline empirical differences are statistically reliable; both need strengthening before the benchmark can serve as a rigorous evaluation standard.","major_comments":[{"comment":"The validity of the hard rephrase and hard neighborhood samples is not verified per sample. Hard rephrase images are generated by SDXL from a LLaVA-v1.5-7B description plus a prompt that asserts the desired answer, but there is no automatic check that the generated image actually supports that answer. Section 3.4 reports that only 75% of rephrase and 66% of neighborhood outputs passed pre-filter human standards, and the post-filter human evaluation covers only 80 of 500 samples (Table 4). Appendix D documents that one neighborhood generation strategy was tried and abandoned after failing, which illustrates that the pipeline's outputs cannot be assumed correct without per-sample verification. If a non-negligible fraction of hard rephrase images do not contain the answer, then the hard-image attack success rates in Tables 1 and 2 may measure the model's prior or hallucination on mismatched image-text pairs rather than recovery of the deleted fact. Please add an automatic or substantially larger human verification step and release per-sample labels so that the generalization and specificity measurements can be audited.","section":"Section 3.2 and 3.4, Appendix D"},{"comment":"All headline empirical comparisons appear to be based on single runs with no confidence intervals or significance tests. For example, the differences between defenses in Table 1, the easy/medium/hard trends in Table 2, and the 7B-versus-13B differences in Figure 3 could be within run-to-run or editing-seed variability, especially given that LoRA edits and some defense objectives (e.g., Empty and Error Injection) may have hyperparameter sensitivity. The paper should report multiple seeds or editing runs with confidence intervals and, where appropriate, a significance test, or explicitly state that the reported numbers are single-run observations. Without this, the central quantitative claim that HP reduces the multimodal attack from 45.5% to 15.7% is not yet fully supported.","section":"Section 6.1, Tables 1-3, Figure 3"},{"comment":"The HP defense and the HP attack share the same mechanism: the defense suppresses the target answer from top-k LogitLens distributions and the final output, while the attack collects top-k LogitLens tokens. Consequently, the low HP-attack success rate of 3.6% against the HP defense is expected by construction to a substantial degree. The defense is not vacuous because it also reduces the blackbox multimodal rephrase attack to 15.7%, but the whitebox comparison should be complemented with hidden-state attacks that do not use the same top-k LogitLens criterion, such as linear probes on residual streams or subspace projections. This would separate genuine erasure of answer information from alignment between the defense and the attack's readout mechanism.","section":"Sections 4.2 and 4.3, Table 1"},{"comment":"The scaling claim rests on two model sizes, 7B and 13B, with (as far as the text reports) one edited model per size. The conclusion that 'scaling enhances safety' is an n=2 observation and is not established as a general trend. Please add at least one intermediate scale or repeated edits with variance reporting, or substantially soften the claim to a case study of these two LLaVA-v1.5 sizes.","section":"Section 6.2, Figure 3"}],"minor_comments":[{"comment":"The choice of edited layer (7th for LLaVA-v1.5-7B, 9th for 13B) is described only briefly; please state the layer-search procedure and the criterion used, and clarify whether the same criterion was applied at both scales.","section":"Section 5 and Appendix B"},{"comment":"No inter-annotator agreement metric is reported for the human evaluation; reporting Cohen's kappa or similar would help calibrate the quality claims.","section":"Table 4 / Appendix C"},{"comment":"The legend 'MM Rephrase HP' is ambiguous: it should clearly indicate whether it denotes the multimodal rephrase attack against the HP defense or the HP whitebox attack.","section":"Figure 3"},{"comment":"The medium rephrase example 'What kind of habitation is shown?' is itself a poor paraphrase of 'What kind of habitat is shown?'; consider replacing it with a clearer example in the paper.","section":"Section 3.2 / Table 7"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"UnLOK-VQA is a real contribution. It is the first multimodal unlearning benchmark I know of that includes rephrase and neighborhood samples at multiple proximity levels, and it fills a genuine gap: prior unlearning datasets are text-only, and multimodal deletion is basically untested. The attack-defense protocol is thorough, and the paper is refreshingly honest about what did not work—PD2 does not beat PD, and the Grounded SAM repainting strategy for neighborhood images was abandoned after failing. They release code and data. That is the part worth having.\n\nThe empirical part is shakier. All the headline numbers in Tables 1–3 and Figure 3 come from single runs with no confidence intervals or significance tests. For a paper whose main message is that the HP defense beats the alternatives, that is a real weakness. And the best-known result has a built-in circularity: the HP defense is optimized to push the answer out of top-k LogitLens distributions, while the HP attack simply collects top-k LogitLens tokens. So the 45.5 percent to 15.7 percent drop is partly the defense defeating its own attack. The defense does also beat other attacks, which helps, but a non-LogitLens whitebox attack would have been more convincing.\n\nThe benchmark validity concern is legitimate too. Hard rephrase images are SDXL generations from LLaVA-1.5-7B text descriptions, and the same model family is the thing being evaluated. Nothing checks that the generated image really supports the recorded answer. Pre-filter quality is reported at 75 percent for rephrase and 66 percent for neighborhood, and the post-filter human evaluation covers only 80 of 500 samples. If a non-trivial fraction of hard rephrases are mismatched, the generalization numbers are measuring the model's priors, not the recovery of deleted facts. The authors' own Appendix D shows how easily these pipelines go wrong.\n\nNone of this makes the paper a reject. The benchmark is usable, the protocol is a sensible template, and the honesty is a plus. But before leaning on the specific numbers, I would want seeded runs with error bars and a per-sample verification step (or a much larger human eval) on the hard rephrase split. I would send this to peer review, and I would bring it to a reading group.","headline":"A genuinely useful multimodal unlearning benchmark, but the headline numbers need error bars and the hard rephrase generation needs a validity check.","tokens_in":21280,"tokens_out":5309,"would_cite":true,"duration_ms":47618,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper introduces UnLOK-VQA, a benchmark for multimodal knowledge deletion, and shows that suppressing deleted answers in internal hidden states cuts attack success from 45.5% to 15.7%.","keywords":["multimodal unlearning","machine unlearning","visual question answering","model editing","adversarial attacks","hidden state interpretability","UnLOK-VQA","knowledge deletion"],"falsifier":"Take the full UnLOK-VQA set, have independent annotators verify every rephrase and neighborhood answer, then re-run the defense comparison on the verified subset; if the Head Projection defense no longer beats fact erasure, or multimodal attacks no longer outperform image-only and text-only attacks, the paper's central empirical claim is refuted.","tokens_in":20290,"feed_emoji":"🛡️","tokens_out":6374,"duration_ms":59890,"temperature":0.7,"pith_summary":"This paper introduces UnLOK-VQA, a manually filtered benchmark for testing whether multimodal LLMs can forget one specific piece of knowledge, and pairs it with an attack-defense protocol. The central empirical finding is that deletion by weight editing is leaky: combining rephrased text and images recovers deleted answers 45.5% of the time, more than either modality alone. The strongest defense, which removes the answer from internal hidden-state distributions, cuts this to 15.7%. If correct, the work provides a reusable way to measure multimodal unlearning along efficacy, generalization, and specificity, and it identifies hidden-state suppression and model scale as levers for safer deletion.","feed_headline":"Hidden-state defense cuts multimodal unlearning attack to 15.7%","feed_subtitle":"New UnLOK-VQA benchmark tests deleting sensitive image-text knowledge, and finds rephrased multimodal attacks beat single-modality ones.","key_machinery":"Two mechanisms carry the argument. First, UnLOK-VQA's variable-proximity sample generation: for each answer to delete, it creates rephrase images and questions at three difficulty levels (noisy, object-replaced, fully regenerated; prefix, paraphraser, jailbreak) and neighborhood samples that change the answer, so generalization and specificity can both be measured. Second, the LogitLens-style hidden-state probe: the paper reads the next-token distribution from each transformer layer, uses it to build whitebox attacks that collect candidate tokens, and defines the Head Projection defense as a max-margin objective that keeps the deleted answer out of the top-k positions across selected layers and the final output. The defense works by removing the answer's trace from internal representations rather than only lowering its final probability.","core_discovery":"The paper claims that deleting one sensitive answer from an MLLM via LoRA weight edits still leaves it extractable: a multimodal rephrase attack recovers the deleted answer 45.5% of the time from the baseline edited model. The strongest defense, Head Projection, suppresses the answer in hidden-state distributions and lowers this to 15.7% at budget 20. The same evaluation shows multimodal attacks outperform image-only attacks (32%) and text-only attacks (39%), and the 13B model resists extraction better than the 7B after the same edit. The paper concludes that hidden-state-level erasure is more effective than simply lowering answer probability, and that scale aids deletion robustness.","pith_inferences":["Editorial inference: because part of the test data is generated by the same model family evaluated, the absolute attack-success numbers may not transfer to other MLLMs; a cross-model replication with human-verified rephrases would show whether the ranking holds.","Editorial inference: the failure of the second-order PD2 attack to beat PD suggests hidden-state traces are too diluted by layer-to-layer differences at budget 20; testing larger budgets or targeted layers could change that comparison.","Editorial inference: a natural next experiment is to apply the same attack-defense protocol to closed-source MLLMs through API blackbox access to see whether hidden-state defenses still help when adversaries cannot see internal states."],"forward_implications":["Unlearning evaluations that check only text or only images will underestimate information leakage; the benchmark shows combined multimodal rephrases are the stronger attack.","Defenses that reduce the probability of the target answer are weaker than defenses that suppress the answer across internal layer distributions, so hidden-state objectives should be part of any deletion recipe.","Because larger LLaVA models resist both whitebox and blackbox extraction better after the same edit, scaling up model size can be treated as a robustness measure for unlearning.","Editing the LLM layers rather than the multimodal projector yields lower attack success, pointing to where the to-be-deleted knowledge actually lives.","The easy/medium/hard proximity tiers make it possible to measure how broadly an edit generalizes and how much collateral damage it does, so benchmarks should report specificity at multiple distances."],"supporting_citations":[{"why":"Supplies the base OK-VQA triplets that UnLOK-VQA extends with rephrase and neighborhood samples.","marker":"Marino et al. (2019)"},{"why":"Provides the LLaVA-v1.5 7B and 13B models that are edited and attacked throughout the evaluation.","marker":"Liu et al. (2023a)"},{"why":"Supplies the threat model, the LogitLens-based whitebox attacks, and the Head Projection defense objective.","marker":"Patil et al. (2023a)"},{"why":"Provides the rewrite score metric and the fact-erasure deletion objective.","marker":"Hase et al. (2023)"},{"why":"Motivates editing MLP modules and the LoRA rank-1 editing setup used for deletion.","marker":"Meng et al. (2022)"},{"why":"Motivates the need for rigorous unlearning evaluation and the attack-defense framing.","marker":"Lynch et al. (2024)"},{"why":"Provides DIPPER-11B, the paraphraser used to generate medium-difficulty rephrase questions.","marker":"Krishna et al. (2023)"},{"why":"Provides Grounded SAM, used to remove or repaint objects for medium rephrase and neighborhood images.","marker":"Ren et al. (2024)"}],"fun_headline_variants":["Hidden-state defense cuts MLLM unlearning attack from 45.5% to 15.7%","Multimodal rephrase attack foils MLLM unlearning; hidden-state defense thwarts it","UnLOK-VQA benchmark shows multimodal attacks beat single-modality in MLLM unlearning","Scale helps: 13B MLLM resists unlearning extraction better than 7B","Erase hidden states to truly unlearn in multimodal LLMs, study says"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The benchmark assumes the automatically generated rephrase and neighborhood samples really have the answers the pipeline says they have; those samples are produced partly by the same model family being tested and checked by humans on only 80 of 500 points.","fun_headline_variants_meta":{"raw":{"variants":["Hidden-state defense cuts MLLM unlearning attack from 45.5% to 15.7%","Multimodal rephrase attack foils MLLM unlearning; hidden-state defense thwarts it","UnLOK-VQA benchmark shows multimodal attacks beat single-modality in MLLM unlearning","Scale helps: 13B MLLM resists unlearning extraction better than 7B","Erase hidden states to truly unlearn in multimodal LLMs, study says"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000808,"raw_usage":{"total_tokens":3548,"prompt_tokens":950,"completion_tokens":2598,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":566,"completion_tokens_details":{"reasoning_tokens":2477}},"tokens_in":566,"tokens_out":2598,"duration_ms":15762,"temperature":1.0,"reasoning_tokens":2477,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:47:05.315807+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the full UnLOK-VQA set, have independent annotators verify every rephrase and neighborhood answer, then re-run the defense comparison on the verified subset; if the Head Projection defense no longer beats fact erasure, or multimodal attacks no longer outperform image-only and text-only attacks, the paper's central empirical claim is refuted.","supporting_citations":[],"review_version":1}