{"id":"76e8e9e6-eccb-46ac-a53a-5c313ebe70bf","arxiv_id":"2505.02884","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"DF-MCQ flattens a model's predictions over multiple-choice questions to make it refuse target-person queries, and the paper's probing tests suggest this removes knowledge rather than merely obfuscating it.","lead":"What this paper found: common LLM unlearning methods often obscure knowledge by training on false information, and this paper gives probing tests that expose the difference. Why read it: it also proposes a cheap fine-tuning method, DF-MCQ, that makes models refuse target-person questions with over 90% consistency.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"DF-MCQ's evidence for true removal is circular: refusal is a tuned training target and MCQ entropy is the loss objective, so no test yet separates knowledge deletion from a name-triggered suppression shortcut.","rationale":"The reader's weakest assumption identifies the same central risk: high entropy and refusal behavior are treated as proof that knowledge is gone, but a name-triggered shortcut can produce the same observations. My stress-test sharpens this in two ways. First, the paper explicitly tunes the learning rate to elicit refusal, so the refusal rate is a selected outcome rather than an emergent signal of knowledge removal. Second, the MCQ flattening objective is evaluated on the same MCQ format used for probing, making the near-maximum entropy in Table 10 a direct product of training, not a diagnostic. These two points make the shortcut concern more than a hypothetical: the evidence as presented cannot distinguish deletion from suppression because the measured behaviors are exactly the behaviors the method was built and tuned to produce. The proposed relearning test is the right settlement because it targets latent association directly: if a few target-fact examples restore original probe performance, the underlying fact was never removed. I do not see this as grounds for outright rejection, because the paper's probing framework and the distinction between obfuscation and unlearning are genuinely useful contributions, and the method may still be valuable as a suppression technique. A conditional verdict with a requirement for a retrained oracle or relearning probe is the appropriate outcome.","tokens_in":11854,"tokens_out":5117,"duration_ms":61349,"concrete_test":"Run a relearning attack on the DF-MCQ-unlearned Llama-3.1-8B: fine-tune with LoRA for at most one epoch on a small set of genuinely target-related passages (e.g., 64 examples drawn from the WPU forget-2 article), in contrast to the original paper's SFT attack, which used only questions about other individuals. Then evaluate on the same WPU forget-set open-ended, Yes/No, and MCQ probes. If accuracy and entropy snap back toward the original model (74.26% MCQ accuracy, near-zero reference-set entropy) within far fewer steps than a control model that never saw the target articles, the flat distribution and refusal were a name-triggered output policy rather than deleted knowledge. To calibrate, train the same control on the target articles afterward; if DF-MCQ relearns the facts as quickly as the control, the facts were not actually removed.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim that DF-MCQ 'removes knowledge' rests on observed refusal and near-uniform MCQ entropy, but these are not independent evidence of removal. Section 6.2 states that the learning rate 'is adjusted such that the model refuses to answer,' so the headline 92.72% refusal rate is a tuned training target, not an emergent property of genuine forgetting. Likewise, the DF-MCQ loss (Eq. 4) directly minimizes KL divergence to a flat distribution over MCQs, meaning the near-maximum MCQ entropy of 1.61 in Table 10 is a direct consequence of the objective, not a diagnostic of erasure. Eq. (1) defines unlearning as matching H(Y|X; D\\F), but no model trained without the fact is ever constructed; the paper merely assumes that flattening the MCQ distribution forces deletion of the underlying edge. The retain loss (Eq. 5) only preserves behavior on other people's MCQs, so it does not block a target-name-triggered shortcut: whenever the prompt contains the target person, the model can output 'I don't know' or a uniform choice distribution without deleting the fact. The exact 1.61 entropy across all five subsets (Table 10) is the signature of such a policy. The SFT robustness test (Table 4) is also non-discriminating: it fine-tunes on 'questions about other individuals,' never on the target facts, so it cannot show whether the target association is recoverable. Without a retrained oracle, a representation-level probe, or a relearning test on target facts, the experiments support suppression or obfuscation as much as true removal.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that many existing LLM unlearning methods are better characterized as obfuscation, because they add distracting or false knowledge rather than removing the original fact. It proposes an evaluation framework with three probe types (open-ended, yes/no, and multiple-choice questions) and introduces DF-MCQ, a method that flattens the model's predictive distribution over automatically generated MCQs via a KL-divergence loss. Experiments on the WPU forget-2 benchmark with Llama-3.1-8B-Instruct and Qwen2.5-7B-Instruct report that DF-MCQ achieves a 92.72% refusal rate on open-ended forget-set questions, near-random entropy on yes/no and MCQ probes, and less degradation on retain sets than the obfuscation baselines NPO and WHP+. The paper concludes that DF-MCQ achieves true knowledge removal rather than obfuscation.","tokens_in":12134,"tokens_out":3204,"duration_ms":36689,"significance":"If the central claim is correct, the paper would make a useful contribution by sharpening the distinction between unlearning and obfuscation and by providing a concrete method with a low-cost training recipe and an open-source implementation. The probing framework is a reasonable step beyond open-ended ROUGE-L evaluation, and the decision to compare against WHP+ and NPO on a standard benchmark is appropriate. However, the main evidence for 'true removal' is currently weak: the headline refusal rate is a tuned training target, and the near-uniform MCQ entropy is the optimization objective itself. The paper's contribution is therefore best assessed as a promising evaluation framework and method proposal whose central empirical claim requires independent verification before it can support the strong conclusion stated in the abstract.","major_comments":[{"comment":"The reported refusal rate of 92.72% in Table 2 is not independent evidence of knowledge removal because the learning rate is explicitly 'adjusted such that the model refuses to answer.' This makes refusal a tuned training target rather than an emergent property of forgetting. The authors should either fix the training protocol in advance, report the tuning process and its variance, or provide a separate test where refusal is not optimized for.","section":"6.2 Model and Training"},{"comment":"The near-uniform MCQ entropy in Table 7 and the exact value 1.61 for every subset in Table 10 is precisely what the DF-MCQ loss in Eq. (4) minimizes, so this entropy cannot serve as independent evidence of true removal. The paper needs a diagnostic that is not the training objective itself, such as a retrained-oracle baseline from Eq. (1), a representation-level probe, or a relearning/attack experiment on the target facts.","section":"7.3 MCQ Probing Questions and Eq. (4)"},{"comment":"The formal definition of unlearning in Eq. (1) requires comparing the unlearned model with a model trained on D\\F, but no such retrained oracle is ever constructed or evaluated in the experiments. Without this baseline, the claim that DF-MCQ achieves 'the same level of uncertainty as one trained on the dataset excluding the fact' is unsupported. Adding this baseline, or at least a lower-bound oracle, is necessary to substantiate the central claim.","section":"3 Unlearning and Obfuscation, Eq. (1)"},{"comment":"The retain loss in Eq. (5) only preserves behavior on MCQs about other people, so it does not exclude a target-name-triggered shortcut: whenever the prompt contains the target person, the model could learn to output a refusal or a uniform distribution without deleting the underlying fact. The control in Section 7.2 with distractors from the MCQ training set reduces but does not eliminate this possibility. A control using target-name prompts that are unrelated to the unlearned facts, or a relearning test on the target facts, would help separate suppression from deletion.","section":"4 Distribution Flattening MCQ, Eq. (5)"}],"minor_comments":[{"comment":"No error bars, confidence intervals, or repeated-run statistics are reported anywhere in the paper, despite the fact that the DF-MCQ learning rate is tuned to achieve refusal. Reporting variance across seeds or subsets would strengthen the empirical claims.","section":"Tables 2–10"},{"comment":"The Pearson correlation coefficient of 0.84 in Fig. 5 is reported without a p-value or sample-size information; given the small number of settings in Fig. 5(a), this should be interpreted cautiously or supplemented with a significance test.","section":"7.1 Open-Ended Questions, Fig. 5"},{"comment":"The same Figure 3 caption and example block appears twice in the manuscript, once after Section 5.2 and again inside Section 7.1. This duplicate should be removed.","section":"Figures and text"},{"comment":"The reference list contains a duplicate: Xu et al. 2025a and Xu et al. 2025b are the same arXiv preprint 'Relearn: Unlearning via learning for large language models.' One entry should be removed.","section":"References"},{"comment":"The caption contains a typo: 'comapred' should be 'compared.'","section":"Table 5"}],"recommendation":"major_revision","confidential_remarks":"The paper has a useful evaluation framework and a practical unlearning recipe, but the central claim of genuine knowledge removal currently rests on metrics that are directly optimized or tuned. I would encourage the editor to request a revision that adds at least one independent verification path, such as a retrained-oracle comparison, a representation-level probe, or a relearning attack on the target facts. If such evidence is added, the paper could be suitable for publication; without it, the abstract's claim of 'effectively removing knowledge' is stronger than what the experiments establish."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should look at this paper if you work on LLM unlearning. The probing framework is the real contribution: three question types (open-ended, yes/no, MCQ) that separate hiding from removal, plus a clear demonstration that the obfuscation baseline WHP+ collapses into an always-“yes” shortcut on yes/no probes. That pattern, with the 0.84 correlation between obfuscation efficacy and yes-rate, is a solid empirical finding. The DF-MCQ method itself is simple and practical: flatten the model’s distribution over automatically generated MCQs with KL divergence, keep a retain loss on other people’s MCQs, and the model ends up refusing open-ended questions about the target. It is cheap (LoRA, 15 minutes on an A100) and works on two model families. I would use the probing suite in my own evaluations.\n\nBut the central claim—“effectively removing knowledge”—is not supported by the experiments. The two headline numbers are both direct consequences of the training objective. The 92.72% refusal rate is tuned: Section 6.2 says the learning rate is adjusted until the model refuses to answer. The MCQ entropy of 1.61 is exactly what Eq. (4) minimizes; and the fact that it is 1.61 across all five subsets suggests the model learned a simple policy of outputting uniform over the letters whenever the target name appears. That is suppression, not deletion. The paper never constructs the retrained oracle that Eq. (1) defines as the reference for unlearning, so we never see whether the entropy actually matches the “never trained on the fact” model. The SFT attack is also non-discriminating: it only fine-tunes on other individuals, so it cannot show whether the target association is recoverable. The absence of error bars is a minor issue relative to these.\n\nThe authors do acknowledge the shortcut concern implicitly by testing the retain set, which shows the flattening is largely tied to target names. That is consistent with a name-triggered shortcut rather than knowledge erasure. I think the paper would be strengthened substantially by one of three additions: a retrained oracle baseline, a relearning test on target facts, or a representation-level probe. As it stands, the paper is a good framework plus a useful method, with an overstated interpretation.\n\nVerdict for peer review: yes, send it out. The probing framework and the DF-MCQ method are useful enough to merit referee time, but the authors should be pushed to either add the missing baselines or soften the removal claim to suppression. I would not cite the central claim; I would cite the probing suite and the WHP+ shortcut finding.","headline":"A useful probing framework and a cheap refusal-inducing method, but the paper overclaims that DF-MCQ truly removes knowledge when the evidence is largely consistent with a name-triggered suppression shortcut.","tokens_in":12714,"tokens_out":1442,"would_cite":true,"duration_ms":18273,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes DF-MCQ, which flattens answer distributions over multiple-choice questions, and claims this achieves genuine knowledge removal rather than obfuscation.","keywords":["machine unlearning","large language models","obfuscation","knowledge removal","probing evaluation","distribution flattening","multiple-choice questions","privacy"],"falsifier":"Take a DF-MCQ-unlearned model and ask about the target without using the name, e.g. \"Where was the 19th-century German historian born who wrote about palaeography?\" or paraphrase the MCQ; if the correct answer resurfaces, the knowledge was suppressed, not removed. The same test on a model genuinely retrained without the target passages would stay silent, and the behaviour difference would settle whether DF-MCQ truly unlearns.","tokens_in":11599,"feed_emoji":"🧠","tokens_out":8028,"duration_ms":80738,"temperature":0.7,"pith_summary":"Many LLM unlearning methods are really obfuscation: they add wrong or irrelevant facts to suppress the target knowledge, leaving the original association in place. The paper defines unlearning as the uncertainty state of a model that never saw the fact, with refusal behaviour (\"I do not have information\") as its observable signature, and builds probing questions, Yes-No and multiple choice, that expose whether a method merely added distracting edges. It then introduces DF-MCQ, which fine-tunes the model so its probability over MCQ answer choices about the target person is flat, while a retain loss preserves other knowledge. On the WPU benchmark, DF-MCQ reaches 92.72% refusal on open-ended questions and maximum five-choice entropy of 1.61 on every MCQ probing subset, which the paper presents as evidence that the knowledge itself has been removed. If correct, this gives privacy-sensitive applications a way to test for true unlearning instead of trusting surface-level evasion.","feed_headline":"A flat MCQ answer removes knowledge; obfuscation only hides it","feed_subtitle":"Probing Yes-No and MCQ tests show true removal: DF-MCQ refuses 92% of questions and hits maximum choice entropy.","key_machinery":"The central mechanism is distribution flattening over a confined MCQ output space. Each automatically generated question $X_i$ has a small set of answer letters $c$; DF-MCQ minimizes $L_{\\text{unlearn}} = \\sum_i D_{\\text{KL}}[P_\\theta(c|X_i) \\,\\|\\, \\hat P(c|X_i)]$ with $\\hat P$ uniform, which in a space whose probabilities sum to almost one is equivalent to flattening the whole relevant output distribution, and combines it with $L_{\\text{retain}} = \\sum_j D_{\\text{KL}}[P_\\theta(c|X_j) \\,\\|\\, P_{\\theta_{\\text{orig}}}(c|X_j)]$ to prevent a global uniform-output shortcut. The evaluation machinery is the probing framework itself: open-ended refusal rate, Yes-No entropy and accuracy on reference/in-training/out-of-training splits, and MCQ accuracy and entropy, which together are designed to reveal whether an unlearning method has removed the edge or just added distractors.","core_discovery":"The paper's central claim is that DF-MCQ removes targeted personal knowledge rather than masking it. Viewing model knowledge as a graph of facts (subject, relation, object), the paper defines genuine unlearning by the equality $H_\\theta(Y_i|X_i,R_i;\\mathcal{D}) \\approx H_\\theta(Y_i|X_i,R_i;\\mathcal{D}\\setminus F_i)$: the model should be exactly as uncertain as one trained without the fact, and should therefore refuse open-ended questions rather than answer them. Obfuscation methods fail this definition because they only add competing edges; the original edge still exists, so probes that rule out the distractors recover the truth. DF-MCQ avoids adding edges by minimizing $D_{\\text{KL}}[P_\\theta(c|X_i)\\,\\|\\,\\hat{P}(c|X_i)]$ over automatically generated MCQs, pushing the choice-letter distribution to uniform, and pairs this with a retain loss on MCQs about other people so the flattening does not become a global shortcut. The reported behaviour, 92.72% refusal on open-ended forget-set questions, 77.6% accuracy on reference Yes-No probes with 0.65 entropy, and the maximum 1.61 entropy on every MCQ subset, supports the paper's conclusion that the model treats questions about the target as unanswerable, which is what unlearning should look like.","pith_inferences":["The reported exact uniform entropy of 1.61 on every MCQ subset is also exactly what a target-name-triggered shortcut would produce; behavioural flattening does not by itself prove the internal fact representation was deleted.","A decisive test would compare DF-MCQ with a model retrained without the target passages, probing both with paraphrased or name-free questions, or with activation-level probes; until then, \"removal\" is an interpretation of the behavioural evidence.","If the shortcut reading is correct, DF-MCQ is a stronger form of suppression rather than a different kind of operation, consistent with the paper's own remark that there is no clear boundary between obfuscation and unlearning.","The same flattening idea might extend to non-person facts, but the paper's limitations list restricts the current evidence to person-centric facts and models under 10B parameters, so generalization to multi-hop or procedural knowledge is untested."],"forward_implications":["Open-ended ROUGE-L scores alone cannot certify unlearning; evaluations should include Yes-No and MCQ probes because these expose whether the original fact is still reachable.","A model unlearned with DF-MCQ will refuse instead of producing a plausible wrong answer, avoiding the new false facts that obfuscation methods inject into the knowledge graph.","The forget-set behaviour survives a benign SFT attack and continual unlearning of additional targets, so the method can be used incrementally.","DF-MCQ transfers across instruction-tuned base models: Llama-3.1-8B-Instruct and Qwen-2.5-7B-Instruct show similar refusal rates, 92.72% and 88.17%, and low forget-set ROUGE-L.","Obfuscation methods' privacy protection degrades on MCQ probes, where WHP+ still reaches 36.73% accuracy and sometimes nearly matches the original model; DF-MCQ drops to 18.86% with maximum entropy."],"supporting_citations":[{"why":"Provides the WPU benchmark and the WHP+ obfuscation baseline that DF-MCQ is compared against.","marker":"Liu et al. (2024)"},{"why":"Introduces the WHP obfuscation approach whose mechanism DF-MCQ contrasts with and extends.","marker":"Eldan and Russinovich (2023)"},{"why":"Supplies NPO, the other obfuscation baseline, and the idea of increasing probability of false statements as an early obfuscation form.","marker":"Zhang et al. (2024)"},{"why":"Argues existing unlearning methods merely obscure information and supplies the SFT attack used to test DF-MCQ's robustness.","marker":"Hu et al. (2025)"},{"why":"Provides the general definition of unlearning referenced in the introduction.","marker":"Liu et al. (2025)"},{"why":"Gives TOFU, the other open-ended unlearning benchmark mentioned alongside WPU for standard evaluation.","marker":"Maini et al. (2024)"}],"fun_headline_variants":["DF-MCQ truly removes knowledge, obfuscation only masks it","Probing shows DF-MCQ unlearns, obfuscation just hides facts","Unlearning done right: DF-MCQ flattens, obfuscation adds noise","DF-MCQ refuses 92%: true unlearning vs obfuscation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The evaluation assumes that high output entropy and refusal behaviour prove the knowledge is gone; the paper does not rule out the model simply learning a shortcut that makes it say \"I do not know\" or answer uniformly whenever the target person's name appears, while the underlying fact remains stored.","fun_headline_variants_meta":{"raw":{"variants":["DF-MCQ truly removes knowledge, obfuscation only masks it","Probing shows DF-MCQ unlearns, obfuscation just hides facts","Unlearning done right: DF-MCQ flattens, obfuscation adds noise","DF-MCQ refuses 92%: true unlearning vs obfuscation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00038,"raw_usage":{"total_tokens":2040,"prompt_tokens":991,"completion_tokens":1049,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":607,"completion_tokens_details":{"reasoning_tokens":957}},"tokens_in":607,"tokens_out":1049,"duration_ms":10683,"temperature":1.0,"reasoning_tokens":957,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T00:44:22.720375+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a DF-MCQ-unlearned model and ask about the target without using the name, e.g. \"Where was the 19th-century German historian born who wrote about palaeography?\" or paraphrase the MCQ; if the correct answer resurfaces, the knowledge was suppressed, not removed. The same test on a model genuinely retrained without the target passages would stay silent, and the behaviour difference would settle whether DF-MCQ truly unlearns.","supporting_citations":[{"cited_title":"Lipton, and J","cited_arxiv_id":null,"evidence_quote":"Gives TOFU, the other open-ended unlearning benchmark mentioned alongside WPU for standard evaluation."}],"review_version":1}