{"id":"3445f8c7-8aa6-4ec5-a1be-9f35e12dad22","arxiv_id":"2505.14832","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SEPS measures separation of forget and retain queries in mixed prompts, and Mixed Prompt training makes unlearned LLMs much better at this separation.","lead":"This paper introduces SEPS, a metric that tests whether an unlearned LLM can refuse forget-set questions while still answering retain questions when both appear in the same prompt. It also proposes Mixed Prompt training, which builds prompts containing both question types and substantially improves separability over existing unlearning methods.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Stress-test and SEPS evaluations reuse the exact forget/retain samples used for MP training (App. C.8) with epoch selection on the evaluation metric itself (App. C.3), so the reported multi-query robustness may reflect memorization rather than generalization.","rationale":"I agree with the reader's conditional verdict, but I prioritize the train/evaluation overlap over the LLM-as-judge concern. The judge concern is partly mitigated by Table 2, where LLM-as-Judge correlates highly with ROUGE and cosine similarity across MU, FE, and SEPS, so a format artifact would likely also show up in those correlations. The overlap problem is more structural: the unlearning operator is allowed to train on Df and Dr, and then the same Df and Dr populate the stress test. For standard forget-efficacy measurement, evaluating on the target forget set is appropriate, but the paper's 'robustness' and 'generalization' language is broader. A stress test built from the same 40 forget01 samples cannot distinguish a learned ability to separate query types from familiarity with the specific authors and facts in the prompts. The epoch selection on the evaluation metric compounds this by choosing the checkpoint that maximizes the reported score. These issues do not overturn the baseline-failure observations, which are already informative, and the concrete test I propose would settle whether the MP advantage is transferable. If it is not transferable, the paper should be revised to claim robustness on the unlearning target set rather than robustness in complex real-world settings.","tokens_in":32088,"tokens_out":3721,"duration_ms":35917,"concrete_test":"Train MP-ME and MP-IDK on only 20 of the 40 forget01 forget samples and a disjoint subset of retain samples, then construct the multi-query stress test exclusively from the held-out 20 forget samples and held-out retain samples using the Appendix C.8 template and the Section 6.4 protocol. Select epochs on a small validation split rather than on test SEPS. If the SEPS gap over baselines persists on never-trained forget content, the robustness claim is supported; if it collapses, the paper should reframe its claim as memorized-content robustness.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing claim is that MP-ME and MP-IDK generalize to mixed prompts with up to eight queries (Sec. 6.4 and the abstract). That claim requires the stress-test prompts to measure transfer to configurations or content not seen during MP training. The paper does not establish this. Appendix C.8 builds the 180 stress-test prompts from the 40 forget01 forget samples and randomly selected retain samples; these are the same Df and Dr used to train MP-ME and MP-IDK in Secs. 6.1-6.2, and no train/test split is reported. The model has therefore seen the exact question-answer pairs whose separability is being measured, and the two-query SEPS evaluation appears to use the same pool. Additionally, Appendix C.3 selects the reported epoch by the harmonic mean of MU, FE, and SEPS on this same evaluation, so the headline numbers are produced by test-set selection. This does not invalidate the observed failure of baseline unlearning methods to separate queries; those failures are comparisons on the same evaluation and the untargeted 'bleeding' effect is corroborated by qualitative examples. But it does weaken the inference from 'MP methods score well on this stress test' to 'MP methods are robust in complex settings.' The metric SEPS is less affected; the exposed claim is the proposed remedy's generalization.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SEPS, an evaluation metric for machine unlearning that measures whether a model answers retain queries while refusing forget queries when both appear in the same prompt. Using TOFU, MUSE, and WMDP, it reports that existing unlearning methods have near-zero SEPS and identifies two failure modes: untargeted methods collapse retain scores when a forget query is present, and targeted methods overfit single-query behavior. It then proposes MP-ME and MP-IDK, which train on interleaved forget/retain prompts, and reports large SEPS improvements and robustness up to eight mixed queries in a stress test.","tokens_in":32347,"tokens_out":5346,"duration_ms":48357,"significance":"If the results hold, SEPS is a useful evaluation primitive and the mixed-prompt training strategy is a simple, practical remedy for a real failure mode. The paper includes a broad comparison across ten baselines and three benchmarks, releases code, and provides qualitative examples showing the 'bleeding' and single-query overfitting effects. The main uncertainty is whether the stress-test results measure generalization: the stress-test prompts reuse the exact forget samples used to train MP methods, and epoch selection includes SEPS on the reported evaluation set. These issues are fixable with a held-out split and a validation-based selection protocol, so the central idea remains defensible.","major_comments":[{"comment":"The stress-test prompts are built from the same 40 forget01 forget samples and randomly selected retain samples used to train MP-ME and MP-IDK in Sections 6.1-6.2, and no train/test split is reported. The abstract and Section 6.4 claim robustness 'even in complex settings with up to eight mixed forget and retain queries,' but with this overlap the high stress-test scores may largely reflect memorization of the exact question-answer pairs whose separability is being measured. Please rerun the stress test on held-out content (e.g., a disjoint split of authors or QA pairs, or paraphrased queries), or explicitly separate and report results for query content never used in MP training, and adjust the generalization claim accordingly.","section":"Section 6.4, Appendix C.8"},{"comment":"The checkpoint is selected by the harmonic mean of MU, FE, and SEPS computed on the same evaluation set that is reported in Tables 1 and 7. Because SEPS is part of the selection criterion, the headline numbers are produced by test-set selection, which inflates apparent performance and makes comparisons between methods difficult to interpret. Please select epochs on a validation split disjoint from the reported evaluation, or report results for both 5 and 10 epochs so readers can assess the sensitivity of every table to this choice.","section":"Appendix C.3"},{"comment":"The paper states that MP-ME performs well in the RF ordering but struggles in the FR ordering, yet the stress-test summary in Figure 6 reports only average retain and forget scores collapsed over both orderings and over the 1/2/4 query counts. This averaging can hide the FR failure mode that the two-query analysis identifies, so the claim of robust performance 'up to eight' queries is not supported by the displayed aggregation. Please report stress-test results separately for retain-first and forget-first orderings, and preferably broken down by query count as well.","section":"Section 6.3, Figure 5, Figure 6"},{"comment":"The validity of the LLM-as-Judge scores for SEPS is supported only by correlation with ROUGE and cosine similarity, but all three metrics could be correlated while still sharing a systematic bias induced by the numbered mixed-prompt format or by the style of 'I don't know' refusals. Please provide a direct validation of the judge against known ground-truth inclusion levels, for example outputs that contain known fractions of forget and retain content and refusal-style outputs with no content, and report per-item agreement or calibration metrics in addition to correlation.","section":"Appendix C.6, Table 2"},{"comment":"All quantitative results are point estimates without error bars, confidence intervals, or repeated-seed variation. Since the central claim is that MP methods 'significantly improve' over baselines, please report at least the standard error over evaluation samples or multiple training seeds for the main SEPS and H-Avg. comparisons; this is particularly important for the smaller differences, such as MP-ME versus NPO+GD in the forget01 setting.","section":"Tables 1, 7, 8, Figure 6"}],"minor_comments":[{"comment":"The formulas for FIS and RIS are printed identically as 'FR Score + RF Score / 2' and differ only through the underlining convention. Please use explicit notation, such as FIS = (F_R + F_RF)/2 and RIS = (R_RF + R_FR)/2, to avoid confusion.","section":"Section 4"},{"comment":"The phrase 'SEPS is formularized as' should be 'SEPS is formulated as'.","section":"Section 4"},{"comment":"The sentence 'In our experiments, we mainly employ LLM-as-Judge scores to quantify the MU, FE, and SEPS of unlearned models' is repeated verbatim in the same paragraph; please delete the duplicate.","section":"Appendix C.3"},{"comment":"The caption should state explicitly how many prompts contribute to each bar and whether the averages are over prompts or over individual queries; currently the reader cannot tell whether the collapsed scores are dominated by the two-query or eight-query configurations.","section":"Figure 6"},{"comment":"The phrase 'task arithematic' should be 'task arithmetic.'","section":"Section 2"},{"comment":"Please report the number of sampled retain questions per line and the exact random seed or sampling procedure, since the stress test currently uses only 10 samples per configuration and reproducibility depends on this detail.","section":"Appendix C.8"}],"recommendation":"major_revision","confidential_remarks":"The paper's main risk is that the proposed MP methods are evaluated on data they were trained on, and the model-selection rule uses the evaluation metric itself. Neither issue invalidates the observed failure modes of baselines, but both must be addressed before the robustness claim in the abstract can be accepted. I would also encourage the authors to release the exact stress-test construction and judge outputs to facilitate reproducibility."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"SEPS is a simple but sensible metric: it measures whether a model answers retain queries and refuses forget queries when both appear in the same prompt. The failure modes it exposes — untargeted methods erasing whatever follows a forget query, targeted methods overfitting to single-query formats — are real, and the paper documents them across TOFU, MUSE, and WMDP with qualitative examples that match the numeric pattern. The MP training variants are straightforward data augmentation on mixed prompts, but the systematic comparison across twelve methods is new and useful. The paper also checks the GPT-4 judge against ROUGE and cosine similarity, which is more than most LLM-as-judge papers do.\n\nSoft spots: the strongest claim — that MP methods are robust up to eight mixed queries — is not fully supported. Appendix C.8 builds the 180 stress-test prompts from the same forget01 samples used to train MP-ME and MP-IDK, and no train/test split is reported. So the stress test measures memorization of those exact question-answer pairs, not transfer to new content. Also, epoch selection in C.3 picks the checkpoint with the highest harmonic mean of MU, FE, and SEPS, so the headline numbers are chosen on the test metric. That is a selection-on-test-set issue, though it applies to all baselines equally. No error bars or multiple seeds are reported, which is annoying but not disqualifying for this kind of benchmark study. The judge validity is less concerning than you might think, since the correlation table gives reasonable evidence that the judge tracks ROUGE and cosine similarity.\n\nOn the circularity concern: it lands partially. High SEPS for MP methods is partly the fitted objective, because MP-ME and MP-IDK train on exactly the RF/FR orderings that SEPS evaluates. But the baseline failure is an independent comparison on the same metric, and the qualitative examples corroborate the failure mode. The core observation survives; the generalization claim needs a cleaner stress test. The metric itself is fine; the exposed claim is the remedy's generalization.\n\nBottom line: this deserves peer review. A good referee will ask for a split stress test, error bars, and a clearer statement of when SEPS measures memorization versus behavior. I would cite the SEPS metric and the baseline-failure analysis even if the MP training results need revision. Bring it to the reading group; it will generate a good discussion about evaluation leakage.","headline":"A useful mixed-prompt evaluation for unlearning, with a solid baseline-failure analysis and a training fix whose generalization claims are undercut by train/test overlap.","tokens_in":32888,"tokens_out":1801,"would_cite":true,"duration_ms":17562,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Existing LLM unlearning methods fail when forget and retain queries are mixed in a single prompt, and this paper shows a new separability score plus mixed-prompt training closes much of that gap.","keywords":["machine unlearning","large language models","separability","mixed-prompt evaluation","forget efficacy","model utility","LLM-as-judge","prompt robustness"],"falsifier":"Have human annotators score the same mixed-prompt outputs that the judge scored, especially outputs that say \"I don't know\" or that answer only one of two numbered questions; if the judge's ratings diverge from human judgments of information overlap, the SEPS comparisons do not measure separability. Alternatively, rerun the eight-question stress test with forget and retain questions never seen during MP training; a sharp drop in SEPS would show that the reported robustness is memorization of training prompts.","tokens_in":31842,"feed_emoji":"🧠","tokens_out":9193,"duration_ms":71453,"temperature":0.7,"pith_summary":"The paper's central claim is that current LLM unlearning methods are not evaluated the way real users prompt models: forget and retain questions usually appear in the same message, but standard metrics test them separately. To expose this, the authors define SEPS, a separability score that subtracts how much a model reveals about to-be-forgotten content from how well it answers to-be-retained content inside one prompt. Across three benchmarks they find two failure modes: untargeted unlearning wipes out retain answers as soon as a forget question appears, and targeted \"I don't know\" training overfits to single questions and fails on follow-ups. The paper then shows that training on mixed prompts, with an entropy objective for forget tokens and a reference-alignment objective for retain tokens (MP-ME), or with cross-entropy toward \"I don't know\" for forget answers (MP-IDK), raises SEPS and stays strong with up to eight mixed queries.","feed_headline":"Mixed prompts break LLM unlearning; new metric catches it","feed_subtitle":"New metric and mixed-prompt training keep models refusing forget queries while answering retain queries in one prompt.","key_machinery":"The central object is the Separability Score, $\\text{SEPS}=\\max(\\text{RIS}-\\text{FIS},0)$, built from Retain and Forget Inclusion Scores. RIS and FIS average each query's score over the two orderings of a two-question prompt, so a model scores well only when it answers retain questions and refuses forget questions in the same prompt, rather than leaking everything or refusing everything. The companion machinery is Mixed Prompt training: MP-ME applies a token-level Kullback-Leibler loss toward a uniform distribution on forget content and toward the reference model on retain content, while MP-IDK applies cross-entropy to \"I don't know\" labels for forget answers and ground-truth answers for retain queries; both losses are symmetrized over retain-first and forget-first orders.","core_discovery":"The paper claims that unlearning quality should be judged by separability, not only by single-query forget efficacy and model utility. It defines the Separability Score as $\\max(\\text{RIS}-\\text{FIS},0)$, where Retain Inclusion Score (RIS) and Forget Inclusion Score (FIS) average the score of the retain and forget halves of prompts that appear in both orders, retain-then-forget and forget-then-retain. With this measure, the paper reports that ten existing methods score near zero on SEPS even when their single-query scores look acceptable, and identifies two failure patterns: untargeted methods let the retain score collapse to the forget baseline as soon as a forget question appears, and targeted methods answer a first forget question or refuse a second retain question. The proposed Mixed Prompt unlearning, MP-ME and MP-IDK, trains on prompts containing both kinds of questions with a symmetrized loss, and attains higher SEPS while remaining competitive on utility and forget efficacy, including on a stress test with up to eight mixed questions.","pith_inferences":["If SEPS becomes standard, unlearning training should include both prompt orders and repeated same-type queries, because the paper shows separability failures are order- and position-dependent.","The stress test is built from the same forget and retain samples used for MP training, so the paper does not establish that separability transfers to unseen content; a natural next test is a held-out mixed-prompt split.","Pairing judge-based SEPS with per-answer exact-match or retrieval checks would protect the metric from LLM-judge format bias and make scores easier to audit.","The failure asymmetry (forget-first hurts untargeted methods, forget-last hurts targeted methods) suggests that any deployment of unlearning should be tested with both orderings before release."],"forward_implications":["SEPS should be reported alongside model utility and forget efficacy, because high scores on the standard single-query metrics can coexist with near-zero separability.","Untargeted unlearning methods that maximize loss or entropy on forget data are unsafe for mixed prompts, since a single forget question makes them erase retain content too.","Targeted \"I don't know\" training needs mixed-prompt objectives, because models trained only on single queries answer a first forget question or refuse a second retain question.","Mixed Prompt training with MP-ME and MP-IDK keeps forget and retain answers separated in prompts containing up to eight mixed questions.","Aggregating model utility, forget efficacy, and SEPS by harmonic mean gives a more realistic ranking of unlearning methods than utility and efficacy alone."],"supporting_citations":[{"why":"Reports that NPO and ECO leak or over-refuse when forget and retain queries appear in one prompt; this is the problem SEPS formalizes.","marker":"Thaker et al. (2024a)"},{"why":"Provides the fictitious-author benchmark and the IDK unlearning baseline used in the main experiments.","marker":"Maini et al. (2024)"},{"why":"Supplies the maximizing-entropy and IDK+AP baselines whose loss designs MP-ME and MP-IDK adapt.","marker":"Yuan et al. (2025)"},{"why":"Introduces NPO, a main untargeted baseline and the DPO-style negative-preference formulation.","marker":"Zhang et al. (2024a)"},{"why":"Introduces ECO, an unlearning method the paper identifies as failing on mixed prompts.","marker":"Liu et al. (2024a)"},{"why":"Defines DPO, the preference objective behind the DPO and NPO baselines.","marker":"Rafailov et al. (2023)"},{"why":"Justifies the LLM-as-judge scoring that SEPS relies on for content-inclusion ratings.","marker":"Zheng et al. (2023)"},{"why":"Supplies instruction modeling, the loss-over-instructions technique used in MP-ME.","marker":"Shi et al. (2024)"}],"fun_headline_variants":["New metric exposes unlearning failures on mixed prompts","SEPS: judging LLM unlearning when forget and retain mix","Mixed-prompt training fixes unlearning blind spots","Unlearning metric reveals collapse in mixed-query prompts"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole comparison stands or falls on the language-model judge scoring mixed-prompt outputs by real information overlap rather than by format or refusal style, since every RIS, FIS, and SEPS number is derived from those ratings.","fun_headline_variants_meta":{"raw":{"variants":["New metric exposes unlearning failures on mixed prompts","SEPS: judging LLM unlearning when forget and retain mix","Mixed-prompt training fixes unlearning blind spots","Unlearning metric reveals collapse in mixed-query prompts"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000153,"raw_usage":{"total_tokens":1215,"prompt_tokens":961,"completion_tokens":254,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":577,"completion_tokens_details":{"reasoning_tokens":190}},"tokens_in":577,"tokens_out":254,"duration_ms":3536,"temperature":1.0,"reasoning_tokens":190,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:28:43.073459+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have human annotators score the same mixed-prompt outputs that the judge scored, especially outputs that say \"I don't know\" or that answer only one of two numbered questions; if the judge's ratings diverge from human judgments of information overlap, the SEPS comparisons do not measure separability. Alternatively, rerun the eight-question stress test with forget and retain questions never seen during MP training; a sharp drop in SEPS would show that the reported robustness is memorization of training prompts.","supporting_citations":[],"review_version":1}