{"id":"46c031aa-ea70-47ff-a1d6-f73d5e43ef17","arxiv_id":"2608.01849","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Knowledge holes, severe response degradation on benign inputs that share patterns with forgotten content, are shown to exist in unlearned multimodal LLMs and are partially repaired by SPAR on LLaVA-1.5-7B.","lead":"This paper shows that removing unsafe knowledge from multimodal AI models also hurts their answers to harmless questions that use similar wording, a hidden side effect called knowledge holes. It proposes a training fix, SPAR, that recovers most of the lost quality on a 7-billion-parameter model, but the fix fails on a smaller model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Internal counterexample: Qwen2.5-VL + KL-Min shows no knowledge hole, undercutting the claim that they are a systematic consequence.","rationale":"The reader correctly flagged the spectral-separation assumption as a key weakness of SPAR's mechanism, and the Qwen failure is consistent with that concern. However, the more load-bearing issue is the paper's own Table 1: the Qwen KL-Min row directly contradicts the paper's repeated claim that knowledge holes are a 'systematic consequence' that occurs 'independent of model architecture, parameter scale, or the specific forget loss used.' This is not an unproven assumption but an internal inconsistency in the reported data. The abstract's unqualified '0.00% attack success rate' also misrepresents the Qwen result (80.33%). These overclaims would have to be scoped and re-supported before the central claim can be accepted. The paper's LLaVA-1.5-7B results are still a meaningful contribution: PO, RMU, and KL-Min all show severe degradation there, and SPAR restores response quality to 7.07 with 0% ASR, with ablations (standard SVD failure, k and beta sensitivity) providing some mechanistic support. The spectral-separation question is secondary: even if SPAR's mechanism were fully validated on LLaVA, the 'systematic' claim would still be false on the paper's own evidence. Therefore the verdict remains CONDITIONAL, requiring revised claims and additional evidence, but the core LLaVA finding is not overturned.","tokens_in":19366,"tokens_out":4835,"duration_ms":57380,"concrete_test":"Human-annotate a random sample (e.g., 100) of Qwen2.5-VL-3B KL-Min responses on the knowledge-hole probe, using the same rubrics as GPT-4o. If human scores confirm the ~7.1 quality (vs 7.19 vanilla), the Qwen KL-Min row is a genuine counterexample, and the 'systematic/uniform' claim must be revised to 'common on LLaVA and for PO/RMU, but not universal.' If human scores reveal severe degradation that GPT-4o missed, the counterexample is an evaluation artifact and the claim may survive.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 5, Table 1 contains a direct counterexample to the central claim. On Qwen2.5-VL-3B, KL-Min achieves Res.Q 7.13 vs vanilla 7.19 (relative drop <1%) and RR 3.67% vs 3.46%, i.e., no knowledge hole. Yet the paper states 'all baseline methods ... uniformly suffer from severe knowledge holes' and 'systematic consequence ... independent of model architecture, parameter scale, or the specific forget loss used.' The abstract's unqualified '0.00% attack success rate' is also contradicted by SPAR on Qwen (ASR 80.33%). Thus the central claim is internally inconsistent and overstated: the contribution is currently supported only for LLaVA-1.5-7B, and on Qwen only for PO/RMU, with NPO collapsing completely (all metrics 0.00). This is not a minor caveat; it directly bears on whether knowledge holes are a systematic phenomenon and whether SPAR is a general mitigation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper defines \"knowledge holes\" in unlearned multimodal LLMs as severe degradation on benign inputs that share generic patterns with the forget set, constructs a probing benchmark for this phenomenon, and proposes SPAR (Selective Protection with Anchored Regularization), which combines anchored-SVD activation filtering, entity-masked enhancement, and retain-set regularization. On LLaVA-1.5-7B the method is reported to recover near-vanilla response quality while achieving 0% ASR on SafeEraser. On Qwen2.5-VL-3B the method fails (ASR 80.33%), and the paper frames this as a boundary condition. The central claims are that knowledge holes are a systematic consequence of common unlearning methods across architectures and that SPAR bridges them while preserving forgetting quality.","tokens_in":19662,"tokens_out":3483,"duration_ms":39467,"significance":"The benchmark and the proposed method target a real blind spot in MLLM unlearning evaluation: standard utility benchmarks may miss localized, pattern-level degradation. If the LLaVA-1.5-7B results are reproducible, the paper demonstrates a useful diagnostic tool and a mitigation idea (anchored SVD to separate generic structure from content) that is mechanistically plausible. The ablation showing that standard SVD fails while anchored SVD succeeds (Table 2) is a valuable empirical point. However, the paper's headline claims are broader than the evidence: Table 1 contains a direct counterexample to \"systematic\" knowledge holes, and the abstract's unqualified 0.00% ASR is contradicted by the same table. The contribution is therefore currently supported mainly for one architecture and a subset of baselines, not as the general phenomenon claimed.","major_comments":[{"comment":"The claim that knowledge holes are \"a systematic consequence of unlearning, independent of model architecture, parameter scale, or the specific forget loss used\" is contradicted by the paper's own data. On Qwen2.5-VL-3B, KL-Min has Res. Q 7.13 vs. vanilla 7.19 (relative drop <1%) and RR 3.67% vs. 3.46%, i.e., no knowledge hole by the paper's own definition. Because \"systematic\" is the abstract's central claim and the basis for the proposed evaluation paradigm, this internal counterexample must be addressed by either restricting the claim or explaining why this exception is not informative.","section":"§5, Table 1"},{"comment":"The abstract states SPAR achieves \"0.00% attack success rate\" without qualification, but Table 1 reports SPAR on Qwen2.5-VL-3B with ASR 80.33%. The Limitations section (p. 11) acknowledges the failure on Qwen due to compact hidden dimension and safety alignment. The abstract and introduction should scope the 0.00% claim to LLaVA-1.5-7B, or report both results. As written, the headline claim is misleading.","section":"Abstract and §1, Table 1"},{"comment":"The method relies on the spectral assumption that top singular vectors of hidden states encode generic syntactic structure while content-specific semantics lie in trailing directions. No direct evidence is provided for this decomposition. The Qwen results in Appendix C, Table 6 (ASR rises from 18.67% at k=0 to 80.33% at k=2) are consistent with over-filtering, but they do not independently establish what the top-k singular vectors capture. The authors should provide spectral analysis, e.g., projection of benign vs. harmful token activations onto the top-k basis or an ablation that measures content leakage into the filtered subspace.","section":"§4, Anchored Forget Loss (Eqs. 1–6)"},{"comment":"The benchmark uses GPT-4o both to generate the probing prompts/patterns and to judge ASR, RR, and Res. Q, and SPAR hyperparameters are selected using those same judged metrics (Tables 2, 5, 6). This creates a circularity risk: part of the reported gain may reflect alignment with GPT-4o's evaluation preferences rather than generic knowledge preservation. The manual inspection of prompts and the small spot-check for binary decisions are helpful, but the paper should report inter-annotator agreement on Res. Q, or run the final LLaVA comparison with an independent judge or human evaluation.","section":"§3, Appendix A, D"},{"comment":"NPO collapses to 0.00 across MMVet, POPE, VizWiz, RR, and Res. Q on both models, with Res. Q 1.00. This indicates the model is effectively destroyed, so including NPO in the \"all baselines uniformly suffer from severe knowledge holes\" pattern inflates the systematicity claim: a fully collapsed model trivially has low Res. Q. NPO should either be diagnosed and excluded, or its catastrophic collapse should be analyzed separately. The current presentation treats it as another instance of knowledge holes, which is not substantiated.","section":"Table 1, NPO rows"}],"minor_comments":[{"comment":"\"SPAR recovers over 98% of vanilla response quality compared to below 50% for standard baselines\" is only true on LLaVA. On Qwen, KL-Min retains 7.13/7.19 = 99% of vanilla response quality, so the \"below 50%\" characterization does not generalize.","section":"Abstract"},{"comment":"The sentence \"The same pattern holds on Qwen2.5-VL-3B\" immediately follows a discussion of LLaVA and is immediately qualified by PO's numbers, but the KL-Min row in Table 1 contradicts the claim. Please rephrase to describe per-method, per-architecture patterns rather than a uniform phenomenon.","section":"§5, Existence of Knowledge Holes"},{"comment":"The Qwen-specific SPAR hyperparameters (alpha=300, beta=2.0, lambda=0.05) are very different from LLaVA's (alpha=600, beta=1.0, lambda=0.5). The manuscript does not discuss why lambda must be 0.05, nor whether the Qwen failure can be attributed to this choice. A sentence explaining the selection procedure would improve reproducibility.","section":"Appendix B, Table 4"},{"comment":"The notation H⊙(W_r 1^T_d) is a bit compressed; W_r is defined as an L-vector, so W_r 1^T_d is L×d. Clarify that the rows of H are scaled by w^r_j.","section":"§4, Eq. (5)"},{"comment":"The Res. Q template asks the judge to rate on a 1–10 scale, but the main text says the score is \"on a scale of 1 to 10\" (p. 5). Fine, but consider explicitly stating whether partial scores (e.g., 7.5) are allowed and how the three repeated queries are averaged.","section":"Appendix D"}],"recommendation":"major_revision","confidential_remarks":"The paper has a useful diagnostic idea and a plausible mechanism, but the central systematicity claim is not supported by the paper's own Table 1. The abstract overstates the forgetting result (0.00% ASR) without the Qwen caveat. These are fixable within the manuscript's scope by tightening claims, adding spectral evidence, and addressing the GPT-4o circularity. I would not reject, but the current version is not acceptable as-is."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this paper for one reason: it builds the first multimodal knowledge-hole probe, transplanting structural patterns from forget-set responses into benign prompts, and shows that on LLaVA-1.5-7B, PO and RMU tank response quality on those probes while standard utility benchmarks look fine. That is a genuinely useful evaluation axis, and the SPAR method—anchored SVD from a frozen retain-tuned reference plus entity-masked, visually blanked enhancement—restores Res. Q from ~1.5–4 to 7.07 with 0% ASR on LLaVA. The ablation showing standard SVD lets the model rotate harmful content into filtered directions is a nice mechanistic point.\n\nBut the paper overclaims, and the overclaims are not subtle. Table 1 itself contains the counterexample: KL-Min on Qwen2.5-VL-3B shows Res. Q 7.13 vs vanilla 7.19 and RR 3.67% vs 3.46%—no knowledge hole at all. The text says holes are 'a systematic consequence... independent of model architecture, parameter scale, or the specific forget loss used.' That is simply false given their own data. The abstract's '0.00% attack success rate' also hides that SPAR on Qwen hits 80.33% ASR. To their credit, the Limitations paragraph and the k-ablation on Qwen acknowledge the failure and tie it to hidden dimension and safety alignment, but the abstract and main-claims sections were not reconciled with that.\n\nThe mechanism also rests on an unproven spectral-separation assumption: top singular vectors of hidden states encode generic syntax, trailing directions carry content. The LLaVA results are consistent with that, but the paper provides no direct spectral evidence, and Qwen's behavior suggests the assumption is architecture-dependent. That is a soft spot, not a nail in the coffin—the method works on one model and the ablation logic is coherent.\n\nBenchmark circularity is real but partial. GPT-4o both generates probes and judges Res. Q/RR, no data is released, and no error bars or significance tests appear. Three seeds are averaged, but we only see means. The core phenomenon is measured on raw model responses, so it is not fabricated, but the magnitudes (98% recovery) should be read with caution until artifacts are public.\n\nVerdict: this deserves a serious referee, but the revision must scale the claims back to what Table 1 supports, release the probe data and judge outputs, and either add spectral analysis or state plainly that AFL's mechanism is a working hypothesis. The contribution is real for the MLLM-unlearning subfield; it just needs honest boundaries. I'd bring it to our reading group and would cite it once artifacts exist.","headline":"Useful but overclaimed: the knowledge-hole probe is a real addition, SPAR works on one model, and the paper's own Table 1 contradicts its 'systematic' and '0.00% ASR' claims.","tokens_in":20183,"tokens_out":710,"would_cite":true,"duration_ms":9876,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that standard MLLM unlearning methods create 'knowledge holes'—severe degradation on benign inputs resembling forgotten content—and that its SPAR method restores 98% of vanilla response quality on LLaVA-1.5-7B while achiev","keywords":["knowledge holes","machine unlearning","multimodal large language models","safety alignment","singular value decomposition","null-space projection","response quality","attack success rate"],"falsifier":"Compute, on Qwen2.5-VL-3B, the cosine similarity between the top-k anchored singular vectors and the embedding of refusal words ('sorry', 'cannot'); if these exceed similarity to generic function words, the anchor is protecting refusal behavior, which would explain the 80.33% ASR.","tokens_in":19244,"feed_emoji":"🛡️","tokens_out":4304,"duration_ms":42100,"temperature":0.7,"pith_summary":"This paper establishes that current multimodal unlearning benchmarks miss a systematic failure: after removing unsafe content, models collapse on benign inputs that share generic response patterns with the forgotten material. The authors construct a probing benchmark that transplants structural patterns from forget-set responses onto harmless topics, and show that representative unlearning methods lose 50–80% of response quality on these probes even while standard utility benchmarks look healthy. They then introduce SPAR, which shields generic activation patterns from the forget loss using a frozen-anchor SVD filter and reinforces pattern handling through an entity-masked enhancement loss. On LLaVA-1.5-7B, SPAR recovers over 98% of the original response quality while keeping attack success rate at 0%. The same method fails on Qwen2.5-VL-3B, which the paper attributes to limited hidden dimensionality and strong safety alignment that misclassifies refusal behavior as a generic pattern.","feed_headline":"SPAR erases unsafe answers without wrecking benign replies","feed_subtitle":"Standard unlearning quietly collapses benign replies; SPAR restores near-vanilla quality at 0% attack success.","key_machinery":"The load-bearing mechanism is Anchored SVD inside the Anchored Forget Loss: singular vectors are computed once from a frozen reference model fine-tuned on the retain set, so the trainable model cannot rotate harmful content into the filtered directions. Top-k of these right singular vectors are treated as generic structural patterns; per-token projections onto them are normalized into weights, used to subtract the corresponding components from the trainable hidden states before the forget loss. The companion Abstracted Enhancement Loss masks entity tokens and zeroes the image, then applies cross-entropy only on the remaining non-entity positions, reinforcing generic competence without reintr","core_discovery":"In the paper's own terms, knowledge holes are a measurable, systematic consequence of commonly used MLLM unlearning approaches: forget losses penalize everything in the hidden states that correlates with the forget set, including neutral generic patterns shared with benign tasks, so models become excessively refusal-prone on unrelated-but-similar inputs. The paper's central discovery is that this collateral damage can be largely decoupled from actual forgetting. SPAR computes a frozen SVD basis from a retain-fine-tuned reference model, filters the top-k singular directions (assumed to encode generic syntactic structure) out of the trainable model's activations before applying the forget loss","pith_inferences":["By symmetry, visual-side knowledge holes likely exist: unlearning weapon images may degrade recognition of visually similar benign objects (tools, sports equipment), which the paper lists as future work but never tests.","The spectral-separation assumption—top singular vectors = syntax, trailing = content—could be tested directly by measuring how well principal directions of forget vs. retain hidden states separate in different architectures; if separation degrades with hidden size, a principled threshold for SPAR-like methods could be derived.","The failure mode on Qwen suggests a testable extension: applying SPAR to a 3B-scale model without strong safety alignment should show whether the culprit is dimensionality or the alignment-induced refusal patterns.","If the frozen anchor is obtained from the retain-fine-tuned model, SPAR's effectiveness may depend on retain-set coverage of the generic patterns; probing with out-of-coverage patterns would bound the method's generality."],"forward_implications":["Standard utility benchmarks (MMVet, POPE, VizWiz) are insufficient to certify unlearned MLLMs; adjacent-input probes of this kind should be part of any safety evaluation.","Forgetting strength can be kept at 0% ASR while restoring benign response quality to near-vanilla level on models with sufficient hidden dimension, suggesting the two objectives are not inherently in conflict.","The success of anchored (frozen) SVD over standard SVD shows that unlearning methods must prevent the model from gaming the protection subspace by rotating its features.","The Qwen2.5-VL-3B failure implies a minimum representational capacity for null-space projection approaches to work, and safety-aligned models may absorb refusal patterns into the protected generic directions."],"fun_headline_variants":["SPAR fixes unlearning's hidden cost: 98% quality, 0% attack success","Unlearning's blind spot: knowledge holes and how SPAR avoids them","SPAR erases unsafe content without erasing safe replies","Knowledge holes: the hidden cost of MLLM unlearning, solved","Forget unsafe data, keep safe replies: SPAR does both"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The method assumes that in the hidden states, the top singular directions overwhelmingly encode generic syntactic structure while content-specific semantics live only in trailing directions; if that spectral separation fails—as the paper's own Qwen2.5-VL-3B results suggest—the anchored filter either shields harmful content or fails to protect benign patterns.","fun_headline_variants_meta":{"raw":{"variants":["SPAR fixes unlearning's hidden cost: 98% quality, 0% attack success","Unlearning's blind spot: knowledge holes and how SPAR avoids them","SPAR erases unsafe content without erasing safe replies","Knowledge holes: the hidden cost of MLLM unlearning, solved","Forget unsafe data, keep safe replies: SPAR does both"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000781,"raw_usage":{"total_tokens":3277,"prompt_tokens":721,"completion_tokens":2556,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":465,"completion_tokens_details":{"reasoning_tokens":2469}},"tokens_in":465,"tokens_out":2556,"duration_ms":20741,"temperature":1.0,"reasoning_tokens":2469,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T19:39:51.648595+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute, on Qwen2.5-VL-3B, the cosine similarity between the top-k anchored singular vectors and the embedding of refusal words ('sorry', 'cannot'); if these exceed similarity to generic function words, the anchor is protecting refusal behavior, which would explain the 80.33% ASR.","supporting_citations":[],"review_version":1}