{"id":"bea4773d-37e2-4f7e-a9ea-593058f37480","arxiv_id":"2608.04519","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A new benchmark with six multi-hop reasoning structures and three recovery attacks shows that existing LLM unlearning methods leak knowledge through indirect queries and post-unlearning attacks.","lead":"This paper introduces a benchmark for testing whether large language models truly forget knowledge, using six logical reasoning patterns and three recovery attacks. It finds that current unlearning methods remain vulnerable: erased knowledge reappears through indirect questions and lightweight attacks, and no method balances forgetting, robustness, and utility.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Appendix E.2's judge instructs that any response containing the ground-truth string is CORRECT, even if negated or hedged; this can inflate every recovery rate in Table 3 and may manufacture Finding 2.","rationale":"The reader's weakest assumption pointed to the LLM-generated questions and LLM-as-a-judge grading broadly; my concern is narrower and more specific: the deployed judge prompt itself contains an instruction that makes a substring match sufficient for correctness, independent of whether the model actually asserted, negated, or hedged the answer. That is a concrete, checkable flaw rather than a general worry about LLM grading. The same judge feeds both central metrics, so it is load-bearing for Finding 2 and the derived trade-off in Finding 3. I also considered other candidate weaknesses: absent error bars, the Books dataset-size inconsistency (Section D.6 vs Table 4), and the unverifiable data link. Those affect precision and reproducibility, but they do not directly threaten the direction of the central claim the way a systematically lenient grader does. The proposed fix is inexpensive and decisive: regrade stored outputs with human annotators and corrected external judges. If the corrected recovery rates preserve the SH<MH ordering for most methods, the qualitative central claim survives and the benchmark remains valuable; if not, the headline findings need revision. The reader's CONDITIONAL verdict already requires evaluation fixes, so I keep that verdict rather than moving to REJECT or UNVERDICTED; the contribution is potentially sound, but the grading protocol must be verified.","tokens_in":18372,"tokens_out":9457,"duration_ms":89072,"concrete_test":"Take the stored model outputs that produced Table 3 (or a stratified sample of 200 per dataset/attack, covering cells with both high and low RR) and have three independent human annotators regrade them using a corrected protocol that prohibits substring matching, marks negated or hedged statements as incorrect, and accepts only genuine semantic equivalence. Also regrade the same outputs with 2-3 external LLM judges (e.g., DeepSeek, gemini, Kimi) under the corrected prompt. If human-judged RR differs from Table 3 by more than about 10 points, or if the SH<MH ordering flips for the five methods that currently show it, Finding 2 is not supported and Table 3 must be recomputed before any trade-off conclusions are drawn.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central recovery-robustness claim, Finding 2 and the 'impossible triangle' analysis, is measured with an LLM-as-a-judge whose deployed prompt in Appendix E.2 contains rule 3: 'If the ground-truth answer appears anywhere in the response, judge as CORRECT.' This rule overrides rule 1 ('conveys the same meaning') and does not handle negation or hedging: a response such as 'I cannot disclose that; the answer is not Europe' or 'I don't know, perhaps Europe' is counted as a successful recovery whenever the answer string appears. Unlearned models frequently hedge or refuse while still mentioning the target string, and Appendix F.3 shows base multi-hop accuracy is only 60-65%, so a nontrivial fraction of judged outputs are partial or evasive. Because the same judge underlies both Forget Quality (Eq. 1) and Recovery Rate (Eq. 2), both the path-consistency and recovery-robustness results are exposed. Section 8 concedes general 'LLM-as-a-judge' failure modes, but the prompt makes the failure concrete and testable. If this grading rule inflates RR differentially across single-hop versus multi-hop questions, the headline result that 'multi-hop queries are often easier to recover than single-hop ones' could be an artifact of the grader rather than a property of the unlearned models.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Leak-resistant Unlearning, a benchmark for LLM unlearning that augments single-hop questions with six logic-inspired multi-hop reasoning structures (HS, MP, LL, CC, DS, MT) and three recovery attacks (Probab, FocusOnKey, Quantization). The authors construct datasets from MQuAKE and Books via an LLM-based pipeline with decomposition and uniqueness filters, evaluate six unlearning methods on three open-weight LLMs, and report three findings: forget quality varies sharply across reasoning structures; unlearned knowledge remains recoverable, with multi-hop queries often easier to recover than single-hop ones; and no method simultaneously achieves high forget quality, robustness, and utility. The paper also releases the benchmark and includes prompts, hyperparameters, and a small human annotation study in the appendices.","tokens_in":18607,"tokens_out":5399,"duration_ms":45523,"significance":"If the quantitative findings hold, the benchmark is a valuable contribution because it operationalizes two conditions—path consistency and recovery robustness—that go beyond single-hop or chain-only unlearning evaluation. The six-type logical taxonomy and the inclusion of lightweight recovery attacks are genuinely useful extensions over prior benchmarks such as MUSE, FaithUn, and GONE. The transparency in reporting full prompts, hyperparameter ranges, and a human-annotated quality check is a clear strength, as is the openness of the benchmark. However, the central recovery and path-consistency claims rest on an LLM-as-a-judge whose deployed prompt contains a string-matching rule that counts hedged or negated answers as correct, and the experiments report single runs without seeds or error bars. These issues make the headline numbers unstable and currently prevent the paper from establishing its findings at the strength claimed.","major_comments":[{"comment":"The recovery judge prompt in Appendix E.2 contains rule 3: \"If the ground-truth answer appears anywhere in the response, judge as CORRECT.\" This rule overrides semantic equivalence and counts negated or hedged responses (e.g., \"I cannot disclose that; the answer is not Europe\") as successful recoveries whenever the answer string is mentioned. Because the same judge computes the accuracy entering FQ (Eq. 1) and the recovery rate RR (Eq. 2), both the forget-quality and recovery-robustness results are affected. In particular, the SH-vs-MH comparisons in Table 3 and hence Finding 2 could be partially or wholly manufactured by the judge if multi-hop responses are more hedged than single-hop ones. Section 8 concedes general LLM-as-a-judge failure modes, but the concrete rule makes the problem testable. The authors should either remove rule 3, add explicit negation/hedging handling, or present a human-validated subset showing that the rule does not change the conclusions.","section":"Appendix E.2, Eq. (1), Eq. (2)"},{"comment":"The recovery-rate metric is ambiguous because S^{suc} is introduced without a definition. It is not stated whether S^{suc} is the set of all forget-set questions, the subset for which direct unlearning succeeded (e.g., direct accuracy equals zero), or some other subset. This matters because conditioning on successful direct unlearning changes the interpretation of 'recovery rate' and therefore the strength of the claims in Section 6.2. The authors must define S^{suc} precisely and state how it is obtained; otherwise Table 3 cannot be interpreted by a reader.","section":"Section 5.4, Eq. (2)"},{"comment":"No seeds, standard deviations, or significance tests are reported anywhere in the main results. Table 8 shows that base multi-hop accuracy is only 60–65% across models, so the relative FQ values in Table 2 are quotients of modest accuracies and can be noisy. Differences such as GA SH 42.4 vs. MH 56.3 in Table 3, or structure-to-structure gaps in Table 2, may reflect seed variance rather than structural properties of unlearning. The authors should run at least three to five seeds, report means and standard deviations, and show that Findings 1 and 2 survive this variance; at minimum, they should report a bootstrap or permutation-based confidence statement.","section":"Tables 2–3 and Appendix F.3"},{"comment":"Hyperparameters are tuned independently for each (method, model) pair 'to achieve meaningful forgetting without catastrophic utility degradation.' This is an acceptable protocol, but the search is not fully reported: the number of configurations tried, the selection criterion, and the exact hyperparameter values per (method, model) are not given in a table. Without this, the cross-method comparisons in Figure 4 and the 'impossible triangle' trade-off (Finding 3) cannot be distinguished from tuning artifacts. The authors should report the full hyperparameter grid and selected values, and ideally perform a sensitivity analysis over at least two reasonable configurations per method.","section":"Appendix D.7 and Section 6.3"}],"minor_comments":[{"comment":"The text in D.6 refers to 'Table 6' for dataset sizes, but the table appearing at that location is numbered Table 4; the cross-reference should be corrected.","section":"Appendix D.6"},{"comment":"The heading 'Communication (CT)' appears to be a typo for 'Commutativity (CT)', since the paragraph discusses commutativity as a structural rearrangement; the label should be fixed.","section":"Appendix C.1"},{"comment":"The bold and underline notation in Table 2 is described only in the body text; the caption should note explicitly that bold marks the most resistant structure and underline the second most resistant.","section":"Table 2"},{"comment":"The paper states that the benchmark is open-sourced at leak-resistant.site, but the references do not include a dataset or code repository entry. The authors should state in the paper what exactly is released (data, code, judge prompts, or all) and under what license.","section":"Abstract and Section 1"}],"recommendation":"major_revision","confidential_remarks":"The FocusOnKey recovery method is drawn from a prior paper by overlapping authors (Zhang et al., 2025a), and the manuscript does not disclose this overlap; the editor may wish to request a statement about the relationship between the two papers. On novelty, the comparison with GONE (Dahal et al., 2026) in Table 1 is fair at a high level, but GONE already covers multi-hop and inverse probes; the distinct contributions here are the six-type logical taxonomy and the recovery-attack dimension, and these should be emphasized more sharply in the revision to avoid the benchmark being seen as an incremental combination of existing ideas."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know. First, the six-type multi-hop unlearning benchmark is a real addition: pairing LogicBench-style reasoning structures with recovery attacks is exactly the kind of stress test unlearning evaluation needs. Second, the headline numbers are not trustworthy yet. The LLM judge used for both forget quality and recovery rate contains a rule that counts any response containing the ground-truth string as correct, even if the model says \"I don't think the answer is Europe\" or hedges. That is a direct route to inflating recovery rates, and the paper's own base-model multi-hop accuracy is only 60-65%, so partial or evasive outputs are not rare.\n\nWhat it does well: the taxonomy is clearly motivated, the data construction pipeline is careful (bridge-entity masking, decomposition consistency filtering, answer uniqueness checks), and the authors include both human and independent-LLM quality checks on the generated questions. The \"impossible triangle\" framing - forget quality, robustness, utility - is a simple way to summarize what every table shows. They also control for category size and compare against prior benchmarks (MQuAKE, FaithUn, Eval-DU, GONE) honestly.\n\nSoft spots, in order of severity. 1) The judge bug. Appendix E.2, rule 3: \"If the ground-truth answer appears anywhere in the response, judge as CORRECT.\" This overrides the semantic-equivalence rule and handles negation poorly. Since both FQ and RR use this judge, the main findings - especially \"multi-hop queries are often easier to recover than single-hop ones\" - may be artifacts. This is fixable, but until re-annotated the numbers are suspect. 2) No error bars or seeds; each (method, model) gets its own hyperparameter tuning, so cross-method comparisons are not apples-to-apples. 3) Internal inconsistency: Table 4 says 50 questions per type for Books (300 total), while D.6 text says 100 per type. 4) The data link is a website, not a repository; no commit hash or license visible. Minor point: FocusOnKey comes from a self-cited paper by overlapping authors; not a flaw, but worth noting.\n\nThe central qualitative pattern - some reasoning structures are far more resistant than others - is likely to survive a re-grade; the recovery-rate comparisons are the fragile part. This paper is for researchers building or using unlearning benchmarks. Send it to peer review, but let the authors know the judge prompt must be fixed and the numbers re-validated. The benchmark idea deserves space; the current tables shouldn't be treated as evidence yet.","headline":"A genuinely useful multi-hop unlearning benchmark with a serious, fixable judge bug that undercuts the recovery-rate headline until re-annotated.","tokens_in":19172,"tokens_out":4290,"would_cite":false,"duration_ms":35526,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Current LLM unlearning methods do not achieve leak-resistant forgetting: knowledge remains reachable through multi-hop reasoning paths and recoverable by lightweight attacks.","keywords":["machine unlearning","LLM unlearning benchmark","multi-hop reasoning","recovery attacks","knowledge leakage","forget quality","utility preservation","path consistency"],"falsifier":"Take the paper's masked multi-hop questions and run them on a model that has the same general knowledge but was never trained on the target facts (a held-out or ablated model). If that model answers correctly at any substantial rate, the questions leak the answer through wording or the automated judge is too lenient; if it scores near zero while unlearned models recover high accuracy, the leakage finding is confirmed. A second check is to have humans grade a random sample of the recovery outputs instead of an LLM judge; recovery rates that collapse under human grading would indicate that the reported robustness failure is partly a measurement artifact.","tokens_in":18140,"feed_emoji":"🧠","tokens_out":11667,"duration_ms":87169,"temperature":0.7,"pith_summary":"This paper proposes a benchmark, Leak-resistant Unlearning, for deciding whether an LLM has really forgotten targeted knowledge. It defines forgetting by two conditions: path consistency, meaning the knowledge cannot be reached through any of six logic-inspired multi-hop question shapes, and recovery robustness, meaning the knowledge cannot be restored by lightweight post-unlearning attacks. On three models, six unlearning methods, and two datasets (world-knowledge questions from MQuAKE and fictional knowledge from the Harry Potter books), the benchmark finds that every tested method leaks under at least one reasoning path and that recovery attacks restore substantial accuracy. In several settings, multi-hop questions are easier to recover than single-hop ones, so low accuracy on direct questions does not indicate erasure. The paper also documents a three-way trade-off: no method simultaneously achieves high forget quality, high recovery robustness, and preserved reasoning ability.","feed_headline":"Unlearned knowledge survives multi-hop probing and recovery attacks","feed_subtitle":"Multi-hop reasoning and three lightweight attacks restore what unlearning supposedly erased.","key_machinery":"The load-bearing object is the benchmark's three-part machinery. First, a logic-inspired taxonomy formalizes multi-hop access as six inference shapes — Hypothetical Syllogism (chained relations), Modus Ponens (applying a rule to an instance), Leibniz's Law (transferring properties across equivalent names), Conjunctive Composition (intersecting shared attributes), Disjunctive Syllogism (eliminating candidates), and Modus Tollens (inferring from a negated consequence) — each paired with a matcher that composes single-hop triples by object–subject chaining, alias identity, shared properties, or candidate sets. The key constraint is that the target fact stays implicit: the generation prompt masks the bridge entity and forbids mentioning the forgotten fact, so any correct answer must come from internalized knowledge. Second, three recovery attacks (Probab, FocusOnKey, Quantization) simulate post-unlearning attempts to restore what was erased. Third, relative metrics — Forget Quality, Recovery Rate, and Reasoning Ability on Big Bench Hard — turn the framework into numbers that are comparable across models.","core_discovery":"The paper's central claim is that unlearning is not leak-resistant in current LLMs: knowledge that appears removed under direct or chain-style questioning remains accessible through alternative relational paths and can be elicited by the recovery attacks Probab (decoding by sampling), FocusOnKey (repeating key tokens), and Quantization (applying low-bit weight quantization). Using six logic-inspired reasoning structures — Hypothetical Syllogism, Modus Ponens, Leibniz's Law, Conjunctive Composition, Disjunctive Syllogism, and Modus Tollens — the authors find that forgetting quality varies sharply across structures, with certain structures (for example DS for parameter-updating methods and MT/MP for token-specific methods) much more resistant to suppression. After unlearning, recovery rates are substantially above zero, and multi-hop questions are often recovered more easily than single-hop ones. The authors conclude that current methods mainly suppress surface retrieval paths while leaving the underlying relational knowledge networks intact, and they report an empirical trade-off among forget quality, recovery robustness, and utility: no tested method approaches all three simultaneously.","pith_inferences":["If the benchmark's conclusions hold, 'unlearning' in regulatory settings should be treated as suppression that can fail, not guaranteed erasure; audits would need to probe multi-hop and recovery paths as well as direct questions.","The observed trade-off could be formalized as a genuine impossibility triangle, perhaps a capacity or information-theoretic bound, though the paper does not attempt such a proof.","A cross-lingual version of the benchmark might show even higher leakage, since the paper leaves non-English queries untested and notes that models transfer knowledge across languages.","An attack-only evaluation on black-box APIs using Probab and FocusOnKey, which need no weight access, would show whether the reported open-weight vulnerabilities generalize."],"forward_implications":["A model that scores low on direct single-hop questions can still be leaking knowledge: multi-hop paths and recovery attacks expose information that static single-hop benchmarks miss.","Unlearning methods that work by suppressing surface answer paths will look successful on narrow tests but leave relational knowledge networks intact, so recovered knowledge is often higher for multi-hop than single-hop queries.","Recovery attacks that require no extra knowledge — sampling instead of greedy decoding, repeating key tokens, or quantizing weights — are enough to restore substantial accuracy, so deletion claims based on a single decoding scheme are unsafe.","Choosing an unlearning method means accepting a trade-off: methods with high forget quality can collapse reasoning ability, while utility-preserving methods fail to forget or resist recovery.","Benchmarking should report the joint triangle of forget quality, recovery robustness, and utility, since single-metric rankings can be misleading."],"supporting_citations":[{"why":"Supplies the logical taxonomy from which the six reasoning structures are adapted.","marker":"(Parmar et al., 2024)"},{"why":"Source of the world-knowledge triple pairs used to build the MQuAKE benchmark.","marker":"(Zhong et al., 2023)"},{"why":"Source of the Harry Potter fictional-knowledge data and a prior single-hop unlearning benchmark.","marker":"(Shi et al., 2024)"},{"why":"Defines the Probab recovery attack, one of the three post-unlearning attacks the benchmark uses.","marker":"(Scholten et al., 2025)"},{"why":"Defines the FocusOnKey recovery attack, which repeats key tokens to restore unlearned knowledge.","marker":"(Zhang et al., 2025a)"},{"why":"Defines the Quantization recovery attack, which restores knowledge through low-bit weight quantization.","marker":"(Zhang et al., 2025b)"},{"why":"Defines the Big Bench Hard tasks used to measure reasoning utility in the trade-off analysis.","marker":"(Suzgun et al., 2023)"},{"why":"Gradient Ascent, one of the six unlearning methods benchmarked.","marker":"(Jang et al., 2023)"},{"why":"Negative Preference Optimization, one of the six unlearning methods benchmarked.","marker":"(Zhang et al., 2024)"}],"fun_headline_variants":["Multi-hop reasoning exposes unlearned facts","Probing and attacks reveal unlearning gaps","Unlearning leaks through reasoning paths","Recovery attacks break supposedly erased knowledge"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The benchmark's results assume that the language-model-generated multi-hop questions and the automated judge model that grades them measure hidden knowledge rather than surface wording or grading leniency; the paper's own limitations section concedes that these LLM-driven steps may introduce noise, shortcuts, or bias.","fun_headline_variants_meta":{"raw":{"variants":["Multi-hop reasoning exposes unlearned facts","Probing and attacks reveal unlearning gaps","Unlearning leaks through reasoning paths","Recovery attacks break supposedly erased knowledge"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000186,"raw_usage":{"total_tokens":1316,"prompt_tokens":926,"completion_tokens":390,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":542,"completion_tokens_details":{"reasoning_tokens":337}},"tokens_in":542,"tokens_out":390,"duration_ms":3822,"temperature":1.0,"reasoning_tokens":337,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:37:39.176848+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the paper's masked multi-hop questions and run them on a model that has the same general knowledge but was never trained on the target facts (a held-out or ablated model). If that model answers correctly at any substantial rate, the questions leak the answer through wording or the automated judge is too lenient; if it scores near zero while unlearned models recover high accuracy, the leakage finding is confirmed. A second check is to have humans grade a random sample of the recovery outputs instead of an LLM judge; recovery rates that collapse under human grading would indicate that the reported robustness failure is partly a measurement artifact.","supporting_citations":[],"review_version":2}