Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detection

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read GUARD claims that LLM unlearning can be moved entirely to generation time: a prompt classifier, a retrieval step, and token-level penalties suppress forgotten content during beam search, while the model's weights and general capabilities…

desk verdict A genuinely new inference-time filtering mechanism with a load-bearing dependence on perfect detection and retrieval, and text that overclaims forget quality on TOFU 5%/10%. read the letter →

arxiv 2505.13312 v1 pith:5UBQMKBR submitted 2025-05-19 cs.CL

Zhijie Deng , Chris Yuhao Liu , Zirui Pang , Xinlei He , Lei Feng , Qi Xuan , Zhaowei Zhu , Jiaheng Wei This is my paper · ORCID
classification cs.CL
keywords LLMunlearninggeneration-timeinference-timecontrolbeamsearchfilteringsemanticmatchingpromptclassificationrighttobeforgottencopyright
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Generative unlearning usually means fine-tuning the model to unlearn, which risks degrading everything else; this paper tries to establish that forgetting can instead be enforced at generation time. GUARD detects prompts that concern the forget target, retrieves the original answer that must no longer be spoken, and during beam search penalizes or prunes any candidate tokens that match the forbidden phrases, either exactly or by semantic similarity. Because the weights are never modified, the model's general behavior is preserved exactly: in the paper's tables, model utility and retain-set ROUGE-L equal the original model's values, while forget-quality scores improve to the strongest among the compared methods. If the claim holds, an LLM could honor deletion requests and copyright restrictions without retraining, swapping a gradient update for an inference-time gate.

What carries the argument

The load-bearing device is the penalty-augmented beam search: at each decoding step the total penalty $P_{\text{total}} = P_{\text{token}} + P_{\text{SBERT}}$ is added to the negative log-likelihood to form each candidate's cost, and any candidate with infinite penalty is pruned. The hard matcher uses a trie—a tree structure for fast suffix matching—of forbidden sequences and prunes on any suffix match of length at least $\beta=1$; the soft matcher uses SBERT (Sentence-BERT, a sentence-embedding model) to compute the cosine similarity between the last generated word and each forbidden-token embedding, pruning above the threshold $\delta=0.5$. A simple MLP over averaged penultimate-layer hidden states gates whether the whole mechanism engages. Together, these parts are what distinguish GUARD from a mere output filter: the suppression acts on candidates during decoding rather than on finished text.

What would settle it

Take a forget-set question, paraphrase it into one of the forms the paper's own classifier is shown to miss (paraphrase, adversarial, or irrelevant-context), and run the full GUARD pipeline: if the model reproduces the original answer verbatim in any such case, the unlearning guarantee fails at the detection gate rather than at the generation penalties. A second check targets the retrieval stage, whose top-1 accuracy is 90–97% in the appendix: when retrieval returns the wrong answer, the wrong phrases are blocked and the correct forbidden content can leak through.

Watch

Extended reading notes

Core claim

On the paper's own terms, GUARD's discovery is that a fixed, fully trained LLM can be made to approximate the behavior of a retrained model on the forget set by intervening in the output space only. For each query the pipeline computes $h(x;\theta_u) = \mathrm{Unlearn}(h(x;\theta_o))$: a lightweight MLP classifies whether the prompt belongs to the forget target; if it does, the most semantically similar question-answer pair is retrieved from the forget data and key phrases of the original answer are extracted as forbidden tokens; and during generation, a beam search augmented with token-level hard matching (trie suffix matching) and SBERT-based soft semantic matching assigns penalties, with infinite penalties pruning any candidate that resembles the forbidden content. The result is that the model produces fluent, alternative completions—"The father of Hsiao Yun-Hwa is unemployed" instead of "…is a civil engineer"—while its behavior on all other inputs is untouched. The paper reports the best forget quality among the compared methods on TOFU 1%/5%/10%, MUSE-News, and the Harry Potter copyright task, with model utility (MU), retain-set ROUGE-L, perplexity, and nine-benchmark zero-shot accuracy identical to the original model's, and it states its own main weakness: the privacy-leakage score on MUSE remains high (109.6), comparable to several baselines, which the paper attributes in part to measurement caveats.

Load-bearing premise

The guard only engages when the prompt classifier decides that the query touches the forgotten material: the paper's own appendix reports false-negative rates up to 4% on paraphrased, adversarial, and irrelevant-context prompts, and any query the classifier misses is answered with the forgotten content fully available, since the model's weights were never changed.

Editorial extensions

If this is right

  • Unlearning becomes a deployment-time decision: the same checkpoint serves both "forget" and "retain" regimes, and updating the forbidden-token trie updates what is forgotten, with no retraining.
  • Because no parameters change, utility metrics (MU, R-RL, perplexity, and nine-benchmark zero-shot accuracy) are preserved at the original model's level, eliminating catastrophic forgetting as a failure mode of unlearning.
  • The two matching mechanisms are complementary: ablations on TOFU 1% show that removing either the trie hard matching or the SBERT soft matching drops forget quality from 0.1649 to 0.0541 or 0.0030 respectively.
  • The same three-step pipeline transfers across three task shapes—entity QA (TOFU), news memorization (MUSE-News), and book-copyright continuation (Harry Potter)—with only classifier training specific to each task.
  • The paper's reported trade-off means a provider could serve one model to all users and still satisfy targeted takedown or deletion requests by changing the guard data, not the model.
  • editorial placeholder

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because GUARD prunes tokens without changing the underlying likelihoods, membership-inference signals on the forget data remain intact; a hybrid that also flattens logits or reweights probabilities on forget-triggered prompts could address the privacy-leakage weakness the paper reports on MUSE.
  • The pipeline is black-box friendly: it only needs decode-time token probabilities and embeddings, so it could sit on top of a hosted model, and the forbidden-token list could be updated live as new takedown or deletion requests arrive.
  • A testable extension is to replace the binary classifier gate with a confidence-weighted penalty—scaling the soft penalty by classifier uncertainty—which would soften the failure mode where a misclassified prompt receives no guarding at all.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces GUARD, a training-free, generation-time unlearning framework for LLMs. Instead of fine-tuning, GUARD (i) trains a lightweight MLP prompt classifier to detect whether an input belongs to a forget target, (ii) retrieves the most semantically similar QA pair from the forget set and extracts forbidden phrases from its answer, and (iii) at generation time applies a token-level trie hard match plus an SBERT-based soft semantic match to penalize or prune beam-search candidates that would produce those phrases. Experiments are reported on TOFU (1%, 5%, 10%), MUSE-News, and Harry Potter, with Llama2-7B, Phi-1.5B, OPT-2.7B, and several instruction-tuned models. The central claims are that GUARD achieves strong forget quality across these tasks while causing almost no utility degradation because no parameters are updated.

Significance. If validated, GUARD would be an appealing complement to fine-tuning-based unlearning: it is modular, does not require re-training, and avoids catastrophic forgetting by construction. The paper's strengths include a concrete three-component architecture, ablations of the two matching mechanisms (Table 5) and of forbidden-token extraction strategies (Table 4), and a useful appendix reporting prompt-classifier and retrieval diagnostics. The method is falsifiable and reproducible in principle. However, the significance hinges on an end-to-end leakage-prevention claim that depends on perfect prompt detection and answer retrieval, and the paper's own appendix numbers show those front-end components are not perfect. In addition, the utility-preservation claim is largely definitional because no parameter updates are made, while the 5%/10% TOFU results contradict the paper's 'excellent forget quality' wording. These issues are fixable but currently limit the strength of the contribution.

major comments (4)
  1. [§5.2, Tables 9 and 10] The text states that GUARD 'consistently demonstrates excellent forget quality' on the 5% and 10% TOFU splits, but the reported FQ values are effectively zero: Table 9 reports 1.8266e-05 for Llama2-7B 5%, and Table 10 reports 5.7346e-07 for Llama2-7B 10%, with values of 0.0014 and 0.0023 for Phi-1.5B. These are far from the retained model's FQ of 1.0 and are orders of magnitude below, e.g., NPO-RT's 0.1779 on the 5% split. The broad claim of strong forget quality across tasks and splits is therefore not supported by the paper's own tables. This is load-bearing because the abstract and conclusion generalize from the 1% success to all settings; please either correct the claim or analyze why the guard degrades as the forget set grows.
  2. [§4.2–4.3, Appendix B and C] The leakage-prevention guarantee is conditional on front-end perfection: the prompt classifier must flag every forget-related input and retrieval must return the corresponding original answer. The paper's own Appendix B (Table 7a) reports FNRs up to 0.0429 (TOFU 10%, adversarial) and 0.0400 (TOFU 5%, irrelevant context), and Appendix C (Table 8) reports SBERT top-1 retrieval accuracy as low as 0.9070 (TOFU 10%), rising only to 0.9637 with reranking. Because Eq. (2) leaves model parameters unchanged, any missed or mismatched prompt means the original model can emit the forgotten content verbatim; Table 13 shows that without guard activation the underlying Llama2-7B indeed produces the exact original answers. The claim in the abstract that GUARD 'effectively prevent[s] the model from leaking the forgotten content' is thus an end-to-end claim that the reported front-end numbers disprove. Please report an end-to-end leakage rate over the test set, including classifier misses and retrieval mismatches, and condition the paper's claims on the measured component accuracies.
  3. [§3.3, Tables 1, 3, 9, 10] Because GUARD performs no parameter update, the utility metrics MU, R-RL, PPL, and Avg. Acc. are definitionally equal to those of the original model whenever the guard does not fire; Table 1 shows exact equality (e.g., MU 0.6239 and R-RL 0.9818 for Llama2-7B). The paper presents this as 'the best trade-off' and 'no degradation,' but this is a direct consequence of the method's design, not an empirical demonstration of a favorable forget-utility trade-off. The method's real utility question is what happens when the guard does fire: e.g., false positives on benign prompts, or degraded fluency when long forbidden spans are suppressed. Please reframe the utility claims as definitional and provide a quantitative measure of utility conditional on guard activation, including false-positive behavior on retain and general prompts.
  4. [§5.2–5.4 and Tables 1–12] All reported results appear to come from a single run, with no error bars, multiple seeds, or significance tests. This matters particularly for FQ, which is a KS-test p-value, and for the component-wise results in Tables 7–8, where classifier training, ChatGPT-based forbidden-token extraction, and retrieval are all stochastic. Without repeated runs, comparisons such as the ablation in Table 5 (FQ 0.1649 vs. 0.0541 vs. 0.0030) or the hyperparameter sweep in Table 12 may reflect noise rather than real differences. Please provide multiple seeds and variance for at least the main TOFU results and the key ablations, or state clearly that single-seed results should be interpreted as preliminary.
minor comments (5)
  1. [§B.2 vs. §4.2] Appendix B.2 says 'we use OPT-2.7B for extracting embeddings,' while §4.2 says the frozen LLM 'will later be unlearned'; since the evaluation base models include Llama2-7B and Phi-1.5B, please clarify whether the classifier trained on OPT embeddings is applied to the hidden states of the actual base model or to OPT embeddings computed at test time.
  2. [Appendix F.3] ARC-Challenge and ARC-Easy are cited to reference [12] (Chollet), but the ARC dataset should be cited to its own paper; please correct the reference.
  3. [Eq. (8)] With the hard-match threshold set to β=1, the piecewise definition is confusing: a one-token match both 'fully matches' a forbidden sequence and satisfies 'L_match < β' is false; the text clarifies that any nonzero match is pruned, but the equation should be rewritten to state that every match with L_match ≥ 1 receives the infinite penalty.
  4. [Throughout] The phrase 'forbidden token' is used where a set of tokens is meant; please use 'forbidden tokens' or 'forbidden phrases' consistently.
  5. [Table 13] The escaped Unicode sequences such as '\u0409' appear literally in the generation examples; please render or explain these characters so the reader can interpret the failure modes.

Circularity Check

2 steps flagged · score 6.0 of 10

GUARD's forget-set results are largely self-definitional: the filter is constructed from the exact original answers used in F-RL/VerbMem/KnowMem/FQ Gap, and its utility preservation follows from the no-parameter-update design.

  1. self definitional [Sec. 4.3 (Eqs. 5-9), Fig. 1 Step 2, and metric definitions App. F.1/F.2]
    "In Step 2, we retrieve the original answer from the forget data Df and extract the forbidden token, which consists of key phrases that should no longer appear in model outputs... Once the most relevant answer A∗ is retrieved, we proceed to extract its sensitive textual fragments... These fragments serve as the target content to be blocked in the subsequent generation stage."

    The forget-set metrics are computed against the same original answers used to build the blocklist: F-RL is ROUGE-L between generated outputs and the ground-truth forget answers; MUSE VerbMem/KnowMem score ROUGE against the original continuation/answers; HP FQ Gap is BLEU/ROUGE against the same book chunks in Df. Eq. 5 retrieves A∗ from Df, Eq. 6 extracts F(A∗) from A∗, and Eqs. 8-9 give infinite penalty to any beam candidate matching F(A∗). Suppressing the exact measured text therefore forces F-RL/VerbMem/KnowMem/FQ Gap toward the desired values by construction. This is enforcement using the evaluation target, not a prediction that generalizes beyond it.

  2. self definitional [Sec. 3.3 Eq. (2); Sec. 4.1; Sec. 5.2 'GUARD achieves the best trade-off']
    "The design of GUARD does not touch on updates of model parameters, ensuring the fluency of the generated language after unlearning, and maintaining performance as close as possible to that of the retained model... GUARD causes no degradation in utility... GUARD retains the same MU as the original model."

    Eq. 2 defines the unlearned model purely as an output-space perturbation h(x; θu)=Unlearn(h(x; θo)) with no parameter update. On retain and general-utility prompts that do not trigger the forget classifier, generation is identical to the original model, so MU, R-RL, KnowMem(Dr), PPL, and zero-shot accuracy are identical by construction. Reporting these unchanged numbers as the paper's key trade-off result is a restatement of the method's definition rather than an independent empirical finding.

full rationale

The main forget-quality evidence reduces by construction: GUARD's blocklist is extracted from the very Df answers that F-RL, VerbMem, KnowMem, and HP FQ Gap measure against. A beam candidate matching the extracted forbidden tokens is pruned (Eqs. 8-9), so low scores on those metrics are enforced rather than predicted. The utility claim is likewise a tautology of the no-parameter-update design: if no parameters change, retain-set metrics on non-triggering prompts must equal the original model's. I do not find a load-bearing self-citation chain: references to the authors' FLAT/ECO work are used for baseline setups and evaluation protocols, not to justify the inference-time mechanism. The classifier/retrieval failure rates in Appendix B/C are a real correctness/robustness concern, but they are not circularity; they are an engineering limitation. The KS-test-based FQ metric is less obviously forced than the ROUGE/BLEU-based metrics, which is why the circularity is partial rather than total. Overall score 6: several advertised results are true by construction even though the framework has independent components (classifier, SBERT matching) that could in principle fail.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The method is a retrieval-and-filter system: it needs the original answers, a trained classifier, and hand-set thresholds. These are the load-bearing premises that are not derived within the paper.

free parameters (5)
  • beam width b = 7
    Chosen in Appendix G ablation; larger beam improves FQ, 7 gives best trade-off.
  • hard matching threshold beta = 1
    Set to 1 so any nonzero token match triggers infinite penalty; fixed, not fitted.
  • SBERT similarity threshold delta = 0.5
    Set as default; ablation shows delta=0.7 hurts FQ, delta=0.3 improves F-RL but FQ same.
  • alpha_token
    Soft penalty coefficient in Eq. 8 never assigned a value; the branch is dead when beta=1.
  • alpha_sbert
    Soft penalty coefficient in Eq. 9 never assigned a value; affects all sub-threshold semantic matches.
assumptions (5)
  • domain assumption The forget set Df and its original answers are available at inference time for retrieval and forbidden token extraction.
    The method requires the exact data to be forgotten, section 4.3.
  • ad hoc to paper The prompt classifier has near-zero false negatives on all deployment-time inputs.
    Classifiers show FNR up to 4% on adversarial/irrelevant prompts (Appendix B Table 7); misclassification fully bypasses the guard.
  • ad hoc to paper SBERT cosine similarity at threshold 0.5 separates forbidden content from benign paraphrases.
    Eq. 9; threshold is a hand-set hyperparameter, not derived.
  • domain assumption Beam search (width 7) is the decoding algorithm used at deployment.
    The method is defined over beam search steps; sampling or greedy decoding are not handled.
  • domain assumption The retained model is the correct gold standard for forgetting behavior.
    FQ and FQ Gap compare against the retained model; this is standard in the benchmarks but an assumption about what 'forgotten' means.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detection." pith.science (2026). https://pith.science/paper/5UBQMKBR

@misc{pith2026250513312,
  author       = {Pith},
  title        = {Pith review of: GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5UBQMKBR}},
  note         = {Machine review of arXiv:2505.13312}
}
read the original abstract

Large Language Models (LLMs) have demonstrated strong capabilities in memorizing vast amounts of knowledge across diverse domains. However, the ability to selectively forget specific knowledge is critical for ensuring the safety and compliance of deployed models. Existing unlearning efforts typically fine-tune the model with resources such as forget data, retain data, and a calibration model. These additional gradient steps blur the decision boundary between forget and retain knowledge, making unlearning often at the expense of overall performance. To avoid the negative impact of fine-tuning, it would be better to unlearn solely at inference time by safely guarding the model against generating responses related to the forget target, without destroying the fluency of text generation. In this work, we propose Generation-time Unlearning via Adaptive Restriction and Detection (GUARD), a framework that enables dynamic unlearning during LLM generation. Specifically, we first employ a prompt classifier to detect unlearning targets and extract the corresponding forbidden token. We then dynamically penalize and filter candidate tokens during generation using a combination of token matching and semantic matching, effectively preventing the model from leaking the forgotten content. Experimental results on copyright content unlearning tasks over the Harry Potter dataset and the MUSE benchmark, as well as entity unlearning tasks on the TOFU dataset, demonstrate that GUARD achieves strong forget quality across various tasks while causing almost no degradation to the LLM's general capabilities, striking an excellent trade-off between forgetting and utility.

Figures

Figures reproduced from arXiv: 2505.13312 by the authors.

Figure 1
Figure 1. Overview of GUARD: In Step 1, we use an MLP to determine whether the prompt belongs to the forget target; In Step 2, we retrieve the original answer from the forget data Df and extract the forbidden token, which consists of key phrases that should no longer appear in model outputs; In Step 3, we perform unlearning by dynamically suppressing target tokens during generation using token-level hard matching and SBERT-ba… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Measure, Don't Optimize: Forecasting Recovery in LLM Unlearning

    cs.CL 2026-08 conditional novelty 7.0 of 10

    A Jacobian-lens audit predicts model-level relearning recovery in LLM unlearning but cannot pick which facts return and backfires when used as a training penalty.

  2. SoK: Machine Unlearning for Large Language Models

    cs.LG 2025-06 conditional novelty 5.0 of 10

    A new taxonomy for LLM unlearning distinguishes removal-intended from suppression-intended methods, and argues that gradient ascent methods functionally behave like suppression.

Reference graph

Works this paper leans on

110 extracted references · 6 canonical work pages · cited by 2 Pith papers

  1. [1]

    Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  2. [2]

    Harnessing Business and Media Insights with Large Language Models

    Yujia Bao, Ankit Parag Shah, Neeru Narang, Jonathan Rivers, Rajeev Maksey, Lan Guan, Louise N Barrere, Shelley Evenson, Rahul Basole, Connie Miao, et al. Harnessing business and media insights with large language models.arXiv preprint arXiv:2406.06559, 2024

    work page Pith review arXiv 2024

  3. [3]

    Open problems in machine unlearning for ai safety.arXiv preprint arXiv:2501.04952, 2025

    Fazl Barez, Tingchen Fu, Ameya Prabhu, Stephen Casper, Amartya Sanyal, Adel Bibi, Aidan O’Gara, Robert Kirk, Ben Bucknall, Tim Fist, et al. Open problems in machine unlearning for ai safety.arXiv preprint arXiv:2501.04952, 2025

    arXiv 2025

  4. [4]

    Soft prompting for unlearning in large language models.arXiv preprint arXiv:2406.12038, 2024

    Karuna Bhaila, Minh-Hao Van, and Xintao Wu. Soft prompting for unlearning in large language models.arXiv preprint arXiv:2406.12038, 2024

    arXiv 2024

  5. [5]

    Piqa: Reasoning about physical commonsense in natural language

    Yonatan Bisk, Rowan Zellers, Jianfeng Gao, Yejin Choi, et al. Piqa: Reasoning about physical commonsense in natural language. InProceedings of the AAAI conference on artificial intelligence, volume 34, pages 7432–7439, 2020

    2020

  6. [6]

    Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot

    Lucas Bourtoule, Varun Chandrasekaran, Christopher A. Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning, 2020

    2020

  7. [7]

    Towards making systems forget with machine unlearning

    Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE symposium on security and privacy, pages 463–480. IEEE, 2015

    2015

  8. [8]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In30th USENIX security symposium (USENIX Security 21), pages 2633–2650, 2021

    2021

Show all 110 references
  1. [9]

    Towards robust and cost- efficient knowledge unlearning for large language models.arXiv preprint arXiv:2408.06621, 2024

    Sungmin Cha, Sungjun Cho, Dasol Hwang, and Moontae Lee. Towards robust and cost- efficient knowledge unlearning for large language models.arXiv preprint arXiv:2408.06621, 2024

    2024 arXiv

  2. [10]

    Unlearn what you want to forget: Efficient unlearning for llms

    Jiaao Chen and Diyi Yang. Unlearn what you want to forget: Efficient unlearning for llms. arXiv preprint arXiv:2310.20150, 2023

    2023 arXiv

  3. [11]

    Safeeraser: Enhancing safety in multimodal large language models through multimodal machine unlearning.arXiv preprint arXiv:2502.12520, 2025

    Junkai Chen, Zhijie Deng, Kening Zheng, Yibo Yan, Shuliang Liu, PeiJun Wu, Peijie Jiang, Jia Liu, and Xuming Hu. Safeeraser: Enhancing safety in multimodal large language models through multimodal machine unlearning.arXiv preprint arXiv:2502.12520, 2025

    2025

  4. [12]

    On the measure of intelligence.arXiv preprint arXiv:1911.01547, 2019

    François Chollet. On the measure of intelligence.arXiv preprint arXiv:1911.01547, 2019

    1911 arXiv

  5. [13]

    How to protect copyright data in optimization of large language models? InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 17871–17879, 2024

    Timothy Chu, Zhao Song, and Chiwun Yang. How to protect copyright data in optimization of large language models? InProceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 17871–17879, 2024

    2024

  6. [14]

    Ai safety in generative ai large language models: A survey.arXiv preprint arXiv:2407.18369, 2024

    Jaymari Chua, Yun Li, Shiyi Yang, Chen Wang, and Lina Yao. Ai safety in generative ai large language models: A survey.arXiv preprint arXiv:2407.18369, 2024

    2024 arXiv

  7. [15]

    Boolq: Exploring the surprising difficulty of natural yes/no questions

    Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. Boolq: Exploring the surprising difficulty of natural yes/no questions. arXiv preprint arXiv:1905.10044, 2019

    1905 arXiv

  8. [16]

    The pascal recognising textual entailment challenge

    Ido Dagan, Oren Glickman, and Bernardo Magnini. The pascal recognising textual entailment challenge. InMachine learning challenges workshop, pages 177–190. Springer, 2005

    2005

  9. [17]

    Security and privacy challenges of large language models: A survey.ACM Computing Surveys, 57(6):1–39, 2025

    Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. Security and privacy challenges of large language models: A survey.ACM Computing Surveys, 57(6):1–39, 2025

    2025

  10. [18]

    Adversarial machine unlearning

    Zonglin Di, Sixie Yu, Yevgeniy V orobeychik, and Yang Liu. Adversarial machine unlearning. arXiv preprint arXiv:2406.07687, 2024. 10

    2024 arXiv

  11. [19]

    Label smoothing improves machine unlearning.arXiv preprint arXiv:2406.07698, 2024

    Zonglin Di, Zhaowei Zhu, Jinghan Jia, Jiancheng Liu, Zafar Takhirov, Bo Jiang, Yuanshun Yao, Sijia Liu, and Yang Liu. Label smoothing improves machine unlearning.arXiv preprint arXiv:2406.07698, 2024

    2024 arXiv

  12. [20]

    Unified parameter-efficient unlearning for llms.arXiv preprint arXiv:2412.00383, 2024

    Chenlu Ding, Jiancan Wu, Yancheng Yuan, Jinda Lu, Kai Zhang, Alex Su, Xiang Wang, and Xi- angnan He. Unified parameter-efficient unlearning for llms.arXiv preprint arXiv:2412.00383, 2024

    2024 arXiv

  13. [21]

    Does unlearning truly unlearn? a black box evaluation of llm unlearning methods.arXiv preprint arXiv:2411.12103, 2024

    Jai Doshi and Asa Cooper Stickland. Does unlearning truly unlearn? a black box evaluation of llm unlearning methods.arXiv preprint arXiv:2411.12103, 2024

    2024 arXiv

  14. [22]

    Do membership inference attacks work on large language models?arXiv preprint arXiv:2402.07841, 2024

    Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettle- moyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models?arXiv preprint arXiv:2402.07841, 2024

    2024 arXiv

  15. [23]

    Who’s harry potter? approximate unlearning in llms

    Ronen Eldan and Mark Russinovich. Who’s harry potter? approximate unlearning in llms. arXiv preprint arXiv:2310.02238, 2023

    2023 arXiv

  16. [24]

    Kto: Model alignment as prospect theoretic optimization.arXiv preprint arXiv:2402.01306, 2024

    Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela. Kto: Model alignment as prospect theoretic optimization.arXiv preprint arXiv:2402.01306, 2024

    2024 arXiv

  17. [25]

    General data protection regulation (gdpr)

    European Union. General data protection regulation (gdpr). https://gdpr-info.eu/, 2016

    2016

  18. [26]

    Towards llm unlearning resilient to relearning attacks: A sharpness-aware minimization perspective and beyond.arXiv preprint arXiv:2502.05374, 2025

    Chongyu Fan, Jinghan Jia, Yihua Zhang, Anil Ramakrishna, Mingyi Hong, and Sijia Liu. Towards llm unlearning resilient to relearning attacks: A sharpness-aware minimization perspective and beyond.arXiv preprint arXiv:2502.05374, 2025

    2025 arXiv

  19. [27]

    Challenging forgets: Unveiling the worst-case forget sets in machine unlearning

    Chongyu Fan, Jiancheng Liu, Alfred Hero, and Sijia Liu. Challenging forgets: Unveiling the worst-case forget sets in machine unlearning. InEuropean Conference on Computer Vision, pages 278–297. Springer, 2024

    2024

  20. [28]

    Simplicity prevails: Rethinking negative preference optimization for llm unlearning.arXiv preprint arXiv:2410.07163, 2024

    Chongyu Fan, Jiancheng Liu, Licong Lin, Jinghan Jia, Ruiqi Zhang, Song Mei, and Sijia Liu. Simplicity prevails: Rethinking negative preference optimization for llm unlearning.arXiv preprint arXiv:2410.07163, 2024

    2024

  21. [29]

    Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508, 2023

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation.arXiv preprint arXiv:2310.12508, 2023

    arXiv

  22. [30]

    Practical unlearning for large language models.arXiv preprint arXiv:2407.10223, 2024

    Chongyang Gao, Lixu Wang, Chenkai Weng, Xiao Wang, and Qi Zhu. Practical unlearning for large language models.arXiv preprint arXiv:2407.10223, 2024

    2024 arXiv

  23. [31]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  24. [32]

    The times sues openai and microsoft over ai use of copyrighted work.The New York Times, 27, 2023

    Michael M Grynbaum and Ryan Mac. The times sues openai and microsoft over ai use of copyrighted work.The New York Times, 27, 2023

    2023

  25. [33]

    Meow: Memory supervised llm unlearning via inverted facts.arXiv preprint arXiv:2409.11844, 2024

    Tianle Gu, Kexin Huang, Ruilin Luo, Yuanqi Yao, Yujiu Yang, Yan Teng, and Yingchun Wang. Meow: Memory supervised llm unlearning via inverted facts.arXiv preprint arXiv:2409.11844, 2024

    2024 arXiv

  26. [34]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948, 2025

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12948, 2025

    2025 arXiv

  27. [35]

    news-please - a generic news crawler and extractor

    Felix Hamborg, Norman Meuschke, Corinna Breitinger, and Bela Gipp. news-please - a generic news crawler and extractor. InIntelligence and Security Informatics, 2017

    2017

  28. [36]

    Risk and response in large language models: Evaluating key threat categories.arXiv preprint arXiv:2403.14988, 2024

    Bahareh Harandizadeh, Abel Salinas, and Fred Morstatter. Risk and response in large language models: Evaluating key threat categories.arXiv preprint arXiv:2403.14988, 2024. 11

    2024 arXiv

  29. [37]

    Mmunlearner: Reformulating multimodal machine unlearning in the era of multimodal large language models.arXiv preprint arXiv:2502.11051, 2025

    Jiahao Huo, Yibo Yan, Xu Zheng, Yuanhuiyi Lyu, Xin Zou, Zhihua Wei, and Xuming Hu. Mmunlearner: Reformulating multimodal machine unlearning in the era of multimodal large language models.arXiv preprint arXiv:2502.11051, 2025

    2025 arXiv

  30. [38]

    Editing models with task arithmetic.arXiv preprint arXiv:2212.04089, 2022

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic.arXiv preprint arXiv:2212.04089, 2022

    2022 arXiv

  31. [39]

    Knowledge unlearning for mitigating privacy risks in language models

    Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504, 2022

    2022 arXiv

  32. [40]

    Reversing the forget-retain objectives: An efficient llm unlearning framework from logit difference.Advances in Neural Information Processing Systems, 37:12581–12611, 2024

    Jiabao Ji, Yujian Liu, Yang Zhang, Gaowen Liu, Ramana Kompella, Sijia Liu, and Shiyu Chang. Reversing the forget-retain objectives: An efficient llm unlearning framework from logit difference.Advances in Neural Information Processing Systems, 37:12581–12611, 2024

    2024

  33. [41]

    Model sparsity can simplify machine unlearning.Advances in Neural Information Processing Systems, 36:51584–51605, 2023

    Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity can simplify machine unlearning.Advances in Neural Information Processing Systems, 36:51584–51605, 2023

    2023

  34. [42]

    Wagle: Strategic weight attribution for effective and modular unlearning in large language models.arXiv preprint arXiv:2410.17509, 2024

    Jinghan Jia, Jiancheng Liu, Yihua Zhang, Parikshit Ram, Nathalie Baracaldo, and Sijia Liu. Wagle: Strategic weight attribution for effective and modular unlearning in large language models.arXiv preprint arXiv:2410.17509, 2024

    arXiv

  35. [43]

    Soul: Unlocking the power of second-order optimization for llm unlearning.arXiv preprint arXiv:2404.18239, 2024

    Jinghan Jia, Yihua Zhang, Yimeng Zhang, Jiancheng Liu, Bharat Runwal, James Diffenderfer, Bhavya Kailkhura, and Sijia Liu. Soul: Unlocking the power of second-order optimization for llm unlearning.arXiv preprint arXiv:2404.18239, 2024

    2024 arXiv

  36. [44]

    Triviaqa: A large scale distantly supervised challenge dataset for reading comprehension.arXiv preprint arXiv:1705.03551, 2017

    Mandar Joshi, Eunsol Choi, Daniel S Weld, and Luke Zettlemoyer. Triviaqa: A large scale distantly supervised challenge dataset for reading comprehension.arXiv preprint arXiv:1705.03551, 2017

    2017 arXiv

  37. [45]

    Copyright violations and large language models.arXiv preprint arXiv:2310.13771, 2023

    Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Søgaard. Copyright violations and large language models.arXiv preprint arXiv:2310.13771, 2023

    2023 arXiv

  38. [46]

    Proactive privacy amnesia for large language models: Safeguarding pii with negligible impact on model utility.arXiv preprint arXiv:2502.17591, 2025

    Martin Kuo, Jingyang Zhang, Jianyi Zhang, Minxue Tang, Louis DiValentin, Aolin Ding, Jingwei Sun, William Chen, Amin Hass, Tianlong Chen, et al. Proactive privacy amnesia for large language models: Safeguarding pii with negligible impact on model utility.arXiv preprint arXiv:2...

    2025 arXiv

  39. [47]

    Race: Large-scale reading comprehension dataset from examinations.arXiv preprint arXiv:1704.04683, 2017

    Guokun Lai, Qizhe Xie, Hanxiao Liu, Yiming Yang, and Eduard Hovy. Race: Large-scale reading comprehension dataset from examinations.arXiv preprint arXiv:1704.04683, 2017

    2017 arXiv

  40. [48]

    Textbooks are all you need ii: phi-1.5 technical report.arXiv preprint arXiv:2309.05463, 2023

    Yuanzhi Li, Sébastien Bubeck, Ronen Eldan, Allie Del Giorno, Suriya Gunasekar, and Yin Tat Lee. Textbooks are all you need ii: phi-1.5 technical report.arXiv preprint arXiv:2309.05463, 2023

    2023 arXiv

  41. [49]

    Avoiding data contamination in language model evaluation: Dynamic test construction with latest materials.arXiv preprint arXiv:2312.12343, 2023

    Yucheng Li, Frank Geurin, and Chenghua Lin. Avoiding data contamination in language model evaluation: Dynamic test construction with latest materials.arXiv preprint arXiv:2312.12343, 2023

    2023 arXiv

  42. [50]

    Rouge: A package for automatic evaluation of summaries

    Chin-Yew Lin. Rouge: A package for automatic evaluation of summaries. InText summariza- tion branches out, pages 74–81, 2004

    2004

  43. [51]

    Truthfulqa: Measuring how models mimic human falsehoods.arXiv preprint arXiv:2109.07958, 2021

    Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods.arXiv preprint arXiv:2109.07958, 2021

    2021 arXiv

  44. [52]

    Continual learning and private unlearning

    Bo Liu, Qiang Liu, and Peter Stone. Continual learning and private unlearning. InConference on Lifelong Learning Agents, pages 243–254. PMLR, 2022

    2022

  45. [53]

    Large language model unlearning via embedding-corrupted prompts.Advances in Neural Information Processing Systems, 37:118198–118266, 2024

    Chris Liu, Yaxuan Wang, Jeffrey Flanigan, and Yang Liu. Large language model unlearning via embedding-corrupted prompts.Advances in Neural Information Processing Systems, 37:118198–118266, 2024. 12

    2024

  46. [54]

    Automatic dataset construction (adc): Sample collection, data curation, and beyond.arXiv preprint arXiv:2408.11338, 2024

    Minghao Liu, Zonglin Di, Jiaheng Wei, Zhongruo Wang, Hengxiang Zhang, Ruixuan Xiao, Haoyu Wang, Jinlong Pang, Hao Chen, Ankit Shah, et al. Automatic dataset construction (adc): Sample collection, data curation, and beyond.arXiv preprint arXiv:2408.11338, 2024

    2024 arXiv

  47. [55]

    Rethinking machine unlearning for large language models.Nature Machine Intelligence, pages 1–14, 2025

    Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, et al. Rethinking machine unlearning for large language models.Nature Machine Intelligence, pages 1–14, 2025

    2025

  48. [56]

    Trustworthy llms: a survey and guideline for evaluating large language models’ alignment.arXiv preprint arXiv:2308.05374, 2023

    Yang Liu, Yuanshun Yao, Jean-Francois Ton, Xiaoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Muhammad Faaiz Taufiq, and Hang Li. Trustworthy llms: a survey and guideline for evaluating large language models’ alignment.arXiv preprint arXiv:2308.05374, 2023

    2023 arXiv

  49. [57]

    On the generalization ability of machine- generated text detectors.arXiv preprint arXiv:2412.17242, 2024

    Yule Liu, Zhiyuan Zhong, Yifan Liao, Zhen Sun, Jingyi Zheng, Jiaheng Wei, Qingyuan Gong, Fenghua Tong, Yang Chen, Yang Zhang, et al. On the generalization ability of machine- generated text detectors.arXiv preprint arXiv:2412.17242, 2024

    2024 arXiv

  50. [58]

    Decoupled weight decay regularization.arXiv preprint arXiv:1711.05101, 2017

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization.arXiv preprint arXiv:1711.05101, 2017

    2017 arXiv

  51. [59]

    Eight methods to evaluate robust unlearning in llms.arXiv preprint arXiv:2402.16835, 2024

    Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. Eight methods to evaluate robust unlearning in llms.arXiv preprint arXiv:2402.16835, 2024

    2024 arXiv

  52. [60]

    Tofu: A task of fictitious unlearning for llms.arXiv preprint arXiv:2401.06121, 2024

    Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter. Tofu: A task of fictitious unlearning for llms.arXiv preprint arXiv:2401.06121, 2024

    2024 arXiv

  53. [61]

    Llm dataset inference: Did you train on my dataset?Advances in Neural Information Processing Systems, 37:124069– 124092, 2024

    Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. Llm dataset inference: Did you train on my dataset?Advances in Neural Information Processing Systems, 37:124069– 124092, 2024

    2024

  54. [62]

    Alternate preference optimization for unlearning factual knowledge in large language models.arXiv preprint arXiv:2409.13474, 2024

    Anmol Mekala, Vineeth Dorna, Shreya Dubey, Abhishek Lalwani, David Koleczek, Mukund Rungta, Sadid Hasan, and Elita Lobo. Alternate preference optimization for unlearning factual knowledge in large language models.arXiv preprint arXiv:2409.13474, 2024

    2024 arXiv

  55. [63]

    Pointer sentinel mixture models.arXiv preprint arXiv:1609.07843, 2016

    Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models.arXiv preprint arXiv:1609.07843, 2016

    2016 arXiv

  56. [64]

    Can a suit of armor conduct electricity? a new dataset for open book question answering.arXiv preprint arXiv:1809.02789, 2018

    Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. Can a suit of armor conduct electricity? a new dataset for open book question answering.arXiv preprint arXiv:1809.02789, 2018

    2018 arXiv

  57. [65]

    Can llms keep a secret? testing privacy implications of language models via contextual integrity theory.arXiv preprint arXiv:2310.17884, 2023

    Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. Can llms keep a secret? testing privacy implications of language models via contextual integrity theory.arXiv preprint arXiv:2310.17884, 2023

    arXiv

  58. [66]

    Quantifying the privacy risks of learning high-dimensional graphical models

    Sasi Kumar Murakonda, Reza Shokri, and George Theodorakopoulos. Quantifying the privacy risks of learning high-dimensional graphical models. InInternational Conference on Artificial Intelligence and Statistics, pages 2287–2295. PMLR, 2021

    2021

  59. [67]

    Unlearnable algorithms for in-context learning.arXiv preprint arXiv:2402.00751, 2024

    Andrei Muresanu, Anvith Thudi, Michael R Zhang, and Nicolas Papernot. Unlearnable algorithms for in-context learning.arXiv preprint arXiv:2402.00751, 2024

    2024

  60. [68]

    Rectified linear units improve restricted boltzmann machines

    Vinod Nair and Geoffrey E Hinton. Rectified linear units improve restricted boltzmann machines. InProceedings of the 27th international conference on machine learning (ICML- 10), pages 807–814, 2010

    2010

  61. [69]

    Token cleaning: Fine-grained data selection for llm supervised fine-tuning.arXiv preprint arXiv:2502.01968, 2025

    Jinlong Pang, Na Di, Zhaowei Zhu, Jiaheng Wei, Hao Cheng, Chen Qian, and Yang Liu. Token cleaning: Fine-grained data selection for llm supervised fine-tuning.arXiv preprint arXiv:2502.01968, 2025

    2025

  62. [70]

    Improving data efficiency via curating LLM-driven rating systems

    Jinlong Pang, Jiaheng Wei, Ankit Shah, Zhaowei Zhu, Yaxuan Wang, Chen Qian, Yang Liu, Yujia Bao, and Wei Wei. Improving data efficiency via curating LLM-driven rating systems. InThe Thirteenth International Conference on Learning Representations, 2025. 13

    2025

  63. [71]

    Bleu: a method for automatic evaluation of machine translation

    Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. InProceedings of the 40th annual meeting of the Association for Computational Linguistics, pages 311–318, 2002

    2002

  64. [72]

    In-context unlearning: Language models as few shot unlearners.arXiv preprint arXiv:2310.07579, 2023

    Martin Pawelczyk, Seth Neel, and Himabindu Lakkaraju. In-context unlearning: Language models as few shot unlearners.arXiv preprint arXiv:2310.07579, 2023

    2023 arXiv

  65. [73]

    Direct preference optimization: Your language model is secretly a reward model

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36:53728–53741, 2023

    2023

  66. [74]

    Exploring the limits of transfer learning with a unified text-to-text transformer.Journal of machine learning research, 21(140):1–67, 2020

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer.Journal of machine learning research, 21(140):1–67, 2020

    2020

  67. [75]

    Squad: 100,000+ questions for machine comprehension of text.arXiv preprint arXiv:1606.05250, 2016

    Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. Squad: 100,000+ questions for machine comprehension of text.arXiv preprint arXiv:1606.05250, 2016

    2016 arXiv

  68. [76]

    Lume: Llm unlearning with multitask evaluations.arXiv preprint arXiv:2502.15097, 2025

    Anil Ramakrishna, Yixin Wan, Xiaomeng Jin, Kai-Wei Chang, Zhiqi Bu, Bhanukiran Vinza- muri, V olkan Cevher, Mingyi Hong, and Rahul Gupta. Lume: Llm unlearning with multitask evaluations.arXiv preprint arXiv:2502.15097, 2025

    2025 arXiv

  69. [77]

    Sentence-bert: Sentence embeddings using siamese bert- networks.arXiv preprint arXiv:1908.10084, 2019

    Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert- networks.arXiv preprint arXiv:1908.10084, 2019

    1908 arXiv

  70. [78]

    Scholastic Incorporated, 2023

    Joanne K Rowling.Harry Potter and the sorcerer’s stone. Scholastic Incorporated, 2023

    2023

  71. [79]

    Winogrande: An adversarial winograd schema challenge at scale.Communications of the ACM, 64(9):99–106, 2021

    Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. Winogrande: An adversarial winograd schema challenge at scale.Communications of the ACM, 64(9):99–106, 2021

    2021

  72. [80]

    Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789, 2023

    Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789, 2023

    2023 arXiv

  73. [81]

    Muse: Machine unlearning six- way evaluation for language models.arXiv preprint arXiv:2407.06460, 2024

    Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang. Muse: Machine unlearning six- way evaluation for language models.arXiv preprint arXiv:2407.06460, 2024

    2024 arXiv

  74. [82]

    Large language models encode clinical knowledge.Nature, 620(7972):172–180, 2023

    Karan Singhal, Shekoofeh Azizi, Tao Tu, S Sara Mahdavi, Jason Wei, Hyung Won Chung, Nathan Scales, Ajay Tanwani, Heather Cole-Lewis, Stephen Pfohl, et al. Large language models encode clinical knowledge.Nature, 620(7972):172–180, 2023

    2023

  75. [83]

    Beyond memorization: Violating privacy via inference with large language models.arXiv preprint arXiv:2310.07298, 2023

    Robin Staab, Mark Vero, Mislav Balunovi ´c, and Martin Vechev. Beyond memorization: Violating privacy via inference with large language models.arXiv preprint arXiv:2310.07298, 2023

    2023 arXiv

  76. [84]

    Galactica: A large language model for science.arXiv preprint arXiv:2211.09085, 2022

    Ross Taylor, Marcin Kardas, Guillem Cucurull, Thomas Scialom, Anthony Hartshorn, Elvis Saravia, Andrew Poulton, Viktor Kerkez, and Robert Stojnic. Galactica: A large language model for science.arXiv preprint arXiv:2211.09085, 2022

    2022 arXiv

  77. [85]

    Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805, 2023

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805, 2023

    2023 arXiv

  78. [86]

    The falcon 3 family of open models, December 2024

    TII Team. The falcon 3 family of open models, December 2024

    2024

  79. [87]

    Guardrail baselines for unlearning in llms.arXiv preprint arXiv:2403.03329, 2024

    Pratiksha Thaker, Yash Maurya, Shengyuan Hu, Zhiwei Steven Wu, and Virginia Smith. Guardrail baselines for unlearning in llms.arXiv preprint arXiv:2403.03329, 2024

    2024 arXiv

  80. [88]

    Memorization without overfitting: Analyzing the training dynamics of large language models.Advances in Neural Information Processing Systems, 35:38274–38290, 2022

    Kushal Tirumala, Aram Markosyan, Luke Zettlemoyer, and Armen Aghajanyan. Memorization without overfitting: Analyzing the training dynamics of large language models.Advances in Neural Information Processing Systems, 35:38274–38290, 2022. 14

    2022

  81. [89]

    Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  82. [90]

    Kga: A general machine unlearning framework based on knowledge gap alignment.arXiv preprint arXiv:2305.06535, 2023

    Lingzhi Wang, Tong Chen, Wei Yuan, Xingshan Zeng, Kam-Fai Wong, and Hongzhi Yin. Kga: A general machine unlearning framework based on knowledge gap alignment.arXiv preprint arXiv:2305.06535, 2023

    2023 arXiv

  83. [91]

    Llm unlearning via loss adjustment with only forget data

    Yaxuan Wang, Jiaheng Wei, Chris Yuhao Liu, Jinlong Pang, Quan Liu, Ankit Parag Shah, Yujia Bao, Yang Liu, and Wei Wei. Llm unlearning via loss adjustment with only forget data. arXiv preprint arXiv:2410.11143, 2024

    2024 arXiv

  84. [92]

    Distributionally robust post-hoc classifiers under prior shifts

    Jiaheng Wei, Harikrishna Narasimhan, Ehsan Amid, Wen-Sheng Chu, Yang Liu, and Abhishek Kumar. Distributionally robust post-hoc classifiers under prior shifts. InThe Eleventh International Conference on Learning Representations, 2023

    2023

  85. [93]

    Measuring and reducing llm hallucination without gold-standard answers.arXiv preprint arXiv:2402.10412, 2024

    Jiaheng Wei, Yuanshun Yao, Jean-Francois Ton, Hongyi Guo, Andrew Estornell, and Yang Liu. Measuring and reducing llm hallucination without gold-standard answers.arXiv preprint arXiv:2402.10412, 2024

    2024 arXiv

  86. [94]

    Learning with noisy labels revisited: A study using real-world human annotations.arXiv preprint arXiv:2110.12088, 2021

    Jiaheng Wei, Zhaowei Zhu, Hao Cheng, Tongliang Liu, Gang Niu, and Yang Liu. Learning with noisy labels revisited: A study using real-world human annotations.arXiv preprint arXiv:2110.12088, 2021

    2021 arXiv

  87. [95]

    Machine unlearning for traditional models and large language models: A short survey

    Yi Xu. Machine unlearning for traditional models and large language models: A short survey. arXiv preprint arXiv:2404.01206, 2024

    2024 arXiv

  88. [96]

    Mathagent: Leveraging a mixture-of-math-agent framework for real-world multimodal mathematical error detection.arXiv preprint arXiv:2503.18132, 2025

    Yibo Yan, Shen Wang, Jiahao Huo, Philip S Yu, Xuming Hu, and Qingsong Wen. Mathagent: Leveraging a mixture-of-math-agent framework for real-world multimodal mathematical error detection.arXiv preprint arXiv:2503.18132, 2025

    2025 arXiv

  89. [97]

    An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report.arXiv preprint arXiv:2412.15115, 2024

    2024 arXiv

  90. [98]

    Machine unlearning of pre-trained large language models.arXiv preprint arXiv:2402.15159, 2024

    Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. Machine unlearning of pre-trained large language models.arXiv preprint arXiv:2402.15159, 2024

    2024 arXiv

  91. [99]

    Large language model unlearning.Advances in Neural Information Processing Systems, 37:105425–105475, 2024

    Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning.Advances in Neural Information Processing Systems, 37:105425–105475, 2024

    2024

  92. [100]

    Enhanced membership inference attacks against machine learning models

    Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri. Enhanced membership inference attacks against machine learning models. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 3093–3106, 2022

    2022

  93. [101]

    Towards robust knowledge unlearning: An adversarial framework for assessing and improving unlearn- ing robustness in large language models

    Hongbang Yuan, Zhuoran Jin, Pengfei Cao, Yubo Chen, Kang Liu, and Jun Zhao. Towards robust knowledge unlearning: An adversarial framework for assessing and improving unlearn- ing robustness in large language models. InProceedings of the AAAI Conference on Artificial Intelligen...

    2025

  94. [102]

    Hellaswag: Can a machine really finish your sentence?arXiv preprint arXiv:1905.07830, 2019

    Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence?arXiv preprint arXiv:1905.07830, 2019

    1905 arXiv

  95. [103]

    Negative preference optimization: From catastrophic collapse to effective unlearning.arXiv preprint arXiv:2404.05868, 2024

    Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. Negative preference optimization: From catastrophic collapse to effective unlearning.arXiv preprint arXiv:2404.05868, 2024

    2024 arXiv

  96. [104]

    Opt: Open pre-trained transformer language models.arXiv preprint arXiv:2205.01068, 2022

    Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models.arXiv preprint arXiv:2205.01068, 2022

    2022 arXiv

  97. [105]

    Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models.arXiv e-prints, pages arXiv–2402, 2024

    Yihua Zhang, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Xiaoming Liu, and Sijia Liu. Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models.arXiv e-prints, pages arXiv–2402, 2024. 15

    2024

  98. [106]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images

    Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. InEuropean Conference on Computer Vision, pages 385–403. Spr...

    2024

  99. [107]

    Safetybench: Evaluating the safety of large language models.arXiv preprint arXiv:2309.07045, 2023

    Zhexin Zhang, Leqi Lei, Lindong Wu, Rui Sun, Yongkang Huang, Chong Long, Xiao Liu, Xuanyu Lei, Jie Tang, and Minlie Huang. Safetybench: Evaluating the safety of large language models.arXiv preprint arXiv:2309.07045, 2023

    2023 arXiv

  100. [108]

    Reefknot: A comprehensive benchmark for relation hallucination evaluation, analysis and mitigation in multimodal large language models.arXiv preprint arXiv:2408.09429, 2024

    Kening Zheng, Junkai Chen, Yibo Yan, Xin Zou, and Xuming Hu. Reefknot: A comprehensive benchmark for relation hallucination evaluation, analysis and mitigation in multimodal large language models.arXiv preprint arXiv:2408.09429, 2024

    2024 arXiv

  101. [109]

    right to be forgotten

    Haomin Zhuang, Yihua Zhang, Kehan Guo, Jinghan Jia, Gaowen Liu, Sijia Liu, and Xiangliang Zhang. Uoe: Unlearning one expert is enough for mixture-of-experts llms.arXiv preprint arXiv:2411.18797, 2024. 16 Appendix A Broader Impacts and Limitations A.1 Broader Impacts The propos...

    2024 arXiv

  102. [110]

    I’m not sure

    and randomly sampled 1,000 data points for this purpose. Additionally, forverbmem, we only constructed irrelevant context prompts and jailbreak prompts. General utility evaluation.In real-world applications, it is important not only to distinguish retain/forget targets, but al...

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.