Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

RippleBench: an automatic pipeline shows that every unlearning method tested degrades knowledge beyond its target, with method-specific ripple curves that survive across base models.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

RippleBench automatically generates questions at increasing semantic distance from unlearned topics and shows all eight tested unlearning methods degrade accuracy that recovers only slowly with distance.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection Genuinely useful benchmark pipeline for unlearning ripple effects, but the abstract promises validation (MTurk, cross-model replication) that the body does not deliver; the semantic-distance axis is unvalidated as printed. the 4 major comments →

arxiv 2512.04144 v3 pith:VRENVHAI submitted 2025-12-03 cs.AI

RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories

Roy Rinberg , Usha Bhalla , Igor Shilov , Flavio P. Calmon , Rohit Gandikota This is my paper
classification cs.AI
keywords machine unlearningripple effectssemantic distancelanguage model evaluationretrieval-augmented generationWMDP-Bioknowledge editingbenchmark generation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that when a language model is edited to remove specific knowledge, the damage is not confined to those topics but spreads to semantically related knowledge, and that this ripple effect can be measured automatically. It builds RippleBench-Maker, a pipeline that takes any target concept, finds its nearest neighbors in a large knowledge repository (English Wikipedia), and generates multiple-choice questions at increasing semantic distance. Using this on the WMDP-Bio biosecurity benchmark, the paper evaluates eight unlearning methods on Llama-3-8B-Instruct and reports that all eight produce accuracy drops largest at distance 1 that decay with distance yet remain visible past distance 50, each with a distinct curve. It also reports that these curves are nearly identical across four different base models, suggesting the ripple profile is a property of the unlearning method rather than the underlying model. If correct, this gives the field a tool to compare unlearning methods on collateral damage, not just on the narrow forget set.

Core claim

The paper's central claim is that ripple effects in unlearning are systematic, method-dependent, and measurable at scale. Evaluating eight unlearning methods (GradDiff, RMU, RMU+LAT, RepNoise, ELM, RR, TAR, PB&J) on the RippleBench-WMDP-Bio dataset built from Wikipedia, the authors find that every method suppresses accuracy most strongly at semantic distance 1—the directly unlearned topics—and that accuracy partially recovers with distance but retains a degradation even past distance 50. The relative shape of the decay curve is nearly identical across Llama-3-8B-Instruct, Mistral-7B, Zephyr-7B, and Yi-34B, so the authors attribute the curve shape to the unlearning method rather than the base

What carries the argument

The load-bearing object is the ripple-effect function R_c,K,U,d(x), which averages the knowledge-delta ΔU(θ,θ′)(c) over all concepts at semantic distance x from a target c; the knowledge-delta is the difference in utility between base and edited model on questions about a concept. Semantic distance is operationalized as the rank of a Wikipedia article in a retrieval system (WikiRAG) when queried with the target concept, so 'distance 1' means the nearest retrieved neighbor and 'distance 1000' the farthest of the retrieved set. RippleBench-Maker instantiates this by mapping WMDP questions to seed topics, retrieving ranked neighbors from Wikipedia, extracting factual statements, generating mult

Load-bearing premise

The load-bearing premise is that the rank of a retrieved Wikipedia article in a vector search is a faithful proxy for how conceptually close two topics are to humans; retrieval-rank distance depends on article density in different subdomains and can interleave unrelated senses of polysemous terms, and if these artifacts dominate, the measured curves tell us about the geometry of the embedding space rather than about the semantic spread of unlearning.

What would settle it

Take a sample of RippleBench-Bio topics, have human raters order the retrieved neighbors by conceptual similarity to the target, and compare that ordering with the retrieval-rank ordering. If the accuracy-drop curves follow rank but not human ratings—or if switching to a different embedding model and knowledge corpus removes the monotone decay—then the measured ripple effects are artifacts of the retrieval metric rather than evidence about the semantics of unlearning.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • RippleBench-Bio provides a 352,961-question benchmark spanning semantic distances 1–1000 for the WMDP-Bio domain, letting any unlearning method be scored on collateral behavior, not just forget-set accuracy.
  • Because all eight methods show residual degradation beyond distance 50, reports of 'minimal utility loss' on unrelated benchmarks can miss real collateral damage that a distance-aware benchmark would expose.
  • The near-identical cross-model curves imply that comparing methods on different base models is meaningful in the ripple domain, and that the curve shape can characterize an unlearning method independently of the architecture.
  • The gap between distance-0 and distance-1 accuracy suggests that unlearning evaluation should include nearest-neighbor questions; otherwise the method may appear to forget concepts it actually still knows in slightly reworded form.
  • RippleBench-Maker is not prescriptive about the desired curve shape, so it enables explicit trade-off choices between forgetting strength and collateral damage for a given application.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the authors do not claim: the monotone decay of accuracy with distance is what one would expect if unlearning perturbs a shared feature space, so the ripple curve could be read as a measure of how broadly a method rewrites representations; testing the curve against layer-by-layer ablations would localize where the spread originates.
  • Because retrieval-rank distance is density-dependent (which the paper itself notes), the same rank number means different things in dense and sparse Wikipedia areas; replacing rank with calibrated embedding similarity or human proximity ratings on a sample would test whether the method-specific curve shapes survive a change of distance metric.
  • The reported cross-model invariance suggests the ripple curve may work as a fingerprint for identifying which unlearning algorithm produced a given edited model; the paper stops short of claiming this diagnostic use.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces RippleBench-Maker, an automatic pipeline that builds multiple-choice question sets over semantic neighborhoods of target concepts from a knowledge repository, instantiated with WikiRAG (FAISS over English Wikipedia) to produce RippleBench-Bio from the WMDP-Bio unlearning benchmark. The authors evaluate eight unlearning methods on Llama3-8B-Instruct and report that all methods show accuracy decreases concentrated near the unlearned target that decay with increasing WikiRAG rank distance, with method-specific profiles. The abstract additionally claims cross-model replication across Mistral-7B, Zephyr-7B, and Yi-34B, and a four-experiment Mechanical Turk study validating pipeline stages, but these results do not appear in the main text or appendices. The paper releases code, data, and infrastructure.

Significance. If the semantic-distance axis is valid, RippleBench fills a real gap: existing unlearning evaluations are largely binary (forget vs. retain), while a graded-distance benchmark could enable more nuanced assessment of collateral damage. The finding that all eight methods show measurable degradation beyond the directly unlearned topics, with different propagation profiles, is a useful empirical contribution. The pipeline is general and the release of the benchmark and tools is valuable for the community. However, the central claim — that accuracy decays as a function of human-relevant semantic distance — is currently supported only by a retrieval-rank axis that the paper itself concedes is subject to article-density and polysemy artifacts. The missing human validation and cross-model replication are therefore not minor omissions but load-bearing evidence. The theoretical framework is clean, but the empirical validation is incomplete as presented.

major comments (4)
  1. [Abstract vs. full text] The abstract promises a four-experiment Mechanical Turk validation (5,200+ responses, 61 workers) and replication across Mistral-7B, Zephyr-7B, and Yi-34B. Neither appears in the main text, appendices, or figures. This is not cosmetic: the MTurk study is the only stated evidence that WikiRAG rank corresponds to human conceptual proximity, and the cross-model replication is the evidence that ripple curves reflect the unlearning method rather than the base model. Please add these results (or at least summary statistics and analysis) to the body or appendix, or remove the claims from the abstract.
  2. [§3.5, Table 1, §4.2] The semantic-distance axis is defined as the FAISS/WikiRAG retrieval rank. The paper explicitly notes that rank inherits biases from article density in different subdomains and that polysemous terms such as 'Agent Orange' interleave unrelated senses. Section 4.3 further concedes that misleading neighbors can inflate apparent distance. Because all ripple curves are plotted against this rank, the central decay result may be an artifact of retrieval geometry (e.g., low-rank items are simply more topically mixed) rather than a true ripple of unlearning. The paper needs either a direct validation of rank against human similarity judgments, or robustness checks such as restricting to clearly monosemous topics, controlling for article density, or showing that the curves persist under alternative distance measures.
  3. [§4.2, Figures 2–4] No error bars, confidence intervals, or significance tests are reported. The claims in §4.2 that 'residual degradation remains visible even past distance 50' and that methods 'show distinct propagation profiles' are based on aggregated accuracy curves whose variability across topics is unknown. For a benchmark with 584 seed topics, it is essential to report topic-level variance (e.g., bootstrap intervals) and to test whether the method-to-method differences at large distances are statistically distinguishable from the base model and from each other.
  4. [§4.3, Definition 3] The 'Bomb-Next-Door' analysis compares WMDP performance at distance 0 with RippleBench-Bio at distance 1, but the manuscript does not precisely define what distance 0 contains. Is it the original WMDP questions, the extracted seed topics, or a RippleBench-generated set at rank 0? Definition 3 frames ripple effect in terms of concepts, while the evaluation is on questions. This ambiguity affects the interpretation of the core gap result. Please clarify the mapping and state explicitly whether WMDP questions are included in RippleBench-Bio at distance 0.
minor comments (6)
  1. [§3.2, §A.1] Typos: 'representating' in §3.2, 'desribe' in §A.1, 'theripple' in the Abstract, 'underling' in §3.3. Please proofread.
  2. [Figure 2 caption] The legend is cluttered, and the star markers are said to 'signify the utility on the baseline WMDP-bio dataset' but their placement and scale are not explained clearly. Please define the stars in the caption.
  3. [§3.8] The statement that questions are 'distributed across semantic distances ... from 1 to 1000 in steps of 5' is unclear: does this mean 200 discrete buckets, or are distances continuous and bucketed? Specify the bucket edges and whether the reported curves use these buckets.
  4. [§3.4] The Wikipedia snapshot is dated April 10, 2025, but no details are given about preprocessing, article filtering, or the bge-base embedding configuration. This is important for reproducibility of the retrieval index.
  5. [§A.1] K-FADE is described in the appendix but is not among the eight evaluated methods in the main text. Either add it to the evaluation or note explicitly that it is included for completeness.
  6. [§2] The discussion of TOFU and WMDP is brief, but the distinction between granular semantic-distance benchmarks and existing retain/forget sets would benefit from a comparison table or a few quantitative examples (e.g., how many distance-1 topics overlap with the forget set).

Circularity Check

0 steps flagged

No circular derivation: ripple curves are measured on an independently constructed benchmark; minor author-overlap and missing abstract-promised validations do not make the result circular.

full rationale

The central claim—that all eight unlearning methods show accuracy drops concentrated near the unlearned target that decay with semantic distance—is an empirical measurement on RippleBench-Bio, not a fitted prediction. The benchmark is constructed upstream of the evaluated models: WikiRAG rank (Section 3.4–3.5) selects topics and generates questions, and the unlearned checkpoints are taken from prior released work [7, 32]. No equation in the paper reduces the measured curves to the construction: Definition 3 is an expectation over utility differences, and the reported accuracy-vs-distance profiles could in principle have been flat or non-monotonic (indeed GradDiff/TAR show persistent broad degradation). The choice of RAG rank as semantic distance is an input assumption with acknowledged caveats (§3.5, §4.3), which creates a validity risk—if rank is dominated by article density or polysemy, the curves partly reflect retrieval geometry—but that is not circularity. There is minor author overlap: the ELM method and the checkpoint-release work used for evaluation involve a co-author (Gandikota), and these self-citations are descriptive rather than load-bearing. The abstract promises MTurk validation and cross-model replication that are absent from the body; this is an evidentiary/completeness gap, not a circular step. Overall, the benchmark construction does not force the measured outcome, so circularity is minimal.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

No numeric parameters are fitted to model accuracy. The central assumptions are the validity of the RAG-rank distance axis and the quality of LLM-generated questions. The paper acknowledges some distance-axis caveats but does not correct for them. No new physical or conceptual entities are postulated beyond the framework definitions.

free parameters (3)
  • max semantic rank = 1000
    WikiRAG retrieves 1000 results per target; this sets the extent of the distance axis. Chosen by hand, not fitted to data.
  • distance bucket stride = 5
    Distances are reported in steps of 5 (Section 3.8). Aggregation choice that affects curve smoothness but not the qualitative result.
  • manual distance band boundaries = 0-10, 10-50, 50-100, 100-250, 250-500, ≥500
    Section 3.5 assigns qualitative labels to rank ranges. These are descriptive, but they influence how the authors interpret the curve.
axioms (5)
  • domain assumption WikiRAG rank approximates human semantic distance.
    Section 3.5 defines semantic distance exclusively as RAG rank; the entire ripple analysis depends on this proxy.
  • domain assumption BGE embeddings over full Wikipedia pages capture conceptual proximity.
    Section 3.4 relies on FAISS similarity over Wikipedia page embeddings; no independent validation is shown in the preprint.
  • domain assumption LLM-generated multiple-choice questions are valid measures of knowledge.
    Section 3.3 generates questions from LLM-extracted facts; the claimed MTurk validation is not reported in the text.
  • domain assumption Each WMDP question can be mapped to a single representative topic.
    Section 3.2 step 1 uses an LLM to map questions to topics; errors here propagate to the entire neighbor graph.
  • domain assumption WMDP-Bio is a suitable source of unlearned targets.
    Section 3.8 treats WMDP-Bio as the target domain; the benchmark inherits any biases in that seed set.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories." pith.science (2026). https://pith.science/paper/VRENVHAI

@misc{pith2026251204144,
  author       = {Pith},
  title        = {Pith review of: RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VRENVHAI}},
  note         = {Machine review of arXiv:2512.04144}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Targeted interventions on language models, such as unlearning or model editing, aim to modify specific information, but their effects often propagate to related, unintended areas (e.g., removing virology content may degrade performance on allergies); these side-effects are commonly referred to as the ripple effect. We introduce RippleBench-Maker, an automatic pipeline that retrieves semantic neighbors of any source concept from a knowledge repository and generates multiple-choice questions at varying semantic distances. We instantiate this framework using WikiRAG, an open-source RAG system over English Wikipedia, to construct RippleBench-WMDP-Bio (584 seed topics, 352,961 questions), and evaluate eight unlearning methods on Llama3-8B-Instruct. All eight exhibit accuracy drops that are largest near the unlearned target and decay with semantic distance, each with a distinct propagation profile. We replicate these findings across Mistral-7B, Zephyr-7B, and Yi-34B; cross-model delta curves are nearly identical, suggesting ripple effects are a property of the unlearning method rather than the base model. We validate all major pipeline stages using a four-experiment Mechanical Turk study (5,200+ responses, 61 workers). We release all code, data, and infrastructure.

Figures

Figures reproduced from arXiv: 2512.04144 by Flavio P. Calmon, Igor Shilov, Rohit Gandikota, Roy Rinberg, Usha Bhalla.

Figure 1
Figure 1. Figure 1: The RippleBench-Maker pipeline. Starting from an unlearned topic (e.g., Viral Evolution), WikiRAG retrieves related topics, factual statements are extracted, and language models generate multiple-choice questions. While we focus on WMDP-Bio in this work, the pipeline applies to any model-editing or unlearning task. 3.3 Instantiating RippleBench-Maker with Wikipedia In this work, we instantiate RippleBench-… view at source ↗
Figure 2
Figure 2. Figure 2: Ripple effects of unlearning methods on model performance across semantic distances. The [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: RippleBench-Bio utility over unlearning checkpoints for ELM and RMU unlearning methods [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: For 3 different semantic distances, we plot the utility over unlearning checkpoints. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Example of RAG similarity scores for the seed topic [PITH_FULL_IMAGE:figures/full_fig_p015_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Checkpoint progression for Llama-RMU-LAT. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 15 [PITH_FULL_IMAGE:figures/full_fig_p015_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Checkpoint progression for Llama-ELM. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 0 200 400 600 800 1000 Semantic Distance 50 55 60 65 70 Accuracy (%) Checkpoint Progression: Llama-RMU Llama Baseline ckpt1 ckpt2 ckpt3 ckpt4 ckpt5 ckpt6 ckpt7 ckpt8 [PITH_FULL_IMAGE:figures/full_fig_p016_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Checkpoint progression for Llama-RMU. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Checkpoint progression for Llama-GradDiff. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 0 200 400 600 800 1000 Semantic Distance 55 60 65 70 Accuracy (%) Checkpoint Progression: Llama-RR Llama Baseline ckpt1 ckpt2 ckpt3 ckpt4 ckpt5 ckpt6 ckpt7 ckpt8 [PITH_FULL_IMAGE:figures/full_fig_p017_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Checkpoint progression for Llama-RR. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Checkpoint progression for Llama-PBJ. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 0 200 400 600 800 1000 Semantic Distance 40 45 50 55 60 65 70 Accuracy (%) Checkpoint Progression: Llama-TAR Llama Baseline ckpt1 ckpt2 ckpt3 ckpt4 ckpt5 ckpt6 ckpt7 ckpt8 [PITH_FULL_IMAGE:figures/full_fig_p018_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Checkpoint progression for Llama-TAR. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Checkpoint progression for Llama-RepNoise. Accuracy over semantic distance is plotted for the baseline and 8 unlearning checkpoints. 19 [PITH_FULL_IMAGE:figures/full_fig_p019_13.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Forget Narrowly, Retain Broadly: Unlearning as an Asymmetric Generalization Problem

    cs.LG 2026-07 accept novelty 7.0

    SUITE defines the forget-retain boundary at semantic, syntactic and lexical levels; training on it plus JensUn++ yields near-complete forgetting with minimal retain and utility loss.

Reference graph

Works this paper leans on

32 extracted references · 16 linked inside Pith · cited by 1 Pith paper

  1. [2]

    Evaluating the ripple effects of knowledge editing in language models, 2023

    Roi Cohen, Eden Biran, Ori Yoran, Amir Globerson, and Mor Geva. Evaluating the ripple effects of knowledge editing in language models, 2023

    2023

  2. [3]

    Open problems in machine unlearning for ai safety.arXiv preprint arXiv:2501.04952, 2025

    Fazl Barez, Tingchen Fu, Ameya Prabhu, Stephen Casper, Amartya Sanyal, Adel Bibi, Aidan O’Gara, Robert Kirk, Ben Bucknall, Tim Fist, et al. Open problems in machine unlearning for ai safety.arXiv preprint arXiv:2501.04952, 2025

    Pith/arXiv arXiv 2025

  3. [4]

    Are we making progress in unlearning? findings from the first neurips unlearning competition, 2024

    Eleni Triantafillou, Peter Kairouz, Fabian Pedregosa, Jamie Hayes, Meghdad Kurmanji, Kairan Zhao, Vincent Dumoulin, Julio Jacques Junior, Ioannis Mitliagkas, Jun Wan, Lisheng Sun Hosoya, Sergio Escalera, Gintare Karolina Dziugaite, Peter Triantafillou, and Isabelle Guyon. Are we making progress in unlearning? findings from the first neurips unlearning com...

    2024

  4. [5]

    Tofu: A task of fictitious unlearning for llms.arXiv preprint arXiv:2401.06121, 2024

    Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter. Tofu: A task of fictitious unlearning for llms.arXiv preprint arXiv:2401.06121, 2024

    Pith/arXiv arXiv 2024

  5. [6]

    Lipton, J

    Vineeth Dorna, Anmol Mekala, Wenlong Zhao, Andrew McCallum, Zachary C. Lipton, J. Zico Kolter, and Pratyush Maini. Openunlearning: Accelerating llm unlearning via unified bench- marking of methods and metrics, 2025

    2025

  6. [7]

    Model tampering attacks enable more rigorous evaluations of llm capabilities.arXiv preprint arXiv:2502.05209, 2025

    Zora Che, Stephen Casper, Robert Kirk, Anirudh Satheesh, Stewart Slocum, Lev E McKinney, Rohit Gandikota, Aidan Ewart, Domenic Rosati, Zichu Wu, et al. Model tampering attacks enable more rigorous evaluations of llm capabilities.arXiv preprint arXiv:2502.05209, 2025

    Pith/arXiv arXiv 2025

  7. [8]

    Measuring massive multitask language understanding, 2021

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding, 2021

    2021

  8. [9]

    Eight methods to evaluate robust unlearning in llms.arXiv preprint arXiv:2402.16835, 2024

    Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. Eight methods to evaluate robust unlearning in llms.arXiv preprint arXiv:2402.16835, 2024

    Pith/arXiv arXiv 2024

  9. [10]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249, 2024

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249, 2024

    Pith/arXiv arXiv 2024

  10. [11]

    Adversarial tuning: Defending against jailbreak attacks for llms.arXiv preprint arXiv:2406.06622, 2024

    Fan Liu, Zhao Xu, and Hao Liu. Adversarial tuning: Defending against jailbreak attacks for llms.arXiv preprint arXiv:2406.06622, 2024

    Pith/arXiv arXiv 2024

  11. [12]

    Robust llm safeguarding via refusal feature adversarial training.arXiv preprint arXiv:2409.20089, 2024

    Lei Yu, Virginie Do, Karen Hambardzumyan, and Nicola Cancedda. Robust llm safeguarding via refusal feature adversarial training.arXiv preprint arXiv:2409.20089, 2024

    Pith/arXiv arXiv 2024

  12. [13]

    Defending against unforeseen failure modes with latent adversarial training.arXiv preprint arXiv:2403.05030, 2024

    Stephen Casper, Lennart Schulze, Oam Patel, and Dylan Hadfield-Menell. Defending against unforeseen failure modes with latent adversarial training.arXiv preprint arXiv:2403.05030, 2024. 10

    Pith/arXiv arXiv 2024

  13. [14]

    Rethinking machine unlearning for large language models.Nature Machine Intelligence, pages 1–14, 2025

    Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, et al. Rethinking machine unlearning for large language models.Nature Machine Intelligence, pages 1–14, 2025

    2025

  14. [15]

    Who’s harry potter? approximate unlearning in llms.URL https://arxiv

    Ronen Eldan and Mark Russinovich. Who’s harry potter? approximate unlearning in llms.URL https://arxiv. org/abs/2310.02238, 1(2):8, 2023

    Pith/arXiv arXiv 2023

  15. [16]

    Improving alignment and robustness with circuit breakers.Advances in Neural Information Processing Systems, 37:83345–83373, 2024

    Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, J Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers.Advances in Neural Information Processing Systems, 37:83345–83373, 2024

    2024

  16. [17]

    Latent adver- sarial training improves robustness to persistent harmful behaviors in llms.arXiv preprint arXiv:2407.15549, 2024

    Abhay Sheshadri, Aidan Ewart, Phillip Guo, Aengus Lynch, Cindy Wu, Vivek Hebbar, Henry Sleight, Asa Cooper Stickland, Ethan Perez, Dylan Hadfield-Menell, et al. Latent adver- sarial training improves robustness to persistent harmful behaviors in llms.arXiv preprint arXiv:2407.15549, 2024

    Pith/arXiv arXiv 2024

  17. [18]

    Tamper-resistant safeguards for open-weight llms.URL https://arxiv

    Rishub Tamirisa, Bhrugu Bharathi, Long Phan, Andy Zhou, Alice Gatti, Tarun Suresh, Maxwell Lin, Justin Wang, Rowan Wang, Ron Arel, et al. Tamper-resistant safeguards for open-weight llms.URL https://arxiv. org/abs/2408.00761, 2024

    Pith/arXiv arXiv 2024

  18. [19]

    Representation noising effectively prevents harmful fine-tuning on llms.CoRR, 2024

    Domenic Rosati, Jan Wehner, Kai Williams, Lukasz Bartoszcze, David Atanasov, Robie Gonza- les, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad, and Frank Rudzicz. Representation noising effectively prevents harmful fine-tuning on llms.CoRR, 2024

    2024

  19. [20]

    Mechanistic unlearning: Robust knowledge unlearning and editing via mechanistic localization

    Phillip Guo, Aaquib Syed, Abhay Sheshadri, Aidan Ewart, and Gintare Karolina Dziugaite. Mechanistic unlearning: Robust knowledge unlearning and editing via mechanistic localization. arXiv preprint arXiv:2410.12949, 2024

    Pith/arXiv arXiv 2024

  20. [21]

    Redirection for erasing memory (rem): Towards a universal unlearning method for corrupted data.arXiv preprint arXiv:2505.17730, 2025

    Stefan Schoepf, Michael Curtis Mozer, Nicole Elyse Mitchell, Alexandra Brintrup, Georgios Kaissis, Peter Kairouz, and Eleni Triantafillou. Redirection for erasing memory (rem): Towards a universal unlearning method for corrupted data.arXiv preprint arXiv:2505.17730, 2025

    arXiv 2025

  21. [22]

    Saes can improve unlearning: Dynamic sparse autoencoder guardrails for precision unlearning in llms

    Aashiq Muhamed, Jacopo Bonato, Mona T Diab, and Virginia Smith. Saes can improve unlearning: Dynamic sparse autoencoder guardrails for precision unlearning in llms. InICML 2025 Workshop on Reliable and Responsible Foundation Models, 2025

    2025

  22. [23]

    Model unlearning via sparse autoencoder subspace guided projections.arXiv preprint arXiv:2505.24428, 2025

    Xu Wang, Zihao Li, Benyou Wang, Yan Hu, and Difan Zou. Model unlearning via sparse autoencoder subspace guided projections.arXiv preprint arXiv:2505.24428, 2025

    Pith/arXiv arXiv 2025

  23. [25]

    C-pack: Packaged resources to advance general chinese embedding, 2023

    Shitao Xiao, Zheng Liu, Peitian Zhang, and Niklas Muennighoff. C-pack: Packaged resources to advance general chinese embedding, 2023

    2023

  24. [26]

    The faiss library

    Matthijs Douze, Alexandr Guzhva, Chengqi Deng, Jeff Johnson, Gergely Szilvasy, Pierre- Emmanuel Mazaré, Maria Lomeli, Lucas Hosseini, and Hervé Jégou. The faiss library. 2024

    2024

  25. [27]

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ah- mad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao, Aston Zhang, Aurelien Rodriguez, Austen Gregerson, Ava...

    2024

  26. [28]

    Continual learning and private unlearning

    Bo Liu, Qiang Liu, and Peter Stone. Continual learning and private unlearning. InConference on Lifelong Learning Agents, pages 243–254. PMLR, 2022

    2022

  27. [29]

    The wmdp benchmark: Measuring and reducing malicious use with unlearning.arXiv preprint arXiv:2403.03218, 2024

    Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The wmdp benchmark: Measuring and reducing malicious use with unlearning.arXiv preprint arXiv:2403.03218, 2024

    Pith/arXiv arXiv 2024

  28. [30]

    Erasing conceptual knowl- edge from language models.arXiv preprint arXiv:2410.02760, 2024

    Rohit Gandikota, Sheridan Feucht, Samuel Marks, and David Bau. Erasing conceptual knowl- edge from language models.arXiv preprint arXiv:2410.02760, 2024

    Pith/arXiv arXiv 2024

  29. [31]

    Unlearning in large language models via activation projections

    Anonymous. Unlearning in large language models via activation projections. 2025

    2025

  30. [32]

    Model tampering attacks enable more rigorous evaluations of llm capabilities, 2025

    Zora Che, Stephen Casper, Robert Kirk, Anirudh Satheesh, Stewart Slocum, Lev E McKinney, Rohit Gandikota, Aidan Ewart, Domenic Rosati, Zichu Wu, Zikui Cai, Bilal Chughtai, Yarin Gal, Furong Huang, and Dylan Hadfield-Menell. Model tampering attacks enable more rigorous evaluations of llm capabilities, 2025

    2025

  31. [33]

    Representation misdirection for unlearning.arXiv preprint arXiv:2404.03233, 2024

    Phillip Li, Huiwen Li, and Alexander Patel. Representation misdirection for unlearning.arXiv preprint arXiv:2404.03233, 2024

    Pith/arXiv arXiv 2024

  32. [34]

    unknowledgeable

    Lev E McKinney, Anvith Thudi, Juhan Bae, Tara Rezaei Kheirkhah, Nicolas Papernot, Sheila A McIlraith, and Roger Baker Grosse. Gauss-newton unlearning for the llm era. InICML 2025 Workshop on Machine Unlearning for Generative AI, 2025. A Supplementary Material A.1 Existing Unlearning Techniques The unlearning methods evaluated by Che et al. (2025) can be b...

    2025

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.