Pith. sign in

REVIEW 5 major objections 5 minor 21 references

A model can erase specific knowledge from itself even if the only data it sees is anonymized, by working in the model's internal activation geometry rather than on raw text.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 12:10 UTC pith:YOCIMWIV

load-bearing objection Real problem framing, but the main evaluation table doesn't reproduce from the paper's own formulas—verify before relying on any performance claim. the 5 major comments →

arxiv 2601.04275 v2 pith:YOCIMWIV submitted 2026-01-07 cs.CR cs.AIcs.CL

Shadow Unlearning: A Neuro-Semantic Approach to Fidelity-Preserving Faceless Forgetting in LLMs

Dinesh Srivasthav P , Ashok Urlana , Rahul Mishra , Bala Mallikarjunarao Garlapati , Ponnurangam Kumaraguru This is my paper
classification cs.CR cs.AIcs.CL
keywords shadow unlearningmachine unlearningprivacy-preserving unlearninganonymizationlatent representation alignerforget subspacemembership inferenceLLM utility-fidelity tradeoff
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to resolve a privacy paradox in machine unlearning: to delete a user's data, the model operator usually has to be handed exactly that data, defeating the purpose. It proposes Shadow Unlearning, where unlearning runs on anonymized forget sets, and a concrete method, NSPU, that learns the semantic mapping between anonymized and original text inside the model's activation space, extracts the principal directions of the forget set from that space, and suppresses those directions during inference. If this works, a deletion request can be honored without anyone touching PII, while the model keeps most of its utility and the compute stays far below gradient-based unlearning. The experiments span four LLMs and five domains, and the paper's central claim is that this privacy--utility--efficiency balance is achieved by a training-free, projection-based filter.

Core claim

The central claim is that unlearning can be done on anonymized data alone by operating in the model's internal activation geometry. A lightweight MLP aligner, trained once on public (original, anonymized) text pairs, projects anonymized activations into the original activation space; PCA over the projected forget-set activations yields a forget subspace; and a non-trainable filter I - alpha*U*U^T, inserted at the final layer, subtracts the forget-subspace component from every activation during inference. The paper argues this simultaneously makes the forget set hard to detect via membership inference, preserves retain-set performance, and avoids any gradient update of the target model, givin

What carries the argument

The Latent Representation Aligner Pθ, a lightweight MLP trained with ||Pθ(φ_l(x_anon)) - φ_l(x_orig)||² and an inversion-resistance term, maps anonymized activations into the original activation space. The Forget Subspace U is the top-k PCA basis of those projected forget activations. The Unlearning Filter UL_filter = I - α U U^T is a non-trainable adapter that projects each activation away from the forget subspace at inference, attenuating forget-related concepts while leaving the orthogonal complement intact.

Load-bearing premise

The load-bearing premise is that a small MLP trained on public (original, anonymized) text pairs can predict the original activation of an anonymized forget sample accurately enough that the principal directions of those predictions coincide with the true semantic content to be forgotten; the paper's own domain-wise similarity numbers (as low as 0.47 for one model and domain) and its stated dependence on overlap between forget and retain distributions mark this as the fragile

What would settle it

Take a model after NSPU unlearning and ask it the original, non-anonymized forget questions: if it still reproduces the gold answers at the same confidence as the target model, the filter removed nothing relevant. A sharper test is out-of-distribution: feed the aligner anonymized forget text from a domain absent from its public training corpus and compare Pθ(φ_l(x_anon)) to the true φ_l(x_orig) via cosine similarity; if the similarity collapses toward zero, the forget subspace is built from noise and the reported separations on the synthetic set would not transfer.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Unlearning pipelines can be restructured so the forget set is anonymized before it reaches the model operator, removing a major PII exposure point during deletion requests.
  • Because the target model stays frozen, a deletion request can be serviced with a single matrix multiply per token instead of gradient updates, with FLOP counts roughly 10x lower than gradient baselines and about 10^6 lower than retraining.
  • The harmonic evaluation stack (perplexity, truth ratio, ROUGE-L, and conditional NLL combined into retention-versus-forgetting ratios) gives a single score for the utility--efficacy tradeoff, making it possible to compare unlearning methods on how much knowledge survives rather than only on how much is forgotten.
  • The entity-level analysis suggests the method can erase specific PII types, such as person names, locations, and phone numbers, while leaving other domain knowledge in place.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper does not develop: because the filter is a linear projection independent of the input text, the same U could be built from any one-way anonymization function f(·), as long as the aligner is retrained on that f's outputs, making shadow unlearning a plug-in for pseudonymization schemes beyond NER tag replacement.
  • The paper tests paraphrased, context-augmented, and hard-token attacks on the filter, but it leaves open a sharper adversarial question: whether someone with access to the aligner Pθ can invert its outputs to reconstruct the original text. The InvOptScore term is designed to raise that cost, and a direct inversion attack on the aligner would be the natural stress test.
  • Because the evaluation rests on synthetic author profiles, the practical deployment claim—that a public-corpus-trained aligner maps real-world anonymized forget sets reliably—remains untested at scale. Running the pipeline on a real PII-bearing corpus with known ground-truth pairs would be the direct way to test transfer.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes Shadow Unlearning, a paradigm in which machine unlearning is performed on an anonymized forget set, and introduces NSPU, a three-stage method: (i) train an MLP to map anonymized activations back into the original activation space, (ii) construct a PCA-based forget subspace from the projected anonymized forget activations, and (iii) insert a non-trainable linear filter I−αUU^T into the frozen target model. The authors introduce a synthetic five-domain MuFU benchmark and evaluate four LLMs against GA, GD, KLM, DPO, and NPO using four harmonic trade-off metrics plus an SQS-based membership-inference analysis. The central claims are that NSPU consistently outperforms the baselines, preserves utility, enhances user privacy, and is at least 10 times more computationally efficient than standard unlearning approaches. I find that the headline evaluation is not self-consistent: the reported metric values in Table 2 cannot be reproduced from the paper's own equations, and the stated efficiency claim is contradicted by Table 3. As a result, the principal empirical claims are not currently supported.

Significance. The idea of performing unlearning on anonymized data is timely, and the frozen-target projection architecture is an interesting and nonstandard approach. The construction of the MuFU benchmark and the breadth of models and ablations are also useful if the underlying measurements are reliable. However, the current manuscript does not establish its central claims. The main evidence for 'NSPU consistently outperforms baselines' is a table whose values do not follow the paper's stated formulas, and the 'at least 10x' efficiency claim is contradicted by the paper's own FLOPs table. Because these are load-bearing issues in the abstract, Section 4.4, and Takeaway 2, the contribution cannot be assessed as presented. If the evaluation were corrected and independently reproducible, the paradigm could be a valuable addition to privacy-preserving unlearning; the present version does not provide that reliable basis.

major comments (5)
  1. [§4.4, Table 2, Eqs. (4) and (13)] The HCS/HPS and HCNLL values are not derivable from the definitions. For Mistral-7B NSPU, Table 2 gives GF=−0.084 and CR=2.066, but Eq. (4) yields HPS = 2(−0.084)/((−0.084)(2.066)+1) = −0.203, not 4.995. For Llama-7B NSPU, GF=1.388 and CR=2.055 yield HPS ≈ 0.721, not 1.067. Similarly, Eq. (13) with Mistral's GFL=0.955 and CRL=1.650 gives HCNLL ≈ 0.741, not 1.281. Since the aggregate scores and the conclusion that 'NSPU consistently outperforms baseline unlearning methods' are built on these columns, the central experimental result is unsupported as reported.
  2. [Abstract, §4.5, Table 3] The claim that NSPU is 'at least 10x more computationally efficient than standard unlearning approaches' is contradicted by the paper's own FLOPs table. For Llama-7B, NSPU is 7.63e16 FLOPs versus GA's 1.29e17, a ratio of about 1.7x; for Mistral-7B the ratio is about 1.7x; for Llama-13B about 1.7x; for OLMoE about 2.1x. Even compared with GD/DPO/NPO at 5.16e17 FLOPs, the Llama-7B ratio is about 6.8x, still below 10x. Only the comparison with retraining from scratch approaches the claimed 10^6x. Takeaway 2 and the abstract therefore materially overstate the efficiency result.
  3. [§3.6, Table 12, §4.4] The reported superiority of NSPU may be inflated by tuning and by construction. The forget subspace U is built from the same anonymized forget set that is later used to compute forget-set effectiveness, and α is selected separately for every model and overlap variant (values range from 0.01 to 0.315 in Table 12) with no described validation or selection criterion. Without a sensitivity analysis or an independent validation split, one cannot tell whether the head-to-head win reflects the method itself or favorable hyperparameter selection. The paper should report how α was chosen and show performance across a range of α values.
  4. [§3.4, §7, Table 5, Appendix B] The privacy claim is not currently established. The method requires training a projector to map anonymized activations back into the original activation space; Table 5 reports cosine similarities up to 0.87 (Llama-13B), and Appendix B refers to the projector as a 'deanonymization module.' Section 3.1 asserts that the anonymization function f is one-way in practice, but the projector appears to be a partial inversion tool. No attack on the projection is reported, and InvOptScore is only a heuristic training penalty rather than a demonstrated privacy guarantee. Thus 'enhances user privacy' remains a conjecture rather than a measured property.
  5. [Table 2, Table 9] Several entries appear to be copy-paste artifacts rather than distinct measurements. In Table 2, the GA and KLM rows are numerically identical for Llama-7B (e.g., GF=104.730, CR=110.110) and again for Mistral-7B (GF=154.695, CR=202.520), even though KLM includes an additional retain-set KL regularizer and therefore should differ from GA. In Appendix B Table 9, the MLP reconstruction rows for Mistral-7B and OLMoE-1B-7B are identical across all overlap settings (e.g., 5%: MSE=1.044, R²=0.443), despite being different models. These duplicates further undermine the reliability of the reported numerical results.
minor comments (5)
  1. [§4.2, Table 2] The notation is inconsistent: the text defines HPS, but Table 2 uses the column label HCS without defining it. Please harmonize the metric names.
  2. [§5.3] The text says 'As depicted in Table 6' when referring to the LLM-as-a-judge results; the relevant artifact is Figure 6, while Table 6 is the PII attribute similarity table. The cross-reference should be corrected.
  3. [Appendix C, Eqs. (30)-(31)] Equation (31) writes UL_filter = I − α v_in U U^T, but v_in is an activation vector, not a d×d matrix, so the expression is dimensionally inconsistent. From the preceding definitions the filter should be I − α U U^T. Also, the section is titled 'Theoretical Guarantee' but contains only an algebraic re-derivation; no formal forgetting guarantee is provided.
  4. [§3.6] The phrase 'training-free unlearning procedure' is misleading because Stage 1 trains the latent representation aligner Pθ. It would be more accurate to say that NSPU performs no gradient updates to the target model.
  5. [Abstract, §8] The abstract says 'Code is available at Github' without a URL, and the reproducibility statement does not provide a repository link or dataset access information. For a paper whose central evaluation is currently unreproducible, providing the actual artifacts is essential.

Circularity Check

0 steps flagged

No circularity found; NSPU's derivation is self-contained. Table 2 non-reproducibility and Appendix C algebra errors are correctness issues, not circular reductions.

full rationale

The paper's derivation chain—Latent Representation Aligner (Eq. 1), forget subspace PCA (Section 3.5.1), unlearning filter (Section 3.6.1), and harmonic metrics (Eqs. 4, 6, 9, 13)—does not reduce any claimed result to its own inputs by construction under the stated hard rules. The forget subspace is intentionally computed from the anonymized forget set and then evaluated on the same underlying forget data; this is the standard unlearning objective, not a fitted parameter renamed as a prediction, and the comparison with baselines is symmetric. No load-bearing self-citation or imported uniqueness theorem appears; the cited anonymization work is external. I considered the possibility that tuning alpha (Table 12) or using the forget set to build the subspace makes the forgetting scores forced, but the paper does not state that alpha was selected on the test metrics, and the forgetting/retention tradeoff still leaves independent content. The main problems are not circularity: Table 2's HCS/HCNLL values cannot be reproduced from Eqs. (4) and (13) (e.g., Mistral-7B GF=-0.084, CR=2.066 gives HPS≈-0.20, not 4.995), and Appendix C's 'theoretical guarantee' contains a dimensionally inconsistent derivation (Eqs. 30-31). These are reproducibility/correctness failures. The Limitations section (Section 7) explicitly concedes dependence on public-corpus/forget overlap, which is an acknowledged validity caveat, not a circular step.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The method introduces no new physical or mathematical entities. Its load-bearing assumptions are the transferability of the learned projection and the linear separability of knowledge in activation space, both of which are only partially supported by the paper's own measurements. The free parameters (α, τ, λ_inv, layer choice) are fitted or hand-selected without a clean validation protocol, and the privacy argument rests on an unexamined one-way property of anonymization that the projector itself undermines.

free parameters (4)
  • α (unlearning filter strength) = 0.0097–0.315 (Table 12, varies per model and overlap variant)
    Controls how much of the forget-subspace projection is subtracted. Tuned separately for each model and overlap variant with no validation criterion or selection protocol reported.
  • PCA explained-variance threshold τ = 0.95
    Rank k of the forget subspace is chosen so that cumulative explained variance ≥95% (Appendix D, Eq. 33). A hand-set threshold; not swept or justified.
  • Inversion penalty weight λ_inv = not reported
    Trade-off between semantic alignment and inversion resistance in the projector training objective (Section 3.4.1). No value is given in the main text or appendices.
  • Projector layer l and MLP architecture = 4096-8192-8192-4096 for LLaMA-7B; final-layer placement for filter
    The activation layer used for the projector and the MLP size are chosen by hand; the filter layer placement is selected based on the same drift analysis used to justify the method.
axioms (4)
  • domain assumption Anonymized texts retain enough semantic structure for a low-capacity projector to reconstruct the original activation geometry of the target model.
    Used in Section 3.4; if the projection is poor, the PCA forget subspace is wrong. The paper's own Table 5 shows domain cosine similarities as low as 0.47, so this assumption is partially violated.
  • domain assumption Removing the top principal components of the forget-set activations attenuates the target knowledge without damaging orthogonal retain knowledge; i.e., knowledge is linearly separable in activation space.
    Core of Sections 3.5–3.6; Appendix C provides only algebraic manipulation, not a formal proof that this holds for LLM knowledge.
  • domain assumption The public corpora used to train the projector are distributionally close enough to the forget data for the learned mapping to transfer.
    Section 3.4.1 and Appendix B; the Limitations section explicitly concedes that performance depends on overlap between the public training data and the forget/retain distributions.
  • ad hoc to paper The NER anonymization function f is one-way in practice, so the anonymized forget set is safe to share even though the projector can partially undo it.
    The paper's own Table 5 shows the projector achieves 0.71–0.84 cosine similarity with original activations, which indicates that the anonymization is partially invertible at the activation level; the paper does not analyze the risk of the projector itself leaking.

pith-pipeline@v1.3.0-alltime-deepseek · 32341 in / 13429 out tokens · 119883 ms · 2026-08-03T12:10:56.433445+00:00 · methodology

0 comments
read the original abstract

Machine unlearning aims to selectively remove the influence of specific training samples to satisfy privacy regulations such as the GDPR's 'Right to be Forgotten'. However, many existing methods require access to the data being removed, exposing it to membership inference attacks and potential misuse of Personally Identifiable Information (PII). We address this critical challenge by proposing Shadow Unlearning, a novel paradigm of approximate unlearning, that performs machine unlearning on anonymized forget data without exposing PII. We further propose a novel privacy-preserving framework, Neuro-Semantic Projector Unlearning (NSPU) to achieve Shadow unlearning. To evaluate our method, we compile Multi-domain Fictitious Unlearning (MuFU) forget set across five diverse domains and introduce an evaluation stack to quantify the trade-off between knowledge retention and unlearning effectiveness. Experimental results on various LLMs show that NSPU achieves superior unlearning performance, preserves model utility, and enhances user privacy. Additionally, the proposed approach is at least 10x more computationally efficient than standard unlearning approaches. Our findings foster a new direction for privacy-aware machine unlearning that balances data protection and model fidelity.

Figures

Figures reproduced from arXiv: 2601.04275 by Ashok Urlana, Bala Mallikarjunarao Garlapati, Dinesh Srivasthav P, Ponnurangam Kumaraguru, Rahul Mishra.

Figure 1
Figure 1. Figure 1: The paradigm of Shadow Unlearning. Motivation: In a traditional unlearning setup, it is often required to share the retain and forget datasets for facilitating unlearning of the target model. This raises several privacy concerns related to PII. Data anonymization is a de facto way to deal with the pri￾vacy risk. This improves ‘privacy’, nevertheless, dents the ‘utility’, resulting in an ‘ambiguous’ model. … view at source ↗
Figure 2
Figure 2. Figure 2: Neuro-Semantic Projector Unlearning (NSPU) Pipeline comprises three key phases: (i) learning a latent representation aligner that maps anonymized and original activation spaces, (ii) constructing a forget subspace from projected forget activations, and (iii) integrating a linear unlearning filter that suppresses components aligned with the forget subspace during inference. a publicly available corpus. More… view at source ↗
Figure 3
Figure 3. Figure 3: , for any activation vector v ∈ R d , the term UU ⊤v gives its orthogonal projection onto the forget subspace, and [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Layer-wise drift in activation vectors between target model (Mistral-7b-ins) and its unlearned version [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Impact of unlearning on forget and retain datasets before and after applying the unlearning filter (Mistral-7b-ins). Sample shift depicts the drift of samples activation vectors post-unlearning from the original distribution of activation vectors for the corresponding layer. (Best viewed in color) [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: LLM-based evaluation results for the unlearned model on both forget and retain datasets. 6 presents the corresponding entity-wise cosine similarity scores. The results reinforce our hypothesis—NSPU con￾sistently erases the intended entity representations, thereby satisfying the objective of faithful and entity-specific un￾learning while retaining remaining domain knowledge. 5.3. LLM-based evaluation We uti… view at source ↗
Figure 7
Figure 7. Figure 7: T-sne plot of activation vectors distribution of original forget and retain TOFU dataset 30 20 10 0 10 20 30 t-SNE 1 30 20 10 0 10 20 30 t-SNE 2 30 20 10 0 10 20 30 t-SNE 1 20 10 0 10 20 30 t-SNE 3 30 20 10 0 10 20 30 t-SNE 2 20 10 0 10 20 30 t-SNE 3 Syn. Forget TOFU Retain [PITH_FULL_IMAGE:figures/full_fig_p017_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: T-sne plot of activation vectors distribution of TOFU retain set and synthetic forget set B.2. Training the MLP To assess the recoverability of semantic information removed during anonymization, we train a lightweight Multilayer Perceptron (MLP) model designed to reconstruct the embedding of the original text from the embedding of its anonymized counterpart. The MLP is optimized using the mean squared erro… view at source ↗
Figure 9
Figure 9. Figure 9: T-sne plot of activation vectors distribution of synthetic multi-domain forget sets To assess the quality of reconstructing the original embedding yi from its anonymized counterpart, we compute a set of complementary evaluation metrics. 1. Mean Squared Error (MSE). The Mean Squared Error measures the average squared deviation between the true and reconstructed embeddings: MSE = 1 N X N i=1 ∥yi − yˆi∥ 2 2 .… view at source ↗
Figure 10
Figure 10. Figure 10: VRAM usage for designing the unlearning model. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Mistral-7B model domain-wise evaluations, the x-axis represents the 5%, 25%, 50%, 75% synthetic data variations. 5 25 50 75 1.0 1.2 1.4 1.6 1.8 Harmonic Perplexity 5 25 50 75 2.0 1.5 1.0 0.5 0.0 0.5 Combined Efficacy Score 5 25 50 75 0.7 0.8 0.9 1.0 1.1 Harmonic ROUGE 5 25 50 75 0.7 0.8 0.9 1.0 1.1 Conditional Log Probability Digital Informatics Politics Sports Science and Technology Finance and Trading … view at source ↗
Figure 12
Figure 12. Figure 12: OLMoE-1B-7B model domain-wise evaluations, the x-axis represents the 5%, 25%, 50%, 75% synthetic data variations. I. NSPU Performance Across Domains To assess the performance of the proposed NSPU method across various domains for different LLMs, we conduct experiments and report the results in Figures 11, 12, 13, and 14. J. NSPU Performance on Downstream Benchmark Tasks J.1. MMLU [PITH_FULL_IMAGE:figures… view at source ↗
Figure 13
Figure 13. Figure 13: LLaMA-7B model domain-wise evaluations, the x-axis represents the 5%, 25%, 50%, 75% synthetic data variations. 5 25 50 75 1.00 1.02 1.04 1.06 1.08 1.10 1.12 Harmonic Perplexity 5 25 50 75 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 1.1 Combined Efficacy Score 5 25 50 75 0.8 0.9 1.0 1.1 1.2 1.3 Harmonic ROUGE 5 25 50 75 0.91 0.92 0.93 0.94 0.95 0.96 0.97 Conditional Log Probability Digital Informatics Politics Sports … view at source ↗
Figure 14
Figure 14. Figure 14: LLaMA-13B model domain-wise evaluations, the x-axis represents the 5%, 25%, 50%, 75% synthetic data variations. K. Non-member Dataset Creation for MIA To perform the membership inference attack task, we create a novel non-member dataset of 400 samples, which is distinct from the retain and forget data distribution. The corresponding to generate non-member data is detailed in [PITH_FULL_IMAGE:figures/full… view at source ↗
Figure 15
Figure 15. Figure 15: Change in MMLU average accuracy post-unlearning. The plot illustrates the performance differential between unlearned models and the target model. Positive values indicate that general model capabilities were preserved or improved (utility preservation), while negative values signify a degradation in performance [PITH_FULL_IMAGE:figures/full_fig_p030_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Change in ARC-c score post-unlearning. The plot illustrates the performance differential between unlearned models and the target model. Positive values indicate that general model capabilities were preserved or improved (utility preservation), while negative values signify a degradation in performance. Llama-7B Mistral-7B OLMOE-1B-7B Llama-13B 4 3 2 1 0 1 2 TruthfulQA Change (%) GA GD KLM DPO NSPU (Ours) … view at source ↗
Figure 17
Figure 17. Figure 17: Change in TruthfulQA score post-unlearning. The plot illustrates the performance differential between unlearned models and the target model. Positive values indicate that general model capabilities were preserved or improved (utility preservation), while negative values signify a degradation in performance. 32 [PITH_FULL_IMAGE:figures/full_fig_p032_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: Impact of unlearning on forget and retain datasets before and after applying the unlearning filter (Llama-13B). Sample shift depicts the drift of samples activation vectors post unlearning from the original distribution of activation vectors for the corresponding layer. (Best viewed in color) [PITH_FULL_IMAGE:figures/full_fig_p033_18.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

21 extracted references

  1. [1]

    Mean Squared Error (MSE).The Mean Squared Error measures the average squared deviation between the true and reconstructed embeddings: MSE= 1 N NX i=1 ∥yi − ˆyi∥2 2 .(17) 2.Mean Absolute Error (MAE).MAE quantifies the average magnitude of reconstruction error: MAE= 1 N NX i=1 |yi − ˆyi|.(18)

  2. [2]

    correct": fully aligns with Gold Answer meaning, including variants or paraphrases. -

    answer correctness - "correct": fully aligns with Gold Answer meaning, including variants or paraphrases. - "partially correct": somewhat aligns but missing key info. - "incorrect": wrong or unrelated. STEP 2 | Output Format Return strictly valid JSON using exactly this schema (no explanations): { "evaluation":{ "model":{ "answer exists": <0 or 1>, "answe...

    2020

  3. [3]

    Coefficient of Determination (R2).The R2 metric measures the proportion of variance in the original embeddings explained by the reconstructed embeddings: R2 = 1− PN i=1 ∥yi − ˆyi∥2 2PN i=1 ∥yi − ¯y∥2 2 ,(19) where ¯ydenotes the mean embedding over the dataset. Table 7.Domain-wise PII Distribution PII Type Sports Finance Digital Informatics Science Politic...

    1953

  4. [4]

    Cosine Similarity.To measure semantic alignment, we compute cosine similarity between each original and recon- structed embedding: cos(θi) = yi · ˆyi ∥yi∥2 ∥ˆyi∥2 .(20)

  5. [5]

    {question}

    Pearson Correlation.Pearson correlation captures linear correlation between the embedding dimensions of yi and ˆyi: ρi = Cov(yi, ˆyi) σyi σˆyi .(21) 19 A Neuro-Semantic Approach to Fidelity-Preserving Faceless Forgetting in LLMs Table 11.Models used in our experiments. Model name Parameters count Model type Llama-7B 7B Base Mistral-7B-Instruct-v0.1 7B Ins...

    2023

  6. [6]

    - 0 otherwise

    answer exists - 1 if any part answers the question. - 0 otherwise

  7. [7]

    FLOPs for Retraining from Scratch on retain dataset Given that LLaMA 7B was trained on 2 trillion tokens (2×10 12) with 7 billion parameters (7×10 9), and retain dataset consists of 3600 samples each with 512 tokens such that the total number of tokens are (2×10 12) + (3600×512 ). The number of FLOPs for retraining is calculated as: 6×(2×10 12 + 3600×512)...

  8. [8]

    Gradient Ascent: Finetuning for 2000 forget set samples (Each with 512 Tokens and three epochs) • Forward pass FLOPs: 2×2000×512×7×10 9 = 1.4336×10 16 • Backward pass FLOPs (approximately twice the forward pass): 2×(2×2000×512×7×10 9) = 2.8672×10 16 • Total FLOPs per epoch: 1.43×10 16 + 2.86×10 16 = 4.3008×10 16 • Total FLOPs for 3 epochs: (4.3008×10 16)×...

    2000

  9. [9]

    Gradient difference: we perform the finetuning on the Gradient ascent model on 3600 retain set samples each with 512 tokens for five epochs. • Forward pass FLOPs: 2×3600×512×7×10 9 = 2.58048×10 16 • Backward pass FLOPs (approximately twice the forward pass): 2×(2×3600×512×7×10 9) = 5.16096×10 16 • Total FLOPs to finetune on retain data per epoch: 2.58×10 ...

  10. [10]

    1.29024×10 17

    KLM method: It follows the same number FLOPs required for gradient ascent approach. 1.29024×10 17

  11. [11]

    5.16096×10 17

    DPO method: It follows the same number FLOPs required for gradient difference approach. 5.16096×10 17

  12. [12]

    5.16096×10 17

    NPO method: It follows the same number FLOPs required for DPO approach. 5.16096×10 17

  13. [13]

    {retain dataset}

    NSPU Method (Proposed Unlearning Method) Stage 1: •Step 1:FLOPs per forward pass through MLP The MLP consists of 3 linear layers with two ReLU and dropout layers (ReLU and dropout FLOPs considered negligible compared to linear layers). FLOPs for each linear layer computed as: FLOPs≈2×input units×output units Layer 1:2×4096×8192 = 67,108,864 Layer 2:2×8192...

    2021

  14. [14]

    - No thematic, semantic, or contextual overlap is allowed

    Domain Exclusion: - The non-member dataset must not share ANY domain, theme, topic, subject area, or conceptual space with the retain or forget datasets. - No thematic, semantic, or contextual overlap is allowed

  15. [15]

    Content Exclusion: - No author names, book titles, story elements, named entities, or identifiers found in the retain or forget datasets. Continued on next page 28 A Neuro-Semantic Approach to Fidelity-Preserving Faceless Forgetting in LLMs Non-Member Dataset Generation Prompt (Continued) - No reused sentences, paraphrases, writing patterns, stylistic str...

  16. [16]

    Style Separation: - The writing style, vocabulary, grammar, and sentence constructions must be substantially different from both datasets

  17. [17]

    - Question: 1--2 sentences

    Format Specification: - Each sample must be in Question--Answer format. - Question: 1--2 sentences. - Answer: 1--3 sentences

  18. [18]

    - Use neutral, creative, or abstract topics unrelated to either dataset

    Originality Requirement: - All content must be synthetic, novel, and not derived from any part of the retain or forget data. - Use neutral, creative, or abstract topics unrelated to either dataset. OUTPUT FORMAT (MANDATORY): Produce exactly 400 QA pairs using the following format: Q: <question> A: <answer> Do NOT include any explanations, reasoning steps,...

    2025

  19. [19]

    From each set of 20 QA pairs, select exactly 3 QA pairs

  20. [20]

    -- Augment only the question by incorporating relevant contextual information drawn from the remaining 17 QA pairs within the same set

    For each selected QA pair: -- Preserve the original answer without any modification. -- Augment only the question by incorporating relevant contextual information drawn from the remaining 17 QA pairs within the same set. -- The added context must be factually consistent with the original content and strictly derived from the given set (no external facts)

  21. [21]

    original question

    Retain the original question alongside the context-enriched question. Output Format: Produce the final output as a JSONL file, where each line corresponds to one QA pair and follows this schema: Continued on next page 30 A Neuro-Semantic Approach to Fidelity-Preserving Faceless Forgetting in LLMs Prompt for Context-Enriched QA Construction (Continued) "or...

    arXiv 2024