Pith. sign in

REVIEW 4 major objections 5 minor 46 references

Investigating the Feasibility of Mitigating Potential Copyright Infringement via Large Language Model Unlearning

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Repeated unlearning of copyrighted books can stay stable enough to preserve an LLM's general abilities, the paper argues, by combining random-label training noise with weight-selective updates before subtracting a task vector.

desk verdict A useful first pass at sequential unlearning for copyrighted books, with an honest limitations section, but the core unlearning claim rests on a metric the paper itself admits is weak and on single runs with no released artifacts. read the letter →

arxiv 2412.18621 v1 pith:2AU2V5GF submitted 2024-12-16 cs.CL

Guangyao Dou This is my paper · ORCID
classification cs.CL
keywords machineunlearningsequentialcopyrightinfringementlargelanguagemodelstaskvectorsweightsaliencyRougeevaluationtakedown
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that copyright takedown requests can be handled sequentially, one book at a time as requests arrive, without retraining from scratch, and that this can be done much more stably than existing unlearning methods allow. It proposes Stable Sequential Unlearning (SSU), which fine-tunes the current model on the book to forget while adding a random-labeling loss and masking updates to gradient-salient weights, then subtracts the resulting task vector from the model. On Llama-3.1-8B-Instruct and Mistral-7B-Instruct-v0.3, SSU is reported to achieve a better trade-off between lower Rouge-1/Rouge-L scores on targeted books and stable MMLU/MT-Bench performance than Gradient Ascent, Gradient Difference, Task Vector, and NPO baselines, while prompt-based and decoding-time defenses leave infringement risk essentially unchanged. The paper itself hedges: SSU 'sometimes achieves an effective trade-off' and 'is not a cure-all,' and its limitations section concedes that lexical-overlap metrics may create a false sense of privacy if unlearning merely obfuscates data.

What carries the argument

The load-bearing object is the stable task vector: instead of subtracting a task vector computed from a plain forget-set fine-tune, SSU computes it from a fine-tune whose loss mixes the forget cross-entropy with a random-labeling term and whose parameter updates are masked by a gradient-based weight saliency map. The random-labeling loss $L_{\mathrm{rnd}} = \frac{1}{|D_f|} \sum_{(x_{\mathrm{fgt}},\cdot)\in D_f} \sum_{(\cdot,y_{\mathrm{rnd}})\in D_f} L(x_{\mathrm{fgt}}, y_{\mathrm{rnd}}, \theta_t)$ injects controlled noise so the fine-tuned model does not overfit the forget set, and the mask $m_s = \mathbb{1}(|\nabla_\theta L_f(\theta_t)| \ge \gamma)$ confines updates to the weights most relevant to the target data. After this stabilized fine-tuning the method applies the task-vector negation $\theta_u^t = \theta_u^{t-1} - (\theta_{\mathrm{ft}}^t - \theta_u^{t-1})$ to erase the book; this is what lets SSU avoid the catastrophic capability collapse that the ablations show when either component is removed.

What would settle it

Run an adversarial extraction suite on the SSU-unlearned model: for each book in $D_f$, take a held-out 100-token continuation and prompt the model with dozens of paraphrased instructions (continue in the author's style, complete the scene, etc.). If any prompt elicits a completion whose Rouge-1 score matches the vanilla model's, the low scores on the standard prompt are evasion, not forgetting, and the paper's central trade-off claim collapses.

Watch

Extended reading notes

Core claim

The central claim is that sequential unlearning of copyrighted literary works is feasible enough to be worth pursuing as a copyright-takedown remedy, and that SSU is the first method to keep the trade-off between unlearning efficacy and general capability retention favorable across many time steps. At each step $t$ the algorithm fine-tunes the already-unlearned model $\theta_u^{t-1}$ on the forget set $D_f^t$ with objective $L_f = \epsilon_1 L_{\mathrm{fgt}} + \epsilon_2 L_{\mathrm{rnd}}$, where $L_{\mathrm{fgt}}$ is standard cross-entropy and $L_{\mathrm{rnd}}$ randomly mismatches outputs from $D_f$ to inputs from $D_f$; it restricts each gradient update to the mask $m_s = \mathbb{1}(|\nabla_\theta L_f(\theta_t)| \ge \gamma)$, and then unlearns by $\theta_u^t = \theta_u^{t-1} - (\theta_{\mathrm{ft}}^t - \theta_u^{t-1})$. In the reported experiments SSU lands in the top-right region of the unlearning-versus-ability trade-off plots for both models, whereas gradient ascent, gradient difference, and task-vector baselines eventually collapse (MMLU or MT-Bench dropping sharply, sometimes to zero) and NPO leaves Rouge scores near the vanilla model. The paper's own summary is that this trade-off is achieved 'sometimes' and that unlearning is not yet a complete remedy.

Load-bearing premise

The claim that SSU 'unlearns' books rests on treating lower Rouge-1/Rouge-L lexical overlap as evidence of reduced copyright-infringement risk; if the model simply learns to paraphrase or evade the evaluation prompt, the measured unlearning is an artifact of the metric, a possibility the paper itself raises in Section 5.1.

Editorial extensions

If this is right

  • A model that has been through ten sequential SSU unlearning steps can still score within a few points of the vanilla model on MMLU and MT-Bench, while baseline gradient-ascent and task-vector methods collapse to near-zero MMLU by step ten.
  • System-prompt defenses and MemFree decoding do not move Rouge scores materially below the vanilla model, so weight-updating unlearning is the only tested class that meaningfully reduces verbatim reproduction of targeted books.
  • Both SSU components are load-bearing: removing the weight-saliency mask speeds capability decline, and removing the random-labeling loss raises Rouge scores on $D_f$, so the paper's ablations attribute the trade-off to the two mechanisms working together.
  • Because SSU needs no in-distribution retained set and no reference model, it avoids two practical overheads that Gradient Difference and NPO carry, making sequential takedowns cheaper to deploy.
  • The paper's conclusion is that unlearning, even when stabilized, is not a complete copyright-takedown remedy: some non-targeted knowledge and general ability are still lost, so complementary detection-and-regeneration or certified mechanisms are needed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural stress test the paper leaves implicit: run SSU's unlearned model under an adversarial extraction attack with varied prompts, such as 'continue this passage' or style mimicry. If completions recover high-overlap text from $D_f$ while the fixed evaluation prompt keeps Rouge low, the reported unlearning is evasion rather than removal, exactly the risk the limitations section raises.
  • Because the failure mode SSU targets (gradual then sudden capability collapse) also appears in sequential model editing, the weight-saliency-plus-random-label recipe could plausibly transfer to fact-editing or safety-patching pipelines that use task-vector subtraction; testing that transfer would separate the method's general stabilization effect from its copyright-specific design.
  • The 'sometimes' hedge suggests the trade-off may depend on model family, learning-rate schedule, or book length; a systematic sweep across more base models and curricula would reveal the boundary conditions under which SSU falls behind NPO or plain task vectors.
  • Rouge-1/Rouge-L measure n-gram overlap, not semantic reproduction; a stronger evaluation would add semantic-similarity thresholds and membership-inference attacks. Until such metrics are applied, the size of SSU's advantage over baselines should be read as suppression of lexical overlap, not proof of forgetting.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper investigates sequential machine unlearning as a remedy for LLM copyright infringement. It proposes Stable Sequential Unlearning (SSU), which at each time step fine-tunes the current model on the book to forget plus a random-labeling loss, masks parameter updates with a gradient-based saliency map, and then negates the resulting task vector. Experiments on Llama-3.1-8B-Instruct and Mistral-7B-Instruct-v0.3 compare SSU against prompting, MemFree decoding, gradient ascent, gradient difference, task-vector negation, and NPO over 10 (or 6) books, measuring Rouge-1/Rouge-L on forget/previous/non-target books and MMLU/MT-Bench. The paper reports that SSU provides a favorable, or sometimes favorable, trade-off between unlearning efficacy and retention, while several baselines suffer catastrophic collapse, and it includes ablations of the two SSU components.

Significance. If the central empirical claim holds, SSU is a practical contribution: it addresses a realistic sequential takedown scenario, does not require a retained in-distribution dataset unlike gradient difference, and avoids catastrophic collapse while reducing lexical overlap with targeted books. The paper also makes a useful step by formalizing sequential unlearning for copyrighted text and by reporting results on two 7-8B instruction-tuned models over multiple books, with code released. It deserves credit for candidly stating in Section 5.1 that the evaluation metrics can create a false sense of privacy and that unlearning methods may merely obfuscate data. However, because the trade-off claim is built entirely on Rouge scores and single-run measurements, the significance is conditional on stronger evidence that the observed reductions reflect genuine, non-recoverable forgetting rather than output obfuscation.

major comments (4)
  1. [§5.1, Eq. (4.18)] The paper's central claim that SSU achieves a better unlearning/retention trade-off is supported only by Rouge-1 and Rouge-L on Df and Dprev. Section 5.1 explicitly acknowledges that verbatim-memorization metrics can create a false sense of privacy and that existing unlearning/editing methods may merely obfuscate data rather than remove it. Since all comparisons of unlearning efficacy in Figures 4.1a/b, 4.2a/b, and 4.3 use these lexical-overlap scores, a model that produces evasive, generic, or degraded continuations would appear to 'unlearn' without actually removing the ability to reproduce the book under other prompts or decoding settings. The reported effects are also small (e.g., Table 4.7, Df Rouge-1: SSU 0.2532 vs. vanilla 0.2678; Table 4.13, Df Rouge-1: SSU 0.2204 vs. NPO 0.2448), so mild obfuscation could change the ranking. Adding membership-inference or extraction-style probes, paraphrase robustness checks, and prompt-variation tests is necessary to substantiate the trade-off claim; absent that, the headline conclusion remains conditional on the very metric the manuscript disowns.
  2. [§4.3.4, Tables 4.1–4.16] Every numeric result is a single run with no error bars, repeated seeds, or significance tests. The trade-off plots in Figure 4.3 compare point estimates across methods and time steps; without variance, the apparent superiority of SSU over NPO (e.g., MMLU in Tables 4.3–4.5) cannot be distinguished from noise, especially given differences of only 0.01–0.03 in Rouge scores. The paper should report at least three seeds with confidence intervals or paired tests and should specify whether the same checkpoints are used for all evaluations. This is essential because the paper's own contribution is an empirical trade-off claim, not a theoretical guarantee.
  3. [§3.2.1, Eq. (3.3)] The random labeling loss is not well-defined as written. The summation indices are incomplete ('(xfgt,)' and '(,yrnd)'), and it is unclear whether each input is paired with one randomly drawn label per batch, whether labels are drawn with replacement over the full Df, and whether the same random pairing is used across epochs. Since the ablation in Section 4.4.2 credits this loss with improving unlearning consistency, the exact sampling procedure is part of the method and must be specified precisely for reproducibility.
  4. [§3.2.1, Eqs. (3.5)–(3.6)] The weight saliency mask is computed as an element-wise threshold on ∇θLf(θt), but the description then says the masked update is applied 'at each gradient accumulation step.' The paper does not say whether the mask is recomputed after each update or frozen for the whole fine-tuning phase; a stale mask would limit the analogy to existing saliency-based unlearning methods. In addition, the threshold γ is defined only as '1 standard deviation away from the mean of the gradient vector,' which is ambiguous about which gradient vector and which axes (all parameters vs. per-module). This should be clarified, since the Section 4.4.1 ablation attributes preservation of general abilities to the mask.
minor comments (5)
  1. [Chapter 1, §4.3.1, §4.3.2] There are several typos: 'unleaning' in Chapter 1, 'for for' in §4.3.1, 'Dnrr' in §4.3.2, and 'Lora' should be 'LoRA'.
  2. [Tables 4.1 and 4.11] Dprev values at time step 1 are reported as all zeros, but there is no previously unlearned book at time step 1; these entries should be marked N/A or omitted rather than treated as zero Rouge scores.
  3. [Figure 4.3 caption] The caption says TV collapsed at time step 3 for Mistral-7B, but Table 4.15 shows TV's collapse at time step 5 and §4.3.1 also states time step 5; the caption should be corrected.
  4. [Abstract vs. §4.3.4] The abstract hedges that SSU 'sometimes achieves an effective trade-off,' while §4.3.4 asserts without qualification that SSU achieves a better trade-off; the claims should be aligned with the evidence and with Section 5.1's caveats.
  5. [§4.5.2, Table 4.14] The text says GA collapses at the first time step for Mistral, but Tables 4.11–4.13 report nonzero GA scores and collapse to exactly zero only at time step 4; a precise collapse criterion would avoid ambiguity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the SSU trade-off is an empirical comparison against external benchmarks, and the Rouge-metric caveat in Section 5.1 is a validity limitation, not a circular reduction.

full rationale

The derivation chain for SSU is self-contained. The method in Section 3.2 is defined by a cross-entropy forget loss, a random-labeling loss, a gradient-saliency mask, and task-vector negation; none of these objectives is the evaluation metric. The trade-off claim in Section 4.3.4 (Eqs. 4.18-4.19) is measured against external Rouge-1/Rouge-L, MMLU, and MT-Bench scores, and the SSU hyperparameters (epsilon_1 = 1, epsilon_2 = 0.5, gamma = one standard deviation of the gradient) are fixed constants rather than values fit to those metrics. The self-citations (e.g., Dou et al. 2024; Liu et al. 2024c/f) appear in the literature review and are not load-bearing: the catastrophic-collapse behavior they describe is also demonstrated in this thesis's own tables, so the central comparison does not reduce to a self-citation chain. The real weakness is construct validity, not circularity: Section 5.1 explicitly concedes that lexical metrics 'can create a false sense of privacy' and that unlearning methods 'may merely obfuscate data rather than achieve genuine unlearning.' This caveat undermines the real-world inference from lower Rouge to reduced copyright risk, but it does not make the empirical comparison equivalent to the method's inputs or to a fitted parameter. No equation in the paper is equal to its input by construction, and no prediction is a renamed fit; therefore the circularity score is 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on five unproven premises: task-vector negation erases knowledge rather than corrupting it, random-label loss stabilizes rather than randomizes, saliency masks target the correct weights, Gutenberg books proxied by one-epoch fine-tuning behave like real copyrighted content, and Rouge scores measure infringement. None of these is machine-checked or validated against a retrained gold model.

free parameters (4)
  • epsilon1 (forget loss weight) = 1.0
    Hand-set in Eq. 3.4 for all models and time steps; no sensitivity analysis is reported.
  • epsilon2 (random labeling loss weight) = 0.5
    Hand-set in Eq. 3.4; no sensitivity analysis is reported.
  • gamma (saliency threshold) = one standard deviation above the mean of the gradient vector
    Threshold in Eq. 3.5, chosen heuristically; no tuning study is provided.
  • learning rate schedule = 1e-5 for early steps, 1e-6 for later steps
    Set separately for Llama3.1 and Mistral-7B in Section 4.2.6; hand-chosen.
assumptions (5)
  • domain assumption Task vector negation removes learned knowledge from the model.
    Eq. 3.7 and 3.8 rely on the task arithmetic principle from Ilharco et al. (2022); the thesis does not prove it applies in the sequential setting.
  • ad hoc to paper Random labeling loss stabilizes unlearning.
    Eq. 3.3 introduces random label matching; the paper motivates it by analogy to noise injection but provides no theoretical basis.
  • domain assumption Gradient-based weight saliency restricts destructive weight updates.
    Eq. 3.5 and 3.6 use a gradient-magnitude mask, following Fan et al. (2023); the thesis assumes the most salient weights for forgetting are the right ones to update.
  • domain assumption Project Gutenberg books plus one-epoch fine-tuning make a valid proxy for copyrighted content memorized by the model.
    Section 4.1.3 chooses public domain books as stand-ins and fine-tunes the models on them for one epoch; real-world infringement dynamics may differ.
  • domain assumption Rouge-1 and Rouge-L capture copyright infringement risk.
    Section 4.1.2 uses lexical overlap as the outcome; Section 5.1 concedes this may create a false sense of privacy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Investigating the Feasibility of Mitigating Potential Copyright Infringement via Large Language Model Unlearning." pith.science (2026). https://pith.science/paper/2AU2V5GF

@misc{pith2026241218621,
  author       = {Pith},
  title        = {Pith review of: Investigating the Feasibility of Mitigating Potential Copyright Infringement via Large Language Model Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2AU2V5GF}},
  note         = {Machine review of arXiv:2412.18621}
}
read the original abstract

Pre-trained Large Language Models (LLMs) have demonstrated remarkable capabilities but also pose risks by learning and generating copyrighted material, leading to significant legal and ethical concerns. In a potential real-world scenario, model owners may need to continuously address copyright infringement in order to address requests for content removal that emerge at different time points. One potential way of addressing this is via sequential unlearning, where copyrighted content is removed sequentially as new requests arise. Despite its practical relevance, sequential unlearning in the context of copyright infringement has not been rigorously explored in existing literature. To address this gap, we propose Stable Sequential Unlearning (SSU), a novel framework designed to unlearn copyrighted content from LLMs over multiple time steps. Our approach works by identifying and removing specific weight updates in the model's parameters that correspond to copyrighted content using task vectors. We improve unlearning efficacy by introducing random labeling loss and ensuring the model retains its general-purpose knowledge by adjusting targeted parameters with gradient-based weight saliency. Extensive experimental results show that SSU sometimes achieves an effective trade-off between unlearning efficacy and general-purpose language abilities, outperforming existing baselines, but it's not a cure-all for unlearning copyrighted material.

Figures

Figures reproduced from arXiv: 2412.18621 by the authors.

Figure 1
Figure 1. FIGURE 1.1 An example of a GPT model generating substantially similar copyrighted con [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗
Figure 4
Figure 4. FIGURE 4.1 The average of Rouge-1 and Rouge-l and benchmark scores for LLaMA3.1: (a) [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 1.1
Figure 1.1. An example of a GPT model generating substantially similar copyrighted content from [PITH_FULL_IMAGE:figures/full_fig_p012_1_1.png] view at source ↗
Figures from the paper (6 more)
Figure 3.1
Figure 3.1. Figure 3.1: Overall process of our unlearning framework. (a) At each time step t, an unlearning request is received to forget the dataset Dt f . The unlearning algorithm involves first fine-tuning θ t−1 u on Dt f to obtain θ t f t, and then subtracting the task vector from previ…
Figure 4.1
Figure 4.1. Figure 4.1: The average of Rouge-1 and Rouge-l and benchmark scores for LLaMA3.1: (a) books to [PITH_FULL_IMAGE:figures/full_fig_p033_4_1.png]
Figure 4.2
Figure 4.2. Figure 4.2: The average of Rouge-1 and Rouge-l score and reasoning abilities for Mistral-7B-Instruct: [PITH_FULL_IMAGE:figures/full_fig_p034_4_2.png]
Figure 4.3
Figure 4.3. Figure 4.3: Trade-off between general-purpose language abilities and unlearning efficacy for [PITH_FULL_IMAGE:figures/full_fig_p037_4_3.png]
Figure 4.4
Figure 4.4. Figure 4.4: Ablation study of SSU for Llama3.1-8B-Instruct. The orange line represents unlearning [PITH_FULL_IMAGE:figures/full_fig_p038_4_4.png]
Figure 4.5
Figure 4.5. Figure 4.5: Ablation study of SSU for Mistral-7B-Instruct-v0.3. The orange line represents unlearn [PITH_FULL_IMAGE:figures/full_fig_p038_4_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 2 canonical work pages

  1. [5]

    Tackling Copyright Issues in AI Image Generation Through Originality Estimation and Genericization

    Hiroaki Chiba-Okabe and Weijie J Su. Tackling genai copyright issues: Originality estimation and genericization. arXiv preprint arXiv:2406.03341,

    work page Pith review arXiv

  2. [6]

    Unmemo- rization in large language models via self-distillation and deliberate imagination.arXiv preprint arXiv:2402.10052,

    Yijiang River Dong, Hongzhou Lin, Mikhail Belkin, Ramon Huerta, and Ivan Vulić. Unmemo- rization in large language models via self-distillation and deliberate imagination.arXiv preprint arXiv:2402.10052,

    arXiv

  3. [7]

    Avoiding copyright infringe- ment via machine unlearning.arXiv preprint arXiv:2406.10952,

    Guangyao Dou, Zheyuan Liu, Qing Lyu, Kaize Ding, and Eric Wong. Avoiding copyright infringe- ment via machine unlearning.arXiv preprint arXiv:2406.10952,

    arXiv

  4. [8]

    Do membership inference attacks work on large language models?arXiv preprint arXiv:2402.07841,

    Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models?arXiv preprint arXiv:2402.07841,

    arXiv

  5. [9]

    De-cop: Detecting copyrighted content in language models training data.arXiv preprint arXiv:2402.09910,

    André V Duarte, Xuandong Zhao, Arlindo L Oliveira, and Lei Li. De-cop: Detecting copyrighted content in language models training data.arXiv preprint arXiv:2402.09910,

    arXiv

  6. [10]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783,

    arXiv

  7. [12]

    Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation

    Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310.12508,

    arXiv

  8. [13]

    Meta-unlearning on diffusion models: Preventing relearning unlearned concepts.arXiv preprint arXiv:2410.12777,

    Hongcheng Gao, Tianyu Pang, Chao Du, Taihang Hu, Zhijie Deng, and Min Lin. Meta-unlearning on diffusion models: Preventing relearning unlearned concepts.arXiv preprint arXiv:2410.12777,

    arXiv

Show all 46 references
  1. [14]

    Attribute-to-delete: Machine unlearning via datamodel matching.arXiv preprint arXiv:2410.23232,

    39 Kristian Georgiev, Roy Rinberg, Sung Min Park, Shivam Garg, Andrew Ilyas, Aleksander Madry, and Seth Neel. Attribute-to-delete: Machine unlearning via datamodel matching.arXiv preprint arXiv:2410.23232,

    arXiv

  2. [16]

    Model editing at scale leads to gradual and catastrophic forgetting.arXiv preprint arXiv:2401.07453, 2024a

    Akshat Gupta, Anurag Rao, and Gopala Anumanchipalli. Model editing at scale leads to gradual and catastrophic forgetting.arXiv preprint arXiv:2401.07453, 2024a. Akshat Gupta, Dev Sajnani, and Gopala Anumanchipalli. A unified framework for model editing. arXiv preprint arXiv:24...

    arXiv

  3. [17]

    Measuring massive multitask language understanding

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300,

    2009 arXiv

  4. [18]

    Model editing with canonical examples.arXiv preprint arXiv:2402.06155, 2024a

    John Hewitt, Sarah Chen, Lanruo Lora Xie, Edward Adams, Percy Liang, and Christopher D Manning. Model editing with canonical examples.arXiv preprint arXiv:2402.06155, 2024a. John Hewitt, Nelson F Liu, Percy Liang, and Christopher D Manning. Instruction following without instru...

    arXiv

  5. [20]

    Demystifying verbatim memorization in large language models

    40 Jing Huang, Diyi Yang, and Christopher Potts. Demystifying verbatim memorization in large language models. arXiv preprint arXiv:2407.17817,

    arXiv

  6. [21]

    Editing models with task arithmetic

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089,

    arXiv

  7. [22]

    Preventing verbatim memorization in language models gives a false sense of privacy.arXiv preprint arXiv:2210.17546,

    Daphne Ippolito, Florian Tramèr, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher A Choquette-Choo, and Nicholas Carlini. Preventing verbatim memorization in language models gives a false sense of privacy.arXiv preprint arXiv:2210.17546,

    arXiv

  8. [23]

    Knowledge unlearning for mitigating privacy risks in language models

    Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504,

    arXiv

  9. [24]

    Mistral 7b

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:2310.06825,

    arXiv

  10. [25]

    Copyright violations and large language models

    Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Søgaard. Copyright violations and large language models. arXiv preprint arXiv:2310.13771,

    arXiv

  11. [26]

    The wmdp benchmark: Measuring and reducing malicious use with unlearning.arXiv preprint arXiv:2403.03218,

    Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The wmdp benchmark: Measuring and reducing malicious use with unlearning.arXiv preprint arXiv:2403.03218,

    arXiv

  12. [28]

    Tofu: A task of fictitious unlearning for llms.arXiv preprint arXiv:2401.06121,

    Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter. Tofu: A task of fictitious unlearning for llms.arXiv preprint arXiv:2401.06121,

    arXiv

  13. [29]

    Copyright traps for large language models.arXiv preprint arXiv:2402.09363,

    Matthieu Meeus, Igor Shilov, Manuel Faysse, and Yves-Alexandre de Montjoye. Copyright traps for large language models.arXiv preprint arXiv:2402.09363,

    arXiv

  14. [30]

    Mass-editing memory in a transformer.arXiv preprint arXiv:2210.07229,

    Kevin Meng, Arnab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. Mass-editing memory in a transformer.arXiv preprint arXiv:2210.07229,

    arXiv

  15. [31]

    Silo language models: Isolating legal risk in a nonparametric datastore

    Sewon Min, Suchin Gururangan, Eric Wallace, Hannaneh Hajishirzi, Noah A Smith, and Luke Zettlemoyer. Silo language models: Isolating legal risk in a nonparametric datastore. arXiv preprint arXiv:2308.04430,

    arXiv

  16. [32]

    Adversarial training methods for semi- supervised text classification.arXiv preprint arXiv:1605.07725,

    Takeru Miyato, Andrew M Dai, and Ian Goodfellow. Adversarial training methods for semi- supervised text classification.arXiv preprint arXiv:1605.07725,

    arXiv

  17. [34]

    Adding gradient noise improves learning for very deep networks.arXiv preprint arXiv:1511.06807,

    Arvind Neelakantan, Luke Vilnis, Quoc V Le, Ilya Sutskever, Lukasz Kaiser, Karol Kurach, and James Martens. Adding gradient noise improves learning for very deep networks.arXiv preprint arXiv:1511.06807,

    arXiv

  18. [37]

    Muse: Machine unlearning six-way evaluation for language models.arXiv preprint arXiv:2407.06460,

    Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang. Muse: Machine unlearning six-way evaluation for language models.arXiv preprint arXiv:2407.06460,

    arXiv

  19. [40]

    Evaluating copyright takedown methods for language models.arXiv preprint arXiv:2406.18664,

    Boyi Wei, Weijia Shi, Yangsibo Huang, Noah A Smith, Chiyuan Zhang, Luke Zettlemoyer, Kai Li, and Peter Henderson. Evaluating copyright takedown methods for language models.arXiv preprint arXiv:2406.18664,

    arXiv

  20. [41]

    Model merging in llms, mllms, and beyond: Methods, theories, applications and opportunities

    Enneng Yang, Li Shen, Guibing Guo, Xingwei Wang, Xiaochun Cao, Jie Zhang, and Dacheng Tao. Model merging in llms, mllms, and beyond: Methods, theories, applications and opportunities. arXiv preprint arXiv:2408.07666, 2024a. Tianyu Yang, Lisen Dai, Zheyuan Liu, Xiangqi Wang, Me...

    arXiv

  21. [42]

    Large language model unlearning

    Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning. arXiv preprint arXiv:2310.10683,

    arXiv

  22. [43]

    A closer look at machine unlearning for large language models.arXiv preprint arXiv:2410.08109,

    Xiaojian Yuan, Tianyu Pang, Chao Du, Kejiang Chen, Weiming Zhang, and Min Lin. A closer look at machine unlearning for large language models.arXiv preprint arXiv:2410.08109,

    arXiv

  23. [44]

    Towards certified unlearning for deep neural networks.arXiv preprint arXiv:2408.00920, 2024a

    Binchi Zhang, Yushun Dong, Tianhao Wang, and Jundong Li. Towards certified unlearning for deep neural networks.arXiv preprint arXiv:2408.00920, 2024a. Chiyuan Zhang, Daphne Ippolito, Katherine Lee, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. Counterfactual memoriz...

    arXiv

  24. [45]

    Negative preference optimization: From catas- trophic collapse to effective unlearning.arXiv preprint arXiv:2404.05868, 2024b

    Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. Negative preference optimization: From catas- trophic collapse to effective unlearning.arXiv preprint arXiv:2404.05868, 2024b. Weixiang Zhao, Yulin Hu, Zhuojun Li, Yang Deng, Yanyan Zhao, Bing Qin, and Tat-Seng Chua. Towards compr...

    arXiv

  25. [46]

    Making harmful behaviors unlearnable for large language models.arXiv preprint arXiv:2311.02105,

    Xin Zhou, Yi Lu, Ruotian Ma, Tao Gui, Qi Zhang, and Xuanjing Huang. Making harmful behaviors unlearnable for large language models.arXiv preprint arXiv:2311.02105,

    arXiv

  26. [2004]

    Infini-gram: Scaling unbounded n-gram language models to a trillion tokens.arXiv preprint arXiv:2401.17377, 2024a

    Jiacheng Liu, Sewon Min, Luke Zettlemoyer, Yejin Choi, and Hannaneh Hajishirzi. Infini-gram: Scaling unbounded n-gram language models to a trillion tokens.arXiv preprint arXiv:2401.17377, 2024a. Xiaoze Liu, Ting Sun, Tianyang Xu, Feijie Wu, Cunxiang Wang, Xiaoqian Wang, and Ji...

    2024 arXiv

  27. [2006]

    Who’s harry potter? approximate unlearning in llms.arXiv preprint arXiv:2310.02238,

    Ronen Eldan and Mark Russinovich. Who’s harry potter? approximate unlearning in llms.arXiv preprint arXiv:2310.02238,

    arXiv

  28. [2014]

    Llama 2: Open founda- tion and fine-tuned chat models.arXiv preprint arXiv:2307.09288,

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models.arXiv preprint arXiv:2307.09288,

    arXiv

  29. [2015]

    Unlearning graph classifiers with limited data re- sources

    42 Chao Pan, Eli Chien, and Olgica Milenkovic. Unlearning graph classifiers with limited data re- sources. In Proceedings of the ACM Web Conference 2023, pages 716–726,

    2023

  30. [2016]

    Scalable extraction of training data from (production) language models

    Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tramèr, and Katherine Lee. Scalable extraction of training data from (production) language models. arXiv preprint arXiv:2311.17035,

    arXiv

  31. [2017]

    Dropout: a simple way to prevent neural networks from overfitting

    Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research, 15(1):1929–1958,

    1929

  32. [2018]

    Can sensitive information be deleted from llms? objectives for defending against extraction attacks.arXiv preprint arXiv:2309.17410,

    Vaidehi Patil, Peter Hase, and Mohit Bansal. Can sensitive information be deleted from llms? objectives for defending against extraction attacks.arXiv preprint arXiv:2309.17410,

    arXiv

  33. [2019]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685,

    arXiv

  34. [2020]

    Rebuilding rome: Resolving model collapse during sequential model editing.arXiv preprint arXiv:2403.07175,

    Akshat Gupta and Gopala Anumanchipalli. Rebuilding rome: Resolving model collapse during sequential model editing.arXiv preprint arXiv:2403.07175,

    arXiv

  35. [2021]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. arXiv preprint arXiv:2202.07646,

    arXiv

  36. [2022]

    Trustworthy, responsible, and safe ai: A comprehensive architectural framework for ai safety with challenges and mitiga- tions

    Chen Chen, Ziyao Liu, Weifeng Jiang, Si Qi Goh, and KwoK-Yan Lam. Trustworthy, responsible, and safe ai: A comprehensive architectural framework for ai safety with challenges and mitiga- tions. arXiv preprint arXiv:2408.12935,

    arXiv

  37. [2023]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877–1901,

    1901

  38. [2024]

    Unlearn what you want to forget: Efficient unlearning for llms.arXiv preprint arXiv:2310.20150,

    Jiaao Chen and Diyi Yang. Unlearn what you want to forget: Efficient unlearning for llms.arXiv preprint arXiv:2310.20150,

    arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.