Pith. sign in

REVIEW 56 cited by

Who's Harry Potter? Approximate Unlearning in LLMs

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2310.02238 v2 pith:BLIM427O submitted 2023-10-03 cs.CL cs.AI

Ronen Eldan , Mark Russinovich This is my paper
classification cs.CLcs.AI
keywords modelunlearningdatatargettechniqueharrylabelslanguage
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Large language models (LLMs) are trained on massive internet corpora that often contain copyrighted content. This poses legal and ethical challenges for the developers and users of these models, as well as the original authors and publishers. In this paper, we propose a novel technique for unlearning a subset of the training data from a LLM, without having to retrain it from scratch. We evaluate our technique on the task of unlearning the Harry Potter books from the Llama2-7b model (a generative language model recently open-sourced by Meta). While the model took over 184K GPU-hours to pretrain, we show that in about 1 GPU hour of finetuning, we effectively erase the model's ability to generate or recall Harry Potter-related content, while its performance on common benchmarks (such as Winogrande, Hellaswag, arc, boolq and piqa) remains almost unaffected. We make our fine-tuned model publicly available on HuggingFace for community evaluation. To the best of our knowledge, this is the first paper to present an effective technique for unlearning in generative language models. Our technique consists of three main components: First, we use a reinforced model that is further trained on the target data to identify the tokens that are most related to the unlearning target, by comparing its logits with those of a baseline model. Second, we replace idiosyncratic expressions in the target data with generic counterparts, and leverage the model's own predictions to generate alternative labels for every token. These labels aim to approximate the next-token predictions of a model that has not been trained on the target data. Third, we finetune the model on these alternative labels, which effectively erases the original text from the model's memory whenever it is prompted with its context.

Discussion (0). Sign in to comment.

Forward citations

Cited by 56 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearning

    cs.CL 2026-07 conditional novelty 8.0 of 10

    LACUNA is a new testbed that injects PII into predefined model parameters to benchmark the localization precision of LLM unlearning methods, revealing that SOTA approaches are imprecise despite strong output performance.

  2. Defenses at Odds: Measuring and Explaining Defense Conflicts in Large Language Models

    cs.CR 2026-05 conditional novelty 8.0 of 10

    Sequential LLM defense deployment leads to risk exacerbation in 38.9% of cases due to anti-aligned updates in shared critical layers, addressed by conflict-guided layer freezing.

  3. DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning

    cs.LG 2026-05 conditional novelty 8.0 of 10

    INT4 quantization recovers up to 22 times more forgotten training data in unlearned LLMs, and the proposed DURABLEUN-SAF method is the first to maintain forgetting across BF16, INT8, and INT4 precisions.

  4. Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning

    cs.LG 2024-04 conditional novelty 8.0 of 10

    NPO enables stable unlearning of 50%+ training data in LLMs on TOFU by making collapse exponentially slower than gradient ascent, preserving sensible outputs where prior methods fail.

  5. Crossing the Margin Cliff: Toward Relearn-Robust LLM Unlearning via Margin Calibration

    cs.AI 2026-07 conditional novelty 7.0 of 10

    Margin Calibration, a non-saturating margin-anchored LoRA polish, crosses the margin cliff and cuts post-attack relearn recovery on all 97 populated cells in the paper's stress matrix.

  6. Unlearning as Distribution Restoration: A Controlled Counterfactual Study, a Validated Selective Screen, and the Limits of Oracle-Free Certification

    cs.LG 2026-07 conditional novelty 7.0 of 10

    Matching a retrained oracle on trained probes can certify models that still retain held-out forget knowledge, and oracle-free unlearning certification is only possible for counterfactual, non-inferable facts.

  7. Forget Narrowly, Retain Broadly: Unlearning as an Asymmetric Generalization Problem

    cs.LG 2026-07 accept novelty 7.0 of 10

    SUITE defines the forget-retain boundary at semantic, syntactic and lexical levels; training on it plus JensUn++ yields near-complete forgetting with minimal retain and utility loss.

  8. Revocable Learned State via Process Sidecars

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    Process sidecars use a secant-based two-parameter edit to achieve second-order accurate memory revocation after safety training, outperforming scalar task arithmetic on refusal tasks across three models.

  9. TimeROME-DLM: Temporal Causal Tracing and Low-Rank Inference-Time Knowledge Editing for Masked Diffusion Language Models

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    TimeROME-DLM enables training-free knowledge editing in masked diffusion language models via temporal causal tracing and low-rank residual edit memory applied at inference time.

  10. REMEDI: A Benchmark for Retention and Unlearning Evaluation in Multi-label Clinical Disease Inference

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    REMEDI is a new benchmark for evaluating machine unlearning in multi-label clinical disease inference on MIMIC-III data that reveals trade-offs in existing methods.

  11. TRACER: Token ReAssignment for Concept ERasure in Generative Recommendation

    cs.IR 2026-06 unverdicted novelty 7.0 of 10

    TRACER uses token reassignment for concept-related items plus a coherence regularizer to unlearn specific concepts in generative recommendation while preserving utility better than baselines.

  12. Exact Unlearning in Reinforcement Learning

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    For any ρ>0 there exists a ρ-TV-stable RL algorithm for tabular MDPs supporting exact unlearning at expected cost ρ√(ln T) of retraining from scratch, with regret O(H²√(SAT)+H³S²A+H^{2.5}S²A/ρ) and matching lower boun...

  13. Initialization is Half the Battle: Generating Diverse Images from a Guidance Potential Posterior

    cs.CV 2026-06 unverdicted novelty 7.0 of 10

    DivIn samples initial noise from a guidance potential posterior via Langevin dynamics to improve diversity in class-to-image and text-to-image generation.

  14. DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning

    cs.LG 2026-05 unverdicted novelty 7.0 of 10

    INT4 quantization recovers forgotten data in unlearned LLMs up to 22x, exposing a trilemma with no existing method solving forgetting, utility, and robustness together; a new sharpness-aware method achieves cross-prec...

  15. Revisiting Privacy Leakage in Machine Unlearning: Membership Inference Beyond the Forgotten Set

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    TC-UMIA is a population-level attack using pre- and post-unlearning predictions to infer membership across forget, retain, and unseen sets, revealing added privacy leakage to retained data.

  16. Revisiting Privacy Leakage in Machine Unlearning: Membership Inference Beyond the Forgotten Set

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    Unlearning increases privacy leakage for the retain set, and a new tri-class membership inference attack distinguishes forget, retain, and unseen data using pre- and post-unlearning model outputs.

  17. Improving LLM Unlearning Robustness via Random Perturbations

    cs.CL 2025-01 unverdicted novelty 7.0 of 10

    LLM unlearning is reframed as inadvertently installing backdoor triggers on forget-tokens; Random Noise Augmentation is introduced as a defense that improves robustness with theoretical guarantees.

  18. Detecting Pretraining Data from Large Language Models

    cs.CL 2023-10 conditional novelty 7.0 of 10

    Min-K% Prob detects pretraining data in LLMs by flagging outlier low-probability words in text, achieving 7.4% better performance than prior methods on the new WIKIMIA benchmark.

  19. Metis: Memory Foundation Model

    cs.CL 2026-07 conditional novelty 6.5 of 10

    Metis equips frozen LLMs with gradient-free native memory states and mid-trained store/use procedures that beat no-context parametric baselines on short memory tasks but still lag full context and degrade over long tr...

  20. Exploring and Bridging Knowledge Holes in Unlearned Multimodal Large Language Models

    cs.AI 2026-08 conditional novelty 6.0 of 10

    Knowledge holes, severe response degradation on benign inputs that share patterns with forgotten content, are shown to exist in unlearned multimodal LLMs and are partially repaired by SPAR on LLaVA-1.5-7B.

  21. Understanding Machine Unlearning Through the Lens of Mode Connectivity

    cs.LG 2026-07 conditional novelty 6.0 of 10

    Unlearned models often lie in connected low-loss basins, and that geometry can predict unlearning difficulty and improve robustness to relearning attacks.

  22. Understanding Machine Unlearning Through the Lens of Mode Connectivity

    cs.LG 2026-07 unverdicted novelty 6.0 of 10

    Unlearned models usually connect to their originals by smooth low-loss paths, and the smoothness of that path can predict how hard the unlearning task was.

  23. Stochastic Meta-Unlearning: Bridging Language Backbone and Multimodal Unlearning

    cs.CL 2026-07 conditional novelty 6.0 of 10

    A bilevel meta-training method aligns text-only backbone unlearning with full vision-language model forgetting, improving forget-retain trade-offs across two VLMs and two meme datasets.

  24. Targeted Recovery of Weight-Space Mechanisms From Neural Networks

    cs.LG 2026-06 conditional novelty 6.0 of 10

    A targeted decomposition method recovers the weight-space mechanisms behind specific inputs at low FLOPs, enabling focused ablation and rewiring of a 12-block transformer.

  25. Fast Unlearning at Scale via Margin Self-Correction

    cs.LG 2026-06 unverdicted novelty 6.0 of 10

    MASC achieves competitive forget-retain trade-offs in language model unlearning at lower computational cost via margin self-correction and an online stopping criterion on TOFU, MUSE News, and MUSE Books.

  26. How Hard Can It Be? Hardness-Aware Multi-Objective Unlearning

    cs.LG 2026-06 unverdicted novelty 6.0 of 10

    HAMU is a constrained-optimization unlearning method that uses forget-retain data similarity as a hardness measure to guarantee specified forget-quality gains while minimizing retain degradation.

  27. Visual-Noise Guided In-Context Distillation for Multimodal Large Language Model Unlearning

    cs.CV 2026-05 unverdicted novelty 6.0 of 10

    VGID constructs an intervention-induced teacher distribution via visual perturbation plus textual in-context unlearning and distills it into the student MLLM to achieve parameter-level forgetting.

  28. Pretraining Data Exposure in Large Language Models: A Survey of Membership Inference, Data Contamination, and Security Implications

    cs.CL 2026-05 unverdicted novelty 6.0 of 10

    First unified survey formalizing Pretraining Data Exposure across exposure levels and reviewing attack, defense, and contamination methods for LLMs.

  29. Auditing Reasoning-Trace Memorization Claims after Unlearning with Head-Conditioned Canaries

    cs.LG 2026-05 conditional novelty 6.0 of 10

    Swapping the reasoning trace prefill on unlearned weights can replicate or reverse the parser-split bypass gap, showing that the gap alone does not identify or rule out weight-level memorization.

  30. ZeroUnlearn: Few-Shot Knowledge Unlearning in Large Language Models

    cs.LG 2026-05 unverdicted novelty 6.0 of 10

    ZeroUnlearn reformulates machine unlearning as knowledge re-mapping via model editing, using multiplicative updates with closed-form solutions for efficient few-shot removal of sensitive representations while preservi...

  31. Probe-Geometry Alignment: Erasing the Cross-Sequence Memorization Signature Below Chance

    cs.LG 2026-05 unverdicted novelty 6.0 of 10

    Probe-geometry alignment erases cross-sequence memorization signatures in LLMs below chance using per-depth rank-one activation interventions with negligible impact on zero-shot capabilities.

  32. Unlearning What Matters: Token-Level Attribution for Precise Language Model Unlearning

    cs.CL 2026-05 unverdicted novelty 6.0 of 10

    TokenUnlearn identifies critical tokens via masking and entropy signals then applies hard selection or soft weighting to unlearn only those tokens, yielding better forgetting and retained utility than sequence-level b...

  33. Separable Expert Architecture: Toward Privacy-Preserving LLM Personalization via Composable Adapters and Deletable User Proxies

    cs.AI 2026-04 unverdicted novelty 6.0 of 10

    A separable expert architecture uses base models, LoRA adapters, and deletable per-user proxies to enable privacy-preserving personalization and deterministic unlearning in LLMs.

  34. CiPO: Counterfactual Unlearning for Large Reasoning Models through Iterative Preference Optimization

    cs.CL 2026-04 unverdicted novelty 6.0 of 10

    CiPO removes undesired knowledge from both intermediate reasoning steps and final answers in large reasoning models by iteratively optimizing preferences toward valid counterfactual traces while keeping overall reason...

  35. Temper-Then-Tilt: Principled Unlearning for Generative Models through Tempering and Classifier Guidance

    cs.LG 2026-02 conditional novelty 6.0 of 10

    Temper-then-tilt reweights a frozen generative model's distribution with a classifier on a tempered base to unlearn concentrated forget data, with finite-sample bounds and TOFU gains.

  36. A Mechanistic Perspective and Circuit-Guided Difficulty Metric for Unlearning

    cs.LG 2026-01 conditional novelty 6.0 of 10

    A circuit-similarity score predicts which samples an LLM unlearning method will fail to erase, with hard samples relying on deeper, output-facing pathways.

  37. RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories

    cs.AI 2025-12 conditional novelty 6.0 of 10

    RippleBench automatically generates questions at increasing semantic distance from unlearned topics and shows all eight tested unlearning methods degrade accuracy that recovers only slowly with distance.

  38. The Realignment Problem: When Right becomes Wrong in LLMs

    cs.CL 2025-11 unverdicted novelty 6.0 of 10

    TRACE is a three-stage optimization framework that realigns LLMs to new policies by categorizing preference conflicts, scoring impact via bi-level optimization, and applying hybrid losses without new human annotations.

  39. OFMU: Optimization-Driven Framework for Machine Unlearning

    cs.LG 2025-09 unverdicted novelty 6.0 of 10

    A penalty-based bi-level optimization framework for machine unlearning that decorrelates forget and retention gradients via inner maximization and restores utility via outer minimization, with convergence guarantees a...

  40. LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems

    cs.CR 2025-09 conditional novelty 6.0 of 10

    A systematic review that categorizes LLM threats, severity scores, and mitigations across development and operation life cycles and multiple deployment scenarios.

  41. Towards Integrated Alignment

    cs.CY 2025-08 conditional novelty 6.0 of 10

    LLM-generated textbook-style forget sets, produced from a domain name alone, achieve unlearning performance comparable to expert-curated datasets in biosecurity, cybersecurity, and Harry Potter benchmarks.

  42. TOFU: A Task of Fictitious Unlearning for LLMs

    cs.LG 2024-01 conditional novelty 6.0 of 10

    TOFU is a new benchmark with synthetic profiles and metrics demonstrating that existing unlearning algorithms for LLMs fail to achieve effective forgetting of targeted information.

  43. Beyond Binary Rewards: A Comparative Study of Reward Design for Reinforcement Unlearning

    cs.LG 2026-07 conditional novelty 5.0 of 10

    Exponential and PageRank-weighted verifiable rewards forget real-world knowledge in LLMs up to 3× faster than binary PURGE rewards without harming utility on RWKU.

  44. Metis: Memory Foundation Model

    cs.CL 2026-07 conditional novelty 5.0 of 10

    Metis puts a trainable fixed-size memory matrix inside a frozen LLM backbone and learns to remember, update, forget, and reflect across turns without replaying original context.

  45. Null-Space Constrained Low-Rank Adaptation for Response-Specified Large Language Model Unlearning

    cs.AI 2026-06 unverdicted novelty 5.0 of 10

    NSRU constrains LoRA updates via null-space projection of retain subspaces to jointly optimize safe-target learning, undesired-response suppression, and retention in LLM unlearning.

  46. Calibration vs Decision Making: Revisiting the Reliability Paradox in Unlearned Language Models

    cs.CL 2026-05 unverdicted novelty 5.0 of 10

    Unlearned language models retain low calibration error but show increased shortcut reliance on the TOFU benchmark, extending the reliability paradox to machine unlearning.

  47. ZeroUnlearn: Few-Shot Knowledge Unlearning in Large Language Models

    cs.LG 2026-05 unverdicted novelty 5.0 of 10

    ZeroUnlearn is a few-shot unlearning method that maps sensitive inputs to neutral states and enforces representational orthogonality through a closed-form multiplicative update, outperforming baselines while preservin...

  48. ZeroUnlearn: Few-Shot Knowledge Unlearning in Large Language Models

    cs.LG 2026-05 unverdicted novelty 5.0 of 10

    ZeroUnlearn is a few-shot unlearning method that overwrites sensitive inputs with neutral targets via closed-form multiplicative parameter updates enforcing representational orthogonality in LLMs.

  49. Towards Scalable Lifelong Knowledge Editing with Selective Knowledge Suppression

    cs.AI 2026-04 unverdicted novelty 5.0 of 10

    LightEdit enables scalable lifelong knowledge editing in LLMs via selective knowledge retrieval and probability suppression during decoding, outperforming prior methods on ZSRE, Counterfact, and RIPE while reducing tr...

  50. Position: No Retroactive Cure for Infringement during Training

    cs.CR 2026-04 unverdicted novelty 5.0 of 10

    Post-hoc mitigation cannot retroactively cure infringement that occurred during unauthorized data ingestion and training because liability attaches to data lineage and retained expressive value in model weights.

  51. Module-Aware Parameter-Efficient Machine Unlearning on Transformers

    cs.LG 2025-08 conditional novelty 5.0 of 10

    MAPE-Unlearn uses Fisher-information-based scores and greedy search to select important heads and filters, then applies sparse unlearning updates, claiming improved efficacy-fidelity trade-offs on Transformers.

  52. Revisiting the Past: Data Unlearning with Model State History

    cs.LG 2025-06 unverdicted novelty 5.0 of 10

    MSA performs data unlearning in LLMs by arithmetic operations on prior model checkpoints to remove targeted datapoint influence, with experiments showing competitive or better results than existing unlearning methods.

  53. AI as a Tool for Simulation-Based Experiments in Literary Studies

    cs.CL 2026-06 unverdicted novelty 4.0 of 10

    Proposes AI-driven simulations for literary-historical experiments and reports preliminary text-generation results claiming the first limited in-distribution outputs matching human novels.

  54. A Survey on Generative Model Unlearning: Fundamentals, Taxonomy, Evaluation, and Future Direction

    cs.LG 2025-07 conditional novelty 4.0 of 10

    A survey and framework that categorizes generative model unlearning by point-wise versus concept-wise objectives, parameter-based versus non-parametric methods, and completeness/utility/efficiency evaluation.

  55. AI Safety Landscape for Large Language Models: Taxonomy, State-of-the-art, and Future Directions

    cs.AI 2024-08 unverdicted novelty 4.0 of 10

    The paper introduces a taxonomy of AI safety for LLMs organized into Trustworthy AI, Responsible AI, and Safe AI perspectives, accompanied by a review of state-of-the-art methods, challenges, and future directions.

  56. iShumei-Chinchunmei at SemEval-2025 Task 4: A balanced forgetting and retention multi-task framework using effective unlearning loss

    cs.CL 2025-07 conditional novelty 3.0 of 10

    The authors propose Effective Unlearning Loss, the inverse of the standard next-token prediction loss, within a multi-task framework, and report a 5th-place finish at SemEval-2025 Task 4.

Pith tools