REVIEW 65 cited by
Who's Harry Potter? Approximate Unlearning in LLMs
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Large language models (LLMs) are trained on massive internet corpora that often contain copyrighted content. This poses legal and ethical challenges for the developers and users of these models, as well as the original authors and publishers. In this paper, we propose a novel technique for unlearning a subset of the training data from a LLM, without having to retrain it from scratch. We evaluate our technique on the task of unlearning the Harry Potter books from the Llama2-7b model (a generative language model recently open-sourced by Meta). While the model took over 184K GPU-hours to pretrain, we show that in about 1 GPU hour of finetuning, we effectively erase the model's ability to generate or recall Harry Potter-related content, while its performance on common benchmarks (such as Winogrande, Hellaswag, arc, boolq and piqa) remains almost unaffected. We make our fine-tuned model publicly available on HuggingFace for community evaluation. To the best of our knowledge, this is the first paper to present an effective technique for unlearning in generative language models. Our technique consists of three main components: First, we use a reinforced model that is further trained on the target data to identify the tokens that are most related to the unlearning target, by comparing its logits with those of a baseline model. Second, we replace idiosyncratic expressions in the target data with generic counterparts, and leverage the model's own predictions to generate alternative labels for every token. These labels aim to approximate the next-token predictions of a model that has not been trained on the target data. Third, we finetune the model on these alternative labels, which effectively erases the original text from the model's memory whenever it is prompted with its context.
Forward citations
Showing 60 of 65 Pith papers that cite this
-
The Space Complexity of Learning-Unlearning Algorithms
The space complexity of machine unlearning for realizability testing is characterized by eluder dimension (central lower bound), star number (ticketed upper bound), and hollow star number (bounded deletions), separati...
-
MOON: Multi-Objective OrthoNormalized Updates for Multitask Learning
MOON applies spectral-nuclear-norm geometry to multi-objective gradient manipulation and uses polar-factor updates, with O(T^-1/2) deterministic and O(T^-1/4) stochastic convergence to Pareto stationarity.
-
Measure, Don't Optimize: Forecasting Recovery in LLM Unlearning
A Jacobian-lens audit predicts model-level relearning recovery in LLM unlearning but cannot pick which facts return and backfires when used as a training penalty.
-
PRMU: A Corpus-Free Benchmark for Person-Centric Knowledge Unlearning in Multimodal Large Language Models
PRMU provides a corpus-free, person-centric multimodal unlearning benchmark with proxy corpora and neighbor-based locality evaluation, plus SGPE, a projection-editing baseline.
-
Suppression Sticks, Locality Is Fragile: A Closed-Loop Target-and-Control Audit of Task-Vector Negation in VLA Policies
Subtracting a task vector from a vision-language-action robot policy suppresses the target skill but not its collateral damage: only five of ten LIBERO-Goal skills separate cleanly, and held-out control retention aver...
-
Crossing the Margin Cliff: Toward Relearn-Robust LLM Unlearning via Margin Calibration
Margin Calibration, a non-saturating margin-anchored LoRA polish, crosses the margin cliff and cuts post-attack relearn recovery on all 97 populated cells in the paper's stress matrix.
-
Unlearning as Distribution Restoration: A Controlled Counterfactual Study, a Validated Selective Screen, and the Limits of Oracle-Free Certification
Matching a retrained oracle on trained probes can certify models that still retain held-out forget knowledge, and oracle-free unlearning certification is only possible for counterfactual, non-inferable facts.
-
Forget Narrowly, Retain Broadly: Unlearning as an Asymmetric Generalization Problem
SUITE defines the forget-retain boundary at semantic, syntactic and lexical levels; training on it plus JensUn++ yields near-complete forgetting with minimal retain and utility loss.
-
Targeted Angular Reversal of Weights (TARS) for Knowledge Removal in Large Language Models
TARS locates feedforward weights most aligned with a model-derived concept vector and replaces them with its reversed form, removing concepts like 'Sherlock Holmes' with a few edits while preserving general model behavior.
-
Provable unlearning in topic modeling and downstream tasks
Provable (epsilon, delta)-unlearning algorithms for topic models achieve deletion capacity O~(m/(r^2 sqrt(nr))) before fine-tuning and O~(m q/(r sqrt(nr))) after fine-tuning, with the base model untouched in the downs...
-
Metis: Memory Foundation Model
Metis puts a trainable fixed-size memory matrix inside a frozen LLM backbone and learns to remember, update, forget, and reflect across turns without replaying original context.
-
Policy-Masked Private Experts: Auditable and Reversible Capability Access Control in Sparse MoE Models
Trusted authorization can completely prevent a separately trained private expert branch from executing in sparse MoE LLMs, verified across Qwen3-30B-A3B and DeepSeek-V2-Lite.
-
Exploring and Bridging Knowledge Holes in Unlearned Multimodal Large Language Models
Knowledge holes, severe response degradation on benign inputs that share patterns with forgotten content, are shown to exist in unlearned multimodal LLMs and are partially repaired by SPAR on LLaVA-1.5-7B.
-
Understanding Machine Unlearning Through the Lens of Mode Connectivity
Unlearned models usually connect to their originals by smooth low-loss paths, and the smoothness of that path can predict how hard the unlearning task was.
-
Stochastic Meta-Unlearning: Bridging Language Backbone and Multimodal Unlearning
A bilevel meta-training method aligns text-only backbone unlearning with full vision-language model forgetting, improving forget-retain trade-offs across two VLMs and two meme datasets.
-
Targeted Recovery of Weight-Space Mechanisms From Neural Networks
A targeted decomposition method recovers the weight-space mechanisms behind specific inputs at low FLOPs, enabling focused ablation and rewiring of a 12-block transformer.
-
Temper-Then-Tilt: Principled Unlearning for Generative Models through Tempering and Classifier Guidance
Temper-then-tilt reweights a frozen generative model's distribution with a classifier on a tempered base to unlearn concentrated forget data, with finite-sample bounds and TOFU gains.
-
A Mechanistic Perspective and Circuit-Guided Difficulty Metric for Unlearning
A circuit-similarity score predicts which samples an LLM unlearning method will fail to erase, with hard samples relying on deeper, output-facing pathways.
-
RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories
RippleBench automatically generates questions at increasing semantic distance from unlearned topics and shows all eight tested unlearning methods degrade accuracy that recovers only slowly with distance.
-
OFMU: Optimization-Driven Framework for Machine Unlearning
OFMU is a penalty-based bi-level optimizer for machine unlearning that alternates between a gradient-ascent forgetting step and a gradient-descent utility-restoration step, with a similarity penalty between forget and...
-
LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems
A systematic review that categorizes LLM threats, severity scores, and mitigations across development and operation life cycles and multiple deployment scenarios.
-
Towards Integrated Alignment
LLM-generated textbook-style forget sets, produced from a domain name alone, achieve unlearning performance comparable to expert-curated datasets in biosecurity, cybersecurity, and Harry Potter benchmarks.
-
Unlearning of Knowledge Graph Embedding via Preference Optimization
GraphDPO applies direct preference optimization to knowledge graph embedding unlearning, using out-boundary sampling and boundary recall to forget triples while retaining neighbors.
-
What Should LLMs Forget? Quantifying Personal Data in LLMs for Right-to-Be-Forgotten Requests
WikiMem, a Wikidata-derived canary dataset and a calibrated NLL-ranking metric, identifies which human-fact associations an LLM has memorized, with higher rates for famous people and larger models.
-
The Safety Gap Toolkit: Evaluating Hidden Dangers of Open-Source Models
On Llama-3 and Qwen-2.5, removing safety guardrails sharply raises compliance with dangerous bio, chem, and cyber requests, and the resulting safety gap grows with model scale.
-
Model Collapse Is Not a Bug but a Feature in Machine Unlearning for LLMs
A new method, Partial Model Collapse, iteratively fine-tunes an LLM on its own self-generated responses to conditionally collapse its output distribution on forget queries, removing private answers without the true la...
-
Learning-Time Encoding Shapes Unlearning in LLMs
How knowledge is encoded during LLM fine-tuning strongly affects later unlearning: paraphrased training data helps unlearning, while entangled chunks hinder selective forgetting.
-
LLM Unlearning Should Be Form-Independent
Existing LLM unlearning is form-dependent; the new ORT benchmark measures this, and the training-free ROCR edit reduces it by redirecting concept representations.
-
Certified Unlearning for Neural Networks
Noisy fine-tuning with gradient or model clipping on retained data provably removes the influence of forget data, with guarantees that need no smoothness or convexity assumptions.
-
Targeted Forgetting of Image Subgroups in CLIP Models
A three-stage forgetting, reminding, and restoring pipeline lets CLIP forget a targeted image subgroup without pre-training data while keeping zero-shot performance.
-
Existing Large Language Model Unlearning Evaluations Are Inconclusive
Existing LLM unlearning evaluations are inconclusive: they can inject new information, depend heavily on task format, and rely on spurious correlations.
-
DUSK: Do Not Unlearn Shared Knowledge
DUSK benchmarks machine unlearning under overlapping forget and retain documents, showing existing methods remove surface text but fail to preserve shared knowledge while erasing unique content.
-
GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detection
GUARD performs inference-time unlearning by classifying prompts, retrieving original answers, and penalizing token matches during beam search, preserving utility but with forget quality that collapses on larger TOFU f...
-
Unilogit: Robust Machine Unlearning for LLMs Using Uniform-Target Self-Distillation
Unilogit unlearns text from LLMs by setting the target token probability to 1/|V| and distilling from the current model, reporting stronger forgetting at comparable retained utility than NPO and UnDIAL.
-
Unlearning vs. Obfuscation: Are We Truly Removing Knowledge?
DF-MCQ flattens a model's predictions over multiple-choice questions to make it refuse target-person queries, and the paper's probing tests suggest this removes knowledge rather than merely obfuscating it.
-
Can Language Models Represent the Past without Anachronism?
Fine-tuned GPT-4o-mini still betrays its present-day training to human readers, while prompting alone fails to shift style, evidence that period pretraining may be required for historical simulation.
-
Certified Mitigation of Worst-Case LLM Copyright Infringement
BloomScrub detects long verbatim quotes from a protected corpus with a Bloom filter, rewrites them iteratively, and abstains when needed, certifying that no quote longer than the threshold is emitted.
-
A mean teacher algorithm for unlearning of language models
A mean teacher optimizer that approximates slow natural gradient descent, paired with a new negative log-unlikelihood loss, reduces memorization and privacy leakage on MUSE-News and MUSE-Books, with the strongest vari...
-
A Lightweight Method to Disrupt Memorized Sequences in LLM
A decoding-time intervention that substitutes a small model's probabilities for common function words into a large model's output reduces exact training-data recall by up to 10x with minimal measured quality loss.
-
Position: Adversarial ML for LLMs Is Not Making Any Progress
The authors argue that LLM-era adversarial machine learning is less well-defined, harder to solve, and harder to evaluate, so meaningful progress may not be achievable or trackable in the current paradigm.
-
Agents Are All You Need for LLM Unlearning
A four-agent pipeline, Vanilla, AuditErase, Critic, and Composer, filters target references out of LLM responses, claiming robust and scalable inference-time unlearning without weight updates.
-
Investigating the Feasibility of Mitigating Potential Copyright Infringement via Large Language Model Unlearning
SSU combines task-vector negation, random-label loss, and weight saliency to forget copyrighted books sequentially while retaining more general language ability than existing baselines.
-
Copyright-Protected Language Generation via Adaptive Model Fusion
CP-Fuse adaptively fuses two models trained on disjoint data to suppress verbatim reproduction of memorized text without a measured utility drop.
-
Unified Parameter-Efficient Unlearning for LLMs
An influence-function-based parameter editing framework performs instance removal, query modification, and response correction on PEFT adapters without retraining.
-
SEUF: Is Unlearning One Expert Enough for Mixture-of-Experts LLMs?
SEUF restricts MoE LLM unlearning to the top-1 most relevant expert and adds a router anchor loss, improving utility by up to 35% while keeping forget efficacy roughly comparable.
-
Beyond Binary Rewards: A Comparative Study of Reward Design for Reinforcement Unlearning
Exponential and PageRank-weighted verifiable rewards forget real-world knowledge in LLMs up to 3× faster than binary PURGE rewards without harming utility on RWKU.
-
Module-Aware Parameter-Efficient Machine Unlearning on Transformers
MAPE-Unlearn uses Fisher-information-based scores and greedy search to select important heads and filters, then applies sparse unlearning updates, claiming improved efficacy-fidelity trade-offs on Transformers.
-
Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methods
Prepending a Hindi filler paragraph to WMDP-bio questions restores 57.3% accuracy in ELM-unlearned models, showing the unlearning is superficial output suppression rather than true knowledge removal.
-
SoK: Machine Unlearning for Large Language Models
A new taxonomy for LLM unlearning distinguishes removal-intended from suppression-intended methods, and argues that gradient ascent methods functionally behave like suppression.
-
BLUR: A Benchmark for LLM Unlearning Robust to Forget-Retain Overlap
BLUR adds forget-retain overlapping combined queries and relearning data to four unlearning benchmarks, and shows existing unlearning methods degrade on them.
-
Exploring Criteria of Loss Reweighting to Enhance LLM Unlearning
The authors propose SatImp, a product of a saturation weight and an importance weight, and show it improves the unlearn-retain trade-off on TOFU, WMDP, and MUSE.
-
OBLIVIATE: Robust and Practical Machine Unlearning for Large Language Models
OBLIVIATE combines masked-token suppression, teacher distillation, and world-fact regularization under LoRA to remove targeted content from LLMs while preserving utility and fluency.
-
Code Simulation as a Proxy for High-order Tasks in Large Language Models
LLM performance on naturalistic reasoning tasks tracks performance on equivalent Python code simulation, but the effect is partly driven by pattern matching and memorization rather than faithful execution.
-
Resolving Editing-Unlearning Conflicts: A Knowledge Codebook Framework for Large Language Model Updating
LOKA is a knowledge codebook framework that separates or merges editing and unlearning objectives based on measured gradient conflict, and reports improved LLM updating performance across three benchmarks.
-
Multi-Objective Large Language Model Unlearning
MOLLM formulates LLM unlearning as a three-objective optimization problem and uses a bounded unlearning loss plus a common descent direction to forget target data while preserving model utility.
-
Generative Model Unlearning: A Survey through Target Events, Unlearning Operators, and Evaluation Protocols
A survey and framework that categorizes generative model unlearning by point-wise versus concept-wise objectives, parameter-based versus non-parametric methods, and completeness/utility/efficiency evaluation.
-
Mr. Snuffleupagus at SemEval-2025 Task 4: Unlearning Factual Knowledge from LLMs Using Adaptive RMU
Adaptive RMU with layer selection at decoder layers 12-14 (1B) and 24-26 (7B) ranked 4th in SemEval-2025 Task 4 unlearning.
-
Lifting Data-Tracing Machine Unlearning to Knowledge-Tracing for Foundation Models
A position paper urging a shift from data-tracing to knowledge-tracing machine unlearning for foundation models, supported by a CLIP case study that shows current methods struggle to generalize.
-
Open Problems in Machine Unlearning for AI Safety
Machine unlearning is not a comprehensive solution for AI safety; it is best suited to data removal, while capability control faces fundamental and unresolved challenges.
-
Large Language Model Federated Learning with Blockchain and Unlearning for Cross-Organizational Collaboration
A hybrid blockchain federated learning framework with Q-learning agents and LoRA-based unlearning is proposed, but the experiments do not show that model utility survives data removal.
Discussion (0). Continue with ORCID to comment.