Pith. sign in

REVIEW 4 major objections 4 minor 4 cited by

Unlearning Sensitive Information in Multimodal LLMs: Benchmark and Attack-Defense Evaluation

T0 review · 4 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper introduces UnLOK-VQA, a benchmark for multimodal knowledge deletion, and shows that suppressing deleted answers in internal hidden states cuts attack success from 45.5% to 15.7%.

desk verdict A genuinely useful multimodal unlearning benchmark, but the headline numbers need error bars and the hard rephrase generation needs a validity check. read the letter →

arxiv 2505.01456 v1 pith:H443T3OZ submitted 2025-05-01 cs.CL cs.AIcs.CV

Vaidehi Patil , Yi-Lin Sung , Peter Hase , Jie Peng , Tianlong Chen , Mohit Bansal This is my paper · ORCID
classification cs.CLcs.AIcs.CV
keywords multimodalunlearningmachinevisualquestionansweringmodeleditingadversarialattackshiddenstateinterpretabilityUnLOK-VQAknowledgedeletion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces UnLOK-VQA, a manually filtered benchmark for testing whether multimodal LLMs can forget one specific piece of knowledge, and pairs it with an attack-defense protocol. The central empirical finding is that deletion by weight editing is leaky: combining rephrased text and images recovers deleted answers 45.5% of the time, more than either modality alone. The strongest defense, which removes the answer from internal hidden-state distributions, cuts this to 15.7%. If correct, the work provides a reusable way to measure multimodal unlearning along efficacy, generalization, and specificity, and it identifies hidden-state suppression and model scale as levers for safer deletion.

What carries the argument

Two mechanisms carry the argument. First, UnLOK-VQA's variable-proximity sample generation: for each answer to delete, it creates rephrase images and questions at three difficulty levels (noisy, object-replaced, fully regenerated; prefix, paraphraser, jailbreak) and neighborhood samples that change the answer, so generalization and specificity can both be measured. Second, the LogitLens-style hidden-state probe: the paper reads the next-token distribution from each transformer layer, uses it to build whitebox attacks that collect candidate tokens, and defines the Head Projection defense as a max-margin objective that keeps the deleted answer out of the top-k positions across selected layers and the final output. The defense works by removing the answer's trace from internal representations rather than only lowering its final probability.

What would settle it

Take the full UnLOK-VQA set, have independent annotators verify every rephrase and neighborhood answer, then re-run the defense comparison on the verified subset; if the Head Projection defense no longer beats fact erasure, or multimodal attacks no longer outperform image-only and text-only attacks, the paper's central empirical claim is refuted.

Watch

Extended reading notes

Core claim

The paper claims that deleting one sensitive answer from an MLLM via LoRA weight edits still leaves it extractable: a multimodal rephrase attack recovers the deleted answer 45.5% of the time from the baseline edited model. The strongest defense, Head Projection, suppresses the answer in hidden-state distributions and lowers this to 15.7% at budget 20. The same evaluation shows multimodal attacks outperform image-only attacks (32%) and text-only attacks (39%), and the 13B model resists extraction better than the 7B after the same edit. The paper concludes that hidden-state-level erasure is more effective than simply lowering answer probability, and that scale aids deletion robustness.

Load-bearing premise

The benchmark assumes the automatically generated rephrase and neighborhood samples really have the answers the pipeline says they have; those samples are produced partly by the same model family being tested and checked by humans on only 80 of 500 points.

Editorial extensions

If this is right

  • Unlearning evaluations that check only text or only images will underestimate information leakage; the benchmark shows combined multimodal rephrases are the stronger attack.
  • Defenses that reduce the probability of the target answer are weaker than defenses that suppress the answer across internal layer distributions, so hidden-state objectives should be part of any deletion recipe.
  • Because larger LLaVA models resist both whitebox and blackbox extraction better after the same edit, scaling up model size can be treated as a robustness measure for unlearning.
  • Editing the LLM layers rather than the multimodal projector yields lower attack success, pointing to where the to-be-deleted knowledge actually lives.
  • The easy/medium/hard proximity tiers make it possible to measure how broadly an edit generalizes and how much collateral damage it does, so benchmarks should report specificity at multiple distances.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because part of the test data is generated by the same model family evaluated, the absolute attack-success numbers may not transfer to other MLLMs; a cross-model replication with human-verified rephrases would show whether the ranking holds.
  • Editorial inference: the failure of the second-order PD2 attack to beat PD suggests hidden-state traces are too diluted by layer-to-layer differences at budget 20; testing larger budgets or targeted layers could change that comparison.
  • Editorial inference: a natural next experiment is to apply the same attack-defense protocol to closed-source MLLMs through API blackbox access to see whether hidden-state defenses still help when adversaries cannot see internal states.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces UnLOK-VQA, a multimodal unlearning benchmark built by extending OK-VQA with automatically generated rephrase and neighborhood samples at varying proximity levels, followed by manual filtering and a human evaluation. It then presents an attack-and-defense framework with four whitebox and three blackbox attacks, including a new second-order LogitLens attack (PD2), and evaluates six defense objectives on LLaVA-v1.5-7B and 13B. The headline results are that multimodal rephrase attacks are more effective than unimodal ones (45.5% attack success against a baseline defense) and that a Head Projection defense that suppresses answer tokens in internal LogitLens distributions reduces multimodal attack success to 15.7%. Additional findings are that editing LLM layers is more effective than editing the multimodal projector, and that the 13B model is more robust to attacks after editing than the 7B model. The paper argues that UnLOK-VQA enables rigorous comparison of multimodal unlearning methods, and it releases code and data.

Significance. If the benchmark validity and empirical claims hold, the paper fills a real gap: it provides a public, structured benchmark for multimodal targeted unlearning and a broad attack-defense evaluation protocol, including a novel PD2 whitebox attack and an ablation of edited modules. The dataset construction is unusually transparent about manual filtering and reports post-filter human evaluation above 90% for most sample types, and the code/data release is a concrete asset for the community. The comparison of six defenses against seven attacks, with explicit budget-based attack success metrics, is a useful framework even if some of the specific numerical conclusions need further support. The main significance rests on (i) whether the generated rephrase and neighborhood samples actually have the intended answer relationships, and (ii) whether the headline empirical differences are statistically reliable; both need strengthening before the benchmark can serve as a rigorous evaluation standard.

major comments (4)
  1. [Section 3.2 and 3.4, Appendix D] The validity of the hard rephrase and hard neighborhood samples is not verified per sample. Hard rephrase images are generated by SDXL from a LLaVA-v1.5-7B description plus a prompt that asserts the desired answer, but there is no automatic check that the generated image actually supports that answer. Section 3.4 reports that only 75% of rephrase and 66% of neighborhood outputs passed pre-filter human standards, and the post-filter human evaluation covers only 80 of 500 samples (Table 4). Appendix D documents that one neighborhood generation strategy was tried and abandoned after failing, which illustrates that the pipeline's outputs cannot be assumed correct without per-sample verification. If a non-negligible fraction of hard rephrase images do not contain the answer, then the hard-image attack success rates in Tables 1 and 2 may measure the model's prior or hallucination on mismatched image-text pairs rather than recovery of the deleted fact. Please add an automatic or substantially larger human verification step and release per-sample labels so that the generalization and specificity measurements can be audited.
  2. [Section 6.1, Tables 1-3, Figure 3] All headline empirical comparisons appear to be based on single runs with no confidence intervals or significance tests. For example, the differences between defenses in Table 1, the easy/medium/hard trends in Table 2, and the 7B-versus-13B differences in Figure 3 could be within run-to-run or editing-seed variability, especially given that LoRA edits and some defense objectives (e.g., Empty and Error Injection) may have hyperparameter sensitivity. The paper should report multiple seeds or editing runs with confidence intervals and, where appropriate, a significance test, or explicitly state that the reported numbers are single-run observations. Without this, the central quantitative claim that HP reduces the multimodal attack from 45.5% to 15.7% is not yet fully supported.
  3. [Sections 4.2 and 4.3, Table 1] The HP defense and the HP attack share the same mechanism: the defense suppresses the target answer from top-k LogitLens distributions and the final output, while the attack collects top-k LogitLens tokens. Consequently, the low HP-attack success rate of 3.6% against the HP defense is expected by construction to a substantial degree. The defense is not vacuous because it also reduces the blackbox multimodal rephrase attack to 15.7%, but the whitebox comparison should be complemented with hidden-state attacks that do not use the same top-k LogitLens criterion, such as linear probes on residual streams or subspace projections. This would separate genuine erasure of answer information from alignment between the defense and the attack's readout mechanism.
  4. [Section 6.2, Figure 3] The scaling claim rests on two model sizes, 7B and 13B, with (as far as the text reports) one edited model per size. The conclusion that 'scaling enhances safety' is an n=2 observation and is not established as a general trend. Please add at least one intermediate scale or repeated edits with variance reporting, or substantially soften the claim to a case study of these two LLaVA-v1.5 sizes.
minor comments (4)
  1. [Section 5 and Appendix B] The choice of edited layer (7th for LLaVA-v1.5-7B, 9th for 13B) is described only briefly; please state the layer-search procedure and the criterion used, and clarify whether the same criterion was applied at both scales.
  2. [Table 4 / Appendix C] No inter-annotator agreement metric is reported for the human evaluation; reporting Cohen's kappa or similar would help calibrate the quality claims.
  3. [Figure 3] The legend 'MM Rephrase HP' is ambiguous: it should clearly indicate whether it denotes the multimodal rephrase attack against the HP defense or the HP whitebox attack.
  4. [Section 3.2 / Table 7] The medium rephrase example 'What kind of habitation is shown?' is itself a poor paraphrase of 'What kind of habitat is shown?'; consider replacing it with a clearer example in the paper.

Circularity Check

1 steps flagged · score 4.0 of 10

Head-Projection defense is trained to suppress the same top-k LogitLens tokens that the Head-Projection attack collects, making the whitebox 30%→3.6% reduction partly by construction; the multimodal blackbox result and overall ranking remain independent.

  1. self definitional [Section 4.2 (Whitebox Attacks, item 1) and Section 4.3 (Defense Methods, Head Projection Defense); Table 1, HP row]
    "Head Projection Attack (Patil et al., 2023a): This attack constructs a candidate set by collecting the top-k highest probability tokens from each layer probed by LogitLens. ... Head Projection (HP) Defense (Patil et al., 2023a): This approach employs a max-margin objective to prevent the deleted answer from appearing among the top-k elements in LogitLens distributions across chosen layers (L) and the final output."

    The defense's optimization target and the attack's candidate-set definition are the same object: the top-k LogitLens token lists. AttackSuccess@B (Eq. 2) counts success when the answer is in candidate set C, and the HP attack defines C as the collected top-k LogitLens tokens across layers, while HP defense is trained to keep the answer out of exactly those top-k lists (plus final output). Thus the reported whitebox drop from 0.300 (Fact-Eras) to 0.036 (HP defense) for the HP attack is obtained by construction: the defense directly minimizes the quantity used to score the attack. This result alone is not independent evidence of internal-state erasure.

full rationale

The one formal circularity I can exhibit is the Head-Projection attack/defense pair. The HP defense optimizes a max-margin objective to keep the answer out of the top-k LogitLens distributions across layers and the final output; the HP attack's candidate set is exactly the collection of those top-k LogitLens tokens. Since AttackSuccess@B is defined as the answer being in that candidate set, the defense is literally trained against the metric used to measure the attack, so the 30%→3.6% whitebox comparison is partly self-definitional. This is partial, not total: the headline blackbox multimodal result (45.5%→15.7%) and the performance of HP against PD, PD2, HP+FT, and the blackbox rephrase attacks do not share the defense's training objective, and HP is still best on those independent attacks, so the central claim that HP is the most effective defense retains independent content. The benchmark-generation self-reference (hard rephrase and neighborhood images produced from LLaVA-v1.5-7B descriptions plus SDXL, with post-filter human evaluation on 80 of 500 samples) is a data-validity concern rather than derivation-circularity: target answers come from OK-VQA ground truth, and the attack/defense numbers are empirical on the filtered set. The paper's own Appendix D documents that one generation strategy was abandoned because it could not reliably alter answers by editing one object, which underscores that answer-preservation in generated images is unverified and weakens transfer claims, but it is not a case where an output reduces to an input by construction. I also note a smaller disclosed artifact: the Input Rephrasing defense uses easy question rephrases in training, and Appendix B explains that medium rephrases are more effective 'because the defense employs question rephrases belonging to the easy question rephrase distribution'; this is a distribution-overlap issue in a non-central defense, not a load-bearing circularity. Citations to Patil et al. (2023a) supply the HP attack/defense and threat model, but these are implemented and empirically evaluated here rather than invoked as an unverified theorem, so they do not form a self-citation chain. Score 4 reflects one significant self-definitional evaluation component while the central blackbox/ranking findings remain independent.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claims rest on four domain assumptions and four hand-chosen settings. No fitted theory parameters or invented entities are present. The largest burden is the assumption that OK-VQA general-knowledge answers stand in for sensitive information and that LogitLens top-k probabilities are a faithful window into whether deletion occurred.

free parameters (4)
  • LoRA rank and alpha = rank=1, alpha=1
    Used for all edits (Appendix B); chosen to make edits precise, and all attack/defense numbers depend on this choice.
  • Edited layer index (LLM MLP) = Layer 7 for LLaVA-7B; Layer 9 for LLaVA-13B
    Selected empirically in Section 5 to reach rewrite score above 85% and random delta-acc below 5%; different layer choices could change attack success rates.
  • Attack budget B = 20
    All AttackSuccess@B numbers in Table 1 use B=20; changing the budget changes all reported attack rates.
  • Defense training hyperparameters = not fully reported; tuned per defense
    Section 6.1 states the authors adjusted hyperparameters per defense to reach reasonable rewrite scores and delta-acc; exact settings are not given, so the defense comparison is not fully controlled.
assumptions (4)
  • domain assumption OK-VQA answers are a valid proxy for sensitive information that a multimodal model should be able to forget.
    The entire benchmark and threat model treat general-knowledge answers as sensitive data (Sections 1 and 3.1). If OK-VQA facts are not representative of PII or harmful content, the safety conclusions do not transfer.
  • domain assumption LogitLens top-k hidden-state probabilities reveal the presence of deleted information, so removing the answer from top-k constitutes deletion.
    The HP attack and HP defense both rely on this interpretability assumption, inherited from Patil et al. (2023a) and used in Sections 4.2 and 4.3.
  • domain assumption The automatic generation pipeline plus one round of manual filtering produces rephrase and neighborhood samples whose intended answer relationships are correct.
    Hard rephrase images and neighborhood questions depend on LLaVA descriptions and SDXL/Grounded SAM generations; human validation covers only 80 of 500 samples (Section 3.4).
  • domain assumption The attack success metric with exact answer membership in a candidate set is a faithful measure of information extraction.
    Equation (2) defines success as exact string match; paraphrased or partial answers are counted as failures, which may distort comparisons.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Unlearning Sensitive Information in Multimodal LLMs: Benchmark and Attack-Defense Evaluation." pith.science (2026). https://pith.science/paper/H443T3OZ

@misc{pith2026250501456,
  author       = {Pith},
  title        = {Pith review of: Unlearning Sensitive Information in Multimodal LLMs: Benchmark and Attack-Defense Evaluation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H443T3OZ}},
  note         = {Machine review of arXiv:2505.01456}
}
read the original abstract

LLMs trained on massive datasets may inadvertently acquire sensitive information such as personal details and potentially harmful content. This risk is further heightened in multimodal LLMs as they integrate information from multiple modalities (image and text). Adversaries can exploit this knowledge through multimodal prompts to extract sensitive details. Evaluating how effectively MLLMs can forget such information (targeted unlearning) necessitates the creation of high-quality, well-annotated image-text pairs. While prior work on unlearning has focused on text, multimodal unlearning remains underexplored. To address this gap, we first introduce a multimodal unlearning benchmark, UnLOK-VQA (Unlearning Outside Knowledge VQA), as well as an attack-and-defense framework to evaluate methods for deleting specific multimodal knowledge from MLLMs. We extend a visual question-answering dataset using an automated pipeline that generates varying-proximity samples for testing generalization and specificity, followed by manual filtering for maintaining high quality. We then evaluate six defense objectives against seven attacks (four whitebox, three blackbox), including a novel whitebox method leveraging interpretability of hidden states. Our results show multimodal attacks outperform text- or image-only ones, and that the most effective defense removes answer information from internal model states. Additionally, larger models exhibit greater post-editing robustness, suggesting that scale enhances safety. UnLOK-VQA provides a rigorous benchmark for advancing unlearning in MLLMs.

Figures

Figures reproduced from arXiv: 2505.01456 by the authors.

Figure 1
Figure 1. Illustration of (1) information leakage in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Pipeline for UnLOK-VQA generation: (1) We utilize the OK-VQA dataset as a basis for evaluating the efficacy of editing methods in removing knowledge from MLLMs; (2) We employ multiple techniques to produce rephrase data with different levels, which we use in blackbox attacks to assess the generalizability of the unlearning methods; (3) We create various levels of neighborhood data to check whether the editing method… view at source ↗
Figure 3
Figure 3. Effect of scaling the LLaVA-v1.5’s size from [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Distribution of question categories in UnLOK-VQA. It consists of samples belonging to diverse categories and covers all the categories in the original OK-VQA dataset. 0.0 0.5 1.0 1.5 2.0 Random Neigh Img Rephrase Img [PITH_FULL_IMAGE:figures/full_fig_p020_4.png]
Figure 5
Figure 5. Figure 5: Average distance of the random, neigh￾borhood image and rephrase image points from the original data point. Neighborhood points are closer to the target data point being deleted compared to random points on which other unlearning datasets evaluate specificity. Rephrase…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. How China-Origin Vision-Language Models Move from Refusal to Reframing in State Alignment

    cs.CR 2026-08 conditional novelty 7.0 of 10

    Chinese-language prompts triple the odds of state-aligned framing in nine tested vision-language models, and across four Qwen generations, explicit refusal falls while fluent reframing rises.

  2. Toward Fine-Grained Forgetting:Attribute Unlearning for Multimodal Large Language Models

    cs.AI 2026-08 reject novelty 6.0 of 10

    The paper defines attribute-level MLLM unlearning and proposes CLRP, but the method's headline forgetting gains on cloze are partly produced by test-time logit subtraction applied only to the forget and test sets.

  3. Stochastic Meta-Unlearning: Bridging Language Backbone and Multimodal Unlearning

    cs.CL 2026-07 conditional novelty 6.0 of 10

    A bilevel meta-training method aligns text-only backbone unlearning with full vision-language model forgetting, improving forget-retain trade-offs across two VLMs and two meme datasets.

  4. POPS: Recovering Unlearned Multi-Modality Knowledge in MLLMs with Prompt-Optimized Parameter Shaking

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Prompt-optimized suffixes plus synthetic fine-tuning recover ~82% of knowledge that multimodal unlearning methods claim to erase from MLLMs.

Reference graph

Works this paper leans on

65 extracted references · 16 canonical work pages · cited by 4 Pith papers

  1. [1]

    Gems: Scene expansion using generative models of graphs

    Rishi Agarwal, Tirupati Saketh Chandra, Vaidehi Patil, Aniruddha Mahapatra, Kuldeep Kulkarni, and Vishwa Vinay. Gems: Scene expansion using generative models of graphs. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp.\ 157--166, January 2023

    work page 2023

  2. [2]

    Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond

    Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond. arXiv preprint arXiv:2308.12966, 2023

    arXiv 2023

  3. [3]

    Constitutional ai: Harmlessness from ai feedback

    Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073, 2022

    arXiv 2022

  4. [4]

    Leace: Perfect linear concept erasure in closed form

    Nora Belrose, David Schneider-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman. Leace: Perfect linear concept erasure in closed form. arXiv preprint arXiv:2306.03819, 2023. URL https://arxiv.org/pdf/2306.03819.pdf

    arXiv 2023

  5. [5]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33: 0 1877--1901, 2020

    1901

  6. [6]

    Towards making systems forget with machine unlearning

    Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE symposium on security and privacy, pp.\ 463--480. IEEE, 2015. URL https://www.ieee-security.org/TC/SP2015/papers-archived/6949a463.pdf

    work page 2015

  7. [7]

    The secret sharer: Evaluating and testing unintended memorization in neural networks

    Nicholas Carlini, Chang Liu, \'U lfar Erlingsson, Jernej Kos, and Dawn Xiaodong Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In USENIX Security Symposium, 2018. URL https://api.semanticscholar.org/CorpusID:170076423

    work page 2018

  8. [8]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019

    arXiv 1902

Show all 65 references
  1. [9]

    Can language models be instructed to protect personal information?, 2023

    Yang Chen, Ethan Mendes, Sauvik Das, Wei Xu, and Alan Ritter. Can language models be instructed to protect personal information?, 2023

    2023

  2. [10]

    Siyuan Cheng, Bozhong Tian, Qingbin Liu, Xi Chen, Yongheng Wang, Huajun Chen, and Ningyu Zhang. Can we edit multimodal large language models? In Houda Bouamor, Juan Pino, and Kalika Bali (eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Proces...

    2023 doi

  3. [11]

    Deep reinforcement learning from human preferences

    Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human preferences. Advances in neural information processing systems, 30, 2017

    2017

  4. [12]

    Scaling instruction-finetuned language models

    Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. Scaling instruction-finetuned language models. Journal of Machine Learning Research, 25 0 (70): 0 1--53, 2024

    2024

  5. [13]

    Editing factual knowledge in language models

    Nicola De Cao, Wilker Aziz, and Ivan Titov. Editing factual knowledge in language models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp.\ 6491--6506, 2021

    2021

  6. [14]

    Privacy side channels in machine learning systems

    Edoardo Debenedetti, Giorgio Severi, Nicholas Carlini, Christopher A Choquette-Choo, Matthew Jagielski, Milad Nasr, Eric Wallace, and Florian Tram \`e r. Privacy side channels in machine learning systems. arXiv preprint arXiv:2309.05610, 2023

    2023 arXiv

  7. [15]

    Erasing concepts from diffusion models

    Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. Erasing concepts from diffusion models. arXiv preprint arXiv:2303.07345, 2023. URL https://arxiv.org/pdf/2303.07345.pdf

    2023 arXiv

  8. [16]

    Transformer feed-forward layers are key-value memories

    Mor Geva, Roei Schuster, Jonathan Berant, and Omer Levy. Transformer feed-forward layers are key-value memories. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp.\ 5484--5495, 2021

    2021

  9. [17]

    Does localization inform editing? surprising differences in causality-based localization vs

    Peter Hase, Mohit Bansal, Been Kim, and Asma Ghandeharioun. Does localization inform editing? surprising differences in causality-based localization vs. knowledge editing in language models. Advances in Neural Information Processing Systems, 36, 2023

    2023

  10. [18]

    Self-destructing models: Increasing the costs of harmful dual uses of foundation models

    Peter Henderson, Eric Mitchell, Christopher Manning, Dan Jurafsky, and Chelsea Finn. Self-destructing models: Increasing the costs of harmful dual uses of foundation models. In Proceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society, pp.\ 287--296, 2023

    2023

  11. [19]

    Selective amnesia: A continual learning approach to forgetting in deep generative models

    Alvin Heng and Harold Soh. Selective amnesia: A continual learning approach to forgetting in deep generative models. arXiv preprint arXiv:2305.10120, 2023. URL https://arxiv.org/pdf/2305.10120.pdf

    2023 arXiv

  12. [20]

    Tifa: Accurate and interpretable text-to-image faithfulness evaluation with question answering

    Yushi Hu, Benlin Liu, Jungo Kasai, Yizhong Wang, Mari Ostendorf, Ranjay Krishna, and Noah A Smith. Tifa: Accurate and interpretable text-to-image faithfulness evaluation with question answering. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp.\ 2...

    2023

  13. [21]

    Propagation and pitfalls: Reasoning-based assessment of knowledge editing through counterfactual tasks

    Wenyue Hua, Jiang Guo, Mingwen Dong, Henghui Zhu, Patrick Ng, and Zhiguo Wang. Propagation and pitfalls: Reasoning-based assessment of knowledge editing through counterfactual tasks. arXiv preprint arXiv:2401.17585, 2024. URL https://arxiv.org/pdf/2401.17585.pdf

    2024 arXiv

  14. [22]

    Liu, Shu Wu, Liang Wang, and Tien-Ping Tan

    Han Huang, Haitian Zhong, Q. Liu, Shu Wu, Liang Wang, and Tien-Ping Tan. Kebench: A benchmark on knowledge editing for large vision-language models. ArXiv, abs/2403.07350, 2024. URL https://api.semanticscholar.org/CorpusID:268364273

    2024 arXiv

  15. [23]

    Editing models with task arithmetic, 2023

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic, 2023. URL https://arxiv.org/pdf/2212.04089.pdf

    2023 arXiv

  16. [24]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of naacL-HLT, volume 1, pp.\ 2, 2019

    2019

  17. [25]

    Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense

    Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. arXiv preprint arXiv:2303.13408, 2023

    2023 arXiv

  18. [26]

    Ablating concepts in text-to-image diffusion models

    Nupur Kumari, Bingliang Zhang, Sheng-Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. arXiv preprint arXiv:2303.13516, 2023. URL https://arxiv.org/pdf/2303.13516.pdf

    2023 arXiv

  19. [27]

    Lora fine-tuning efficiently undoes safety training in llama 2-chat 70b

    Simon Lermen, Charlie Rogers-Smith, and Jeffrey Ladish. Lora fine-tuning efficiently undoes safety training in llama 2-chat 70b. arXiv preprint arXiv:2310.20624, 2023

    2023 arXiv

  20. [28]

    Single image unlearning: Efficient machine unlearning in multimodal large language models

    Jiaqi Li, Qianshan Wei, Chuanyi Zhang, Guilin Qi, Miaozeng Du, Yongrui Chen, and Sheng Bi. Single image unlearning: Efficient machine unlearning in multimodal large language models. arXiv preprint arXiv:2405.12523, 2024 a

    2024 arXiv

  21. [29]

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven C. H. Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In International Conference on Machine Learning (ICML), 2023. URL https://api.semanticscholar.org/CorpusID:256390509

    2023

  22. [30]

    The wmdp benchmark: Measuring and reducing malicious use with unlearning

    Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The wmdp benchmark: Measuring and reducing malicious use with unlearning. arXiv preprint arXiv:2403.03218, 2024 b . URL htt...

    2024 arXiv

  23. [31]

    Visual instruction tuning

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. In NeurIPS, 2023 a

    2023

  24. [32]

    Query-relevant images jailbreak large multi-modal models

    Xin Liu, Yichen Zhu, Yunshi Lan, Chao Yang, and Yu Qiao. Query-relevant images jailbreak large multi-modal models. arXiv preprint arXiv:2311.17600, 2023 b

    2023 arXiv

  25. [33]

    Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-B'eguelin

    Nils Lukas, A. Salem, Robert Sim, Shruti Tople, Lukas Wutschitz, and Santiago Zanella-B'eguelin. Analyzing leakage of personally identifiable information in language models. 2023 IEEE Symposium on Security and Privacy (SP), pp.\ 346--363, 2023. URL https://api.semanticscholar....

    2023

  26. [34]

    Eight methods to evaluate robust unlearning in llms

    Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. Eight methods to evaluate robust unlearning in llms. arXiv preprint arXiv:2402.16835, 2024

    2024 arXiv

  27. [35]

    Tofu: A task of fictitious unlearning for llms

    Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter. Tofu: A task of fictitious unlearning for llms. arXiv preprint arXiv:2401.06121, 2024

    2024 arXiv

  28. [36]

    Ok-vqa: A visual question answering benchmark requiring external knowledge

    Kenneth Marino, Mohammad Rastegari, Ali Farhadi, and Roozbeh Mottaghi. Ok-vqa: A visual question answering benchmark requiring external knowledge. In Proceedings of the IEEE/cvf conference on computer vision and pattern recognition, pp.\ 3195--3204, 2019

    2019

  29. [37]

    Locating and editing factual associations in GPT

    Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in GPT . Advances in Neural Information Processing Systems, 36, 2022

    2022

  30. [38]

    interpreting gpt: the logit lens, 2020

    nostalgebraist. interpreting gpt: the logit lens, 2020. URL https://www.lesswrong.com/posts/AcKRB8wDpdaN6v6ru/interpreting-gpt-the-logit-lens

    2020

  31. [39]

    Gpt-4 technical report

    OpenAI. Gpt-4 technical report. 2023. URL https://api.semanticscholar.org/CorpusID:257532815

    2023

  32. [40]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35: 0 2...

    2022

  33. [41]

    Can sensitive information be deleted from llms? objectives for defending against extraction attacks

    Vaidehi Patil, Peter Hase, and Mohit Bansal. Can sensitive information be deleted from llms? objectives for defending against extraction attacks. In The Twelfth International Conference on Learning Representations, 2023 a

    2023

  34. [42]

    Debiasing multimodal models via causal information minimization

    Vaidehi Patil, Adyasha Maharana, and Mohit Bansal. Debiasing multimodal models via causal information minimization. In Findings of the Association for Computational Linguistics: EMNLP 2023, pp.\ 4108--4123, 2023 b

    2023

  35. [43]

    Refinesumm: Self-refining mllm for generating a multimodal summarization dataset

    Vaidehi Patil, Leonardo Ribeiro, Mengwen Liu, Mohit Bansal, and Markus Dreyer. Refinesumm: Self-refining mllm for generating a multimodal summarization dataset. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ...

    2024

  36. [44]

    Upcore: Utility-preserving coreset selection for balanced unlearning

    Vaidehi Patil, Elias Stengel-Eskin, and Mohit Bansal. Upcore: Utility-preserving coreset selection for balanced unlearning. arXiv preprint arXiv:2502.15082, 2025

    2025 arXiv

  37. [45]

    Mllm-protector: Ensuring mllm's safety without hurting performance

    Renjie Pi, Tianyang Han, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. Mllm-protector: Ensuring mllm's safety without hurting performance. arXiv preprint arXiv:2401.02906, 2024

    2024 arXiv

  38. [46]

    SDXL : Improving latent diffusion models for high-resolution image synthesis

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas M \"u ller, Joe Penna, and Robin Rombach. SDXL : Improving latent diffusion models for high-resolution image synthesis. In The Twelfth International Conference on Learning Representations, 2024. UR...

    2024

  39. [47]

    Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693, 2023

    Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693, 2023

    2023 arXiv

  40. [48]

    Sentence-bert: Sentence embeddings using siamese bert-networks

    Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert-networks. In Conference on Empirical Methods in Natural Language Processing, 2019. URL https://api.semanticscholar.org/CorpusID:201646309

    2019

  41. [49]

    Grounded sam: Assembling open-world models for diverse visual tasks, 2024

    Tianhe Ren, Shilong Liu, Ailing Zeng, Jing Lin, Kunchang Li, He Cao, Jiayu Chen, Xinyu Huang, Yukang Chen, Feng Yan, Zhaoyang Zeng, Hao Zhang, Feng Li, Jie Yang, Hongyang Li, Qing Jiang, and Lei Zhang. Grounded sam: Assembling open-world models for diverse visual tasks, 2024

    2024

  42. [50]

    Exploring resiliency to natural image corruptions in deep learning using design diversity

    Rafael Rosales, Pablo Munoz, and Michael Paulitsch. Exploring resiliency to natural image corruptions in deep learning using design diversity. arXiv preprint arXiv:2303.09283, 2023

    2023 arXiv

  43. [51]

    Xstest: A test suite for identifying exaggerated safety behaviours in large language models

    Paul R \"o ttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263, 2023

    2023 arXiv

  44. [52]

    Scalable and transferable black-box jailbreaks for language models via persona modulation

    Rusheb Shah, Quentin Feuillade Montixi, Soroush Pour, Arush Tagade, and Javier Rando. Scalable and transferable black-box jailbreaks for language models via persona modulation. In Socially Responsible Language Modelling Research, 2023

    2023

  45. [53]

    Detecting pretraining data from large language models

    Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. arXiv preprint arXiv:2310.16789, 2023

    2023 arXiv

  46. [54]

    Yolov9: Learning what you want to learn using programmable gradient information

    Chien-Yao Wang, I-Hau Yeh, and Hongpeng Liao. Yolov9: Learning what you want to learn using programmable gradient information. ArXiv, abs/2402.13616, 2024. URL https://api.semanticscholar.org/CorpusID:267770251

    2024 arXiv

  47. [55]

    Shadow alignment: The ease of subverting safely-aligned language models

    Xianjun Yang, Xiao Wang, Qi Zhang, Linda Petzold, William Yang Wang, Xun Zhao, and Dahua Lin. Shadow alignment: The ease of subverting safely-aligned language models. arXiv preprint arXiv:2310.02949, 2023

    2023 arXiv

  48. [56]

    Safree: Training-free and adaptive guard for safe text-to-image and video generation

    Jaehong Yoon, Shoubin Yu, Vaidehi Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation. arXiv preprint arXiv:2410.12761, 2024

    2024 arXiv

  49. [57]

    Rrhf: Rank responses to align language models with human feedback without tears

    Zheng Yuan, Hongyi Yuan, Chuanqi Tan, Wei Wang, Songfang Huang, and Fei Huang. Rrhf: Rank responses to align language models with human feedback without tears. arXiv preprint arXiv:2304.05302, 2023

    2023 arXiv

  50. [58]

    Removing rlhf protections in gpt-4 via fine-tuning

    Qiusi Zhan, Richard Fang, Rohan Bindu, Akul Gupta, Tatsunori Hashimoto, and Daniel Kang. Removing rlhf protections in gpt-4 via fine-tuning. arXiv preprint arXiv:2311.05553, 2023

    2023 arXiv

  51. [59]

    Removing rlhf protections in gpt-4 via fine-tuning

    Qiusi Zhan, Richard Fang, Rohan Bindu, Akul Gupta, Tatsunori B Hashimoto, and Daniel Kang. Removing rlhf protections in gpt-4 via fine-tuning. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language T...

    2024

  52. [60]

    Forget-me-not: Learning to forget in text-to-image diffusion models

    Eric Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me-not: Learning to forget in text-to-image diffusion models. arXiv preprint arXiv:2303.17591, 2023

    2023 arXiv

  53. [61]

    Modifying memories in transformer models

    Chen Zhu, Ankit Singh Rawat, Manzil Zaheer, Srinadh Bhojanapalli, Daliang Li, Felix Yu, and Sanjiv Kumar. Modifying memories in transformer models. arXiv preprint arXiv:2012.00363, 2020

    2012 arXiv

  54. [62]

    Minigpt-4: Enhancing vision-language understanding with advanced large language models

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. ArXiv, abs/2304.10592, 2023. URL https://api.semanticscholar.org/CorpusID:258291930

    2023 arXiv

  55. [63]

    Safety fine-tuning at (almost) no cost: A baseline for vision large language models

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207, 2024

    2024 arXiv

  56. [64]

    Universal and transferable adversarial attacks on aligned language models

    Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. URL https://arxiv.org/pdf/2307.15043.pdf

    2023 arXiv

  57. [65]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.