REVIEW 3 major objections 6 minor 186 references
Measure, Don't Optimize: Forecasting Recovery in LLM Unlearning
T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read J-Access, an inference-time audit using the Jacobian lens, shows that residual internal accessibility predicts model-level relearning recovery but cannot certify individual facts, and that minimizing the audit score makes recovery worse.
desk verdict J-Access is a genuinely useful empirical contribution—behavioral forgetting hides recoverable knowledge, and the audit predicts model-level recovery but fails as an optimization target—though the checkpoint-dependent normalization and missing artifacts leave the quantitative story unfinished. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the Jacobian lens: a corpus-averaged Jacobian $J_\ell = \mathbb{E}_{x,p,p'\ge p}[\partial h_{T,p'}(x)/\partial h_{\ell,p}(x)]$ that transports residual-stream states from an intermediate layer $\ell$ into the basis of a later target layer $T$, followed by the model's unembedding $z_{\ell,p}(x)=W_U\,\mathrm{Norm}(J_\ell h_{\ell,p}(x))$ to produce vocabulary scores. J-Access then records, over a band of mid-to-late layers and readout positions, whether any token in the target concept set appears in the top $k$ decoded tokens, and normalizes the resulting access rate against the original model and a retain-only gold model. The lens matters because unlearning can shift representations and break the shared-basis assumption of a direct logit lens; the linear transport is what lets the audit read accessibility without relying on the model's expressed output. This machinery does the argument's work by converting residual traces into a score that can be correlated with recovery and, in the WD-Train variant, differentiated as a training penalty that augments the unlearning loss.
What would settle it
Take a set of unlearned checkpoints whose pre-attack J-Access is at or below the retain-only gold level; if, after a fixed cross-entity relearning attack, a substantial fraction of them revive at rates well above the identically attacked gold model, then accessibility does not track recovery susceptibility. A more direct version is to rerun the recovery-prediction analysis with a single fixed probe set shared by all checkpoints instead of per-model silent-probe subsets; if the model-level correlation with revival disappears, the reported signal is an artifact of probe selection rather than of residual knowledge.
Extended reading notes
Core claim
On its own terms, the paper's central discovery is that residual internal accessibility, as measured by J-Access, is a checkpoint-level predictor of relearning vulnerability but not an item-level deletion certificate, and that it cannot be safely optimized. Most unlearned models (85%) retain target knowledge more accessible than a retain-only gold model, and the median normalized accessibility is 0.69, so behavioral forgetting does not imply internal erasure. Pre-attack J-Access correlates with excess revival at +0.35 across the pool, +0.45 within method families, and +0.71 with the knowledge-level variant, and with fewer steps to recover at -0.70. At item level, AUROC for predicting which facts revive stays near chance, and adding J-Access to behavioral and membership-inference predictors adds little. Directly minimizing J-Access via a suppression penalty lowers the score from 0.67 to 0.55 while post-attack revival rises from 0.283 to 0.387 and causal deletion depth stays flat, indicating the model hides knowledge from the audit rather than deleting it. The conclusion is that internal audits belong in unlearning evaluation as an independent diagnostic dimension, but must be validated against causal and recovery evidence before they are optimized.
Load-bearing premise
The load-bearing premise is that the corpus-averaged Jacobian lens still transports intermediate residual states into the target-layer basis faithfully after unlearning, and that comparing models on their own behaviorally silent probe sets does not bias the J-Access normalization.
Editorial extensions
If this is right
- Behavioral benchmarks alone can rank unlearned checkpoints by what they output, not by how much erased knowledge remains internally reachable; J-Access supplies that missing dimension.
- Checkpoint-level relearning risk can be monitored before an attack: models with higher pre-attack accessibility recover faster and more fully, even after controlling for forgetting quality and model utility and within every method family tested.
- No item-level deletion certificate is achievable from this signal: facts that revive cannot be distinguished from facts that stay suppressed, so J-Access should not be treated as per-fact proof of erasure.
- Optimizing the audit backfires: a model trained to lower J-Access scores lower on the audit but revives more after relearning, so audit scores should not be used as training rewards or penalties without causal validation.
- Internal audits and behavioral metrics should be reported together; a checkpoint that passes both is more credible than one passing either alone.
Reading between the lines
- If recovery is governed by a shared retrieval pathway rather than per-item traces, as the paper suggests from localization work, then monitoring J-Access on a small probe set may be enough for risk dashboards, while per-fact erasure guarantees may require causal interventions rather than audit scores.
- The backfire result likely extends beyond J-Access to any differentiable white-box audit: any internal metric whose gradient can suppress the measured signal will face the same measure-optimization collapse, so new audits should be tested under optimization before being used as objectives.
- A direct test of the mechanism would be to run relearning attacks on models whose J-Access is reduced by causal interventions, such as mechanistic localization edits, rather than by penalty training; the paper's account predicts these should lower both J-Access and revival, unlike WD-Train.
- Because J-Access normalization conditions on each checkpoint's own behaviorally silent probe subset, cross-checkpoint comparisons could be confounded; fixing a common probe set or weighting probes by difficulty would test whether the recovery correlations hold outside the paper's protocol.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes J-Access, an inference-time audit that uses the Jacobian lens to decode mid-layer residual states into vocabulary space and measures whether target concept tokens appear in the top-k decoded tokens on probes where the model is behaviorally silent. The audit is normalized between the original pre-unlearning model and a retain-only gold model. The authors audit 398 public TOFU/OpenUnlearning checkpoints across eight unlearning methods, conduct cross-entity relearning attacks to define recovery outcomes, and train WD-Train variants that directly penalize J-Access. The central findings are that most unlearned checkpoints retain accessibility above the gold level; pre-attack J-Access correlates with model-level recovery (Spearman +0.35 overall, +0.45 within-method, +0.71 for the knowledge-level variant) but not with item-level recovery (AUROC near 0.5); and minimizing J-Access lowers the audit score but increases post-attack revival, indicating audit evasion rather than deletion.
Significance. If the results hold, J-Access would be a valuable model-level diagnostic for comparing unlearning checkpoints and for prospective risk monitoring: it is evaluated at scale on public models, uses Holm-corrected significance testing, held-out entities for recovery, partial correlations controlling for forget quality and model utility, and a convergent-validity check against the activation-patching UDS criterion. The paper's negative item-level result is important because it cautions against treating internal accessibility as a per-fact deletion certificate, and the WD-Train result is a clean demonstration that a proxy audit can be gamed. The main risks are that the model-dependent silent-probe normalization may compromise cross-checkpoint comparability and that the manuscript refers to appendices that are not included, so the specific methodology cannot currently be audited.
major comments (3)
- [The J-Access Score, Eqs. (4)-(6)] The silent-probe subset I(θ) is checkpoint-dependent, so J-Access is not measured on a fixed audit instrument. Eq. (4) defines I(θ) as the probes on which θ does not emit any concept token, and Eq. (6) evaluates the audited model and both anchors on that same I(θ). A checkpoint can therefore lower its J-Access either by reducing internal accessibility or by becoming behaviorally expressive on high-access probes and removing them from the audited set; conversely, across the 398 checkpoints, models with different silence patterns are scored on different probe subsets, so the anchor values in the numerator and denominator of Eq. (6) can differ due to subset composition alone. The partial correlations in Table 2 control for Forget Quality and Model Utility but not for I(θ) composition, which is a function of the model itself. Please report |I(θ)| and pre-attack emission rates per checkpoint, and re-run the Test 2 and Test 3 analyses on a fixed probe subset (for example, probes silent under all checkpoints) to show that the recovery correlations and the WD-Train backfire result are not driven by this selection effect.
- [Experimental Setup and Appendix References] The method description is incomplete because the manuscript relies on appendices that are not part of the submitted text. Appendix A is said to specify the construction of concept token sets, workspace band selection, readout positions, and layer selection; Appendix B the robustness variants; Appendix C the predictor definitions; and Appendix D the WD-Train objective, hyperparameters, and seed-level results. None of these appendices are present. As a result, key audit parameters (top-k threshold k, workspace band B, readout positions P, concept-token filters, calibration entities) and the 'lens refit after unlearning' control described in Test 1 cannot be checked, and the preregistration status claimed in Table 3 is unverifiable. Please include the appendices or a code release with the full configuration before the methods can be assessed.
- [Test 3, Table 4 and Fig. 4] The central Test 3 claim is not supported with uncertainty quantification. Table 4 reports single values for WD-Train λ = 0, 5, 10 even though the text states three random seeds per setting; no standard errors, confidence intervals, or significance tests are given, and Fig. 4 shows only aggregated lines. The differences that carry the conclusion (J-Access 0.67 to 0.55, revival 0.283 to 0.387, UDS roughly flat) could plausibly be within seed noise. Please report the seed-level results and test the monotone trend, and also state whether the J-Access decrease is accompanied by changes in behavioral emission rate or |I(θ)|, which is the selection channel identified in the first major comment.
minor comments (6)
- [Notation, Eq. (6)] The notation JOcc(θ) introduced in Eq. (6) is not used elsewhere; the paper consistently writes J-Access for the normalized score. Please define the relationship explicitly to avoid confusion.
- [Results, Test 2] The sentence 'This observe admits a natural interpretation' contains a typo and should read 'This observation admits a natural interpretation'.
- [Table 3] The 'J-Access(preregistered)' row is not accompanied by any preregistration specification; please clarify what was fixed in advance and where this is documented.
- [Fig. 4] The y-axis label 'post-attack revial' should be 'post-attack revival'.
- [Test 1 versus Tests 2 and 3] Please state explicitly whether the Jacobian lens used in Tests 2 and 3 is the original corpus-averaged lens or the lens refitted after unlearning; the refit control is mentioned only for Test 1.
- [Table 4] Table 4 reports Model Utility as n/a for RMU; please explain why RMU utility is not reported.
Circularity Check
No circularity: J-Access and recovery are independently measured, and the audit's parameters are fixed on held-out calibration data.
full rationale
The central recovery analysis is not circular. J-Access is computed before any relearning from Jacobian-lens top-k ranks of concept tokens on silent probes (Eqs. 1-6), while recovery is measured after separate fine-tuning via ROUGE recall and answer probability on held-out entities. No parameter of the audit is fitted to recovery outcomes: the lens J_l is a corpus-averaged Jacobian over generic text, the workspace band, readout positions, and k are selected on held-out calibration entities, and the normalization in Eq. (6) uses the original and gold anchors evaluated with the same fixed readout. Excess revival subtracts the identically attacked gold model as an independent baseline, so predictor and outcome are not defined from each other. Test 3 is also non-circular: WD-Train minimizes J-Access, and the observed increase in post-attack revival with flat UDS is an independent empirical result. Self-citations in the related work are background references and are not load-bearing; the Jacobian lens and UDS criterion come from external groups. The model-dependent silent-probe set I(θ) in Eqs. (4)-(6) and the overlap between knowledge-level concept tokens and ROUGE answer words are construct-validity concerns that could bias correlations, but they do not make the recovery prediction equivalent to the audit by construction. The derivation chain is therefore self-contained with respect to its prediction claims.
Assumptions & free parameters
free parameters (5)
- Top-k threshold k =
10
- Workspace band B and readout positions P =
Mid-to-late layers and positions chosen on held-out calibration entities
- Concept token construction filters =
Document-frequency and inferability thresholds (Appendix A)
- WD-Train suppression weight lambda =
0, 5, 10
- Recovery thresholds =
Half of the original model's score for revival and steps-to-recover
assumptions (5)
- domain assumption Jacobian lens linear transport remains valid after unlearning (Eq. 1-2).
- domain assumption Probe queries and concept token sets faithfully operationalize forgotten knowledge.
- domain assumption Relearning attack outcomes isolate revival from fresh learning.
- domain assumption Original and gold models are valid anchors for normalization.
- domain assumption Mid-depth residual states form a verbalizable workspace.
Cite this review
Pith. "Pith review of Measure, Don't Optimize: Forecasting Recovery in LLM Unlearning." pith.science (2026). https://pith.science/paper/KQ5OV7LZ
@misc{pith2026260811408,
author = {Pith},
title = {Pith review of: Measure, Don't Optimize: Forecasting Recovery in LLM Unlearning},
year = {2026},
howpublished = {\url{https://pith.science/paper/KQ5OV7LZ}},
note = {Machine review of arXiv:2608.11408}
}
read the original abstract
Prior white-box studies show that large language models can retain latent traces of target knowledge after unlearning, even when the knowledge is no longer expressed in their outputs. However, existing audits remain limited to one-off diagnostics: it is unclear whether these residual signals can predict future recovery under continued training or serve as reliable optimization targets. Resolving this gap is essential to determine whether internal auditing can move beyond post-hoc evaluation toward proactive risk monitoring and safer unlearning. We propose J-Access, an inference-time audit that uses the Jacobian lens to map intermediate representations into vocabulary space and measures how often target concepts remain accessible along the model's output pathway. We hypothesize that residual accessibility reflects recovery susceptibility: knowledge that remains closer to the output pathway requires less fine-tuning to restore, leading to faster recovery. We audit 398 public unlearned models spanning eight unlearning methods. We find that: (1) most unlearned models retain access above the retain-only gold level; (2) pre-attack accessibility predicts recovery speed and extent at the model level, but cannot identify which specific facts will be recovered; and (3) directly minimizing J-Access does not promote genuine deletion. Instead, the model learns to hide knowledge from the audit, producing lower audit scores but greater post-attack recovery. These findings position J-Access as a model-level diagnostic for assessing residual susceptibility in unlearned models. We argue internal audits should serve as an independent diagnostic dimension in unlearning evaluation, and should not be converted into optimization targets without validation.
Figures
Figures from the paper (1 more)
Reference graph
Works this paper leans on
-
[1]
Bailey, L.; Serrano, A.; Sheshadri, A.; Seleznyov, M.; Taylor, J.; Jenner, E.; Hilton, J.; Casper, S.; Guestrin, C.; and Emmons, S. 2025. Obfuscated Activations Bypass LLM Latent-Space Defenses. arXiv:2412.09565
arXiv 2025
-
[3]
A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N
Bourtoule, L.; Chandrasekaran, V.; Choquette-Choo, C. A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N. 2020. Machine Unlearning. arXiv:1912.03817
arXiv 2020
-
[5]
Cao, P.; Wang, C.; He, Z.; Yuan, H.; Li, J.; Chen, Y.; Liu, K.; Zhao, J.; et al. 2024. Rwku: Benchmarking real-world knowledge unlearning for large language models. Advances in Neural Information Processing Systems, 37: 98213--98263
2024
-
[7]
R.; Lin, H.; Belkin, M.; Huerta, R.; and Vuli \'c , I
Dong, Y. R.; Lin, H.; Belkin, M.; Huerta, R.; and Vuli \'c , I. 2025. Undial: Self-distillation with adjusted logits for robust unlearning in large language models. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), 8827--8840
2025
-
[8]
Dorna, V.; Mekala, A.; Zhao, W.; McCallum, A.; Kolter, Z.; Lipton, Z.; and Maini, P. 2026. Openunlearning: Accelerating llm unlearning via unified benchmarking of methods and metrics. Advances in Neural Information Processing Systems, 38
2026
-
[9]
Eldan, R.; and Russinovich, M. 2023. Who's H arry P otter? A pproximate Unlearning in LLM s. arXiv preprint arXiv:2310.02238
arXiv 2023
-
[10]
Fan, C.; Jia, J.; Zhang, Y.; Ramakrishna, A.; Hong, M.; and Liu, S. 2025. Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond. In ICML
2025
-
[11]
Fan, C.; Liu, J.; Lin, L.; Jia, J.; Zhang, R.; Mei, S.; and Liu, S. 2026. Simplicity prevails: Rethinking negative preference optimization for llm unlearning. Advances in Neural Information Processing Systems, 38: 1540--1567
2026
Show all 186 references
-
[12]
Gao, L.; Schulman, J.; and Hilton, J. 2022. Scaling Laws for Reward Model Overoptimization. arXiv:2210.10760
2022 arXiv
-
[15]
Guo, C.; Goldstein, T.; Hannun, A.; and van der Maaten, L. 2023. Certified Data Removal from Machine Learning Models. arXiv:1911.03030
2023 arXiv
-
[18]
Hong, Y.; Yu, L.; Yang, H.; Ravfogel, S.; and Geva, M. 2025. Intrinsic Test of Unlearning Using Parametric Knowledge Traces. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 19524--19546
2025
-
[19]
Hong, Y.; Zou, Y.; Hu, L.; Zeng, Z.; Wang, D.; and Yang, H. 2024. Dissecting fine-tuning unlearning in large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 3933--3941
2024
-
[20]
Hu, S.; Fu, Y.; Wu, S.; and Smith, V. 2024. Jogging the memory of unlearned models through targeted relearning attacks. In ICML 2024 Workshop on Foundation Models in the Wild
2024
-
[21]
Jacobi, C. G. J. 1841. De Determinantibus functionalibus. Journal f \"u r die reine und angewandte Mathematik (Crelles Journal) , 1841(22): 319--359
-
[22]
Jang, J.; Yoon, D.; Yang, S.; Cha, S.; Lee, M.; Logeswaran, L.; and Seo, M. 2023. Knowledge unlearning for mitigating privacy risks in language models. In ACL
2023
-
[25]
Y.; Xu, X.; Li, H.; et al
Liu, S.; Yao, Y.; Jia, J.; Casper, S.; Baracaldo, N.; Hase, P.; Yao, Y.; Liu, C. Y.; Xu, X.; Li, H.; et al. 2025. Rethinking machine unlearning for large language models. Nature Machine Intelligence
2025
-
[28]
C.; and Kolter, J
Maini, P.; Feng, Z.; Schwarzschild, A.; Lipton, Z. C.; and Kolter, J. Z. 2024. Tofu: A task of fictitious unlearning for llms. In CoLM
2024
-
[29]
A.; and Lobo, E
Mekala, A.; Dorna, V.; Dubey, S.; Lalwani, A.; Koleczek, D.; Rungta, M.; Hasan, S. A.; and Lobo, E. 2025. Alternate preference optimization for unlearning factual knowledge in large language models. In Proceedings of the 31st International Conference on Computational Linguisti...
2025
-
[30]
R.; Hase, P.; and Bansal, M
Patil, V. R.; Hase, P.; and Bansal, M. 2024. Can sensitive information be deleted from llms? objectives for defending against extraction attacks. In International Conference on Learning Representations, volume 2024, 45497--45514
2024
-
[33]
A.; and Zhang, C
Shi, W.; Lee, J.; Huang, Y.; Malladi, S.; Zhao, J.; Holtzman, A.; Liu, D.; Zettlemoyer, L.; Smith, N. A.; and Zhang, C. 2025. MUSE : Machine unlearning six-way evaluation for language models. In ICLR
2025
-
[35]
Song, Z.; Jiang, Q.; Cui, M.; Li, M.; Gao, L.; Zhang, Z.; Xu, Z.; Wang, Y.; Ouyang, G.; Chen, Z.; et al. 2026. Audio jailbreak: An open comprehensive benchmark for jailbreaking large audio-language models. In Proceedings of the 64th Annual Meeting of the Association for Comput...
2026
-
[36]
Song, Z.; Yan, B.; Liu, Y.; Fang, M.; Li, M.; Yan, R.; and Chen, X. 2025. Injecting Domain-Specific Knowledge into Large Language Models: A Comprehensive Survey. In Christodoulopoulos, C.; Chakraborty, T.; Rose, C.; and Peng, V., eds., Findings of the Association for Computati...
2025
-
[37]
S.; and Smith, V
Thaker, P.; Hu, S.; Kale, N.; Maurya, Y.; Wu, Z. S.; and Smith, V. 2025. Position: LLM Unlearning Benchmarks are Weak Measures of Progress. arXiv:2410.02879
2025 arXiv
-
[38]
Wang, C.; Gu, T.; Wei, Z.; Gao, L.; Song, Z.; and Chen, X. 2025. Word form matters: Llms’ semantic reconstruction under typoglycemia. In Findings of the Association for Computational Linguistics: ACL 2025, 16870--16885
2025
-
[40]
Zhang, R.; Lin, L.; Bai, Y.; and Mei, S. 2024. Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning. In CoLM
2024
-
[41]
Zhang, Z.; Wang, F.; Li, X.; Wu, Z.; Tang, X.; Liu, H.; He, Q.; Yin, W.; and Wang, S. 2025. Catastrophic failure of llm unlearning via quantization. In International Conference on Learning Representations, volume 2025, 74925--74948
2025
-
[42]
2023 , eprint=
Certified Data Removal from Machine Learning Models , author=. 2023 , eprint=
2023
-
[43]
2025 , eprint=
Position: LLM Unlearning Benchmarks are Weak Measures of Progress , author=. 2025 , eprint=
2025
-
[44]
2022 , eprint=
Scaling Laws for Reward Model Overoptimization , author=. 2022 , eprint=
2022
-
[45]
2025 , eprint=
Obfuscated Activations Bypass LLM Latent-Space Defenses , author=. 2025 , eprint=
2025
-
[46]
2020 , eprint=
Machine Unlearning , author=. 2020 , eprint=
2020
-
[47]
arXiv preprint arXiv:2212.03827 , year=
Discovering latent knowledge in language models without supervision , author=. arXiv preprint arXiv:2212.03827 , year=
-
[48]
arXiv preprint arXiv:2505.14352 , year=
Towards eliciting latent knowledge from LLMs with mechanistic interpretability , author=. arXiv preprint arXiv:2505.14352 , year=
-
[49]
arXiv preprint arXiv:2407.00106 , year=
Ununlearning: Unlearning is not sufficient for content regulation in advanced generative ai , author=. arXiv preprint arXiv:2407.00106 , year=
-
[50]
arXiv preprint arXiv:2411.02631 , year=
Extracting unlearned information from llms with activation steering , author=. arXiv preprint arXiv:2411.02631 , year=
-
[51]
arXiv preprint arXiv:2401.06102 , year=
Patchscopes: A unifying framework for inspecting hidden representations of language models , author=. arXiv preprint arXiv:2401.06102 , year=
-
[52]
Injecting Domain-Specific Knowledge into Large Language Models: A Comprehensive Survey
Song, Zirui and Yan, Bin and Liu, Yuhan and Fang, Miao and Li, Mingzhe and Yan, Rui and Chen, Xiuying. Injecting Domain-Specific Knowledge into Large Language Models: A Comprehensive Survey. Findings of the Association for Computational Linguistics: EMNLP 2025. 2025. doi:10.18...
2025 doi
-
[53]
arXiv preprint arXiv:2505.15524 , year=
Evaluate bias without manual test sets: A concept representation perspective for llms , author=. arXiv preprint arXiv:2505.15524 , year=
-
[54]
arXiv preprint arXiv:2605.01844 , year=
The Cylindrical Representation Hypothesis for Language Model Steering , author=. arXiv preprint arXiv:2605.01844 , year=
-
[55]
Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
Audio jailbreak: An open comprehensive benchmark for jailbreaking large audio-language models , author=. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
-
[56]
Findings of the Association for Computational Linguistics: ACL 2025 , pages=
Word form matters: Llms’ semantic reconstruction under typoglycemia , author=. Findings of the Association for Computational Linguistics: ACL 2025 , pages=
2025
-
[57]
Undial: Self-distillation with adjusted logits for robust unlearning in large language models , author=. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Pape...
2025
-
[58]
arXiv preprint arXiv:2403.03218 , year=
The wmdp benchmark: Measuring and reducing malicious use with unlearning , author=. arXiv preprint arXiv:2403.03218 , year=
-
[59]
International Conference on Learning Representations , volume=
Catastrophic failure of llm unlearning via quantization , author=. International Conference on Learning Representations , volume=
-
[60]
arXiv preprint arXiv:2410.12949 , year=
Mechanistic unlearning: Robust knowledge unlearning and editing via mechanistic localization , author=. arXiv preprint arXiv:2410.12949 , year=
-
[61]
Advances in Neural Information Processing Systems , volume=
Simplicity prevails: Rethinking negative preference optimization for llm unlearning , author=. Advances in Neural Information Processing Systems , volume=
-
[62]
Proceedings of the 31st International Conference on Computational Linguistics , pages=
Alternate preference optimization for unlearning factual knowledge in large language models , author=. Proceedings of the 31st International Conference on Computational Linguistics , pages=
-
[63]
, author=
De Determinantibus functionalibus. , author=. Journal f. 1841 , publisher=
-
[64]
ICML 2024 Workshop on Foundation Models in the Wild , year=
Jogging the memory of unlearned models through targeted relearning attacks , author=. ICML 2024 Workshop on Foundation Models in the Wild , year=
2024
-
[65]
arXiv preprint arXiv:2410.08827 , year=
Do unlearning methods remove information from language model weights? , author=. arXiv preprint arXiv:2410.08827 , year=
-
[66]
arXiv preprint arXiv:2409.18025 , year=
An adversarial perspective on machine unlearning for ai safety , author=. arXiv preprint arXiv:2409.18025 , year=
-
[67]
Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=
Dissecting fine-tuning unlearning in large language models , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=
2024
-
[68]
Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=
Intrinsic Test of Unlearning Using Parametric Knowledge Traces , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=
2025
-
[69]
arXiv preprint arXiv:2605.24614 , year=
Measuring the Depth of LLM Unlearning via Activation Patching , author=. arXiv preprint arXiv:2605.24614 , year=
-
[70]
arXiv preprint arXiv:2607.15495 , year=
Verbalizable representations form a global workspace in language models , author=. arXiv preprint arXiv:2607.15495 , year=
-
[71]
International Conference on Learning Representations , volume=
Can sensitive information be deleted from llms? objectives for defending against extraction attacks , author=. International Conference on Learning Representations , volume=
-
[72]
Advances in Neural Information Processing Systems , volume=
Openunlearning: Accelerating llm unlearning via unified benchmarking of methods and metrics , author=. Advances in Neural Information Processing Systems , volume=
-
[73]
Advances in Neural Information Processing Systems , volume=
Rwku: Benchmarking real-world knowledge unlearning for large language models , author=. Advances in Neural Information Processing Systems , volume=
-
[74]
arXiv preprint arXiv:2605.16776 , year=
Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning , author=. arXiv preprint arXiv:2605.16776 , year=
-
[75]
arXiv preprint arXiv:2303.08774 , year=
Gpt-4 technical report , author=. arXiv preprint arXiv:2303.08774 , year=
-
[76]
arXiv preprint arXiv:2412.19437 , year=
Deepseek-v3 technical report , author=. arXiv preprint arXiv:2412.19437 , year=
-
[77]
Arxiv Preprint , year=
What Is Preference Optimization Doing, How and Why? , author=. Arxiv Preprint , year=
-
[78]
International Conference on Learning Representations , year=
Explainable LLM Unlearning through Reasoning , author=. International Conference on Learning Representations , year=
-
[79]
ICML , year=
In-Context Unlearning: Language Models as Few-Shot Unlearners , author=. ICML , year=
-
[80]
Nature Machine Intelligence , year=
Rethinking machine unlearning for large language models , author=. Nature Machine Intelligence , year=
-
[81]
Proceedings of the ACM collective intelligence conference , year=
Gender bias and stereotypes in large language models , author=. Proceedings of the ACM collective intelligence conference , year=
-
[82]
EMNLP , year=
Copyright violations and large language models , author=. EMNLP , year=
-
[83]
Public Choice , year=
More human than human: measuring ChatGPT political bias , author=. Public Choice , year=
-
[84]
arXiv preprint arXiv:2311.17035 , year=
Scalable extraction of training data from (production) language models , author=. arXiv preprint arXiv:2311.17035 , year=
-
[85]
ICML , year=
GRU: Mitigating the Trade-off between Unlearning and Retention for LLMs , author=. ICML , year=
-
[86]
ICML , year=
Position: Trustllm: Trustworthiness in large language models , author=. ICML , year=
-
[87]
CoLM , year=
Tofu: A task of fictitious unlearning for llms , author=. CoLM , year=
-
[88]
CoLM , year=
Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning , author=. CoLM , year=
-
[89]
ACL , year=
Knowledge unlearning for mitigating privacy risks in language models , author=. ACL , year=
-
[90]
ICLR , year=
Rethinking LLM Unlearning Objectives: A Gradient Perspective and Go Beyond , author=. ICLR , year=
-
[91]
ICML , year=
Exploring Criteria of Loss Reweighting to Enhance LLM Unlearning , author=. ICML , year=
-
[92]
NeurIPS , year=
Lunar: Llm unlearning via neural activation redirection , author=. NeurIPS , year=
-
[93]
arXiv preprint arXiv:2504.05058 , year=
Not all data are unlearned equally , author=. arXiv preprint arXiv:2504.05058 , year=
-
[94]
ICLR , year=
A Probabilistic Perspective on Unlearning and Alignment for Large Language Models , author=. ICLR , year=
-
[95]
arXiv preprint arXiv:2509.24675 , year=
Understanding the Dilemma of Unlearning for Large Language Models , author=. arXiv preprint arXiv:2509.24675 , year=
-
[96]
ICLR , year=
LLM Unlearning with LLM Beliefs , author=. ICLR , year=
-
[97]
arXiv preprint arXiv:2511.04934 , year=
Leak@ k : Unlearning Does Not Make LLMs Forget Under Probabilistic Decoding , author=. arXiv preprint arXiv:2511.04934 , year=
-
[98]
EMNLP , year=
A Fully Probabilistic Perspective on Large Language Model Unlearning: Evaluation and Optimization , author=. EMNLP , year=
-
[99]
S&P , year=
Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning , author=. S&P , year=
-
[100]
2025 , howpublished =
Introducing GPT-5.2 , author =. 2025 , howpublished =
2025
-
[101]
do anything now
" do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models , author=. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , year=
2024
-
[102]
ICML , year=
Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond , author=. ICML , year=
-
[103]
arXiv preprint arXiv:2402.16835 , year=
Eight methods to evaluate robust unlearning in llms , author=. arXiv preprint arXiv:2402.16835 , year=
-
[104]
Predicting Structured Data , year=
A tutorial on energy-based learning , author=. Predicting Structured Data , year=
-
[105]
arXiv preprint arXiv:2302.13971 , year=
Touvron, Hugo and Lavril, Thibaut and Izacard, Gautier and Martinet, Xavier and Lachaux, Marie-Anne and Lacroix, Timoth. arXiv preprint arXiv:2302.13971 , year=
-
[106]
ICML 2025 Workshop MUGen , year=
On the Fragility of Latent Knowledge: Layer-wise Influence under Unlearning in Large Language Model , author=. ICML 2025 Workshop MUGen , year=
2025
-
[107]
arXiv preprint arXiv:2307.09288 , year=
Llama 2: Open foundation and fine-tuned chat models , author=. arXiv preprint arXiv:2307.09288 , year=
-
[108]
Simplicity Prevails: Rethinking Negative Preference Optimization for
Fan, Chongyu and Liu, Jiancheng and Lin, Licong and Jia, Jinghan and Zhang, Ruiqi and Mei, Song and Liu, Sijia , booktitle=. Simplicity Prevails: Rethinking Negative Preference Optimization for
-
[109]
ICALP , year=
Differential privacy , author=. ICALP , year=
-
[110]
CVPR , year=
Eternal sunshine of the spotless net: Selective forgetting in deep networks , author=. CVPR , year=
-
[111]
S&P , year=
Towards making systems forget with machine unlearning , author=. S&P , year=
-
[112]
ACL , year=
Unsupervised word sense disambiguation rivaling supervised methods , author=. ACL , year=
-
[113]
arXiv preprint arXiv:2412.17686 , year=
Large language model safety: A holistic survey , author=. arXiv preprint arXiv:2412.17686 , year=
-
[114]
NeurIPS , year=
A Sober Look at the Robustness of CLIPs to Spurious Features , author=. NeurIPS , year=
-
[115]
arXiv preprint arXiv:2503.01854 , year=
A comprehensive survey of machine unlearning techniques for large language models , author=. arXiv preprint arXiv:2503.01854 , year=
-
[116]
Sutherland , booktitle=
Yi Ren and Danica J. Sutherland , booktitle=. Learning Dynamics of
-
[117]
NeurIPS , year=
Pareto multi-task learning , author=. NeurIPS , year=
-
[118]
NeurIPS , year=
Gradient episodic memory for continual learning , author=. NeurIPS , year=
-
[119]
Unrolling
Thudi, Anvith and Deza, Gabriel and Chandrasekaran, Varun and Papernot, Nicolas , booktitle=. Unrolling
-
[120]
arXiv preprint arXiv:2405.07987 , year=
The platonic representation hypothesis , author=. arXiv preprint arXiv:2405.07987 , year=
-
[121]
Textbooks are all you need
Li, Yuanzhi and Bubeck, S. Textbooks are all you need. arXiv preprint arXiv:2309.05463 , year=
-
[122]
arXiv preprint arXiv:1707.06347 , year=
Proximal policy optimization algorithms , author=. arXiv preprint arXiv:1707.06347 , year=
-
[123]
arXiv preprint arXiv:2403.07691 , year=
Orpo: Monolithic preference optimization without reference model , author=. arXiv preprint arXiv:2403.07691 , year=
-
[124]
NeurIPS , year=
Direct preference optimization: Your language model is secretly a reward model , author=. NeurIPS , year=
-
[125]
Towards Effective Evaluations and Comparisons for
Qizhou Wang and Bo Han and Puning Yang and Jianing Zhu and Tongliang Liu and Masashi Sugiyama , booktitle=. Towards Effective Evaluations and Comparisons for
-
[126]
arXiv preprint arXiv:2402.00888 , year=
Security and privacy challenges of large language models: A survey , author=. arXiv preprint arXiv:2402.00888 , year=
-
[127]
Can sensitive information be deleted from
Patil, Vaidehi and Hase, Peter and Bansal, Mohit , booktitle=. Can sensitive information be deleted from
-
[128]
arXiv preprint arXiv:2303.18223 , year=
A survey of large language models , author=. arXiv preprint arXiv:2303.18223 , year=
-
[129]
arXiv preprint arXiv:1801.10198 , year=
Generating wikipedia by summarizing long sequences , author=. arXiv preprint arXiv:1801.10198 , year=
-
[130]
CVPR , year=
Robust fine-tuning of zero-shot models , author=. CVPR , year=
-
[131]
NeurIPS , year=
Language models are few-shot learners , author=. NeurIPS , year=
-
[132]
arXiv preprint arXiv:2303.17564 , year=
Bloomberggpt: A large language model for finance , author=. arXiv preprint arXiv:2303.17564 , year=
-
[133]
ACL , year=
Automatic evaluation of machine translation quality using longest common subsequence and skip-bigram statistics , author=. ACL , year=
-
[134]
ACL , year=
Quantifying privacy risks of masked language models using membership inference attacks , author=. ACL , year=
-
[135]
NeurIPS , year=
Training language models to follow instructions with human feedback , author=. NeurIPS , year=
-
[136]
arXiv preprint arXiv:2010.01412 , year=
Sharpness-aware minimization for efficiently improving generalization , author=. arXiv preprint arXiv:2010.01412 , year=
2010 arXiv
-
[137]
ICLR , year=
Quantifying memorization across neural language models , author=. ICLR , year=
-
[138]
NeurIPS , year=
Positive-unlabeled learning with non-negative risk estimator , author=. NeurIPS , year=
-
[139]
arXiv preprint arXiv:2205.01068 , year=
Opt: Open pre-trained transformer language models , author=. arXiv preprint arXiv:2205.01068 , year=
-
[140]
NeurIPS , year=
Task arithmetic in the tangent space: Improved editing of pre-trained models , author=. NeurIPS , year=
-
[141]
ICLR , year=
Decoupled weight decay regularization , author=. ICLR , year=
-
[142]
NeurIPS , year=
Knowledge Circuits in Pretrained Transformers , author=. NeurIPS , year=
-
[143]
EMNLP , year=
Knowledge Conflicts for LLMs: A Survey , author=. EMNLP , year=
-
[144]
Provably robust
Chowdhury, Sayak Ray and Kini, Anush and Natarajan, Nagarajan , booktitle=. Provably robust
-
[145]
arXiv preprint arXiv:2104.08164 , year=
Editing factual knowledge in language models , author=. arXiv preprint arXiv:2104.08164 , year=
-
[146]
arXiv preprint arXiv:2407.16216 , year=
A Comprehensive Survey of LLM Alignment Techniques: RLHF, RLAIF, PPO, DPO and More , author=. arXiv preprint arXiv:2407.16216 , year=
-
[147]
arXiv preprint arXiv:2303.08112 , year=
Eliciting latent predictions from transformers with the tuned lens , author=. arXiv preprint arXiv:2303.08112 , year=
-
[148]
EMNLP , year=
Transformer feed-forward layers are key-value memories , author=. EMNLP , year=
-
[149]
USENIX Security , year=
Extracting training data from large language models , author=. USENIX Security , year=
-
[150]
S&P , year=
Machine unlearning , author=. S&P , year=
-
[151]
NeurIPS , year=
Large Language Model Unlearning , author=. NeurIPS , year=
-
[152]
arXiv preprint arXiv:2308.12950 , year=
Code llama: Open foundation models for code , author=. arXiv preprint arXiv:2308.12950 , year=
-
[153]
arXiv preprint arXiv:2308.05374 , year=
Trustworthy LLMs: A Survey and Guideline for Evaluating Large Language Models' Alignment , author=. arXiv preprint arXiv:2308.05374 , year=
-
[154]
ACL , year=
Reasoning with language model prompting: A survey , author=. ACL , year=
-
[155]
Fan, Chongyu and Liu, Jiancheng and Zhang, Yihua and Wei, Dennis and Wong, Eric and Liu, Sijia , journal=
-
[156]
arXiv preprint arXiv:2310.03693 , year=
Fine-tuning aligned language models compromises safety, even when users do not intend to! , author=. arXiv preprint arXiv:2310.03693 , year=
-
[157]
NeurIPS ML Safety Workshop , year=
Hidden poison: Machine unlearning enables camouflaged poisoning attacks , author=. NeurIPS ML Safety Workshop , year=
-
[158]
arXiv preprint arXiv:2305.13860 , year=
Jailbreaking chatgpt via prompt engineering: An empirical study , author=. arXiv preprint arXiv:2305.13860 , year=
-
[159]
arXiv preprint arXiv:2309.00770 , year=
Bias and fairness in large language models: A survey , author=. arXiv preprint arXiv:2309.00770 , year=
-
[160]
arXiv preprint arXiv:2305.13172 , year=
Editing large language models: Problems, methods, and opportunities , author=. arXiv preprint arXiv:2305.13172 , year=
-
[161]
arXiv preprint arXiv:2402.07841 , year=
Do membership inference attacks work on large language models? , author=. arXiv preprint arXiv:2402.07841 , year=
-
[162]
Eldan, Ronen and Russinovich, Mark , journal=. Who's
-
[163]
and Zhang, Chiyuan , booktitle=
Shi, Weijia and Lee, Jaechan and Huang, Yangsibo and Malladi, Sadhika and Zhao, Jieyu and Holtzman, Ari and Liu, Daogao and Zettlemoyer, Luke and Smith, Noah A. and Zhang, Chiyuan , booktitle=
-
[164]
arXiv preprint arXiv:2310.16944 , year=
Zephyr: Direct distillation of lm alignment , author=. arXiv preprint arXiv:2310.16944 , year=
-
[165]
ICLR , year=
In-Context Pretraining: Language Modeling Beyond Document Boundaries , author=. ICLR , year=
-
[166]
arXiv preprint arXiv:2510.17620 , year=
Forget to Know, Remember to Use: Context-Aware Unlearning for Large Language Models , author=. arXiv preprint arXiv:2510.17620 , year=
-
[167]
Grattafiori, Aaron and Dubey, Abhimanyu and Jauhri, Abhinav and Pandey, Abhinav and Kadian, Abhishek and Al-Dahle, Ahmad and Letman, Aiesha and Mathur, Akhil and Schelten, Alan and Vaughan, Alex and others , journal=. The
-
[168]
Zheng, Lianmin and Chiang, Wei-Lin and Sheng, Ying and Zhuang, Siyuan and Wu, Zhanghao and Zhuang, Yonghao and Lin, Zi and Li, Zhuohan and Li, Dacheng and Xing, Eric and others , booktitle=. Judging
-
[169]
AAAI , year=
Latesteval: Addressing data contamination in language model evaluation through dynamic and time-sensitive test construction , author=. AAAI , year=
-
[170]
and Kolter, J
Dorna, Vineeth and Mekala, Anmol and Zhao, Wenlong and McCallum, Andrew and Lipton, Zachary C. and Kolter, J. Zico and Maini, Pratyush , booktitle=
-
[171]
ICLR , year=
Measuring Massive Multitask Language Understanding , author=. ICLR , year=
-
[172]
IEEE Transactions on Emerging Topics in Computational Intelligence , volume=
Machine unlearning: Solutions and challenges , author=. IEEE Transactions on Emerging Topics in Computational Intelligence , volume=
-
[173]
USENIX Security , year=
On the necessity of auditable algorithmic definitions for machine unlearning , author=. USENIX Security , year=
-
[174]
Wang, Yaxuan and Wei, Jiaheng and Liu, Chris Yuhao and Pang, Jinlong and Liu, Quan and Shah, Ankit Parag and Bao, Yujia and Liu, Yang and Wei, Wei , booktitle=
-
[175]
Unlearn What You Want to Forget: Efficient Unlearning for
Chen, Jiaao and Yang, Diyi , booktitle=. Unlearn What You Want to Forget: Efficient Unlearning for
-
[176]
NAACL , year=
Soft Prompting for Unlearning in Large Language Models , author=. NAACL , year=
-
[177]
Jia, Jinghan and Zhang, Yihua and Zhang, Yimeng and Liu, Jiancheng and Runwal, Bharat and Diffenderfer, James and Kailkhura, Bhavya and Liu, Sijia , booktitle=
-
[178]
and Liu, Sijia and Chang, Shiyu , booktitle=
Ji, Jiabao and Liu, Yujian and Zhang, Yang and Liu, Gaowen and Kompella, Ramana R. and Liu, Sijia and Chang, Shiyu , booktitle=. Reversing the forget--retain objectives: An efficient
-
[179]
Adaptive localization of knowledge negation for continual
Wuerkaixi, Abudukelimu and Wang, Qizhou and Cui, Sen and Xu, Wutong and Han, Bo and Niu, Gang and Sugiyama, Masashi and Zhang, Changshui , booktitle=. Adaptive localization of knowledge negation for continual
-
[180]
ICLR , year=
DRAGON: Guard LLM Unlearning in Context via Negative Detection and Reasoning , author=. ICLR , year=
-
[181]
Qwen2.5: A Party of Foundation Models , url =
Qwen Team , month =. Qwen2.5: A Party of Foundation Models , url =
-
[182]
arXiv preprint arXiv:2403.03329 , year=
Guardrail baselines for unlearning in llms , author=. arXiv preprint arXiv:2403.03329 , year=
-
[183]
arXiv preprint arXiv:2505.13312 , year=
Guard: Generation-time llm unlearning via adaptive restriction and detection , author=. arXiv preprint arXiv:2505.13312 , year=
-
[184]
arXiv preprint arXiv:2507.07341 , year=
On the impossibility of separating intelligence from judgment: The computational intractability of filtering for ai alignment , author=. arXiv preprint arXiv:2507.07341 , year=
-
[185]
EMNLP , year=
Unveiling the implicit toxicity in large language models , author=. EMNLP , year=
-
[186]
, author=
DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models. , author=. NeurIPS , year=
-
[187]
The right to be forgotten , author=. Stan. L. Rev. Online , year=
-
[188]
Information & Communications Technology Law , year=
The European Union general data protection regulation: what it is and what it means , author=. Information & Communications Technology Law , year=
-
[189]
NeurIPS , year=
Quark: Controllable text generation with reinforced unlearning , author=. NeurIPS , year=
-
[190]
ICML , year=
Fast Exact Unlearning for In-Context Learning Data for LLMs , author=. ICML , year=
-
[191]
arXiv preprint arXiv:2510.04773 , year=
Distribution Preference Optimization: A Fine-grained Perspective for LLM Unlearning , author=. arXiv preprint arXiv:2510.04773 , year=
-
[192]
NeurIPS Workshop , year=
LLM Unlearning via Calibrated and Tokenized Negative Preference Alignment , author=. NeurIPS Workshop , year=
-
[193]
EMNLP , year=
Can Prompts Rewind Time for LLMs? Evaluating the Effectiveness of Prompted Knowledge Cutoffs , author=. EMNLP , year=
-
[194]
NeurIPS , year=
Efficient learning of sparse representations with an energy-based model , author=. NeurIPS , year=
-
[195]
NeurIPS , year=
Energy-based out-of-distribution detection , author=. NeurIPS , year=
-
[196]
AISTATS , year=
A unified energy-based framework for unsupervised learning , author=. AISTATS , year=
-
[197]
ICLR , year=
Energy-based Generative Adversarial Networks , author=. ICLR , year=
-
[198]
IEEE T-PAMI , year=
Cooperative training of descriptor and generator networks , author=. IEEE T-PAMI , year=
-
[199]
IEEE T-PAMI , year=
Learning energy-based spatial-temporal generative convnets for dynamic patterns , author=. IEEE T-PAMI , year=
-
[200]
ICLR , year=
Plugin estimators for selective classification with out-of-distribution detection , author=. ICLR , year=
-
[201]
ICML , year=
The relationship between Precision-Recall and ROC curves , author=. ICML , year=
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.