REVIEW 8 cited by
Do Unlearning Methods Remove Information from Language Model Weights?
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Large Language Models' knowledge of how to perform cyber-security attacks, create bioweapons, and manipulate humans poses risks of misuse. Previous work has proposed methods to unlearn this knowledge. Historically, it has been unclear whether unlearning techniques are removing information from the model weights or just making it harder to access. To disentangle these two objectives, we propose an adversarial evaluation method to test for the removal of information from model weights: we give an attacker access to some facts that were supposed to be removed, and using those, the attacker tries to recover other facts from the same distribution that cannot be guessed from the accessible facts. We show that using fine-tuning on the accessible facts can recover 88% of the pre-unlearning accuracy when applied to current unlearning methods for information learned during pretraining, revealing the limitations of these methods in removing information from the model weights. Our results also suggest that unlearning evaluations that measure unlearning robustness on information learned during an additional fine-tuning phase may overestimate robustness compared to evaluations that attempt to unlearn information learned during pretraining.
Forward citations
Cited by 8 Pith papers
-
Suppression Sticks, Locality Is Fragile: A Closed-Loop Target-and-Control Audit of Task-Vector Negation in VLA Policies
Subtracting a task vector from a vision-language-action robot policy suppresses the target skill but not its collateral damage: only five of ten LIBERO-Goal skills separate cleanly, and held-out control retention aver...
-
Unlearning Isn't Invisible: Detecting Unlearning Traces in LLMs from Model Outputs
Unlearning in LLMs leaves detectable 'fingerprints' that let a simple classifier distinguish an unlearned model from its original, even on unrelated prompts.
-
Unlearning's Blind Spots: Over-Unlearning and Prototypical Relearning Attack
The paper proposes an over-unlearning metric and a prototype-based relearning attack for class-level machine unlearning, together with a defense objective called Spotter.
-
Existing Large Language Model Unlearning Evaluations Are Inconclusive
Existing LLM unlearning evaluations are inconclusive: they can inject new information, depend heavily on task format, and rely on spurious correlations.
-
Leveraging Per-Instance Privacy for Machine Unlearning
Per-instance privacy losses, estimated from gradient norms during training, predict the number of fine-tuning steps needed for machine unlearning and rank data points by unlearning difficulty.
-
SoK: Machine Unlearning for Large Language Models
A new taxonomy for LLM unlearning distinguishes removal-intended from suppression-intended methods, and argues that gradient ascent methods functionally behave like suppression.
-
BLUR: A Benchmark for LLM Unlearning Robust to Forget-Retain Overlap
BLUR adds forget-retain overlapping combined queries and relearning data to four unlearning benchmarks, and shows existing unlearning methods degrade on them.
-
Step-by-Step Reasoning Attack: Revealing 'Erased' Knowledge in Large Language Models
Step-by-step reasoning prompts can recover purportedly erased facts from unlearned LLMs, but the paper's quantitative evidence is internally inconsistent.
Discussion (0). Sign in to comment.