Temper-Then-Tilt: Principled Unlearning for Generative Models through Tempering and Classifier Guidance

Aryan Mokhtari; Jacob L. Block; Mehryar Mohri; Sanjay Shakkottai

REVIEW 4 major objections 5 minor 8 references

Temper-Then-Tilt: Principled Unlearning for Generative Models through Tempering and Classifier Guidance

T0 review · 4 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Tempering the base distribution before classifier-guided tilting is necessary to control forget-set leakage when forget data is sharply concentrated, at the cost of a bias-vs-robustness tradeoff.

desk verdict Strong theory in an idealized setting; the LLM experiments are not covered by the stated assumptions, so the empirical claims are less supported than the abstract implies. read the letter →

arxiv 2602.10217 v2 pith:YFMWH5XG submitted 2026-02-10 cs.LG

Jacob L. Block , Mehryar Mohri , Aryan Mokhtari , Sanjay Shakkottai This is my paper

classification cs.LG

keywords machineunlearninggenerativemodelsdensityratioestimationclassifierguidancetemperingforgeterrorfinite-sampleguaranteeslargelanguage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper's central claim is that standard classifier-guided unlearning—tilting a generative model's distribution by a learned retain-vs-forget classifier—cannot faithfully remove a sharply concentrated forget distribution: with finite samples, forget error grows with the peak density of the forget set, and no amount of classifier accuracy removes that dependence. The proposed fix is Temper-Then-Tilt (T3): first raise the base distribution to the power 1/T to flatten high-confidence spikes, then tilt with the classifier. The main theorem shows this changes forget-error scaling from linear in the peak density to a sublinear 1/T power, at the price of a tempering bias and a slower dependence on classifier excess risk. On the TOFU benchmark, the paper reports a forget quality of 0.914 on the 5% split while training only a small linear head on frozen representations, making the approach substantially cheaper than fine-tuning baselines.

What carries the argument

The estimator p̂(T) ∝ p^{1/T} · f̂, where f̂ is a learned surrogate for the Bayes posterior P(s=1|z); the Bayes identity f* ∝ pr/p connects classification to density-ratio estimation; the tempering exponent 1/T converts the peak-density dependence into a sublinear power; the finite-sample excess risk δ of the classifier controls a partition-function lower bound and the final error via Pinsker and Hölder arguments.

What would settle it

Take a base model whose distribution is known to deviate from the empirical data mixture (measure this with a held-out density test), train the T3 head on a sharp synthetic forget mode, and compare forget error to the theoretical bound as the mode sharpens. The claim predicts the tempered error tracks ||pf||∞^{1/T} once δ is fixed; if the error grows faster than this, or if the temperature that minimizes forget error shifts with the model-vs-data mismatch, the central claim is falsified.

Watch

Extended reading notes

Core claim

Under the model that the original generative model pθ* equals the true data mixture p = (1−γ)pr + γpf, the retain distribution is a tilt of p by the Bayes classifier: pr ∝ p · P(s=1|z). The paper proves that the direct tilted estimator p̂r ∝ p · f̂ has retain error O(δ) but forget error as large as Ω(||pf||∞ δ), even when the classifier has excess risk at most δ. The tempered estimator p̂r^(T) ∝ p^{1/T} · f̂ avoids this: its forget error is bounded by a bias term plus O(||pf||∞^{1/T} δ^{1/2k}), so when the forget distribution is sharply peaked, flattening first is what makes unlearning statistically possible. Empirically on the TOFU benchmark this translates to state-of-the-art forget qualit

Load-bearing premise

Everything rests on the assumption that the frozen base model's distribution coincides with the true mixture of retain and forget data; real models deviate from their training distribution, and then the classifier no longer targets the true retain distribution.

Editorial extensions

If this is right

For any unlearning method based on classifier guidance, a sharp forget distribution requires some form of tempering or explicit mode-flattening; otherwise forget error cannot be controlled independently of the classifier's accuracy.
A frozen base model plus a lightweight per-token classifier head is enough to unlearn: the underlying language-model parameters need not be touched, so unlearning cost is dominated by one forward pass to cache features.
The theoretical tradeoff predicts an optimal temperature for each forget set: too small leaks sharp modes, too large distorts retain behavior—observed as non-monotone forget quality in the temperature sweep.
The guarantees are stated in terms of classifier excess risk, so any improvement in the surrogate classification problem (more data, better feature representation) translates directly into better forget/retain error bounds.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the theory assumes pθ* equals the true mixture, real models with systematic distribution shift will weaken the guarantees; a natural extension is to replace f̂ with an estimate of pr/pθ* directly or to calibrate the classifier against the model's own marginals (an inference, not in the paper).
The temperature T could be made adaptive per token or per region instead of global: the bias term in Theorem 3.7 is small where pr and pf are well separated, so a spatially varying T could suppress sharp forget modes without flattening the whole retain distribution—testable in the same TOFU setup.
Since the learned object is a head that outputs a per-vocabulary posterior, the same frozen base model could host many unlearning heads for different forget requests at serving time, turning unlearning into a retrieval/selection problem rather than a model edit (not claimed by the paper).

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear colleague,

Here is my read of arXiv:2602.10217. The paper has a solid theoretical result about classifier-guided unlearning, but the guarantees only hold in an idealized world where the frozen model is exactly the data distribution. The LLM experiments do not verify that this assumption holds, so the empirical claims are supported by the theory less than the abstract suggests.

What is actually new: the temper-then-tilt idea is a sensible combination of two known tools, and the lower bound (Theorem 3.5) is a genuine insight — untempered classifier-guided unlearning has Forget Error growing with the peak density of the forget distribution, and tempering improves that dependence. The proofs are internally coherent at the level of the appendix, and the finite-sample bounds in Theorems 3.7 and 3.8 give a principled tradeoff. The TOFU numbers are strong: 0.914 Forget Quality on the 5% split with a 2.65M-parameter head, and the runtime table is impressive. Credit where it is due: the authors state their assumptions clearly, and they do not claim the lower bound as if it were derived from the same framework that produces the upper bounds.

The soft spots are real but not the kind that destroys the paper. The central assumption that the base model pθ* equals the true mixture p is used to identify the Bayes classifier and to define the target. In the experiments the frozen LLM is not the empirical data distribution. The stress-test note states the issue correctly: with a perfect classifier the estimator is proportional to b^{1/T}·pr/p, and unless b is a power of p, this is not pr. The paper does not bound or measure this mismatch, so the theory does not actually cover the experiments. That is a gap between the theoretical claims and the empirical validation, not a flaw in the proofs themselves.

Two smaller concerns: the excess risk δ is never measured, and the low-rank head (h=20) is not shown to be in a class with small δ, so the bounds could be vacuous in practice. And the hyperparameter selection uses seeds 1 and 2 before averaging over five seeds; that is a mild selection effect, and no code is released. All of these are addressable.

Who should read it: people working on unlearning theory and on parameter-efficient methods for LLM unlearning. It is not a finished answer to the transfer problem, but it is a serious contribution worth discussing. I would send it to peer review, not desk reject. The referees should push on the base-model mismatch and ask for code.

Best.

Referee Report

4 major / 5 minor

Summary. The paper frames machine unlearning in generative models as density-ratio estimation via classifier guidance. It shows that standard classifier-guided tilting of the base distribution can incur large forget-set leakage when the forget distribution is sharply concentrated, and proposes T3-Unlearning, which first tempers the base distribution and then tilts with a learned classifier. The main theoretical results (Theorems 3.3–3.8) give finite-sample bounds on retain and forget errors in terms of the surrogate classifier's excess risk, including a lower bound (Theorem 3.5) indicating that the untempered estimator's forget error depends linearly on the peak forget density. Experiments on TOFU report high Forget Quality with a small linear head over frozen LLM features, along with detailed runtime and parameter-efficiency comparisons.

Significance. If the theoretical guarantees held for the deployed setting, this would be a meaningful contribution: it gives explicit finite-sample bounds linking classifier excess risk to unlearning error, offers a concrete mechanism (tempering) to handle concentrated forget components, and provides an efficient implementation with strong empirical performance. The paper also ships thorough appendix proofs, a synthetic validation of the predicted tempering tradeoff, and a transparent hyperparameter search. However, the strength of the 'principled' claim is limited by two structural gaps: the theory assumes the frozen base model equals the true data mixture, and the theoretical setting is unconditional while the LLM implementation is conditional. These gaps are not merely cosmetic and affect whether the stated theorems apply to the experiments.

major comments (4)

[§1, §2.1, §3; Eq. (5) vs Eq. (8)] The theoretical analysis assumes p in Eq. (8) is the true mixture p = (1−γ)pr + γpf of Section 2.1. The LLM implementation, however, replaces p by the frozen base model pθ* in Eq. (5). When pθ* ≠ p, the Bayes classifier under the true labels is still f* = pr/p, so the deployed estimator is proportional to pθ*^{1/T}·pr/p. This equals pr only if pθ*^{1/T}/p is constant, which for T=1 requires pθ*=p and for T>1 requires pθ* ∝ p^T—both stronger than the stated assumption. Consequently Theorems 3.3–3.8 bound errors for an estimator that is not the one evaluated in Section 4. No term in the theorem statements accounts for the mismatch between pθ* and p. Since real LLMs are not exact data mixtures, the claimed guarantees do not transfer to the experiments. The paper should either add a model-mismatch term to the bounds or substantially qualify the 'principled' claim for the LLM setting.
[§3 vs §2.3/§4] Section 3 explicitly says the setting is 'unconditional generative models over a continuous domain', and the estimator, errors, and proofs use a joint density p(z) over a fixed sample space Z. In the LLM implementation (Section 2.3 and Section 4), the objects are conditional distributions pθ*(y|x), tempered and tilted per token, and the evaluation is on conditional next-token predictions. The paper does not show that the unconditional theory extends to this conditional autoregressive setting. The mixture representation p(z) = (1−γ)pr(z)+γpf(z), with z=(x,y), does not by itself yield the conditional mixture p(y|x) = (1−γ)pr(y|x)+γpf(y|x) that the per-token classifier and estimator assume. Without a formal derivation adapting the KL/ℓ1 metrics and the Bayes classifier to conditional distributions, the theoretical guarantees of Section 3 do not cover the empirical setup.
[§2.3, §3.2, Appendix C] The bounds in Theorems 3.3–3.8 are stated in terms of the classifier's excess risk δ, and the text states that the theory is agnostic to the function class. However, in the LLM implementation the classifier is a low-rank linear head with hidden dimension h=20 on pooled hidden states. No estimate of δ is reported for this classifier on the TOFU task, and the paper does not provide any excess risk bound for this particular function class over the actual feature distribution. The synthetic experiments (Appendix E) do verify the tempering tradeoff when excess risk is controlled, but the TOFU results are not tied to a measured or bounded δ. This leaves the empirical validation disconnected from the theoretical claim that small δ implies small unlearning error.
[§3.3, Theorem 3.5, Remark 3.6] Theorem 3.5 is used to support the claim that 'the dependence on the sharpness of pf is unavoidable' and that tempering is necessary. But the theorem only constructs a single adversarial classifier (setting f̂=ϵ on the forget support) that achieves the stated excess risk while causing leakage. This is an existence result, not a minimax lower bound over all classifiers with excess risk ≤ δ. In particular, a different classifier with the same δ could have much smaller forget error, and the theorem does not exclude the possibility that a learning algorithm might avoid the bad classifier. The claim that sharpening the classifier 'cannot eliminate the fundamental dependence' also conflates the dependence for a fixed δ with the effect of reducing δ. The paper should temper the necessity claim or prove a genuine lower bound over a class of estimators.

minor comments (5)

[§1, Notation] The notation p, pr, pf is used interchangeably for measures, densities, and conditional probabilities. While this is explicitly flagged, it makes the transition from the unconditional theory to the conditional LLM setup harder to follow. A separate notation for conditional densities would improve clarity.
[§4.1, MU-ROUGE] The paper introduces MU-ROUGE as the primary utility metric and later argues that the standard Model Utility is 'unreliable' because some baselines exceed the original model. The new metric is not standard in the TOFU literature, and the choice to switch the primary metric after observing the baseline scores should be justified more carefully, e.g., by showing MU-ROUGE is robust across seeds.
[§4.2, Table 1] T3-Unlearning's FQ values are 0.914 on the 5% split and 0.671 on the 10% split, but the per-seed results in Table 4 show that on the 10% split, three seeds give 0.758 while two seeds give 0.322 and 0.758. This variability is not discussed; the conclusion that T3-Unlearning is 'consistently' better in the 10% split is not fully supported by the seed-level data.
[Appendix F.3.3, Table 5] The temperature sensitivity table shows FQ=0.000 at T=1.0 and FQ=0.586/0.191 at T=2.0, with a peak at T=2.5. Because T is selected on the same benchmark (seeds 1–2) and then reported on five seeds, the improvement at the selected T could be partly due to selection bias. A separate validation set or a confidence interval would make the effect of tempering more convincing.
[§3.4, Theorem 3.7 and 3.8] Both theorems state bounds that hold 'for some τ∈[1,T]' and involve quantities like ∥pf∥_{2,p(τ)_r} and Std_{p(τ)_r}[ln p] that depend on the unknown τ and on p. This makes the bounds non-constructive and hard to verify in practice. A bound that holds uniformly over τ, or a distribution-independent estimate, would be more useful.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the theoretical bounds are derived from an explicit external excess-risk assumption, and the one self-citation is not load-bearing.

full rationale

The derivation chain is not circular. The key identity f*(z) ∝ P(s=1|z) = (1−γ)pr(z)/p(z) follows by Bayes' rule from the explicitly stated mixture model in Eq. (1), and the T3 estimator in Eq. (8) is a standard importance-weighting tilt of that identity. Theorems 3.3–3.8 state unlearning-error guarantees in terms of the surrogate classifier's excess risk δ, which is an externally defined quantity, not a value fitted from TOFU or from the retained/forget distributions being predicted. The lower bound in Theorem 3.5 is explicitly constructed with a classifier whose excess risk is controlled, so it is a genuine adversarial construction rather than a renamed fit. The temperature T is selected empirically on TOFU, but the theoretical results do not depend on those empirical values, and the reported FQ/MU numbers are measurements, not predictions derived from the bounds. The only self-citation, [BMS25], appears in related-work context ('In contrast to these works, which formulate unlearning as a parameter recovery problem') and is not used to justify the main theorems. The assumption that the frozen base model equals the true data mixture p is stated explicitly ('we assume the original model has learned the ground truth distribution p over the full dataset D'; 'we assume approximates the data distribution p'), so the gap between pθ* and p in real LLMs is a robustness/correctness limitation, not a circular step: pr is not defined in terms of fitted values of pθ*. No equation reduces to its own input by construction.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central theoretical claim rests on the idealized assumption that the frozen base model is exactly the data mixture, on an unmeasured excess-risk bound δ, and on integrability of the tempered density. The method introduces no new physical or natural entities; the classifier head is an algorithmic component. The empirical claim depends on tuned hyperparameters (T, h, λ, η) and on an unverified small-δ assumption for the low-rank head.

free parameters (4)

Temperature T = T=2.5 for TOFU 5% and 10% splits
Controls the flattening of the base distribution; the central design choice, selected by grid search in Appendix F.3.1; theoretical bounds treat T as a free knob.
Classifier hidden dimension h = h=20
Capacity of the low-rank linear head; chosen by hyperparameter search; smaller h means fewer parameters but also limits the function class.
Regularization coefficient λ = λ=10^-3
Weight decay for classifier training; tuned in the hyperparameter search.
Learning rate η and training epochs = η=5×10^-4, 100 epochs
Standard training hyperparameters tuned on seeds 1 and 2.

assumptions (6)

domain assumption The base model pθ* equals the mixture p=(1−γ)pr+γpf over the full data distribution
Stated in Section 1 and Section 2.1; the entire density-ratio formulation and all theorems rely on this exact equality.
domain assumption Labeled samples (z,s) are drawn i.i.d. from P with s∼Bernoulli(1−γ), and the learned classifier has excess risk L(fhat)−L(f*)≤δ
Section 3.2; the bounds are conditional on δ, which is not measured in the LLM experiments.
domain assumption p^{1/τ} is integrable for all 1≤τ≤T
Remark 3.2; required for the tempered estimator to be well-defined; for power-law tails this forces α>dT.
standard math Bayes rule gives f*(z)=P(s=1|z) ∝ pr(z)/p(z)
Section 2.1, Eq. (2); standard Bayes computation under the mixture model.
ad hoc to paper The low-rank classifier head in Section 2.3 achieves small excess risk δ for the LLM task
Not proven in the paper; h=20 is a very small capacity. If the actual δ is large, the theoretical guarantees do not transfer to the empirical results.
standard math Standard analytic tools: Pinsker's inequality, Hölder, Jensen, Fubini, mean value theorem
Used throughout the Appendix A proofs.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Temper-Then-Tilt: Principled Unlearning for Generative Models through Tempering and Classifier Guidance." pith.science (2026). https://pith.science/paper/YFMWH5XG

@misc{pith2026260210217,
  author       = {Pith},
  title        = {Pith review of: Temper-Then-Tilt: Principled Unlearning for Generative Models through Tempering and Classifier Guidance},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YFMWH5XG}},
  note         = {Machine review of arXiv:2602.10217}
}

read the original abstract

We study machine unlearning in large generative models by framing the task as density ratio estimation to a target distribution rather than supervised fine-tuning. While classifier guidance is a standard approach for approximating this ratio and can succeed in general, we show it can fail to faithfully unlearn with finite samples when the forget set represents a sharp, concentrated data distribution. To address this, we introduce Temper-Then-Tilt Unlearning (T3-Unlearning), which freezes the base model and applies a two-step inference procedure: (i) tempering the base distribution to flatten high-confidence spikes, and (ii) tilting the tempered distribution using a lightweight classifier trained to distinguish retain from forget samples. Our theoretical analysis provides finite-sample guarantees linking the surrogate classifier's risk to unlearning error, proving that tempering is necessary to successfully unlearn for concentrated distributions. Empirical evaluations on the TOFU benchmark show that T3-Unlearning improves forget quality and generative utility over existing baselines, while training only a fraction of the parameters with a minimal runtime.

Figures

Figures reproduced from arXiv: 2602.10217 by the authors.

**Figure 2.** Retain and Forget Errors as a function of forget set component variance [PITH_FULL_IMAGE:figures/full_fig_p034_2.png] view at source ↗

**Figure 3.** Retain and Forget Errors as a function of sample size [PITH_FULL_IMAGE:figures/full_fig_p036_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Example data and learned classifier for Experiment 2 with [PITH_FULL_IMAGE:figures/full_fig_p037_4.png]

**Figure 5.** Figure 5: Estimated retain set densities pˆ (T) r in the setting of Experiment 2 for n = 25 samples and temperature T ∈ {1.0, 1.5, 2.0}. We observe that as T increases, the estimated density pˆ (T) r (black curve) becomes progressively less influenced by the forget set, with the…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

8 extracted references · 2 linked inside Pith

[1]

Discriminative learning for differing training and test distributions

[BBS07] S. Bickel, M. Br¨ uckner, and T. Scheffer. “Discriminative learning for differing training and test distributions”. In:Proceedings of the 24th international conference on Machine learning. 2007, pp. 81–88 (page 2). [BMS25] J. L. Block, A. Mokhtari, and S. Shakkottai. “Machine Unlearning under Overparameterization”. In:Advances in Neural Informatio...

2007
[23]

Diffusion models beat GANs on image syn- thesis

2010 (page 3). [DN21] P. Dhariwal and A. Nichol. “Diffusion models beat GANs on image syn- thesis”.Advances in Neural Information Processing Systems34 (2021), pp. 8780–8794 (pages 2, 6, 9). [DLBHV25] Y. R. Dong, H. Lin, M. Belkin, R. Huerta, and I. Vuli´ c. “Undial: Self- distillation with adjusted logits for robust unlearning in large language models”. I...

arXiv 2010
[36]

Zero: Memory optimiza- tions toward training trillion parameter models

2023, pp. 53728–53741 (pages 2, 39). [RRRH20] S. Rajbhandari, J. Rasley, O. Ruwase, and Y. He. “Zero: Memory optimiza- tions toward training trillion parameter models”. In:SC20: International Conference for High Performance Computing, Networking, Storage and Analysis. IEEE. 2020, pp. 1–16 (page 42). [R WGKP25] A. Rashid, R. Wu, J. Grosse, A. Kristiadi, an...

2023
[267]

TOFU: A Task of Fictitious Unlearning for LLMs

Proceedings of Machine Learning Research. PMLR, July 2025, pp. 40560–40592 (page 3). [MFSLK24] P. Maini, Z. Feng, A. Schwarzschild, Z. C. Lipton, and J. Z. Kolter. “TOFU: A Task of Fictitious Unlearning for LLMs”. In:First Conference on Language Modeling. 2024 (pages 3, 4, 7, 11, 12, 39, 40). [Mud+24] S. Mudgal, J. Lee, H. Ganapathy, Y. Li, T. Wang, Y. Hu...

2025
[291]

Ticketed learning–unlearning schemes

Proceedings of Machine Learning Research. PMLR, July 2025, pp. 2026–2142 (page 3). [GKKMSZ23] B. Ghazi, P. Kamath, R. Kumar, P. Manurangsi, A. Sekhari, and C. Zhang. “Ticketed learning–unlearning schemes”. In:The Thirty Sixth Annual Con- ference on Learning Theory. PMLR. 2023, pp. 5110–5139 (page 3). [GSHSBS+09] A. Gretton, A. Smola, J. Huang, M. Schmittf...

arXiv 2025
[2016]

Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning

2016 (page 2). 46 [FLLJZML25] C. Fan, J. Liu, L. Lin, J. Jia, R. Zhang, S. Mei, and S. Liu. “Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning”. In:Advances in Neural Information Processing Systems. 2025 (pages 4, 12, 40). [FMR25] D. J. Foster, Z. Mhammedi, and D. Rohatgi. “Is a Good Foundation Necessary for Efficient Rei...

2016
[2018]

Extracting training data from large language models

Statute. Cal. Civ. Code§1798.100 et seq. 2018 (page 2). [CTWJHLRBSE+21] N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. “Extracting training data from large language models”. In:30th USENIX security symposium. 2021, pp. 2633–2650 (page 2). [CKMKY23] H. Chung, J. Kim, M. T. Mcca...

2018
[2025]

Trust region policy optimization

arXiv:2510.03149 [cs.LG](page 3). [SLAJM15] J. Schulman, S. Levine, P. Abbeel, M. Jordan, and P. Moritz. “Trust region policy optimization”. In:International conference on machine learning. PMLR. 2015, pp. 1889–1897 (page 2). [SWDRK17] J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov. “Proximal policy optimization algorithms”.arXiv preprint ...

arXiv 2015

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.

[1] [1]

Discriminative learning for differing training and test distributions

[BBS07] S. Bickel, M. Br¨ uckner, and T. Scheffer. “Discriminative learning for differing training and test distributions”. In:Proceedings of the 24th international conference on Machine learning. 2007, pp. 81–88 (page 2). [BMS25] J. L. Block, A. Mokhtari, and S. Shakkottai. “Machine Unlearning under Overparameterization”. In:Advances in Neural Informatio...

2007

[2] [23]

Diffusion models beat GANs on image syn- thesis

2010 (page 3). [DN21] P. Dhariwal and A. Nichol. “Diffusion models beat GANs on image syn- thesis”.Advances in Neural Information Processing Systems34 (2021), pp. 8780–8794 (pages 2, 6, 9). [DLBHV25] Y. R. Dong, H. Lin, M. Belkin, R. Huerta, and I. Vuli´ c. “Undial: Self- distillation with adjusted logits for robust unlearning in large language models”. I...

arXiv 2010

[3] [36]

Zero: Memory optimiza- tions toward training trillion parameter models

2023, pp. 53728–53741 (pages 2, 39). [RRRH20] S. Rajbhandari, J. Rasley, O. Ruwase, and Y. He. “Zero: Memory optimiza- tions toward training trillion parameter models”. In:SC20: International Conference for High Performance Computing, Networking, Storage and Analysis. IEEE. 2020, pp. 1–16 (page 42). [R WGKP25] A. Rashid, R. Wu, J. Grosse, A. Kristiadi, an...

2023

[4] [267]

TOFU: A Task of Fictitious Unlearning for LLMs

Proceedings of Machine Learning Research. PMLR, July 2025, pp. 40560–40592 (page 3). [MFSLK24] P. Maini, Z. Feng, A. Schwarzschild, Z. C. Lipton, and J. Z. Kolter. “TOFU: A Task of Fictitious Unlearning for LLMs”. In:First Conference on Language Modeling. 2024 (pages 3, 4, 7, 11, 12, 39, 40). [Mud+24] S. Mudgal, J. Lee, H. Ganapathy, Y. Li, T. Wang, Y. Hu...

2025

[5] [291]

Ticketed learning–unlearning schemes

Proceedings of Machine Learning Research. PMLR, July 2025, pp. 2026–2142 (page 3). [GKKMSZ23] B. Ghazi, P. Kamath, R. Kumar, P. Manurangsi, A. Sekhari, and C. Zhang. “Ticketed learning–unlearning schemes”. In:The Thirty Sixth Annual Con- ference on Learning Theory. PMLR. 2023, pp. 5110–5139 (page 3). [GSHSBS+09] A. Gretton, A. Smola, J. Huang, M. Schmittf...

arXiv 2025

[6] [2016]

Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning

2016 (page 2). 46 [FLLJZML25] C. Fan, J. Liu, L. Lin, J. Jia, R. Zhang, S. Mei, and S. Liu. “Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning”. In:Advances in Neural Information Processing Systems. 2025 (pages 4, 12, 40). [FMR25] D. J. Foster, Z. Mhammedi, and D. Rohatgi. “Is a Good Foundation Necessary for Efficient Rei...

2016

[7] [2018]

Extracting training data from large language models

Statute. Cal. Civ. Code§1798.100 et seq. 2018 (page 2). [CTWJHLRBSE+21] N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. “Extracting training data from large language models”. In:30th USENIX security symposium. 2021, pp. 2633–2650 (page 2). [CKMKY23] H. Chung, J. Kim, M. T. Mcca...

2018

[8] [2025]

Trust region policy optimization

arXiv:2510.03149 [cs.LG](page 3). [SLAJM15] J. Schulman, S. Levine, P. Abbeel, M. Jordan, and P. Moritz. “Trust region policy optimization”. In:International conference on machine learning. PMLR. 2015, pp. 1889–1897 (page 2). [SWDRK17] J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov. “Proximal policy optimization algorithms”.arXiv preprint ...

arXiv 2015