{"id":"02f7565e-51ca-4480-a0a2-a2efc9f94549","arxiv_id":"2412.18621","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SSU combines task-vector negation, random-label loss, and weight saliency to forget copyrighted books sequentially while retaining more general language ability than existing baselines.","lead":"Guangyao Dou's thesis tests whether copyrighted book content can be removed from large language models one book at a time, using a new method called Stable Sequential Unlearning (SSU) based on subtracting task vectors from model weights. SSU often preserves more general ability than existing unlearning methods, but the author cautions that unlearning alone is not a complete remedy for copyright takedowns.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported SSU trade-off may be an artifact of obfuscation rather than genuine unlearning, since all unlearning-efficacy comparisons rely on Rouge-1/L, which §5.1 concedes can create a false sense of privacy.","rationale":"The reader's weakest assumption matches the main concern I would raise: Rouge-1/Rouge-L lexical overlap is the sole measure of unlearning efficacy in the paper's headline comparison, and the manuscript itself acknowledges in §5.1 that such metrics can create a false sense of privacy and that existing methods may merely obfuscate data. Since the central claim is a trade-off whose x-axis is built entirely from these contested metrics, the claim cannot be regarded as robust until a stronger extraction-based or attack-based evaluation is supplied. The general benchmarks (MMLU and MT-Bench) check broad ability retention but do not test whether memorized text can be elicited through alternative prompts, so they do not resolve the concern. The effect sizes separating SSU from the strongest baselines are modest, which makes the absence of repeated runs and error bars a secondary but reinforcing issue. I therefore agree with the reader's weakest assumption and with the CONDITIONAL verdict: the method is coherent, the reported numbers are internally consistent, and the trade-off is plausible, but the central claim's decisive evidence is missing. The proposed paraphrased-prompt extraction test would either validate or undermine the claim, so the verdict should not be changed, but the conditions attached to acceptance should explicitly include such an evaluation.","tokens_in":31392,"tokens_out":7005,"duration_ms":70058,"concrete_test":"Using the SSU-unlearned Llama3.1 checkpoint corresponding to Table 4.10, run an extraction attack suite (e.g., Wei et al. 2024 or MUSE-style probing) in which each of 200 Df chunks is prompted with 5 paraphrased, reordered, or partial prompts instead of the exact first-100-token prompts used in §4.1.1. Measure the fraction of 50-token verbatim spans from the original books that appear in the generated completions, and compare this fraction with the vanilla model under the same paraphrased prompts. If SSU's verbatim extraction rate remains close to the vanilla rate while exact-prompt Rouge has dropped, then the lower Rouge reflects obfuscation or refusal rather than genuine unlearning, and the trade-off claims in Figures 4.3a/b would need to be reassessed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim in §4.3.4 is that SSU achieves a better trade-off between unlearning efficacy and general-purpose language ability retention than baselines. But 'unlearning efficacy' is defined entirely through Rouge-1 and Rouge-L on Df and Dprev (Eqs. 4.18). The paper's own Section 5.1 states that measuring verbatim memorization can create a false sense of privacy and that unlearning methods may merely obfuscate data rather than genuinely remove it. This is not a peripheral caveat: a model that becomes evasive, generic, or degraded on the exact prompt-continuation task will show lower Rouge scores while still being able to reproduce copyrighted expression under different prompts, paraphrases, or decoding settings. The reported effect sizes are also small, with Rouge-1 reductions of roughly 0.01–0.03 relative to the vanilla model, so even mild metric gaming could reverse the ranking. Because every experimental comparison in Figures 4.3a/b inherits this weakness, the central claim is only as strong as the validity of Rouge as a copyright-risk measure. Section 5.1 is therefore a direct admission that the decisive evidence for the claimed unlearning efficacy has not been supplied.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper investigates sequential machine unlearning as a remedy for LLM copyright infringement. It proposes Stable Sequential Unlearning (SSU), which at each time step fine-tunes the current model on the book to forget plus a random-labeling loss, masks parameter updates with a gradient-based saliency map, and then negates the resulting task vector. Experiments on Llama-3.1-8B-Instruct and Mistral-7B-Instruct-v0.3 compare SSU against prompting, MemFree decoding, gradient ascent, gradient difference, task-vector negation, and NPO over 10 (or 6) books, measuring Rouge-1/Rouge-L on forget/previous/non-target books and MMLU/MT-Bench. The paper reports that SSU provides a favorable, or sometimes favorable, trade-off between unlearning efficacy and retention, while several baselines suffer catastrophic collapse, and it includes ablations of the two SSU components.","tokens_in":31627,"tokens_out":7721,"duration_ms":64390,"significance":"If the central empirical claim holds, SSU is a practical contribution: it addresses a realistic sequential takedown scenario, does not require a retained in-distribution dataset unlike gradient difference, and avoids catastrophic collapse while reducing lexical overlap with targeted books. The paper also makes a useful step by formalizing sequential unlearning for copyrighted text and by reporting results on two 7-8B instruction-tuned models over multiple books, with code released. It deserves credit for candidly stating in Section 5.1 that the evaluation metrics can create a false sense of privacy and that unlearning methods may merely obfuscate data. However, because the trade-off claim is built entirely on Rouge scores and single-run measurements, the significance is conditional on stronger evidence that the observed reductions reflect genuine, non-recoverable forgetting rather than output obfuscation.","major_comments":[{"comment":"The paper's central claim that SSU achieves a better unlearning/retention trade-off is supported only by Rouge-1 and Rouge-L on Df and Dprev. Section 5.1 explicitly acknowledges that verbatim-memorization metrics can create a false sense of privacy and that existing unlearning/editing methods may merely obfuscate data rather than remove it. Since all comparisons of unlearning efficacy in Figures 4.1a/b, 4.2a/b, and 4.3 use these lexical-overlap scores, a model that produces evasive, generic, or degraded continuations would appear to 'unlearn' without actually removing the ability to reproduce the book under other prompts or decoding settings. The reported effects are also small (e.g., Table 4.7, Df Rouge-1: SSU 0.2532 vs. vanilla 0.2678; Table 4.13, Df Rouge-1: SSU 0.2204 vs. NPO 0.2448), so mild obfuscation could change the ranking. Adding membership-inference or extraction-style probes, paraphrase robustness checks, and prompt-variation tests is necessary to substantiate the trade-off claim; absent that, the headline conclusion remains conditional on the very metric the manuscript disowns.","section":"§5.1, Eq. (4.18)"},{"comment":"Every numeric result is a single run with no error bars, repeated seeds, or significance tests. The trade-off plots in Figure 4.3 compare point estimates across methods and time steps; without variance, the apparent superiority of SSU over NPO (e.g., MMLU in Tables 4.3–4.5) cannot be distinguished from noise, especially given differences of only 0.01–0.03 in Rouge scores. The paper should report at least three seeds with confidence intervals or paired tests and should specify whether the same checkpoints are used for all evaluations. This is essential because the paper's own contribution is an empirical trade-off claim, not a theoretical guarantee.","section":"§4.3.4, Tables 4.1–4.16"},{"comment":"The random labeling loss is not well-defined as written. The summation indices are incomplete ('(xfgt,)' and '(,yrnd)'), and it is unclear whether each input is paired with one randomly drawn label per batch, whether labels are drawn with replacement over the full Df, and whether the same random pairing is used across epochs. Since the ablation in Section 4.4.2 credits this loss with improving unlearning consistency, the exact sampling procedure is part of the method and must be specified precisely for reproducibility.","section":"§3.2.1, Eq. (3.3)"},{"comment":"The weight saliency mask is computed as an element-wise threshold on ∇θLf(θt), but the description then says the masked update is applied 'at each gradient accumulation step.' The paper does not say whether the mask is recomputed after each update or frozen for the whole fine-tuning phase; a stale mask would limit the analogy to existing saliency-based unlearning methods. In addition, the threshold γ is defined only as '1 standard deviation away from the mean of the gradient vector,' which is ambiguous about which gradient vector and which axes (all parameters vs. per-module). This should be clarified, since the Section 4.4.1 ablation attributes preservation of general abilities to the mask.","section":"§3.2.1, Eqs. (3.5)–(3.6)"}],"minor_comments":[{"comment":"There are several typos: 'unleaning' in Chapter 1, 'for for' in §4.3.1, 'Dnrr' in §4.3.2, and 'Lora' should be 'LoRA'.","section":"Chapter 1, §4.3.1, §4.3.2"},{"comment":"Dprev values at time step 1 are reported as all zeros, but there is no previously unlearned book at time step 1; these entries should be marked N/A or omitted rather than treated as zero Rouge scores.","section":"Tables 4.1 and 4.11"},{"comment":"The caption says TV collapsed at time step 3 for Mistral-7B, but Table 4.15 shows TV's collapse at time step 5 and §4.3.1 also states time step 5; the caption should be corrected.","section":"Figure 4.3 caption"},{"comment":"The abstract hedges that SSU 'sometimes achieves an effective trade-off,' while §4.3.4 asserts without qualification that SSU achieves a better trade-off; the claims should be aligned with the evidence and with Section 5.1's caveats.","section":"Abstract vs. §4.3.4"},{"comment":"The text says GA collapses at the first time step for Mistral, but Tables 4.11–4.13 report nonzero GA scores and collapse to exactly zero only at time step 4; a precise collapse criterion would avoid ambiguity.","section":"§4.5.2, Table 4.14"}],"recommendation":"major_revision","confidential_remarks":"The manuscript reads as a master's thesis and is candid about its main weakness, but that weakness is also decisive for the central claim. The empirical trade-off result needs either a substantially stronger evaluation (membership/extraction probes, paraphrase and prompt variation, variance estimates) or a much more modest claim. I would not reject outright because the limitation is openly stated and fixable in principle; a major revision with additional experiments and tightened claims seems appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read the arXiv thesis 2412.18621. The useful core: it formally sets up sequential unlearning of copyrighted books as a task, and it shows that a combination of task-vector negation, random-label loss, and gradient-based weight saliency (SSU) degrades less than GA/TV/GD over multiple removal rounds while beating NPO on the reported trade-off. The writing is clear and the limitation section is unusually honest.\n\nWhat is genuinely new and good: the sequential-unlearning formulation, the systematic comparison of existing baselines in this setting (including the documented catastrophic collapse of GA, TV, and Gradient Difference), and SSU itself. The experiments cover two instruction-tuned 7-8B models, ten books, and MMLU/MT-Bench for retention. The ablations show that both the random-label loss and the saliency map matter, which gives some internal evidence that the method is not just one component doing all the work.\n\nNow the soft spots, in proportion. The central unlearning measure is Rouge-1/Rouge-L, which the paper itself (Section 5.1) concedes can create a false sense of privacy and that unlearning methods may merely obfuscate data. That is not a peripheral caveat: every headline comparison in Figures 4.3a/b and the trade-off in Section 4.3.4 inherits this weakness. The stress-test note is fair and lands. However, this is a limitation rather than a fatal flaw, because the contribution is the sequential framework and the empirical comparison, not a certified-removal guarantee. Effect sizes are small—Rouge reductions of 0.01–0.03 relative to vanilla—so the ranking could be fragile, and everything is a single run with no seeds, no error bars, and no significance tests. Given the sampling temperature of 0.4, run-to-run variance could matter. Dprev is only 200 sampled chunks per step, which adds noise. The abstract says code is available, but the text does not actually ship code or data; I could not verify reproducibility. The method has free hyperparameters (epsilon1, epsilon2, gamma, learning-rate schedule) tuned per model and time step, with no sensitivity analysis beyond the two ablations. There is no MIA or adversarial extraction test, which the limitations section correctly identifies as needed. These issues cap the strength of the claim; they do not make the paper worthless.\n\nWho this is for: people working on machine unlearning for LLMs, especially anyone evaluating copyright takedown methods or building sequential-unlearning baselines. It deserves a serious referee, but the referee should ask for multiple seeds, at least one non-Rouge leakage test, and actual code/data before the main trade-off claim is treated as robust. My recommendation: engage with it, but treat the quantitative results as preliminary evidence, not a settled finding.","headline":"A useful first pass at sequential unlearning for copyrighted books, with an honest limitations section, but the core unlearning claim rests on a metric the paper itself admits is weak and on single runs with no released artifacts.","tokens_in":32138,"tokens_out":2201,"would_cite":true,"duration_ms":23337,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Repeated unlearning of copyrighted books can stay stable enough to preserve an LLM's general abilities, the paper argues, by combining random-label training noise with weight-selective updates before subtracting a task vector.","keywords":["machine unlearning","sequential unlearning","copyright infringement","large language models","task vectors","weight saliency","Rouge evaluation","copyright takedown"],"falsifier":"Run an adversarial extraction suite on the SSU-unlearned model: for each book in $D_f$, take a held-out 100-token continuation and prompt the model with dozens of paraphrased instructions (continue in the author's style, complete the scene, etc.). If any prompt elicits a completion whose Rouge-1 score matches the vanilla model's, the low scores on the standard prompt are evasion, not forgetting, and the paper's central trade-off claim collapses.","tokens_in":31166,"feed_emoji":"📚","tokens_out":10308,"duration_ms":81038,"temperature":0.7,"pith_summary":"The paper tries to establish that copyright takedown requests can be handled sequentially, one book at a time as requests arrive, without retraining from scratch, and that this can be done much more stably than existing unlearning methods allow. It proposes Stable Sequential Unlearning (SSU), which fine-tunes the current model on the book to forget while adding a random-labeling loss and masking updates to gradient-salient weights, then subtracts the resulting task vector from the model. On Llama-3.1-8B-Instruct and Mistral-7B-Instruct-v0.3, SSU is reported to achieve a better trade-off between lower Rouge-1/Rouge-L scores on targeted books and stable MMLU/MT-Bench performance than Gradient Ascent, Gradient Difference, Task Vector, and NPO baselines, while prompt-based and decoding-time defenses leave infringement risk essentially unchanged. The paper itself hedges: SSU 'sometimes achieves an effective trade-off' and 'is not a cure-all,' and its limitations section concedes that lexical-overlap metrics may create a false sense of privacy if unlearning merely obfuscates data.","feed_headline":"Unlearn copyrighted books step by step without collapsing the model","feed_subtitle":"SSU improves the Rouge-vs-MMLU trade-off over gradient-ascent, task-vector, and NPO baselines across ten takedown steps.","key_machinery":"The load-bearing object is the stable task vector: instead of subtracting a task vector computed from a plain forget-set fine-tune, SSU computes it from a fine-tune whose loss mixes the forget cross-entropy with a random-labeling term and whose parameter updates are masked by a gradient-based weight saliency map. The random-labeling loss $L_{\\mathrm{rnd}} = \\frac{1}{|D_f|} \\sum_{(x_{\\mathrm{fgt}},\\cdot)\\in D_f} \\sum_{(\\cdot,y_{\\mathrm{rnd}})\\in D_f} L(x_{\\mathrm{fgt}}, y_{\\mathrm{rnd}}, \\theta_t)$ injects controlled noise so the fine-tuned model does not overfit the forget set, and the mask $m_s = \\mathbb{1}(|\\nabla_\\theta L_f(\\theta_t)| \\ge \\gamma)$ confines updates to the weights most relevant to the target data. After this stabilized fine-tuning the method applies the task-vector negation $\\theta_u^t = \\theta_u^{t-1} - (\\theta_{\\mathrm{ft}}^t - \\theta_u^{t-1})$ to erase the book; this is what lets SSU avoid the catastrophic capability collapse that the ablations show when either component is removed.","core_discovery":"The central claim is that sequential unlearning of copyrighted literary works is feasible enough to be worth pursuing as a copyright-takedown remedy, and that SSU is the first method to keep the trade-off between unlearning efficacy and general capability retention favorable across many time steps. At each step $t$ the algorithm fine-tunes the already-unlearned model $\\theta_u^{t-1}$ on the forget set $D_f^t$ with objective $L_f = \\epsilon_1 L_{\\mathrm{fgt}} + \\epsilon_2 L_{\\mathrm{rnd}}$, where $L_{\\mathrm{fgt}}$ is standard cross-entropy and $L_{\\mathrm{rnd}}$ randomly mismatches outputs from $D_f$ to inputs from $D_f$; it restricts each gradient update to the mask $m_s = \\mathbb{1}(|\\nabla_\\theta L_f(\\theta_t)| \\ge \\gamma)$, and then unlearns by $\\theta_u^t = \\theta_u^{t-1} - (\\theta_{\\mathrm{ft}}^t - \\theta_u^{t-1})$. In the reported experiments SSU lands in the top-right region of the unlearning-versus-ability trade-off plots for both models, whereas gradient ascent, gradient difference, and task-vector baselines eventually collapse (MMLU or MT-Bench dropping sharply, sometimes to zero) and NPO leaves Rouge scores near the vanilla model. The paper's own summary is that this trade-off is achieved 'sometimes' and that unlearning is not yet a complete remedy.","pith_inferences":["A natural stress test the paper leaves implicit: run SSU's unlearned model under an adversarial extraction attack with varied prompts, such as 'continue this passage' or style mimicry. If completions recover high-overlap text from $D_f$ while the fixed evaluation prompt keeps Rouge low, the reported unlearning is evasion rather than removal, exactly the risk the limitations section raises.","Because the failure mode SSU targets (gradual then sudden capability collapse) also appears in sequential model editing, the weight-saliency-plus-random-label recipe could plausibly transfer to fact-editing or safety-patching pipelines that use task-vector subtraction; testing that transfer would separate the method's general stabilization effect from its copyright-specific design.","The 'sometimes' hedge suggests the trade-off may depend on model family, learning-rate schedule, or book length; a systematic sweep across more base models and curricula would reveal the boundary conditions under which SSU falls behind NPO or plain task vectors.","Rouge-1/Rouge-L measure n-gram overlap, not semantic reproduction; a stronger evaluation would add semantic-similarity thresholds and membership-inference attacks. Until such metrics are applied, the size of SSU's advantage over baselines should be read as suppression of lexical overlap, not proof of forgetting."],"forward_implications":["A model that has been through ten sequential SSU unlearning steps can still score within a few points of the vanilla model on MMLU and MT-Bench, while baseline gradient-ascent and task-vector methods collapse to near-zero MMLU by step ten.","System-prompt defenses and MemFree decoding do not move Rouge scores materially below the vanilla model, so weight-updating unlearning is the only tested class that meaningfully reduces verbatim reproduction of targeted books.","Both SSU components are load-bearing: removing the weight-saliency mask speeds capability decline, and removing the random-labeling loss raises Rouge scores on $D_f$, so the paper's ablations attribute the trade-off to the two mechanisms working together.","Because SSU needs no in-distribution retained set and no reference model, it avoids two practical overheads that Gradient Difference and NPO carry, making sequential takedowns cheaper to deploy.","The paper's conclusion is that unlearning, even when stabilized, is not a complete copyright-takedown remedy: some non-targeted knowledge and general ability are still lost, so complementary detection-and-regeneration or certified mechanisms are needed."],"supporting_citations":[{"why":"Supplies task arithmetic, the task-vector subtraction mechanism that SSU modifies and evaluates against.","marker":"(Ilharco et al., 2022)"},{"why":"Supplies the gradient-based weight saliency map used to gate parameter updates in SSU.","marker":"(Fan et al., 2023)"},{"why":"Supplies the copyright-takedown evaluation pipeline, system prompts, MemFree implementation, and baseline protocol used in the experiments.","marker":"(Wei et al., 2024)"},{"why":"Supplies the Gradient Difference baseline (gradient ascent plus random mismatch plus KL on a retained set).","marker":"(Yao et al., 2023)"},{"why":"Supplies the NPO baseline and the limitation that a reference model containing copyrighted data compromises unlearning efficacy.","marker":"(Zhang et al., 2024b)"},{"why":"Supplies MemFree decoding, the decoding-time baseline that blocks verbatim memorization but not paraphrased reproduction.","marker":"(Ippolito et al., 2022)"},{"why":"Supplies the bag-of-tricks extraction protocol used to construct prompts and continuations from book chunks.","marker":"(Yu et al., 2023)"},{"why":"Supplies Rouge-1 and Rouge-L, the lexical similarity metrics used to measure unlearning efficacy.","marker":"(Lin, 2004)"}],"fun_headline_variants":["SSU: Stepwise unlearning of copyrighted books without collapse","Sequential unlearning erases copyrighted works, preserves skills","New method unlearns copyrighted tales, keeps model knowledge","SSU: A trade-off lens on sequential copyright unlearning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim that SSU 'unlearns' books rests on treating lower Rouge-1/Rouge-L lexical overlap as evidence of reduced copyright-infringement risk; if the model simply learns to paraphrase or evade the evaluation prompt, the measured unlearning is an artifact of the metric, a possibility the paper itself raises in Section 5.1.","fun_headline_variants_meta":{"raw":{"variants":["SSU: Stepwise unlearning of copyrighted books without collapse","Sequential unlearning erases copyrighted works, preserves skills","New method unlearns copyrighted tales, keeps model knowledge","SSU: A trade-off lens on sequential copyright unlearning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000267,"raw_usage":{"total_tokens":1684,"prompt_tokens":1085,"completion_tokens":599,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":701,"completion_tokens_details":{"reasoning_tokens":530}},"tokens_in":701,"tokens_out":599,"duration_ms":5725,"temperature":1.0,"reasoning_tokens":530,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:11:25.328286+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an adversarial extraction suite on the SSU-unlearned model: for each book in $D_f$, take a held-out 100-token continuation and prompt the model with dozens of paraphrased instructions (continue in the author's style, complete the scene, etc.). If any prompt elicits a completion whose Rouge-1 score matches the vanilla model's, the low scores on the standard prompt are evasion, not forgetting, and the paper's central trade-off claim collapses.","supporting_citations":[],"review_version":1}