{"id":"5d0d2af8-449a-4046-b855-c5c1a12a3681","arxiv_id":"2505.04416","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"OBLIVIATE combines masked-token suppression, teacher distillation, and world-fact regularization under LoRA to remove targeted content from LLMs while preserving utility and fluency.","lead":"This paper presents OBLIVIATE, a method that fine-tunes large language models with three custom loss functions so they stop reproducing specific unwanted content, such as copyrighted books or hazardous knowledge, while keeping general abilities. It reports tests on the Harry Potter books, the WMDP biosecurity and cybersecurity benchmark, and the TOFU fake-author dataset, comparing against a dozen prior unlearning methods.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Target-token coverage is the load-bearing premise: the masked loss suppresses only GPT-4o-extracted tokens, but a fact can survive in paraphrase; the paper's own Limitations admit retrieval instability.","rationale":"Read in good faith: OBLIVIATE is a plausible three-loss LoRA recipe, and the attack suite (MIA, relearning, quantization, jailbreak) is broader than most unlearning papers. The reason I focus on token coverage is that the paper's headline contribution is the masked-loss guarantee; every forget-quality result is downstream of the GPT-4o target-token list. The Limitations section itself names 'retrieval instability' as a weakness. The reader's weakest_assumption is the same premise, so agreement is 'agree'. I would not change the conditional verdict: the empirical recipe may work on these benchmarks, but the overclaim in Sections 1 and 3.3 and the admitted token-extraction fragility mean the central claim is not yet cleanly supported. The paraphrase probe is a single experiment that can convert this worry into evidence either way.","tokens_in":23966,"tokens_out":5476,"duration_ms":55750,"concrete_test":"Take a random sample of 100 forget-set documents. For each, have an independent annotator or LLM produce a paraphrase of a key fact that contains none of the GPT-4o target tokens (e.g., for Harry Potter, replace 'Harry Potter' with 'the boy wizard' and 'Hogwarts' with 'the wizarding school'). Run the unlearned model on these paraphrased prompts and score whether it produces the fact, using semantic similarity (e.g., BERTScore) to the original sentence or an independent QA judge. Also compute DRMA and Min-K% on the paraphrased set. If semantic recall remains high while token-level metrics are low, the method has only suppressed the extracted token list and the central claim fails. If recall is at chance, the concern is settled in the paper's favor.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.2 constructs the unlearning target as a list of tokens identified by GPT-4o; Section 3.3 then zeros only those tokens in the masked KL loss. The central claim that OBLIVIATE 'completely suppresses the generation of unlearning data' therefore requires that every token capable of expressing the targeted knowledge is on that list, and that suppressing surface tokens removes the underlying association. Neither is established. The list is prompt-generated (Appendix B, Table 11), and the Limitations section concedes 'retrieval instability'; if a fact can be expressed through synonyms, circumlocutions, or named entities the extractor missed, the masked loss never sees those tokens and the association remains. The evaluation metrics do not close this gap: DRMA (Section 3.4) is a next-token probability over the original document, so it is insensitive to semantically equivalent but lexically different outputs, and the MIA tests used (Min-K%, ppl/zlib) also operate on token likelihoods. A low DRMA/MIA score can therefore coexist with intact knowledge. Relearning, quantization, and jailbreak evaluations are useful empirical support, but they probe the same token-level surface. The masking is applied to construct the training target distribution, not at inference time, so 'enforces zero-generation probability' is an overstatement; the loss only discourages the model from assigning high probability to known tokens. The unlearned model can be judged to meet the paper's strongest claim only if paraphrastic leakage is shown to be absent.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes OBLIVIATE, an LLM unlearning framework that removes targeted data while preserving model utility and fluency. The method has three components: a masked loss that suppresses target tokens by optimizing a KL divergence between masked and original output distributions, a distillation loss that aligns the student model with teacher models on generic and other-style documents, and a world-fact loss that preserves encyclopedic knowledge via cross-entropy on WikiText. Fine-tuning is done with LoRA. The paper introduces DRMA, a document-level memorization metric, and evaluates on Harry Potter, WMDP, and TOFU, including robustness to membership inference, relearning, quantization, and jailbreaking attacks.","tokens_in":24231,"tokens_out":6278,"duration_ms":60573,"significance":"If the results hold, OBLIVIATE would be a practical and efficient unlearning method: it uses LoRA, requires no retraining, and shows strong forget quality while retaining MMLU-level utility across multiple models and datasets. The paper ships code, evaluates on three benchmarks with a broad robustness suite, and introduces a new metric (DRMA). These are concrete strengths. However, the core evaluation relies heavily on token-level metrics that align closely with the training objective, and the hyperparameters are selected on the same datasets used for final reporting, so the central claims of complete suppression and state-of-the-art performance are not yet fully supported.","major_comments":[{"comment":"The primary forget metric DRMA (Eq. 1) is the average next-token probability of the exact tokens in the forget documents, and the masked loss is designed to suppress exactly those tokens. Consequently, a low DRMA reflects the training objective by construction. It does not establish that the underlying knowledge is forgotten, especially since the target token list is extracted by GPT-4o and the Limitations section concedes \"retrieval instability.\" The paper should add paraphrase-based tests (e.g., questions that express the same facts with different surface forms) and demonstrate that the association is removed, not only the likelihood of the original token sequences.","section":"§3.4 and §3.3"},{"comment":"The hyperparameters λ1 and λ2 are selected via grid search on the same datasets and metrics used for the final reported results, as shown in Table 19 (Harry Potter) and the discussion in Section 4. This selection procedure can inflate apparent performance. The paper should either choose hyperparameters on a validation split that is not used for final evaluation, or report sensitivity analyses that allow the reader to assess the effect of this selection. Since the final numbers are presented as state-of-the-art, this issue is load-bearing.","section":"§4 and Appendix G"},{"comment":"The claim that the masked loss \"enforces zero-generation probability for targeted content\" and \"completely suppresses the generation of unlearning data\" is an overstatement. The loss minimizes a KL divergence that encourages the total probability mass of target tokens to approach zero, but it does not provide a hard guarantee of zero probability at inference. Moreover, the implementation description is inconsistent: Section 3.2 says \"zeroing out logits\" while Section 3.3 says \"probabilities ... to zero.\" Setting logits to zero (rather than -∞) does not produce zero probabilities after softmax. The authors should clarify the exact masking operation and temper the wording to \"reduces\" or \"suppresses\" rather than \"enforces zero.\"","section":"§3.3"},{"comment":"All experimental results appear to be single-run with no standard deviations or significance tests. Given that several comparisons are within very small margins (e.g., Table 3: Zephyr-7B MMLU Ours=56.1 vs ELM=56.6; Table 4: TOFU utility Ours=62.44 vs Retain Model=62.38), the paper cannot robustly support \"competitive\" or \"state-of-the-art\" claims without quantifying variability. Reporting repeated runs with variance or significance tests is necessary for the central empirical claims.","section":"§4 (Tables 2-6)"}],"minor_comments":[{"comment":"The notation for the masked loss is underspecified: P(θ_masked) and Q(θ) are not defined as probability distributions over the vocabulary at each token position, and the summation over documents does not show how token positions are handled. Please clarify the exact tensors and the operation being summed.","section":"§3.3 (Eq. 1)"},{"comment":"The column formatting in the main tables is hard to parse; for example, the TOFU table (Table 4) shows values such as ppl=0.09 for Ours, which appears inconsistent with the definition of perplexity. Please check the alignment of columns and the direction of each metric (higher/lower is better) so that the reader can interpret the numbers correctly.","section":"Tables 2-5"},{"comment":"The statement that λ1=0.2 and λ2=0.7 are selected \"across all datasets\" is not fully supported by the appendix, which only shows a grid search on Harry Potter (Table 19). Clarify whether the same values were used for WMDP and TOFU and whether any per-dataset tuning was performed.","section":"§4"},{"comment":"The Limitations section honestly acknowledges the reliance on GPT-4o for token extraction and the resulting retrieval instability. This is a strength of the paper, but the abstract and contributions should be consistent with this caveat rather than claiming complete suppression without qualification.","section":"§6 (Limitations)"}],"recommendation":"major_revision","confidential_remarks":"The paper makes a practical empirical contribution, but the evaluation design has two issues that materially affect the headline claims: the forget metric overlaps with the training objective, and the hyperparameters are selected on the same data used for final reporting. Both are fixable with additional experiments and careful reporting. The overstatement of 'zero-generation probability' in the abstract and contributions should also be tempered. The novelty relative to prior masked-KL methods (e.g., Li et al., 2024a) is incremental but sufficient for a journal paper if the evaluation is strengthened."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about OBLIVIATE. First, it is a sensible engineering contribution: combining vocabulary-level masked KL loss, MSE distillation from style teachers, and world-fact CE regularization under LoRA is not something I've seen in the baselines, and the attack coverage (relearning, quantization, jailbreak) is genuinely broader than most unlearning papers. Second, the central claim that the masked loss 'completely suppresses' targeted content is not backed by the evidence, and the current evaluation has enough circularity and reporting gaps that the strong conclusions outrun the data.\n\nWhat the paper does well: the framework is concrete and reproducible (code is linked), the three-loss combination is reasonable, and the DRMA metric, though a small extension of RMA, does capture long-horizon leakage better than token-level scores. The runtime numbers show LoRA-scale costs, which is what people need in practice. The results on WMDP, in particular, show competitive forgetting with MMLU and fluency largely intact, which is the right tradeoff to aim for.\n\nWhere it gets soft: the target-token list from GPT-4o is load-bearing. The masked loss zeroes probabilities only for tokens on that list. The paper's own Limitations admit retrieval instability, but the forget metrics are computed on those same tokens, so a low DRMA or MIA score can coexist with intact knowledge expressed via paraphrase. Calling this 'enforcing zero-generation probability' overstates what a training-time KL loss does. There are also two reporting problems that should be fixed before this is citable as-is: the hyperparameters (lambda1, lambda2) are grid-searched on the same datasets and metrics reported as final results, which inflates apparent performance, and all results are single-run with no error bars or significance tests. Finally, the DRMA direction is internally inconsistent: in the Harry Potter table the original model has a much lower DRMA (0.05) than OBLIVIATE (0.63), which would mean the unlearned model scores worse on memorization; but on TOFU the retain model is lower than OBLIVIATE. That needs a clear explanation or a corrected definition.\n\nThis is not a desk-reject paper. The method is plausible, the experiments are broad, and the authors are honest about the GPT-4o dependency. It deserves a serious referee, but the referee should send it back for: held-out hyperparameter selection, variance reporting, a paraphrase-based forgetting test, and a fixed DRMA definition with direction consistency. After those changes it will be a solid practical contribution for people building unlearning pipelines.","headline":"A useful empirical unlearning recipe, but the headline claim of 'complete suppression' is not supported by the current evaluation and needs re-scoping.","tokens_in":24801,"tokens_out":1747,"would_cite":false,"duration_ms":20002,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Masked-token loss erases targeted LLM content while keeping the model fluent","keywords":["machine unlearning","large language models","targeted knowledge removal","masked loss","low-rank adapters","membership inference attacks","model utility","fluency"],"falsifier":"Generate many paraphrases of forget-set facts using only words that are not on the extracted target-token list, prompt the unlearned model with them, and measure how often it completes them correctly; a non-negligible completion rate would refute the token-coverage premise. Equivalently, run a membership-inference attack on rephrased forget-set documents: if the model's perplexity signals the rephrased content as training data, the forgetting is surface-level only.","tokens_in":23730,"feed_emoji":"🧠","tokens_out":5389,"duration_ms":48538,"temperature":0.7,"pith_summary":"OBLIVIATE claims that a three-part fine-tuning loss can delete specific memorized content from a large language model while leaving the model's general skills and fluency intact. The masked loss forces the probability of target tokens to zero, the distillation loss borrows teacher-model outputs on similar documents to protect fluency, and the world-fact loss anchors general knowledge. The paper tests this on the Harry Potter books, the WMDP hazardous-knowledge benchmark, and the TOFU author-profile benchmark, measuring forget quality, utility, fluency, and robustness to membership-inference, relearning, quantization, and jailbreaking attacks. A practical reader would care because the method promises a cheap, LoRA-based way to comply with privacy and copyright removal requests without retraining.","feed_headline":"Masked-token loss erases LLM data without breaking the model","feed_subtitle":"A three-part LoRA recipe deletes specific memorized content while preserving benchmark utility and fluency.","key_machinery":"The engine is the masked loss: for each forget-set document, the model's logits for target tokens are set to zero before softmax, and a KL divergence drives the full output distribution toward that masked distribution, enforcing zero-generation probability for the targeted content. Two regularizers carry the retained side: a distillation loss using mean-squared error between the student's logits and teachers trained on generic and other-style documents, and a world-fact loss using cross-entropy alignment on WikiText to protect encyclopedic knowledge. All updates go through LoRA adapters on the MLP and attention layers, and the forget/retain trade-off is governed by two hyperparameters $\\lambda_1$ and $\\lambda_2$. The paper's new evaluation object, DRMA, averages next-token probabilities over entire documents in the forget set, generalizing token-level remnant memorization accuracy to catch leakage that only appears after a long context.","core_discovery":"On its own terms, the paper's central discovery is that aggressive forgetting does not have to destroy the model: zeroing the logits of an externally extracted list of target tokens, then rebalancing the model with two retention losses, yields an unlearned model whose forget-set outputs drop sharply while MMLU-scale utility and human-rated fluency stay near baseline levels. The method is presented as more robust than gradient ascent and related baselines, surviving membership-inference probing, 4-bit quantization, fine-tuning-based relearning, and jailbreak prompts. The paper also introduces document-level RMA (DRMA), a metric that averages per-token generation probabilities across whole documents to catch delayed leakage that token-level metrics miss.","pith_inferences":["The paper does not test whether paraphrases of forget-set facts remain generatable through tokens absent from the extracted list; that is the most direct untested implication of the token-coverage design.","Because the target-token list comes from a proprietary model, the method's reproducibility and stability depend on that model's output; a cheaper or open-source token extractor could be a testable extension.","The context-aware behavior shown in the examples suggests the same machinery could be tuned for selective forgetting of harmful combinations, such as 'computer' plus 'virus', while preserving benign uses of the same words.","DRMA might serve as a general evaluation standard for document-level unlearning, since it is simple to compute and directly tracks long-horizon leakage."],"forward_implications":["Unlearning a document collection such as a copyrighted book series can be done with a single LoRA fine-tuning run instead of retraining from scratch.","If the forgetting is real, the unlearned model should resist membership-inference attacks that would otherwise flag forget-set documents as training data.","The two retention losses are what keep utility and fluency alive; dropping either one degrades the balance in the ablations.","Robustness results imply the forgotten content stays suppressed even after 4-bit quantization, fine-tuning-based relearning, and jailbreak prompting, not just under direct generation."],"supporting_citations":[{"why":"Provides the Harry Potter unlearning setup and the GPT-4 anchored-term idea that motivates target-token extraction.","marker":"(Eldan and Russinovich, 2023)"},{"why":"Supplies the vocabulary-level masking strategy that the masked loss adapts to LLM-scale text unlearning.","marker":"(Li et al., 2024a)"},{"why":"Defines LoRA, the parameter-efficient adapter used for all fine-tuning in the framework.","marker":"(Hu et al., 2022)"},{"why":"Provides WikiText, the encyclopedic corpus used by the world-fact loss.","marker":"(Merity et al., 2017)"},{"why":"Defines remnant memorization accuracy, which DRMA generalizes from token to document level.","marker":"(Lee et al., 2024)"},{"why":"Contributes the TOFU benchmark and its fine-tuned Llama-2 base model for forget/utility evaluation.","marker":"(Maini et al., 2024)"},{"why":"Contributes the WMDP hazardous-knowledge benchmark and the RMU baseline.","marker":"(Li et al., 2024b)"},{"why":"Supplies the Min-K% membership-inference attack and evidence that weak unlearning remains vulnerable.","marker":"(Shi et al., 2024)"},{"why":"Defines the quantization attack scenario used to test robustness after 4-bit conversion.","marker":"(Zhang et al., 2025)"},{"why":"Defines the relearning attack scenario used to test whether forgotten content can be recovered by fine-tuning.","marker":"(Lo et al., 2024)"}],"fun_headline_variants":["Erase targeted LLM data, keep utility and fluency","Three-part loss unlearns robustly, survives probing and fine-tuning","New DRMA metric catches delayed leakage in unlearned LLMs","LoRA-based unlearning erases books without breaking the model"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire method depends on the automatically extracted target-token list being complete enough that zeroing those tokens also suppresses the underlying knowledge, since a fact phrased with words outside the list would survive and the claimed membership-inference resistance would fail.","fun_headline_variants_meta":{"raw":{"variants":["Erase targeted LLM data, keep utility and fluency","Three-part loss unlearns robustly, survives probing and fine-tuning","New DRMA metric catches delayed leakage in unlearned LLMs","LoRA-based unlearning erases books without breaking the model"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000276,"raw_usage":{"total_tokens":1595,"prompt_tokens":845,"completion_tokens":750,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":461,"completion_tokens_details":{"reasoning_tokens":677}},"tokens_in":461,"tokens_out":750,"duration_ms":7790,"temperature":1.0,"reasoning_tokens":677,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:29:45.903094+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate many paraphrases of forget-set facts using only words that are not on the extracted target-token list, prompt the unlearned model with them, and measure how often it completes them correctly; a non-negligible completion rate would refute the token-coverage premise. Equivalently, run a membership-inference attack on rephrased forget-set documents: if the model's perplexity signals the rephrased content as training data, the forgetting is surface-level only.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines remnant memorization accuracy, which DRMA generalizes from token to document level."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the quantization attack scenario used to test robustness after 4-bit conversion."}],"review_version":1}