{"id":"07a66e90-d9b3-413a-9a3c-e844ffe29cf0","arxiv_id":"2506.07171","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"RULE trains LLMs to refuse forgotten knowledge and answer permissible queries by optimizing a refusal boundary with reinforcement learning, beating baselines on forget quality and response naturalness with far less data.","lead":"This paper introduces RULE, a two-stage reinforcement learning method that teaches LLMs to refuse questions about targeted knowledge while continuing to answer other questions. It reports stronger forgetting and more natural refusals using only a fraction of forget data and small synthetic boundary sets on standard benchmarks.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Concern: the synthetic boundary set, not the RL algorithm, carries the load; if GPT-4o-mini's entity replacement yields queries that are not genuinely permissible or gold answers that are wrong, Eq. 5's reward trains on mislabeled retain data, invalidating utility and Pareto claims.","rationale":"The reader identified the synthetic boundary set as the load-bearing premise; I agree. The mechanism in Eq. 5 can only place the refusal boundary correctly if \\tilde{D}_r is genuinely on the retain side and y_gold is a correct reference. The paper's own ablation (Table 2) shows the method collapses when \\tilde{D}_r is replaced with another target's forget set, so \\tilde{D}_r is not a convenience but the entire source of retain-side supervision. The internal inconsistency about y_gold's provenance (§3.2 vs Appendix A.2) makes this unverifiable without code/data. I considered the naturalness-evaluator bias and the ill-defined Pareto/AUC argument; these are real but secondary—they weaken specific headlines, whereas a contaminated boundary set would invalidate the mechanism itself and the utility-preservation claim. The proposed audit of the boundary set would settle it; until then CONDITIONAL is appropriate, hence verdict unchanged.","tokens_in":23814,"tokens_out":9444,"duration_ms":105273,"concrete_test":"Release the RWKU Stephen King boundary set (162 queries) with the exact y_gold strings used. Independently annotate each query as (i) permissible vs forget-related and (ii) the supplied answer as correct/incorrect/mixed, with three annotators. Then rerun ReBO-GRPO using only the subset with unanimous 'permissible and correct' labels. If forget quality or retain quality shifts by more than ~3 points, the original boundary data were not clean and the Pareto/utility claims are not robust. A cheaper proxy: run the original llama3-8b-instruct on each boundary query and check whether it gives an informative non-refusal answer whose ROUGE-L against the supplied y_gold exceeds τ; a high refusal rate or low agreement rate would indicate a mislabeled boundary set.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central method reduces unlearning to learning a refusal boundary trained on D_f ∪ \\tilde{D}_r. The only supervision about where the boundary should lie on the retain side comes from \\tilde{D}_r, built by prompting GPT-4o-mini to replace the sensitive entity and to return an 'ACCURATE_ANSWER_HERE' (Appendix A.2). Eq. 5 then rewards non-refusals whose ROUGE-L against y_gold exceeds τ. This is load-bearing because the ablation in Table 2 shows that replacing \\tilde{D}_r with another target's forget set causes collapse (Retain 23.6), so the method's utility preservation is entirely purchased by the correctness of \\tilde{D}_r. There is an internal inconsistency: §3.2 states y_gold is generated by the original model, while Appendix A.2's prompt has GPT-4o-mini return the gold answer; no code or data is released to resolve which source was used. If GPT-4o-mini's entity replacement produces questions that still touch the forget entity, or its answers are inaccurate, RL will be rewarded for refusing or mis-answering retain-side inputs. The reported retain-quality drop on RWKU (87.6→73.7) is consistent with, though not proof of, such contamination. The conclusion itself admits dependence on synthetic boundary data, so this is a known fragile point.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes RULE, a two-stage reinforcement-learning framework for LLM unlearning. Stage I (Rejection Steering) fine-tunes the base model on a small forget set to produce refusals; Stage II (Refusal Boundary Optimization) runs on-policy RL over the forget set and a synthetic boundary set generated by GPT-4o-mini via entity replacement. The reward function (Eq. 5) rewards template-matched refusals on forget queries and non-refusals with sufficient ROUGE-L overlap on boundary queries. The authors report strong forget quality and naturalness on RWKU and MUSE with only 12% forget data and 8% boundary data, and claim forget-retain Pareto optimality, supported by a generalization theorem in Appendix B.4.","tokens_in":1914,"tokens_out":5086,"duration_ms":97928,"significance":"If the empirical claims are reproducible, the paper makes a useful contribution: it reframes unlearning as refusal-policy learning with a verifiable reward, reports substantially more fluent refusals than GA/NPO/SimNPO, and demonstrates data efficiency and generalization to unseen queries. The naturalness evaluation is a valuable addition to unlearning benchmarks, and the two-stage design with rejection steering is a sensible practical recipe. However, the headline claims of retained utility and Pareto optimality are not supported by the reported operating points, and the method's utility preservation rests entirely on an unvalidated synthetic boundary set. The paper also contains an inconsistency about the source of gold answers and a theoretical appendix that is only a proof sketch. These issues are load-bearing for the central claims and require substantial revision.","major_comments":[{"comment":"The claim that RULE \"maintains general utility\" and achieves \"forget-retain Pareto optimality\" is contradicted by the reported retain-quality numbers. In Table 1, RULE GRPO has Retain Quality All = 73.7, below NPO (75.1), SimNPO (76.5), and the original model (87.6); in Table 9 the drop is larger (68.9 vs 75.1 and 76.5). A method that loses 13.9 or 18.7 points of neighbor-set retain quality relative to the original model cannot be described as maintaining utility unless the term is restricted to the four dimensions in Table 3, and even then the comparison is not made at matched forget levels. The Pareto analysis in Figure 4 uses thresholded AUC over training trajectories, but the final operating points themselves show RULE trading a large forget improvement for a meaningful retain loss; the paper should report matched-forget or matched-retain comparisons and confidence intervals before claiming Pareto optimality.","section":"Tables 1 and 9; Sec. 5.3"},{"comment":"The correctness of the synthetic boundary set Dtilde_r is the load-bearing component of the entire method, and it is not validated. The ablation in Table 2 shows that removing Dtilde_r collapses Retain to 23.6, so the method's utility preservation is purchased entirely by the entity-replacement queries. Yet Sec. 3.2 states that the gold answers y_gold are \"generated by the original model,\" while the prompt in Appendix A.2 instructs GPT-4o-mini to return \"ACCURATE_ANSWER_HERE\"; the training-details paragraph in Sec. 4.1 says the boundary set is constructed by prompting GPT-4o. These are three different descriptions of the same data-generation step, and no code or data is released to resolve them. If GPT-4o-mini's replacements are not genuinely permissible or the answers are inaccurate, Eq. (5) rewards the model for refusing or mis-answering retain-side inputs. The authors should release the boundary data, report a human audit of permissibility and answer accuracy, and provide statistics on how often the replacement still touches the forget entity.","section":"Appendix A.2; Eq. (5); Table 2; Sec. 6"},{"comment":"There is a circularity risk between the reward function and the forget-quality metric. The forget-branch reward in Eq. (5) directly optimizes template-matched refusal and key-entity mention, while RWKU's forget quality is measured by ROUGE-L against the original answer (lower is better), so a refusal will trivially produce a low score. The reported forget-quality gains may therefore reflect reward alignment rather than knowledge erasure. The relearning experiment in Figure 5 is also behavioral: it shows that the model continues to refuse after fine-tuning on forget passages, but it does not show that the target knowledge is absent from the model's representations. The authors should test for retained knowledge with indirect elicitation or representation-level probes, and should report whether the refusal behavior can be bypassed by rephrasing or jailbreaking.","section":"Eq. (5); Sec. 4.1; Figure 5"},{"comment":"The theoretical analysis is not a proof and contains an unjustified step that is load-bearing for the paper's \"theoretical evidence\" claim. The bound in Eq. (1.2) is derived by treating RULE's exploration as if it samples from the true retain distribution P_r, but the actual algorithm samples from D_f union Dtilde_r, where Dtilde_r is a synthetic set whose relationship to P_r is exactly the unverified assumption from Appendix A.2. In addition, Step 4 asserts C_KL(pi) <= C(pi) exp(-1/2 E_x[KL(pi || pi_anchor)]) without justification; this capacity-reduction inequality is not generally true and appears dimensionally suspect. The authors should either provide a rigorous proof with explicit assumptions about Dtilde_r, or remove the theoretical claim and present the appendix as intuition.","section":"Appendix B.4; Eqs. (1.1)-(1.2)"}],"minor_comments":[{"comment":"The notation D_r in Eq. (3) and Algorithm 1 is used for the combined retain/boundary set, but Sec. 3.1 defines D_r as the true retain set; this conflation makes the theory harder to follow.","section":"Sec. 3.2; Appendix A.2"},{"comment":"The MUSE-books table has formatting problems: several rows appear to list D_f/D_r token ratios as 0% even when the baseline is reported as using 100% of the forget set, and the columns are misaligned.","section":"Table 10"},{"comment":"The claim that the refusal regex \"aligns well with human annotation in over 95% of sampled cases\" is not backed by any protocol, sample size, or inter-annotator agreement; please provide details or remove the number.","section":"Appendix C.1"},{"comment":"The case study in Table 8 is helpful, but the \"Before\" and \"After\" states in Figure 2b are not defined in the caption or text; please clarify which training steps they correspond to.","section":"Appendix D.4"},{"comment":"References [51] and [52] cite the same arXiv paper with different titles/venues; this should be corrected.","section":"References"},{"comment":"The footnote \"geq0.4\" contains a LaTeX typo and should read \">=0.4\".","section":"Sec. 5.3"},{"comment":"The paper repeatedly says \"codes will be available\" but includes no repository link, no data, and no random seeds; given the proprietary GPT-4o-mini dependency, releasing the exact prompts, generated boundary sets, and evaluation code is essential for reproducibility.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The paper has a solid empirical core but the headline claims are broader than what the tables support. The synthetic boundary data is both the method's main novelty and its main fragility, and the internal inconsistency about the source of gold answers should be resolved before this is publishable. I would encourage the editor to ask for a careful revision rather than reject, because the naturalness results and the two-stage RL formulation are potentially valuable to the unlearning community."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is genuinely worth a look: instead of trying to erase knowledge, RULE treats unlearning as teaching a refusal policy, using a small forget set plus a synthetic boundary set of entity-replacement queries, then on-policy RL (PPO/GRPO/RPP) with a two-branch reward. That framing is clean, the ablations show both stages matter, and the naturalness improvements over GA/NPO/SimNPO are credible. This is not just a re-run of NPO with a different objective; the refusal-boundary formulation is new and could be useful for privacy and copyright applications where a fluent refusal is acceptable.\n\nBut there are several soft spots that need attention before the claims hold. First, the synthetic boundary set is load-bearing. The reward for boundary queries relies on ROUGE-L against a gold answer, and the paper is inconsistent about where that gold answer comes from: Section 3.2 says it is generated by the original model, while Appendix A.2 has GPT-4o-mini return it. If those entity-replaced questions still touch the forget target or the gold answers are wrong, the RL stage is rewarded on mislabeled retain data. The w/o eDr ablation, where retain collapses to 23.6, shows how much utility preservation depends on the quality of that synthetic set. No code or data is released, so this cannot be checked. That has to be fixed.\n\nSecond, the Pareto optimality claim is overstated. In Table 1, RULE's final point has better forget quality than every baseline, but retain quality is 73.7 versus 76.5–79.5 for the best NPO/SimNPO variants. That is a trade-off, not dominance. The AUC analysis in Figure 4 is suggestive, but it does not make the headline operating point Pareto-optimal. The paper should either report a proper frontier with error bars or soften the claim.\n\nThird, the naturalness evaluation is biased. The judge is told the response comes from an unlearned model that must not answer about Stephen King, and the rubric's helpfulness 5 example is almost exactly RULE's output. A blind judge, or at least a prompt that does not reveal the unlearning context, would be more convincing.\n\nThe theory is basically a generalization bound showing that using boundary data helps versus SFT on the forget set alone; it does not support the Pareto claim and could be trimmed. The paper also does not address whether refusal behavior is enough for true unlearning—an adversary using paraphrase or jailbreak prompts might still extract the knowledge. The relearning experiment is a start, but not a robustness study.\n\nWho is this for? Researchers in LLM unlearning, especially those interested in output-side unlearning rather than weight erasure. The method has legs, but it needs a revision that fixes the gold-answer ambiguity, releases the synthetic data, redoes the naturalness evaluation blind, and rephrases the Pareto claim. I would send it to peer review, but with a recommendation for major revision.\n\nEngage with it, but do not take the headline numbers at face value.","headline":"The refusal-boundary RL idea is real and worth testing, but the paper oversells Pareto optimality and leans too hard on unverified synthetic data.","tokens_in":24691,"tokens_out":3967,"would_cite":false,"duration_ms":45364,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"RULE frames LLM unlearning as refusal-policy learning: a small forget sample plus synthesized near-miss queries, trained by on-policy RL, beat full-data baselines on forgetting, naturalness, and utility.","keywords":["LLM unlearning","refusal policy optimization","reinforcement learning","forget-retain trade-off","Pareto optimality","boundary data synthesis","response naturalness"],"falsifier":"Sample a batch of RULE's synthesized boundary queries for several forget targets and have annotators check each one for two properties: does the query still leak or require the forgotten content, and is the supplied reference answer factually correct? If a substantial share, say more than one in five, fails either check, then the boundary-reward signal is actively teaching the model to refuse or answer wrongly on genuine retain inputs, and the forget–retain Pareto claim would not survive a change of entity-replacement generator.","tokens_in":23586,"feed_emoji":"🚫","tokens_out":16948,"duration_ms":155940,"temperature":0.7,"pith_summary":"RULE sets out to establish that unlearning a piece of knowledge from an LLM is best done by teaching the model where to refuse, not by erasing information. The recipe is two-stage: a short supervised 'rejection steering' pass on a small sample of the forget set so the model can produce natural refusals, then on-policy reinforcement learning on those forget queries plus a small set of synthesized 'boundary queries', reformulations in which the sensitive entity is swapped for a permissible one, with a verifiable reward that says refuse here, answer there. The paper's headline empirical claim is that with only about 12% of the forget set and 8% synthesized boundary data, RULE beats baselines that use the full forget set, by up to 17.5 points on forget quality and 16.3 points on response naturalness, while keeping general utility and extending refusal behavior to unseen related queries. If true, this matters because it removes two practical blockers of existing unlearning: the need for a cleanly partitioned retain set, which real training corpora almost never provide, and the tendency of gradient-based unlearning to produce collapsed, evasive, or hallucinated outputs that advertise the unlearning.","feed_headline":"Teach refusal, not erasure: unlearning needs just 12% of the data","feed_subtitle":"A two-stage RL recipe with a small forget sample and synthesized look-alike queries wins on naturalness and utility.","key_machinery":"The carrying object is the refusal boundary, and the machinery is two-stage refusal-policy optimization. Stage one, rejection steering, is a short supervised pass on a 12% forget sample with entity-specific refusal templates adapted from an existing 'I don't know' phrasing; it exists because pretrained models rarely emit refusals, so RL rollouts need a policy that can refuse at initialization. Stage two, refusal boundary optimization, runs on-policy RL over the forget sample plus the boundary set $\\widetilde{\\mathcal{D}}_r$: queries synthesized by prompting a general-purpose model to rewrite each forget query with the sensitive entity swapped for a permissible counterpart, forming hard negatives that are semantically close to forget queries but lie on the retain side. The reward function $r(x,y)$ is the mechanism that shapes the boundary: on $\\mathcal{D}_f$ it credits refusal-template matches plus target-entity mention, while on $\\widetilde{\\mathcal{D}}_r$ it credits non-refusal plus ROUGE-L overlap with the original model's reference answer, and a KL term anchored on the rejection-steered model keeps updates near the refusal-competent policy. The theoretical claim in Theorem 1 is that this design yields a smaller worst-case mis-refusal risk than supervised fine-tuning for an equal token budget, because exploration adds $KmH$ additional observations and the boundary probes estimate retain-side risk instead of bounding it by the worst case.","core_discovery":"On the paper's own terms, the central discovery is that the unlearning objective can be written as a refusal-boundary constraint, where the ideal policy $\\pi_\\theta$ refuses forget-side queries ($\\pi_\\theta(\\texttt{[refuse]}\\mid x)\\to 1$ for $x\\in\\mathcal{D}_f$) and answers retain-side ones, and that this boundary is learnable from drastically less data than current baselines use. RULE first fine-tunes the base model on a 12% sample of the forget set with supervised refusal outputs (rejection steering), producing a policy that can refuse at all; it then runs on-policy reinforcement learning with PPO, GRPO, or Reinforce++ over that same forget sample plus an 8%-scale boundary set $\\widetilde{\\mathcal{D}}_r$ of synthesized near-miss queries, where the sensitive entity has been replaced by a permissible counterpart while structure and length stay intact. The reward $r(x,y)$ is verifiable rather than learned: template-matched refusal plus mention of the key entity earns reward on $\\mathcal{D}_f$, and non-refusal plus ROUGE-L agreement with the original model's answer earns reward on $\\widetilde{\\mathcal{D}}_r$. Empirically, the GRPO variant reports 27.7 overall forget quality on the RWKU benchmark (against 40.1 for the best baseline) with retain quality 73.7, a 89.1 score on a three-axis naturalness evaluation (versus 72.8 for the best baseline), and the highest Pareto-frontier AUC at every retain threshold from 0.4 to 0.7, which the paper reads as forget–retain Pareto optimality. The paper also claims a generalization advantage over supervised fine-tuning in its Theorem 1: on-policy rollouts enlarge the effective sample size and convert worst-case retain-side risk into a bound that decays with interaction.","pith_inferences":["My read is that the data economy, if it holds, relocates the hard part of unlearning from optimization to synthesis: the bottleneck becomes generating trustworthy near-miss queries with guaranteed-correct retain answers, and the RL stage might be portable to cheaper optimizers; a direct test is to vary the synthesizer, using smaller models or rule-based swaps, and see whether the forget–retain fro","The reward's ROUGE-L branch credits word-level overlap with the original model's answer on boundary queries, which may quietly reward reproducing the original phrasing rather than helpfulness; replacing ROUGE-L with an independent factuality check and re-measuring retain quality would separate faithful retention from paraphrase matching.","The paper's Theorem 1 suggests a transferable principle beyond unlearning: on-policy exploration enlarges the effective sample of any refusal-shaped objective, so safety refusal training and copyright takedown could inherit the same advantage; the paper's own relearning experiment is one hint, but checking relearning resistance across target types, longer fine-tuning budgets, and multilingual or m"],"forward_implications":["Unlearning no longer needs a cleanly partitioned retain set: RULE reports better forget quality with 12% of the forget queries and 8% synthesized boundary data than baselines that train on the full sets.","Refusal behavior generalizes: RULE transfers refusals to semantically related queries it never trained on, across all three RWKU forget categories (FB, QA, AA), which is the property that directly attacks the overfitting-to-$\\mathcal{D}_f$ failure.","Response naturalness becomes a measurable axis of unlearning: RULE scores 89.1 on the combined readability/helpfulness/truthfulness evaluation versus 72.8 for the best baseline, so unlearned models need not leak the fact that they were unlearned.","The forget–retain trade-off is not forced to be zero-sum: RULE holds the largest Pareto-frontier AUC at every retain threshold from 0.4 to 0.7, supporting the claimed forget–retain Pareto optimality.","General utility can improve along with forgetting: RULE reports higher truthfulness and fluency than the original model on RWKU's utility dimensions, suggesting refusal learning reinforces honest abstention instead of damaging capability."],"supporting_citations":[{"why":"Supplies the RWKU benchmark: the forget/retain query sets and the ROUGE-L based evaluation behind the main results tables.","marker":"[16]"},{"why":"Provides the MUSE-books benchmark used to test RULE on a book-series knowledge target.","marker":"[37]"},{"why":"Cites the gradient-ascent and negative-preference baselines used in the main comparison.","marker":"[51]"},{"why":"Contributes the 'I don't know' refusal template that RULE adapts into entity-specific refusal responses for rejection steering.","marker":"[28]"},{"why":"Introduces GRPO, the on-policy RL algorithm whose variant yields RULE's best forget quality and naturalness numbers.","marker":"[35]"},{"why":"Introduces PPO, the second on-policy RL algorithm instantiated in the refusal boundary optimization stage.","marker":"[32]"},{"why":"Introduces Reinforce++, the third RL variant, whose token-level KL regularization anchors the policy during optimization.","marker":"[12]"},{"why":"Supplies the relearning protocol used to test whether RULE resists reacquiring unlearned knowledge via fine-tuning.","marker":"[18]"},{"why":"Defines SimNPO, the strongest full-data baseline in the forget-quality comparison that RULE improves on.","marker":"[10]"}],"fun_headline_variants":["Unlearning with 12% data: refusal-boundary RL hits Pareto optimum","RULE unlearns with 12% data: refusal-boundary RL wins Pareto","Forget-retain Pareto: reinforcement unlearning with 12% data","12% data, Pareto-optimal unlearning: refusal-boundary RL","RL refusal boundary: forget with 12% data, keep Pareto"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise, which the paper's own conclusion flags as a scalability limit, is that the synthesized boundary queries truly sit on the answerable side of the refusal boundary and carry correct reference answers; if entity-swapped questions still touch the forgotten content, or the reference answers are wrong, the reward would train the model to refuse or misanswer exactly the inputs that ought to be kept.","fun_headline_variants_meta":{"raw":{"variants":["Unlearning with 12% data: refusal-boundary RL hits Pareto optimum","RULE unlearns with 12% data: refusal-boundary RL wins Pareto","Forget-retain Pareto: reinforcement unlearning with 12% data","12% data, Pareto-optimal unlearning: refusal-boundary RL","RL refusal boundary: forget with 12% data, keep Pareto"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000914,"raw_usage":{"total_tokens":4053,"prompt_tokens":1204,"completion_tokens":2849,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":820,"completion_tokens_details":{"reasoning_tokens":2750}},"tokens_in":820,"tokens_out":2849,"duration_ms":20773,"temperature":1.0,"reasoning_tokens":2750,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:40:32.427479+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Sample a batch of RULE's synthesized boundary queries for several forget targets and have annotators check each one for two properties: does the query still leak or require the forgotten content, and is the supplied reference answer factually correct? If a substantial share, say more than one in five, fails either check, then the boundary-reward signal is actively teaching the model to refuse or answer wrongly on genuine retain inputs, and the forget–retain Pareto claim would not survive a change of entity-replacement generator.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the RWKU benchmark: the forget/retain query sets and the ROUGE-L based evaluation behind the main results tables."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the MUSE-books benchmark used to test RULE on a book-series knowledge target."},{"cited_title":"Zhang, L","cited_arxiv_id":null,"evidence_quote":"Cites the gradient-ascent and negative-preference baselines used in the main comparison."},{"cited_title":"Maini, Z","cited_arxiv_id":null,"evidence_quote":"Contributes the 'I don't know' refusal template that RULE adapts into entity-specific refusal responses for rejection steering."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces GRPO, the on-policy RL algorithm whose variant yields RULE's best forget quality and naturalness numbers."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces Reinforce++, the third RL variant, whose token-level KL regularization anchors the policy during optimization."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the relearning protocol used to test whether RULE resists reacquiring unlearned knowledge via fine-tuning."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines SimNPO, the strongest full-data baseline in the forget-quality comparison that RULE improves on."}],"review_version":1}