REVIEW 3 major objections 5 minor 15 references
Fine-tuning an LLM only on its worst concept-prediction prompt type unlearns biased concepts more thoroughly than training on all prompt types together.
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · grok-4.5
2026-07-11 22:54 UTC pith:32TMWC2J
load-bearing objection Solid empirical PEFT recipe for prompt-robust concept unlearning; the two-stage worst-prompt idea works in the tables, but rests on a discrete proxy that is only partially stress-tested. the 3 major comments →
MPSelectTune: Prompt-type Selection for Fine-tuning improves Concept Unlearning in LLMs
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The paper establishes that fine-tuning with the worst prompt type for concept prediction—the type that still yields the highest concept accuracy after multi-prompt multi-task training—improves average unlearning performance over a method that weights all prompt types equally. The resulting model keeps strong main-task accuracy while pushing concept accuracy near random and reducing spurious task–concept correlation.
What carries the argument
MPSelectTune: a two-stage algorithm that first optimizes a multi-task loss (task loss, concept-randomization loss, format loss, next-word prediction) over twelve joint prompt types, then selects the single highest-accuracy concept-prediction prompt type and continues fine-tuning only on prompts of that type.
Load-bearing premise
That the single discrete prompt type with the highest concept accuracy after the first stage is a sufficient proxy for residual concept knowledge, so that further training only on that type also collapses accuracy on the other prompt types and on unseen prompts.
What would settle it
After stage-two training, evaluate concept accuracy on a held-out prompt construction never used in either stage; if that accuracy remains well above chance while main-task accuracy stays high, the claim that worst-prompt fine-tuning erases residual concept knowledge fails.
If this is right
- Concept-unlearning evaluations must report worst-prompt (not only average) concept accuracy, otherwise residual leakage is hidden.
- Safety or fairness fine-tunes that ignore prompt diversity leave concept knowledge that can be re-elicited by simple changes in in-context examples.
- Joint task-and-concept prompts plus an explicit format loss stabilize multi-objective LoRA updates and keep outputs parseable.
- The same selection-tuning pattern can be applied to other spurious attributes beyond gender and race, such as toxicity or race in income prediction.
Where Pith is reading between the lines
- An online version that continually re-selects the current worst prompt during a single training run may reduce residual leakage without a hard two-stage schedule.
- The same worst-prompt idea may transfer to chain-of-thought or tool-use formats that were never among the twelve discrete types used here.
- The observed drop in spuriousness score suggests the method could double as a practical diagnostic for whether a deployed model still relies on a protected attribute at inference time.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes MPSelectTune, a two-stage PEFT method for concept unlearning in LLMs. Stage 1 (MPTune) fine-tunes with a multi-task loss (task, concept-randomization, next-word prediction, and a novel format loss) over 12 joint task–concept prompt types that vary exemplar count and selection strategy. Stage 2 identifies the single prompt type with highest concept accuracy after Stage 1 and continues fine-tuning only on that type. The central claim is that this worst-prompt selection yields better average unlearning than multi-prompt fine-tuning alone, producing 2–15% higher main-task accuracy and up to 17% lower worst-case concept accuracy than recent baselines (ICUL, SKU, ECK, etc.) while preserving MMLU and reducing a generalized SP-score of spurious correlation. Results are reported on five task–concept pairs across LLaMA-2/3.1 and Mistral.
Significance. If the result holds, the work supplies a practical, prompt-aware recipe for concept erasure that existing representation-level and single-prompt unlearning methods largely ignore. The joint-prompt construction, format loss, multi-task objective, and explicit worst-prompt stage are concrete contributions; the held-out-prompt generalization experiment and SP-score reductions give additional evidence that residual concept knowledge is being reduced rather than merely masked. The approach is immediately usable with LoRA and standard open models, so the practical impact on safety/compliance pipelines would be non-trivial even if the adversarial proxy remains discrete and heuristic.
major comments (3)
- §3.4 / Algorithm 1 (lines 3–8): the load-bearing claim is that the single discrete prompt type π* = arg max Acc_c after Stage 1 is a sufficient adversarial proxy for residual concept knowledge, so that further gradient steps on only that type drive concept accuracy near chance for the other eleven types and for unseen constructions. Figure 3 (left) and §4.5 show that the selection does reduce peak and average concept accuracy relative to MPTune, but the paper never tests a continuous adversary, multi-seed variance of the argmax, or an alternative selection rule (e.g., top-k or random high-accuracy type). Without that check the proxy remains an unproven modeling assumption rather than a demonstrated necessity.
- Tables 1 and 6 report point estimates only; no multi-seed standard deviations or confidence intervals appear for Task-Acc, Concept-Acc, or SP-score. Given that Stage-2 selection itself depends on a noisy accuracy ranking over D_tr, the absence of variance estimates makes it impossible to judge whether the reported 2–17% gains over ICUL/SKU/ECK are stable. At least three seeds (or bootstrap intervals) on the key rows of Table 1 are needed before the central numerical claim can be treated as established.
- Eq. (6) introduces free weights η_T, η_C, η_G, η_F whose values and selection procedure are never stated. Table 2 ablates presence/absence of each loss term but does not explore weight sensitivity. Because the concept-loss term is the only driver of unlearning, the reported near-chance concept accuracies could be brittle to the particular (unreported) weight vector; a short sensitivity sweep or explicit default values are required for reproducibility.
minor comments (5)
- Abstract and §1 claim “four benchmarks” while §4.1 and Table 3 list five task–concept pairs; align the count.
- Table 5 contains residual LaTeX artifacts (“extbfMPTune”); clean for camera-ready.
- §4.1 SP-score definition: the clean models c_M / c_F are constructed by restricting in-context exemplars, yet the precise sampling procedure and whether the same k and selection strategy are retained is only sketched; a short clarifying sentence would help.
- Appendix A.7 reports wall-clock and memory for BIOS only; a one-line note on relative cost of Stage 2 versus Stage 1 for the other datasets would be useful.
- Figure 3 caption and axis labels mix “MPT une” / “MPSelectT une”; fix typography.
Circularity Check
No circularity: two-stage empirical fine-tuning procedure with independent held-out metrics; nothing reduces by construction to its own inputs.
full rationale
The paper defines a multi-task multi-prompt loss (Eq. 6 combining task, concept, NWP and format losses) that is optimized via LoRA to produce Θ_MPTune, then selects the single discrete prompt type π* = arg max Acc_c(π_i | D_tr, Θ_MPTune) and re-optimizes only on prompts of that type (Algorithm 1). All reported numbers (task accuracy, concept accuracy, MMLU, SP-score) are measured on held-out joint examples, on averages over the twelve prompt types, and on completely unseen prompt constructions (§4.5). No free parameter is fitted to a quantity that is later presented as a prediction; the concept-loss term deliberately maximizes a squashed classification loss rather than fitting a target accuracy; the SP-score is an external diagnostic adapted from Kumar et al. and is not used inside the training loop. There are no load-bearing self-citations of uniqueness theorems, no ansatz smuggled via prior author work, and no renaming of a known empirical pattern as a derived result. The method is therefore self-contained against external benchmarks and exhibits zero circular reduction.
Axiom & Free-Parameter Ledger
free parameters (3)
- loss weights η_T, η_C, η_G, η_F
- LoRA rank r=8, α=64, dropout=0.05
- prompt sizes k ∈ {2,3,4,5} and three selection strategies
axioms (4)
- ad hoc to paper Concept knowledge remaining after multi-prompt fine-tuning is sufficiently revealed by the single prompt type of highest concept accuracy, so that further gradient steps on only that type reduce concept accuracy for other types.
- domain assumption The concept loss 1−σ(L'_C) randomizes concept predictions without collapsing main-task or language-modeling capability when combined with the other three losses.
- domain assumption LoRA fine-tuning of 7–8 B decoder-only models is an adequate optimization regime for concept unlearning.
- standard math Cross-entropy and next-token prediction losses are well-defined and differentiable for the joint output format.
invented entities (3)
-
worst-prompt-type selection stage (MPSelectTune)
no independent evidence
-
format loss LF based on regex-masked token probabilities
no independent evidence
-
generalized multi-class SP-Score
no independent evidence
read the original abstract
LLMs can be conveniently adapted to a diverse set of tasks, e.g, prediction, question-answering tasks, etc, using appropriate prompts with few-shot examples. Biased or harmful concepts, e.g. gender or bio-weapons, present in pre-trained LLMs can lead to unsafe or unethical responses for many such prompts. Removing such undesirable concepts robustly across different prompt types remains a challenging problem, since existing unlearning methods typically ignore the impact of prompt variation. In this paper, we explore a novel adversarial approach to use a joint prompt for the main task and concept task prediction. We show that fine-tuning using the ``worst prompt type'' for concept prediction (with the highest concept accuracy) improves the average unlearning performance over a fine-tuning method that uses a combination of all prompt types. Our proposed method, MPSelectTune, is a two-stage approach that minimizes the concept accuracy of the highest accuracy-prompt type, after fine-tuning using a novel multi-task loss using multiple prompt types. Experimental results on four benchmarks show $2 - 15\%$ main task accuracy improvements over recent baselines and while reducing the worst-case concept accuracy by up to $17\%$ compared to recent baselines.
Figures
Reference graph
Works this paper leans on
-
[1]
BERT: Pre-training of deep bidirectional transformers for language understanding
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Jill Burstein, Christy Doran, and Thamar Solorio, editors,Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volu...
2019
-
[2]
Association for Computational Linguistics. doi: 10.18653/v1/N19-1423. URL https://aclanthology.org/ N19-1423. Chenlu Ding, Jiancan Wu, Yancheng Yuan, Jinda Lu, Kai Zhang, Alex Su, Xiang Wang, and Xiangnan He. Unified parameter-efficient unlearning for llms.arXiv preprint arXiv:2412.00383,
-
[3]
A survey on in-context learning
Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Baobao Chang, et al. A survey on in-context learning. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 1107–1128,
2024
-
[4]
Erasing conceptual knowledge from language models.arXiv preprint arXiv:2410.02760,
Rohit Gandikota, Sheridan Feucht, Samuel Marks, and David Bau. Erasing conceptual knowledge from language models.arXiv preprint arXiv:2410.02760,
-
[5]
Measuring massive multitask language understanding.arXiv preprint arXiv:2009.03300,
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding.arXiv preprint arXiv:2009.03300,
Pith/arXiv arXiv 2009
-
[6]
Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685,
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685,
-
[7]
Preserving privacy through dememorization: An unlearning technique for mitigating memorization risks in language models
Aly Kassem, Omar Mahmoud, and Sherif Saad. Preserving privacy through dememorization: An unlearning technique for mitigating memorization risks in language models. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4360–4379,
2023
-
[8]
Rethinking machine unlearning for large language models.arXiv preprint arXiv:2402.08787, 2024a
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, et al. Rethinking machine unlearning for large language models.arXiv preprint arXiv:2402.08787, 2024a. Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. Towards safer large language models through mach...
-
[9]
Linear adversarial concept erasure
Shauli Ravfogel, Michael Twiton, Yoav Goldberg, and Ryan D Cotterell. Linear adversarial concept erasure. InInternational Conference on Machine Learning, pages 18400–18421. PMLR, 2022a. Shauli Ravfogel, Francisco Vargas, Yoav Goldberg, and Ryan Cotterell. Adversarial concept erasure in kernel space. InProceedings of the 2022 Conference on Empirical Method...
2022
-
[10]
Association for Computational Linguistics. doi: 10.18653/v1/D19-1410. URLhttps://aclanthology.org/D19-1410. Ohad Rubin, Jonathan Herzig, and Jonathan Berant. Learning to retrieve prompts for in-context learning. InProceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,...
-
[11]
doi: 10.18653/v1/2022.conll-1.10
Association for Computational Linguistics. doi: 10.18653/v1/2022.conll-1.10. URLhttps://aclanthology.org/2022.conll-1.10. Rob V oigt, David Jurgens, Vinodkumar Prabhakaran, Dan Jurafsky, and Yulia Tsvetkov. RtGender: A corpus for studying differential responses to gender. InProceedings of the Eleventh Interna- tional Conference on Language Resources and E...
-
[12]
Association for Computational Linguistics. doi: 10.18653/v1/W17-4413. URL https://aclanthology.org/W17-4413. Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning.arXiv preprint arXiv:2310.10683,
-
[13]
11 A Appendix A.1 Datasets and Task Descriptions We evaluate our method on a diverse set of benchmark datasets spanning multiple domains, each associated with a main task and a concept task. The main task represents the primary learning objective (e.g., classification or prediction), while the concept task captures a sensitive or spurious attribute that w...
2023
-
[14]
nurse” often co-occurs with “female,
for binary concept and task labels to our setting with multiclass main tasks and binary concept labels. While our current work focuses on binary concepts (e.g., gender, toxicity), the SP-Score can be extended to scenarios involving multi-class concept labels by redefining the minority subset appropriately. To elaborate, the minority set Sminor includes th...
2048
-
[15]
Joel Clinton
17 Training Prompt - Bios Dataset Instruction: You are an expert assistant trained to predict the profession and the gender for the given input based on the provided biography. Possible types of professions are: psychologist, poet, photographer, nurse, software_engineer, comedian, pastor, architect, chiropractor, dentist, model, interior_designer, teacher...
1951
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.