Pith. sign in

REVIEW 4 major objections 5 minor 4 cited by

DUSK: Do Not Unlearn Shared Knowledge

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that unlearning one document from an LLM also erases facts that other retained documents support, and that no tested method removes only the document's unique content.

desk verdict DUSK asks the right question—can unlearning preserve shared facts?—but its central shared-knowledge metric rests on an unverified data-generation assumption. read the letter →

arxiv 2505.15209 v3 pith:ZG6S5I3I submitted 2025-05-21 cs.CL

Wonje Jeung , Sangyeon Yoon , Hyesoo Hong , Soeun Kim , Seungju Han , Youngjae Yu , Albert No This is my paper
classification cs.CL
keywords DUSKmachineunlearningsharedknowledgeLLMbenchmarkforgettingmulti-sourcedocumentoverlapmembershipinferencesyntheticprofessorprofiles
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces DUSK, a benchmark that tests whether large language model unlearning can remove a document's unique content while preserving facts that also appear in retained documents. The authors construct 120 fictional professor profiles, split into 60 profiles shared across five stylistically different documents and 60 profiles unique to individual documents, then designate one document as the forget set and ask whether unlearning methods know the difference. They evaluate nine methods with seven metrics, including explicit Shared Knowledge and Unique Forget Knowledge scores. The paper claims the results show a systematic pattern: methods that suppress verbatim text still retain unique facts, and methods that push further also damage shared knowledge, so no method fully removes the forget document's influence while preserving behavior on the retain set. The benchmark matters because real unlearning requests, such as removing a copyrighted news article, usually concern documents that overlap with publicly supported facts.

What carries the argument

DUSK is the central object: 120 synthetic professors, each with 20 question-answer pairs, organized into five style-specific documents. Sixty shared profiles appear in all five documents, while sixty unique profiles are split twelve per document, so designating one document as the forget set creates a controlled setting where shared knowledge is supported by the retain set and unique knowledge is not. Seven metrics then separate verbatim memorization, unique forget knowledge, shared knowledge, unique retain knowledge, downstream capability, privacy leakage, and retain deviation, making it possible to attribute changes to overlapping versus document-specific content.

What would settle it

Compare the five generated styles of each shared professor against the source QA pairs and against each other; if any style changes a fact, such as giving a different office number or alma mater, then the shared/unique split is corrupted and the reported Shared Knowledge damage could come from generation drift rather than from unlearning.

Watch

Extended reading notes

Core claim

The paper claims that current LLM unlearning methods cannot selectively erase document-specific knowledge while preserving facts the model also learned from retained documents. On its benchmark, verbatim memorization drops for most methods, yet Unique Forget Knowledge scores remain far above the Retrain model (for example, 24.3 for GA and 55.1 for RMU versus 5.2), while Shared Knowledge drops heavily (GA falls to 50.7, TAU to 33.5, versus the Retrain's 98.3). Because shared knowledge degrades more than unique retain knowledge, and because Privacy Leakage and Retain Deviation show either over-unlearning or under-unlearning in every tested configuration, the paper concludes that no method can fully remove the forget document's influence while preserving behavior on the retain set.

Load-bearing premise

The shared and unique labels in DUSK depend on the five style-specific versions of each shared professor carrying exactly the same facts, with no added contradictions or omissions, and the paper verifies only duplicate names rather than semantic drift between styles.

Editorial extensions

If this is right

  • In realistic multi-source settings, unlearning a document will likely degrade the model's ability to answer questions about facts that are also supported by retained documents.
  • Current methods can remove surface-level wording but do not reliably remove the underlying unique knowledge, so copyright-style takedowns may not achieve their intended effect.
  • Since Shared Knowledge drops more than Unique Retain Knowledge, collateral damage is concentrated in information overlapping the forget set, not spread uniformly across retained knowledge.
  • Any unlearning method claiming practical deployment should report both Privacy Leakage and Retain Deviation, since methods that look successful on one metric fail on the other.
  • The Retrain model, trained without the forget document, is the correct reference point for judging unlearning, and no tested method reaches its behavior.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The benchmark's synthetic overlap could be replaced by automatically detected overlapping facts from real corpora, which would test whether the reported trade-off holds outside artificially partitioned documents.
  • The Shared Knowledge versus Unique Forget Knowledge trade-off suggests an information-theoretic limit related to entangled representations; a representative test would be to see whether methods that separate shared and unique knowledge at the representation level beat the nine baselines on both metrics.
  • Because Privacy Leakage and Retain Deviation move in opposite directions across methods, practical evaluations should report both jointly, since single-score comparisons can be misleading when forget and retain sets overlap.
  • Fine-grained entity- or attribute-level unlearning, removing one fact about a professor rather than a whole document, is the natural next stress test for selective removal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. DUSK introduces a benchmark for LLM unlearning in multi-source scenarios where the forget set and retain set overlap. The benchmark is built from 120 synthetic professor profiles: 60 shared professors appear in all five style-specific documents, and 60 unique professors are distributed across documents. Forgetting is evaluated on document D1, with the retain set being the other four documents. Seven metrics are defined: Verbatim Memorization, Unique Forget Knowledge, Shared Knowledge, Unique Retain Knowledge, Downstream Capability, Privacy Leakage, and Retain Deviation. Nine unlearning methods (GA, NPO, RMU, TV, TAU, with GD or KL regularizers) are evaluated on LLaMA-3-8B. The main empirical finding is that most methods remove surface-level text but fail to erase unique knowledge while also degrading shared knowledge, leading the authors to conclude that no evaluated approach fully disentangles forget-specific from shared content.

Significance. The benchmark addresses a real and underexplored gap: existing unlearning benchmarks mostly assume disjoint forget and retain sets, while real corpora contain overlapping facts. The controlled synthetic construction, the seven evaluation dimensions, the comparison of nine methods, and the public release are genuine strengths. If the shared/unique labeling is valid, the finding that unlearning methods degrade overlapping knowledge is an important and useful result for the community. The paper also makes a falsifiable empirical claim about current methods that others can test. However, the central conclusion rests on a data-generation assumption that is only weakly verified, and one of the reported metrics has an internal sign inconsistency; both issues need to be resolved before the benchmark can be fully relied upon.

major comments (4)
  1. [Section A.1 and Figure 9] The benchmark's load-bearing assumption is that the five style-specific renderings of each shared professor encode exactly the same facts, so that the Shared Knowledge, Unique Forget Knowledge, and Unique Retain Knowledge labels are accurate. The only validation step reported in Section A.1 is a duplicate-name check, while the Figure 9 generation prompt asks for biographies of at least 300 words built 'EXCLUSIVELY' from 20 one- or two-word QA answers. These constraints leave substantial room for cross-style fact drift: if GPT-4 omitted, added, or altered a fact in one style, then an SK query could fail because that style's document never contained the fact, or could appear to preserve a fact that only one style actually stated. Because this assumption underlies the SK metric and the Section 4.3.2 conclusion that unlearning 'degrades shared knowledge,' the authors should verify fact-level consistency between each generated profile and its source QA pairs, for example by extracting all 20 fields and checking for extra or missing facts, and report the pass rate or rerun the affected analyses.
  2. [Section 3.4.3, Eq. (4), Table 8, Figure 5] The Privacy Leakage sign convention is internally inconsistent. The text after Eq. (4) states that values below zero indicate under-unlearning and values above zero indicate over-unlearning, and Table 8 labels negative values for NPO and RMU as 'under-unlearn' and positive values for GA and TV as 'over-unlearn.' Under the standard AUC-ROC orientation with Df as the positive class, a model that still assigns high probability to Df should yield an AUC above the Retrain model, giving a positive PrivacyLeak, not a negative one; the Target row (-100.0) also has the wrong sign under that reading. The authors should explicitly define the orientation of the AUC or the sign of the score and make Eq. (4), the surrounding prose, Figure 5, and Table 8 mutually consistent.
  3. [Section 4.2, Table 1, Table 4] The universal stopping rule—'terminate unlearning at the first epoch where the Unique Retain Knowledge (URK) score falls below 70'—uses one of the benchmark's own evaluation metrics as a model-selection criterion. Since the Retrain model's URK is 84.8 in Table 1, every method is run until its unique-retain knowledge has degraded well below the retrain baseline. This by construction guarantees large URK degradation and can bias the SK-versus-URK comparison that supports the Section 4.3.2 claim. The authors should report results at matched epochs, or at a range of thresholds, to show that the observed degradation pattern is robust rather than an artifact of the stopping rule.
  4. [Section 4.3.3 and Section 5] The sentence 'no method can completely remove the influence of Df while fully preserving the model’s behavior on Dr' is stronger than the evidence supports. The experiments establish that none of the nine evaluated methods achieved this on DUSK, not that the goal is impossible in general. This wording appears in the conclusion and should be qualified to 'none of the evaluated methods' or 'no method we evaluated.'
minor comments (5)
  1. [Section 3.3 and Section A.1] The description of the unique-knowledge split is inconsistent: the main text says the 60 unique profiles are evenly distributed with 12 per document, while Appendix A.1 says each document contains 12 professors × 5 styles = 60 profiles. Please clarify whether 'unique profiles' refers to unique professors or to style-specific profile instances.
  2. [Title page] The affiliation 'Standford University' should be corrected to 'Stanford University.'
  3. [Table 2] The department field is phrased as 'The major of the professor is affiliated with'; this should be grammatically corrected, e.g., 'The department with which the professor is affiliated.'
  4. [Figure 3] The caption '(a) Target model (trained onD)' is missing a space before 'D'; please fix the typo.
  5. [Section 3.4.3 and Figure 5] The optimal bands of [-5%, 5%] for Privacy Leakage and [0%, 5%] for Retain Deviation are introduced without justification; the authors should explain how these thresholds were chosen.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: DUSK's shared/unique labels are fixed by synthetic dataset construction, its metrics are measured behaviors, and its conclusions are empirical rather than fitted; the main weakness is an unverified data-generation assumption, which is a validity concern, not a circular derivation.

full rationale

DUSK does not derive its central claims from its own assumptions by construction. The Shared Knowledge (SK), Unique Forget Knowledge (UFK), and Unique Retain Knowledge (URK) splits are defined as Kf∩Kr, Kf∖Kr, and Kr∖Kf, and the membership of each professor profile in these sets is fixed by the benchmark construction (60 shared profiles in all five documents, 12 unique profiles per document), not by any fitted parameter or by the unlearning outcome. The reported results in Table 1 and Figure 4 are direct ROUGE measurements on those fixed sets, and the privacy/retain-deviation results in Figure 5 are normalized AUC measurements. The URK stopping threshold of 70 and the ±5% bands are hand-set experimental choices, but they do not encode the conclusion that unlearning degrades shared knowledge; they merely define a comparison point. Self-citations such as [29] and [31] appear in related-work context and are not load-bearing for the benchmark's validity or for the conclusion in Sections 4.3.2–4.3.3. The skeptical concern that the five style-specific GPT-4 renderings may not encode identical facts is a real threat to the benchmark's construct validity, and the paper's own Limitations section acknowledges the synthetic-data limitation; however, this is an unverified empirical assumption about data generation fidelity, not a reduction of the paper's conclusion to its input by definition or by self-citation. Therefore no significant circularity is present.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central claims rest on the semantic identity of shared knowledge across stylistically different documents, the validity of the Retrain model as the ideal reference, and the chosen evaluation thresholds. Free parameters are mostly standard hyperparameters plus a few hand-set evaluation thresholds that affect the quantitative conclusions. No new physical or conceptual entities are introduced.

free parameters (7)
  • URK stopping threshold = 70
    Unlearning is stopped at the first epoch where Unique Retain Knowledge falls below 70, which determines when each method is evaluated and shapes all reported trade-offs.
  • Privacy leakage optimal band = [-5%, 5%]
    Hand-set acceptable range used to classify under/over-unlearning in Figure 5 and Table 8; no statistical justification is provided.
  • RMU layer index = 7
    Representation manipulation layer chosen for RMU; affects RMU's measured unlearning behavior.
  • NPO beta = 0.1
    Deviation control in the negative preference optimization loss; chosen per method and affects results.
  • Task vector alpha = 1.0
    Subtraction strength for TV and TAU, hand-set in experiments.
  • Learning rate = 1e-5
    Used for target/retrain fine-tuning and all unlearning methods; a standard but hand-chosen value.
  • Data split counts = 60 shared / 60 unique / 5 documents
    Benchmark construction choice determining the overlap structure; central to the scenario, but a design parameter rather than a fitted value.
assumptions (5)
  • domain assumption The Retrain model trained only on Dr represents ideal unlearning behavior and is a valid reference for UFK, SK, URK, and distributional metrics.
    Used throughout Section 3.4 and Table 1; the benchmark treats Retrain as the target behavior.
  • domain assumption GPT-4 generated profiles with the verbatim prompt contain exactly the facts from the QA pairs, with all five style variants semantically identical.
    Section A.1 and A.2; the whole shared/unique distinction depends on this semantic identity.
  • domain assumption Min-K++ membership inference AUC over Df versus Dh is a valid measure of privacy leakage, and normalization by AUCretrain is meaningful.
    Section 3.4.3; the reported sign and labels conflict with the formula, making this axiom questionable.
  • domain assumption ROUGE-L overlap between generated answers and ground-truth QA answers measures knowledge retention.
    Used to define UFK, SK, and URK in Section 3.4.
  • domain assumption LLaMA-3-8B fine-tuned for 5 epochs memorizes the synthetic corpus, providing a Target model with forget knowledge to remove.
    Section 4.2; if memorization is incomplete, unlearning results are hard to interpret.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DUSK: Do Not Unlearn Shared Knowledge." pith.science (2026). https://pith.science/paper/ZG6S5I3I

@misc{pith2026250515209,
  author       = {Pith},
  title        = {Pith review of: DUSK: Do Not Unlearn Shared Knowledge},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZG6S5I3I}},
  note         = {Machine review of arXiv:2505.15209}
}
read the original abstract

Large language models (LLMs) are increasingly deployed in real-world applications, raising concerns about the unauthorized use of copyrighted or sensitive data. Machine unlearning aims to remove such 'forget' data while preserving utility and information from the 'retain' set. However, existing evaluations typically assume that forget and retain sets are fully disjoint, overlooking realistic scenarios where they share overlapping content. For instance, a news article may need to be unlearned, even though the same event, such as an earthquake in Japan, is also described factually on Wikipedia. Effective unlearning should remove the specific phrasing of the news article while preserving publicly supported facts. In this paper, we introduce DUSK, a benchmark designed to evaluate unlearning methods under realistic data overlap. DUSK constructs document sets that describe the same factual content in different styles, with some shared information appearing across all sets and other content remaining unique to each. When one set is designated for unlearning, an ideal method should remove its unique content while preserving shared facts. We define seven evaluation metrics to assess whether unlearning methods can achieve this selective removal. Our evaluation of nine recent unlearning methods reveals a key limitation: while most can remove surface-level text, they often fail to erase deeper, context-specific knowledge without damaging shared content. We release DUSK as a public benchmark to support the development of more precise and reliable unlearning techniques for real-world applications.

Figures

Figures reproduced from arXiv: 2505.15209 by the authors.

Figure 1
Figure 1. DUSK provides a realistic unlearning evaluation scenario where forget documents (Df ) contain both unique information to be forgotten and shared knowledge that must be preserved. Unlike conventional setups that naively erase entire forget sets, DUSK evaluates whether unlearning methods can selectively remove sensitive information while retaining shared knowledge supported by other documents in the retain set (Dr), w… view at source ↗
Figure 2
Figure 2. Distributions of country of nationality (left) and graduate year (right) for the seven most common attributes in GPT-4 outputs. This reveals mode collapse with default prompts, disproportionately favoring frequent values like “Canada” and “2010.” After prompt refinement, distributions become more balanced, reflecting a more diverse attribute range. We define Kf as the knowledge contained in the forget set Df , and K… view at source ↗
Figure 3
Figure 3. Min-K++ Probability Distributions over Df , Dr, and Dh. (a) Target model trained on both Df and Dr show higher probabilities, reflecting retained knowledge, while Dh exhibits lower probabilities. (b) Retrain model reduces probabilities on the Df , as they are not trained on Df , representing ideal unlearning. (c) Some unlearned models achieve ideal low probabilities on Df but risk collapsing Dr, which can be detecte… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Two-dimensional analysis of unlearning dynamics. We visualize model trajectories over multiple epochs to illustrate key trade-offs in DUSK. (a) shows the trade-off between verbatim and knowledge forgetting, while (b) shows the trade-off between shared knowledge and uni…
Figure 5
Figure 5. Figure 5: Privacy Leakage and Retain Deviation Analysis. Gray bands indicate optimal bounds: [−5%, 5%] for leakage and [0%, 5%] for deviation. Values outside these ranges reflect under￾unlearning (below −5%), over-unlearning (above 5%) in leakage, or degradation of retained know…
Figure 6
Figure 6. Figure 6: Distributions of seven most common attributes in GPT-4 outputs before prompt refinement. Several features exhibit mode collapse, with overrepresentation of specific values such as “Canadian” for nationality, “2010” for year of employment, and “Agnostic” for religion, r…
Figure 7
Figure 7. Figure 7: Distributions of seven most common attributes after prompt refinement. The frequency of values across attributes such as nationality, religion, and year of employment is more balanced, indicating improved diversity and reduced mode collapse in GPT-4 outputs. In contras…
Figure 8
Figure 8. Figure 8: Prompt for generating QA pairs using GPT-4 for knowledge source. [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: Prompt for generating profiles using GPT-4. [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. R-TOFU: Unlearning in Large Reasoning Models

    cs.CL 2025-05 conditional novelty 6.0 of 10

    R-TOFU shows that answer-level unlearning is insufficient for large reasoning models because residual knowledge persists in chain-of-thought traces.

  2. BalDRO: A Distributionally Robust Optimization based Framework for Large Language Model Unlearning

    cs.LG 2026-01 conditional novelty 5.0 of 10

    BalDRO makes LLM unlearning more balanced by updating against a worst-case-weighted forget distribution, improving forget quality on TOFU/MUSE at stable utility.

  3. SoK: Machine Unlearning for Large Language Models

    cs.LG 2025-06 conditional novelty 5.0 of 10

    A new taxonomy for LLM unlearning distinguishes removal-intended from suppression-intended methods, and argues that gradient ascent methods functionally behave like suppression.

  4. SEPS: A Separability Measure for Robust Unlearning in LLMs

    cs.CL 2025-05 conditional novelty 5.0 of 10

    SEPS measures separation of forget and retain queries in mixed prompts, and Mixed Prompt training makes unlearned LLMs much better at this separation.

Reference graph

Works this paper leans on

57 extracted references · 24 canonical work pages · cited by 4 Pith papers

  1. [1]

    Achiam, S

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  2. [2]

    Barbulescu and P

    G.-O. Barbulescu and P. Triantafillou. To each (textual sequence) its own: Improving memorized- data unlearning in large language models.arXiv preprint arXiv:2405.03097, 2024

    arXiv 2024

  3. [3]

    Brophy and D

    J. Brophy and D. Lowd. Machine unlearning for random forests. InICML, 2021

    work page 2021

  4. [4]

    Cao and J

    Y . Cao and J. Yang. Towards making systems forget with machine unlearning. InIEEE S&P, 2015

    work page 2015

  5. [5]

    Carlini, F

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. Extracting training data from large language models. In30th USENIX security symposium (USENIX Security 21), pages 2633–2650, 2021

    2021

  6. [6]

    D. Cer, M. Diab, E. Agirre, I. Lopez-Gazpio, and L. Specia. Semeval-2017 task 1: Se- mantic textual similarity-multilingual and cross-lingual focused evaluation.arXiv preprint arXiv:1708.00055, 2017

    arXiv 2017

  7. [7]

    Chen and D

    J. Chen and D. Yang. Unlearn what you want to forget: Efficient unlearning for llms. InEMNLP, 2023

    work page 2023

  8. [8]

    Clark, I

    P. Clark, I. Cowhey, O. Etzioni, T. Khot, A. Sabharwal, C. Schoenick, and O. Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge.arXiv preprint arXiv:1803.05457, 2018

    arXiv 2018

Show all 57 references
  1. [9]

    Cobbe, V

    K. Cobbe, V . Kosaraju, M. Bavarian, M. Chen, H. Jun, L. Kaiser, M. Plappert, J. Tworek, J. Hilton, R. Nakano, et al. Training verifiers to solve math word problems.arXiv preprint arXiv:2110.14168, 2021

    2021 arXiv

  2. [10]

    O. Dige, D. Arneja, T. F. Yau, Q. Zhang, M. Bolandraftar, X. Zhu, and F. Khattak. Can machine unlearning reduce social bias in language models? InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track, pages 954–969, 2024

    2024

  3. [11]

    Doshi and A

    J. Doshi and A. C. Stickland. Does unlearning truly unlearn? a black box evaluation of llm unlearning methods.arXiv preprint arXiv:2411.12103, 2024

    2024 arXiv

  4. [12]

    Eldan and M

    R. Eldan and M. Russinovich. Who’s harry potter? approximate unlearning in llms.arXiv preprint arXiv:2310.02238, 2023. [13]Chabon v. OpenAI, Inc.,. 3:23-cv-04625, (N.D. Cal.), 2023. [14]DOE 1 v. GitHub, Inc.4:22-cv-06823, N.D. Cal. 2022. [15]Kadrey v. Meta Platforms, Inc.3:23-...

    2023 arXiv

  5. [17]

    C. Gao, L. Wang, K. Ding, C. Weng, X. Wang, and Q. Zhu. On large language model continual unlearning. InThe Thirteenth International Conference on Learning Representations, 2025

    2025

  6. [18]

    L. Gao, J. Tow, B. Abbasi, S. Biderman, S. Black, A. DiPofi, C. Foster, L. Golding, J. Hsu, A. Le Noac’h, H. Li, K. McDonell, N. Muennighoff, C. Ociepa, J. Phang, L. Reynolds, H. Schoelkopf, A. Skowron, L. Sutawika, E. Tang, A. Thite, B. Wang, K. Wang, and A. Zou. A framework ...

    2024

  7. [19]

    Golatkar, A

    A. Golatkar, A. Achille, and S. Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. InCVPR, 2020

    2020

  8. [20]

    Grattafiori, A

    A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024. 10

    2024 arXiv

  9. [21]

    M. M. Grynbaum and R. Mac. The times sues openai and microsoft over ai use of copyrighted work.The New York Times, 27, 2023

    2023

  10. [22]

    C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten. Certified data removal from machine learning models.arXiv preprint arXiv:1911.03030, 2019

    1911 arXiv

  11. [23]

    P. Guo, A. Syed, A. Sheshadri, A. Ewart, and G. K. Dziugaite. Mechanistic unlearn- ing: Robust knowledge unlearning and editing via mechanistic localization.arXiv preprint arXiv:2410.12949, 2024

    2024 arXiv

  12. [24]

    Hendrycks, C

    D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt. Measuring massive multitask language understanding.arXiv preprint arXiv:2009.03300, 2020

    2009 arXiv

  13. [25]

    G. Hinton. Distilling the knowledge in a neural network.arXiv preprint arXiv:1503.02531, 2015

    2015 arXiv

  14. [26]

    S. Hu, Y . Fu, S. Wu, and V . Smith. Jogging the memory of unlearned llms through targeted relearning attacks. InICLR, 2025

    2025

  15. [27]

    Ilharco, M

    G. Ilharco, M. T. Ribeiro, M. Wortsman, S. Gururangan, L. Schmidt, H. Hajishirzi, and A. Farhadi. Editing models with task arithmetic. InICLR, 2023

    2023

  16. [28]

    J. Jang, D. Yoon, S. Yang, S. Cha, M. Lee, L. Logeswaran, and M. Seo. Knowledge unlearning for mitigating privacy risks in language models. InACL, 2023

    2023

  17. [29]

    D. Jeon, W. Jeung, T. Kim, A. No, and J. Choi. An information theoretic evaluation metric for strong unlearning.arXiv preprint arXiv:2405.17878, 2024

    2024

  18. [30]

    Jeung, D

    W. Jeung, D. Jeon, A. Yousefpour, and J. Choi. Large language models still exhibit bias in long text.arXiv preprint arXiv:2410.17519, 2024

    2024 arXiv

  19. [31]

    Jeung, S

    W. Jeung, S. Yoon, and A. No. Seps: A separability measure for robust unlearning in llms. arXiv preprint arXiv:2505.14832, 2025

    2025 arXiv

  20. [32]

    J. Jia, Y . Zhang, Y . Zhang, J. Liu, B. Runwal, J. Diffenderfer, B. Kailkhura, and S. Liu. Soul: Unlocking the power of second-order optimization for llm unlearning. InEMNLP, 2024

    2024

  21. [33]

    Z. Jin, P. Cao, C. Wang, Z. He, H. Yuan, J. Li, Y . Chen, K. Liu, and J. Zhao. Rwku: Bench- marking real-world knowledge unlearning for large language models. InNeurIPS, 2024

    2024

  22. [34]

    Joshi, S

    A. Joshi, S. Saha, D. Shukla, S. Vema, H. Jhamtazni, M. Gaur, and A. Modi. Towards robust evaluation of unlearning in llms via data transformations. InEMNLP, 2024

    2024

  23. [35]

    Joshi, E

    M. Joshi, E. Choi, D. S. Weld, and L. Zettlemoyer. Triviaqa: A large scale distantly supervised challenge dataset for reading comprehension.arXiv preprint arXiv:1705.03551, 2017

    2017 arXiv

  24. [36]

    A. M. Kassem, O. A. M. Mahmoud, and S. Saad. Preserving privacy through dememorization: An unlearning technique for mitigating memorization risks in language models. InEMNLP, 2023

    2023

  25. [37]

    Kurmanji, P

    M. Kurmanji, P. Triantafillou, J. Hayes, and E. Triantafillou. Towards unbounded machine unlearning. InNeurIPS, 2023

    2023

  26. [38]

    V . I. Levenshtein et al. Binary codes capable of correcting deletions, insertions, and reversals. InSoviet physics doklady, volume 10, pages 707–710. Soviet Union, 1966

    1966

  27. [39]

    N. Li, A. Pan, A. Gopal, S. Yue, D. Berrios, A. Gatti, J. D. Li, A.-K. Dombrowski, S. Goel, L. Phan, et al. The wmdp benchmark: Measuring and reducing malicious use with unlearning. arXiv preprint arXiv:2403.03218, 2024

    2024 arXiv

  28. [40]

    C.-Y . Lin. Rouge: A package for automatic evaluation of summaries. InText summarization branches out, pages 74–81, 2004

    2004

  29. [41]

    S. Lin, J. Hilton, and O. Evans. Truthfulqa: Measuring how models mimic human falsehoods. arXiv preprint arXiv:2109.07958, 2021. 11

    2021 arXiv

  30. [42]

    C. Y . Liu, Y . Wang, J. Flanigan, and Y . Liu. Large language model unlearning via embedding- corrupted prompts. InNeurIPS, 2024

    2024

  31. [43]

    S. Liu, Y . Yao, J. Jia, S. Casper, N. Baracaldo, P. Hase, Y . Yao, C. Y . Liu, X. Xu, H. Li, et al. Rethinking machine unlearning for large language models.Nature Machine Intelligence, pages 1–14, 2025

    2025

  32. [44]

    Lynch, P

    A. Lynch, P. Guo, A. Ewart, S. Casper, and D. Hadfield-Menell. Eight methods to evaluate robust unlearning in llms.arXiv preprint arXiv:2402.16835, 2024

    2024 arXiv

  33. [45]

    Maini, Z

    P. Maini, Z. Feng, A. Schwarzschild, Z. C. Lipton, and J. Z. Kolter. Tofu: A task of fictitious unlearning for llms.arXiv preprint arXiv:2401.06121, 2024

    2024 arXiv

  34. [46]

    M. Nasr, N. Carlini, J. Hayase, M. Jagielski, A. F. Cooper, D. Ippolito, C. A. Choquette-Choo, E. Wallace, F. Tramèr, and K. Lee. Scalable extraction of training data from (production) language models.arXiv preprint arXiv:2311.17035, 2023

    2023 arXiv

  35. [47]

    T. T. Nguyen, T. T. Huynh, Z. Ren, P. L. Nguyen, A. W.-C. Liew, H. Yin, and Q. V . H. Nguyen. A survey of machine unlearning.arXiv preprint arXiv:2209.02299, 2022

    2022 arXiv

  36. [48]

    Parrish, A

    A. Parrish, A. Chen, N. Nangia, V . Padmakumar, J. Phang, J. Thompson, P. M. Htut, and S. R. Bowman. Bbq: A hand-built bias benchmark for question answering.arXiv preprint arXiv:2110.08193, 2021

    2021 arXiv

  37. [49]

    Pawelczyk, S

    M. Pawelczyk, S. Neel, and H. Lakkaraju. In-context unlearning: Language models as few shot unlearners. InICML, 2024

    2024

  38. [50]

    Rafailov, A

    R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn. Direct preference optimization: Your language model is secretly a reward model. InNeurIPS, 2023

    2023

  39. [51]

    W. Shi, A. Ajith, M. Xia, Y . Huang, D. Liu, T. Blevins, D. Chen, and L. Zettlemoyer. Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789, 2023

    2023 arXiv

  40. [52]

    W. Shi, J. Lee, Y . Huang, S. Malladi, J. Zhao, A. Holtzman, D. Liu, L. Zettlemoyer, N. A. Smith, and C. Zhang. Muse: Machine unlearning six-way evaluation for language models.arXiv preprint arXiv:2407.06460, 2024

    2024 arXiv

  41. [53]

    Thaker, S

    P. Thaker, S. Hu, N. Kale, Y . Maurya, Z. S. Wu, and V . Smith. Position: Llm unlearning benchmarks are weak measures of progress.arXiv preprint arXiv:2410.02879, 2024

    2024 arXiv

  42. [54]

    Thaker, Y

    P. Thaker, Y . Maurya, S. Hu, Z. S. Wu, and V . Smith. Guardrail baselines for unlearning in llms. InICLR Workshop (SeTLLM), 2024

    2024

  43. [55]

    V oigt and A

    P. V oigt and A. V on dem Bussche. The eu general data protection regulation (gdpr).A practical guide, 1st ed., Cham: Springer International Publishing, 10(3152676):10–5555, 2017

    2017

  44. [56]

    B. Wei, W. Shi, Y . Huang, N. A. Smith, C. Zhang, L. Zettlemoyer, K. Li, and P. Henderson. Evaluating copyright takedown methods for language models.arXiv preprint arXiv:2406.18664, 2024

    2024 arXiv

  45. [57]

    Yousefpour, T

    A. Yousefpour, T. Kim, R. S. Kwon, S. Lee, W. Jeung, S. Han, A. Wan, H. Ngan, Y . Yu, and J. Choi. Representation bending for large language model safety.arXiv preprint arXiv:2504.01550, 2025

    2025 arXiv

  46. [58]

    Zhang, J

    J. Zhang, J. Sun, E. Yeats, Y . Ouyang, M. Kuo, J. Zhang, H. F. Yang, and H. Li. Min-k%++: Improved baseline for detecting pre-training data from large language models.arXiv preprint arXiv:2404.02936, 2024

    2024 arXiv

  47. [59]

    Zhang, L

    R. Zhang, L. Lin, Y . Bai, and S. Mei. Negative preference optimization: From catastrophic collapse to effective unlearning. InCOLM, 2024

    2024

  48. [60]

    Zhang, F

    Z. Zhang, F. Wang, X. Li, Z. Wu, X. Tang, H. Liu, Q. He, W. Yin, and S. Wang. Catastrophic failure of llm unlearning via quantization. InICLR, 2025

    2025

  49. [61]

    Canadian

    Z. Zhang, J. Yang, P. Ke, S. Cui, C. Zheng, H. Wang, and M. Huang. Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks.arXiv preprint arXiv:2407.02855, 2024. 12 A Details of DUSK A.1 Dataset Construction Details Table 2: Pro...

    2024 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.