The paper argues that machine unlearning, which seeks to erase specific information from large language models, is often evaluated only on a single benchmark distribution, leading to an incomplete assessment of privacy. The authors demonstrate that forgetting can differ significantly when the same information is queried in different languages and scripts across multilingual models, revealing a gap between behavioral forgetting and true inaccessibility. They call for broader evaluation that includes access‑path generalization and adversarial recoverability to ensure genuine privacy protection.
arXiv:2607. 09236v1 Announce Type: new Abstract: Machine unlearning in LLMs is the targeted removal of specific knowledge while preserving all other capabilities, critical for privacy and safety.
arXiv:2608.29943v1 Announce Type: new Abstract: Large language models (LLMs) can memorize sensitive information, raising serious privacy concerns. Machine unlearning offers a potential solution to re...
Machine unlearning for large language models (LLMs) often assumes that a pre-defined forget set matches what the model has memorized, but this frequently breaks in realistic privacy settings where the...
The paper identifies a problem in large language model (LLM) unlearning called forget‑set misalignment, where the set of data to be forgotten does not match what the model has actually memorized. Two failure modes are described: Under Unlearning, where memorized information is omitted from the forget set, and Out‑of‑Knowledge Unlearning, where the algorithm attempts to forget knowledge the model never learned, harming performance. The authors propose CONfs, a data‑blind framework that constructs model‑aligned forget sets by eliciting the model’s memorized knowledge, and demonstrate that it achieves near‑gold standard forgetting while preserving utility better than other data‑blind methods.
Nullify is a training‑free method for unlearning sensitive information from large language models by steering activations during inference. It uses steering vectors to redirect privacy‑related activations away from memorized answers while enforcing a null‑space constraint that preserves activations for retained queries, thereby maintaining model utility. Experiments on TOFU and MUSE demonstrate that Nullify matches or outperforms existing baselines in forget quality while keeping utility nearly intact, all without any weight updates.
The paper introduces the problem of cross‑lingual loopholes in large language model (LLM) unlearning, where forgetting a fact in one language can leave it accessible in others. It presents a new 174‑language benchmark, the Cross‑Lingual Unlearning Tensor, and proposes COVER, a method that selects a subset of source languages to maximize unlearning coverage under a language budget. Experiments show COVER reduces residual knowledge by 7.8–27.3% compared to uniform selection and works on both synthetic and real low‑resource news data.
Large Language Models (LLMs) inevitably internalize substantial amounts of sensitive or private information during pre-training, while LLM unlearning aims to selectively erase specific knowledge to pr...
arXiv:2605.27138v2 Announce Type: replace Abstract: Machine unlearning aims to remove the influence of specific data from trained language models. In real-world deployments, unlearning requests often...
RAG-CT is a defense mechanism designed to protect Retrieval-Augmented Generation (RAG) systems from leaking personally identifiable information (PII). It works by detecting malicious queries through analysis of entropy and margin distributions, applying a score-based detection method. Experiments across four attack strategies and four baseline defenses on two datasets show that RAG-CT significantly reduces PII leakage while outperforming existing defenses, all without altering the underlying LLM or retriever.
arXiv:2606. 06320v1 Announce Type: new Abstract: Machine unlearning aims to remove targeted knowledge from a trained model while preserving its general capabilities.
MemCut introduces a benchmark to test user-requested forgetting in large language model agents, featuring 456 hand-designed secrets embedded in long-horizon conversations with fully annotated evidence trails. The benchmark defines two recovery metrics—native and residual—to assess how well secrets can be retrieved after deletion. Experiments across five memory designs and four LLMs show that deletion reduces native recovery more than residual recovery, highlighting candidate coverage as a key bottleneck.
The paper introduces ADU, a fine‑grained training framework that unlearns sensitive information from large language models by decoupling contextual attention pathways instead of erasing tokens. ADU exploits the distinction between local and global attention heads to identify and suppress attention paths that retrieve persistent sensitive anchors, while preserving local‑attention structure and overall language modeling performance. Evaluation on the TOFU and WMDP benchmarks shows ADU achieves superior forget quality (0.93 on TOFU) and retains 92.9% of model utility compared to 81.9% for existing baselines, with fewer side effects in benign contexts.