Scalable and Robust LLM Unlearning by Correcting Responses with Retrieved Exclusions

## Abstract

Abstract Language models trained on web-scale corpora risk memorizing and exposing sensitive information, prompting the need for effective machine unlearning.
Prior methods mainly focus on input queries to suppress sensitive outputs, yet this often fails to eliminate the underlying knowledge and limits scalability.
To address this, we propose Corrective Unlearning with Retrieved Exclusions (CURE), a novel unlearning framework that verifies model outputs for leakage and revises them into safe responses.
Specifically, CURE employs a lightweight corrector that is applied to the original model to verify whether outputs contain target knowledge and to rewrite them if any leakage is detected.
To efficiently handle large-scale unlearning requests, CURE retrieves unlearning targets that are relevant to the initial response and provides them as in-context references to the corrector for detection and conditional revision.
By leveraging this retrieval augmentation, the corrector can adapt to new unlearning requests without additional training.
Extensive evaluations demonstrate that CURE substantially reduces information leakage, even from indirect queries where prior works fall short, while maintaining response quality and general utility.
Moreover, it demonstrates robustness under continual unlearning scenarios, making it practical for real-world applications. 1 1 1 The source code is available at: https://github.com/the-jb/cure

## 1 Introduction

Large language models (LLMs) have demonstrated remarkable performance across a wide range of domains (Achiam et al., 2023; Google DeepMind, 2025), primarily driven by scaling model parameters and pre-training on internet-scale data (Radford et al., 2018; 2019; Brown et al., 2020).
However, these large-scale corpora often contain harmful or sensitive content, such as individuals’ personally identifiable data (Si et al., 2023; Yao et al., 2024a).
Such content can be inadvertently memorized by models and later extracted through malicious attacks, such as membership inference (Carlini et al., 2021; Duan et al., 2024), raising serious concerns about user privacy and trust.

To address these concerns, several machine unlearning methods have been proposed to prevent the disclosure of sensitive information in model outputs (Chen & Yang, 2023; Yao et al., 2024b; Cha et al., 2025; Ding et al., 2025).
A common approach is to fine-tune models to unlearn specific target information, such as reducing the likelihood of sensitive outputs (Jang et al., 2022; Zhang et al., 2024) or corrupting representations from inputs (Li et al., 2024a).
However, such input-based suppression often fails to fully eliminate the targeted knowledge (see Figure [1](https://arxiv.org/html/2509.25973v1#S1.F1)) and risks unintentionally impairing other general capabilities (i.e., catastrophic forgetting; McCloskey & Cohen, 1989).

Recently, another line of work has explored techniques to simulate the outputs that an unlearned model would ideally produce, without modifying the original model (Pawelczyk et al., 2023; Thaker et al., 2024; Liu et al., 2024).
Several methods leverage classifiers to identify sensitive queries and suppress corresponding outputs, for example by perturbing prompts before feeding them to LLMs (Liu et al., 2024) or by adapting LoRA (Gao et al., 2024).
However, relying solely on input classifiers is inherently limited in preventing model leakage, especially when responding to indirect or seemingly harmless queries (see Figure [1](https://arxiv.org/html/2509.25973v1#S1.F1)).
Moreover, implementing such guardrails typically requires training classifiers to detect sensitive inputs, which incurs significant costs, particularly under continual unlearning scenarios.
Overall, input-based methods are limited in their ability to suppress knowledge and often excessively sacrifice response quality.
This raises a key question:

*Can we achieve unlearning by revising model outputs, rather than relying solely on inputs?*

To this end, we propose Corrective Unlearning with Retrieved Exclusions (CURE), a novel unlearning framework that employs a self-correcting mechanism to mitigate information leakage in model outputs.
At its core, CURE introduces a parameter-efficient fine-tuning (PEFT) corrector that attaches to the base model, enabling response correction without altering the original parameters.
After the model generates an initial draft, the corrector identifies potential leakage and, if detected, revises the response using unlearning targets supplied as in-context reference.
To efficiently handle large-scale unlearning requests, relevant targets are retrieved from external memory based on the draft output and then provided to the corrector.
To train the corrector, we design a two-stage curriculum: (i) detection and revision of leaked content, and (ii) reinforcement of suppression strategies.
This curriculum enables CURE to suppress information leakage while preserving the utility of non-leakage responses.

Figure: Figure 1: Limitations of existing unlearning methods. Red text marks information to unlearn, and blue text indicates safe content. (a) When responding to explicitly unlearned questions, fine-tuning methods such as RMU (Li et al., 2024a) degrade Llama3.1-8B’s ability to produce valid responses, and guardrail-based methods like ECO (Liu et al., 2024) also lose coherence. (b) Moreover, both methods fail to fully remove the target knowledge, which can be revealed through indirect questions.
Refer to caption: x1.png

We demonstrate the effectiveness of CURE through extensive evaluations across diverse unlearning tasks.
Notably, we show that both fine-tuning (RMU; Li et al., 2024a) and guardrail (ECO; Liu et al., 2024) approaches fail to eliminate leakage under indirect queries on the TOFU benchmark (Maini et al., 2024), reducing leakage by only 6.7% and 11.2%, respectively, relative to the original model.
In contrast, CURE achieves a 69.2% reduction without compromising response quality and model utility.
Furthermore, once trained, CURE can generalize to diverse unlearning tasks, including privacy (Maini et al., 2024), harmful content (Li et al., 2024a), and general knowledge (Hendrycks et al., 2021) unlearning.
Even in continual unlearning setups, where fine-tuning approaches can incur severe utility loss after just a few requests, CURE maintains robust performance while preserving model capabilities.
Taken together, these results suggest a promising direction for developing scalable and practical frameworks for LLM unlearning.

## 2 Related Work

Knowledge unlearning. As large language models (LLMs) scale by training on vast corpora from the internet, the models inevitably acquire knowledge of personal and sensitive data, sparking growing interest in unlearning techniques that prevent such information from being generated (Si et al., 2023; Yao et al., 2024b).
To this end, two major directions have emerged for LLM unlearning: (i) directly removing the target knowledge from the model, and (ii) modifying model outputs through prompting or guardrail mechanisms, while leaving the underlying model unchanged.
Although modifying model parameters can effectively erase knowledge (Jang et al., 2022; Meng et al., 2022; Zhang et al., 2024; Cha et al., 2025; Ding et al., 2025), precisely targeting and deleting specific information remains challenging, and the required fine-tuning often degrades overall model utility (Maini et al., 2024; Jin et al., 2024).
Moreover, continual unlearning necessitates repeated optimization, further exacerbating this performance degradation (Liu et al., 2022; Gao et al., 2024).
Guardrail-based approaches, by contrast, train classifiers to detect sensitive inputs and either perturb them (Liu et al., 2024) or adapt the model outputs at inference time (Gao et al., 2024), thereby avoiding parameter updates.
However, as illustrated in Figure [1](https://arxiv.org/html/2509.25973v1#S1.F1), these methods remain vulnerable to leakage in outputs for seemingly general queries or simple rephrasings (Patil et al., 2024), and each additional unlearning request typically requires further training of the classifiers.
In this work, we propose a scalable and effective LLM unlearning framework that verifies and rewrites model outputs through an in-context corrector.

Self-verification and correction.
Recent work has shown that combining LLM generation with self-verification and self-correction can significantly reduce jailbreak risks (Zhang et al., 2025), improve alignment (Wang et al., 2024b), and enhance test-time performance (Madaan et al., 2023).
In particular, prompting models to first verify their own answers and then revise them, rather than directly generating responses, has yielded substantial gains (Kumar et al., 2025; Lee et al., 2025).
Building on these insights, we introduce a novel output-based LLM unlearning framework that employs a self-corrector, trained via parameter-efficient fine-tuning of the original model, to verify and revise generated outputs.

Retrieval augmented in-context learning.
Retrieval-augmented generation (RAG) has proven effective across a range of NLP tasks by retrieving relevant information from external knowledge sources and supplying it as in-context input to LLMs (Guu et al., 2020; Lazaridou et al., 2022; Izacard et al., 2023; Sarthi et al., 2024).
Beyond improving performance, RAG has also emerged as an efficient approach for knowledge editing, as it introduces new information without modifying model parameters and reduces context length by selecting only a small, targeted subset of data (Xu et al., 2024; Wang et al., 2024a).
Crucially, by avoiding parameter updates, RAG mitigates the risk of catastrophic forgetting (McCloskey & Cohen, 1989).
As a result, it has demonstrated strong performance in large-scale knowledge editing scenarios, including continual knowledge editing (Gutiérrez et al., 2024; 2025) and long-context understanding (Li et al., 2024b; Jin et al., 2025).
However, while most prior work on RAG has focused on in-context learning, i.e., leveraging query-driven retrieval to enhance responses, relatively little attention has been paid to in-context avoidance, where the objective is to steer models away from sensitive information.
Our work takes a step in this direction by introducing an output-driven retrieval strategy and a two-stage curriculum that enables effective in-context avoidance for unlearning by reinforcing original content suppression.

Figure: Figure 2: Overview of CURE. Given a query $x$, the base model $\mathcal{M}_{\theta}$ first produces a draft response $y_{0}$ that may contain private or undesired knowledge. CURE operates in two stages: (1) Draft-based retrieval: The pair $(x,y_{0})$ is used to query an unlearning-target database $\mathcal{K}$, retrieving the most relevant exclusions $\mathcal{K}^{\mathtt{retr}}$. (2) Response correction: A parameter-efficiently tuned corrector $\phi$ is applied at inference time, conditioning on $(x,y_{0},\mathcal{K}^{\mathtt{retr}})$, to detect leakage and rewrite the response, producing the final safe output $y^{\!*}$ while preserving $\mathcal{M}_{\theta}$’s general knowledge.
Refer to caption: x2.png

## 3 CURE: Corrective Unlearning with Retrieved Exclusions

In this section, we introduce Corrective Unlearning with Retrieved Exclusions (CURE), a retrieval-augmented unlearning framework designed to prevent knowledge leakage by revising model responses based on retrieved exclusions, i.e., explicit targets to unlearn.
As illustrated in Figure [2](https://arxiv.org/html/2509.25973v1#S2.F2), the framework (1) generates a draft response to retrieve the relevant unlearning targets, and (2) applies the corrector to verify and revise the draft response, yielding a final safe output.
Given a query $x$, the base model $\mathcal{M}_{\theta}$ first generates a draft response $y_{0}$, which is used to retrieve a set of relevant unlearning targets $\mathcal{K}^{\mathtt{retr}}$ from a non-parametric memory (Section [3.2](https://arxiv.org/html/2509.25973v1#S3.SS2)).
A corrector module $\phi$ is then used to verify and revise $y_{0}$ based on $\mathcal{K}^{\mathtt{retr}}$, producing a revised response $y^{*}$ that avoids leaking excluded knowledge (Section [3.3](https://arxiv.org/html/2509.25973v1#S3.SS3)). Lastly, we introduce a mechanism for training the corrector module $\phi$ (Section [3.4](https://arxiv.org/html/2509.25973v1#S3.SS4)).

### 3.1 Problem formulation: Model unlearning

We consider a practical unlearning task where the goal is to prevent a language model from generating outputs that reveal specified target knowledge.
Our goal is to constrain the model so that, for any query $x$ and any knowledge instance $k\in\mathcal{K}$, the probability of producing responses that expose $k$ remains below a small tolerance level, while the overall capability of the model is preserved.
Formally, let $\mathcal{M}_{\theta}$ denote the original model and let $\mathcal{K}=\{k_{1},\dots,k_{n}\}$ be the set of knowledge instances to be unlearned.
An ideally unlearned model $\mathcal{M}^{\prime}_{\theta}$ should satisfy:

$$ $\Pr\big[y\in\mathcal{Y}(k)\mid x;\mathcal{M}^{\prime}_{\theta}\big]\leq\varepsilon\quad\text{s.t.}\quad C(\mathcal{M}^{\prime}_{\theta})\approx C(\mathcal{M}_{\theta}),$ (1) $$

where $\mathcal{Y}(k)$ denotes the set of responses that reveal knowledge $k$, $\varepsilon$ is a small tolerance parameter, and $C(\cdot)$ denotes the overall capability of a model independent of $\mathcal{K}$.

### 3.2 Retrieving knowledge exclusion

When the unlearning target set $\mathcal{K}$ is large, it becomes computationally impractical to encode all its elements in-context or to examine every model response against the entire set.
To efficiently handle this, we identify a smaller subset $\mathcal{K}^{\mathtt{retr}}\subset\mathcal{K}$ by selecting the knowledge instances that are relevant to the draft response $y_{0}$.
The subset $\mathcal{K}^{\mathtt{retr}}$ is constructed by retrieving the $K$ unlearning targets in $\mathcal{K}$ that are most similar to the query-response pair $(x,y_{0})$.
Here, we formulate the pair as a text query and apply BM25 (Robertson et al., 2009) retrieval to obtain the top-$K$ most relevant unlearning targets from $\mathcal{K}$, i.e., $|\mathcal{K}^{\mathtt{retr}}|=K$.

### 3.3 Response correction with corrector module

Given a draft response $y_{0}$ and a retrieved subset of unlearning targets $\mathcal{K}^{\mathtt{retr}}\subset\mathcal{K}$, the objective is to generate a revised response $y^{*}$ that minimizes leakage of the knowledge contained in $\mathcal{K}^{\mathtt{retr}}$.
Here, we introduce a corrector module $\phi$, which is implemented as a Low-Rank Adapter (LoRA) (Hu et al., 2022) and attaches to the original model $\mathcal{M}_{\theta}$ only during the correction phase, thereby preserving the original parameters $\theta$.

The correction phase consists of two steps: (i) leakage detection, and (ii) response correction (when there is a leakage).
Given the original query $x$, the draft response $y_{0}$, the correction prompt $x_{\text{correct}}$ that incorporates $x$ and $y_{0}$ (presented in Figure [6](https://arxiv.org/html/2509.25973v1#A2.F6)), and the retrieved unlearning targets $\mathcal{K}^{\mathtt{retr}}$, the model $\mathcal{M}_{\theta,\phi}$ takes $x_{\text{correct}}$ and $\mathcal{K}^{\mathtt{retr}}$ as input and first assesses if $y_{0}$ contains any information from $\mathcal{K}^{\mathtt{retr}}$ by predicting one of two tokens: [LEAKAGE] and [NO_LEAKAGE].

CURE determines whether the knowledge leakage has occurred by using Equation [2](https://arxiv.org/html/2509.25973v1#S3.E2).
Then, if the leakage is detected, CURE revises the original response $y_{0}$ by removing the overlapping information, yielding the rewritten output $y^{*}$.
Otherwise (i.e., no leakage detected), we use the original response as the final output, i.e., $y^{*}:=y_{0}$.

##### Leakage detection.

Let $z_{\text{leak}}$ and $z_{\text{noleak}}$ denote the logits from the model $\mathcal{M}_{\theta,\phi}(x_{\text{correct}},\mathcal{K}^{\mathtt{retr}})$ corresponding to [LEAKAGE] and [NO_LEAKAGE], respectively.
Given a threshold $\tau\in(0,1)$, we classify the response $y_{0}$ as containing leakage if:

$$ $\sigma(z_{\text{leak}}-z_{\text{noleak}})>\tau,\quad\text{where }\sigma(z)=(1+e^{-z})^{-1}.$ (2) $$

##### Response correction.

If leakage is detected, the draft response $y_{0}$ is revised by the model $\mathcal{M}_{\theta,\phi}$, removing information overlapping with $\mathcal{K}^{\mathtt{retr}}$.
Otherwise, we omit the generation for efficiency, and directly yield $y_{0}$.
The final output $y^{*}$ is given by

$$ $y^{*}=\begin{cases}\mathcal{M}_{\theta,\phi}(\texttt{[LEAKAGE]},y_{0},x_{\text{correct}},\mathcal{K}^{\mathtt{retr}})&\text{if leakage detected},\\ y_{0}&\text{otherwise}\end{cases}.$ (3) $$

### 3.4 Training corrector module with curriculum learning

The goal of the corrector $\phi$ is to detect and revise leakage in responses by distinguishing between content derived from the retrieval set $\mathcal{K}^{\mathtt{retr}}$ and legitimate content in the query $x$.
To train such a corrector,
we first construct contrastive retrieval sets for context-sensitive leakage identification.
We then employ a two-stage curriculum: (i) learning to identify leakage and rewrite the response to avoid it, and (ii) reinforcing leakage suppression in the rewritten response.

Contrastive retrieval sets.
For each query-response pair $(x,y_{0})$, we build two sets $\mathcal{K}^{\mathtt{retr+}}$ and $\mathcal{K}^{\mathtt{retr-}}$, where $\mathcal{K}^{\mathtt{retr+}}$ overlaps with $y_{0}$ and $\mathcal{K}^{\mathtt{retr-}}$ does not.
Based on these sets, we construct tuples of the form $(x_{\text{correct}},\mathcal{K}^{\mathtt{retr}},y_{\text{judge}},y^{*})$.
When $\mathcal{K}^{\mathtt{retr}}=\mathcal{K}^{\mathtt{retr+}}$ the tuple corresponds to a case with $\mathds{1}_{\text{leak}}=1$, i.e., $y_{\text{judge}}=\texttt{[LEAKAGE]}$, and when $\mathcal{K}^{\mathtt{retr}}=\mathcal{K}^{\mathtt{retr-}}$, it corresponds to a case with $\mathds{1}_{\text{leak}}=0,y^{*}=y_{0},y_{\text{judge}}=\texttt{[NO_LEAKAGE]}$.
We collect the revision target $y^{*}$ using GPT-4o. Details are provided in Appendix [B](https://arxiv.org/html/2509.25973v1#A2).

#### 3.4.1 Stage I: Leakage identification and response revision

In stage I, we train the corrector $\phi$ to perform both leakage detection and conditional response revision tasks simultaneously.
Given a tuple $(x,x_{\text{correct}},y_{0},\mathcal{K}^{\mathtt{retr}},y_{\text{judge}},y^{*})$, we define two losses below.

Judgement loss.
Let $\Delta=z_{\text{leak}}-z_{\text{noleak}}$ and given a judge token $y_{\text{judge}}$,
we optimize $\mathcal{M}_{\theta,\phi}$ using a combined objective of binary cross-entropy and a language modeling loss:

$$ $\mathcal{L}_{\text{judge}}=-\frac{1}{2}\left(\big(\mathds{1}_{\text{leak}}\log\sigma(\Delta)+(1-\mathds{1}_{\text{leak}})\log(1-\sigma(\Delta))\big)+\log p(y_{\text{judge}}\mid x,y_{0},\mathcal{K}^{\mathtt{\text{retr}}};\mathcal{M}_{\theta,\phi})\right).$ (4) $$

Revision loss. We also train the revision target $y^{*}$, by negative log-likelihood loss:

$$ $\mathcal{L}_{\text{revision}}=-\sum_{t}\log p\big(y^{*}_{t}\mid y^{*}_{<t},y_{\text{judge}},x_{\text{correct}},x,y_{0},\mathcal{K}^{\mathtt{\text{retr}}};\mathcal{M}_{\theta,\phi}\big).$ (5) $$

The final training objective is defined as
$\mathcal{L}_{\text{Stage I}}=\mathcal{L}_{\text{judge}}+\mathcal{L}_{\text{revision}}$.

#### 3.4.2 Stage II: Reinforcement of leakage suppression

Stage I trains the corrector to revise leaked responses using language modeling loss.
However, solely relying on this does not sufficiently reduce the likelihood of the original response $y_{0}$, which poses a potential risk of exposing original content.
To address this, we introduce a suppression objective based on DPO Rafailov et al., 2023, encouraging the model to prefer safe corrections over leaked outputs.
Specifically, DPO relies on a reference model to preserve linguistic fluency, but in unlearning tasks this dependence can hinder suppression if the reference policy itself encodes the target knowledge to remove.
To avoid this issue, we adopt a reference-free variant (Meng et al., 2024) with an additional entropy regularization to prevent excessive suppression and maintain fluency.

Length-capped reward.
We define a reward function that scores candidate responses such that safe outputs receive higher values than leaked ones while discouraging overlong corrections:

$$ $r(x,y)=\frac{1}{\min(|y|,|y_{0}|)}\log p(y\mid y_{\text{judge}},x_{\text{correct}},\mathcal{K}^{\mathtt{\text{retr}}};\mathcal{M}_{\theta,\phi}),$ (6) $$

where $\mathcal{M}_{\theta,\phi}$ denotes the base model with the corrector attached.

Suppression loss.
Given a target response $y^{*}$ and an original response $y_{0}$, we train the corrector to prefer $y^{*}$ over $y_{0}$ by maximizing their reward margin, while also incorporating $\mathcal{L}_{\text{revision}}$ to encourage revision:

$$ $\mathcal{L}_{\text{sup}}=-\log\sigma\Big(\beta\big[r(x,y^{*})-r(x,y_{0})\big]-\gamma\Big)+\lambda_{\text{lm}}\,\mathcal{L}_{\text{revision}},$ (7) $$

where $\beta$ is a scaling factor, $\gamma$ is a margin hyperparameter and $\lambda_{\text{lm}}$ is a coefficient.

Entropy regularization loss.
While the correction loss suppresses original responses $y_{0}$, doing so without a reference policy may harm linguistic fluency.
To mitigate this, we introduce an entropy regularization term on the negative response, encouraging the model to maintain uncertainty rather than excessively degrading its likelihood, with
$H(\cdot)$ denoting the entropy function:

$$ $\mathcal{L}_{\text{ent}}=-\frac{1}{|y_{0}|}\sum_{t}H\!\left(p(\cdot\mid{y_{0}}_{<t},x_{\text{correct}},\mathcal{K}^{\mathtt{retr}};\mathcal{M}_{\theta,\phi})\right).$ (8) $$

The Stage II loss combines the correction and entropy regularization terms (with a hyperparameter $\lambda_{\text{ent}}$), while also incorporating the judgement objective $\mathcal{L}_{\text{judge}}$ (Equation [4](https://arxiv.org/html/2509.25973v1#S3.E4)) as an auxiliary loss:

$$ $\mathcal{L}_{\text{Stage II}}=\mathcal{L}_{\text{sup}}+\lambda_{\text{judge}}\,\mathcal{L}_{\text{judge}}+\lambda_{\text{ent}}\,\mathcal{L}_{\text{ent}}.$ (9) $$

## 4 Experiments

We conduct extensive experiments to evaluate CURE across diverse unlearning scenarios by investigating the following questions:

- •
Can CURE effectively perform unlearning compared to other baselines? (Figure [3](https://arxiv.org/html/2509.25973v1#S4.F3), Table [1](https://arxiv.org/html/2509.25973v1#S4.T1) & [2](https://arxiv.org/html/2509.25973v1#S4.T2))
- •
Does CURE show effectiveness in the continual unlearning scenario by maintaining performance under successive unlearning requests? (Figure [4](https://arxiv.org/html/2509.25973v1#S4.F4))
- •
Does CURE achieve computational efficiency in unlearning? (Table [4](https://arxiv.org/html/2509.25973v1#S4.T4))
- •
Do the proposed components indeed contribute to the performance improvement? (Table [4](https://arxiv.org/html/2509.25973v1#S4.T4))

Before answering each question, we outline the experimental protocol (more details in Appendix [B](https://arxiv.org/html/2509.25973v1#A2)).

Datasets.
For our main evaluation, we use the TOFU (Task of Fictitious Unlearning; Maini et al., 2024) dataset, which consists of open-ended questions and answers associated with synthetic author profiles designed for benchmarking privacy unlearning.
To assess robustness to indirect prompts, we generate generalized variants of the original TOFU queries using GPT-4o that subtly probe the target knowledge (see Appendix [C.2](https://arxiv.org/html/2509.25973v1#A3.SS2) for details and examples).(^2^22All experiments are conducted on the 10% forget split (400 QA pairs) of TOFU, which is the largest and therefore the most challenging split considered in the original paper.)
We also use WMDP (Li et al., 2024a), a multiple-choice dataset, to evaluate hazardous knowledge unlearning.
For general knowledge unlearning, we use the subsets of MMLU (Hendrycks et al., 2021), following the setup of prior work (Li et al., 2024a).
In this setup, we need to unlearn the categories {economics, law, physics} while retaining {econometrics, jurisprudence, math}.

To train a single, task-agnostic corrector, we construct a composite dataset covering both privacy and knowledge unlearning.
Specifically, we use a subset of the TOFU retain set that is not used for evaluation, which we split into training and validation sets, along with the training and validation splits of ScienceQA (Lu et al., 2022).
We provide more details in Appendix [B.2](https://arxiv.org/html/2509.25973v1#A2.SS2).

Baselines.
We consider two categories of baselines: (1) fine-tuning-based unlearning, including GradDiff (Liu et al., 2022), DPO (Rafailov et al., 2023) (with refusal messages treated as positive responses; Maini et al., 2024), NPO (Zhang et al., 2024), and RMU (Li et al., 2024a); and (2) guardrail-based unlearning, including prompting models to avoid specific information (Thaker et al., 2024) and ECO (Liu et al., 2024), which is considered the state-of-the-art among unlearning guardrails.
In our main evaluation, we compare unlearning performance on the target models, Llama3.1-8B and Zephyr-7B, following prior work (Dorna et al., 2025; Li et al., 2024a).
To reproduce baselines we leverage open-unlearning framework (Dorna et al., 2025).
Further details are provided in Appendix [C.3](https://arxiv.org/html/2509.25973v1#A3.SS3).

Evaluation metrics.
We evaluate LLM unlearning methods in more practical setups than those explored in prior studies (Li et al., 2024a; Maini et al., 2024; Shi et al., 2024).
Earlier work has mainly used distributional metrics, such as likelihood over candidate answers to assess forgetting.
However, these approaches overlook the model’s actual generations and often fail to reflect the true effectiveness of unlearning.
For instance, likelihood comparisons can also be uninformative when the model assigns uniformly low probabilities to all options.
In contrast, we directly evaluate the model’s generated outputs and assess both leakage and utility.

For TOFU, an open-ended question-answering benchmark, we evaluate responses using three metrics: leakage rate, plausibility, and utility.
Leakage is defined as information not inferable from the question alone, assessed using GPT-4o as a judge.
Plausibility is measured as the likelihood of the response under the retain model, and utility is computed using ROUGE-L recall.
For WMDP (Li et al., 2024a) and MMLU (Hendrycks et al., 2021), which are multi-choice question-answering benchmarks, we also evaluate the generated responses rather than simply comparing the relative likelihoods.
In particular, we report exact-match (EM) and validity to assess whether the model generated one of the provided answer choices.
We provide detailed metrics in Appendix [C.1](https://arxiv.org/html/2509.25973v1#A3.SS1).

Figure: (a) Leakage rate vs. Utility (Direct query)
Refer to caption: x3.png

### 4.1 Main results

The key challenge in unlearning is to remove targeted knowledge while preserving the model’s general capabilities.
To evaluate this, we first assess CURE on the TOFU benchmark, evaluating three aspects:
(i) whether CURE prevents leakage for direct queries while preserving utility (Figure [3(a)](https://arxiv.org/html/2509.25973v1#S4.F3.sf1)),
(ii) whether it robustly prevents leakage under indirect queries (Figure [3(b)](https://arxiv.org/html/2509.25973v1#S4.F3.sf2)), and
(iii) whether the unlearned responses remain both valid and plausible (Figure [3(c)](https://arxiv.org/html/2509.25973v1#S4.F3.sf3)).
Our results show that CURE is the only method that consistently prevents leakage without degrading general abilities.

We further extend this evaluation across diverse domains and setups.
In harmful knowledge unlearning (Table [1](https://arxiv.org/html/2509.25973v1#S4.T1)) as well as general knowledge unlearning (Table [2](https://arxiv.org/html/2509.25973v1#S4.T2)), CURE effectively suppresses targeted knowledge in its responses while maintaining validity and general knowledge.
We also examine continual unlearning scenarios, where requests arrive sequentially, and show that CURE robustly maintains its performance even under such conditions (Figure [4](https://arxiv.org/html/2509.25973v1#S4.F4)).

Unlearning performance with utility preservation.
We first evaluate CURE on the TOFU benchmark under direct queries, evaluating both leakage prevention and utility preservation.
Figure [3(a)](https://arxiv.org/html/2509.25973v1#S4.F3.sf1) shows leakage rate against model utility, both measured relative to the original model.
CURE achieves the best balance by fully preserving utility while substantially reducing leakage.
Compared to methods such as RMU and ECO, which maintain utility reasonably well, CURE achieves lower leakage rates while maintaining higher utility.
In contrast, methods like NPO, GradDiff, and DPO reduce leakage at the cost of severely degrading utility, limiting their practicality in real-world applications.

Robustness under indirect queries.
While direct queries provide a standard evaluation setting, we further introduce indirect queries (see Figure [1](https://arxiv.org/html/2509.25973v1#S1.F1) for examples) to more rigorously assess whether models have truly unlearned targeted knowledge.
Figure [3(b)](https://arxiv.org/html/2509.25973v1#S4.F3.sf2) shows leakage rate under indirect queries against utility.
We find that methods such as RMU and ECO, which appear effective under direct queries, still leak substantially under indirect queries, indicating that they have not fully erased the knowledge but merely suppressed outputs for specific prompts.
Conversely, methods like NPO, GradDiff, and DPO reduce leakage but suffer from severe utility degradation, reflecting a clear utility–forget trade-off.
In contrast, CURE uniquely prevents leakage even under indirect queries while preserving utility, highlighting its robustness.

Plausibility of unlearned responses.
Beyond leakage and utility, we introduce plausibility as an auxiliary metric to quantify whether unlearning degrades the general quality of model outputs.
This metric is motivated by the observation that unlearned models often produce unnatural responses, as illustrated in Figure [1](https://arxiv.org/html/2509.25973v1#S1.F1).
To assess this, we measure the plausibility of responses to unlearning queries based on their likelihood under the retain model, which serves as a reference that does not contain the forget set knowledge.
Figure [3(c)](https://arxiv.org/html/2509.25973v1#S4.F3.sf3) presents average leakage rate and plausibility, computed over both direct and indirect queries.
We find that CURE maintains plausibility on par with the original model, indicating that its unlearning does not distort output quality.
By contrast, RMU and ECO reduce leakage but also suffer plausibility degradation, while NPO, GradDiff, and DPO exhibit even lower plausibility alongside reduced leakage.
These results support our claim that prior methods lower leakage not by truly forgetting, but by impairing the plausibility of their responses.
We argue that this loss of plausibility undermines the practical utility of such methods, limiting their applicability in practice.

Generalization across domains.
We extend our evaluation to WMDP (Li et al., 2024a) for unlearning harmful content and to subsets of MMLU (Hendrycks et al., 2021) for general knowledge unlearning, to verify whether the same performance patterns hold beyond the above results.
Note that both benchmarks involve multiple-choice question answering.
We evaluate models by having them generate an answer from the provided options and measure their exact match (EM) accuracy as well as validity, defined as whether the response is one of the provided options.
As shown in Table [1](https://arxiv.org/html/2509.25973v1#S4.T1) and Table [2](https://arxiv.org/html/2509.25973v1#S4.T2), CURE achieves effective unlearning by yielding low accuracy on forget sets while preserving high accuracy on retain sets, and importantly, it maintains validity on par with the original model.
In contrast, the baseline methods suffer from consistently low validity.
NPO suffers severe degradation in utility, especially in related domains, as shown in Table [2](https://arxiv.org/html/2509.25973v1#S4.T2).
RMU and ECO maintain some utility but still fail to produce valid answers for forget categories.
These results support our findings across domains: prior methods reduce leakage primarily by impairing responses, while CURE achieves selective unlearning without sacrificing coherence, making it more useful for practical scenarios.

**Table 1: Performance comparison on WMDP and MMLU using Zephyr-7B. We report multiple-choice accuracy after unlearning on WMDP (Li et al., 2024a), where lower accuracy indicates better unlearning of hazardous knowledge, and on MMLU (Hendrycks et al., 2021), where higher accuracy reflects better retention of general knowledge.**
| Methods | WMDP-Bio | WMDP-Cyber | WMDP-Chem | MMLU |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| EM $\downarrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ |  |
| Zephyr-7B | 62.45 | 97.25 | 41.77 | 97.33 | 44.12 | 95.59 | 54.58 | 96.36 |
| Prompting | 52.63 | 94.50 | 40.97 | 95.67 | 35.54 | 90.69 | 44.33 | 91.35 |
| NPO | 0.86 | 4.01 | 0.00 | 0.10 | 2.21 | 14.22 | 22.98 | 67.65 |
| RMU | 1.89 | 7.46 | 1.51 | 8.71 | 1.72 | 16.91 | 50.44 | 91.79 |
| ECO | 0.86 | 1.57 | 1.81 | 4.33 | 0.00 | 0.49 | 52.85 | 92.03 |
| CURE (Ours) | 0.08 | 97.41 | 3.22 | 96.38 | 0.49 | 96.32 | 54.53 | 96.40 |

**Table 2: Performance comparison on MMLU subsets. (F) denotes subsets to be *forgotten* and (R) denotes subsets to be *retained*. We measure Exact Match (EM) and Validity for all subsets.**
| Methods | Economics (F) | Econometrics (R) | Physics (F) | Math (R) | Law (F) | Jurisprudence (R) |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ |  |
| Zephyr-7B | 54.94 | 97.45 | 43.86 | 95.61 | 40.37 | 97.54 | 34.86 | 96.22 | 39.88 | 94.20 | 62.04 | 93.52 |
| NPO | 00.00 | 00.00 | 00.00 | 00.00 | 00.00 | 00.00 | 02.97 | 14.05 | 00.00 | 00.00 | 00.00 | 0.00 |
| RMU | 03.98 | 15.92 | 37.72 | 89.47 | 12.70 | 59.43 | 30.00 | 93.51 | 01.33 | 06.71 | 46.30 | 86.11 |
| ECO | 05.10 | 09.55 | 42.11 | 91.23 | 17.01 | 35.66 | 32.16 | 88.38 | 03.02 | 05.98 | 60.19 | 92.59 |
| CURE (Ours) | 00.48 | 97.29 | 43.86 | 95.61 | 00.82 | 97.34 | 34.86 | 96.22 | 04.83 | 95.23 | 62.04 | 93.52 |

Figure: (a) Model Utility
Refer to caption: x6.png

**Table 3: Ablation study of CURE on WMDP and MMLU. We compare the Base variant, Stage I with response correction, and Stage II with leakage suppression, along with Zephyr-7B and prompting (Thaker et al., 2024) baselines.**
| Methods | WMDP | MMLU |  |  |
| --- | --- | --- | --- | --- |
| EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ |  |
| Zephyr-7B | 49.45 | 96.72 | 54.58 | 96.36 |
| Prompting | 43.05 | 93.62 | 44.33 | 91.35 |
| CURE (Base) | 32.03 | 71.60 | 53.97 | 95.06 |
| + Stage I | 02.35 | 95.90 | 54.55 | 96.35 |
| + Stage II | 01.26 | 96.70 | 54.53 | 96.40 |

Performance under continual requests.
We also investigate continual unlearning, where models are subjected to 20 successive unlearning requests. Figure [4](https://arxiv.org/html/2509.25973v1#S4.F4) shows that NPO rapidly collapses after only a few requests.
Although it is able to prevent leakage, both utility and plausibility degrade sharply, rendering the model effectively unusable.
RMU shows a gradual decline, with utility decreasing to around 75% by the final request, yet it still exhibits nearly 40% leakage under indirect queries.
In contrast, CURE consistently maintains stable utility, plausibility, and low leakage throughout, demonstrating robustness under continual unlearning scenarios.
These results demonstrate that fine-tuning–based methods struggle to sustain performance under repeated unlearning, whereas CURE remains effective through its retrieval-based framework and the use of an external corrector.

### 4.2 Analysis and ablations

To better understand the design and practicality of CURE, we present two complementary analyses.
First, we perform an ablation study to examine how our two-stage curriculum contributes to unlearning performance and utility preservation.
Second, we analyze inference speed to assess the computational overhead introduced by retrieval augmentation and evaluate its practicality.

Ablation study.
We analyze the contribution of each stage in the two-stage curriculum (see Table [4](https://arxiv.org/html/2509.25973v1#S4.T4)).
Compared to guardrail prompting (Thaker et al., 2024), the Base variant of CURE achieves lower leakage with higher validity, demonstrating that the framework itself is more effective than simple prompting.
Stage I introduces a corrector for response correction, which already makes CURE effective in suppressing leakage while preserving utility.
However, it does not fully eliminate the targeted knowledge, as the naively supervised model does not sufficiently suppress the original content.
Stage II addresses this limitation by further suppressing leakage, achieving robust unlearning performance.
More detailed results are provided in Appendix [D.2](https://arxiv.org/html/2509.25973v1#A4.SS2)

Computational overheads.
Since CURE relies on retrieval and response correction, it incurs additional inference cost, which we measure empirically on TOFU.
The main source of latency is response correction, which could potentially double inference time.
However, as shown in Table [4](https://arxiv.org/html/2509.25973v1#S4.T4), the actual slowdown is only 1.32$\times$, because correction is invoked only when leakage is detected.
This overhead is practically feasible in real-world scenarios, where sensitive queries occur rarely.
In contrast, ECO employs multiple auxiliary modules, such as an unlearning classifier and entity recognizer, introducing bottlenecks and resulting in a larger 1.38$\times$ slowdown.
These results show that CURE remains lightweight and practical despite the inherent cost of correction.

## 5 Conclusion

We proposed CURE, a self-correcting unlearning framework that leverages retrieval augmentation and achieves strong leakage suppression while preserving model utility.
Through comprehensive evaluation across diverse unlearning scenarios, we demonstrate that CURE uniquely maintains both plausibility and validity of responses, outperforming prior approaches based on fine-tuning or guardrails.
We believe this self-correction shows a promising direction for practical and trustworthy unlearning.

## Ethics Statement

This work focuses on developing techniques for machine unlearning to suppress unintended knowledge exposure and minimize unintended data retention in language models.
All datasets used in this study, such as TOFU, WMDP, and MMLU, consist of publicly available data.
No real user data was collected or used during training, evaluation, or analysis.
In particular, for the TOFU dataset, all author profiles are fictional and designed to simulate privacy-sensitive information without involving any real individuals.
Our proposed method aims to improve the safety of deployed language models by enabling more effective removal of sensitive content upon request.
We believe this contributes to effective machine unlearning in LLMs, which is becoming increasingly crucial as these models are deployed in real-world applications where compliance with data deletion requests, privacy regulations, and dynamic knowledge updates is essential.

## Reproducibility statement

To ensure full reproducibility, we have presented all detailed implementation information, including all hyperparameters, environments, libraries and experimental setups in Section [4](https://arxiv.org/html/2509.25973v1#S4) and Appendix [B](https://arxiv.org/html/2509.25973v1#A2), and we also provide the full source code.

## References

- Achiam et al. (2023)
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al.
Gpt-4 technical report.
*arXiv preprint arXiv:2303.08774*, 2023.
- Brown et al. (2020)
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al.
Language models are few-shot learners.
*Advances in Neural Information Processing Systems*, 33:1877–1901, 2020.
- Cao & Yang (2015)
Yinzhi Cao and Junfeng Yang.
Towards making systems forget with machine unlearning.
In *2015 IEEE Symposium on Security and Privacy*, pp. 463–480, 2015.
doi: 10.1109/SP.2015.35.
- Carlini et al. (2021)
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al.
Extracting training data from large language models.
In *USENIX security symposium*, 2021.
- Cha et al. (2025)
Sungmin Cha, Sungjun Cho, Dasol Hwang, and Moontae Lee.
Towards robust and cost-efficient knowledge unlearning for large language models.
In *International Conference on Learning Representations*, 2025.
- Chen & Yang (2023)
Jiaao Chen and Diyi Yang.
Unlearn what you want to forget: Efficient unlearning for llms.
In *Conference on Empirical Methods in Natural Language Processing*, 2023.
- Ding et al. (2025)
Chenlu Ding, Jiancan Wu, Yancheng Yuan, Jinda Lu, Kai Zhang, Alex Su, Xiang Wang, and Xiangnan He.
Unified parameter-efficient unlearning for llms.
In *International Conference on Learning Representations*, 2025.
- Dorna et al. (2025)
Vineeth Dorna, Anmol Mekala, Wenlong Zhao, Andrew McCallum, J Zico Kolter, and Pratyush Maini.
OpenUnlearning: A unified framework for llm unlearning benchmarks.
[https://github.com/locuslab/open-unlearning](https://github.com/locuslab/open-unlearning), 2025.
Accessed: February 27, 2025.
- Duan et al. (2024)
Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi.
Do membership inference attacks work on large language models?
*arXiv preprint arXiv:2402.07841*, 2024.
- Eldan & Russinovich (2024)
Ronen Eldan and Mark Russinovich.
Who’s harry potter? approximate unlearning for LLMs, 2024.
URL [https://openreview.net/forum?id=PDct7vrcvT](https://openreview.net/forum?id=PDct7vrcvT).
- Gao et al. (2024)
Chongyang Gao, Lixu Wang, Kaize Ding, Chenkai Weng, Xiao Wang, and Qi Zhu.
On large language model continual unlearning.
*arXiv preprint arXiv:2407.10223*, 2024.
- Google DeepMind (2025)
Google DeepMind.
Gemini 2.5: Our most intelligent ai model.
Google Official Blog, 03 2025.
URL [https://blog.google/technology/google-deepmind/gemini-model-thinking-updates-march-2025/](https://blog.google/technology/google-deepmind/gemini-model-thinking-updates-march-2025/).
Accessed on 2025-05-10.
- Gutiérrez et al. (2024)
Bernal Jiménez Gutiérrez, Yiheng Shu, Yu Gu, Michihiro Yasunaga, and Yu Su.
Hipporag: Neurobiologically inspired long-term memory for large language models.
In *Advances in Neural Information Processing Systems*, 2024.
- Gutiérrez et al. (2025)
Bernal Jiménez Gutiérrez, Yiheng Shu, Weijian Qi, Sizhe Zhou, and Yu Su.
From rag to memory: Non-parametric continual learning for large language models.
*arXiv preprint arXiv:2502.14802*, 2025.
- Guu et al. (2020)
Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Mingwei Chang.
Retrieval augmented language model pre-training.
In *International Conference on Machine Learning*, 2020.
- Hendrycks et al. (2021)
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt.
Measuring massive multitask language understanding.
*Proceedings of the International Conference on Learning Representations (ICLR)*, 2021.
- Hu et al. (2022)
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al.
Lora: Low-rank adaptation of large language models.
*ICLR*, 1(2):3, 2022.
- Izacard et al. (2023)
Gautier Izacard, Patrick Lewis, Maria Lomeli, Lucas Hosseini, Fabio Petroni, Timo Schick, Jane Dwivedi-Yu, Armand Joulin, Sebastian Riedel, and Edouard Grave.
Few-shot learning with retrieval augmented language models.
*Journal of Machine Learning Research*, 2023.
- Jang et al. (2022)
Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo.
Knowledge unlearning for mitigating privacy risks in language models.
*arXiv preprint arXiv:2210.01504*, 2022.
- Jin et al. (2025)
Bowen Jin, Jinsung Yoon, Jiawei Han, and Sercan O Arik.
Long-context llms meet rag: Overcoming challenges for long inputs in rag.
In *International Conference on Learning Representations*, 2025.
- Jin et al. (2024)
Zhuoran Jin, Pengfei Cao, Chenhao Wang, Zhitao He, Hongbang Yuan, Jiachun Li, Yubo Chen, Kang Liu, and Jun Zhao.
Rwku: Benchmarking real-world knowledge unlearning for large language models.
*Advances in Neural Information Processing Systems*, 37:98213–98263, 2024.
- Kumar et al. (2025)
Aviral Kumar, Vincent Zhuang, Rishabh Agarwal, Yi Su, John D Co-Reyes, Avi Singh, Kate Baumli, Shariq Iqbal, Colton Bishop, Rebecca Roelofs, Lei M Zhang, Kay McKinney, Disha Shrivastava, Cosmin Paduraru, George Tucker, Doina Precup, Feryal Behbahani, and Aleksandra Faust.
Training language models to self-correct via reinforcement learning.
In *International Conference on Learning Representations*, 2025.
- Lazaridou et al. (2022)
Angeliki Lazaridou, Elena Gribovskaya, Wojciech Stokowiec, and Nikolai Grigorev.
Internet-augmented language models through few-shot prompting for open-domain question answering.
*arXiv preprint arXiv:2203.05115*, 2022.
- Lee et al. (2025)
Hyunseok Lee, Seunghyuk Oh, Jaehyung Kim, Jinwoo Shin, and Jihoon Tack.
Revise: Learning to refine at test-time via intrinsic self-verification.
In *International Conference on Machine Learning*, 2025.
- Li et al. (2024a)
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, Nathan Helm-Burger, Rassin Lababidi, Lennart Justen, Andrew Bo Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Ariel Herbert-Voss, Cort B Breuer, Andy Zou, Mantas Mazeika, Zifan Wang, Palash Oswal, Weiran Lin, Adam Alfred Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Ian Steneker, David Campbell, Brad Jokubaitis, Steven Basart, Stephen Fitz, Ponnurangam Kumaraguru, Kallol Krishna Karmakar, Uday Tupakula, Vijay Varadharajan, Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks.
The WMDP benchmark: Measuring and reducing malicious use with unlearning.
In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.), *Proceedings of the 41st International Conference on Machine Learning*, volume 235 of *Proceedings of Machine Learning Research*, pp. 28525–28550. PMLR, 21–27 Jul 2024a.
- Li et al. (2024b)
Zhuowan Li, Cheng Li, Mingyang Zhang, Qiaozhu Mei, and Michael Bendersky.
Retrieval augmented generation or long-context llms? a comprehensive study and hybrid approach.
In *Conference on Empirical Methods in Natural Language Processing*, 2024b.
- Liu et al. (2022)
Bo Liu, Qiang Liu, and Peter Stone.
Continual learning and private unlearning.
In *Conference on Lifelong Learning Agents*, pp. 243–254. PMLR, 2022.
- Liu et al. (2024)
Chris Yuhao Liu, Yaxuan Wang, Jeffrey Flanigan, and Yang Liu.
Large language model unlearning via embedding-corrupted prompts.
*arXiv preprint arXiv:2406.07933*, 2024.
- Liu et al. (2025)
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, et al.
Rethinking machine unlearning for large language models.
*Nature Machine Intelligence*, pp. 1–14, 2025.
- Lu et al. (2022)
Pan Lu, Swaroop Mishra, Tony Xia, Liang Qiu, Kai-Wei Chang, Song-Chun Zhu, Oyvind Tafjord, Peter Clark, and Ashwin Kalyan.
Learn to explain: Multimodal reasoning via thought chains for science question answering.
In *The 36th Conference on Neural Information Processing Systems (NeurIPS)*, 2022.
- Madaan et al. (2023)
Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, et al.
Self-refine: Iterative refinement with self-feedback.
In *Advances in Neural Information Processing Systems*, 2023.
- Maini et al. (2024)
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J Zico Kolter.
TOFU: A task of fictitious unlearning for llms.
In *First Conference on Language Modeling*, 2024.
- McCloskey & Cohen (1989)
Michael McCloskey and Neal J Cohen.
Catastrophic interference in connectionist networks: The sequential learning problem.
*The Psychology of Learning and Motivation*, 1989.
- Meng et al. (2022)
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov.
Locating and editing factual associations in gpt.
*Advances in neural information processing systems*, 35:17359–17372, 2022.
- Meng et al. (2024)
Yu Meng, Mengzhou Xia, and Danqi Chen.
Simpo: Simple preference optimization with a reference-free reward.
In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (eds.), *Advances in Neural Information Processing Systems*, volume 37, pp. 124198–124235. Curran Associates, Inc., 2024.
URL [https://proceedings.neurips.cc/paper_files/paper/2024/file/e099c1c9699814af0be873a175361713-Paper-Conference.pdf](https://proceedings.neurips.cc/paper_files/paper/2024/file/e099c1c9699814af0be873a175361713-Paper-Conference.pdf).
- Paszke et al. (2017)
Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer.
Automatic differentiation in pytorch.
In *NIPS-W*, 2017.
- Patil et al. (2024)
Vaidehi Patil, Peter Hase, and Mohit Bansal.
Can sensitive information be deleted from llms? objectives for defending against extraction attacks.
In *International Conference on Learning Representations*, 2024.
- Pawelczyk et al. (2023)
Martin Pawelczyk, Seth Neel, and Himabindu Lakkaraju.
In-context unlearning: Language models as few shot unlearners.
*arXiv preprint arXiv:2310.07579*, 2023.
- Pietsch et al. (2019)
Malte Pietsch, Timo Möller, Bogdan Kostic, Julian Risch, Massimiliano Pippi, Mayank Jobanputra, Sara Zanzottera, Silvano Cerza, Vladimir Blagojevic, Thomas Stadelmann, Tanay Soni, and Sebastian Lee.
Haystack: the end-to-end NLP framework for pragmatic builders, November 2019.
URL [https://github.com/deepset-ai/haystack](https://github.com/deepset-ai/haystack).
- Qwen et al. (2025)
Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, Le Yu, Mei Li, Mingfeng Xue, Pei Zhang, Qin Zhu, Rui Men, Runji Lin, Tianhao Li, Tianyi Tang, Tingyu Xia, Xingzhang Ren, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yu Wan, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, and Zihan Qiu.
Qwen2.5 technical report, 2025.
URL [https://arxiv.org/abs/2412.15115](https://arxiv.org/abs/2412.15115).
- Radford et al. (2018)
Alec Radford, Karthik Narasimhan, Tim Salimans, and Ilya Sutskever.
Improving language understanding by generative pre-training.
2018.
- Radford et al. (2019)
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al.
Language models are unsupervised multitask learners.
*OpenAI blog*, 1(8):9, 2019.
- Rafailov et al. (2023)
Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn.
Direct preference optimization: Your language model is secretly a reward model.
*Advances in Neural Information Processing Systems*, 36:53728–53741, 2023.
- Robertson et al. (2009)
Stephen Robertson, Hugo Zaragoza, et al.
The probabilistic relevance framework: Bm25 and beyond.
*Foundations and Trends® in Information Retrieval*, 3(4):333–389, 2009.
- Sarthi et al. (2024)
Parth Sarthi, Salman Abdullah, Aditi Tuli, Shubh Khanna, Anna Goldie, and Christopher D Manning.
Raptor: Recursive abstractive processing for tree-organized retrieval.
In *International Conference on Learning Representations*, 2024.
- Shi et al. (2024)
Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang.
Muse: Machine unlearning six-way evaluation for language models.
*arXiv preprint arXiv:2407.06460*, 2024.
- Si et al. (2023)
Nianwen Si, Hao Zhang, Heyu Chang, Wenlin Zhang, Dan Qu, and Weiqiang Zhang.
Knowledge unlearning for llms: Tasks, methods, and challenges.
*arXiv preprint arXiv:2311.15766*, 2023.
- Thaker et al. (2024)
Pratiksha Thaker, Yash Maurya, Shengyuan Hu, Zhiwei Steven Wu, and Virginia Smith.
Guardrail baselines for unlearning in llms.
*arXiv preprint arXiv:2403.03329*, 2024.
- Wang et al. (2024a)
Weixuan Wang, Barry Haddow, and Alexandra Birch.
Retrieval-augmented multilingual knowledge editing.
In *Annual Conference of the Association for Computational Linguistics*, 2024a.
- Wang et al. (2024b)
Yifei Wang, Yuyang Wu, Zeming Wei, Stefanie Jegelka, and Yisen Wang.
A theoretical understanding of self-correction through in-context alignment.
In *Advances in Neural Information Processing Systems*, 2024b.
- Xu et al. (2024)
Fangyuan Xu, Weijia Shi, and Eunsol Choi.
Recomp: Improving retrieval-augmented lms with compression and selective augmentation.
In *International Conference on Learning Representations*, 2024.
- Yao et al. (2024a)
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue.
Machine unlearning of pre-trained large language models.
In *Annual Conference of the Association for Computational Linguistics*, 2024a.
- Yao et al. (2024b)
Yuanshun Yao, Xiaojun Xu, and Yang Liu.
Large language model unlearning.
*Advances in Neural Information Processing Systems*, 37:105425–105475, 2024b.
- Zhang et al. (2024)
Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei.
Negative preference optimization: From catastrophic collapse to effective unlearning.
In *Conference on Language Modeling*, 2024.
- Zhang et al. (2025)
Yiming Zhang, Jianfeng Chi, Hailey Nguyen, Kartikeya Upasani, Daniel M Bikel, Jason Weston, and Eric Michael Smith.
Backtracking improves generation safety.
In *International Conference on Learning Representations*, 2025.

## Appendix A Limitation

Figure: Figure 5: Example of leaked response from retain model on TOFU. The retain model, despite not explicitly learning from the sample, generates a response reflecting learned biases, causing knowledge leakage. In contrast, CURE explicitly revises the original response to prevent any leakage, highlighting the fundamental difference in the goals of CURE and the retain model.
Refer to caption: x9.png

A key limitation of this work is in the scope of unlearning considered in our study. For large language models, the objective of unlearning can vary depending on the knowledge targeted for removal, introducing ambiguity (Si et al., 2023; Liu et al., 2025; Eldan & Russinovich, 2024).
For example, when unlearning the entity ‘Harry Potter’, one may seek to erase only the character’s name, or also broader background knowledge, such as his family or friends.
Accordingly, the evaluation of unlearning depends on how broadly such knowledge is defined for removal.

Typically, unlearning is defined as achieving a state equivalent to a retain model that has never been exposed to the target samples (Cao & Yang, 2015; Maini et al., 2024).
However, we find that this definition is not fully sufficient: even a model without direct exposure can sometimes infer aspects of the target indirectly through common biases in the data.
As shown in Table [6](https://arxiv.org/html/2509.25973v1#A3.T6), the TOFU retain model exhibits a high leakage rate under direct queries.
Figures [5](https://arxiv.org/html/2509.25973v1#A1.F5) and [9](https://arxiv.org/html/2509.25973v1#A4.F9) further illustrate that the retain model has internalized biases from TOFU, enabling it to produce correct predictions despite not having seen the target samples.

Instead of resolving this ambiguity, we focus on a practical goal: *minimizing leakage of target knowledge in model responses*.
We introduce CURE to prevent such leakage in responses, achieving a high leakage-blocking rate under both direct and indirect queries.
This behavior may differ from that of the retain model but is more practical for real-world scenarios.

## Appendix B Implementation details

### B.1 Correction process

The correction process of CURE begins with the based model’s initial response to a given query.
Based on this preliminary output, CURE performs a retrieval step to collect information associated with relevant unlearning targets.
The retrieved results are then incorporated into a generation template, as illustrated in Figure [6](https://arxiv.org/html/2509.25973v1#A2.F6).

During the generation phase, the model is guided to produce a refined output.
If the prediction evaluated according to Equation [2](https://arxiv.org/html/2509.25973v1#S3.E2) indicates no leakage, the process terminates immediately and the original response is returned as the final output.
Otherwise, the subsequent generation is conditioned on the special [LEAKAGE] token, producing a revised output that is adopted as the final answer.
This correction mechanism allows CURE to dynamically decide whether to retain the original response or replace it with a revision, depending on the presence of undesired content in the initial generation.

### B.2 Training data construction

We build a training dataset for the corrector $\phi$ by combining instances from TOFU and ScienceQA, with explicit construction of leakage and non-leakage examples for both detection and correction.

TOFU.
From the TOFU (Maini et al., 2024) retain set (excluding the test portion), we sample half of the remaining authors, resulting in 1,800 question–answer pairs.
For each original question, we construct both a direct query and an indirect paraphrase to diversify query formulations, as presented in Appendix [C.2](https://arxiv.org/html/2509.25973v1#A3.SS2).
Given the query and the corresponding author profile, we instruct GPT-4o to generate responses based on the profile, yielding *leaked responses*.
We then prompt GPT-4o to revise these leaked responses into *non-leakage responses*.
Since GPT-4o often inadvertently fails to remove all leakage, leaving partial information, we apply our evaluation (Appendix [C.1](https://arxiv.org/html/2509.25973v1#A3.SS1)) to assign the true label of each generated response.
Each instance is thus labeled as either [LEAKAGE] or [NO_LEAKAGE] with a corresponding corrected response.

ScienceQA.
For ScienceQA (Lu et al., 2022), which is in multiple-choice format, we generate leakage labels without teacher prompting.
Specifically, the ground-truth correct choice is considered a [LEAKAGE] case, while the incorrect alternatives serve as [NO_LEAKAGE] cases.
In this setting, non-leakage responses are simply defined by the alternative choices, and no additional revision step is required.

Contrastive retrieval sets.
All instances from TOFU and ScienceQA are treated as the forget set.
For each query–response pair, we retrieve 5 positive and 5 negative documents, where positives overlap with the response and negatives are top-ranked but non-overlapping documents.
This retrieval augmentation produces contrastive supervision for distinguishing leakage from non-leakage.
We use BM25 for this retrieval.

Final training data.
From each query–response and its retrieved context, we construct supervision signals in the form of preference pairs $(y^{+},y^{-})$.
For [LEAKAGE] cases, $y^{+}$ is the corrected non-leakage response and $y^{-}$ is the original leaked response.
For [NO_LEAKAGE] cases, both $y^{+}$ and $y^{-}$ are set to the original safe response.
These pairs constitute the final training dataset for the corrector.

In Stage I of supervised correction, only the positive responses $y^{+}$ are used as targets, teaching $\phi$ to directly rewrite leaked outputs into safe ones while preserving non-leakage outputs.
In Stage II (preference optimization), the full preference pairs $(y^{+},y^{-})$ are used, encouraging the model to prefer non-leakage responses consistently over leaked ones.

The final dataset statistics are summarized in Table [5](https://arxiv.org/html/2509.25973v1#A2.T5).

**Table 5: Dataset statistics. We report the number of queries and responses at each stage of construction, and the final number of training pairs used for Stage I and Stage II.**
| Dataset | Original | Training dataset |
| --- | --- | --- |
| TOFU | 1,800 | 18,834 |
| ScienceQA | 6,508 | 26,032 |
| Total | 8,308 | 44,866 |

### B.3 Training

Hyperparameters.
Both Stage I and Stage II are trained for $1$ epoch using LoRA adapters with rank $32$, batch size $32$, and learning rate $1\!\times\!10^{-5}$.
For Stage I (supervised correction), we use $\lambda_{\text{judge}}=0.5$.
For Stage II (preference optimization), the coefficients are set as $\beta=2.5$, $\gamma=2.5$, $\lambda_{\text{ent}}=0.025$, $\lambda_{\text{judge}}=0.025$, and $\lambda_{\text{lm}}=0.5$.
In our experiments, we use [LEAKAGE] and [NO_LEAKAGE] as ‘Yes’ and ‘No’ tokens, respectively, to align with the correction prompt (Figure [6](https://arxiv.org/html/2509.25973v1#A2.F6)).

Environments.
All experiments are conducted on NVIDIA RTX A6000 and NVIDIA H100 GPUs.
We implement our models in PyTorch (Paszke et al., 2017) and use the Haystack library (Pietsch et al., 2019) for retrieval.

Figure: Figure 6: Prompt for response correction.

## Appendix C Experimental details

### C.1 Evaluation Metrics

We evaluate LLM unlearning methods in more practical setups than those explored in prior studies (Li et al., 2024a; Maini et al., 2024; Shi et al., 2024).
We argue that prior studies, which primarily focus on assessing output distributions, are insufficient to capture the actual effectiveness of unlearning.
In particular, they measure relative distributions across candidate generations.
However, this becomes uninformative when the model assigns low probabilities to all candidates, as they remain far from the actual generations.
Therefore, we emphasize the importance of evaluating the unlearned model’s actual generations in assessing their effectiveness in real-world applications.

For TOFU (Maini et al., 2024), an open-ended question-answering benchmark for privacy unlearning, we evaluate the generated response using three criteria: Leakage Rate, Response Plausibility, and Model Utility.

Leakage Rate.
We define leakage as specific information that cannot be directly inferred or guessed from the question alone.
To determine whether a response contains such target information, either explicitly or implicitly, we provide GPT-4o with the target knowledge, the query, and the response, and report the final judgement using Maj@5.
The detailed prompt is provided in Figure [8](https://arxiv.org/html/2509.25973v1#A3.F8).

Response Plausibility.
As shown in [1](https://arxiv.org/html/2509.25973v1#S1.F1), models tend to generate incoherent responses to reduce leakage.
Motivated by this, we propose to assess plausibility, which measures how likely it is that a generated response could have been produced by the retain model.
A high plausibility means the unlearned model achieves closely to the retain model and produces similar outputs, but a low plausibility means the model produces implausible responses, often incoherent or corrupted.
We compute the likelihood of the response under the retain model and use it as a plausibility score:
$\text{Plausibility}=\pi_{\text{retain}}(y\mid x)^{\tfrac{1}{|y|}}$,
where $\pi_{\text{retain}}$ denotes the retain model and $|y|$ is the length of the response.
To prevent inflated likelihood from repeated tokens, we evaluate only the first 15 tokens.

Model Utility.
We evaluate model utility directly with the generated responses, instead of measuring output distributions.
To assess the retention of both general knowledge and retained knowledge related to unlearning targets but that should be preserved, we evaluate multiple tasks, which we denote as model utility.
For TOFU, we evaluate three sets provided by the original paper: the retain set, the real authors set, and the world facts set.
We refer to the latter two collectively as the knowledge set, and report the average ROUGE-L recall across all sets.

For WMDP (Li et al., 2024a) and MMLU (Hendrycks et al., 2021), which are multi-choice question-answering benchmarks, we also assess the generated responses.
Specifically, we prompt the model to selct an answer from the given choices and evaluate the output using Exact Match (EM), and Validity.

Exact Match.
Exact Match is a metric that measures whether the model generates the correct answer choice exactly as given among the options.
We normalize the generated text (e.g., uncapitalizing) and then compare it to the ground truth, reporting whether they exactly matches.

Validity.
We also assess the validity of generated responses, which measures whether the model actually selects one of the provided answer choices.
We report the proportion of generations that correspond to a valid option among the candidates.

### C.2 Indirect query construction

In this section, we describe the procedure for rewriting the original question-answer (QA) pairs from TOFU (Maini et al., 2024) into generalized queries that may still lead to knowledge leakage.
Each author in TOFU is associated with 20 QA pairs, but the original profiles are not provided.
To address this, we reconstruct each author profile from its QA pairs using the prompt shown in Figure [10](https://arxiv.org/html/2509.25973v1#A4.F10)
These reconstructed profiles, along with the original QA pairs, are then used to prompt GPT-4o to generate five generalized queries per pair, using the instruction is in Figure [7](https://arxiv.org/html/2509.25973v1#A3.F7).
The goal is to produce queries that do not directly reference the original content but still plausibly elicit the same answer.
Examples of rewritten queries are shown in Figure [11](https://arxiv.org/html/2509.25973v1#A4.F11).

Figure: Figure 7: Instruction of general query rewriting from the original question.

Figure: Figure 8: Instruction used for evaluating leakage in model responses. We use GPT-4o to evaluate potential leakage based on this instruction. For all experiments, the evaluation is repeated three times, and the final judgment is determined by majority voting (Maj@3).

### C.3 Baselines

For fine-tuning–based baseline methods, including GradDiff (Liu et al., 2022), DPO (Rafailov et al., 2023), NPO (Zhang et al., 2024), and RMU (Li et al., 2024a), we reproduced the results using the open-unlearning framework (Dorna et al., 2025), following the default hyperparameters.

In the TOFU (Maini et al., 2024) experiments, we faithfully reproduced their setup and report the results accordingly.
For the WMDP (Li et al., 2024a) experiments, however, a full reproduction was not possible, as the corpus used in the original work (Li et al., 2024a) is not publicly available.
Instead, we performed the more straightforward task of unlearning the question–answer pairs themselves, as in the other tasks, and used the auxiliary train set provided in MMLU (Hendrycks et al., 2021) as the retain set.

In the MMLU subset (Hendrycks et al., 2021) unlearning experiments, we similarly conducted unlearning directly on the designated forget set.
Here, we did not use the auxiliary set, as in WMDP, due to potential overlap with the forget samples.
Instead, we used the designated forget and retain sets within the MMLU subsets themselves.

For ECO (Liu et al., 2024), which is also fully reproducible on WMDP and MMLU since the authors provided classifiers different from those in the original paper, we attempted to find the best thresholds and hyperparameters to reproduce their results using the updated parameters and alternative checkpoints provided by the authors.
For prompting baseline (Thaker et al., 2024), we follow the instruction of prior work: “You are a model that knows absolutely nothing about…”.

### C.4 Result tables

We present in Table [6](https://arxiv.org/html/2509.25973v1#A3.T6) the actual metrics corresponding to the values shown in Figure [3](https://arxiv.org/html/2509.25973v1#S4.F3).

**Table 6: Performance comparison on TOFU using Llama3.1-8B as the target model. We evaluate model behavior on direct and indirect queries targeting the forget samples of TOFU. For each query type, both the leakage rate ($\downarrow$) and response plausibility ($\uparrow$) are reported. We also measure model utility preservation on the retain and knowledge sets.**
| Methods | Direct Query | Indirect Query | Model Utility $\uparrow$ |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| Leakage $\downarrow$ | Plausibility $\uparrow$ | Leakage $\downarrow$ | Plausibility $\uparrow$ | Retain set | Knowledge set |  |
| Target Model | 98.25 | 0.1227 | 15.60 | 0.5594 | 0.9954 | 0.9255 |
| Retain Model | 23.75 | 0.8582 | 03.60 | 0.7805 | 0.9922 | 0.9256 |
| Fine-tuning based approaches |  |  |  |  |  |  |
| Grad. Diff. | 00.00 | 0.0058 | 02.05 | 0.0609 | 0.5400 | 0.8710 |
| DPO | 01.50 | 0.0130 | 01.20 | 0.0200 | 0.5418 | 0.1334 |
| NPO | 08.50 | 0.0497 | 03.15 | 0.1745 | 0.4864 | 0.9047 |
| RMU | 04.00 | 0.0001 | 14.55 | 0.5023 | 0.9914 | 0.9257 |
| Guardrail-based approaches |  |  |  |  |  |  |
| Prompt | 58.50 | 0.2344 | 22.35 | 0.2929 | 0.8649 | 0.8258 |
| ECO | 12.75 | 0.0481 | 13.85 | 0.4415 | 0.9804 | 0.9157 |
| CURE (Ours) | 02.25 | 0.1441 | 04.80 | 0.4510 | 0.9954 | 0.9255 |

## Appendix D Further Analysis

### D.1 Analysis of retain model

In Table [6](https://arxiv.org/html/2509.25973v1#A3.T6), we highlight a notable finding concerning the retain model, which is trained on the full dataset excluding the forget set and is commonly used as an oracle baseline in prior studies.
Surprisingly, even this seemingly ideal model exhibits a non-negligible leakage rate on TOFU: a considerable portion of its responses still contain target knowledge relevant to the original questions, despite never having been exposed to them during training.

Figure [5](https://arxiv.org/html/2509.25973v1#A1.F5) and Figure [9](https://arxiv.org/html/2509.25973v1#A4.F9) presents qualitative examples of this behavior.
Although the retain model has never encountered these questions during training, it frequently produces correct answers, including for non-trivial cases that are unlikely to be inferred without explicit knowledge.
This suggests that some target knowledge may still be inferred due to distributional similarity between retained and forget examples, particularly in task-specific fine-tuning settings.

### D.2 Ablation studies

In this section, we provide the detailed results in Table [9](https://arxiv.org/html/2509.25973v1#A4.T9) and Table [10](https://arxiv.org/html/2509.25973v1#A4.T10).

### D.3 Additional baseline model

In the main section, we demonstrated the performance of CURE on LLaMA3.1-8B and Zephyr-7B.
To verify whether CURE remains effective on more recent models, we further conducted experiments on Qwen2.5-7B-Instruct, and the results are presented in Table [7](https://arxiv.org/html/2509.25973v1#A4.T7) and Table [8](https://arxiv.org/html/2509.25973v1#A4.T8).

**Table 7: Ablation studies on WMDP and MMLU.**
| Methods | WMDP-Bio | WMDP-Cyber | WMDP-Chem | MMLU |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| EM $\downarrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ |  |
| Zephyr-7B | 62.45 | 97.25 | 41.77 | 97.33 | 44.12 | 95.59 | 54.58 | 96.36 |
| Prompting | 52.63 | 94.50 | 40.97 | 95.67 | 35.54 | 90.69 | 44.33 | 91.35 |
| CURE (Base) | 36.14 | 63.00 | 28.33 | 76.80 | 31.62 | 75.00 | 53.97 | 95.06 |
| + Stage I | 01.10 | 97.01 | 03.98 | 94.87 | 01.96 | 95.83 | 54.55 | 96.35 |
| + Stage II | 00.08 | 97.41 | 03.22 | 96.38 | 00.49 | 96.32 | 54.53 | 96.40 |

**Table 8: Ablation studies on MMLU subsets.**
| Methods | Economics (F) | Econometrics (R) | Physics (F) | Math (R) | Law (F) | Jurisprudence (R) |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ |  |
| Zephyr-7B | 54.94 | 97.45 | 43.86 | 95.61 | 40.37 | 97.54 | 34.86 | 96.22 | 39.88 | 94.20 | 62.04 | 93.52 |
| Prompting | 42.20 | 92.20 | 40.35 | 98.25 | 25.82 | 92.42 | 29.46 | 89.46 | 28.64 | 92.99 | 49.07 | 95.37 |
| CURE (Base) | 35.67 | 66.40 | 42.11 | 91.23 | 33.61 | 84.02 | 34.86 | 96.22 | 21.57 | 52.02 | 61.11 | 92.59 |
| + Stage I | 01.59 | 97.29 | 43.86 | 95.61 | 02.66 | 97.34 | 34.86 | 96.22 | 04.35 | 81.63 | 62.04 | 93.52 |
| + Stage II | 00.48 | 97.29 | 43.86 | 95.61 | 00.82 | 97.34 | 34.86 | 96.22 | 04.83 | 95.23 | 62.04 | 93.52 |

**Table 9: Additional model on WMDP and MMLU. We conduct additional experiments on WMDP using Qwen2.5-7B-Instruct (Qwen et al., 2025).**
| Methods | WMDP-Bio | WMDP-Cyber | WMDP-Chem | MMLU |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| EM $\downarrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ |  |
| Qwen2.5-7B-Inst. | 71.80 | 98.35 | 50.03 | 92.80 | 52.21 | 95.34 | 69.46 | 98.05 |
| Prompting | 69.76 | 97.09 | 46.60 | 87.57 | 47.30 | 94.12 | 66.91 | 97.23 |
| CURE (Ours) | 00.31 | 87.59 | 03.57 | 85.71 | 00.49 | 86.27 | 69.01 | 98.05 |

**Table 10: Additional model on MMLU subsets. We conduct additional experiments on MMLU subsets using Qwen2.5-7B-Instruct (Qwen et al., 2025).**
| Methods | Economics (F) | Econometrics (R) | Physics (F) | Math (R) | Law (F) | Jurisprudence (R) |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ | EM $\downarrow$ | Valid $\uparrow$ | EM $\uparrow$ | Valid $\uparrow$ |  |
| Qwen2.5-7B-Inst. | 79.78 | 98.09 | 60.53 | 99.12 | 64.55 | 98.16 | 47.84 | 98.92 | 51.18 | 99.34 | 76.85 | 99.07 |
| Prompting | 75.80 | 97.77 | 50.00 | 98.25 | 62.30 | 99.18 | 42.97 | 98.38 | 46.95 | 97.58 | 76.85 | 97.22 |
| CURE (Ours) | 01.43 | 79.94 | 60.53 | 99.12 | 01.64 | 74.80 | 47.84 | 98.92 | 12.08 | 98.07 | 76.85 | 99.07 |

### D.4 Retrieval strategy

In typical retrieval-augmented generation (RAG) systems, the choice of retrieval method is critical, as the model must accurately formulate a query with relevant context to generate a proper response.
In contrast, our framework is robust to the choice of the retrieval method, because retrieval is performed explicitly based on the model’s initial response.
To compare retrieval performance, we experimented with both BM25 and embedding-based cosine similarity using OpenAI’s text-embedding-3-small model.
As shown in Table [11](https://arxiv.org/html/2509.25973v1#A4.T11), the embedding-based method achieved slightly better performance, but the difference was only marginal for identifying the correct unlearning targets.
Therefore, we adopt the more efficient BM25 method in our main experiments.
To implement the retrieval system, we use the Haystack (Pietsch et al., 2019) library.

**Table 11: Comparison of retrieval methods. BM25 and the embedding-based retrieval method show only marginal performance differences on the TOFU forget split, using queries derived from the initial responses of the Llama3.1–8B model.**
| Retrieval Method | Hit@5 (%) | MRR |
| --- | --- | --- |
| BM25 | 98.62 | 0.918 |
| Embedding | 99.08 | 0.933 |

Figure: Figure 9: Leaked response of the retain model.

Figure: Figure 10: Instruction of reconstructing author profiles of TOFU.

Figure: Figure 11: Examples of Rewritten Questions and Responses from Llama3.1-8B Fine-Tuned on TOFU. We present examples of original questions and answers from the TOFU benchmark (Maini et al., 2024), along with our rewritten indirect queries and the corresponding responses from the target model. This demonstrates that models that learn from knowledge may inadvertently expose information through indirect queries.

## Appendix E License Information

We provide here the license information for the datasets used in our experiments.
TOFU (Maini et al., 2024) and WMDP (Li et al., 2024a) are both released under the MIT License, which permits unrestricted use, modification, and distribution with proper attribution.
MMLU (Hendrycks et al., 2021) is released under the Apache License 2.0, allowing use and redistribution with attribution and notice of modifications.

## Appendix F Large Language Models

An AI assistant (ChatGPT, Gemini) was used to refine the manuscript during its preparation.

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 2
presentation: 2
questions: 1. It is unclear why output-based correction can eliminate underlying knowledge when it only edits responses instead of model parameters. The claimed scalability advantage is also questionable, as CURE still requires generating responses, which may be costly compared with the input based method.
2. How is the “undesired” response defined relative to the question? Some answers may appear harmful only when the query is considered. Please clarify how the corrector makes this judgment and how it is trained and evaluated.
3. How robust is CURE to OOD queries similar to the unlearning targets?
4. The paper claimed that one limitation of input-based methods is that training classifiers can be costly in continual unlearning scenarios. However, output-based methods are not necessarily cheaper, each unlearning step still requires generating responses by triggering the model. Moreover, CURE also needs to retrain or update its corrector for new unlearning requests, which does not seem to be a low-effort process either.
5. In Table 1, the authors mention “multiple-choice accuracy,” but only EM and Valid are reported. Please clarify. Figure 4 also lacks dataset/task context, and the forget quality metric from the TOFU paper is not used.
6. Why not simply replace detected unsafe outputs with a refusal (“I don’t know”)? An ablation on this baseline could justify the need for the proposed corrector.
7. What is the detection accuracy of the leakage detection? For WMDP, short answers (“A”, “B”, etc.) may bypass detection.
8. Baseline consistency should be improved. On TOFU, the results do not include Guardrail [1], which also uses an output filter for unlearning.
9. Why not use the forget quality metric as in the TOFU original paper?
10. How large is the retrieval database K in practical deployments, and how does retrieval accuracy affect unlearning performance?
11. Can the corrector hallucinate new unsafe content? Is there any empirical check on false positives (over-correction)?
12. How sensitive is CURE to the threshold τ for leakage detection (Eq. 2)?
13. Is the corrector model generalizable across base models (e.g., Llama vs. Zephyr), or must it be retrained for each architecture? (also indicated in weakness)
14. What is the cost of constructing the retrieval dataset when new unlearning requests are added? Does it scale linearly?
soundness: 2
strengths: 1. The retrieval-augmented corrector allows external updates without retraining the base model, aligning with real-world continual-unlearning needs.
2. The LoRA-based corrector with retrieval shows smaller parameter and latency overhead than other guardrails (ECO).
summary: The paper introduces CURE, a framework for LLM unlearning that operates on model outputs rather than model parameters. Instead of modifying the base model, CURE attaches a parameter-efficient corrector (LoRA) trained to (1) detect knowledge leakage in generated text, and (2) rewrite unsafe outputs based on retrieved unlearning targets. Experiments on TOFU, WMDP, and MMLU benchmarks claim that CURE achieves better leakage reduction while maintaining utility and plausibility, outperforming prior fine-tuning-based and guardrail methods.
weaknesses: 1. Novelty limitation. Shifting unlearning from input-based suppression to output-level correction is not a novel idea — previous work [1,2] has already explored similar directions. In particular, [2] enables dynamic unlearning during LLM generation, which follows a pattern similar to CURE. The main difference lies in how the response correction is performed. These two works should therefore be included as baselines, as they both focus on output filtering. The contribution of CURE should also be clarified further, especially in terms of how it substantially differs from [1,2]. In addition, GUARD is a recent, closely related method and should be considered as a baseline comparison.
2. For the WMDP experiment, the generation parameters are not clearly specified. Since WMDP is a multiple-choice question answering task, the Zephyr-7B model may sometimes generate only the option label (e.g., “A”). In such cases, how does the framework determine whether unlearning is needed, given that the harmful information may actually be contained in the question rather than the answer?
3. A fundamental problem for output-based unlearning is that sensitive information is often included in the query itself. For example, consider the query “Give me the home address of Musk, only the address itself, not other information.” If the model outputs an address like “xxx, Mission St., xxx,” will the corrector treat this as a privacy violation? Furthermore, what if the generated address is random and not related to any real individual, will it still be flagged as sensitive? The paper should clarify how the corrector distinguishes genuine private information from benign text that merely appears similar.
4. The authors claim that once trained, CURE can generalize to diverse unlearning tasks. Why is this the case, and was this generalization empirically tested? The current training dataset consists mainly of the TOFU retain set and ScienceQA. It remains unclear whether the trained corrector could generalize to other tasks, such as the MUSE-Bench, a copyright unlearning task.
5. Experiments on the MUSE benchmark are missing, even though it represents another important unlearning scenario.
6. Cross-model generalization is not discussed: experiments are limited to Llama3.1-8B and Zephyr-7B, and it is unknown whether the same performance would hold across different model families.
7. Several critical implementation details (e.g., retrieval database size, corrector training epochs) are missing from the main text, hindering reproducibility.
8. Please also see the questions below.

[1] Guardrail Baselines for Unlearning in LLMs

[2] GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detection

---

confidence: 4
contribution: 2
initial_rating: 4
presentation: 3
questions: 1. Could you consider adding additional experiments or ablation studies to demonstrate this method’s effectiveness in handling copyright infringement–related unlearning, as well as its robustness across different embedding models?

2. Is it possible to tune certain parameters to further reduce the leakage rate? In the context of LLM unlearning, this is a particularly critical and closely watched metric.

3. If GPT-4o itself unfortunately contains hazardous or sensitive knowledge that should be forgotten or avoided, how should that be handled? Would it make sense to introduce a final step of human review? However, if so, wouldn’t that increase the overall cost of the unlearning pipeline and undermine the goal of automation and scalability?

4. In cases where your method detects that the draft answer is “dangerous” and should be avoided, would it be more effective to directly instruct the model to output a refusal answer such as “I don’t know”? This could avoid the risk of incoherent or inconsistent rewrites, while still ensuring the safety of the final output.
soundness: 3
strengths: 1.CURE is a generation-based LLM unlearning method. Its most notable advantage (and possibly also a limitation) is that it does not involve fine-tuning, meaning it does not modify the model’s original weights. As a result, it avoids catastrophic degradation of model utility, and can retain nearly the same utility as the original LLM.

2.The experimental evaluation is quite comprehensive. In addition to experiments on the TOFU, WMDP, and MMLU datasets, the paper also includes several ablation studies.

3.The construction of training data for the corrector is very well designed. It uses GPT-4o with majority voting to generate high-quality training samples. The training process is complete and structured, enabling the model to accurately detect leakage and perform appropriate corrections. Moreover, the corrector can be deployed directly on top of an existing LLM via a LoRA layer, making it highly practical and implementable.

4.The writing structure of the paper is clear and organized, and the figures and tables are appropriately arranged.
summary: This paper proposes an LLM unlearning method based on model generation. Unlike conventional fine-tuning based unlearning approaches, this method does not modify the model’s original weights. Instead, it attaches an externally constructed correction layer that detects and modifies the model’s outputs. This is undoubtedly a clever design—the greatest advantage lies in avoiding the model utility degradation that often occurs during fine-tuning, while maintaining nearly identical utility to the original model. In addition to proposing this effective approach, the paper also conducts extensive experiments on the TOFU, WMDP, and MMLU datasets, as well as comprehensive ablation studies to verify the necessity of each component.
weaknesses: 1.This generation-based LLM unlearning approach does not modify the model’s internal parameters or weights. Therefore, the intrinsic safety of the LLM itself is not truly guaranteed, as the dangerous or sensitive knowledge still remains within the model’s cognition.

2.The experiments lack sufficient coverage of specific unlearning types. In Section 4 (Experiments), the authors evaluate CURE about privacy problems and hazardous knowledge unlearning tasks. However, in the LLM unlearning field, copyright related unlearning remains a crucial and non-negligible topic. This paper appears to omit discussion or experiments related to that issue.

3.On the TOFU benchmark, looking at the leakage rate results, CURE performs worse than methods such as GD, DPO, and NPO in terms of forgetting quality. Although it achieves higher model utility, in LLM unlearning, forget quality (FQ) is one of the most important metrics — we should pursue a balance between forget quality and model utility.

4.The experimental results heavily depend on parameter tuning. For example, if the similarity computation fails (leading to undetected leakage in dangerous responses), the entire method would break down.

5.The deployment of this method requires maintaining an unlearning knowledge database K, which is difficult to manage in real world projects. For instance, even GPT-4o itself might contain hazardous knowledge, and in such cases, human review might be needed to ensure that the database K does not include unsafe content.

6.The method uses an embedding model for the retrieval based exclusion step, yet the ablation study does not include tests on different embedding models. Would using different embedding models lead to different results?

---

confidence: 4
contribution: 1
initial_rating: 2
presentation: 2
questions: How would this approach extend to reasoning models? If we directly work on leakage correction from the raw response, would that destroy the reasoning trace that has been generated by the model? Also, if we assume that the model doesn't have this target knowledge, would the reasoning trace be different?
soundness: 2
strengths: 1. The writing of the paper is very clear and the method is easy to follow.
2. Benchmarks on WMDP, MMLU, and TOFU show better performance on leakage rate and utility.
3. The method is training-free and easy to augment (by updating the forget target database).
summary: This paper introduces CURE, an unlearning framework for training-free unlearning. Given a user query, the system first lets the LLM generate the response as usual. Then this raw response is used to match the existing unlearning targets (through retrieval). The next step is leakage detection to see if the raw response leaks the unlearning targets (by comparing it with the retrieved chunks through an LLM). If there is leakage, an additional correction step is employed to revise the raw response so that it doesn't leak the forget target.
weaknesses: 1. Compared to training-based methods, this approach adds additional latency. Both leakage detection and leakage correction require LLM generation, which could significantly increase latency. Furthermore, the proposed approach is not able to stream tokens to the user.
2. The purpose of unlearning is to assume the target knowledge isn't stored in the LLM, rather than to make up fake knowledge. In the examples shown by the authors (Figure a), the user question is "What is the profession of Hsiao Yun-Hwa's father?", and the original (correct) answer is "The father of Hsiao Yun-Hwa is a civil engineer." The assumption in the figure is that we want to forget the knowledge that "The father of Hsiao Yun-Hwa is a civil engineer." The result shown by the authors is that the output is now "The father of Hsiao Yun-Hwa is a renowned artist." I am concerned about the objective of unlearning here, as while we don't want to leak the target knowledge, we certainly also don't want to mislead the user and generate hallucinated outputs.
3. There are previous works on RAG-based unlearning (I found the paper "DRAGON: Guard LLM Unlearning in Context via Negative Detection and Reasoning," and the authors in that paper also discuss other RAG-based unlearning methods). It is unclear what technical novelty this paper brings.