Label Smoothing Improves Gradient Ascent in LLM Unlearning

## Abstract

Abstract LLM unlearning has emerged as a promising approach, aiming to enable models to forget hazardous/undesired knowledge at low cost while preserving as much model utility as possible. Among existing techniques, the most straightforward method is performing Gradient Ascent (GA) w.r.t. the forget data, thereby forcing the model to unlearn the forget dataset. However, GA suffers from severe instability, as it drives updates in a divergent direction, often resulting in drastically degraded model utility. To address this issue, we propose Smoothed Gradient Ascent ( SGA ). SGA combines the forget data with multiple constructed normal data through a tunable smoothing rate. Intuitively, this extends GA from learning solely on the forget data to jointly learning across both forget and normal data, enabling more stable unlearning while better preserving model utility. Theoretically, we provide the theoretical guidance on the selection of the optimal smoothing rate. Empirically, we evaluate SGA on three benchmarks: TOFU, Harry Potter, and MUSE-NEWS. Experimental results demonstrate that SGA consistently outperforms the original Gradient Ascent (GA) method across all metrics and achieves top-2 performance among all baseline methods on several key metrics.

## 1 Introduction

The rapid development of large language models (LLMs) has enabled widespread adoption(Achiam et al., 2023; Zhang et al., 2022; Touvron et al., 2023; Li et al., 2023; Guo et al., 2025; Team et al., 2023; Yan et al., 2025; Bao et al., 2024; Singhal et al., 2023; Wang et al., 2024b; Ju et al., 2024; Wang et al., 2025b; Li et al., 2025) but also raised significant security concerns(Pang et al., 2025; Xu et al., 2025; Zhang et al., 2025b; Liu et al., 2025), particularly regarding harmful knowledge acquired during pre-training, such as personal attacks(Yao et al., 2024), privacy breaches(Staab et al., 2023; Mireshghallah et al., 2023; Das et al., 2025; Di et al., 2024), or copyright violations(Karamolegkou et al., 2023; Chu et al., 2024; Grynbaum & Mac, 2023; Zhang et al., 2024c; b). Since such knowledge is embedded in model representations, it can easily surface in outputs. Retraining from scratch after corpus filtering is computationally prohibitive, motivating research on LLM unlearning(Yao et al., 2024; Wang et al., 2024a; Deng et al., 2025; Liu et al., 2024a; Wang et al., 2025a; Liu et al., 2024b), which seeks to remove problematic knowledge from trained models. Existing approaches fall into two categories: fine-tuning-based methods(Wang et al., 2024a), which modify model weights via supervised fine-tuning on forget and retain data, and training-free methods(Deng et al., 2025), which preserve parameters but enforce forgetting through external mechanisms. Fine-tuning–based methods modify model weights to achieve unlearning, but often at the cost of degraded utility. In contrast, training-free methods generally preserve model performance, yet their effectiveness is frequently questioned since they do not alter the model’s parameters.

One of the most widely used fine-tuning–based unlearning approaches is Gradient Ascent (GA)(Yao et al., 2024; Maini et al., 2024), which induces forgetting by inverting the supervised fine-tuning (SFT) loss on forget data. While GA often achieves strong forgetting, it suffers from severe instability and can substantially degrade overall model utility(Zhang et al., 2024a; Fan et al., 2024b). Gradient Diff(Maini et al., 2024; Yao et al., 2024) attempts to address this by incorporating retain data, but its effectiveness is limited in practice, as identifying suitable retain sets is often infeasible(Wang et al., 2024a). To overcome these challenges, we propose Smoothed Gradient Ascent (SGA), which leverages label smoothing to combine forget data with semantically related yet safe normal data through a tunable smoothing rate. Figure [1](https://arxiv.org/html/2510.22376v1#S1.F1) illustrates the pipeline of our method. This design enables the model to forget harmful knowledge while reinforcing correct responses, thereby achieving a more favorable balance between forgetting and retention. Experimental results across multiple benchmarks demonstrate that SGA consistently outperforms existing baselines, and further analysis suggests that the optimal smoothing rate strongly depends on model scale.

#### Our contributions are twofolds:

- •
We propose Smoothed Gradient Ascent (SGA), a fine-tuning-based unlearning method requiring only forget data and generated normal data. We show empirically that the hyperparameter *smoothing rate* admits an optimal value $r^{\star}$ for effective unlearning, and provide theoretical analysis on its feasible range.
- •
We evaluate SGA on three benchmarks: TOFU (entity unlearning), Harry Potter (copyright content), and MUSE-NEWS (news-domain). Results demonstrate that SGA consistently surpasses GA and other baselines on key metrics, while effectively mitigating GA’s divergence and improving model utility.

Figure: Figure 1: SGA pipeline. SGA extends Gradient Ascent (SGA, $r=0$) by incorporating normal data generated from the normal model, which is combined with the original forget data to form a distribution over $K$ labels. The smoothing rate $r$ regulates the balance between learning and forgetting, and varying its value leads to different outcomes. Through this mechanism, SGA effectively mitigates the divergence issue of GA, which arises from maximizing the loss solely on the forget set.
Refer to caption: image/pipeline.png

## 2 Related Work

#### Training-free LLM unlearning methods.

Training-free methods avoid modifying model parameters, instead relying on prompt manipulation or output adjustments to steer predictions away from hazardous distributions (Pawelczyk et al., 2023; Muresanu et al., 2024; Thaker et al., 2024; Gao et al., 2024). GUARD (Deng et al., 2025) uses a classifier to detect unlearning-sensitive prompts and semantic matching to block responses tied to forget data. ECO Prompt (Liu et al., 2024a) also leverages a classifier, but introduces lightweight perturbations to guide outputs toward safe responses. Soft Prompt Unlearning (Bhaila et al., 2024), by contrast, attaches learnable soft prompts to inputs to induce unlearning.

#### Fine-tuning-based LLM unlearning methods.

Fine-tuning approaches achieve unlearning by directly modifying model weights (Fan et al., 2024a; Jia et al., 2024a; Fan et al., 2024b; Zhuang et al., 2024; Fan et al., 2025). Gradient Ascent (GA) (Bourtoule et al., 2021) inverts the SFT loss, transforming learning on forget data into forgetting. Gradient Descent (GD) (Wang et al., 2023) extends GA by additionally training on retain data. NPO (Zhang et al., 2024a) mitigates GA’s collapse risk by incorporating a reference model to enforce a lower bound, an idea also adopted in DPO (Rafailov et al., 2023) and KTO (Ethayarajh et al., 2024). SimPO (Fan et al., 2024b) simplifies NPO by removing the reference model. FLAT (Wang et al., 2024a) reframes unlearning as maximizing the f-divergence between forget and retain sets. RULE (Zhang et al., 2025a) integrates reinforcement learning by combining SFT with a subsequent RL phase. In summary, GA focuses solely on maximizing the next-token loss over the forget set, which can lead to severe utility collapse. GD alleviates this issue by incorporating retain data, but such data are often difficult to obtain and may be semantically unrelated to the forget set. To address these limitations, we propose SGA, which leverages a normal model to generate a customized normal set, thereby achieving better forgetting quality and model utility during unlearning.

## 3 Preliminaries

### 3.1 Formulation

Given a pre-trained dataset $\mathcal{D}$, we obtain a pre-trained large language model $\pi_{\text{origin}}$.
The goal of LLM unlearning is to enable $\pi_{\text{origin}}$ to forget hazardous knowledge while preserving its normal performance as much as possible.
In fine-tuning-based unlearning methods, we update the model parameters $\theta$ through training, thereby transforming $\pi_{\text{origin}}$ into $\pi_{\text{unlearn}}$.

In unlearning tasks, it is common to construct a forget dataset $\mathcal{D}_{f}$ and a retain dataset $\mathcal{D}_{r}$ from the pre-training corpus $\mathcal{D}$.
Here, $\mathcal{D}_{f}$ denotes the data that $\pi_{\text{origin}}$ should forget, which is used to evaluate the forgetting performance of unlearning methods;
while $\mathcal{D}_{r}$ denotes the data that $\pi_{\text{origin}}$ should retain, which is used to assess the preservation of the model’s original capabilities.
The parameter $\lambda$ serves as a regularization coefficient to balance these two objectives.
Let $x$ denote the model input and $y$ the next-token output, where subscripts $f$ and $r$ indicate samples drawn from the forget set and the retain set, respectively.
Formally, the optimization objective of unlearning methods can be expressed as:

$$ $\min_{\theta}\;\underbrace{\mathbb{E}_{(x_{f},y_{f})\in\mathcal{D}_{f}}\big[\ell_{f}(y_{f}\mid x_{f};\theta)\big]}_{\text{forget}}\;+\;\lambda\;\underbrace{\mathbb{E}_{(x_{r},y_{r})\in\mathcal{D}_{r}}\big[\ell_{r}(y_{r}\mid x_{r};\theta)\big]}_{\text{retain}}.$ (1) $$

### 3.2 Gradient Ascent

The conventional Gradient Ascent (GA) method performs unlearning solely on the forget data,
which corresponds to setting $\lambda=0$ in Equation [1](https://arxiv.org/html/2510.22376v1#S3.E1):

$$ $\min_{\theta}\;\underbrace{\mathbb{E}_{(x_{f},y_{f})\in\mathcal{D}_{f}}\big[\ell_{f}(y_{f}\mid x_{f};\theta)\big]}_{\text{forget}}.\$ (2) $$

GA achieves unlearning by negating the original training loss, thereby reversing the learning process into “forgetting” and diminishing the influence of previously learned data. At step $t$, GA updates the model in the direction that maximizes the next-token prediction loss on the forget set (Wang et al., 2024a; Yao et al., 2024), i.e.,
$\theta_{t+1}\leftarrow\theta_{t}+\lambda\nabla_{\theta_{t}}L(x,y;\theta_{t}),$
where $\lambda$ denotes the (un)learning rate. However, GA is prone to catastrophic collapse (Zhang et al., 2024a) due to its inherently divergent nature.

To address this, we hypothesize that instead of relying solely on forget data, the model can also be provided with safe answers. While GA maximizes the loss on the forget set, the additional safe losses can partially redirect its optimization trajectory. Based on this intuition, we propose SGA, a gradient combination approach inspired by generalized label smoothing.

### 3.3 Generalized Label Smoothing

Generalized Label Smoothing (GLS) is a simple yet effective learning paradigm that has been widely applied in trustworthy machine learning and deep learning (Wei et al., 2021; Szegedy et al., 2016; Lukasik et al., 2020).
Let $y_{i}$ be the one-hot encoded vector form of the label generated according to $Y$. The random variable of the generalized smoothed label $Y^{\mathrm{GLS},r}$ with smooth rate $r\in(-\infty,1]$ is defined as $y_{i}^{\mathrm{GLS},r}:=(1-r)\cdot y_{i}+\tfrac{r}{K}\cdot\mathbf{1}$ where $K$ is the number of classes and $\mathbf{1}$ is the all-ones vector. For example, when $r=0.3$ and $y_{i}=[1,0,0]^{\top}$, the generalized smoothed label becomes $y_{i}^{\mathrm{GLS},0.3}=[0.8,0.1,0.1]^{\top}$. Conversely, when $r=-0.3$, it becomes $y_{i}^{\mathrm{GLS},-0.3}=[1.2,-0.1,-0.1]^{\top}$.

## 4 Smoothed Gradient Ascent ( SGA )

In this section, we provide a detailed description of the SGA method, followed by an analysis of its improvements over the standard GA approach. Finally, we examine the potential values for estimating the optimal smooth rate.

### 4.1 Method Details

#### Step1: Normal Data Generation.

For each forget data instance, we generate $K-1$ corresponding normal data samples. The generation of normal data follows the principle that they should either be semantically similar to the forget data or constitute entirely safe responses. For example, in the TOFU experiments, we select the $K-1$ samples from the retain data that have the highest cosine similarity in embeddings with the forget data and exceed a predefined threshold; if such samples cannot be found, we substitute them with safe responses such as “I don’t know.” In the MUSE and Harry Potter experiments, we employ GPT-4o-mini (Achiam et al., 2023) to generate $K-1$ semantically similar normal data samples for each forget data instance, ensuring that they do not contain any harmful information. We present the procedure for generating normal data with GPT-4o-mini in Appendix [D](https://arxiv.org/html/2510.22376v1#A4).

#### Step 2: Smoothed Gradient Ascent.

We extend the idea of Generalized Label Smoothing (GLS) by introducing a smoothing rate $r$, which combines the forget data with $K-1$ normal data samples to guide the base LLM during the unlearning and learning process. Under the standard GA setting (SGA with $r=0$), the model ignores the normal data. In the $K$-dimensional label space $(\text{forget data},\text{normal data}_{1},\text{normal data}_{2},\ldots)$, the target label is $(-1,0,0,0,\ldots)$, where the negative coefficient indicates that the model is driven to forget the corresponding data, while positive coefficients represent reinforcement through learning. In contrast, under SGA with a smoothing rate $r$, the label distribution becomes $\Bigl(-\Bigl(1-\tfrac{K-1}{K}r\Bigr),\;-\tfrac{r}{K},\;-\tfrac{r}{K},\;\ldots\Bigr)$. Finally, the optimization objective in (1) can be reformulated as:

$$ $\min_{\theta}\;\underbrace{\left(1-r+\tfrac{r}{K}\right)\,\mathbb{E}_{(x_{f},y_{f})\in\mathcal{D}_{f}}\big[\ell_{f}(y_{f}\mid x_{f};\theta)\big]}_{\text{forget}}\;+\;\underbrace{\left(\tfrac{r}{K}\right)\,\mathbb{E}_{(x_{p},y_{p})\in\mathcal{D}_{p}}\Bigg[\sum_{k=1}^{K}\ell_{p}^{(k)}(y_{p}^{(k)}\mid x_{p}^{(k)};\theta)\Bigg]}_{\text{normal data}}.$ (3) $$

Here, the subscript $p$ denotes samples drawn from our generated normal set.

### 4.2 Why SGA Alleviates the Divergence Problem

From a gradient viewpoint, GA follows the ascent direction of the forget loss only:

$$ $\Delta\theta_{t}\;\propto\;-\,g_{f},\qquad g_{f}\triangleq\nabla_{\theta_{t}}L_{f}.$ $$

This purely divergent direction often leads to catastrophic collapse.

Under our GLS-based construction (Equation [3](https://arxiv.org/html/2510.22376v1#S4.E3)), the per-step objective combines the forget loss with $K$ normal losses via the smooth rate $r$:

$$ $\mathcal{L}_{\mathrm{SGA}}(\theta)\;=\;\left(1-r+\tfrac{r}{K}\right)L_{f}(\theta)\;+\;\left(\tfrac{r}{K}\right)\sum_{k=1}^{K}L_{p}^{(k)}(\theta).$ (4) $$

Taking the gradient yields the combined update direction

$$ $\Delta\theta_{t}\;\propto\;-\,\nabla_{\theta_{t}}\mathcal{L}_{\mathrm{SGA}}(\theta_{t})\;=\;-\,\Biggl[\left(1-r+\tfrac{r}{K}\right)g_{f}\;+\;\left(\tfrac{r}{K}\right)\sum_{k=1}^{K}g_{p}^{(k)}\Biggr],$ (5) $$

where $g_{p}^{(k)}\triangleq\nabla_{\theta_{t}}L_{p}^{(k)}$ denotes the gradient contributed by the $k$-th normal sample. Thus, a key reason why SGA effectively suppresses the divergence issue of GA is that it alters GA’s gradient-ascent direction, preventing the model from updating purely toward maximizing the next-token loss on the forget set.

### 4.3 Optimal Smooth Rate

Given the forget data and $K-1$ normal data, we hypothesize the existence of an optimal smoothing rate $r^{\ast}$. Let $g_{f}$ denote the gradient of the forget loss and $g_{p}^{(k)}$ the gradient of the $k$-th normal loss, with their average denoted as $\bar{g}_{p}$.

The one-step update vector is:

$$ $d(r)=-\,g_{f}\;+\;r\left[\bar{g}_{p}-\left(1-\tfrac{1}{K}\right)g_{f}\right],$ (6) $$

where $r$ provides a tunable deflection from the GA direction $-g_{f}$ along

$$ $u\triangleq\bar{g}_{p}-\left(1-\tfrac{1}{K}\right)g_{f}.$ (7) $$

Without this adjustment, GA updates purely along $-g_{f}$, often causing divergence. To mitigate this, we seek to minimize the update norm while ensuring forgetting:

$$ $r^{\ast}=\arg\min_{r}\|d(r)\|^{2}.$ (8) $$

Solving yields the closed-form:

$$ $r^{\ast}=\frac{\langle g_{f},u\rangle}{\|u\|^{2}}.$ (9) $$

#### Discussion on Equation 9 .

Equation [9](https://arxiv.org/html/2510.22376v1#S4.E9) indicates that the optimal $r^{\ast}$ is jointly determined by the base LLM, the forget data, and the normal data.
Since the model parameters $\theta$ evolve during unlearning, $r^{\ast}$ also changes dynamically.
For efficiency, we fix $r$ at the start of training, so the empirical optimum in Section [5](https://arxiv.org/html/2510.22376v1#S5) cannot be derived directly from Equation [9](https://arxiv.org/html/2510.22376v1#S4.E9).
Nevertheless, by estimating the sign of $\langle g_{f},u\rangle$ on the base LLM,which characterizes the feasible range of $r^{\ast}$,we find:

- •
$\langle g_{f},u\rangle>0$ (the angle between $g_{f}$ and $u$ is less than $90^{\circ}$): $r^{\ast}$ tends to be positive;
- •
$\langle g_{f},u\rangle<0$ (the angle between $g_{f}$ and $u$ is greater than $90^{\circ}$): $r^{\ast}$ tends to be negative.

The effective ranges reported in Section [5.2](https://arxiv.org/html/2510.22376v1#S5.SS2) align with this estimation, as shown in Figure [2](https://arxiv.org/html/2510.22376v1#S5.F2).

## 5 Experiment

In this section, we evaluate the performance of the SGA method on three established LLM unlearning tasks: TOFU (Maini et al., 2024), MUSE-News (Shi et al., 2024), and Harry Potter (Yao et al., 2024). Among them, the TOFU task focuses on the problem of entity unlearning, the Harry Potter experiment addresses copyright-related issues, and MUSE-News concerns the evaluation of general unlearning capabilities.

### 5.1 Baseline Methods

We compare SGA against other fine-tuning-based LLM unlearning methods across three tasks to evaluate its effectiveness. For all tasks, we include Gradient Ascent (GA) (Yao et al., 2024), KL minimization (KL) (Maini et al., 2024), GradDiff (GD) (Liu et al., 2022), NPO (Zhang et al., 2024a), and Forget-data-only Loss Adjustment (FLAT) (Wang et al., 2024a) as baselines. On the copyrighted content task (Harry Potter) and the entity unlearning task (TOFU), we further compare with Preference Optimization (PO) (Maini et al., 2024), Large Language Model Unlearning (LLMU) (Yao et al., 2024), and DPO. For the Harry Potter task, we additionally include the Missmatch (Liu et al., 2024a) method. For the MUSE-News task, we incorporate Task Vector, Who’s Harry Potter (WHP) (Eldan & Russinovich, 2023), and NPO-RT (Zhang et al., 2024a) as baselines.

### 5.2 Entity Unlearning

#### Experiment Setup.

The TOFU(Maini et al., 2024) dataset is a question-answering benchmark built on the biographies of 200 fictional authors, with each author associated with 20 QA pairs. Based on the designated unlearning scope, the dataset is partitioned into a forget set and a retain set. In our experiments, we adopt the 1% forget split. Following (Deng et al., 2025; Wang et al., 2024a), we use Llama2-7B (Touvron et al., 2023), Phi-1.5B (Li et al., 2023), and OPT-2.7B (Zhang et al., 2022) as the base LLMs. In addition, we employ the bge-large-en-v1.5 embedding model (Xiao et al., 2023) as an auxiliary encoder to select normal data from the retain set for training.

#### Evaluation Metrics.

To evaluate both the forgetting quality and the retained utility of the unlearned models, we employed two metrics from the TOFU benchmark: Forget Quality (FQ) and Model Utility (MU) (Maini et al., 2024). FQ is evaluated using the p-value of a Kolmogorov–Smirnov test comparing the unlearned model’s outputs with those of a retain-only model, where higher values indicate stronger forgetting. MU reflects the model’s utility by aggregating performance on held-out retain data spanning fictional authors, real-world profiles, and factual knowledge. We additionally report ROUGE-L scores on both the forget and retain sets. On the forget set, a score closer to that of the retain model indicates better forgetting performance, while on the retain set, higher ROUGE-L scores correspond to better utility. Full metric details are provided in Appendix [C.1](https://arxiv.org/html/2510.22376v1#A3.SS1)

**Table 1: We evaluate the performance of SGA and baseline approaches on three base LLMs: Llama2-7B, OPT-2.7B, and Phi-1.5B. Here, FQ, MU, F-RL, and R-RL denote Forget Quality, Model Utility, and the ROUGE-L scores on the forget and retain sets, respectively. For reference, we also report results from the Original and Retained LLMs. The top-2 results are highlighted in blue.**
| Base LLM | Llama2-7B | OPT-2.7B | Phi-1.5B |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Metric | FQ($\uparrow$) | MU($\uparrow$) | F-RL($\downarrow$) | R-RL($\uparrow$) | FQ($\uparrow$) | MU($\uparrow$) | F-RL($\downarrow$) | R-RL($\uparrow$) | FQ($\uparrow$) | MU($\uparrow$) | F-RL($\downarrow$) | R-RL($\uparrow$) |
| Original LLM | 4.4883e-06 | 0.6239 | 0.9851 | 0.9818 | 0.0013 | 0.5112 | 0.7537 | 0.8807 | 0.0013 | 0.5195 | 0.9607 | 0.9276 |
| Retained LLM | 1.0 | 0.6267 | 0.4080 | 0.9833 | 1.0 | 0.5067 | 0.4217 | 0.7669 | 1.0 | 0.5233 | 0.4272 | 0.9269 |
| GA/SGA (r = 0) | 0.0068 | 0.5990 | 0.4817 | 0.9204 | 0.0541 | 0.4851 | 0.4490 | 0.6440 | 0.0541 | 0.5058 | 0.4914 | 0.8012 |
| KL | 0.0030 | 0.5994 | 0.4922 | 0.9172 | 0.0143 | 0.4785 | 0.3971 | 0.6010 | 0.0541 | 0.5087 | 0.4910 | 0.7603 |
| GD | 0.0068 | 0.5998 | 0.4869 | 0.9182 | 0.0971 | 0.4826 | 0.4085 | 0.6016 | 0.0286 | 0.5117 | 0.4991 | 0.7959 |
| LLMU | 0.0030 | 0.5999 | 0.4891 | 0.9236 | 0.0068 | 0.1849 | 0.0210 | 0.1727 | 0.0143 | 0.5108 | 0.3331 | 0.7785 |
| PO | 0.0030 | 0.6323 | 0.1752 | 0.9169 | 0.0971 | 0.3706 | 0.0393 | 0.3594 | 0.0541 | 0.5064 | 0.4958 | 0.8003 |
| DPO-RT | 0.0068 | 0.6322 | 0.2595 | 0.9091 | 0.0068 | 0.3278 | 0.0348 | 0.2741 | 0.0286 | 0.5053 | 0.2824 | 0.7372 |
| NPO-RT | 0.0030 | 0.5994 | 0.5049 | 0.9270 | 0.0286 | 0.4844 | 0.4353 | 0.6401 | 0.0286 | 0.5090 | 0.4957 | 0.7660 |
| FLAT (Pearson) | 0.0030 | 0.6304 | 0.4825 | 0.9284 | 0.0030 | 0.4714 | 0.1962 | 0.4973 | 0.0541 | 0.5160 | 0.4228 | 0.7674 |
| SGA (r = 0.8) | 0.0030 | 0.6051 | 0.5352 | 0.8929 | 0.0971 | 0.4584 | 0.4360 | 0.5449 | 0.0143 | 0.5085 | 0.4963 | 0.8097 |
| SGA (r = 0.4) | 0.0068 | 0.6027 | 0.4792 | 0.9163 | 0.0286 | 0.4740 | 0.4033 | 0.5862 | 0.0143 | 0.5085 | 0.4963 | 0.8097 |
| SGA (r = 0.2) | 0.0068 | 0.6018 | 0.4777 | 0.9229 | 0.0286 | 0.4799 | 0.3967 | 0.5996 | 0.0286 | 0.5060 | 0.4782 | 0.8075 |
| SGA (r = -0.2) | 0.0068 | 0.6025 | 0.4909 | 0.9270 | 0.0971 | 0.4851 | 0.3973 | 0.6148 | 0.0971 | 0.5100 | 0.4831 | 0.8062 |
| SGA (r = -0.4) | 0.0068 | 0.6032 | 0.4888 | 0.9291 | 0.0971 | 0.4859 | 0.4021 | 0.6939 | 0.0971 | 0.5093 | 0.4851 | 0.8009 |
| SGA (r = -0.8) | 0.0030 | 0.6037 | 0.4871 | 0.9281 | 0.2657 | 0.4867 | 0.3946 | 0.6139 | 0.0971 | 0.5092 | 0.4957 | 0.8040 |
| SGA (r = -2) | 0.0030 | 0.6046 | 0.4897 | 0.9224 | 0.2657 | 0.4784 | 0.3959 | 0.6012 | 0.0971 | 0.5120 | 0.4816 | 0.8043 |
| SGA (r = -4) | 0.0030 | 0.6047 | 0.4985 | 0.9217 | 0.4046 | 0.4747 | 0.3863 | 0.5890 | 0.0971 | 0.5095 | 0.4891 | 0.7953 |
| SGA (r = -8) | 0.0013 | 0.6060 | 0.4916 | 0.9280 | 0.4046 | 0.4749 | 0.3895 | 0.5873 | 0.0541 | 0.5074 | 0.4877 | 0.7918 |

Figure: Figure 2: Following Section [4.3](https://arxiv.org/html/2510.22376v1#S4.SS3), we estimate the sign of $r^{\star}$ for each forget data instance in the TOFU benchmark forget01 dataset, which corresponds to the sign of $\langle g_{f},u\rangle$ in Equation [9](https://arxiv.org/html/2510.22376v1#S4.E9).
Refer to caption: image/rstar.png

#### SGA achieves the best forget quality across all models.

According to Table [1](https://arxiv.org/html/2510.22376v1#S5.T1), we observe that, compared with all baseline methods, the SGA under the optimal smoothing rate achieves the best forget quality. Moreover, the forget quality of SGA substantially surpasses that of GA (i.e., SGA with a smoothing rate of 0), indicating that incorporating new normal data for continued learning while forgetting the target data leads to more effective unlearning.

#### Compared with GA (corresponding to SGA with r=0), SGA generally demonstrates superior performance.

Across all three models, SGA with an appropriately tuned smooth rate consistently outperforms Gradient Ascent on nearly all evaluation metrics. This suggests that jointly incorporating normal data with forget data during training enables the model to achieve effective forgetting while simultaneously preserving its performance to a greater extent.

#### The validity of the optimal smooth rate r ∗ r^{\ast} range is verified on the TOFU benchmark.

According to Section [4.3](https://arxiv.org/html/2510.22376v1#S4.SS3), we estimate the sign of $\langle g_{f},u\rangle$ for each data instance and each base LLM in the TOFU experiments, as illustrated in Figure [2](https://arxiv.org/html/2510.22376v1#S5.F2). Compared with Table [1](https://arxiv.org/html/2510.22376v1#S5.T1), we observe that the empirically optimal smooth rate values largely align with the estimation results. Importantly, different smooth rates can substantially alter the model’s confidence in generating certain key pieces of information, thereby enabling unlearning, as illustrated in Figure [3](https://arxiv.org/html/2510.22376v1#S5.F3).

Figure: Figure 3: Different smoothing rates yield distinct output probabilities for critical tokens across base LLMs. As shown in the figure, the forget data highlights Basil Mahfouz Al-Kuwaiti’s achievements in French literary style. In the LLaMA2-7B model, training with $r=-0.8$ assigns a much higher probability to the token “French,” whereas training with $r=0.2$ makes the model far less likely to produce this privacy-sensitive token.
Refer to caption: image/question_2.png

### 5.3 Copyrighted Content Unlearning

#### Experiment Setup.

Following prior work (Deng et al., 2025; Wang et al., 2024a), we use Harry Potter and the Sorcerer’s Stone (Rowling, 2023; Eldan & Russinovich, 2023) as copyrighted material for unlearning. We extract 400 segments ($\leq 512$ tokens each) as the forget set $\mathcal{D}_{f}$ (Deng et al., 2025; Wang et al., 2024a; Jia et al., 2024b), and sample 400 paragraphs from C4 (Raffel et al., 2020) as the retain set $\mathcal{D}_{r}$. For each forget instance, GPT-4o-mini (Achiam et al., 2023) generates safe normal data. Following (Wang et al., 2024a), we fine-tune OPT-2.7B (Zhang et al., 2022) and Llama2-7B (Touvron et al., 2023) to simulate memorization and run experiments on the fine-tuned models.

#### Evaluation Metrics.

Following the choice of evaluation metrics in prior work (Deng et al., 2025; Wang et al., 2024a), we also consider both unlearning effectiveness and model utility.
Unlearning effectiveness is measured using the Forget Quality Gap (FQ Gap), which evaluates the forgetting performance based on the differences in BLEU (Papineni et al., 2002) and ROUGE-L (Lin, 2004) scores between the unlearned model and the retained model. Model utility is assessed through perplexity (PPL) on Wikitext (Merity et al., 2016) and the average accuracy across nine zero-shot benchmarks. Full metric definitions are provided in Appendix [C.2](https://arxiv.org/html/2510.22376v1#A3.SS2).

**Table 2: SGA and baseline methods are evaluated on the Harry Potter benchmark using two base LLMs: OPT-2.7B and Llama2-7B. We report only the best-performing $r$ for each base model, with full results provided in Appendix [F.1](https://arxiv.org/html/2510.22376v1#A6.SS1). Among the three evaluation metrics—Forget Quality Gap (FQ Gap), Perplexity (PPL), and Average Accuracy (Avg. Acc.)—the top-2 scores are highlighted in blue. Values marked with * are taken directly from (Wang et al., 2024a).**
| Base LLM | OPT-2.7B | Llama2-7B |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| Metric | FQ Gap($\downarrow$) | PPL($\downarrow$) | Avg. Acc.($\uparrow$) | FQ Gap($\downarrow$) | PPL($\downarrow$) | Avg. Acc.($\uparrow$) |
| Original LLM | 1.5346 | 15.6314 | 0.4762 | 3.6594 | 8.9524 | 0.5617 |
| Retained LLM | 0.0 | 14.3190 | 0.4686 | 0.0 | 8.7070 | 0.5599 |
| GA/SGA (r=0)* | 2.7301 | 1.0984e71 | 0.3667 | 0.4587 | 47.2769 | 0.5088 |
| KL* | 2.7301 | 16.1592 | 0.4688 | 0.4225 | 9.4336 | 0.5509 |
| GD* | 2.3439 | 16.1972 | 0.4690 | 0.5304 | 9.1797 | 0.4902 |
| Mismatch* | 1.4042 | 15.7507 | 0.4679 | 0.4647 | 8.9906 | 0.5593 |
| LLMU* | 2.4639 | 15.8398 | 0.4656 | 0.1985 | 9.0530 | 0.5503 |
| PO* | 2.1601 | 14.8960 | 0.4583 | 0.5124 | 8.8364 | 0.5532 |
| DPO* | 2.2152 | 16.8396 | 0.4621 | 0.2924 | 8.9597 | 0.5614 |
| NPO* | 1.2611 | 19.6637 | 0.4644 | 0.5151 | 9.0397 | 0.5609 |
| FLAT (Pearson)* | 1.4089 | 15.5543 | 0.4686 | 0.2265 | 8.9906 | 0.5580 |
| SGA (r=-0.2) | 0 | 6.2700e72 | 0.3683 | 0.0761 | 28.9249 | 0.5421 |
| SGA (r=-0.4) | 0 | 6.8530e30 | 0.3876 | 0.5355 | 11.4885 | 0.5676 |
| SGA (r=-0.8) | 0.0043 | 1.3040e6 | 0.4497 | 0.4141 | 19.9494 | 0.5316 |
| SGA (r=-2) | 0.0084 | 6.7100e5 | 0.4532 | 0.350 | 18.67 | 0.5305 |

#### By appropriately tuning the smoothing rate, SGA consistently outperforms Gradient Ascent.

As shown in Table [2](https://arxiv.org/html/2510.22376v1#S5.T2), aside from a few cases where training collapses under extreme smoothing rates, SGA consistently surpasses GA (i.e., SGA with $r=0$) across all evaluation metrics, including FQ Gap, PPL, and Avg. ACC. This corroborates our discussion in Section [4.2](https://arxiv.org/html/2510.22376v1#S4.SS2), where we argued that incorporating normal data effectively mitigates GA’s instability, which otherwise maximizes loss solely on the forget set. Notably, on OPT-2.7B and Llama2-7B, the GA baseline suffers severe divergence, manifested as extremely high PPL and drastically low Avg. ACC. In contrast, SGA substantially suppresses this issue, rendering GA’s divergence problem far less severe.

#### SGA generally achieves superior forgetting capability.

On OPT-2.7B and Llama2-7B, we observe that when the smoothing rate is properly tuned, SGA typically attains the strongest forgetting performance. This advantage arises because SGA still applies gradient ascent on the forget data as part of its unlearning process, thereby inheriting GA’s beneficial aspects while avoiding instability.

#### Discussion on Perplexity (PPL).

For the OPT-2.7B and Llama2-7B models, GA yields extremely high PPL values. This indicates that models after GA-based unlearning exhibit very high perplexity, reflecting the severe divergence of GA and the resulting degradation in model utility. In contrast, the PPL results for SGA in Table 2 demonstrate that it significantly alleviates this issue, even reducing the PPL on Llama2-7B to a level comparable with other unlearning methods. This further confirms that by jointly leveraging normal data and forget data, SGA effectively mitigates the divergence problem inherent to GA.

### 5.4 MUSE-NEWS Unlearning

#### Experiment Setup.

We evaluate SGA on the MUSE-News benchmark (Shi et al., 2024), constructed from real-world BBC news articles and partitioned into three subsets: a forget set, a retain set, and a holdout set for utility evaluation. In experiments, we perform unlearning on the Llama2-7B (Touvron et al., 2023) pretrained model provided by the MUSE benchmark. The baseline methods in the evaluation are obtained or reproduced from the original implementations provided by MUSE, while SGA is specifically developed and implemented on the MUSE-News benchmark.

#### Evaluation Metrics.

We evaluate both the baseline methods and SGA using the metrics provided by the MUSE benchmark: VerbMem on forget dataset, KnowMem on forget and retain dataset, and Privacy leakage (PrivLeak). VerbMem measures the model’s ability to continue generating forgotten text, while KnowMem evaluates whether the model preserves knowledge from both the forget and retain sets. PrivLeak assesses privacy leakage via membership inference (MIA). For a more detailed description of the evaluation metrics used in MUSE-NEWS, please refer to the Appendix [C.3](https://arxiv.org/html/2510.22376v1#A3.SS3)

**Table 3: The evaluation on the MUSE benchmark is conducted across four criteria. Results are highlighted in blue when the unlearning method satisfies the criterion, and in red when it does not. For $D_{f}$, smaller values are preferable, whereas for $D_{r}$, larger values are desirable. For PrivLeak, the ideal outcome is close to 0, since substantial deviations in either direction may indicate privacy leakage. We further highlight in green the top-2 PrivLeak results that also meet the other three criteria. Only the best-performing $r$ for each method is shown here, with full results provided in Appendix [F.2](https://arxiv.org/html/2510.22376v1#A6.SS2). Values marked with * are taken directly from (Wang et al., 2024a).**
|  | VerbMem on $D_{f}$ ($\downarrow$) | KnowMem on $D_{f}$ ($\downarrow$) | KnowMem on $D_{r}$ ($\uparrow$) | PrivLeak |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Original LLM | 58.4 | - | 63.9 | - | 55.2 | - | -99.8 |
| Retained LLM | 20.8 | - | 33.1 | - | 55.0 | - | 0.0 |
| Task Vectors* | 56.3 | (✘) | 63.7 | (✘) | 54.6 | (✔) | -99.8 |
| WHP* | 19.7 | (✔) | 21.2 | (✔) | 28.3 | (✔) | 109.6 |
| GA* | 0.0 | (✔) | 0.0 | (✔) | 0.0 | (✘) | 17.0 |
| GD* | 4.9 | (✔) | 27.5 | (✔) | 6.7 | (✔) | 109.4 |
| KL* | 27.4 | (✘) | 50.2 | (✘) | 44.8 | (✔) | -96.1 |
| NPO* | 0.0 | (✔) | 0.0 | (✔) | 0.0 | (✘) | 15.0 |
| NPO-RT* | 1.2 | (✔) | 54.6 | (✘) | 40.5 | (✔) | 105.8 |
| FLAT (Pearson)* | 1.6 | (✔) | 0.0 | (✔) | 0.2 | (✔) | 26.8 |
| SGA | 0 | (✔) | 0 | (✔) | 1.9498 | (✔) | 15.5700 |

#### SGA maintains GA’s strong performance on the forget set D f D_{f} while improving upon it on the retain set D r D_{r} .

On $D_{f}$, SGA substantially reduces memorization risk in VerbMem and KnowMem, achieving scores of 0 across both metrics—well below the Retained LLM baseline and fully comparable to GA. On $D_{r}$, SGA raises GA’s KnowMem score from 0 to 1.9498, thereby meeting the criterion that KnowMem should not be 0. Consequently, SGA not only inherits GA’s strengths on $D_{f}$ but also effectively remedies its shortcomings on $D_{r}$.

#### Among methods satisfying the criteria on both VerbMem and KnowMem, SGA ranks within the top-2 for PrivLeak, achieving a score of 15.57.

This demonstrates that SGA provides substantially better control over privacy leakage compared to other approaches. In summary, on the MUSE-NEWS benchmark, SGA has been validated as an unlearning method that not only meets all evaluation criteria but also achieves the strongest performance in mitigating privacy leakage.

### 5.5 Ablation Studies

As described in Section [5.2](https://arxiv.org/html/2510.22376v1#S5.SS2), the procedure for collecting normal data in the TOFU experiment differs from the other two experiments. Instead of relying entirely on generation from an external large model, we compute the similarity between the retain data and forget data using an embedding model, and then select the most similar samples from the retain set as normal data. In the ablation study, we compare the results of training with normal data generated by GPT-4o-mini against those obtained using normal data selected by the embedding model.

#### The SGA method supported by GPT does not lose its effectiveness;

instead, it even achieves better performance than normal data generated by the embedding model on certain base LLMs. However, we also observe that as the source of normal data changes, the value of the optimal smoothing rate shifts accordingly, which is consistent with our analysis in Section [4.3](https://arxiv.org/html/2510.22376v1#S4.SS3).

**Table 4: Ablation study results on TOFU across different base LLMs. We compare SGA selecting normal data via an embedding model (SGA) with SGA employing GPT-4o-mini to generate normal data (GPT), in terms of Forget Quality (FQ) and Model Utility (MU). For each method, we report results for the two best smoothing rates, with the top-2 outcomes highlighted in blue.**
| Llama2-7B | OPT-2.7B | Phi-1.5B |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Metric | FQ($\uparrow$) | MU($\uparrow$) | Metric | FQ($\uparrow$) | MU($\uparrow$) | Metric | FQ($\uparrow$) | MU($\uparrow$) |
| SGA (r=0.4) | 0.0068 | 0.6027 | SGA (r=-0.8) | 0.2657 | 0.4867 | SGA (r=-0.8) | 0.0971 | 0.5092 |
| SGA (r=0.2) | 0.0068 | 0.6018 | SGA (r=-2) | 0.2657 | 0.4784 | SGA (r=-2) | 0.0971 | 0.5120 |
| GPT (r=-2) | 0.1650 | 0.6170 | GPT (r=0.4) | 0.2657 | 0.4830 | GPT (r=-0.4) | 0.0068 | 0.4594 |
| GPT (r=-4) | 0.2657 | 0.6189 | GPT (r=-8) | 0.2657 | 0.4822 | GPT (r=-0.2) | 0.0068 | 0.4669 |

## 6 Conclusion

This paper addresses the limitations of Gradient Ascent in LLM unlearning and introduces Smoothed Gradient Ascent (SGA). Inspired by Generalized Label Smoothin, SGA leverages auxiliary normal models to generate customized normal data for the forget set and integrates them via a tunable smoothing rate $r$, enabling the base LLM to jointly learn and unlearn, thereby effectively “forgetting” hazardous information. We provide a theoretical analysis of the optimal smoothing rate $r^{\ast}$ and empirically validate its feasible range. Experiments on TOFU, Harry Potter, and MUSE-NEWS show that SGA consistently outperforms Gradient Ascent and a list of strong baselines, delivering stronger Forget Quality, mitigating catastrophic divergence in Model Utility, and achieving state-of-the-art results on several key metrics.

## Ethics Statement and Reproducibility Statement

#### Ethics statement.

This work does not involve any ethical or moral concerns.

#### Reproducibility statement.

The computational resources and experimental setup required for this study are provided in Appendix [E](https://arxiv.org/html/2510.22376v1#A5). Upon acceptance of the paper, we will release all source code associated with our experiments.

## References

- Achiam et al. (2023)
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al.
Gpt-4 technical report.
*arXiv preprint arXiv:2303.08774*, 2023.
- Bao et al. (2024)
Yujia Bao, Ankit Parag Shah, Neeru Narang, Jonathan Rivers, Rajeev Maksey, Lan Guan, Louise N Barrere, Shelley Evenson, Rahul Basole, Connie Miao, et al.
Harnessing business and media insights with large language models.
*arXiv preprint arXiv:2406.06559*, 2024.
- Bhaila et al. (2024)
Karuna Bhaila, Minh-Hao Van, and Xintao Wu.
Soft prompting for unlearning in large language models.
*arXiv preprint arXiv:2406.12038*, 2024.
- Bisk et al. (2020)
Yonatan Bisk, Rowan Zellers, Jianfeng Gao, Yejin Choi, et al.
Piqa: Reasoning about physical commonsense in natural language.
In *Proceedings of the AAAI conference on artificial intelligence*, volume 34, pp. 7432–7439, 2020.
- Bourtoule et al. (2021)
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot.
Machine unlearning.
In *2021 IEEE symposium on security and privacy (SP)*, pp. 141–159. IEEE, 2021.
- Chollet (2019)
François Chollet.
On the measure of intelligence.
*arXiv preprint arXiv:1911.01547*, 2019.
- Chu et al. (2024)
Timothy Chu, Zhao Song, and Chiwun Yang.
How to protect copyright data in optimization of large language models?
In *Proceedings of the AAAI Conference on Artificial Intelligence*, volume 38, pp. 17871–17879, 2024.
- Clark et al. (2019)
Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova.
Boolq: Exploring the surprising difficulty of natural yes/no questions.
*arXiv preprint arXiv:1905.10044*, 2019.
- Dagan et al. (2005)
Ido Dagan, Oren Glickman, and Bernardo Magnini.
The pascal recognising textual entailment challenge.
In *Machine learning challenges workshop*, pp. 177–190. Springer, 2005.
- Das et al. (2025)
Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu.
Security and privacy challenges of large language models: A survey.
*ACM Computing Surveys*, 57(6):1–39, 2025.
- Deng et al. (2025)
Zhijie Deng, Chris Yuhao Liu, Zirui Pang, Xinlei He, Lei Feng, Qi Xuan, Zhaowei Zhu, and Jiaheng Wei.
Guard: Generation-time llm unlearning via adaptive restriction and detection.
*arXiv preprint arXiv:2505.13312*, 2025.
- Di et al. (2024)
Zonglin Di, Sixie Yu, Yevgeniy Vorobeychik, and Yang Liu.
Adversarial machine unlearning.
*arXiv preprint arXiv:2406.07687*, 2024.
- Eldan & Russinovich (2023)
Ronen Eldan and Mark Russinovich.
Who’s harry potter? approximate unlearning for llms.
2023.
- Ethayarajh et al. (2024)
Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela.
Kto: Model alignment as prospect theoretic optimization.
*arXiv preprint arXiv:2402.01306*, 2024.
- Fan et al. (2024a)
Chongyu Fan, Jiancheng Liu, Alfred Hero, and Sijia Liu.
Challenging forgets: Unveiling the worst-case forget sets in machine unlearning.
In *European Conference on Computer Vision*, pp. 278–297. Springer, 2024a.
- Fan et al. (2024b)
Chongyu Fan, Jiancheng Liu, Licong Lin, Jinghan Jia, Ruiqi Zhang, Song Mei, and Sijia Liu.
Simplicity prevails: Rethinking negative preference optimization for llm unlearning.
*arXiv preprint arXiv:2410.07163*, 2024b.
- Fan et al. (2025)
Chongyu Fan, Jinghan Jia, Yihua Zhang, Anil Ramakrishna, Mingyi Hong, and Sijia Liu.
Towards llm unlearning resilient to relearning attacks: A sharpness-aware minimization perspective and beyond.
*arXiv preprint arXiv:2502.05374*, 2025.
- Gao et al. (2024)
Chongyang Gao, Lixu Wang, Kaize Ding, Chenkai Weng, Xiao Wang, and Qi Zhu.
On large language model continual unlearning.
*arXiv preprint arXiv:2407.10223*, 2024.
- Grynbaum & Mac (2023)
Michael M Grynbaum and Ryan Mac.
The times sues openai and microsoft over ai use of copyrighted work.
*The New York Times*, 27(1), 2023.
- Guo et al. (2025)
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al.
Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.
*arXiv preprint arXiv:2501.12948*, 2025.
- Jia et al. (2024a)
Jinghan Jia, Jiancheng Liu, Yihua Zhang, Parikshit Ram, Nathalie Baracaldo, and Sijia Liu.
Wagle: Strategic weight attribution for effective and modular unlearning in large language models.
*Advances in Neural Information Processing Systems*, 37:55620–55646, 2024a.
- Jia et al. (2024b)
Jinghan Jia, Yihua Zhang, Yimeng Zhang, Jiancheng Liu, Bharat Runwal, James Diffenderfer, Bhavya Kailkhura, and Sijia Liu.
Soul: Unlocking the power of second-order optimization for llm unlearning.
*arXiv preprint arXiv:2404.18239*, 2024b.
- Ju et al. (2024)
Zeqian Ju, Yuancheng Wang, Kai Shen, Xu Tan, Detai Xin, Dongchao Yang, Yanqing Liu, Yichong Leng, Kaitao Song, Siliang Tang, Zhizheng Wu, Tao Qin, Xiang-Yang Li, Wei Ye, Shikun Zhang, Jiang Bian, Lei He, Jinyu Li, and Sheng Zhao.
Naturalspeech 3: Zero-shot speech synthesis with factorized codec and diffusion models, 2024.
URL [https://arxiv.org/abs/2403.03100](https://arxiv.org/abs/2403.03100).
- Karamolegkou et al. (2023)
Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Søgaard.
Copyright violations and large language models.
*arXiv preprint arXiv:2310.13771*, 2023.
- Kumar Murakonda et al. (2021)
Sasi Kumar Murakonda, Reza Shokri, and George Theodorakopoulos.
Quantifying the privacy risks of learning high-dimensional graphical models.
In Arindam Banerjee and Kenji Fukumizu (eds.), *Proceedings of The 24th International Conference on Artificial Intelligence and Statistics*, volume 130 of *Proceedings of Machine Learning Research*, pp. 2287–2295. PMLR, 13–15 Apr 2021.
URL [https://proceedings.mlr.press/v130/kumar-murakonda21a.html](https://proceedings.mlr.press/v130/kumar-murakonda21a.html).
- Li et al. (2025)
Ling Li, Yao Zhou, Yuxuan Liang, Fugee Tsung, and Jiaheng Wei.
Recognition through reasoning: Reinforcing image geo-localization with large vision-language models, 2025.
URL [https://arxiv.org/abs/2506.14674](https://arxiv.org/abs/2506.14674).
- Li et al. (2023)
Yuanzhi Li, Sébastien Bubeck, Ronen Eldan, Allie Del Giorno, Suriya Gunasekar, and Yin Tat Lee.
Textbooks are all you need ii: phi-1.5 technical report.
*arXiv preprint arXiv:2309.05463*, 2023.
- Lin (2004)
Chin-Yew Lin.
Rouge: A package for automatic evaluation of summaries.
In *Text summarization branches out*, pp. 74–81, 2004.
- Lin et al. (2021)
Stephanie Lin, Jacob Hilton, and Owain Evans.
Truthfulqa: Measuring how models mimic human falsehoods.
*arXiv preprint arXiv:2109.07958*, 2021.
- Liu et al. (2022)
Bo Liu, Qiang Liu, and Peter Stone.
Continual learning and private unlearning.
In *Conference on Lifelong Learning Agents*, pp. 243–254. PMLR, 2022.
- Liu et al. (2024a)
Chris Liu, Yaxuan Wang, Jeffrey Flanigan, and Yang Liu.
Large language model unlearning via embedding-corrupted prompts.
*Advances in Neural Information Processing Systems*, 37:118198–118266, 2024a.
- Liu et al. (2025)
Qiuhao Liu, Ling Li, Yao Lu, Qi Xuan, Zhaowei Zhu, and Jiaheng Wei.
Selectmix: Enhancing label noise robustness through targeted sample mixing, 2025.
URL [https://arxiv.org/abs/2509.11265](https://arxiv.org/abs/2509.11265).
- Liu et al. (2024b)
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, Kush R. Varshney, Mohit Bansal, Sanmi Koyejo, and Yang Liu.
Rethinking machine unlearning for large language models, 2024b.
URL [https://arxiv.org/abs/2402.08787](https://arxiv.org/abs/2402.08787).
- Lukasik et al. (2020)
Michal Lukasik, Srinadh Bhojanapalli, Aditya Menon, and Sanjiv Kumar.
Does label smoothing mitigate label noise?
In *International Conference on Machine Learning*, pp. 6448–6458. PMLR, 2020.
- Maini et al. (2024)
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter.
Tofu: A task of fictitious unlearning for llms.
*arXiv preprint arXiv:2401.06121*, 2024.
- Merity et al. (2016)
Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher.
Pointer sentinel mixture models.
*arXiv preprint arXiv:1609.07843*, 2016.
- Mihaylov et al. (2018)
Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal.
Can a suit of armor conduct electricity? a new dataset for open book question answering.
*arXiv preprint arXiv:1809.02789*, 2018.
- Mireshghallah et al. (2023)
Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi.
Can llms keep a secret? testing privacy implications of language models via contextual integrity theory.
*arXiv preprint arXiv:2310.17884*, 2023.
- Muresanu et al. (2024)
Andrei Muresanu, Anvith Thudi, Michael R Zhang, and Nicolas Papernot.
Unlearnable algorithms for in-context learning.
*arXiv preprint arXiv:2402.00751*, 2024.
- Pang et al. (2025)
Jinlong Pang, Na Di, Zhaowei Zhu, Jiaheng Wei, Hao Cheng, Chen Qian, and Yang Liu.
Token cleaning: Fine-grained data selection for llm supervised fine-tuning, 2025.
URL [https://arxiv.org/abs/2502.01968](https://arxiv.org/abs/2502.01968).
- Papineni et al. (2002)
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu.
Bleu: a method for automatic evaluation of machine translation.
In *Proceedings of the 40th annual meeting of the Association for Computational Linguistics*, pp. 311–318, 2002.
- Pawelczyk et al. (2023)
Martin Pawelczyk, Seth Neel, and Himabindu Lakkaraju.
In-context unlearning: Language models as few shot unlearners.
*arXiv preprint arXiv:2310.07579*, 2023.
- Rafailov et al. (2023)
Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn.
Direct preference optimization: Your language model is secretly a reward model.
*Advances in neural information processing systems*, 36:53728–53741, 2023.
- Raffel et al. (2020)
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu.
Exploring the limits of transfer learning with a unified text-to-text transformer.
*Journal of machine learning research*, 21(140):1–67, 2020.
- Rowling (2023)
Joanne K Rowling.
*Harry Potter and the sorcerer’s stone*.
Scholastic Incorporated, 2023.
- Sakaguchi et al. (2021)
Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi.
Winogrande: An adversarial winograd schema challenge at scale.
*Communications of the ACM*, 64(9):99–106, 2021.
- Shi et al. (2024)
Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang.
Muse: Machine unlearning six-way evaluation for language models.
*arXiv preprint arXiv:2407.06460*, 2024.
- Singhal et al. (2023)
Karan Singhal, Shekoofeh Azizi, Tao Tu, S Sara Mahdavi, Jason Wei, Hyung Won Chung, Nathan Scales, Ajay Tanwani, Heather Cole-Lewis, Stephen Pfohl, et al.
Large language models encode clinical knowledge.
*Nature*, 620(7972):172–180, 2023.
- Staab et al. (2023)
Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev.
Beyond memorization: Violating privacy via inference with large language models.
*arXiv preprint arXiv:2310.07298*, 2023.
- Szegedy et al. (2016)
Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna.
Rethinking the inception architecture for computer vision.
In *Proceedings of the IEEE conference on computer vision and pattern recognition*, pp. 2818–2826, 2016.
- Team et al. (2023)
Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al.
Gemini: a family of highly capable multimodal models.
*arXiv preprint arXiv:2312.11805*, 2023.
- Thaker et al. (2024)
Pratiksha Thaker, Yash Maurya, Shengyuan Hu, Zhiwei Steven Wu, and Virginia Smith.
Guardrail baselines for unlearning in llms.
*arXiv preprint arXiv:2403.03329*, 2024.
- Touvron et al. (2023)
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al.
Llama 2: Open foundation and fine-tuned chat models.
*arXiv preprint arXiv:2307.09288*, 2023.
- Wang et al. (2023)
Lingzhi Wang, Tong Chen, Wei Yuan, Xingshan Zeng, Kam-Fai Wong, and Hongzhi Yin.
Kga: A general machine unlearning framework based on knowledge gap alignment.
*arXiv preprint arXiv:2305.06535*, 2023.
- Wang et al. (2024a)
Yaxuan Wang, Jiaheng Wei, Chris Yuhao Liu, Jinlong Pang, Quan Liu, Ankit Parag Shah, Yujia Bao, Yang Liu, and Wei Wei.
Llm unlearning via loss adjustment with only forget data.
*arXiv preprint arXiv:2410.11143*, 2024a.
- Wang et al. (2025a)
Yaxuan Wang, Quan Liu, Chris Yuhao Liu, Jinlong Pang, Wei Wei, Yujia Bao, and Yang Liu.
DRAGON: Guard LLM unlearning in context via negative detection and reasoning.
In *ICML 2025 Workshop on Machine Unlearning for Generative AI*, 2025a.
URL [https://openreview.net/forum?id=ET24oKP23c](https://openreview.net/forum?id=ET24oKP23c).
- Wang et al. (2024b)
Yuancheng Wang, Haoyue Zhan, Liwei Liu, Ruihong Zeng, Haotian Guo, Jiachen Zheng, Qiang Zhang, Xueyao Zhang, Shunsi Zhang, and Zhizheng Wu.
Maskgct: Zero-shot text-to-speech with masked generative codec transformer, 2024b.
URL [https://arxiv.org/abs/2409.00750](https://arxiv.org/abs/2409.00750).
- Wang et al. (2025b)
Yuancheng Wang, Dekun Chen, Xueyao Zhang, Junan Zhang, Jiaqi Li, and Zhizheng Wu.
Tadicodec: Text-aware diffusion speech tokenizer for speech language modeling, 2025b.
URL [https://arxiv.org/abs/2508.16790](https://arxiv.org/abs/2508.16790).
- Wei et al. (2021)
Jiaheng Wei, Hangyu Liu, Tongliang Liu, Gang Niu, Masashi Sugiyama, and Yang Liu.
To smooth or not? when label smoothing meets noisy labels.
*arXiv preprint arXiv:2106.04149*, 2021.
- Xiao et al. (2023)
Shitao Xiao, Zheng Liu, Peitian Zhang, and Niklas Muennighoff.
C-pack: Packaged resources to advance general chinese embedding, 2023.
- Xu et al. (2025)
Mingjie Xu, Andrew Estornell, Hongzheng Yang, Yuzhi Zhao, Zhaowei Zhu, Qi Xuan, and Jiaheng Wei.
Better reasoning with less data: Enhancing vlms through unified modality scoring, 2025.
URL [https://arxiv.org/abs/2506.08429](https://arxiv.org/abs/2506.08429).
- Yan et al. (2025)
Yibo Yan, Shen Wang, Jiahao Huo, Philip S Yu, Xuming Hu, and Qingsong Wen.
Mathagent: Leveraging a mixture-of-math-agent framework for real-world multimodal mathematical error detection.
*arXiv preprint arXiv:2503.18132*, 2025.
- Yao et al. (2024)
Yuanshun Yao, Xiaojun Xu, and Yang Liu.
Large language model unlearning.
*Advances in Neural Information Processing Systems*, 37:105425–105475, 2024.
- Ye et al. (2022)
Jiayuan Ye, Aadyaa Maddi, Sasi Kumar Murakonda, Vincent Bindschaedler, and Reza Shokri.
Enhanced membership inference attacks against machine learning models, 2022.
URL [https://arxiv.org/abs/2111.09679](https://arxiv.org/abs/2111.09679).
- Zellers et al. (2019)
Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi.
Hellaswag: Can a machine really finish your sentence?
*arXiv preprint arXiv:1905.07830*, 2019.
- Zhang et al. (2025a)
Chenlong Zhang, Zhuoran Jin, Hongbang Yuan, Jiaheng Wei, Tong Zhou, Kang Liu, Jun Zhao, and Yubo Chen.
Rule: Reinforcement unlearning achieves forget-retain pareto optimality, 2025a.
URL [https://arxiv.org/abs/2506.07171](https://arxiv.org/abs/2506.07171).
- Zhang et al. (2024a)
Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei.
Negative preference optimization: From catastrophic collapse to effective unlearning.
*arXiv preprint arXiv:2404.05868*, 2024a.
- Zhang et al. (2022)
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al.
Opt: Open pre-trained transformer language models.
*arXiv preprint arXiv:2205.01068*, 2022.
- Zhang et al. (2025b)
Yichi Zhang, Jinlong Pang, Zhaowei Zhu, and Yang Liu.
Evaluating llm-corrupted crowdsourcing data without ground truth, 2025b.
URL [https://arxiv.org/abs/2506.06991](https://arxiv.org/abs/2506.06991).
- Zhang et al. (2024b)
Yihua Zhang, Yimeng Zhang, Yuguang Yao, Jinghan Jia, Jiancheng Liu, Xiaoming Liu, and Sijia Liu.
Unlearncanvas: A stylized image dataset to benchmark machine unlearning for diffusion models.
*CoRR*, 2024b.
- Zhang et al. (2024c)
Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu.
To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images… for now.
In *European Conference on Computer Vision*, pp. 385–403. Springer, 2024c.
- Zhuang et al. (2024)
Haomin Zhuang, Yihua Zhang, Kehan Guo, Jinghan Jia, Gaowen Liu, Sijia Liu, and Xiangliang Zhang.
Uoe: Unlearning one expert is enough for mixture-of-experts llms.
*arXiv preprint arXiv:2411.18797*, 2024.

## Appendix

The Appendix is organized as follows.

- •
Section A: Presents the Broader Impacts and Limitations.
- •
Section B: Introduces the baseline methods compared in our experiments.
- •
Section C: Describes the evaluation metrics employed in the experiments.
- •
Section D: Demonstrates how we generate normal data using GPT-4o-mini.
- •
Section E: Details our experimental setup.
- •
Section F: Presenting our complete experimental results
- •
Section G: Outlines the extent to which we employ LLMs.

## Appendix A Broader Impacts and Limitations

### A.1 Broader Impacts

We propose an LLM unlearning method: SGA, that facilitates the removal of private, copyrighted, and offensive content that large models may have been exposed to during pre-training, thereby enhancing the safety and trustworthiness of LLMs. Moreover, we introduce a novel solution to mitigate the divergence issue inherent in the Gradient Ascent approach: incorporating the learning of customized safe information alongside the forgetting process. We observe that this not only strengthens the model utility after unlearning but also leads to significantly improved forgetting quality.

### A.2 Limitations

This paper argues that the optimal smoothing rate $r^{\ast}$ is highly dependent on the base LLM, the forget data, and the normal data, and that this theoretical optimum continuously evolves as model training progresses. Consequently, open questions remain as, whether dynamically adjusting the smoothing rate during the unlearning process could yield better results. These directions warrant further exploration in future work.

## Appendix B Baseline Methods

#### Gradient Ascent (GA) (Yao et al., 2024 ) .

Gradient Ascent (GA) is a simple baseline commonly adopted in machine unlearning. The key idea is to reverse the effect of
gradient descent by maximizing the prediction loss on the forget dataset $\mathcal{D}_{f}$.
This encourages the model to move away from knowledge associated with $\mathcal{D}_{f}$,
thereby approximating a model trained only on the retain set $\mathcal{D}_{r}$. The
objective is defined as:

$$ $\mathcal{L}_{\text{GA}}~=~-\frac{1}{|\mathcal{D}_{f}|}\sum_{(x_{i},y_{i})\in\mathcal{D}_{f}}\ell(x_{i},y_{i};\theta).$ (10) $$

#### Gradient Difference (GD) (Liu et al., 2024a ) .

Gradient Difference (GD) is another simple baseline for machine unlearning
. Unlike GA, which only maximizes the loss on the forget set,
GD combines two opposing objectives: minimizing the loss on the retain set
$\mathcal{D}_{r}$ while maximizing the loss on the forget set $\mathcal{D}_{f}$.
This dual objective encourages the model to preserve useful knowledge from
$\mathcal{D}_{r}$ while forgetting information specific to $\mathcal{D}_{f}$. The
composite loss is given by:

$$ $\mathcal{L}_{\text{GD}}~=~\frac{1}{|\mathcal{D}_{r}|}\sum_{(x_{r},y_{r})\in\mathcal{D}_{r}}\ell(x_{r},y_{r};\theta)~-~\frac{1}{|\mathcal{D}_{f}|}\sum_{(x_{f},y_{f})\in\mathcal{D}_{f}}\ell(x_{f},y_{f};\theta).$ (11) $$

#### KL Minimization (KL) (Maini et al., 2024 ) .

KL combines gradient ascent on the forget set $\mathcal{D}_{f}$ with a KL-divergence
regularization on the retain set $\mathcal{D}_{r}$. Specifically, the model is
encouraged to forget by maximizing the loss on $\mathcal{D}_{f}$, while its outputs
on $\mathcal{D}_{r}$ are constrained to stay close to the original (pre-unlearning)
model $M_{\hat{\theta}}$ through Kullback–Leibler divergence. The objective can
be formulated as:

$$ $\mathcal{L}_{\text{KL}}~=~-\frac{1}{|\mathcal{D}_{f}|}\sum_{(x_{f},y_{f})\in\mathcal{D}_{f}}\ell(x_{f},y_{f};\theta)~+~\frac{1}{|\mathcal{D}_{r}|}\sum_{x_{r}\in\mathcal{D}_{r}}\mathrm{KL}\!\left(h_{\hat{\theta}}(x_{r})\;\|\;h_{\theta}(x_{r})\right),$ (12) $$

where $h_{\hat{\theta}}$ and $h_{\theta}$ denote the output distributions of the
original and unlearned models, respectively.

#### Preference Optimization (PO) (Maini et al., 2024 ) .

PO modifies the model’s response
preferences by training it to output safe refusals (e.g., “I don’t know”)
for prompts in the forget set $\mathcal{D}_{f}$. To achieve this, an augmented
forget dataset $\mathcal{D}_{\text{IDK}}$ is constructed, where each input
from $\mathcal{D}_{f}$ is paired with a refusal response. The overall
objective combines the fine-tuning loss on the retain set $\mathcal{D}_{r}$
with a custom loss on $\mathcal{D}_{\text{IDK}}$:

$$ $\mathcal{L}_{\text{PO}}~=~\frac{1}{|\mathcal{D}_{r}|}\sum_{(x_{r},y_{r})\in\mathcal{D}_{r}}\ell(x_{r},y_{r};\theta)~+~\frac{1}{|\mathcal{D}_{\text{IDK}}|}\sum_{(x_{f},y_{\text{IDK}})\in\mathcal{D}_{\text{IDK}}}\ell(x_{f},y_{\text{IDK}};\theta).$ (13) $$

This encourages the model to retain performance on $\mathcal{D}_{r}$ while
learning to reject answering queries from $\mathcal{D}_{f}$.

#### Direct Preference Optimization (DPO) (Rafailov et al., 2023 ) .

Direct Preference Optimization (DPO) adapts the preference optimization
framework to the unlearning setting. Instead of comparing
human-preferred and less-preferred responses, DPO contrasts a safe refusal
completion $y_{e}$ with the original (to-be-forgotten) response $y_{f}$ under the
same forget prompt $x_{f}\in\mathcal{D}_{f}$. The objective encourages the model
to prefer $y_{e}$ over $y_{f}$, thereby enforcing targeted forgetting while
preserving overall utility. Formally, with inverse temperature $\beta$, the loss
is:

$$ $\mathcal{L}_{\text{DPO}}~=~-\,2\beta\;\mathbb{E}_{x_{f}\in\mathcal{D}_{f}}\Bigg[\log\sigma\!\Big(\beta\log h_{\theta}(x_{f},y_{e})~-~\beta\log h_{\theta}(x_{f},y_{f})-M_{\text{ref}}\Big)\Bigg],$ (14) $$

where $h_{\theta}$ denotes the model’s predictive distribution and $M_{\text{ref}}$
is an optional regularization term penalizing deviation from the original model.
A retention-regularized variant further adds supervised loss on $\mathcal{D}_{r}$
to maintain desirable knowledge:

$$ $\mathcal{L}_{\text{DPO-RT}}~=~\mathcal{L}_{\text{DPO}}\;+\;\mathcal{L}(\mathcal{D}_{r};\theta).$ (15) $$

#### Negative Preference Optimization (NPO) (Zhang et al., 2024a ) .

Negative Preference Optimization (NPO) focuses on suppressing undesired responses
by penalizing the likelihood of completions from the forget set $\mathcal{D}_{f}$. Unlike DPO, which contrasts preferred and dispreferred responses,
NPO uses only the dispreferred term, directly discouraging the model from producing
the original (to-be-forgotten) outputs. Formally, with inverse temperature $\beta$,
the loss is:

$$ $\mathcal{L}_{\text{NPO}}~=~-\,2\beta\;\mathbb{E}_{(x_{f},y_{f})\in\mathcal{D}_{f}}\Big[\log\sigma\!\big(-\beta\log h_{\theta}(y_{f}|x_{f})\big)\Big],$ (16) $$

where $h_{\theta}$ denotes the model’s predictive distribution. To preserve utility,
a retention-regularized variant further adds supervised training on $\mathcal{D}_{r}$:

$$ $\mathcal{L}_{\text{NPO-RT}}~=~\mathcal{L}_{\text{NPO}}\;+\;\mathcal{L}(\mathcal{D}_{r};\theta).$ (17) $$

#### Mismatch.

Mismatch extends the preference-optimization framework by introducing
randomly constructed text sequences (Yao et al., 2024). Similar to PO, it
minimizes the fine-tuning loss on the retain set $\mathcal{D}_{r}$, but
additionally incorporates a mismatch loss computed over a random
combination of responses $Y_{\text{rnd}}$. This encourages the model
to produce neutral outputs when exposed to random or irrelevant
continuations, thus reinforcing unlearning. The objective is:

$$ $\mathcal{L}_{\text{Mismatch}}~=~\frac{1}{|\mathcal{D}_{r}|}\sum_{(x_{r},y_{r})\in\mathcal{D}_{r}}\ell(x_{r},y_{r};\theta)~+~\frac{1}{|\mathcal{D}_{\text{rnd}}|}\sum_{y_{\text{rnd}}\in Y_{\text{rnd}}}\ell(x_{f},y_{\text{rnd}};\theta),$ (18) $$

where $Y_{\text{rnd}}$ denotes a set of randomly sampled responses
paired with forget prompts $x_{f}\in\mathcal{D}_{f}$.

#### LLMU (Yao et al., 2024 ) .

LLMU extends Gradient Ascent by incorporating two auxiliary
components: (1) random-completion unlearning using sequences generated from
forget prompts, and (2) retention regularization on normal retain data. The
objective encourages forgetting by maximizing loss on the forget set
$\mathcal{D}_{f}$, while simultaneously training on random completions
$\mathcal{D}_{\text{rand}}$ and aligning the model’s predictions on the retain
set $\mathcal{D}_{\text{normal}}$ with the original model through KL divergence.
Formally, the loss is:

$$ $\displaystyle\mathcal{L}_{\text{LLMU}}~=$ $\displaystyle-\,\frac{\varepsilon_{1}}{|\mathcal{D}_{f}|}\sum_{(x_{f},y_{f})\in\mathcal{D}_{f}}\ell(x_{f},y_{f};\theta)$ (19) $\displaystyle+~\frac{\varepsilon_{2}}{|\mathcal{D}_{\text{rand}}|}\sum_{x\in\mathcal{D}_{\text{rand}}}\ell(x;\theta)$ $\displaystyle+~\frac{\varepsilon_{3}}{|\mathcal{D}_{\text{normal}}|}\sum_{x\in\mathcal{D}_{\text{normal}}}\mathrm{KL}\!\left(h_{\hat{\theta}}(x)\;\|\;h_{\theta}(x)\right),$ $$

#### Task Vectors (Eldan & Russinovich, 2023 ) .

The Task Vector method constructs an unlearned model by explicitly
subtracting the adaptation direction on the forget set $\mathcal{D}_{f}$. Let $\theta_{o}$ denote the parameters of the original
model and $\theta_{\text{reinforce}}$ the parameters of the model
fine-tuned to overfit $\mathcal{D}_{f}$. The task vector is defined as
the difference $(\theta_{\text{reinforce}}-\theta_{o})$, and the
unlearned model parameters are obtained by reversing this direction:

$$ $\theta~=~\theta_{o}-(\theta_{\text{reinforce}}-\theta_{o}).$ (20) $$

This procedure moves the model away from the representation adapted
to $\mathcal{D}_{f}$ without requiring further optimization.

where $\varepsilon_{1},\varepsilon_{2},\varepsilon_{3}$ are weighting coefficients,
and $h_{\hat{\theta}}$ denotes the output distribution of the original model.

#### Who’s Harry Potter (WHP) (Eldan & Russinovich, 2023 ) .

WHP defines the unlearned model through a distributional
interpolation between the original model $\theta_{o}$ and the reinforced model
$\theta_{\text{reinforce}}$. For any input $x$, let $p_{\theta}(\cdot|x)$ denote the
token-level output distribution of the unlearned model. WHP adjusts this
distribution by subtracting a scaled task-adaptation direction:

$$ $p_{\theta}(\cdot|x)~=~p_{\theta_{o}}(\cdot|x)-\alpha\big(p_{\theta_{\text{reinforce}}}(\cdot|x)-p_{\theta_{o}}(\cdot|x)\big),$ (21) $$

where $\alpha$ is a tunable coefficient controlling the degree of forgetting.
This effectively pushes the model’s output distribution away from
$p_{\theta_{\text{reinforce}}}$ while retaining alignment with $p_{\theta_{o}}$.

#### FLAT (Wang et al., 2024a ) .

Forget data only Loss AdjustmenT (FLAT) is a loss
adjustment-based unlearning method that eliminates the need for retain data
or a reference model. Instead of applying direct gradient ascent on the
forget set $\mathcal{D}_{f}$, FLAT leverages $f$-divergence maximization
between a safe template response $y_{e}$ (e.g., a refusal or irrelevant answer)
and the original forget response $y_{f}$. For each forget sample $(x_{f},y_{f})$,
a paired template response $y_{e}$ is introduced, and the objective is:

$$ $\mathcal{L}_{\text{FLAT}}~=~-\,g^{\ast}\!\left(P(x_{f},y_{e};\theta)\right)~+~f^{\ast}\!\left(g^{\ast}\!\left(P(x_{f},y_{f};\theta)\right)\right),$ (22) $$

where $P(x,y;\theta)$ is the average token prediction probability of $y$
given $x$, and $g^{\ast}(\cdot)$ and $f^{\ast}(\cdot)$ are the optimal
variational and conjugate functions for the chosen $f$-divergence.
This formulation enables the model to learn from safe template responses
while forgetting undesired ones, achieving unlearning without sacrificing
overall utility.

## Appendix C Evaluation Metrics

### C.1 TOFU

#### Probability.

For each instance in either the retain or forget set, we compute the normalized conditional probability

$$ $P(a\mid q)^{1/|a|},$ $$

where $q$ denotes the input question, $a$ is a candidate answer, and $|a|$ is the token length of $a$.
In the real authors and world facts subsets, the dataset provides five candidate answers
$\{a_{0},\tilde{a}_{1},\tilde{a}_{2},\tilde{a}_{3},\tilde{a}_{4}\}$, where $a_{0}$ is the correct answer and each $\tilde{a}_{i}$ is a perturbed (incorrect) alternative.
The probability ratio is defined as:

$$ $\text{Probability}=\frac{P(a_{0}\mid q)^{1/|a_{0}|}}{\sum_{i=1}^{4}P(\tilde{a}_{i}\mid q)^{1/|\tilde{a}_{i}|}}.$ $$

#### Truth Ratio.

The truth ratio quantifies the model’s preference for perturbed answers.
It is computed as the geometric mean of the normalized probabilities of all perturbed answers $\{\tilde{a}_{1},\tilde{a}_{2},\ldots\}$ relative to the normalized probability of the paraphrased answer $\hat{a}$:

$$ $R_{\text{truth}}=\frac{\Big(\prod_{i=1}^{|A|}P(\tilde{a}_{i}\mid q)^{1/|\tilde{a}_{i}|}\Big)^{1/|A|}}{P(\hat{a}\mid q)^{1/|\hat{a}|}}.$ $$

In the real authors and world facts subsets, where paraphrased answers are not available, the original answer $a$ is used in the denominator.

#### ROUGE-L.

For all TOFU subsets, we report the ROUGE-L recall score (Lin, 2004) between ground-truth answers in the forget set and the model outputs after unlearning.

#### Model Utility.

Model utility is defined as the harmonic mean of nine scores, covering answer probability, truth ratio, and ROUGE-L recall across the retain, real authors, and world facts subsets.
A higher utility score reflects stronger overall performance.

#### Forget Quality.

Forget quality is evaluated using a Kolmogorov–Smirnov (KS) test that compares the distributions of truth ratios between the retained and unlearned models on the forget set.
A higher $p$-value supports the null hypothesis that the two distributions are statistically indistinguishable, indicating consistent behavior between the retained and unlearned models.

### C.2 Harry Potter

#### ROUGE-L.

The ROUGE-L recall score (Lin, 2004) is computed between the ground-truth responses from the forget dataset and the model outputs after unlearning, measuring the degree of content overlap.

#### BLEU.

The BLEU score (Papineni et al., 2002) is similarly calculated on the forget dataset, evaluating the lexical and semantic similarity between generated outputs and the original ground-truth responses.

#### Perplexity (PPL).

Text fluency and diversity are assessed using perplexity, which is computed on the Wikitext dataset (Merity et al., 2016) with the LM Evaluation Harness. Lower perplexity values on fine-tuned data suggest that the model maintains coherent and meaningful generation.

#### Zero-shot Accuracy.

Zero-shot evaluation is conducted on a diverse set of benchmark tasks, including BoolQ (Clark et al., 2019), RTE (Dagan et al., 2005), HellaSwag (Zellers et al., 2019), Winogrande (Sakaguchi et al., 2021), ARC-Challenge and ARC-Easy (Chollet, 2019), OpenBookQA (Mihaylov et al., 2018), PIQA (Bisk et al., 2020), and TruthfulQA (Lin et al., 2021).
The average accuracy across these tasks is reported as a measure of model utility after unlearning, with higher values indicating stronger generalization and preserved capabilities.

### C.3 MUSE NEWS

#### No Verbatim Memorization (VerbMem).

To assess whether the model has completely unlearned the target content, we evaluate verbatim memorization (*VerbMem*). This metric measures the similarity between the model’s continuation and the ground-truth continuation from the forget set, restricted to the first $l$ tokens of each sample. Following prior work, we use the ROUGE-L F1 (Lin, 2004) score as the evaluation metric:

$$ $\mathrm{VerbMem}(f,\mathcal{D}_{f})=\frac{1}{|\mathcal{D}_{f}|}\sum_{x\in\mathcal{D}_{f}}\mathrm{ROUGE}\big(f(x_{[:l]}),\,x_{[l+1:]}\big).$ (22) $$

#### No Knowledge Memorization (KnowMem).

Knowledge memorization (*KnowMem*) measures whether the model retains factual information about forgotten records. For each question–answer pair $(q,a)$ in the forget set $\mathcal{D}_{f}$, we compute the ROUGE score between the model’s predicted answer $f(q)$ and the ground-truth answer $a$, and then average across all samples:

$$ $\mathrm{KnowMem}(f,\mathcal{D}_{f})=\frac{1}{|\mathcal{D}_{f}|}\sum_{(q,a)\in\mathcal{D}_{f}}\mathrm{ROUGE}\big(f(q),\,a\big).$ (23) $$

#### No Privacy Leakage (PrivLeak).

Privacy leakage is evaluated via membership inference attacks (MIA), which leverage loss statistics to distinguish training examples (members) from non-training examples (non-members). Following prior work (Ye et al., 2022; Kumar Murakonda et al., 2021), we define the privacy leakage score as the relative change in AUC-ROC between the unlearned model and a retrained model:

$$ $\mathrm{PrivLeak}:=\frac{\mathrm{AUC}(f_{\text{unlearn}},\mathcal{D}_{f},\mathcal{D}_{\text{holdout}})-\mathrm{AUC}(f_{\text{retrain}},\mathcal{D}_{f},\mathcal{D}_{\text{holdout}})}{\mathrm{AUC}(f_{\text{retrain}},\mathcal{D}_{f},\mathcal{D}_{\text{holdout}})}.$ (24) $$

An ideal unlearning algorithm should achieve a PrivLeak score close to zero. Significant positive or negative deviations indicate under-unlearning or over-unlearning, respectively.

#### Utility Preservation.

Finally, we evaluate whether the model preserves its general capabilities after unlearning. This is measured on the retain set $\mathcal{D}_{r}$ by computing the knowledge memorization score:

$$ $\mathrm{UtilityPreservation}=\mathrm{KnowMem}(f_{\text{unlearn}},\mathcal{D}_{r}).$ (25) $$

## Appendix D Prompt for Generating Normal Data

For each benchmark, we employ GPT-4o-mini (Achiam et al., 2023) to generate three normal data instances corresponding to each forget data sample.

### D.1 TOFU

### D.2 Harry Potter

### D.3 MUSE NEWS

## Appendix E Experiments Setup

Following prior work (Maini et al., 2024; Eldan & Russinovich, 2023; Zhang et al., 2025a; Shi et al., 2024; Deng et al., 2025; Wang et al., 2024a; Yao et al., 2024), we adopt consistent experimental settings to evaluate our method and baseline approaches. All experiments are conducted on 8 NVIDIA A800 GPUs.

#### TOFU setup.

For all LLM unlearning methods, we follow prior work (Wang et al., 2024a; Deng et al., 2025; Maini et al., 2024) and set the batch size to 32, while adopting consistent learning rates across models.
Specifically, Phi-1.5B is fine-tuned for 5 epochs with a learning rate of $2\times 10^{-5}$ to obtain the original model.
Similarly, Llama2-7B and OPT-2.7B are fine-tuned for the same number of epochs using a learning rate of $1\times 10^{-5}$.
All models employ AdamW as the optimizer.
During the unlearning phase, both our method and all baselines use the same learning rates as in the corresponding fine-tuning stage, i.e., batch size is fixed to 32, with learning rate $2\times 10^{-5}$ for Phi-1.5B and $1\times 10^{-5}$ for Llama2-7B and OPT-2.7B.
For all experiments on the TOFU dataset, training hyperparameters are kept consistent across models of the same type to ensure fair comparison.

#### Harry Potter setup.

To illustrate the copyright removal task, we fine-tune all models on the complete Harry Potter series.
For the OPT-2.7B and Llama2-7B models, we adopt a learning rate of $1\times 10^{-5}$ with a batch size of 2,
using AdamW as the optimizer.
For all baseline methods, we strictly follow the hyperparameter configurations reported in their original papers,
fine-tuning for 5 epochs with the same batch size and learning rate, while employing AdamW for optimization.

#### MUSE-NEWS setup.

For the MUSE-News benchmark, we base our experiments on the official pre-trained models provided by the original authors(Shi et al., 2024), ensuring both reproducibility and consistency with prior work.

## Appendix F Complete Experimental Results

Here we present the results corresponding to all smoothing rates in our Harry Potter and MUSE-NEWS experiments.

### F.1 Harry Potter

| Base LLM | OPT-2.7B | Llama2-7B |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| Metric | FQ Gap($\downarrow$) | PPL($\downarrow$) | Avg. Acc.($\uparrow$) | FQ Gap($\downarrow$) | PPL($\downarrow$) | Avg. Acc.($\uparrow$) |
| Original LLM | 1.5346 | 15.6314 | 0.4762 | 3.6594 | 8.9524 | 0.5617 |
| Retained LLM | 0.0 | 14.3190 | 0.4686 | 0.0 | 8.7070 | 0.5599 |
| GA/SGA (r=0)* | 2.7301 | 1.0984e71 | 0.3667 | 0.4587 | 47.2769 | 0.5088 |
| KL* | 2.7301 | 16.1592 | 0.4688 | 0.4225 | 9.4336 | 0.5509 |
| GD* | 2.3439 | 16.1972 | 0.4690 | 0.5304 | 9.1797 | 0.4902 |
| Mismatch* | 1.4042 | 15.7507 | 0.4679 | 0.4647 | 8.9906 | 0.5593 |
| LLMU* | 2.4639 | 15.8398 | 0.4656 | 0.1985 | 9.0530 | 0.5503 |
| PO* | 2.1601 | 14.8960 | 0.4583 | 0.5124 | 8.8364 | 0.5532 |
| DPO* | 2.2152 | 16.8396 | 0.4621 | 0.2924 | 8.9597 | 0.5614 |
| NPO* | 1.2611 | 19.6637 | 0.4644 | 0.5151 | 9.0397 | 0.5609 |
| FLAT (Pearson)* | 1.4089 | 15.5543 | 0.4686 | 0.2265 | 8.9906 | 0.5580 |
| SGA (r=0.8) | 0.1346 | 6.0387e48 | 0.3607 | 0.2244 | 4.8322e26 | 0.4667 |
| SGA (r=0.4) | 0.1267 | 2.5595e48 | 0.3589 | 0.1566 | 5.385e29 | 0.5005 |
| SGA (r=0.2) | 0.2140 | 2.1745e34 | 0.3652 | 0.1563 | 6.0479e18 | 0.512 |
| SGA (r=-0.2) | 0 | 6.2700e72 | 0.3683 | 0.0761 | 28.9249 | 0.5421 |
| SGA (r=-0.4) | 0 | 6.8530e30 | 0.3876 | 0.5355 | 11.4885 | 0.5676 |
| SGA (r=-0.8) | 0.0043 | 1.3040e6 | 0.4497 | 0.4141 | 19.9494 | 0.5316 |
| SGA (r=-2) | 0.0084 | 6.7100e5 | 0.4532 | 0.350 | 18.67 | 0.5305 |
| SGA (r=-4) | 0.0171 | 1.5620e6 | 0.4599 | 0.4911 | 14.0364 | 0.5492 |
| SGA (r=-8) | 0.0289 | 1.9390e6 | 0.4442 | 0.4615 | 14.3302 | 0.543 |

### F.2 MUSE-NEWS

|  | VerbMem on $D_{f}$ ($\downarrow$) | KnowMem on $D_{f}$ ($\downarrow$) | KnowMem on $D_{r}$ ($\uparrow$) | PrivLeak |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Original LLM | 58.4 | - | 63.9 | - | 55.2 | - | -99.8 |
| Retained LLM | 20.8 | - | 33.1 | - | 55.0 | - | 0.0 |
| Task Vectors* | 56.3 | (✘) | 63.7 | (✘) | 54.6 | (✔) | -99.8 |
| WHP* | 19.7 | (✔) | 21.2 | (✔) | 28.3 | (✔) | 109.6 |
| GA* | 0.0 | (✔) | 0.0 | (✔) | 0.0 | (✘) | 17.0 |
| GD* | 4.9 | (✔) | 27.5 | (✔) | 6.7 | (✔) | 109.4 |
| KL* | 27.4 | (✘) | 50.2 | (✘) | 44.8 | (✔) | -96.1 |
| NPO* | 0.0 | (✔) | 0.0 | (✔) | 0.0 | (✘) | 15.0 |
| NPO-RT* | 1.2 | (✔) | 54.6 | (✘) | 40.5 | (✔) | 105.8 |
| FLAT (Pearson)* | 1.6 | (✔) | 0.0 | (✔) | 0.2 | (✔) | 26.8 |
| SGA (r=0.8) | 0 | (✔) | 0 | (✔) | 0 | (✘) | 0.2934 |
| SGA (r=0.4) | 0 | (✔) | 0 | (✔) | 0 | (✘) | -0.3772 |
| SGA (r=0.2) | 0 | (✔) | 0 | (✔) | 0 | (✘) | 0.4401 |
| SGA (r=-0.2) | 0 | (✔) | 0 | (✔) | 0 | (✘) | 0.6077 |
| SGA (r=-0.4) | 0 | (✔) | 0 | (✔) | 0 | (✘) | 1.8441 |
| SGA (r=-0.8) | 0 | (✔) | 0 | (✔) | 0 | (✘) | -8.2775 |
| SGA (r=-2) | 0 | (✔) | 0 | (✔) | 0 | (✘) | 10.2473 |
| SGA | 0 | (✔) | 0 | (✔) | 1.9498 | (✔) | 15.5700 |
| SGA (r=-8) | 0.7415 | (✔) | 0 | (✔) | 0 | (✘) | 12.8667 |

## Appendix G The Use of Large Language Models (LLMs)

In this paper, we employ large language models (LLMs) to assist us in grammar checking and polishing the manuscript. Additionally, we leverage GPT-4o-mini to generate the normal data required for our experiments, as detailed in Appendix [D](https://arxiv.org/html/2510.22376v1#A4).

## Peer Reviews

confidence: 3
contribution: 3
initial_rating: 4
presentation: 3
questions: See weaknesses
soundness: 3
strengths: - Paper is very well written. Especially, the authors provide proper backgrounds for LLM unlearning and also analyse the problem of existing methods well. This helps understanding the motivation of proposed method.

- Although it might be very simple, authors not just justify their arguments by providing empirical results but also by providing some theoretical analysis.
summary: This paper tackles the divergent collapse behavior of well-known technique 'Gradient Ascent' in fine-tuning based LLM unlearning field. The authors analyse the problem of existing methods and propose simple yet effective technique names as SGA. While doing so, they also provide simple theoretical analysis on why their method can handle those problems and extensive experiments on existing benchmarks.
weaknesses: - The authors claim that identifying suitable retain set is not feasible when they mention the limitations of the existing methods. I wonder how can we confirm that the generated normal dataset would be the 'suitable' retain set? Especially when we are just relying on the other LLMs which can not be assured that they are properly acting. 

- Looks like (3) and (1) is basically equivalent, but just different realisation of given objective. If so, will they yield same results if 'retain set' is properly selected? Also, (3) would fail as well if the generated data are not proper? This question doesn't necessarily need to be answered with experimental evidence.

- Looks like there are some mistakes in Tables. For example, (Table1, Phi-1.5B, R-RL) has 3 blue rectangles. Also looks like the improvement is quite marginal.

- Also I wonder what is the difference in computational complexity sense compared to existing methods since the given method uses additional LLM models.

---

confidence: 3
contribution: 3
initial_rating: 6
presentation: 3
questions: Please refer to my comments in Weaknesses section.
soundness: 3
strengths: - Overall, SGA is novel method that addresses GA’s instability in LLM unlearning. It tackles a key problem in LLM unlearning, improving forgetting-retention balance. The theoretical analysis of the optimal smoothing rate (r*) provides a useful mathematical framework.
- The paper is well-written and structured, with clear explanations and figures.
- Experiments are thorough across three diverse benchmarks with strong baselines, appropriate metrics, and ablation studies that support the method’s effectiveness.
- SGA consistently outperforms baselines, achieving strong Forget Quality without utility collapse, and ranks highly on privacy leakage metrics.
summary: The authors introduce a fine-tuning-based unlearning method called Smoothed Gradient Ascent (SGA) that mitigates divergence issues in gradient ascent (GA) by combining the forget example with K–1 “normal” examples through a generalized label-smoothing coefficient (r). Experiments on TOFU, Harry-Potter, and MUSE-NEWS datasets with LLMs show that SGA improves forget quality and reduces divergence compared to GA and related baselines.
weaknesses: - The authors identified the optimal smoothing rate (r*) as dynamic, but in practice it’s fixed during training. Furthermore, the results also show that the r* varies quite a bit across different smoothing rates and models, and some values even cause training to collapse. Have the authors explored methods that computes r* dynamically/periodically during training? Could it improve results?

- SGA relies quite a bit on normal data, which is generated either via embedding similarity or external models like GPT-4o-mini. Could this introduce biases or make the method overly dependent on these models? Also, generating and incorporating this normal data probably adds computational overhead. It would be helpful to quantify the costs involved to assess the method’s scalability. 

- While SGA outperforms the baselines, the paper doesn’t discuss why that's the case, especially compared to methods like KL that also use retain data. Further analysis like gradient dynamics or the contribution of normal data would help in understanding what drives the improvements and strengthen the overall contribution.

---

confidence: 4
contribution: 2
initial_rating: 4
presentation: 3
questions: Is line 187 mistakenly having minus on the first term?

Have the authors considered normalized gradient difference (without automatic learning rate is enough)? 

Is there an ablation study on the cost and effectiveness tradeoff about K? Can K=1 work?
soundness: 3
strengths: The idea is clear and makes sense if one only wants to unlearn some data from the trained model. The results are convincing as far as I can tell, especially the selection of models is sufficiently large and diverse. There is some originality in combining label smoothing, normal data generation, and gradient ascent.
summary: This work applies label smoothing to a batch of normal data and forgetting data, in order to improve the performance of gradient ascent in machine unlearning. Empirical experiments on 7B models and 3 datasets are presented, as well as some theory insights.
weaknesses: Overall, the quality of this work should be enhanced.

1. Retaining is too weak.

Machine unlearning is actually a multi-task problem: it's not only about unlearning, but also about retaining the utility. However, GA (and this SGA) is not good at retaining at all. SGA Table 1 has almost zero FQ that is not remotely comparable to retained model for llama2 and phi, which has 1.0 FQ. Also in Table 3,  KnowMem on Dr (↑) i.e. utility on retaining data is 1.94 whereas retained model is 55, Kl is 48.

2. Missing baselines

Related to the first weakness, I suggest the authors to pay more attention to Gradient Diff methods and compare to it in tables. Also maybe  build a smoothed gradient diff to really improve the retaining.

3. Theoretical analysis is too simple.

I found it obvious and not insightful when reading Section 4.2/4.3. For example, the authors state "a key reason why SGA effectively suppresses the divergence issue of GA is that it alters GA’s gradient ascent direction, preventing the model from updating purely toward maximizing the next-token loss on the forget set." This sentence can be applied to almost any unlearning method like Gradient Diff.

4. Efficiency concern

Using external models to generate K-1 normal data can be expensive, especially when K is large. In TOFU dataset, the normal data is actually the retaining data, so this SGA is similar to gradient diff but requires more retaining data per-step.

---

confidence: 5
contribution: 2
initial_rating: 4
presentation: 3
questions: See the weaknesses section. I will raise my score if the identified issues are resolved.
soundness: 2
strengths: - SGA is conceptually straightforward, lightweight, and easy to integrate into existing unlearning pipelines.

- Derives an interpretable formula for the optimal smoothing rate and connects it to the geometry of gradients.

- Valuates across three standard unlearning benchmarks with consistent gains in forgetting quality and model stability.
summary: The paper identifies the instability of Gradient Ascent (GA) in LLM unlearning and proposes Smoothed Gradient Ascent (SGA)—a simple yet effective modification inspired by generalized label smoothing. SGA mixes forget data with semantically related “normal” samples (generated or selected) through a tunable smoothing rate r, which stabilizes optimization and mitigates GA’s divergence while preserving model utility. Theoretical analysis derives a closed-form estimate for the optimal r, and experiments on TOFU, Harry Potter, and MUSE-NEWS benchmarks show consistent improvements over GA and competitive results against other baselines such as FLAT and NPO.
weaknesses: There are several weakness:

- Limited novelty in methodology. The use of label smoothing is not new to the unlearning literature. Prior work (e.g., [1]) has discussed how label smoothing can facilitate forgetting, albeit in image classification tasks. The paper should better acknowledge and cite such precedents, clarifying how this work extends those ideas to the LLM unlearning domain rather than presenting them as entirely novel.

- Computational overhead and practicality. The proposed method requires generating multiple synthetic “normal” samples for each forget instance to perform smoothing. This increases both training time and memory cost, as the model must perform roughly K additional forward and backward passes and accumulate corresponding gradients. I think this could be mitigated through online updates, such an approach may still impose a notable computational burden and make comparisons with simpler baselines (like GA) less fair. It would strengthen the work to include a cost analysis or to compare against methods such as DPO trained with the same generated data for a fairer baseline.

- Potential inconsistency in TOFU benchmark results. The reported Forget Quality (FQ) scores on TOFU appear low—around 0.006–0.09, whereas prior works (e.g., NPO’s original results) achieved values close to 1.0 under similar settings (1% forget split). It would be helpful to verify the experimental setup, metrics computation, or evaluation scripts to ensure consistency with benchmark standards.

> [1] Di, Zonglin, et al. "Label smoothing improves machine unlearning." arXiv preprint arXiv:2406.07698 (2024).


Decision: Reject