LLM Unlearning via Loss Adjustment with Only Forget Data
Authors: Yaxuan Wang
Jiaheng Wei
Chris Yuhao Liu
Jinlong Pang
Quan Liu
Ankit Shah
Yujia Bao
Yang Liu
Wei Wei
Venue: ICLR 2025 Poster (2025)
Keywords: LLM Unlearning
Responsible AI
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We introduce a novel Forget data only Loss AjustmenT method (FLAT), eliminating the need for retain data or a reference LLM for response calibration in LLM unlearning.

Abstract: Unlearning in Large Language Models (LLMs) is essential for ensuring ethical and responsible AI use, especially in addressing privacy leak, bias, safety, and evolving regulations. Existing approaches to LLM unlearning often rely on retain data or a reference LLM, yet they struggle to adequately balance unlearning performance with overall model utility. This challenge arises because leveraging explicit retain data or implicit knowledge of retain data from a reference LLM to fine-tune the model tends to blur the boundaries between the forgotten and retain data, as different queries often elicit similar responses. In this work, we propose eliminating the need to retain data or the reference LLM for response calibration in LLM unlearning. Recognizing that directly applying gradient ascent on the forget data often leads to optimization instability and poor performance, our method guides the LLM on what not to respond to, and importantly, how to respond, based on the forget data. Hence, we introduce Forget data only Loss AjustmenT (FLAT), a "flat" loss adjustment approach which addresses these issues by maximizing $f$-divergence between the available template answer and the forget answer only w.r.t. the forget data. The variational form of the defined $f$-divergence theoretically provides a way of loss adjustment by assigning different importance weights for the learning w.r.t. template responses and the forgetting of responses subject to unlearning. Empirical results demonstrate that our approach not only achieves superior unlearning performance compared to existing methods but also minimizes the impact on the model’s retained capabilities, ensuring high utility across diverse tasks, including copyrighted content unlearning on Harry Potter dataset and MUSE Benchmark, and entity unlearning on the TOFU dataset.

Published as a conference paper at ICLR 2025
LLM UNLEARNING VIA Loss ADJUSTMENT WITH ONLY FORGET DATA
Yaxuan Wang"! Jiaheng Weit
Chris Yuhao Liu' Jinglong Pang'
Quan Liu
Ankit Parag Shah Yujia Bao?
Yang Liu
Wei Wei
CCnttr for Advanced AI, Accenture The Hong Kong University of Science and Technology (Guangzhou)
Universitt of California Santa Cruz
ABSTRACT
Unlearning in Large Language Models (LLMs) is essential for ensuring ethical and responsible Al use, especially in addressing privacy leak, bias, safety, and evolving regulations. Existing approaches to LLM unlearning often rely on retain data or a reference LLM, yet they struggle to adequately balance unlearning performance with overall model utility. This challenge arises because leveraging explicit retain data or implicit knowledge of retain data from a reference LLM fine-tune the model tends to blur the boundaries between the forgotten and retain data, as different queries often elicit similar responses. In this work, we propose eliminating the need to retain data or the reference L.LM for response calibration in LLM unlearning. Recognizing that directly applying gradient ascent on the forget data often leads to optimization instability and poor performance, method guides the LLM what not to respond to, and importantly, how respond, based on the forget data. Hence, we introduce Forget data only Loss Adjustmen'T (FLAT), "flat" loss adjustment approach which addresses these issues by maximizing f-divergence between the available template answer and the forget answer only w.r.t. the forget data. The variational form of the defined f-divergence theoretically provides way of loss adjustment by assigning different importance weights for the learning w.r.t. template responses and the forgetting of responses subject to unlearning. Empirical results demonstrate that our approach not only achieves superior unlearning performance compared to existing methods but also minimizes the impact on the model's 's retained capabilities, ensuring high utility across diverse tasks, including copyrighted content unlearning on Harry Potter dataset and MUSE Benchmark, and entity unlearning the TOFU dataset
INTRODUCTION
The widespread integration of Large Language Models (LLMs) into daily applications has raised significant concerns regarding the trustworthiness such models. Their outputs may contain sensitive,
private, or illegal content (Karamolegkou et al. 2023 Patil et al. 2023), reflect societal biases (Motoki
let al. 2024 Yu et al. 2023). or provide harmful instructions Yao et al. 2023 [i et al.) [0044] Barrett al. 2023). In particular, for privacy concerns, regulations (Hoofnagle et al.. (019) have been introduced, requiring applications to support the deletion of information contained in training samples
upon user request. This has motivated research into machine unlearning (MU) (Cao & Yang 2015
Liu et al. 2024b Fan et al.) 2023 Di et al.) 2024 Liu et al. (024c), a critical process aimed at removing the influence of specific data points, data classes, or even higher-level data concepts from
trained models.
LLM unlearning (Eldan & Russinovich 2023 Yao et al. 2023 Liu et al. 2024c) part of a broader set of MU techniques aiming to make the unlearned model forget the knowledge specified in forget dataset, while preserving the model ability to accomplish tasks irrelevant to the unlearning target (Liu
"Wok done during Yaxuan Wang's internship Center for Advanced AI, Accenture.
Work mainly done at Center for Advanced AI, Accenture, corresponding to jiahengweiee @ hkust-gz.edd .dduu..
The code is available at htthttss://gthhti www./mmc/cccccco
Cttp//CSCC-RAAAA BACCCCRRAA/// FLT

---

Published as a conference paper at ICLR 2025
Table 1:
Comparison of different loss adjustment- based baselines terms of their requirement. Our
method relies solely on forget data and available template responses, without using the retain data or reference model for response calibration.
Baselines
Forget Data Retain Data Reference Model
Gradient Ascent (GA) (Maini ct al 2024a
X
Gradient Difference (GD) (aam et a. 2024a
KI. Minimization (KI.) Maini et al. 2024a
Preference Optimization (PO) (Mäini el al 2024a
Mismatch (Liu et al. 2024a
Direct Preference Optimization (DPO) [Ratailov et al.
2024
Negative Preference Optimization (NPO) (Zhang el al. 2024
Large Languuge Model Unlearning (LLMU) ) Yao al.
2023
FLAT (Ours)
X
ct al. 2024c Ji ct al.
2024). To achieve this, existing work can be categorized into three main streams of L.M unlearning approaches: input-basede data-based, and model-based methods. Input-based methods (Liu et al. 2024a] [Pawelezyk et al. 2023) design input instructions to guide the original LLM
towards the unlearning objective without altering the model's parameters. Data-based methods (Choi et al. 2024) typically fine-tune models on pre-constructed desirable responses, using prompts from the torget data distribution. Model-based methods (ao al. 2023 Chen Yang 2023) focus on
modifying the weights or architecture to achieve the unlearning objective. Among these approaches, the most relevant to our work is fine-tuning the target LLM using a modified loss function, which typically incorporates two key objectives: maximizing the loss on the forget samples and minimizing (or maintaining) the loss on the retain samples.
However, as summarized in Table [ current loss adjustment-basee methods either rely on retain
2022; Yao et al. 2023), which might not readily available in real-world scenarios (Li et al. (2224) or utilize reference model (Rafailov et al. 2024 Zhang et al.
data (Maini et al. 2024a Liu et al.
2024 Yao et al. 2023] Maini et al.
2024a) to maintain performance on the retain dataset, incurring additional cost during traiming especially when fine-tuning large-scale LLM. Moreover, leveraging
explicit retain data or implicit knowledge from a reference LLM during fine-tuning may blur the
distinction between the forget and retain data, which lead to a trade-off between model utility and forget quality. Furthermore, fine-tuning using both retain data and forget data would require a careful design of data mixing strategy. To preserve model utility while improving forget quality, we propose Forget data only Loss Adjustmen'T (FLAT), a "flat" loss adjustment approach which adjusts the loss function using only the forget data. Given the forget data, FLAT guides the LLM not only in what to forget but also in how to respond, by optimizing the f-divergence between the template and forget answers with respect to the forget data. The variational form of the /-divergence enables loss adjustment by assigning optimal importance weights to learning from template responses while forgetting the responses subject to unlearning. Our main contributions are highlighted below:
We identify the potential drawback of relying on retain data reference LLM to guide LLM unlearning. To address this, we propose FLAT, which facilitates LLM unlearning without requiring retain data or a reference LLM for response calibration.
FLAT optimizes the f-divergence between template and forget responses guide the LLM through the unlearning process. The variational form of f-divergence optimization provides a clear illustration of how to optimally balance forget quality and model utility, with theoretical guarantees.
Extensive experiments on three unlearning tasks, including copyrighted content unlearning on the Harry Potter dataset and MUSE benchmark, well entity unlearning on the TOFU dataset, demonstrate the superior performance our method, achieving both high unlearning efficiency and strong overall model utility.
2 PRELIMINARIES
In this section, we introduce the preliminary formulation of LLM unlearning and existing LLM unlearning framework.
2

---

Published as a conference paper at ICLR 2025
2.1 FORMULATION
Given an forget dataset D,, a retain dataset D,, and an LLM O.. the task of LLM unlearning is to fine-tune the original model such that the updated LLM resembles model trained without Dj. For a prompt-response pair (Ir, y), the loss function on y for fine-tuning is L(x, y;; 0) EM ((ha (z, V<i), yt), where E(-) the entropy loss, and h0(2, y<s) := P (z. y<:);: is the predicted probability of the token Yi given by an LLM A, with the input prompt z and the already generated tokens yez = (y.......... -/
The most straightforward approach to unlearn is Gradient Ascent (GA). GA modifies trained model so that it "forgets" or minimizes the influence of specific data or patterns it has previously learned. Mathematically. the GA algorithm iteratively updates the model at step & by performing gradient ascent on the next-token prediction loss over the forget dataset: 0c+1 + O2 + ((x, y; 0z), where À is the (un)learning rate.
2.2 EXISTING LLM UNLEARNING PARADIGM
The mainstream class of existing LLM unlearning methods involves fine-tuning the original LLM against an unlearning objective function. Although the exact designs vary, the general type of loss adjustment in LLM unlearning can be characterized as follows:
= LPG + LRT + LCustom
(I)
The modified loss function comprises three main components:
LrG (Forget Loss): Encourages the model "forget" the undesired data or patterns. This typically involves increasing the loss on the data to be forgotten, effectively making the model perform worse on those specific examples. The goal is reduce the model's reliance on these data points, thereby minimizing their influence on future predictions.
TRT (Retain Loss): Ensures that the model maintains its overall performance and general knowl- edge on unaffected data. It typically involves using the original loss function from training modified version that focuses on the data the model is meant to retain. This term prevents the unlearning process from degrading the model's overall capabilities beyond the scope of the specific unlearning objective.
CCustom (Custom Loss): Allows for additional flexibility and customization in the unlearning process. It may include regularization terms to control the magnitude of parameter updates or specific constraints to enforce certain unlearning behaviors. This component enables researchers to tailor the unlearning process to specific requirements or incorporate domain-specific knowledge.
In summary, common loss adjustment methods employ one (Jang et al. 2022), two (Liu et al. 2022 Maini et al. 2024a Zhang et al., 2024),, or all three (Yao et al., 2023) of these components to guide the model towards forgetting specific data while minimizing the impact its overall performance and utility. The interplay between these terms allows for controlled and targeted unlearning, ensuring the model retains its valuable capabilities while selectively forgetting undesired information. More detailed formulations of these loss adjustment-based methods, along with related work, are deferred to Appendix C.I and Appendix E
An Example: Large Language Model Unlearning (LLMU). We adopt popular approach in LLM unlearning, LLMU (Yao et al. 2023), to interpret a special case of Eqn. (.. Specifically, the objective of LLMU contains three components: the Unlearn Harm Lrg, the Maintain Performance LRT, and the Random Mismatch LRandom (the custom loss). The training objective as follows:
LIMMU LvG LRT + LRandom:
The forget loss LIG - -EEE, L(x 0y; where (z,, indicates the forget data pairs from the forget dataset Dy. is the updated unlearned model. It is actually the Gradient Ascent loss to forget the samples subject to unlearning. The retain loss LRT E(E.Y.) Σ IIvel KL (Ir,, Urre))]/ho(s Br<s)), where KT(-) is the KL divergence term, (xy,, Ur) indicates the retain data pairs from the retain dataset D,, 0, is the original model, and O is the updated model. The random loss LRandom (Eyr,)),, |Yenu Σ Ey EYrin L(x Urdni 0). Here, Yran is a of random responses that do not have connection to the forget prompts s.
3

---

Published as a conference paper at ICLR 2025
3 METHOD
In this section, we introduce Forget data only Loss AjustmenT (FLAT), a "flat" loss adjustment approach which adjusts the loss function using only the forget data, by leveraging f-divergence maximization towards the distance between the preferred template and original forget responses. We first derive the formulation of our method via f-divergence maximization ($ B.1). followed by the presentation of the empirical alternative to our approach ($ (32).. In section $ we explore the estimation gap between the theoretical and empirical f-divergence. Finally, we discuss the connection
between our method and DPO ($ 3.4.
3.1 LOSS-ADJUSTMENT VIA /DIIVERGENCE MAXIMIZATION
For each learning batch, we assume that we only have cess to a set of forget samples (z),ys) Dy. Instead of di- rectly adopting gradient ascent over these forget samples, we propose to maximize the diver- gence between exemplary and bad generations of forget data. Key steps are summarized as be- low.
Table 2: faivs, optimal variational g (g') conjugate functions (f*).
Name
g*(o)
domy-
f"(()
1
1
Total Variation
2
tanh v
u E
2
2
u
Jensen-Shannon
log
u
< log 2
log (2 cm))
1
1
Pearson
R
4 u1a
KI.
e d-1
Step 1: Equip example/template responses ye for each forget sample xy. Together we denote the paired samples as {(r)), v2) JE(].
This could be done by leveraging open-souree LLMs such as Llama 3.1 (ubeyy al., 2024) or self-defining the responses according to our wish, etc. The designated unlearning response could be a reject-based answer such as don't know" (denoted as "IDK") or an irrelevant answer devoid of the unlearning target-related information.
Step 1 generates example responses for LLM fine-tuning and provides better instruc- tions on what LLM should respond given the forget data. Besides, certain existing methods make LLM generate hallucinated responses after unlearning, which further illustrates the importance of example responses for LLM unlearning.
Motivation:
Step 2: Loss adjustmens w.r.t. the sample pairs (xy, Ves us) through:
Ma ye, Uy; 0) >e- Le( Mei 0) >y LL 0),
(2)
where L,g L.y are losses designed for the data sample (xr ye) and Uy)) respectively. The corresponding closed form will be introduced Section 33.2
Motivation: Step 2 encourages the LLM forget the forget data with bad responses, meanwhile, learn to generate good responses on relevant forget data. [such as template answers]
Step 3: How to decide on the values of X and Xy? We leverage f-divergence illustrate the appropriate balancing between Le Ye: 0) and [ yy: 0). Assume Ff, is generated by the random variable X,, Y. jointly following the distribution D.. Similarly, zf. Uy is given by X,, Y, and (X,,Y,) Dy. Step shares similar insights if we are maximizing the divergence between D. and D,. Our theoretical purpose is to obtain the model that maximizes the f-divergence between D. and Dy, defined as (D.ll
The variational form f-divergence Instead of optimizing the fase term directly, we resolve to the variational form of it. Due to the Fenchel duality, we would have:
faso (D.l(D)) sup [Ez,DD lg( EZ,nD, (g(, == sup VA(A, g).
(3)
we define fr as the conjugate function of the f-divergence function. Here, Z, takes (I ye: 8) as input and estimates the "loss" between the model's response to 2 and the target ye. ye- Mathematically, this corresponds to the discrepancy between 0(x,) and Ve- where ((x,) represents the answer generated by the L.M parameterized by given prompt v... Similarly, 2, estimates the "loss"
4

---

Published as a conference paper at ICLR 2025
for (æy, ur,, 0). We will provide the empirical estimation for Eqn. (3) in the next section. For simplicity, we define VA 9²) := sup, VA(0, 9). where 9" is the optimal variational function. Hence, the objective of FLAT is to obtain: 0" == arg max, VA(0,g"))
Note that existing solutions fail to keep good balance between model performance forget data and retain data, step provides formal theoretical framework of loss revision in Step 2, under the f --divergence maximization between De and D, the method assigns the appropriate weights (-) (f*)))((f()))))) w.r.t the joint data distributions De, D..
Motivation:
3.2 EMPIRICAL. ALTERNATIVE OF LOSS ADJUSTMENT
Note that Eqn. could viewed data distribution level loss adjustment, in practice, when given access to set of forget data well example and bad answers, z,,, Ve. Vf. the per-sample loss function (closed form of Eqn. would be given by
L Mes Msi 0) sup (o(P 0)) - (((((())))))))
9 (P(z ve: 0)) (P((
(4)
We provide examples of f-divergence functions in Table along with their conjugate and variational functions (Nowozin et al. 2016 Wei & Liu 2021 We illustrate via following examples.
Example Total-Variation For Total-Variation (TV), an example of f-divergence, ('(w)
u. (v) = tanh (e) hence, g" (PP((, ( 0)) (g" (P(ry, (P((r My;
tanh (F(r)1me10) tanh (F(r)
We defer examples of other f-divergence functions the Appendix B.T
How to estimate P(Z Mei P(T
We define the following two quantities:
= Σ Mel ((Mo(I),Be.e)) = ye.s) P(a,,,9;0) = El' P(Ma(Iy, = Mr.))
Mel
lysl
Here, ye, and yy denote the i-th token in the samples ye and yy. respectively, while ye,ci and Vf.ci represent the already generated tokens. |ye and lyyl are the lengths of the example response Ye and the forget response yf, respectively. Given a prompt and the previously generated tokens, P(Ma(Ij, (e, ve)<s)= x)== = ye,a) and P(Ma(IJ,, My,<s) Vs,a) are the probabilities of correctly predicting the next token, where Ma(rr,,e,eee. ve,<i), and Mo(r,, UF,<i) are the predicted token using LLM 0 given input prompt z and the already generated tokens ye.<i and yf,ci- These two quantities represent the average probabilities of correctly generating tokens for the template and forget responses, respectively. To align Eqn. (4 with Eqn. ( we could define A Xy = 1, L. (2 Yai 0) == -0p0ggg(P Ne: f)).
and ( Uf: = - (g (P(5 Ur: O))).
3.3 THE UPPER BOUND OF THE ESTIMATION GAP
To connect the empirical alternative of FLAT with the corresponding theoretical format, in this section, we aim to explore the estimation gap between the theoretical f /'diivergence (av and the empirical optimal estimated f diveergee (Di DD)) here we define:
De
faio D. (D) = Ez,~ [0 [z)] E2,=D, (o(z)))
where ğ = g E2, D. D. lg Z.)] B2 [f (g(Z,))) and T is the function space.
Assumption 3.1 (Bounded Density Ratio). The density ratio Ze/Z, is lower and upper bounded by positive constants a and b. respectively.
Assumption 3.1 is wildely adopted by the literature (Suzuki et al. 2008 Nguyen et al. 2010), which necessitates that the probability density functions Ze, Z, share the same support.
"To clarify, we introduce the negative sign on the r.h.s. because loss function is commonly combined with the minimization task, while method is formulated maximizing the
f-ddin f-divergence.
5

---

Published as a conference paper at ICLR 2025
Assumption 3.2 (Regularity of Divergence Function). f()) is smooth (a, bl, and f(1) = 0. is Ho-strongly convex, and has Lo-Lipschitz continuous gradient on [a, b), for positive constants Pos Lo.
Assumption 3.2 is mild condition since it only requires the condition to hold for the interval [a, b), which works for many commonly used f-divergence functions, i.e., KL divergence.
Let (V, ||_.) be normed space, and & V. "i,.... vC is d-covering C C (1; 8) where (v;, 6) is the 5-ball centered at e4. The covering number is then defined as C2 ①) = min(C: 36-covering over o of size C}. The following assumption would characterize the representation power of the function space 4.
& of size C/ if
Assumption 3.3 (Order of Covering Number). C2(ô, 2) (( (T)pp(6)))))) T*),, and r&p (0,
suppose 9 E D with probability 2 1 - e N
Theorem 3.4. Given Assumptions 3.1 3.3
we have: fas (DellD)) - fase De (Dr) 3 N + where we have defined N as the number of samples in the forget data.
Theorem 3.4 illustrates that the empirical alternative of FLAT, (Del Dy), achieves the optimal non-parametric rate of convergence towards (Del(DD)
3.4 CONNECTION WITH DPO
In this section, we discuss the connection and key differences between our approach and the celebrated Direct Preference Optimization (DPO) Rafailov et al. (2024) approach for aligning LLMs.
Given dataset D = {<r)), v2. 1 jEINY' where Ye and // are preferred template and original forget responses to the forget prompt vy, DPO (Rafailov et al. 2024) fine-tunes original model 0, using D to better align it with good answer preferences, which minmiizs::
L (0)
-
2 - ED
log ( (log
Taeye | 22)) Tres (ye xz)) B blgg To y xz))
Kres (y/ xry)
Ivel
18y1
2 En loog [(log
II Tho Ve. log II ho Ur. (1.))) -
8
<ml
where, (t)) = 1te- is the sigmoid function, B > 0 is the inverse temperature, To =
1
Ill ho(x, Vei) is the predicted probability of the response y to prompt x given by LLM f, Tref the predicted probability given by reference model, and Mref Blog [1!"-]
| he, (x (eff.Ve.) Ve,s)
log [1 he, (1)) As for FLAT, we calculate the average probability of all correctly generated tokens and employ novel re-ieighting mechanism that assigns different importance each term using distinct activate functions for both the example and forget loss terms, which minimizes:
Iial
(()
ED -RD
ho vr,)))
Ve
VF
Here, ((),)(((())) are the activate functions that assign appropriate weights to each loss term. The detailed derivation is in Appendix B.22 The key differences are highlighted in red. Specifically, DPO relies a reference model to guide the unlearning process, whereas FLAT only uses sample pair dataset containing both exemplar and forget responses. Besides, our solution differs from DPO in three critical aspects: the re- weighting activation function, whether losses, and whether to apply the logarithm to the output probability. We conduct an ablation study with DPO evaluate the effectiveness of the proposed re-weighting mechanism in Section $ 4.5
average the token
EXPERIMENT
In this section, we compare the proposed method with baseline unlearning methods on three widely used LLM unlearning tasks: copyrighted content unlearning on Harry Potter (HP) Series Book (Yao)
et al. 2023) ($ 4.2), entity unlearning TOFU dataset (Maini et al. 2024a) (S 4.3). and unlearning
on MUSE-New benchmark (Shi et al., 2024) ($ 4.4). We conduct additional ablation studies to
assess the effectiveness of our methods in Section

---

Published as a conference paper at ICLR 2025
4.1 BASELINE METHODS
We evaluate the effectiveness of our proposed method FLAT by comparing it to a series of strong
LLM unlearning baselines, particularly those based loss adjustment. We consider Gradient Ascent (GA) (Jang et al. 2022 Yao et al., (023), KL minimization (KL) (Maini et al. 2024a),
GradDiff (GD) (Liu al. 2022). NPO (Zhang
al.) (024), and Mismatch (Liu et al.) 2024a)
across all three tasks. For copyrighted content and entity unlearning, we also include Preference
Optimization (PO) (Maini et al.
2024a). Large Language Model Unlearning (LLMU) Yao et al.
2023), and DPO (Rafailov et al. 2024). For the MUSE-NewS benchmark, we additionally consider Task Vectors (Ilharco et al. 2022). Who's Harry Potter (WHP) (Eldan & Russinovich] (023) and an extended version of NPO (NPO-RT) as a comparable method, which incorporates fine-tuning term on the retain dataset. Further experiment details are provided in Appendix C.1
4.2 COPYRIGHITED CONTENT UNLEARNING
Experiment Setup. We select Harry Potter and the Sorcerer's Stone (Rowling, 1997) as the copyrighted content for unlearning. The objective is to ensure that the unlearned model does not generate passages with high similarity to the original text. Following prior works (Liu et al.) 2024a; Yao et al.) (023). we first fine-tune L.MSs on the corresponding corpus, treat- ing it as the model subject to unlearning, while using the original pre-trained checkpoint as the retained modef] Following Yao et al. (2023); Jia et al. (2024), We extract 400 chunks from the Harry Potter book se- ries dataset (Eldan & Russinovich] 2023), with each chunk containing up to 512 tokens, to create the for- get dataset D,- We sample 400 paragraphs in the C4 dataset (Raffel et al. 2020) as the retain data D,..
Table 3: Performance of our method and the base- line methods on Harry Potter datasct using OPT- 2.7B. FLAT consistently ranks in the top two in terms of similarity to the retained model, measured by Forget Quality Gap (FQ Gap), while also gener- ating meaningful and diverse outputs, reflected by perplexity (PPL) and the average zero shot ac- curacy across nine LLM benchmarks (Avg. Acc.). The top two results across three main metrics are highlighted in blue.
Metric
FQ Cap(.)
PPL(.)
Avg.Acc.(1)
Original LLM
1.5346
15.6314
0.4762
Retained LLM
0.0
14.3190
0,4686
GA
2.7301
1 1,0984c71
0.3667
KL.
2.7301
16.1592
0.4688
GD
2,3439
16.1972
0,4690
The IDK dataset comes from Jia et al. (2024). We
Mismatch
PO
2.1601
1,4042
14,8960
15,7507
0,4679
0.4583
experiment with DB Zhang et al. 2022) and
LLMU
2.4639
15. 15.8398
0.4656
Llama2-7B Touvron et al. 2023) for this task.
DPO
2,2152
16.8396
0.4621
NPO
1.2611
19.6637
0,4644
Evaluation Metrics. We report three key metrics to assess the unlearning efficiency and model utility of the unlearned models. For unlearning efficiency, we use the Forget Quality Gap (FQ Gap), similar to Liu eet al. (2024a). which is the sum of the BLEU Gap
FLAT (TV)
1,4047
15.5512
0.4681
FLAT (KI.)
1,3238
15.5311
0.4694
FLAT (IS)
1,4025
15.5499
0.4693
FLAT (Peasson)
1.4089
15.5543
0.4686
and ROUGE-L Gap. is the absolute difference between the retained model and the unlearned model on these metrics. Specifically, we calculate BLEU (Papineni et al. 2002) and ROUGE-L (Lin 2004) scores by comparing ground-truth excerpts with completions generated by the unlearned model, given a fixed prefix length of 200 tokens from the forget data, reflect potential copyright content leakage. We further conduct study on the prompt length for evaluation in Appendix D.I Following (Ji et al. (2024), we measure the model utility using the zero-shot accuracy on nine standard LLM benchmarks to determine if the generated text remains meaningful and diverse. Additionally, we measure perplexity (PPL) on Wikitext (Merity et al. (0166). More details about the experimental setup and implementation are in Appendix
FLAT consistently ranks in the top two across three metries. Table 3 shows that FLAT ranks in the top two across the three primary metrics, with particularly strong performance in KL f-divergence function. Our method achieves scores close to those of the retained model in terms of the average accuracy across nine LLM benchmarks.
FLAT approach achieves good trade-off. Our method demonstrates strong unlearning efficiency while preserving model utility as shown in Table 3 Although NPO demonstrates the best forget quality, outperforming our method, severely suffers from lower model utility, as reflected by its PPL score. PO, while also using example responses, has the lowest PPL and a weak forgetting
We empirically verified that the initial LLM cannot generate the original corpus, making it a valid candidate for retrained model.
7

---

Published as a conference paper at ICLR 2025
Table 4: Performance of method and the baseline methods TOFU dataset using three base LLMs, Llama2-7B, Phi-1.5B, and OPT-2.7B. FQ, MU. R-RL, F-RL represent forget quality, model utility, ROUGE-L on retain dataset and ROUGE-L on forget dataset respectively. We include the original LLM and retain LLM for reference. The top two results are highlighted in blue.
Base L.I
1Jama2-78
Phi-1155
OPT-2.78
Metric
FQ
MU
F-RL(
R-RL
EQ
MU
F-RL())
R R.RL
FQ
ML
F-RL())
R RL
Original LLM Retiied
4.4883c 06
0.6346
0.9851
0.9835
0.0013
0.5184
0.9607
0.9199
0.0013
0,5120
0.7537
0.7494
0.6267
0,4080
0.9833
0.5233
0.4272
0.9269
0.5067
0:4217
0.7669
GA
0.0143
0.6333
0.4862
0.9008
0.0013
0.5069
0,5114
0.8048
0.2657
0.46:99
0.4748
0.6387
K1.
0.0068
0.6300
0,5281
0.
0.0030
0.5047
0.5059
0.8009
0.0286
0.4775
0.4810
0.6613
GD
0.0068
0.6320
0,4773
0.8912
0.0050
0.5110
0.4996
0.84%
0.0541
0.4912
0.4521
0.6605
PO
0.8541
0.6308
0.3640
0.8811
0.0286
0.5127
0,3170
0.7468
0.0088
0.4424
0.0589
0.4015
Mismasch
0.0143
0.6304
0.9406
0.9741
0.5225
0.9612
0.9194
0.0030
0.5025
0.7525
0.7475
LLMU
0.0541
0.6337
0,4480
0.8865
0
0,5110
0.3058
0.7270
0.0286
0.3396
0.0347
0.2495
DIO
0.0541
0.6359
0.5850
0,8852
0.0521
0.0519
0.3437
0.7341
0.0511
0,1261
0,0806
0.3937
NPO
0.00688
0.6321
0.4652
0.8950
0.0030
0.3057
0,5196
0,8000
0.0541
0.4788
0,4993
0.6490
(IV)
0.0541
0.6373
0.4391
0.8826
0.0143
0.5168
0.4689
0.8155
0.0068
0.5086
0.5217
0.7067
FLAT
0,0286
0.6393
0.5199
0,8750
0.0143
0,5180
0.4524
0.7850
0.0286
0:0838
0.1942
0.6974
FLAT (SS)
0.0541
0.6364
0,4454
0,8864
0.0068
0,5144
0.4572
0.8117
0.0541
0.4959
0,4938
0,7013
FLAT (Pearson)
0.0541
0.6374
0,4892
0.8857
0.0143
0.5175
0.4591
0.8099
0.0068
0.5093
0,5052
0.7059
performance (FQ Gap). indicating the ineffectiveness of learning the example responses in a naive manner. These results highlight the effectiveness of our method in balancing forget quality and model utility, even without an explicit retaining term in the loss function. We also include additional results using Llama2-7B (Table 9 in Appendix D.1
4.3 ENTITY UNLEARNING
Experiment Setup. The TOFU dataset (Maini et al. 2024a) is a synthetic question-answering dataset focused on author biographies, aiming enable a LLM to unlearn portion of fictitious authors while retaining knowledge about the rest and real-world facts. The dataset includes 200 fake authors, each with 20 QA pairs, and experiments are conducted with 1,, 5% or 10% of these authors marked for unlearning. We first fine-tuned the target L.M using all dataset to obtain the original LLM. We use Llama2-7B, 1hi- (Li et al. 2023a), and OPT-2.7B as base LLM.
Evaluation Metrics. To assess forget quality and model utility, we mainly use two metrics proposed alongside the TOFU dataset, Forget Quality (FQ) and Model Utility (MU) (Maini et al. 2024a). Forget quality, assessed via p-value from Kolmogorov-Smirno test, measures how closely the unlearned model's ss output matches a model trained only on the retained data distribution. When the p-value is above 0.01, we say the forgetting is significant. Model utility is the aggregated model performance on held-out retain data regarding fictional authors, world author profiles, and world facts. We also report the ROUGE-L score on forget set and retain set. It's important note that for the forget set, lower ROUGE-L score does not necessarily indicate better performance. Therefore, we highlight methods where the ROUGE-L score closely matches that of the retained model, as these are considered to produce better results. More metrics can be found in Appendix C
FLAT is always the best in preserving model utility. As seen in Table it experiences almost no reductions in model utility compared to the original model. On LLaMA2-7B, although GA and KL achieve strong ROUGE-L scores on the retain dataset, their forgetting performance is poor. Similarly, on Phi-1.5B, GD performs well on the retain dataset's 's ROUGE-L score, but its forgetting performance insufficient, failing to exceed 0.01.
FLAT achieves the top two Forget Quality under all three models. FLAT achieves ROUGE score that closest to the Retained LLM on forget dataset under Llama2-7B and Phi- 1.5.1.5B. PO shows the best forgetting efficiency on Phi-1.5B, but its ROUGE-L scores on both the forget and retain datasets are lower compared to the retained L.M,, indicating weaker model utility. A similar issue is observed with GA: while it excels in forgetting performance on the OPT-2.7B model, its model utility remains weaker.
FLAT achieves the best trade-off. Our method consistently ranks in the top two across the primary metrics, achieving the best performance in MU. Specifically, KL f-divergence demonstrates strong results in both FQ and MU on LLama2-7B and Phi-1.5B models. Overall, all four f-divergence functions effectively balance forgetting efficiency and model utility. In summary. our method demonstrates the best model utility while achieving top-two results in forgetting performance.
8

---

Published as a conference paper at ICLR 2025
Table 5: Performace on MUSE benchmark using four criteria. We highlight results in blue if the unlearning algorithm satisfies the criterion and highlight it in red otherwise. For metrics on D,, lower values than the retained L.M are preferred and the lower the better. For metrics on Dr, as long as KnowMent is non-zero (indicating retained knowledge), higher values better. In terms of Privl.eak, the results should be close to O. Large negative or positive values suggest that they may cause privacy leakage.
VerbMem on D, (I) KnowMem on Dj ()) KnowMem on D, (t)
PrivLeak
Original LLM Retained LLM
58.4
63.9
55.2
-99.8
20.8
33.1
55.0
0.0
GA
0.0
0.0
0.0
(x)
17.0
KL
27.4
(x)
S0.2
(X)
44.8
-96.1
NPO
0.0
(V)
0.0
(
0.0
15.0
NPO-RT
54.6
40.5
105.8
Task Vector
56.3
(X)
63.7
(X)
54.6
-99.8
Mismatch
42.8
(X)
52.6
(X)
45.7
-99.8
GD
4.9
S
27.5
6.7
109.4
WHP
19.7
S 2255
21.2
28.3
S
109.6
FLAT (TV)
13.6
S
31.8
45.4
FLAT (KL)
0.0
0.0
0.0
58.9
FLAT (IS)
1.9
36.2
38.5
47.1
FLAT (Pearson)
0.2
26.8
4.4 MUSE-NEWS UNLEARNING
Experiment Setup. We focus on the task of unlearning on News corpus presented in Shi et al. (2024). News consists of BBC news articles (Li et al.] (2023)) collected after August 2023. All articles are randomly divided into forget, retain, and holdout sets. We perform unlearning directly on the pre-trained models provided by the benchmark, following the corresponding experimental setup.
Evaluation Metrics. We report the proposed four metrics, VerbMem on forget dataset, KnowMem on forget and retain dataset, and Privacy leakage (PrivLeak). We quantify the verbatim memorization VerbMem by prompting the model with the first / tokens from a sequence and comparing the continuation outputted by the model the true continuation using the ROUGE-L Fl score (Lin) 2004). We gather the model's 's answers to questions and then average the ROUGE scores for all question-answe pairs in forget dataset or retain dataset compute the knowledge memorization score KnowMem. The PrivLeak metric for a good unlearning algorithm should be close to zero, whereas an per/unnderuulleamiin algorithm will get large positive/neeative metric.
Experiment Results. FLAT effectively removes verbatim and knowledge memorization of forget dataset and achieve good knowledge memorization of retain dataset. But can still reveal the membership of D, in Dr. As shown in Table 5 GA, NPO, GD, WHP, and ours perform well in VerbMem and KnowMem on forget dataset, often reduing them even beyond the levels achieved by the retrained model. However, these reductions often come at the cost of significant utility loss on the retain set. Only GD, WHP and ours can perfome good in all memorization related metrics. And FLAT (TV) can achieve the lowest VerbMem and KnowMem among the three methods. However, none of the methods can achieve satisiable results regarding to the privacy leakage. Since MUSE uses news data, which is highly time-dependent (and thus possibly non-i.i.d.), we advocate for cautious interpretation of the PrivLeak metric (see Appendix C.4.I).
D, and the highest KnowMem
D,
4.5 ABLATION STUDIES
The Effectiveness of Re-weighting Mechanism. As FLAT (KI.) demonstrates strong overall performance, we base our ablation study on KL divergence to explore the effectiveness of the implicit re- re-weighting mechanism within our loss adjustment. This study is conducted on the TOFU dataset using Llama2-7B. For additional results from the ablation studies, please refer to Appendix D.3
When using preferred template data for unlearning, we compare our method with DPO (without the term My,r) and SimPO, as outlined in Appendix C.T All methods use the same data and have similar formulations, with two terms in the loss function; the only difference lies in the intrinsic ne-weighting mechanism. As shown in Table 6 our method achieves the highest number of best

---

Published as a conference paper at ICLR 2025
Table 6: Ablation Study of Re- Re-weighting Mechanism on TOFU dataset using Llama2-7B under all metrics. We report ROUGE-L score (R-L), Probability (P), and Truth Ratio (TR) on all four subsets the TOFU benchmark. Higher scores are better except ROUGE-L and Probability on the Forget Set. The best ones are in blue.
Split
Real Authors
Real World
Retain Set
Forget Set
Metric
R-I
TR
R-1.
TR
R-I.
TR
R-T-())
P(L)
TR
Study on Re- Re-weighting Mechaniem Using Template IDK Data
DPO
0.9350
0.4939
0.6384
0.8917
0.4631
0.5646
0,8852
0.9623
0.5407
0.5860
0.8734
0.6240
DPO w/o M
0,9330
0.4899
0.6333
0.8917
0,4620
0.5642
0.8735
0.9579
0.4388
0.4021
0.8149
0.6326
SimPO
0.9330
0.4002
0,635
0.8917
0.4634
0.5664
0.8758
0.9577
0.4388
0.4087
0.8128
0.6329
FLAT (KL)
0,9180
0.4992
0.6491
0.9060
0.4524
0,5609
0.8750
0.9679
0.4603
0.5199
0.7588
0.5895
Study on Re-weighting Mechanism Using Retain Data
GD) FLAT Rettiintain
0,9080
0.4728
0.6156
0.8718
014439
0,5833
0.8912
0:9655
0,4701
0.4773
0.4238
0.5619
0.9180
0.46413
0.6059
0,8832
0.4356
0.5690
0.9241
0,9734
0,4697
0.4487
0.3342
0.5879
Table 7: Ablation Study of Good Answer Type using three LLMs on TOFU dataset. FQ, MU, R-RL. F-RL represent forget quality, model utility, ROUGE-L on retain datasct and ROUGE-L on forget dataset respectively. The best performance in blue.
Spiit
Llama2-7B
Phi-1-5B
OP'--278
Metric
MU
F-RL(
R-RL
MU
R-RL
F-RL411
R-RL
Original LLM
4.4883e-06
0.6366
0.9651
0.0013
0.9291
0,0013
0.7537
0,4080
0.5233
0.9269
0/4217
FLAT (TV)-IDK
0.541
06633
0.4391
0.8826
0,0143
0.5168
0.4699
0.8155
0.0068
0.5086
0.5217
0,7067
0.5199
0.5180
0,7650
0.2212
(IS-IID
0.0441
0.6364
0.4454
0.8864
0.0068
0.5144
0.5722
0.8117
0.0541
0.4999
0.3104
0,5658
(Pearson) IDK
0.0541
0.4392
0.8857
0,0143
0.5175
0.4591
0.8099
0,0068
0.5093
0.5052
FLAT (TV) Nommal
0.0068
0.4941
0,0068
0.5194
0.4527
0.8245
0,0020
0.5096
0.5644
FLAT (KL)-Nomaal
0.0668
0.1622
0.4273
0.9719
1.008
0.5177
0.5377
0.8575
120020
0.50K2
0.5644
0.7474
FLAT (JS) Nocmal
0.0143
0.6175
0,4910
0,9500
030013
0.5058
0.5538
0.7313
0,0013
0.5068
0.5538
0,2513
FLAT (Peasso)-NNmmal
0.0068
0.6185
0,4972
0.9546
0.0000
0.5094
0.7343
0.0030
0.5094
0.5554
0.7343
results across 12 metrics. When replacing the IDK data with retain data, the results show that the retain version performs better on the Retain Set but worse on Real Authors and Real World compared to FLAT (KL). Since GD shares the same data usage and formulation as our method, except for the re- re-weighting mechanism and utilization of retain data, we compare the retain version to GD. The results show that our method achieves better performance both the Retain Set and Forget Set, with the decline in Real Authors and Real World performance caused by the use of retain data.
The Imapet of Good Answer Type. In the first step of our approach, we intend to generate good example responses for each forget sample. We primarily use the reject- based response "I don't 't know" (denoted as IDK) as the default choice. In this section, we conduct an ablation study data usage for FLAT to analyze how these good responses impact unlearning performance. Table 7 presents the ablation study of good answer type using three L.MS on TOFU dataset, comparing TDK with random normal responses (denoted as Normal). Table [4 in Appendix D.3 provides the ablation study of different good answer type using Llama2-7B on the HP dataset. Results indicate that using normal responses improves model utility on HP datasets and improves ROUGE-L Score on retain set on TOFU datasets, whereas using IDK responses yields better forgetting quality. Additionally, we observe that the performance across the four divergence functions is relatively similar. KL divergence, in particular, demonstrates more consistent results across the three datasets and three models, likely due to its reduced sensitivity to incorrect or bad answers.
5 CONCLUSION
In this paper, we address the limitations of existing LLM unlearning methods, which often rely on the retain data or a reference LLM for response calibration. To overcome these challenges, we propose FLAT (Forget data only Loss AdjustmenT), "flat" loss adjustment approach that eliminates the need for retain data or a reference model. By optimizing the f-divergence between the template and forget responses, FLAT offers a clear and theoretically grounded solution for balancing forget quality with model utility in LLM unlearning. Through extensive experiments on three key unlearning tasks: copyrighted content unlearning on the Harry Potter dataset, the MUSE benchmark, and entity unlearning on the TOFU dataset, we demonstrate the superior performance of FLAT. Our method consistently achieves high unlearning efficiency while preserving overall model utility, showcasing its effectiveness in addressing both practical and theoretical challenges in LLM unlearning.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGMENT
Wang and Y. Liu are partially supported by the National Science Foundation (NSF) under grants IIS-2143895, IIS-2040800, and IIS-2416896.
ETHICS STATEMENT
Our proposed approach emphasizes privacy and fairness by addressing potential data privacy concerns during unlearning procedures, particularly with sensitive datasets. We commit to ensuring that no private or proprietary data is mishandled during experiments, and all data used for training and evaluation are publicly available.
REPRODUCIBILITY STATEMENT
We provide details to reproduce our results in Section 4 and Appendix C. including our experimental setup, evaluation metries and implementation setting. Additionally, the code and scripts used in our experiments will be made publicly available upon acceptance. Any external libraries or dependencies required to reproduce the results are specified.
REFERENCES
Leonard Adolphs, Tianyu Gao, Jing Xu, Kurt Shuster, Sainbayar Sukhbaatar, and Jason Weston. The cringe loss: Learning what language not model. arXiv preprint arXiv:22/1 1.05826, 2022.
Clark Barrett, Brad Boyd, Elie Bursztein, Nicholas Carlini, Brad Chen, Jihye Choi, Amrita Roy Chowdhury, Mihai Christodorescu, Anupam Datta, Soheil Feizi, et al. Identifying and mitigating the security risks of generative ai. Foundations and Trends Privacy and Security, 6(1):1-52, 2023.
Alexander Becker and Thomas Liebig. Evaluating machine unlearning via epistemic uncertainty. arXiv preprint arXiv:2208. 10836 2022.
Nora Belrose, David Schneider-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman. Leace: Perfect linear concept erasure in closed form. Advances in Neural Information Processing Systems, 36, 2024.
Karuna Bhaila, Minh-Ha Van, and Xintao Wu. Soft prompting for unlearning in large language models. arXiv preprint / /008, 2024.
Yonatan Bisk, Rowan Zellers, Jianfeng Gao, Yejin Choi, et al. Piqa: Reasoning about physical commonsense natural language. Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 7432-7439, 2020.
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In 2015 IEEE symposium on security and privacy, pp. 463 480. IEEE, 2015.
Jiaao Chen and Diyi Yang. Unlearn what you want to forget: Efficient unlearning for 1lms. arXiv preprint arXiv:2310.20150, 2023.
Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang. Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 7766-7775, 2023.
Minseok Choi, Daniel Rim, Dohyun Lee, and Jaegul Choo. Snap: Unlearning selective knowledge in large language models with negative instructions. arXiv preprini arXiv:2406. 12329, 2024.
François Chollet. On the measure of intelligence. arXiv preprint arXiv: 190:::1111.00500 19t../971.//77,111111011 2019.
Christopher Clark, Kenton Lee, Ming-Wor Wei Chang, Tom Kwiatkowski. Michael Collins, and Kristina Toutanova. Boolq: Exploring the surprising difficulty of natural yes/no questions. arXiv preprint arXiv: 1905. 10044, 2019.
11

---

Published as a conference paper at ICLR 2025
Ido Dagan, Oren Glickman, and Bernardo Magnini. The pascal recognising textual entailment challenge. In Machine learning challenges workshop, pp. 177-190. Springer, 2005.
Zonglin Di, Zhaowei Zhu, Jinghan Jia, Jiancheng Liu, Zafar Takhirov, Bo Jiang, Yuanshun Yao, Sijia Liu, and Yang Liu. Label smoothing improves machine unlearning. arXiv preprint arXiv:2406.07698, 2024.
Yijiang River Dong, Hongzhou Lin, Mikhail Belkin, Ramon Huerta, and Ivan Vulić. Undial: Self- distillation with adjusted logits for robust unlearning in large language models, 2024. URL
https://arxis: wttp:/iiiv.ggg/b/////o// httgg//b///4222 10052
Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannaneh Hajishirzi. Do membership inference attacks work on large language models? arXiv preprint arXiv:2402.07841, 2024.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang. Angela Fan, al. The llama herd of models. arXiv preprint arXiv:2407.21788, 2024.
Ronen Eldan and Mark Russinovich. Who's harry potter? approximate unleariin in llms. arXiv preprint ar Xrii:23110.02.38, 2023.
Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela. Kto: Model alignment as prospect theoretic optimization. arXiv preprint arXiv:2402.01306 2024.
Chongyu Fan, Jiancheng Liu, Yihua Zhang, Dennis Wei, Eric Wong, and Sijia Liu. Salun: Em- powering machine unlearning via gradient-based weight saliency in both image classification and generation. arXiv preprint arXiv:2310. 23..::2310.1200 12508, 2023.
Chongyu Fan, Jiancheng Liu, Alfred Hero, and Sijia Liu. Challenging forgets: Unveiling the worst-case forget sets in machine unlearning. arXiv preprint arXiv:2403.07362 2024.
Chongyang Gao, Lixu Wang, Chenkai Weng, Xiao Wang, and Qi Zhu. Practical unlearning for large 2024.
language models. arXiv preprint
Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac'h, h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang. Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. A framework for few-shot language model evaluation, 12 2023. BtLhhtpss:/ wtw.e//www..orree.orrrr///030050
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9304-9312, 2020.
Laura Graves, Vineel Nagisetty, and Vijay Ganesh. Amnesiac machine learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 1 1516-11524, 2021.
Tianle Gu, Kexin Huang. Ruilin Luo, Yuanqi Yao, Yujiu Yang, Yan Teng, and Yingchun Wang. Meow: Memory supervised IIm unlearning via inverted facts. arXiv preprint arXiv:2409. /184, 2024.
Chris Jay Hoofnagle, Bart Van Der Sloot, and Frederik Zuiderveen Borgesius. The european union general data protection regulation: what it is and what it means. Information & Communications Technology Law, 28(1):65-95 2019.
James Y Huang, Wenxuan Zhou, Fei Wang, Fred Morstatter, Sheng Zhang, Hoifung Poon, and Muhao Chen. Offset unlearning for large language models. arXiv preprint 1044 2024.
Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannanch Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. arXiv preprint arXiv:2212. 2,0999 2022.
12

---

Published as a conference paper at ICLR 2025
Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou. Approximate data deletion from machine learning models. In International Conference on Artificial Intelligence and Statistics, pp. 2008-2016 PMLR, 2021.
Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks in language models. arXiv preprint arXiv:2210.01504, 2022.
Jiabao Ji, Yujian Liu, Yang Zhang, Gaowen Liu, Ramana Rao Kompella, Sijia Liu, and Shiyu Chang. Reversing the forget-retain objectives: An efficient Ilm unlearning framework from logit difference. arXiv preprint arXiv:2406. 08607 2024.
Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsification can simplify machine unlearning. arXiv preprint ar X3xx:2334404944, 2023.
Jinghan Jia, Yihua Zhang, Yimeng Zhang, Jiancheng Liu, Bharat Runwal, James Diffenderfer, Bhavya Kailkhura, and Sijia Liu. Soul: Unlocking the power of second-order optimization for I1m unlearning, arXiv preprint arXiv:2404.18233 2024.
Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Søgaard. Copyright violations and large language models. arXiv preprint arXiv:2310. 13771, 2023.
Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. Advances in Neural Information Processing Systems, 36, 2024.
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. The wmdp benchmark: Measuring and reducing malicious with unlearning. arXiv preprint arXiv:2403.032/6 2024.
Yuanzhi Li, Sébastien Bubeck, Ronen Eldan, Allie Del Giorno, Suriya Gunasekar, and Yin Tat Lee. Textbooks are all you need ii: phi-1.5 technical report. arXiv preprint wrXivv2309.05463, 2023a.
Yucheng Li, Frank Geurin, and Chenghua Lin. Avoiding data contamination in language model evaluation: Dynamic test construction with latest materials. arXiv preprint arXiv:2312.12343, 2023b.
Chin- Yew Lin. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out, pp. 74-81, 2004.
Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods. arXiv preprint arXiv22109.07958, 2021.
Bo Liu, Qiang Liu, and Peter Stone. Continual learning and private unlearning. In Conference on Lifelong Learning Agents, pp. 243-254 PMLR, 2022.
Chris Yuhao Liu, Yaxuan Wang. Jeffrey Flanigan, and Yang Liu. Large language model unlearning via cobudding-corrupted prompts. arXiv preprint arXiv:2406.0790 07933, 2024a.
Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, PRANAY SHARMA, Sijia Liu, et al. Model sparsity simplify machine unlearning. Advances in Neural Information Processing Systems, 36, 2024b.
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, Kush R. Varshney, Mohit Bansal, Sanmi Koyejo, and Yang Liu. Rethinking machine unlearning for large language models. arXiv preprint arXiv:2402.08787, 2024c.
Yujian Liu, Yang Zhang, Tommi Jaakkola, and Shiyu Chang. Revisiting who's harry potter: Towards targeted unlearning from causal intervention perspective. arXiv preprint arXiv:2407.1699 2024d.
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and Zico Kolter. Tofu: A task of fictitious unlearning for lms.. arXiv preprini arXiv:2401.061 2024a.
13

---

Published as a conference paper at ICLR 2025
Pratyush Maini, Hengrui Jia, Nicolas Papernot, and Adam Dziedzic. Lim dataset inference: Did you train on my dataset? arXiv preprint 1xXiv:22006.04443, 2024b.
Anmol Mekala, Vineeth Domn,, Shreya Dubey, Abhishek Lalwani, David Koleczek, Mukund Rungta, Sadid Hasan, and Elita Lobo. Alternate preference optimization for unlearning factual knowledge in large language models. arXiv preprint arXiv:2409. 2024.
Yu Meng, Mengzhou Xia, and Danqi Chen. Simpo: Simple preference optimization with a reference- free reward. arXiv preprint arXiv:2405. 14734, 2024.
Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models. arXiv preprint 1009:v16090078800 2016.
Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. Can a suit of armor conduct electricity? new dataset for open book question answering. arXiv preprint arXhv:1809.02789, 2018.
Fabio Motoki, Valdemar Pinho Neto, and Victor Rodrigues. More human than human: measuring chatgpt political bias. Public Choice, 198(1):3-23, 2024.
Andrei Muresanu, Anvith Thudi, Michael R Zhang, and Nicolas Papernot. Unlearnable algorithms for in-context learning. arXiv preprint arXivv2402.00751, 2024.
XuanLong Nguyen, Martin J Wainwright, and Michael Jordan. Estimating divergence functionals and the likelihood ratio by convex risk minimization. IEEE Transactions Information Theory, 56(11))5847-588) 2010.
Sebastian Nowozin, Botond Cseke, and Ryota Tomioka. f-gan: Training generative neural samplers using variational divergence minimization. Advances in neural information processing systems, 29, 2016.
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th anmual meeting of the Association for Computational Linguistics, pp. 311-318, 2002.
German Parisi, Ronald Kemker, Jose L Part, Christopher Kanan, and Stefan Wermter. Continual lifelong learning with neural networks: A review. Neural networks, 113:54-71, 2019.
2019.
Vaidehi Patil, Peter Hase, and Mohit Bansal. Can sensitive information be deleted from Ilms? objectives for defending against extraction attacks. arXiv preprint arXiv:2309. 17410, 2023.
Martin Pawelczyk. Seth Neel, and Himabindu Lakkaraju. In-context unlearning: Language models as few shot unlearners. arXiv preprint arXiv:2310.07579, 2023.
Rafacl Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36, 2024.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140): 2020.
J.K. Rowling. Harry Potter and the Sorcerer's Stone. Scholastic, New York, 1997.
Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. Winogrande: An adversarial winograd schema challenge at scale. Communications of the ACM, 64(9):99-106. 2021.
Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah Smith, and Chiyuan Zhang. Muse: Machine unlcarning six-way evaluation for language models. arXiv preprint arXiv:2407. 0676402407.064400 064660
2024.
Taiji Suzuki, Masashi Sugiyama, Jun Sese, and Takafumi Kanamori. Approximating mutual informa- tion by maximum likelihood density ratio estimation. In New challenges for feature selection in data mining and knowledge discovery, pp. 5-20. PMLR, 2008
14

---

Published as a conference paper at ICLR 2025
Pratiksha Thaker, Yash Maurya, and Virginia Smith. Guardrail baselines for unlearning in llms. arXiv preprint arXiv:2403.03322 2024.
Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot. Unrolling sgd: Under- standing factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) P). pp. 303-319. IEEE, 2022.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprini arXiv:2307.09288, 2023.
Lingzhi Wang, Tong Chen, Wei Yuan, Xingshan Zeng, Kam-Fai Wong, and Hongzhi Yin. Kga: A general machine unlearning framework based on knowledge gap alignment. arXiv preprint arXiv:2305.06535, 2023.
Alexander Warnecke, Lukas Pirch, Christian Wressnegger, and Konrad Rieck. Machine unlearning of features and labels. arXiv preprint wxiv:2108.11577, 2021.
Jiaheng Wei and Yang Liu. When optimizing $1% 51S-divergence is robust with label noise. In Interna- tional Conference on Learning Representations, 2021. MRR.htttss://peneevi.cmm net/
Jiaheng Wei, Zuyue Fu, Yang Liu, Xingyu Li, Zhuoran Yang, and Zhaoran Wang. Sample elicitation. In International Conference on Artificial Intelligence and Statistics, pp. 2692-2700. PMLR, 2021.
Ga Wu, Masoud Hashemi, and Christopher Srinivasa. Puma: Performance unchanged model augmentation for training data removal. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pp. 8675-8682, 2022.
Xinwei Wu, Junzhuo Li, Minghui Xu, Weilong Dong, Shuangzhi Wu, Chao Bian, and Deyi Xiong, Depm: Detecting and editing privacy neurons in pretrained language models. arXiv preprint arXiv:2310.20138, 2023.
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. Machine unlearning of pre-trained large language models. arXiv preprint arXivv2402.15158 2024.
Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning, arXiv preprint arXiv:2310. 10..0633. 2023.
Charles Yu, Sullam Jeoung, Anish Kasi, Pengfei Yu, and Heng Ji. Unlearning bias in language models by partitioning gradients. In Findings of the Association for Computational Linguistics: ACL 2023, pp. 6032-6048, 2023.
Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence? arXiv preprint arXiv:1905.072 2019.
Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. preferice optimization: From catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05866 2024.
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. arxiv preprint arXhv:2205.0/00 01068, 2022.
15

---

Published as a conference paper at ICLR 2025
APPENDIX ARRANGEMENT
The Appendix is organized as follows.
Section
A
Discussion of the broad impacts and limitations of our method.
Section
B
Detailed theoretical illustrations and proofs.
Section $
B.1
Additional examples of loss adjustments under various f-divergence functions.
Section $
B.2
Derivation of the empirical loss objective.
Section C
Detailed experimental settings.
Section Revisits existing unlearning methods and unifies them under our general loss
function framework, described in Section $ 2.2
Detailed experimental settings, including evaluation metrics and implementation settings for the three unlearning tasks.
Section %
C.2
C.3 $
C.4
Section D Additional experiments and discussions.
Section E
Related work.
A LIMITATIONS AND BROADER IMPACTS
A.1 BROAD IMPACTS
The proposed FLAT method for LLM unlearning has the potential to significantly advance ethical and responsible AI deployment, particularly in addressing key challenges such as privacy concerns, bias, and regulatory compliance. By enabling models to effectively forget specific data without compromising overall model utility, this approach directly addresses issues related to data privacy, including compliance with regulations like GDPR, which mandates data deletion upon user request. The ability to unlearn sensitive or copyrighted information, as demonstrated on datasets like Harry Potter and TOFU, ensures that Al models be continually refined without propagating harmful or biased content.
Furthermore, the reduced reliance the retain data or reference LLM makes FLAT more resource- efficient, lowering the computational and financial costs associated with large-scale unlearning. This opens up opportunities for wider adoption across industries and research institutions where access to retain data or additional model resources may be limited or not accessible. The implications of this work span multiple domains, including healthcare, finance, and education, where ethical considerations are paramount.
A.2 LIMITATIONS
One key limitation of our approach is the unsatisfactory performance in the privacy leakage evaluation on the MUSE dataset. While FLAT demonstrates strong unlearning efficiency and retains model utility across several benchmarks, it struggles to prevent privacy leakage. Note that all other tested methods suffer from the same issue, this suggests that further refinement is needed to strengthen the crivacy-preserve
aspects of existing LLM unlearning approaches. Future work could explore more robust strategies to address privacy leakage while maintaining the balance between unlearning performance and model utility.
16

---

Published as a conference paper at ICLR 2025
B THEORETICAL ILLUSTRATION AND PROOFS
B. ADDITIONAL EXAMPLES FOR Loss ADJUSTMENTS UNDER MORE F-DIVERGENCE
Example 2: Jenson-Shannon (JS) For Jenson-Shannon f-divergence, have (*)
2
- log (2 - e ""),g" (w) log 1 hence:
2
log
((P(T)) (c:8)) -
log
log
+ e
+ F(rg.vei8)
2
2
log
1 P(
= log
+ log
2 2 c
1 e F(
2
2
= log
+ log
1 e F(zy
1 - F(
2e -e=
llgg
+ F(x + log
+te 2(a
4e P(uz.11966)
log
(1 (1+e P(er. (1 +
P(ay
Example 3: Pearson
For Pearson f-divergence, we have f"( 1² + u. (v) v, hence:
g (P(#), - (P(o))))))))) = P(zy, (P(ks.ur:07 0)2
P(x v1:
P(z)) P' P(x,,,
Example 4: KL For KL f-divergence, we have f") en .0- (v) hence:
((((a))e)))) fr ((P((( vy: Pl Ve: -(0
B.2 THE DERIVATION OF EMPIRICAL LOSS FUNCTION
According to Eqn. we have:
L2 0f: sup ((((2) ( -
(g g" (P((a). ve:
Le(xy.8e0)
Given a dataset D {(x)/ v2 ,/))
jE(M]' where Je and yy are preferred template and original forget responses to the forget prompt Ty estimate Plzy.ye; 0), v(: via the following two quantities:
= Elu Mel P(Mo(I),Be.ct Ne.s) P(a),19:0) = Elurl P(M Vr.)
Mel
lysl
Given a prompt and the previously generated tokens, P(Ma(zy. Ve,cs) = Ve.s) and B(, V5&) are the probabilities of correctly predicting the next token, where Mo(Zy, Me,2y.Be,ei) and Mg(ay, vi) are the predicted token using LLM 0 given input prompt 2 and the already generated tokens ye and yf.si-
17

---

Published as a conference paper at ICLR 2025
Empirically, we can obtain the loss function for the dataset D:
LELAT (0) -ED (P(æ), (P(xy.Ve:0)) Ve: ('
-ED 19" El Ek=1 Ve,in
Ipel
Euss -==l EE=
Vss. ho(or, (
Me
1y5
Σ Mtll
1us ho p. Vensid) (0 is ho halarss (f.e))
-ED (9
We
lyyl
Here, v is the vocabulary size, Ve.i,k is the k-th element of vector representing the i-th token in the good response Ye. ff..kk is the k-th element of vector representing the i-th token in the forget response yf. Additionally, ho (z Ve,<i); and ho Vf)<s) denote the k-th entry of the probability distribution for the correctly generated token.
An example: KL For KL f-divergence, f*(u) en- g9'
hence, g" (P(æ), 2e: 0))
(" (P(21)81;00) P(ar, wei0) e10),8810)11 We have:
Mel ho Be,
Eist Wy
LELAT (0) --En
lyy1
1y/l
B.3 PROOF OF THEOREM
Proof. Remember that we define:
(eil(D)))))) = (.l....0(())). - B2 (f (1(2)))
and
faie (D)) sup E EEMDD lo((,)) - E (g(2))
we first prove the convergence of g. and then the convergence of fai
For the ease of presentation, for any veal-valued function O, we write Ep, (0) ESND [e(2)).
(p) Ez-D, [e(=)), ED, (e) Ez-n, [e(=)], and ED,, (0) = Ez-n, le(=)].
Given any ğ +, according to Lemma C.1 in (Wei et al. 202T), and the fact that f is Lipschitz continuous, we have:
|| 9" ( 3 Eo. g - Ep.
- [(0 - //1
En, ( g²) ("" Ef -f'(0"]]]]] (5)
By using the fact that the true density ratio /2, is bounded below and above, hence, (z( is indeed equivalent to Lz(D)). Based on Eqn. ( Lemma C.2 in (Wei et al. 2021). and the Lipschitz
property of f", with probability at least C1 exp( (oooNNa/(2tro)) /ct) we have
|| 9" 1' 2 2
(6)
Note that we have:
(DellD)) faiv (D.I()))
ED. [g 10'--pn'_l - ED,
Ep.
+ EE, [g '²] ED, (6) f" (+")) + - + [En, (f" ED, (*"))
= Conss Conso + Cons3 + Cons; + Conss-
(7)
By Lemma C.2 in (Wei et al. 2021 1. with probability least ej ( /ct2) we have
Cons 2 2/2orr)+
18

---

Published as a conference paper at ICLR 2025
Similar upper bound holds for Cons2-
Following from Eqn. 6 with probability at least 1 61 (xxp(-Nro((trr)) /c)), we have
Cons3 2 N (
Applying Hoeffding's inequality, with probability at least 01 -xp(-NNe/(2tre)///t we have
Cons 3
Similar upper bound holds for Conss-
Combining the five upper bounds for Cons; where i E [5]. with probability least 1 exp(-NNw/(2Arm) /cf), we have
fasbDll 2 N -
C DETAILED EXPERIMENTAL. SETUP
Table Summary of unlearning tasks, including base models, forget datasets, and evaluation metries.
Untrarning Taok
Base Model
Forget Unttaeet
Metries
Copyrighted Costent L Lnleaming
UP1-2.78, Liama2 78
Honry Foner Series
BLEU ROL G. PYL.. Zeco sbot Act
Enity Unleaming (TOFU)
OFT277B Liumz2 78.
Forget Quality vilue),
Farget Utiltt
Benchmak
Llana2-B
knowledge memoiizaiion D,, prinacy
Table & summarizes the experimental setups, including base models, forget and retain datasets, and evaluation metrics.
C.I FORMULATIONS FOR BASELINE METHODS
In this section, we revisit existing unlearning objectives and unify them under our general loss function framework, described in Section 2.2 We provide formulations for GA, GD, KL, and PO, as presented Maini et al. (2024a), as well as for Mismatch (Liu et al. 2024a). LLMU Yao et al. 2023), (PO(Ratailov al. 2024)) and NPO (Zhang al. 2024). Additionally, we include the formulations for DPO without the Mref term and SimPO (Meng et al. 2024), as discussed in Section $ 3.44 We also add formulations for Task Vectors (Ilhareo et al. 2022) and Who's Harry Potter (WHP) Eldan & Russinovich, 2023).
Fine-tuning on retain data Retraing from scratch the gold standard for unlearning. HHowever, in real-world scenarios, retain data may not always be available, and retraining LLM is highly nesource-intensive Alternatively, we can fine-tune the model using retain data for several epochs, which only involves performing gradient descent on Dr.
LFine-tune
Σ (e.
C(xr, Uri 0)
Dri
Retain Loss
Gradient ascent (GA) GA is simple baselines commonly used in traditional machine unlearning settings (Chen et al., 2023, Tia et al. 2023) Fan et al.) [023] Kurmanji al., 2024). GA reverts the change of the gradient descent during the training with its opposite operation. The rationale of
gradient ascent is that a subsequent maximization prediction loss on the forget dataset D, would approximately "revert" the optimization on the forget dataset, thus unlearning D, and approximating
a model trained on the retain dataset D, only.
LGx = Dy
Σ
((zr.U9:0)
Forget Loss
19

---

Published as a conference paper at ICLR 2025
Gradient difference (GD) Gradient difference has been introduced simple baseline method in Maini et al. (2024a). combines fine-tuning and gradient ascent by compute the sum of the two loss terms.
LGD
Σ
Clar: Uri 0)
Σ
Drl
(Er.Ue)]
(Fu.Uu)ED)
Retain Loss
Forget Loss
KL minimization (KL) The KL minimization is adopted from Maini et al. (2024a) and involves gradient ascent term for forgetting. It also minimizes the Kullback-Leible (KL) divergence between the predictions retain data D, of the reference model (the original model 8₂) and the newly trained model (the unlearned model f). This term aims to keep the unlearned model's current output distribution the retain dataset close its pre-unlearning distribution the retain samples.
18=1 KL KL (hre)ii)) (rci))
LKL
LGA Forget Loss
Σ
D
(Kr.Hr)E
Retain Loss
Preference optimization (PO) Preference Optimization (PO) differs from the traditional direct preference optimization approach as presented in Rafailov et al. (2024) in that combines the fine-tuning loss on D, with term that teaches the model to respond with don't 't know' to prompts from D, (Maini et al. 2024a). Here, Dia refers to an augmented forget dataset where the model's response to the prompt don't know."
LPo LFine-tune +
Σ
Ci Yidki 0)
Diak
Zy-Miee Dat
Custom Loss
Here, the Custom Loss utilizes the modified response the forget prompt ensure that the model rejects answering questions related to the forget data.
Mismatch Mismatch has the same objective to PO, except it involves constructing random combination of text sequences rdn Here, the second term in mismatch the same as the second term in LLMU (Yao al. 2023).
L Mismatch
LFine-tune
Σ
Σ
Cla,, Vrdni 0)
|Yanl
Retain Loss
(xir))Dy
Bedn EYeda
Custom Loss
LLMU Yao et al., 2023) LLMU combines the GA term with two additional terms to learn 1) random completions Y,u. from D, (constructed using prompts from D f)) to facilitate unlearn and 2) D, to preserve performance. We use books with similar styles D, in our experiments and construct Yut using randomly sampled text sequences from D,-
M =
Σ (Ey.Ur)EDD
Σ
Σ
Clxy, Vran' 0)
Yrául
(my;)ED
Brdan EYean
lyal
Σ
KI(ha, (wrr Mrex)) (WT: Ures))
(D..).EDD
1=1
We have already unified LLMU in Section
2.2
20

---

Published as a conference paper at ICLR 2025
Direct preference optimization (DPO), DPO w/o Mrefs SimPO information.
See Section
3.4 for more
lell
l
LDPO,s(0) = - - log 3 log
ho f Ne,<i) - log
ho ho Us,es)
Mref
}
==1
1=
Retain/ Custom Loss
Forget
Me
lyrl
2
LIPO wio Mrst (0) ED log σ
B log II
ho(a ve,c,))
B log II he (a (e(
Custom Loss
Forget Loss
- -
3 Iy
Mel
3 lysl
lyyl
LsimPO.s(0) -
log
log
ho ( No.s)
log
he ( M.l) Ma)) -
Custom Loss
Forget Loss
where y is the target reward margin.
Negative preference optimization (NPO) (Zhang et al. 2024) NPO incorporates only the losing response term in DPO (Rafailov et al. 2024), penalizing only the prompt-response pairs in DD, the formulation below, 5 represents the inverse-temperaatuee, my is the prediction probability of LLM NPO also has two extended versions that include either the KL term or fine-tuning term on D, to preserve model utility.
INPO DD llog -lllgg
Tres xry) )]
To(ys (r)))
ED loggo ( 3 log Tre (ys xx)) 3 log Tolys (xy))
Retain/Custom Loss
Forget Loss
LNFO-KL = LNPO + LKL
LNPORT LNPO + Liie tume
Task Vectors (Eldan& Russinovich 2023) The taks vector derived by calculating the weight difference between the original LLM 6,, and reinforce LLM freinforees which is the model trained on Dj until over-fits. This method then subtract this task vector from the original LLM weights, intuitively moving the model away from the direction it used to adapt Dy. The weights of unlearned model can be obtained as:
0.- (freinforce 0%)
WHP Eldan & Russinovich, 2023 WHP defines the unlearned model 0 as the interpolation
between the original model 6, and the reinforced model Orein/orce: Let pe (-|z) denote the token distribution parametrized by the model when given prompt x as input. Then, for any input WHP samples the next token from:
po (-11=) pa_ (-1x) (p (+1x) pa, (-(2r)
where is hyperparameter that controls the interpolation between the models.
C.2 COPYRIGHTED UNLEARNING ON HP
C.2.1 EVALUATION METRICS
We two text similarity metrics to evaluate our models. In each case, the original copyrighted text serves as the reference, and we calculate the similarity between this reference and the text generated by the L.M.
21

---

Published as a conference paper at ICLR 2025
For the forget dataset, compute the ROUGE-L recall score (Lin 2004) between the ground truth responses (the forget responses) and the text generated by the model after unlearning.
ROUGE-L
BLEU Similarly, we compute the BLEU score (Papineni et al. 2002) for the forget dataset, comparing the ground truth responses the model's output after unlearning.
retained model that has never seen the reference text should score low on both metrics, and a successfully unlearned model should perform similarly. Note that for these metrics, values closer to those of the retained model indicate better unlearning, while values that are too large or too small suggest difference from the retained model Liu al. (2024a). For Harry Potter datasets, evaluate similarity using the first 600 generated tokens as per (Jia et al. 2024).
Perplexity (PPL) We assess text fluency and diversity by computing perplexity on the Wiki- text (Merity et al. 2016) using the LM Evaluation Harness (Gao et al. (023). model with lower perplexity on the fine-tuned data suggests the generated text remains meaningful.
Zero-shot Accuracy We evaluate zero-shot accuracy across various tasks, including BoolQ (Clark) cct al.,
2019), RTE (Dagan et al. 2005), HellaSwag (Zellers et al., 2019), Winogrande (Sakaguchi
al. 2021) ARC-Challenge (Chollet 2019), Easy (Chollet 2019), OpenBookQA (Mihaylov et al.
2018), Piqa (Bisk et al. 2020), and TruthfulQA (Lin et al. 2021]. The mean accuracy across these diverse tasks was computed and reported as comprehensive measure of model utility after unlearning. The higher the average accuracy, the better the results.
C.2.2 IMPLEMENTATION SETTING.
To demonstrate the copyright removal task, undertake the fine-tuning of all the models using the complete Harry Potter series. The finetuning procedure for the OPT-2.7B and Llama2-7B models involve learning rate of le-5 and batch size of 2. AdamW serves as the optimizer for preparing these models. For baseline methods, we set the batch size and learning rate to be the same as in their original papers, and fine-tune for epochs using AdamW optimizer. For method, same training ppper-prraeeters as baseline but set the learning rate to be 2c-7.
the
C.3 ENTITY UNLEARNING ON TOFU
C.3.1
EVALUATION METRICS
We utilize the original evaluation metrics designed in the original paper of the TOFU dataset MMaini
et al. 2024a).
Probability For each instance in the retain or forget set, we calculate the normalized conditional probability P(a 4)1//a on the LLM subject to unlearning, where g represents the question, is the answer, and |al denotes the number of tokens in the answer. For the real authors and world facts subsets, the dataset provides set of five answers {dg. 0i, 02, á3, 3. consisting of one correct answer dg and four perturbed answers that are incorrect. this case, we compute the ratio P(ag V/aa Σ
P(ā: g) 2/jā_l_
Truth ratio The truth ratio is computed as the geometric mean of multiple perturhed (incorrect) an- swers' (A= = {ā1, ...)) probabilities over the normalized conditional probability of the paraphrased answer à.
(IT/2)
AA P(ā 1//l) A/
Ruush
P(a 4/10|
For the real authors and world fact subsets, the original answer is used in the denominator as paraphrased answer is available.
ROUGE-L For all subsets of TOFU, we compute the ROUGE-L recall score (Li 2004) between
the ground truth responses (forget dataset) and the text generated by the model after unlearning.
22

---

Published as a conference paper at ICLR 2025
Model utility The model utility is aggregated as harmonic mean nine numbers: the answer probability, truth ratio, and ROUGE recall scores from each of the retain, real authors, and world facts subsets. A higher model utility is always preferred.
Forget quality The forget quality is determined by calculating the p-value from a Kolmogorov- Smirno (KS) test, which compares two distributions: the truth ratio of the retained model and the truth ratio of the unlearned model on the forget set. A higher p-value suggests that the null hypothesis that the distributions of the truth ratios from both models are identical - cannot be rejected, indicating that the retained and unlearned models behave similarly.
C.3.2 IMPLEMENTATION SETTING.
For all LLM unlearning methods, we set the batch size to be 32 following previous works (Maini al. 2024a, Zhang et al. 2024 Ji et al. (024) and use consistent learning rates for each model. For Phi-1.5B, we tune-tune the pre-trained models for 5 epochs using learning rate of 2e-5 to obtain the original model. Similarly, we fine-tune Llama2-7B and OPT-2.7B for the same duration with a learning rate of le-5. AdamW serve the optimizer for preparing these models. The unlearning process for all methods, including ours, employs the same learning rate as used during fine-tur mun-ttnnng the original models. For all experiments the TOFU dataset, the training hyperparameters remain consistent across models of the same type.
Why do we follow the official implementation of TOFU and report the final results, rather than adopting NPO's best-results strategy (Ji et al. 2024; Liu et al., 2024d)? It is important to note that the original implementation of TOFU does not evaluate the best result from each epoch but instead use the final model after unlearning to get its evaluations. Also, the baseline methods reported in the TOFU paper reflect the performance of the final model. In contrast, NPO begins to introduce an evaluation strategy that reports the best results achieved at each epoch by their method on the TOFU dataset. Reporting the best results across all epochs can overstate the model's performance, it may not fully represent the method's actual unlearning capability. In real-world scenarios, evaluating during each epoch is often impractical. Instead, it is important to develop a robust method that achieves good trade-off without time-consuming parameter tuning or requiring frequent evaluations, especially when dealing with larger forget sets. Therefore, to ensure fair comparison and align with the evaluation settings of the original TOFU paper, we choose to report the final results after unlearning.
C.4 MUSE-NEWS UNLEARNING
C.4.1 EVALUATION METRICS
Note on PrivLeak metric The PrivLeak metric used in (Shi et al., (024) is derived from Min-K% Prob, a membership inference attack method for LLMs. Formally, is calculated as:
PrivLeak AUC (funkeam: Diorget Dholdout) AUC (fretmini D Drorget. Dnoldour)
AUC (Jretrain Diorget, Dholdrat) )
where the AUC score refers the standard AUC-ROC score between Diorer and Dholdout- While this method indeed discriminates between the forget and holdout distributions as a measure of successful unlearning, it is highly dependent on the data selected for evaluation. Specifically, Min-K% Prob has been shown to yield random- guess accuracy due to modern LLMs being trained on large pretraining corpora for only small number of iterations, causing fuzzy boundary between members and non-members (Duan et al. 2024).
Furthermore, Maini al. (004b) demonstrate that Min-K% % Prob results in 1) high variance depend- ing on the random selection of the dataset used for evaluation, 2) better performance when the two subsets (in our case, forget and holdout) are not drawn from the same distribution, and 3) empirically overestimated false positives. The latter finding suggests that the distribution gap (i.e., temporal shift, which is also identified by Duan et al. (2024) acts as a confounding factor in the discrimination process, since the forget set and holdout set may differ in more than one dimension. Given that MUSE (Shi et al.) 2024) uses news data, which is highly dime-dependent (and thus possibly non-i.i.d.), advocate for cautious interpretation of the PrivLeak metric.
23

---

Published as a conference paper at ICLR 2025
Table 9: Unlearning performance of Llama2-7B on the Harry Potter dataset. R-L and Avg. Acc. denote the ROUGE-L score and average zero-shot accuracy across nine LLM benchmarks. We include the original LLM and retained LLM for reference. Some methods, such as PO, LLMU, DPO, and NPO, exhibit strong performance in either forget quality or model utility, but underperform in the other. FLAT consistently ranks in the top three in terms of similarity to the retained model, measured by Forget Quality Gap (FQ Gap), while also generating mcaningful and diverse outputs, indicated by perplexity (PPL. and the average zero-shot accuracy (Avg. Acc.). The top three results across the three main metrics are highlighted blue.
Forget Quality
Model Utility
Metrie
BLEU(L)
BLEU Gup
R-L(U)
R-L Gup
FQ Cap
PPL())
PPL Gap
Avg.Acc.
Acc. Gap
Original LLM
4.0452
0.1487
8.9524
0.5617
Retained LLM
0.4903
0.0442
8.7070
0.5599
GA
0.0624
0.4279
0.0134
0.0308
0.4587
47.2769
-38.5699
0.5088
+0.0511
KL
0.0976
0.3927
0.0144
0.0298
0.4225
9.4336
-0.7266
0,5509
-0.0090
GD
0.0039
0.4864
0.0002
0.0440
0,5304
9.1797
-0.4727
0,4902
-0.0697
PO
0.0206
0.4697
0.0015
0.0427
0.5124
8.8364
-0.1294
0.5532
-0.0067
Mismatch
0,0670
0.4233
0.0028
0.0414
0.4647
8,9906
-0,2836
0,5593
-0.0056
LLMU
0,3033
0.1870
0.0317
0.0125
0.1985
9.0530
-0.3460
0.5503
-0,0096
DPO
0.7717
-0.2814
0.0552
0.01 10
0.2924
8.9597
-0.2527
0.5614
0.0015
NPO
0,9840
-0.4937
0.0656
-000144
0,5151
9.0397
-0.3327
0,5609
0,0010
FLAT (TV)
0.6770
10.1867
0.0673
-0.0231
0.2098
8,9899
-0.2829
0.5592
+0.0007
FLAT (KI.)
0.6829
40.1926
0.0662
.00020
0.2146
8,9803
-0.2733
0.5572
+0.0027
FLAT (JS)
0,6890
-0.1987
0.0684
-0.0242
0.2229
8,9910
-0.2840
0,5574
-0,0025
FLAT (Pearson)
0.6930
-0,2027
0,0680
-0.0238
0.2265
8.9906
-0.2836
0.5580
-0,0019
D EXPERIMENTAL RESULTS
D.1 COPYRIGIITED UNLEARNING ON HP DATASET
Performance using Llama2-7B on HP dataset Table 9 indicates that our method consistently places within the top three across the primary metries, with TV f-divergence showing the best performance. LLMU achieves the best forgetting effect, comparable to our method, but its model utility is inferior. PO again demonstrates the highest PPL but exhibits poor forgetting performance. While DPO shows good model utility, the difference between our method and DPO in PPL is minimal. Unlike other methods, PO directly leverages fine-tune loss, which helps preserve the model's 's performance beyond the unlearning. These results highlight the effectiveness of our method, striking a better balance between forgetting quality and model utility.
Analysis about the edge case of Mismatch When using OPT-2. 7B, the forget quality gap (FQ Gap) between Mismatch and FLAT(TV) is relatively similar. For small LLMs like OPT-2.7B, fine-tuning with the retain data for several epochs can lead to effective forgetting of the forget set. The rationale that fine-tuning on the forget set may induce catastrophic forgetting over the forget set like continual learning (Parisi et al. 2019). Additionally, OPT-2.7B generally produces lower-quality outputs, which reduces the BLEU gaps between FLAT and Mismatch. As result, the differences in unlearning performance (FQ Gap) between these two methods appear comparable in this setting.
Mismatch can achieve comparable results using OPT-2.7B on the HP dataset. However, Llama2- 7B, the FQ Gap for the mismatch 0.4647, and ours 0.2098 (Table D). Note that a smaller FQ Gap indicates better unlearning performance. FLAT can show better adoption to different LLMs and different datasets. This might be because the Mismatch fails to keep good balance between the model utility and the forget quality, while Flat theoretically formulated a reweighting mechanism.
Parameter Study on Prompt Length for HP dataset Following Jia et al. (2024); Eldan &
Russinovich (2023), we evaluate the forget quality using prompt lengths of 50, 100, 200. 300 on
Harry Potter series dataset. Table I0 presentss the parameter study of different prompt lengths for assessing forget quality on this dataset. In the main paper, we adopt the prompt length of 200, as suggested by Liu al. (2024a).
24

---

Published as a conference paper at ICLR 2025
Table 10: Parameter Study of different prompt length Harry Potter book series dataset. We include the original LLM and retained LLM for reference.
Split Metric
Prompt Length
Prompt Length 100
Prompt Length 200
Prompt Length 300
BLEU())
ROUGE L(J)
BLEU())
ROUGE
BLEU())
ROUGE
BLEU())
ROUGE: L(J)
OPT-2.7B
Original LLM
3,4492
0,1203
3.7660
0.1273
4.1163
0.1484
3,4924
0.1551
Retain LLM
1.7350
0.0944
2.3427
0.0986
2.6072
0.1229
2.7479
0.1261
FLAT (TV)
0.8382
0,1090
0,9607
0.1206
1,1955
1.4117
14532
0.1628
(KL.)
0.8363
0,9867
0.1209
1.3329
1,4714
0.1657
FLAT (IS)
0,8709
0.1101
0,9720
0.1213
1,1986
0,1290
1,4735
0,1635
FLAT (Pearson)
0.8430
0,1098
0.9624
0.12111
1.1917
1.4155
1,4501
0.1627
Llama2-7B
Original LLM
0.0448
0,0049
0.3951
0.0254
4,0452
0,1487
0.2541
0.0275
Retain LLM
0.0917
0.0111
0.1664
0.0162
0,4903
0.0442
0.2542
0.0194
FLAT (TV)
0,0293
0.2627
0.0276
0.6770
0.0673
0,2185
0,0251
FLAT (KT)
0.0308
0,0041
0,2592
0.0276
0.6829
0,0662
0.2217
0.0242
FLAT (IS)
0.0505
0.0045
0.2512
0.0279
0,6890
0.0684
0.2143
0.0253
FLAT (Pearson)
0.0310
0,0044
0,2573
0.0281
0.6930
0,0680
0.2163
0.0252
Table 11: Performance of our method and the baseline methods on TOFU-5% and TOFU-10% dataset using Llama2-7B. FQ, MU, R-RL, F-RL represent forget quality, model utility, ROUGE-L on retain dataset and ROUGE-L on forget dataset respectively. We include the original LLM and retain LLM for reference. The top two results are highlighted in blue.
Dataset
TOFU-5%
TOFU-10%
Metric
FQ
MU
F-RL(()
R-RL
FQ
MU
F-RL())
R-RL
Original LLM
3.0507e-1
0.6346
0.9918
0,9833
4.6575e-1
14
0.6346
0.9918
0.9833
Retained LLM
1.0
0.6281
0.3928
0.9803
1.0
0.6225
0.3970
0.9798
GA
0.0043
0.3545
0.2593
0.2858
2.0608e-13 13
0.0
0.0115
0.0128
KL
4.0248e-06
0.0538
0.0619
0.0614
1.6347e-10
0.0
8,3333e-05
0.0004
GD
L.115ce-05
0.5532
0,3482
0.5035
2,0608c-13
0.0093
0.0105
0.0336
PO
3.6025e- (19
(121011
0.0128
0.1385
96
0.4915
0.1091
0.6454
Mismatch
L8266e-05
0.5565
0.5470
0.7506
2.0180c-08
0.5106
0.6219
0.7807
I.LMU
1.1150e-05
0.0142
0.0142
0.0
0.0133
DPO
4.7488e-05
0.0
0.0167
0.0162
0.0055
0.0
0.0147
0.0151
NPO
0.0001
0,4630
0.3234
0.3925
0.0017
0.3086
0.4066
0,4383
NPO-RT
0.0001
0.4811
0.3331
0.4217
0.0423
0.4093
0.4066
0.4883
FLAT (TV)
0.0221
0.0186
0.0047
0,0060
0.0012
0.1624
0.0167
0.0238
FLAT (TV)-RT
0.1452
0.4946
0. 0.19
0,3405
0.0774
0.5204
0.3816
0,4050
D.2 ENTITY UNLEARNING ON TOFU
The results on TOFU-5% and T0FU-10% Table [1 shows the results TOFU-5% and TOFU- 10% using Llama2-7B. Results indicate that FLAT can achieve a good balance between unlearning efficiency and general language capability.
Note that the retain version of FLAT can achieve the best forget quality on TOFU-5% and TOFU-10% while maintaining high model utility. For the TOFU dataset, which is synthetic set with separable profiles of 200 authors, using retain data does not significantly blur the boundaries between the forget and retain data. Hence, using the retain data in this task significantly improves performance. However, the primary focus of our work remains on content unlearning (usually only the forget content is known), which reflects more practical and realistic situations encountered in real-worle applications.
TOFU Experimental Results using All Metrics Table shows the performance on TOFU using three base LLMs, Llama2-7B, Phi-1.5B, and OPT-2.7 under all metrics. From Table we find that the forget quality on the TOFU-1 % is similar to that of the baseline methods may be due to the small size of the forget set (40 samples). When calculating the distributions of truth ratio for such small sample size, the differences between methods tend to diminish.
Clarification of the baseline discrepancy The difference in forget quality values between ours and NPO reported results arises due the differences in evaluation settings. We tried our best to evaluate
25

---

Published as a conference paper at ICLR 2025
Table 12: Performance on TOFU dataset using three base LLMs. 1lama2-7B,, Phi-1.5B. and OPT-2.7 under all metries. We report ROUGE-L score (R-L), Probability (P), and Truth Ratio (TR) on all four subsets of the TOFU benchmark. Higher scores are better except ROUGE-L and probability on the Forget Set. We include the original LLM and retained LLM for reference. The best two are highlighted in blue.
Split
Real Authors
Real World
Rerain Set
Forget Set
Metric
R-L
P
TR
R-L.
P
TR
R-L
TR
R-L(1)
P(D)
TR
I Lamma278
Original LLM
0,4738
0.6210
0.4355
0.5579
0.9833
0.4662
0,9851
0.9898
0.5123
Retained L.M
0,9330
0.4645
0.6118
0.8932
0.4182
0.5449
0.9833
0.9002
0.4724
0.4030
0.1798
0.6939
GA
0,0030
0.4754
0.6233
0.8761
0.4432
0.5843
0.9008
D.9546
0.4695
0.4862
0.3566
0.5705
KL
0.9280
0.4652
0.6092
0.8803
0.4383
0.5691
0.9398
0.9705
0.4655
0.5281
0.5119
0.5626
GD
0,5080
0.1728
0.6156
0.8718
0.4139
0.583
0.8912
0.9657
0.4701
0:1773
0.1238
0.5619
PO
0.4850
0.6269
0.8917
0,4522
0.5601
0
0.9627
0.4393
0.3640
0.8695
0.6318
LLMU
0.9330
0.4905
0.6344
0.8917
0.46113
0.5625
0.8865
0.9628
0.4391
0.4480
0.8600
0.6286
DPO
0.9330
0.4939
0.6384
0.8917
0.4631
0.5646
0.8852
0,9623
0.4407
0.5860
0.8734
0.6240
NPO
0.1751
0.6218
0.4166
0.5798
0.8950
0:9574
0,1680
0,1632
0.3664
0.5785
NPO-RT
0,8830
0.4758
0.6218
0.8746
0.4459
0.5805
0.8958
0.9588
0.4687
0.4519
0.3672
0.579)
FLAT (TV)
0,9880
0.4937
0.6455
0.8974
0.4555
0:5591
0,8826
0.9685
0.4607
0.4391
0.5314
0.6026
FLAT (KL)
0.9130
0.4992
0.6491
0.9060
0.4524
0.5609
0.8750
0.9679
0.4603
0.5199
0.7588
0.5895
FLAT (SS)
0.8980
0.1927
0.5:60
0.8974
0,4508
0.5592
0.8861
0.9686
0.4607
0.4151
0.5183
0.6039
FLAT (Pearson)
0,4932
0.6461
0.8974
0.4509
0.5588
0.8857
0.9684
0.4607
014392
0.5092
0.6037
Phi-1.58
Original LLM
0.4073
0.3744
0,4470
0.7503
0.4148
0.49K2
0.9199
0.9238
0.4810
13.6607
0,9345
0.4839
Retained L.M
D.4340
0.3779
0.4539
0.7585
0.4090
0.4974
0.9269
0.9271
0.4855
134222
0.1686
(16579
GA
0.4573
0.3638
0.4375
0.7541
0.9978
0.4741
0.8048
0.7748
0,4880
0,5114
0.3268
0.5099
KL
0.4273
0.3643
0.4370
0.7474
0.3997
0,4764
0.8109
0.8043
0,4889
0,5059
0.3342
0.5091
GD
0.3907
0,3726
0.4461
0.7605
0,4087
0.193]
0.8496
0.8900
0,4910
0,1996
0,4025
0.1952
PO
0.4240
0.3728
0,4449
0.7699
0.4190
0.5207
0.7468
0.8747
0.459
0.3170
0.7362
0.5416
ILMU
0.3720
0,4421
0.7785
0.4203
0:5197
0.7270
0.8678
0.4572
0,3058
0.7067
0.5453
DPO
0.0420
0,3713
0.4423
0,7785
0.4202
0.5205
0.7349
0.8712
0.4583
0.3437
0.6999
0.5393
NPO
0.4573
0.3619
0.4342
0.7417
0.9988
0.4761
0,8000
0,7856
0.4840
0.5196
0.3529
0,5119
NPO-RT
0.4473
0.3619
0,4340
0.7474
0.3998
0.4770
0.8024
0,7926
0.4851
0,5193
0.3527
0.5129
FLAT (TV)
0.4440
0.3695
0.4390
0,7742
0.4125
0.5040
0.8155
0.8858
0.4709
11.4699
0.4756
0.5305
FLAT
0,3736
0.4175
0.5147
0.7850
0,4524
0.6285
0.5287
FLAT (US)
0.4340
0.3703
0.4386
0.7588
0.4119
0.5045
0.8117
0.8850
0.4714
0.4572
0.4683
0.5390
FLAT (Pearson)
0.4540
0.3694
0,4389
0.7674
0.4117
0.5040
0.8099
0,8850
0.4711
0.4591
0.4672
0.5383
OF'--2.78
Original LLM
0.6687
0,3833
0.4393
0.6433
0.3701
0.1155
0.7494
0.8335
0.4992
0,7537
0.8237
0.5338
Retained LLM
0.6487
0.3735
0,4249
0.6278
0.3696
0.4185
0,7669
0,8399
0.4988
034217
0.1991
0.7097
GA
0,6300
0.3774
0.4375
0.5953
0.3644
0.4071
066387
0.4007
0.4972
0147488
0.8722
0.6355
KL
0.6873
0.3775
0.4346
0.6463
0.3646
0.4071
0.6613
0.4707
0.4958
0,4810
0.1110
0.5902
GD
0.6153
0,3782
0.4336
0.6084
0,3613
0.3979
0.6603
0.6916
0,5162
0.4521
0.1701
0.5774
PO
0.4078
0.3874
0.4540
0.5135
0.3705
0.4207
0.4015
0.6922
0.4546
0.0589
0.5220
0.6037
I.MU
0.1528
0.3739
0,4215
0.3946
0 0.3695
0.4031
0.3495
0.6013
0.4305
0.0347
0.3967
0.6356
DPO
0.3478
0,3853
0.4498
0,1915
0.3708
0.4230
0.3937
0.6445
0.4375
0.0806
0.3931
0,6255
NPO
0,6573
0.3787
0.4349
0.6281
0.3681
0.4130
0.6400
0.4978
0.4870
0.4993
0.1355
0.5052
NPO-RT
0.3646
0.4107
0.6264
0.3675
0.4239
0.4620
0,2459
0.4065
0.3627
0.1087
0.6716
FLAT (TV)
0.6737
0,3878
0.4457
0.6382
0.3715
0.4137
0.7067
0.8075
0.4858
0.5217
0.6368
0.5601
FLAT (KL)
0.6903
0,3802
0.4364
0.6369
0.3672
0.4108
0.6974
0.80778
0.4909
0./1:12
0.6735
0.5515
FLAT (IS)
0.6723
0,3824
0,4385
0.6369
0.3706
0.4162
0.7013
0.7685
0.4911
0349338
0.5662
0,5502
FLAT (Pearson)
0.6737
0.3873
0,4462
0.6467
0.3705
0.4150
0.7059
0.8009
0.4868
0.5052
0.6329
0.5597
the performance of all methods under controlled settings as indicated in TOFU's original paper to ensure a fair comparison. Our implementation is based on the TOFU codebase. The difference between the TOFU official implementation and the NPO implementation is that the NPO evaluates models after every epoch (a total of 10) and reports the epoch with the best forget quality, while the TOFU benchmark uses the final results after five epochs. The difference in reporting policies significantly influences how forget quality is presented and perceived.
D.3 ABLATION STUDY
Ablation Study of Reweighting Mechanism on HP dataset Table 13 demonstrates the effective- ness of the re- weightitnng mechanism on the Harry Potter dataset. When using the preferred template data for unlearning, our method achieves strong forget quality and comparable model utility. When using retain data, our method outperforms GD, indicating that the re-weighting mechanism improves both unlearning efficiency and model utility.
26

---

Published as a conference paper at ICLR 2025
Table 13: Ablation Study of the Re-weighting Mechanism using Llama2-7B Harry Potter dataset. R-L and Avg. Acc. denote the ROUGE-L score and average zero-shot accuracy over nine LLM benchmarks. We include the original LLM and retain LLM for reference. The best ones are highlighted in blue.
Forget Quality
Model Utility
Metric
BLEU())
BLEU Gap
R-L(()
R-L Gap
FQ Gap
PPL(()
PPL Gap
Avg.Acc.
Acc. Gap
Original LLM
4.0452
3,5549
0,1487
0.2933
3,8482
8,9524
0,2444
0.5617
0.0018
Retained LLM
0.4903
0.0
0.0442
0.0
8,7070
0.0
0.5599
0.0
Study Re-weighting Mechanism Using Retain Data
0.0039
0.4864
0.0002
0.0440
0.5304
9.1797
-044277
0.4902
-0.0697
FLAT retain
0.2359
0.2544
0.0263
0.0179
0.2714
8.9948
-0.2878
0.5591
-0.0008
Study on we-weighting Mechanism Using IDK Data
DPO w/o Mrs/
0.7719
-0.2816
0,0523
-0,0081
0.2897
8,9674
-0.2604
0,5560
-0.0039
SimPO
0.6876
-0.1973
0,0552
-0,0110
0.2723
8.9927
-0.2857
0.5593
-0.0006
FLAT (KI.)
0.6829
-0.1926
0.0662
-0.0220
0.2146
8.9803
-0.2733
0.5572
-0.0027
Table 14: Ablation Study of the good answer type using 1lama2-BB on Harry Potter dataset. R-I, and Avg. Acc. denote the ROUGE-L score and average zero-shot accuracy over nine LLM benchmarks. We include the original LLM and retain LLM for reference. The best ones are highlighted in blue.
Forget Quality
Model Utility
Metric
BLEUU()
BLEU Gap
R-I(()
R.I.
FQ Gap
PPL(()
PPI. Gap
Avg.Aec.
Acc. Gap
Original LLM
4,0452
0,1487
8.9524
0.5617 0.5599
Retuined
0.4903
0.0442
8.7070
FLAT (TV)-IDK
0.6770
-0, 1867
0.0673
-0.0231
0.2098
8.9899
-0.2829
0.5592
-0.0007
FLAT (KL)-IDK
0.6829
-0.1926
0.0662
-0.0220
0.2146
8.9803
-0.2733
0,5572
-0.0027
FLAT (J8) IDK
0.6890
-0. 0.1987
0.0684
0.0242
0.2229
8,9910
-0.2840
0.5574
+00025
FLAT (Pearson)-IDK
0.6930
-0.2027
0.0680
-0.0238
0.2265
8.9906
-0,2836
0,5580
-0.0019
FLAT (TV) Norrmal
0.6942
0.2039
0.0677
0.0235
0.2274
8,9872
-0,2802
0.5588
00,011
FLAT (Kr.)-Normal
0.6773
-0. 1870
0.0664
-0.0222
0.2092
8,9721
-0.2651
0.5580
-0,0019
FLAT (JS)-Normal
0.6980
-0,2077
0.0678
-0.0236
0.2313
8. 8,9888
-0,2818
0,5593
-0.0006
FLAT (Pearson)-Normal
0.6991
-0,2088
0.0681
-0.0239
0.2327
8.9882
-0,2812
0.5894
-0,0005
Ablation Study of Good Answer Types on HP dataset Table 14 presents the ablation study on
the good answer types using Llama2-7B 7B on the Harry Potter dataset. The results show that using normal responses enhances model utility on the HP dataset, while using IDK responses leads to better forgetting quality.
Ablation Study of Good Answer Types on TOFU dataset We designed a prompt instructing GPT-4o not to reveal any information about the two authors included in the forget set from TOFU-1%. Table 15 presents the ablation study on the TOFU-1% dataset using Llama2-7B. Generation is the generated template from GPT-4o. This approach demonstrates the worst performance among the three types, including IDK, normal and generation. One possible explanation is that GPT-4o tends to repeat several words from the question in its answer, which increases its similarity to the ground truth answer and undermines the effectiveness of unlearning.
Good Answer Generation using GPT-4o. For TOFU-1% dataset, the system prompt should be following "You are helpful, respectful, and honest assistant. You must not reply with content that violates copyrights for books, news articles, people personal information, or song lyrics. When I ask questions about the authors Basil Mahfouz Al-Kuwaiti or Nikolai Abilov, you must not provide any information about them or even acknowledge their names since these are the private information. However, for questions about other authors, you should answer accurately and provide relevant information. You should use various and high quality response to answer all my questions even with those about personal information." And then we put each question forget set into the L.IM and get the generated template answer as the good answer.
Ablation Study of Reweighting Mechanism on TOFU dataset Table 16 presents the results of the study the importance of reweighting. The results demonstrate that the reweighting mechanism in FLAT enhances both FQ and MU, achieving an effective balance between unlearning efficiency and overall model capability. The FQ the TOFU-1 % is similar among several baseline methods
27

---

Published as a conference paper at ICLR 2025
Table 15: Ablation Study of good answer type on TOFU-198 % dataset using Llama2-7B. Here we mainly focus on (LAT(KL). "Generation" denotes using the generated template from GPT-40. FQ. MU, R-RL, F-RL represent forget quality, model Kuilitt,OGGEE.. on retain dataset and ROUGE-L on forget dataset respectively. We include the original LLM and retain LLM for reference. The best ones are highlighted in blue.
Metrie
FQ
MU
F-RT(()
R-RI.
Original LLM
4.4883e-06
0.6346
0.9851
0.9833
Retained LLM
1.0
0.6267
0.4080
0,9833
FLATIKL)IDK
0,0286
0.8750
FLATIKL)-Norma
0.0068
0.6162
0.6273
0,9719
FLATIKL.-Gennration
0.0030
0.6338
0,9369
0,9818
Table 16: Ablation Study of the implicit reweighting mechanism on TOFU dataset using Llama2-7B. FQ. MU. R-RI,, F-RI. represent forget quality, model utility, ROUGE-I. on retain dataset and ROUGE-I on forget dataset respectively. We include the original L.M and retain LLM for reference. The best one results are highlighted in blue.
Dataset
TOFU-1%
TOFU-5%
TOF0-
Metric
F-R1(()
R-RI.
PQ
MLU
F-RE(.)
R-RI.
FQ
M11
F-RI(U)
Original
4.4883c-05
0.9851
0.9533
3.0507e-13
0.9918
0,9823
4.65%6e-14
0.9918
Retained LLM
1.0
0.6267
0.4080
0.9633
1.0
0.6281
0.3928
0.9803
1.0
0.6225
0.3970
0.9798
DPO
0.0541
0.6359
0.5860
0,8852
4,748%c-05
0.0
0.0167
0.0162
0.0055
0.0
0,0147
0.0151
SimPO
0.0541
0.6335
0.5199
0,8750
0.0003
0.0
0.0137
0.0151
0.0012
0.0
0.0163
0.0158
(TV)
0.6378
0.4391
0.8836
0,0221
0.0186
0.0647
0.0000
0,0012
0.1624
0.0167
may be due to the small size of the forget set (40 samples). When calculating the distributions of truth ratio for such size, the differences between methods tend to diminish.
E RELATED WORK
E LLM UNLEARNING
LLM unlearning approaches can be broadly categorized into three families: model-based methods, input-based methods, and data-based methods (Liu et al. (024c).
Model-based Methods
Model-based approaches involve modifying the weights and/or architecture
to achieve unlearning. These include gradient ascent (GA) and its variants (Yao et al.) [2023] Maini
iet al.
2024a Chen & Yang, 2023). as well as model editing techniques (Wu et al. [2023] Ilharco
al. 2022, Belrose et al. | 2024). The dominant approach among existing LLM unlearning methods
fine-tuning the original model based on carefully designed unlearning objective function (Chen &
Yang, 2023; Yao al. [0233 Tia et al. 2024, Li al., 2024] Yao et al., 2024] Zhang et al.] 2024).
common strategy combines forgetting and retaining objectives, applying gradient ascent updates to
undesirable data while using regular gradient descent on desirable data (Chen & Yang 2023 Li et al.,
2024). The goal of GA is to maximize the loss on the forget data, essentially reversing the effect of gradient descent during training. Some methods employ custom loss functions that go beyond standard forgetting and retaining losses. For example, Yao et al. (023) introduce loss function with three components, where the custom loss reflects advanced techniques or regularization applied to the objectives. Other methods, such as DPO (Rafallov et al. 2024). KTO (Ethayarajh al. 2024). and NPO (Zhang et al. 2024), utilize reference models to guide the unlearning process.
Chen & Yang (2023) fine-tunes an adapter over the unlearning objective, which acts as an unlearn- ing layer within the LLM. Several works also employ assistant or reinforced LLMs to facilitate unlearning (Ilharco et al., 2222, Eldan & Russinovich] [023)] Huang et al. 2024). Who's Harry Potter (WHP) (Eldan & Russinovich, 2023) is a classic method in LLM unlcarning. It involves three components: reinforced training to identify tokens linked to the unlearning target, replacing unique expressions with generic alternatives using the model's predictions, and fine-tuning the model on alternative labels to crase the original text from its memory. Liu et al. (024d) extends WHP and introduces a causal intervention framework for targeted unlearning. It can achieve strong performance on specific benchmarks (c.g.. TOFU) because it relies on targeted input modifications. However, this approach is specifically designed for target unlearning and lacks generalizability and practicality for other tasks. et al. (2024) introduce an assistant LLM that pursues the opposite of the unlcarning goals, i.e., remembering forgotten documents and forgetting retained knowledge. The unlearned
28

---

Published as a conference paper at ICLR 2025
LLM is then derived by computing the logit difference between the original and assistant LLMs. UNDIAL (Dong et al. 2024) employs self-distillation to adjust logits, selectively diminishing the impact of targeted tokens. This approach ensures smooth convergence while effectively mitigating catastrophic forgetting.
Data-based Methods Data-based methods fine-tune the LLM using set of modified responses. This approach often begins by generating altered outputs (e.g.. refusal-basee responses), such as obliterated responses (Choi et al. 2024), inverted facts (Gu al. 2024), or in-domain plausible alternatives (Mekala et al. 2024). These generated responses are then used to guide the unlearning process. MMkala al. (024)) propose Alternate Preference Optimization, which utilizes in-domain positive feedback on the forget set, complementing the usual negative feedback to overcome the limitations of relying solely on negative feedback during unlearning. this work, we employ reject-based template outputs the modified "good" responses for the forgotten samples.
Input-based Methods Input-based methods craft input instructions (Pawelczyk et al. 2023 Mure
sanu al. 2024 Thaker et al., 2024| Bhaila et al.) 20224 Gao et al. 2024 Liu et al. 2024a). such as in-context examples and prompts, to steer the original LLM toward the unlearning objective without altering the model's 's parameters. These approaches aim achieve unlearning the output space rather than in the parameter space. Among these methods, a notable baseline by Liu et al. (2024a) uses an external prompt classifier as a guardrail, applying embedding corruptions to the identified prompts. The authors demonstrate that this corruption scheme results in distribution-wis wise similarity to the retrained model.
In this work, propose novel loss adjustment method for LLM unlearning, which simultancously utilizes available example responses, effectively combining data-based and model-based methods.
E.2 MACHINE UNLEARNING
In response the data regulation requirements (Hoofnagle et al. 2019), machine unlearning (MU) has emerged as critical process to remove the influence of specific data points, data classes, or even higher-level data concepts from trained machine-learning model. One direct unlearning method involves retraining the model from scratch after removing the forgotten data from the original dataset, which often considered the gold standard (Liu et al., 2024b) Fan al.] 2024). However, this approach comes with significant computational demands. To alleviate this, most research focuses on developing approximate but much faster unlearning techniques, including gradient ascent (Thudi et al., 2022 Graves et al., 1021), influence unlearning (Izzo et al., 2021 Warnecke et al., 2021 I Wu et al. (2022), Fisher forgetting (Becker & Liebig [022] Golatkar et al. 2020), finetuning- based approaches (Liu et al. 2024b Fan al. (023), and loss correction-reatedd unlearning (Adolphs et al.
2022 Wang et al. 2023 Di et al. 2024).
29


Reviews:
[{"review_id": "ZoyRyWwrW6", "reviewer": "Reviewer_n2JT", "summary": "The paper introduces FLAT (Forget data only Loss Adjustment), a novel method for unlearning in large language models (LLMs) without requiring retain data or a reference model. By leveraging f-divergence maximization between template and forget responses, FLAT achieves unlearning solely based on the forget data. The empirical results across three datasets show that the method offers competitive performance, effectively balancing forget quality with model utility.", "questions": "1. Step 1 (template generation) seems to offer various alternatives and variations. Have the authors conducted ablation studies to evaluate the impact of different template response strategies on unlearning performance?\n2. Can the authors provide additional analysis on why simpler baselines, such as Mismatch, occasionally achieve comparable results and how FLAT specifically addresses these edge cases?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The proposed FLAT method addresses a critical limitation in existing LLM unlearning techniques by eliminating the need for retain data or reference models, making it highly practical for real-world applications where such data is often unavailable. The paper provides a thorough theoretical foundation for the method, supported by the use of f-divergence as a guiding principle for loss adjustment. Furthermore, the extensive experiments on diverse datasets (Harry Potter, TOFU, and MUSE benchmarks) demonstrate the versatility and robustness of the method. The paper also situates FLAT well within the landscape of existing methods, clearly delineating its advantages.", "weaknesses": "While FLAT demonstrates strong performance, its advantages over simpler baselines, such as the Mismatch method, appear marginal in some scenarios. For instance, in Table 3, the FLAT (KL) method outperforms alternatives but only slightly, raising questions about the practical significance of these improvements. Additionally, the performance of Mismatch is not consistently included in all subsequent experiments (e.g., Tables 6 and 7), which could provide a clearer comparative analysis.\n\nThe paper also lacks an ablation study on Step 1 (template response generation), despite its pivotal role in the method. Variations in template design could significantly impact unlearning performance, and exploring these effects would enhance the methodological insights.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "iyTNihkpIP", "reviewer": "Reviewer_awBu", "summary": "This paper introduces FLAT, a method for LLM unlearning that does not require access to retain data to maintain model utility. The idea of FLAT is to obtain a model that maximizes the f-divergence between an example response distribution (how the model should respond on the forget data) and the forget response distribution (distribution of forget data). Experiments on three LLM unlearning datasets demonstrate that FLAT can balance the forget effectiveness and model utility, without access to retain data.", "questions": "Please see the weaknesses. Additionally,\n1. Why is the TOFU experiment only conducted on 1% subset? Most works evaluate on all 1%, 5%, and 10%, and it seems 10% is a more difficult setting.\n2. What does it mean to satisfy a criterion in Table 5?\n3. Why is VerbMem calculated using only 1 prefix token? It does not make much sense to only have a single-token prefix.\n4. Why does Table 6 report different metrics from other experiments on TOFU?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 1, "contribution": 2, "strengths": "1. This paper studies an important question of how to perform LLM unlearning when retain data is not available. The paper provides a new perspective from f-divergence, which is missing in existing LLM unlearning works and could benefit future research.\n2. The paper conducts experiments on three datasets, covering different popular LLM unlearning settings.", "weaknesses": "1. My main concern is about the performance of the proposed method. Particularly, on TOFU, FLAT does not show a significant improvement compared to baselines. Most methods achieve similar forget quality (FQ) and model utility (MU), so it's unclear if the improvement is significant or not. Additionally, why is the reported FQ much lower than the NPO paper? On 1% subset, the NPO paper reports a FQ greater than 0.8. The retain performance in Tables 3 and 5 also does not show a significant improvement.\n2. Several related works that also perform unlearning without retain data are missing [1-3]. Particularly, the name change algorithm in [1-2] is not compared. In [2], it shows that this method achieves a much higher FQ while maintaining the MU, without access to retain data.\n3. The presentation of the paper, especially the methodology section, is confusing. Specifically, it is stated that the goal is to maximize the f-divergence in Eq 3. However, how exactly does $\\theta$ appear in Eq 3? Based on the description of the algorithm, both distributions $\\mathcal{D}_e$ and $\\mathcal{D}_f$ seem to have nothing to do with $\\theta$. $\\mathcal{D}_f$ is the distribution for the forget data, and $\\mathcal{D}_e$ is the distribution for the example response on the forget data. So what does it mean to maximize Eq 3 with $\\theta$? How is Eq 4 derived from Eq 3? Some notations, such as $h$, are also confusing. It appears in multiple equations, but it seems sometimes it's the predicted probability for a specific token, and sometimes it's just a predicted token.\n\n[1] Ronen Eldan and Mark Russinovich. Who’s harry potter? approximate unlearning in llms.\n[2] Liu et al., Revisiting Who’s Harry Potter: Towards Targeted Unlearning from a Causal Intervention Perspective.\n[3] Dong et al., UNDIAL: Self-Distillation with Adjusted Logits for Robust Unlearning in Large Language Models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XhEDjJvvI6", "reviewer": "Reviewer_vnkm", "summary": "This paper explores a method for LLM unlearning with only the data designated for forgetting, rather than relying on both forget and retain data. The proposed method employs a weighted loss function comprising two terms: one term encourages the model to produce template/refusal response for the forget data, and the other term discourages the model from generating the original. The experimental results suggest that this method achieves a favorable trade-off between forgetting accuracy and retaining the model's overall performance.", "questions": "* How is the alternative answer sampled? Is it generated by the model undergoing unlearning, or by a separate LLM?\n* It seems that the primary difference between the proposed objective function and the SimPO objective function is the weight for the two loss terms. Is there an intuitive explanation for why the proposed f-divergence-based weighting would perform better than the approach used in SimPO?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "* The paper studies a relaxed unlearning setting for LLMs that does not require retain data, which may be challenging to obtain in some cases. \n* The experiment involves multiple benchmarks, diverse LLMs, and various baseline unlearning methods to offer a comprehensive assessment of the proposed approach.", "weaknesses": "* Unclear Motivation for f-divergence Reweighting: I did not quite follow the method section. Specifically, I think using f-divergence to reweight the loss terms with coefficients $\\lambda_e$ and $\\lambda_f$ remains unclear. The method section (specifically lines 197-215, step 3) states that this maximizes the f-divergence between $D_e$ and $D_f$. But I'm not fully clear why this is beneficial for LLM unlearning.\n* Limited Performance improvement: The experimental results do not clearly demonstrate a significant advantage of the proposed method over baseline methods. For example, the forget quality on the TOFU dataset is similar to that of the baseline methods. Additionally, the NPO method paper reports a substantially higher forget quality (close to 1.0) in the TOFU-1% unlearning scenario, yet Table 4 reports a much lower forget quality for NPO (6e-3).\n* Scalability Concerns: The experiments focus only on the TOFU-1% unlearning setting for TOFU dataset, which involves forgetting information on only 2 authors out of 200 in the synthetic dataset. There is no result on the performance of the method with larger forget sets, such as the TOFU-5% or TOFU-10% settings, raising concerns about the scalability and generalizability of the proposed method.\n\n\nPlease let me know if I have misunderstood any points in the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "G8uqqpxoHi", "reviewer": "Reviewer_DTQM", "summary": "This paper proposes FLAT, an LLM unlearning method that only requires \"forget data\" for parameter update. FLAT is driven by an optimization loss that maximizes the f-divergence between the forget data and the forget query paired with expected unlearned responses. The authors finds in this way model can implicitly choose a balance between promoting exemplary and suppressing bad generations of forget data. Experimental results show FLAT's superiority against previous baselines. More importantly, FLAT does not require optimizing models on \"retain data\" or any reference model to achieve unlearning.", "questions": "1. Should line 235 be log prob inthe equation? Since you have a sum rather than multiplication on probabilities.\n2. Line 371. PO should have the lowest PPL as shown in Table 3.\n3. On TOFU dataset. Did you first finetune base LLMs on fictitious data (including forget, reatin and held-out) and then perform unlearning? I think you should add one sentence explaining that. And the forget quality measures the how close the unlearned model’s output matches a model trained only on the retain data. Should here the input into the unlearned model the input of forget data? Then why we should expect the unlearned model resembles a model trained only on the retain data? I feel very confused with this setting. Could you provide clearer explanation?\n4. I am also wondering why on Harry Potter you used Forget Quality Gap, which is the difference in ROGUE L and and BLEU. However in TOFU you choose to directly compare the ROGUE-L between unlearned model and retained model. As pointed our in line 408, low ROGUE-L doesn’t necessarily indicate to better performance. Then why you still use Forget Quality Gap in Harry Potter?\n5. Is line 512-515 repeated content?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. FLAT is a method without using \"retain data\" or reference models, which is novel and potentially more efficient against previous baselines.\n2. Paper is easy to follow. Proof is provided.\n3. Experiments are comprehensive and convincing.\n4. I like the informative appendices.", "weaknesses": "1. Not really a lot of weaknesses. I just feel that some experimental settings should be more clearly discussed. Please refer to the questions below.\n2. Some repeated contents in the main body and I suspect some equation is not correct. But I can understand. Please refer to the questions.\n\nPlease address my questions one by one. Good luck with the rebuttal.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)