Composable Interventions for Language Models
Authors: Arinbjörn Kolbeinsson
Kyle O'Brien
Tianjin Huang
Shanghua Gao
Shiwei Liu
Jonathan Richard Schwarz
Anurag Jayant Vaidya
Faisal Mahmood
Marinka Zitnik
Tianlong Chen
Thomas Hartvigsen
Venue: ICLR 2025 Poster (2025)
Keywords: Model editing
Compression
Unlearning
Interventions
Language models
Primary area: foundation or frontier models, including LLMs

Abstract: Test-time interventions for language models can enhance factual accuracy, mitigate harmful outputs, and improve model efficiency without costly retraining. But despite a flood of new methods, different types of interventions are largely developing independently.
In practice, multiple interventions must be applied sequentially to the same model, yet we lack standardized ways to study how interventions interact. We fill this gap by introducing composable interventions, a framework to study the effects of using multiple interventions on the same language models, featuring new metrics and a unified codebase. Using our framework, we conduct extensive experiments and compose popular methods from three emerging intervention categories---knowledge editing, model compression, and machine unlearning. Our results over 417 different compositions uncover meaningful interactions: compression hinders editing and unlearning, composing interventions hinges on their order of application, and popular general-purpose metrics are inadequate for assessing composability. Taken together, our findings showcase clear gaps in composability, suggesting a need for new multi-objective interventions.

Published as a conference paper at ICLR 2025
COMPOSABLE INTERVENTIONS FOR LANGUAGE MODELS
Arinbjörn Kolbeinsson University of Virginia & Askan ar arinbjorn@virge wiw.niiiiiiiiiio edu
Kyle O'Brien ElcutherAI
Tianjin Huang* University of Exeter
Shanghua Gao Harvard Medical School
Shiwei Liu University of Oxford
Jonathan Richard Schwarz
Thomson-Reuter Foundational Research
Anurag Vaidya Harvard Medical School Mass General Brigham
Faisal Mahmood
Marinka Zitnik Harvard Medical School
Harvard Medical School
Mass General Brigham
Tianlong Chen
Tom Hartvigsen
UNC Chapel Hill
University of Virginia & Thomson-Reuter Foundational Research
Sartvigssenvirriiiia
ABSTRACT
Test-time interventions for language models can enhance factual accuracy, miti- gate harmful outputs, and improve model efficiency without costly retraining. But despite a flood of new methods, different types of interventions are largely devel- oping independently. In practice, multiple interventions must be applied sequen- tially to the same model, yet we lack standardized ways to study how interven- tions interact. We fill this gap by introducing composable interventions, frame- work to study the effects of using multiple interventions the same language models, featuring new metrics and unified codebase. Using our framework, we conduct extensive experiments and compose popular methods from three emerg- ing intervention categories knowledge editing, model compression, and machine unlearning. Our results over 417 different compositions uncover meaningful in- teractions: compression hinders editing and unlearning, composing interventions hinges on their order of application, and popular general-purpose metrics are in- adequate for assessing composability. Taken together, our findings showcase clear gaps in composability, suggesting need for new multi-objective interventions
INTRODUCTION
Language models (LMs) exhibit striking capabilities important tasks in many domains including medicine (Singhal et al. 2023), finance (Wu et al. (2023), science (Tylor et al.) 2022). and enter-
tainment (Zhong et al. 2023a). But despite high performance, deployed LMs can still misbehave unpredictably and require updates. For example, LMs generate content that is hallucinatory (Ji
et al. 2023), factually incorrect (Zhao et al.) 2023b), and harmful (Mendelsohn et al.) 2023 Jain
et al. 2024 Hartvigsen et al., 2022). Beyond unwanted behaviors. user requirements also change
over time. For example, regulations arise (The President of the United States 2023), computa-
tional resources constrict, knowledge gets outdated (Tack et al. 2024). and copyrighted training
All of our code is available at: gettablccmhartigeegggopooopppppe ont.raaeeeoocooooooooeeeeeeeennn
"Equal contribution.

---

Published as a conference paper at ICLR 2025
Expensive Pre-training
Independent Interventions for Language Models
g.g., Llama (Towsoon et al, 2023]
training data
"Swine Flu"
65B parameters
"COVID"
2,048 A100 GPUs $2.44 21 days
quantize
deployment lisre
>1,000 tons CO2
"Latest US
forgot traiining data
pandemic"
prune
Unlearning
Knowledge Editing
Compression
Generative
do
deployment
L.M
00
Kn. Edit
- 0
Compress
02
Unlearn
-
0g
Proposed Framework:
Composable Interventions for Language Models
Figure 1: Interventions aim update targeted properties of language models without impacting unrelated behaviors or adding excessive compute. We introduce and extensively experiment with composability of different interventions used the same model.
materials are identified (Grynbaum & Mac 2023). Without ways to quickly address these issues, models can be left unsafe, outdated, biased, and non-compliant with laws or regulations, limiting their widespread responsible use (Kaddour et al. 2023).
Many recent works study efficient, in-place updates for LMs. We broadly refer to these as inter- ventions-uudates to targeted properties of LMs applied after pretraining (and optional fine-tuning).
For example, we can view model compression (Zhu et al. 2023 Frantar et al. 2023
Frantar &
Alistarh 2023) as an intervention to make language models more inference- or memory-effiiient
Other rapiday advanccig examples include knowledge editing (Mazzia et al., 2023 Hartvigsen et al.
2023
Meng et al. 2022 2023; Yu et al. 2024 Tan et al., 2024). detoxification Welbl et al. 2021
Yu et al. 2023 Wang et al. 2022 Suau et al.) and unlearning (Liu et al. 2024a Lynch al. 2024
Eldan & Russinovich 2023 Lucki et al. 2024). However, these interventions are largely advanc-
ing independently. In practice, we usually have multiple requirements for properties of our models (e.g., factuality and efficiency). And as requirements change over time, new interventions must be applied. While some works have started studying interactions between training objectives (Matzken al. 2023 Xu et al., 2023b Li et al.) 2024b), practical widespread use is limited without unified evaluations for how interventions interact.
As depicted in Figure 1 we propose that practical interventions should be composable: When an intervention is applied to model, it should avoid interfering with success of prior or future inter- ventions. For example, model user might need to repair factual eπror in an LM using a knowledge editing method. Later on, they might have to quantize that model for deployment on mobile devices. A composable quantization method should specifically preserve the edited fact and a composable editor should withstand quantization. However, it remains unknown how well existing interventions compose, and we lack formal notions of intervention composition. We therefore propose two met- rics for composability: 1) Order-free Error, where an intervention is composable if its application leaves others' success unimpacted, and 2) Order Sensitivity, where the combined success of multiple interventions should not depend on the order which they are applied. We instantiate these metries in a codebase that includes popular interventions, tackling major lack of standardized code that has inhibited cross-intervention evaluations until now.
We use our framework extensively study composability of state-of-the-art knowledge editing, model compression, and machine unlearning interventions popular and recent LMs. Our exper- iments with 417 different compositions unearth novel insights and offer guidance for composing recent methods. Three key results are follows: ! Model compression often limits the suc- cess of other interventions. This suggests significant drawback of existing compression methods, which are nearly universal LM deployments. ② The order in which interventions are applied dramatically alters their success. Therefore, need new interventions explicitly designed for
2

---

Published as a conference paper at ICLR 2025
composabilityy. ② General-purposs post-intervention model performance is a poor proxy for composability. This indicates that targeting composability metric has the potential to drive the development of new, practically -orooaallyggounned interventions. Taken alongside our other findings (Sec- tion our experiments suggest we sorely need to broaden intervention method evaluations and to design new methods explicitly for composability.
Our key contributions are as follows:
We introduce the notion of composability for post-training interventions to LMs.. Our work opens doors to address crucial, practical challenges in online LM updates and broadens evaluation criteria for interventions.
Our main contribution is extensive experimentation, identifying unknown interactions be- tween knowledge editing, model compression, and machine unlearning.
Our findings suggest clear need to develop novel interventions that target composability, a crucial property of practical interventions.
We release an extendable codebase that unifies many statc-of-the-ar implementations to enable others to develop new multi-objective interventions.
2 METHODS TO EVALUATE INTERVENTION COMPOSABILITY
2.1 PRELIMINARIES: INTERVENTIONS FOR LANGUAGE MODELS
Assume given language model fe, where 0 θ contains its pre-trained parameters and θ is the parameter space. We define intervention & as the combination of four things: 1) operator ((e.))) that produces of intervention, 3) a loss {(w(fe:>)) that specifies the targeted update and evaluation criteria x(fo, D) E [o, 1], where higher scores indicate better performance. Each intervention's 's operator aims minimize loss l and ultimately achieve high performance according to k. For readability, denote the application of intervention model fe (()).
model fo. 2) hyperparameters 7, which typically control the strength
2.2 COMPOSABLE INTERVENTIONS FOR LANGUAGE MODELS
We propose that multiple interventions should compose with one another. Consider N possible interventions {Ø:
N-1 H Intervention composition is the application of multiple interventions to model in sequence For example, we might apply intervention án model fo. then Φi to the intervened-upon model. We write this composition either &1 (do(Jo) Φ1 (o(f))
Most interventions Φ; are developed specifically for their own criterion K;. For simplicity, we let each intervention have one criterion, though in practice many have multiple. We propose that the quality of many interventions in practice should also relate to how an intervention impacts our ability to apply other interventions. To meet this need, we propose two metrics that measure such compos- ability. Each is computed for given criterion K2 and can be computed for a single hyperparameter setting or ranged over multiple settings to attain richer description of intervention interactions.
Our evaluation strategy is straightforward: After applying an intervention (x we measure its success as (o)(.))) Then, we can add another intervention é; and measure ky(0, (x())) The difference between these measures then elicits how Φ; impacts the success of Φi according to KG. To disentangle absolute performance on K; from the interventions, we explore the impact of ordering by reversing the interventions and computing (i o (fo)). By pairing absolute changes with results from different orderings, we isolate direct interactions between interventions. Overall, this approach provides guidance when choosing interventions to compose and illuminates failure modes
"Some interventions require data, but we remove data-dependent notation for simplicity. For readability, deseribe framework terms of two interventions, even though it scales.
3

---

Published as a conference paper at ICLR 2025
of existing methods. We next describe two concrete composability metrics. The first describes best-case composability regardless of order, and the second isolates the impact of ordering.
Composability Error Metric 1: Order-free Error. Interventions are more composable if they achieve high performance when applied in either order. We therefore measure the impacts of adding a second intervention to model regardless of order for a chosen criterion Kę using order-free er- ror, computed as the area above the maximum of two curves. small area means higher overall performance on the metric. We use the maximum criterion value as an upper bound for this area, and assume it is I, though this is easily changed in practice. Each curve corresponds to an order in which each intervention is applied and sweeps over hyperparameter choices for 7/
1 min (n,lon 0 (fo 11)) K. (1)(( (
intervention order
intervention order
A smaller area indicates better composability. By sweeping over hyperparameters, this measure pro- vides a general sense of composability without choosing hyperparameters ahead of time. The area can be computed for any criteria K-in our experiments, we evaluate all criteria for each composi- tion. In practice, not all hyperparameters are practical. For example, harsh model compression can have catastrophic impacts on model utility and so comparing interventions at extreme levels may be unrealistic. Therefore, we can also set a bound on acceptable performance decay with respect to R; or any other criterion when using Equation [ and can also easily be measured for hand-chosen hyperparameters, and for single setting Yh Order-free Error reduces to the simple error score: (fe))).
min (x; (fe. ()), Ni (7))
Composability Error Metric 2: Order Sensitivity. Interventions performance is invariant to their order of application. We measure order invariance for criterion Ka as the area between the two curves defined by each direction of intervention application. Again, we compute this across hyperparameter choices for 7/2:
composable if their
[ (o, (f((f.7)))
o
(2)
A smaller area again indicates better composability. And again, if hyperparameters are already chosen, this simplifies to a straightforward error: (<:( <<(o)())) o (Jo))))
Overall, measuring Order-free Error and Order Sensitivity provides the first insights into intervention composability. Each reduces to a simple form for point measures of the impact of composition. While more computationally costly, the broader sweeps over hyperparameters enable clearer pictures of how interventions interact. As shown in Section B the curves produced by these sweeps also enable intuitive, visual understandings of composability.
EXPERIMENTAL SETUP
We study the effects sequentially applying multiple interventions to the same model on perfor- mance as measured by intervention-specinn metrics and overall utility. Understanding these effects crucial for the practical application of test-time interventions. The following sections detail our experiments to illuminate how composable various interventions are across model editing, unlearn- ing, and compression.
3.1 INTERVENTION DATASETS, METHODS, AND METRICS
We select ten methods from the three categories of interventions below. Each features task-specifis and overall utility metries. Appendix Becanndxxfuutttee further elaborates and Table summarizes our setup.
Knowledge Editing, LMs' knowledge can be fundamentally incorrect grow outdated. Knowl- edge editing aims update facts according LMs, typically framed question-ant anestinn-nsswering Here,
4

---

Published as a conference paper at ICLR 2025
INTERVENTIONS
METHODS
DATASETS
INTERVENTION METRICS
COMPOSABILITY METRICS
MODELS
Knowledge
Finetuning, MEMIT
Generalization. Striet Edit Locality, MMLU
Editing
ZARE
Model
Praming: Wanda, SpansGPTT
Order free Error
(Equation D
Llama-3 SB
Compression
Quantization: GPTQ.AW)
MMLU
Mistral 7B Instruct
Machine
Gradient Difference (GD),
Gradient Ascent (GA).
WMDP MMLU
Order Sensitivity
(Equaaion
Chat
Unlearming
Represcutation Misdirection
Unleurning (RMU)
Table I: Summary of the methods, data, and metrics used in our experiments. We use Llama-3 8B as the benchmark model our main results (Section 4 and conduct additional generalizability exper- iments on Mistral 7B Instruct and Yi 1.5 9B Chat. Composability metrics apply to all experiments.
where models are edited to return updated answers to questions by increasing the likelihood of the correct answers. We use three methods, including the popular MEMIT (Meng et al. 2023) editor, as well as LoRA (Hu al., 202T) and finetuning, which have recently been shown to be surprisingly successful editors, despite their simplicity (Gangadhar & Stratos 2024 Hsueh et al., 2024| Hua
ct al. 2024). We use the zsRE (Levy al. 2017) dataset, which is popular question-ansween benchmark for knowledge editing.
To evaluate editors' performance, use three standard metrics (ao et al. 2023): Edit success measures whether the post-edit model successfully outputs the correct, edited response. Edit gen- erulization measures how well the edit generalizes to other gemanticall--equivllee inputs. We compute generalization as the average edit success across set of 10 holdout edit rephrasings. Strict Edit locality measures the impact of edits on unrelated inputs as the average success on random, unedited samples. All editing metrics are computed as the F1 score on the correct output logits as a strict measure of editing performance- intended outputs must be the most-likely tokens after editing. Each metric's ' highest value 1.0.
Machine Unlearning. LMs can learn undesirable knowledge from their pretraining data, including information that is potentially dangerous (Li et al. 2024a) copyrighted (Karamolegkou et al. 2023]
Meeus et al. 2024), toxic (Sheng et al., 2019 Gehman et al.) 2020 Hartvigsen et al. 2022), or
memorized (Crllnii al. 2018 Ippolito al. 2022 Biderman et al.
2023 Prashanth al. 2024).
Machine unlearning methods aim remove undesirable knowledge from LMs without regressing
2024a). We experiment with performance extraneous domains (Cao & Yang 2015 Liu al.
three popular and representative methods: Gradient Ascent (GA) (Jang al. 2022), Gradient Dif- ference (GD) (Maini et al. 2024), and Representation Misdirection for Unlearning (RMU) (Li al.
2024a). GA is a traditional approach that minimizes the likelihood of chosen unlearning targets. GD augments GA by also maintaining the LM's predictions on unrelated retention data. RMU, the most recent method, perturbs the model's representations for inputs related to the learning target. Further details are in Appendix C.4
We evaluate unlearning with Weapons of Mass Description Proxy (WMDP) (Li et al. 2024a), updat- ing LMs to forget potentially hazardous biosecurity and cybersecurity knowledge. We average the performance on WMDP's cyber and bio splits, totaling 3,260 questions. We report individual split performance in Appendix E Optimal unlearning yields 25% accuracy as this is random performance on the four-choice benchmark.
Unlearning is a broad problem area. While, WMDP is among the most studied unlearning bench- marks, recent works have suggested that WMDP performance provides an imperfect evaluation of unlearning writ-large. We proceed with leveraging WMDP is a sufficient evaluation setting for measuring composability when applied unlearning, but caveat that comprehensive evaluation of unlearning is open research problem.
5

---

Published as a conference paper at ICLR 2025
Model Compression. LMs require significant compute resources during pretraining, finetuning, and inference. Model compression methods aim reduce resources needed at test-time. We ex- periment with four popular, state-of-the-art weight pruning and quantization methods. For pruning, we choose SparseGPT (Frantar & Alistarh 2023) and Wanda (Sun et al. 2023). For quantization, we choose GPTQ (Frantar et al.
2023) and AWQ (Lin et al.. 2023). Pruning and quantization are used for different reasons, so we generally avoid comparisons between the two, Each algorithm has a hyperparameter that controls the compression level-% of zeroed weights for pruning, bity for quantization. Naturally, efficiency grows with compression, but at the expense of task performance. We vary this hyperparameter to explore various levels of compression, choosing sparsity levels of .25, .35, .45, .55, .65, and .75 for pruning and 2, 3, 4, and bits for quantization down from 16 bits. We note that most compression techniques require decompressing models, so we recompress after editing or unlearning using the same compression technique.
Measuring General Model Utility. All interventions aim to avoid degrading overall model utility.
While assessing general performance of LMs an active area (Dehghani et al. 2021 Biderman
al. 2024 Gupta al. 2024), we make the standard choice evaluate question- answering accu-
racy MMLU (Hendrycks et al.) 2020) using the LM Eval Haresss (Gao al. 2023 of 25% indicates random predictions.
Accuracy
3.2 IMPLEMENTATION DETAILS
All experiments in our main results (Section 4 are performed with Llama3-8B (A Meta 2024). which is well-studied and highly capable for its parameter count. All results for knowledge editing methods are averaged over 10 batches of 50 randomly-selected edits from zsRE Further details on implementations and hyperparameters are Appendix C
RESULTS
In the following subsections, we first examine how each pair of interventions compose individually, then summarize general trends. We measure composability using our metrics from Section 2 for each intervention's criteria and report impacts of compression at different levels. All intervention pairs are applied in both directions (e.g.. MEMIT before AWQ and AWQ before MEMIT), For composability metries, we compare methods regardless of metric ranges by counting the number of times each intervention method outperforms the others (# Wins) with ties counting as losses.
4.1 COMPOSING MODEL COMPRESSION WITH KNOWLEDGE EDITING
Our results are shown in Figure 2 where we find that model compression and knowledge editing interact in meaningful ways at different levels of compression. We report three editing metrics and MMLU to measure general model degradation. All results are averaged (mean) over 10 batches of 50 edits each. Illustrated below, these experiments reveal that there is a large gap in composability of existing methods. Our findings are as follows.
① Model compression degrades editing performance. Across Figure 2 edits made by MEMIT, LoRA, and Finetuning deteriorate as compression increases. In weight pruning, the editing met- rics, Success, Generalization, and Locality, steadily drop with higher sparsity. For quantization, the steepest drops occur between and Bits, and GPTQ decays editing performance faster than AWQ. While general performance decay from compression unsurprising, its steepness varies dra- matically between editors and compression methods. Decay curves also depend on the order of interventions. Finetuning remains surprisingly strong baseline higher compression levels, often surpassing MEMIT LoRA. Overall, these results suggests that model compression limit model's editability.

---

Published as a conference paper at ICLR 2025
Weight Pruning
Quantization
FT
MEMIT
LoRA
FT
MEMIT
LoRA
Edit Success
6.25
6,50
0.25
0.50
3.25
0.25
0.50
0.55
1.04
Ceneralization
6.8-
0.5
0.8-
6.5
6.5
6.75
3.50
3.5
0.5
0.5
0.50
6.22
0.50
0.75
16
3.20
0.20
3.20
Striet Locality
0.05
3.22
0.15
0.17
0.12
0.30
9.00
0.40
0.10
0.00
0.05
9:05
0,07
5.7
0.05
0.00
0.00
0.00
5.00
2,00
0.00
9.50
6.26
6.50
0.75
0.00
3.26
0.30
0.76
0.00
0.25
0.30
0.55
0.6
6.6
0.5
0.6
0.6
MMLUT
0.6
5.6
0.4
0.4
0.6
5.4
0.2
5.2
02
02
0.2
5.2
0.50
Sparsity
Sparsity
Sparsity
Bits
Bits
Bits
FT FGPS
MEMIT SSPT
LoRA SGPT
FT FT-CPIQ
MEMI GPTQ
LORA-GPTO
MEMIT
GPTQ
GPTO MEMIT
GPTQ
FT Wande
MEMIT-Wande
LoRA Wazdl
FT AWW
MEMET-ANC
LWQ
Wazda FT
Wanda MEMI
Wanda - LoRA
AWQ-FT
AWQ-MEMIT
AWQ - LoRA
Edit - Compress
Compress + Edit
Figure 2: Composing Knowledge Editing with Model Compression with varying degrees com-
pression. Higher values are better for all metries. Key Takeaways: Editing post-compression generally outperforms the reverse order, as compression tends to degrade edit performance and all editors exhibit order sensitivity.
② Editing performance hinges on the order of interventions. The shaded between the curves in Figure 2 shows the impact of ordering. Ordering is highly impactful in most cases and varies dramatically between editing methods. For pruning methods (left side), compressing first is generally better than editing first. For example, pruning after Finetuning or LoRA destroys edits much faster than if the model had been compressed first. For quantization (right side), the order also matters, but the best order differs by method. For GPTQ, editing should be done first. For AWQ, compression should be done first. This finding suggests that these interventions interact in meaningful ways and successful composition will benefit from tailored, composable methods that have expected hehaviors.
Composability can vary within the same intervention category. We next summarize the gen- eral composability of each intervention pair in Table 2 using the metrics from Section 2 Order-frea Error (L) measures best-case composition error, while Order Sensitivity (L) measures unwanted fects of intervention ordering- These metrics let us compare methods according to composability, and we find that 1) MEMIT generally the most composable editor, totaling 14 wins compared to by Finetuning and by LoRA, 2) SparseGPT is the most composable pruning method with wins compared Wanda's 6, and 3) AWQ far surpasses GPTQ, achieving 17 wins compared GPTQ's However, many wins quite close and composability can change dramatically between metrics. These results indicate need many metrics explicitly target and evaluate composability.

---

Published as a conference paper at ICLR 2025
Edit Success
Edit Generalization
Order-free Error (J)
Order Sensitiiity (U)
Order-free Error ())
Order Sensitivity (1)
Method
FT
MEMIT
LoRA
FT
MEMIT
LoRA
FT
MEMIT
LoRA
FT
MEMIT
LoRA
# Wons
Wanda
.11
.05
.05
.03
.24
.08
20
.10
46
.44
.21
.01
SparseGPT
.23
AWQ
011
07
00
04
001
008
.66
-11
26
00
.00
.14
12
GPTQ
.21
.16
42
.36
40
.36
.11
.27
# Wins
0
Striet Edit Locality
MMLU
Order-free Error (J)
Order Sensitivity ())
Order-free Error (J)
Order Sensitivity (1)
Method
FT
MEMIT
LoRA
FT
MEMIT
LoRA
FT
MEMIT
LoRA
FT
MEMIT
LoRA
Wins
Wanda
.89
.97
.96
.04
.40
.00
.00
SparseGPT
.89
96
96
.03
.00
.00
.40
.40
.00
.00
.00
AWQ
85
96
93
04
000
003
41
.41
41
.02
011
.00
5
GPTQ
96
95
.07
.41
.00
# Wins
0
Table Composability metries for Knowledge Editing composed with Model Compression. Order- free Error (U) measures best-case error, while Order Sensitivity (1) measures unwanted effects of intervention re-ordering. Wins is the number of times each method outperforms others in its category, counting all ties losses. Sparsity is 25% and quantization is 4-bit. Key Takeaways: AWQ composes better than GPTQ and LoRA is surprisingly non-composable.
Overall utility evaluations fail to measure composability. Despite similar MMLU scores, methods vary significantly in composability. For example, Table 2 shows that MEMIT and Wanda achieve near-perfect Order Sensitivity on MMLU but have 0.24 Order Sensitivity Edit Success. This is bolstered by Figure 2 where all compositions are similar according MMLU, but not according to editing metrics. The disparity between overall utility and composability metrics under- scores the need for more nuanced evaluations explicitly targeting composability design criterion.
4.2 COMPOSING MODEL COMPRESSION WITH MACHINE UNLEARNING
5 Compression hinders unlearning. Our main results in Figure 3 show that applying unlearning to compressed model can degrade unlearning performance, measured via WMDP (Section 3.1 With RMU, pruning the model before unlearning can significantly regress unlearning performance, especially at higher sparsity levels. There is similar trend with quantization when composing RMU and GPTQ. With GD, we similarly find that pruning after unlearning is best, though quantizing first can be best. We observe the opposite trend with GA, though GA's poor unlearning performance, as seen in other studies (Maini et al. 2024 Zhang et al., 2024 Wang et al. 2024), is possible con- founder. Overall, unlcarning compressed model is hard, but the degree to which cost-compression unlearning hurts performance contingent on the composition and compression level.
Order Sensitivity can determine overall composability. Table reports the composability metries of each unlearning technique. Both GD and RMU's successful unlearning (low Order- free Error), with RMU having lower overall Order Sensitivity than GD. While task performance critical, it alone does not fully capture the practical challenges of applying interventions RMU is more robust to order.
4.3 COMPOSING KNOWLEDGE EDITING WITH MACHINE UNLEARNING
We next examine the composability between editing and unlearning. Both categories of interven- tions aim modify the model's knowledge without degrading overall utility. The need keep LMs factually updated while forgetting undesirable knowledge makes pairing editing and unlearning practical composition.
8

---

Published as a conference paper at ICLR 2025
Weight Pruning
Quantization
7.-
0.5
0.6-
0.0
36-
0.5
WMDP
92
9.2
6.8
02
2.75
0.02
622
0.72
2.5
0.6
0.5
25
0.3
0.5
0.5
05
0.3
MMLU
24-
6.4
6.8
02
0.0
0.25
0.50
2.75
0.00
622
0.30
0.75
3.00
5:55 0.00
0.7
16
15
16
Sparsity
Sparsity
Sparsity
Bits
Bits
Bits
GA + SGPT
GD
RMU - SGPT
GA-GPTO
GD GPTQ
RMU - GPTQ
SGPT GA
SGPT~GD
SGPT RMU
GPTQ GA
GPTQ CD
GPTQ RMU
Wanda
Wanda
RMU Wanda
GA-AAW
Wanda GA
Wanda - CD
Wanda RMU
AWQ-GA
AWQ-GD
AWQ RMU
Unlearn + Compress
Compress Unlearn
Figure 3: Composing Machine Unlearning with Model Compression at different levels of compres-
sion. Key Takeaways: Unlearning should generally be applied before compression, and perfor- mance varies significantly by composition.
WMDP (Unlearning)
MMLU
Order-free Error (L)
Order Sensitivity ())
Order-free Error (L)
Order Sensitivity ())
Method
GA
GD
RMU
GA
GD
RMU
GA
GD
RMU
GA
GD
RMU
# Wins
Wanda
.46
.35
.29
.03
.17
.03
.46
.42
.43
.02
.01
.01
4
SparseGPT
.43
.28
.28
.03
.22
.02
.49
.42
.3.
.06
.09
.01
4
AWQ
.43
.24
.77
.02
.00
.01
.53
.88
44
.02
.07
.01
GPTQ
.34
.24
.27
.02
.52
.42
.09
.24
.05
Wins
0
2
2
2
0
0
3
Table 3: Composability metrics for machine unlearning and model compression. Key Takeaways: GD and RMU have overall comparable performance and far outperform GA. RMU is less sensitive to ordering than GD.
7 Editing and unlearning are highly composable for some unlearning methods. Table shows that the editing metrics' Order-free Error and Order Sensitivity vary greatly between unlearning techniques. RMU has a lower overall Order-free Error and Order Sensitivity than every other un- learning technique across all editors. Similar Section 4.2 we find that GD can perform compa- rably to RMU but with worse Order Sensitivity. GA's catastrophic forgetting makes unsuitable for composition. Excluding GA, editing does not disrupt the model's ability forget the unlearning target, possibly due knowledge editing's 's relatively surgical modification to the LM and targeting knowledge semantically distinct from the WMDP unlearning target. Together, these results imply that editing and unlearning be composable, but composability depends most the unlearning technique.
4.4 TRENDS AND GENERALIZATION ACROSS MODELS
finally summarize trends revealed when considering all findings.
Ablation experiments with Mistral 7B Instruct and Yi 1.5 9B Chat show that composi- tion metrics generally consistent across LMs. The exception being Fditinge+Compressoon,

---

Published as a conference paper at ICLR 2025
Edit Success
Edit Generalization
Order-free Error ())
Order Sensitivity (J)
Order-free Error (1)
Order Sensitivity ())
Method
FT
MEMIT
LoRA
MEMIT
LoRA
FT
MEMIT
LoRA
MEMIT
LoRA
Wins
GA
93
.52
.00
.07
.48
1.0
96
.59
.22
.04
.11
.78
1
GD
011
.07
00
-67
.40
-66
.19
_11
.29
.56
.1
.48
0
RMU
.00
00
.01
.18
.07
.29
10
# Wins
0
3
0
WMDP (Unlearning)
MMLU
Order-free Error (1)
Order Sensitivity (.)
Order-free Error ())
Order Sensitivity (.)
Method
FT
MEMIT
LoRA
MEMIT
LoRA
FT
MEMIT
LoRA
FT
MEMIT
LoRA
Wins
GA
.47
.40
.28
00
.05
.07
.47
.51
.64
.11
04
.07
1
GD
.99
.26
.30
.00
02
.24
41
.42
41
.18
.22
.14
4
28
.44
Wins
0
Table 4: Composability metrics for Machine Unlearning composed with Model Editing. We study compression at 25% sparsity and 4-bit quantization. Note that lower values of WMDP MCS indi- cate more unlearning and therefore better performance while higher values are better for the other metries' MCS. Key Takeaways: Editing and unlearning are successfully composable for GD and RMU, with RMU having the lowest Order Sensitivity.
as expected since performance has been shown to vary between models (Meng et al. 2023) Editing++Unlamming and Compression++Unleamin These results (detailed Appendix [E1I) suggest intervention composability trends often generalize similar models. We also experiments across model families and sizes in Appendix E.2
consistently exhibit low Order Sensitivity.
Compression consistently hinders other interventions. Compressing edited model can regress editing performance. Unlearning on a compressed model is often more challenging than the base model. The same trends appear with triplet interventions, Appendix [..41] These trends suggest compression may alter how models encode knowledge. making targeted updates harder. Previous works have explored how compression leads to knowledge loss (Hooker et al., 2019 Du et al.) 2021 Azeemi et al. 2023 Hoang et al. 2023) and how editing modifies model internals, increasing fragility (Brown et al. 2023a Gu et al. 2024b). However, the relationship between how models are compressed and how knowledge is modified remains underexplored. Understanding these dynamics could guide more composable interventions and illuminate how LMs encode knowledge.
MMLU is insufficient for measuring composability. MMLU is a common measure of model's general performance, but similar scores can mask significant differences in intervention perfor- mance. Interventions generally appear more composable on MMLU than on other metries. Thus, advocate for thorough multi-metric and multi-dataset evaluations for composable interventions.
5 CONCLUSION
We conduct an extensive study of composing test-time interventions for language models. Our setup aligns with the practical need to update the same models multiple times as use cases evolve and training remains expensive. We deploy this new framework to investigate composability between popular interventions spanning knowledge editing, machine unlearning, and model compression. We show that these interventions interact in non-trivial ways, pointing to concrete directions for future work. We further discover guidance for current practice: model compression harms other interventions, unlearning compressed models is especially hard, and the order in which interventions are applied changes their outcomes substantially. Our composability metrics also pave the way for formal investigations and practical principles. Finally, our framework is general and naturally extends broad range of test-time interventions.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGEMENTS
We thank the University of Virginia Research Computing team for providing access to excellent high-performance computing resources.
REFERENCES
Al@Meta. Llama 3 model card. 2024. URL httpss///ssauub..c//ttteee----
Lama3/blone mealoo/mminn.. / CARD md
Abdul Hameed Azeemi, Ihsan Ayyub Qazi, and Agha Ali Raza. Data pruning for efficient model pruning in neural machine translation. In Conference Empirical Methods in Natural Language Processing, 2023.
266176746
Stella Biderman, USVSN Sai Prashanth, Lintang Sutawika, Hailey Schoelkopf, Quentin G. Anthony, Shivanshu Purohit, and Edward Raf. Emergent and predictable memorization in large language models. ArXiv, abs/2304.11158, 2023. URL https: /api. semanticscholary org/
Corpus 25:22911
Stella Biderman, Hailey Schoelkopf, Lintang Sutawika, Leo Gao, Jonathan Tow, Baber Abbasi, Al- ham Fikri Aji, Pawan Sasanka Ammanamanchi, Sidney Black, Jordan Clive, Anthony DiPofi, Julen Etxaniz, Benjamin Fattori, Jessica Zosa Forde, Charles Foster, Mimansa Jaiswal, Wil- son Y. Lee, Haonan Li, Charles Lovering, Niklas Muennighoff, Ellie Pavlick, Jason Phang, Aviya Skowron, Samson Tan, Xiangru Tang, Kevin A. Wang, Genta Indra Winata, Franccois Y Yvon, and Andy Zou. Lessons from the trenches reproducible evaluation of language models. 2024. URL attpss:/aape wtw.:el.seaannicccchcooooo wwt.:o/aarrrrroooooooeooeo wtt//orppsssIII 269982020
Davis Brown, Charles Godfrey, Cody Nizinski, Jonathan Tu, and Henry Kvinge, Edit at your own risk: evaluating the robustness of edited models to distribution shifts. 2023a. URL https:
//api. htt..//matttccccbolaa.....///r/r
Davis Brown, Charles Godfrey, Cody Nizinski, Jonathan Tu, and Henry Kvinge. Robustness of edited neural networks. arXiv preprint arXiv:2303.00044, 2023b.
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. 2015
IEEE Symposium on Security and Privacy, pp. 463-480, 2015. URL https: //api.
Gemanticscholoe httptool.....rrr/oooouusas555551
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jemnj Kos, and Dawn Xiaodong Song. The se- cret sharer: Evaluating and testing unintended memorization in neural networks. In USENIX Security Symposium, 2018. htllhttps://aa wwwanticscholoooocc.omcccc CorpppruurrrCCrpIIII::::
170076423
Roi Cohen, Eden Biran, Ori Yoran, Amir Globerson, and Mor Geva. Evaluating the ripple effects of knowledge editing in language models. Transactions of the Association for Computational Linguistics, 12:283-298, 2024.
Nicola De Cao, Wilker Aziz, and Ivan Titov. Editing factual knowledge in language models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp- 6491-6506, 2021.
Mostafa Dehghani, Yi Tay, Alexey A. Gritsenko, Zhe Zhao, Neil Houlsby, Femaand Diaz, Donald Metzler, and Oriol Vinyals. The benchmark lottery. ArXiv, abs/2107.07002, 2021. URL https:
Tim Dettmers, Mike Lewis, Younes Belkada, and Luke Zettlemoyer: Llm. int8 O: 8-bit matrix multiplication for transformers scale. arXiv preprint arXiv:2208.07339, 2022.

---

Published as a conference paper at ICLR 2025
Mengnan Du, Subhabrata Mukherjee, Yu Cheng, Milad Shokouhi, Xia Hu, and Ahmed Hassan Awadallah. What do compressed large language models forget? robustness challenges in model compression. ArXiv, abs/2110.08419, 2021. URL httpss///pp.smmnntccccho.....a
SIt/CooppuID:239001
Ronen Eldan and Mark Russinovich.
Who's harry potter? approximate unlearning in
1lms. ArXiv, abs/2310.02238, 2023.
URL https:/ semant htCpos//ap...ematticcccol..., org/
CorpusID:2636081337
Elias Frantar and Dan Alistarh. SparseGPT: Massive language models can be accurately pruned in one-shot. In International Conference Machine Learning. 2023.
Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh. GPTQ: Accurate post-training
quantization for generative pre-trained transformers. In International Conference on Learning Representations, 2023.
Govind Gangadhar and Karl Stratos. Model editing by pure fine-tuning, 2024.
Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Fos- ter, Laurence Golding, Jeffrey Hsu, Alain Le Noac'h, Haonan Li, Kyle McDonell, Niklas Muen- nighoff, Chris Ociepa, Jason Phang. Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lin- tang Sutawika, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. A framework org for few-shot language model evaluation, 12 2023. URL httthtttpp///eette www.o/dooo..rrrrrrrr.do.... records/ 10256836
Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. Realtoxici- typrompts: Evaluating neural toxic degeneration in language models. In Findings. 2020. URL
https: seepp::
semant wesccccssaateo htt.://aa...gggoooss::::::::00:: 121117777
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Se- lective forgetting deep networks. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9301-9309, 2019. URL. https: http:///ppp.aaaiiiiee.eeem
oxc//oorpusI::20766222
Michael Grynbaum and Ryan Mac. The times openai and microsoft over a.i. use of copyrighted work. The New York Times, 2023.
Jia-Chen Gu, Hao-Xiang Xu, Jun- Yu Ma, Pan Lu, Zhen-Hua Ling, Kai- Wei Chang, and Nanyun Peng. Model editing can hurt general abilities of large language models. arXiv preprint arXiv:2401.04700 2024a.
Jia-Chen Gu, Haoyang Xu, Jun- Yu Ma, Pan Lu, Zhen- Ling, Kai-Wer Chang, and Nanyun Peng. Model editing harms general abilities of large language models: Regularization to the rescue. 2024b. URL
Jia-Chen Gu, Haoyang Xu, Yun-Yu Ma. Pan Lu, Zhen-Hua Ling, Kai wei Chang, and Nanyun Peng. Model editing can hurt general abilities of large language models. ArXiv, 0atps/201.047000 2024c. ascho inmmantticccooo ar wwwp///rgg//soo.o 266995568888
URL htt.t:ttpp/ppppp semant i
Vipul Gupta, David Pantoja, Candace Ross, Adina Williams, and Megan Ung. Changing answer order can decrease mmlu accuracy. 2024. URL httt::://pp..emmnttcccho........
CoopussD:22784542)
Thomas Hartvigsen, Saadia Gabriel, Hamid Palangi. Maarten Sap, Dipankar Ray, and Ece Ka- mar. Toxigen: large-scale machine-generated dataset for adversarial and implicit hate speech detection. In Annual Meeting of the Association for Computational Linguistics, 2022. URL
fttts:://pp semanticscho ar wttpa/aror/oorrss1:2/22200000 9233
12

---

Published as a conference paper at ICLR 2025
Thomas Hartvigsen, Swami Sankaranarayanan, Hamid Palangi, Yoon Kim, and Marzyeh Ghassemi. Aging with grace: Lifelong model editing with discrete key-value adaptors. In Advances in Neural Information Processing Systems, 2023.
Peter Hase, Mohit Bansal, Been Kim, and Asma Ghandeharioun. Does localization inform editing? surprising differences in causality- localization vs. knowledge editing language models. In Advances in Neural Information Processing Systems, 2023.
Rima Hazra, Sayan Layek, Somnath Banerjee, and Soujanya Poria. Sowing the wind, reaping the whirlwind: The impact of editing language models. arXiv preprint arXiv:2401.00447, 2024.
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Xiaodong Song. and Jacob Steinhardt. Measuring massive multitask language understanding. ArXiv,
abs/2009.03300, 221516475
2020.
URL https: semanticscholaar ottppp/s/aa....ena..ooooooaao.r. Seemanniisccholl...oo///rrrrssss wrg/CorpusIrr
Duc N. M. Hoang, Minsik Cho, Thomas Merth, Mohammad Rastegari, and Zhangyang Wang. Do compressed ilms forget knowledge? an experimental study with practical implications. 2023.
URL http:s///ppp..eean..ccccooo..rr. htt.:/oo........ooooooooii222222
Jason Hoelscher-Obermaiir,, Julia Persson, Esben Kran, Ioannis Konstas, and Fazl Barez. Detect- ing edit failures in large language models: An improved specificity benchmark. arXiv preprint arXiv:2305. 17553, 2023.
Sara Hooker, Aaron C. Courville, Gregory Clark, Yann Dauphin, and Andrea Frome. What do compressed deep neural networks forget. arXiv: Learning, 2019. URL https://api,
Cheng-Yu Yu Hsich, Chun-Liang Li, Chih-Kuan Yeh, Hootan Nakhost, Yasuhisa Fujii, Alexander Rat- ner, Ranjay Krishna, Chen- Lee, and Tomas Pfister. Distilling step-by-step! outperform- ing larger language models with less training data and smaller model sizes. arXiv preprint arXiv:2305.02301 2023.
Cheng-Hsun Hsueh, Paul Kuo-Ming Huang, Tzu-Han Lin, Che-Wei Liao, Hung-Chieh Fang, Chao- Wei Huang, and Yun-Nung Chen. Editing the mind of giants: An in-depth exploration of pitfalls of knowledge editing in large language models. arXiv preprint arXiv:2406.01455 2024.
J. Edward Hu, Yelong Shen, Phillip Wallis. Zeyuan Allen-Zhu, Yuanzhi Li. Shean Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. ArXiv, abs/2106.09685, 2021. htLhttts://apaa htt.tpp://apl..smmiiiiccoc.. www.mmainccccccc...........a ott.ccccc..aa..ooooooraaaaaaaaa.
Wenyue Hua, Jiang Guo, Mingwen Dong, Henghui Zhu, Patrick Ng, and Zhiguo Wang. Propaga- tion and pitfalls: Reasoning- based assessment of knowledge editing through counterfactual tasks. arXiv preprint arXiv:2401.17585. 2024.
Zeyu Huang, Yikang Shen, Xiaofeng Zhang, Jie Zhou, Wenge Rong, and Zhang Xiong. Tranterrmer-patcher:: One mistake worth one neuron. In International Conference on Learning Representations, 2023.
Daphne Ippolito, Florian Tramèr, Milad Nasr, Chiyuan Zhang, Matthew Jagielski, Katherine Lee, Christopher A. Choquette-Chin Chho, and Nicholas Carlini. Preventing verbatim memorization in language models gives a false sense of privacy. ArXiv, abs/2210.17546. 2022. URL https:
Devansh Jain, Priyanshu Kumar, Samuel Gehman, Xuhui Zhou, Thomas Hartvigsen, and Maarten Sap. PolygloToxicityyrompss Multilingual evaluation of neural toxic degeneration in large lan- guage models. arXiv preprint arX1v.2405.09373, 2024.
13

---

Published as a conference paper at ICLR 2025
Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks in language models. In Annual Meeting of the Association for Computational Linguistics. 2022. URL https:
//ppi. www.eeeaitnsciinee httpa//ccc....o.ooooooooooaaa/a.
Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12): 2023.
Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu. Model sparsity can simplify machine unlearning, In Neural Information Processing Systems, 2023. B htt:p::/ www.sseeetnnntccceeeeeee htttba/s//...ssmmmmtcccccooeee org/Corpus
2288059852
Albert Qiaochu Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de Las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lu- cile Saulnier, L'elio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b. ArXiv, abs/2310.06825, 2023. 263830492
URL httpss//aap semanticscholeee ott.ps/s//..eeeennaoooooooo..oor org/CorpusII:
Jean Kaddour, Joshua Harris, Maximilian Mozes, Herbie Bradley, Roberta Raileanu, and Robert McHardy. Challenges and applications of large language models. arXiv preprint arXiv:2307.10169, 2023.
Antonia Karamolegkou, Jiaang Li, Li Zhou, and Anders Sogaard. Copyright violations and large language models. ArXiv, abs/2310. 13771, 2023. httttss:/aap...mmaatiiooomm
org/CorpusTD: 264426289
Omer Levy, Minjoon Seo, Eunsol Choi, and Luke Zettlemoyer. Zero-shot relation extraction via reading comprehension. Proceedings of the 21st Conference on Computational Natural Language Learning (CoNLL 2017). pp. 333-342, 2017.
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm Burger, Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Zhenqi Zhao, Ariel Herbert- Voss, Cort B. Breuer, Samuel Marks, Oam Patel, Andy Zou, Mantas Mazeika, Zifan Wang, Palash Oswal, Weiran Liu, Adam A. Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Tal- ley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis, Alex Levinson, Jean Wang, William Qian, Kallol Krishna Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, Ponnurangam Kumaraguru, Uday Tupakula, Vijay Varadharajan, Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. The wmdp benchmark: Measuring and reducing malicious use with unlearning. 2024a.
Yixiao Li, Yifan Yu, Chen Liang, Pengcheng He, Nikos Karampatziakis, Weizhu Chen, and Tuo Zhao. LoftQ: Lora-fine-tunin-awwal quantization for large language models. In International Conference on Learning Representations, 2024b.
Zhoubo Li, Ningyu Zhang, Yunzhi Yao, Mengru Wang, Xi Chen, and Huajun Chen. Unveiling the pitfalls of knowledge editing for large language models. arXiv preprint arXiv:2310002129, 2023.
Ji Lin, Jiaming Tang, Haotian Tang, Shang Yang, Xingyu Dang, and Song Han. AWQ: Activation-aware weight quantization for Ilm compression and acceleration. arXiv preprint arXiv:2306.00978. 2023.
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Xiaojun Xu, Yuguang Yao, Hang Li, Kush R. Varshney, Mohit Bansal, Sanmi Koyejo, and Yang Liu.
14

---

Published as a conference paper at ICLR 2025
Rethinking machine unlearning for large language models. ArXiv, abs/2402.08787, 2024a. URL https://ap1 semant nt icscho ar. wwtp/oorprsTtaa.....o.. 267.77777:::67577222
Zheyuan Liu, Guangyao Dou, Zhaoxuan Tan, Yijun Tian, and Meng Jiang. Towards safer large
language models through machine unlearning. ArXiv, abs/2402. 10058, 2024b. URL https:
//api. semaaeissaniicccoola.a http://chh..aaaca.coooooaaaaaa/a
Jakub Lucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Simon Tramèr, and Javier
Rando. An adversarial perspective on machine unlearning for safety. 2024. URL https:
//api. sepiissmmaticschol.... htt.sascoo......oooooooraaaaa/11
Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield- Eight meth- ods to evaluate robust unlearning in llms. arXiv preprint arXiv:2402.16833 2024.
Xinyin Ma, Gongfan Fang, and Xinehao Wang. LIm-pruner: On the structural pruning large language models. arXiv preprint arXiv:2305. 1627, 2023.
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J. Zico Kolter. Tofu:
A task of fictitious unlearning for llms. ArXiv, abs/2401.06121, 2024. URL https://apil
semant. cscholccaaeco lar Seccholar..rg//orpppuu TD: 266933371
Clco Matzken, Steffen Eger, and Ivan Habernal. Trade-off's between faimess and privacy in language modeling. arXiv preprint arXiv:2305. 14936, 2023.
Vittorio Mazzia, Alessandro Pedrani, Andrea Caciolai, Kay Rottmann, and Davide Bernardi. A
survey on knowledge editing of neural networks. arXiv preprint arXiv:2310.19704 2023.
Matthieu Meeus, Igor Shilov, Manuel Faysse, and Yves-Alexandre de Montjoye. Copyright
traps for large language models. ArXiv, abs/2402.09363, 2024. URL https://api.
Isemanticchollan 20t.aaaroooro/oooo.o::227555255
Julia Mendelsohn, Ronan Le Bras, Yejin Choi, and Maarten Sap. From dogwhistles to bullhorns:
Unveiling coded rhetoric with language models. arXiv preprint wwXi::2355.17174 2023.
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and editing factual associations in gpt. In Advances Neural Information Processing Systems, 2022.
Kevin Meng, Amab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. Mass-editing memory in transformer. In International Conference Learning Representations, 2023.
Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models. In International Conference on Learning Representations, 2016.
Eric Mitchell, Charles Lin, Antoine Bosselut, Chelsea Finn, and Christopher Manning. Fast model editing scale. In International Conference on Learning Representations, 2022a.
Eric Mitchell, Charles Lin, Antoine Bosselut, Christopher D Manning, and Chelsea Finn. Memory- based model editing scale. In International Conference on Machine Learning. PMLR, 2022b.
Derek Powell, Walter Gerych, and Thomas Hartvigsen. TAXI: Evaluating categorical knowledge editing for language models. In Findings of the Association for Computational Linguistics; ACL 2024, 2024.
USVSN Sai Prashanth, Alvin Deng, Kyle O'Brien, V JyothirS, Mohammad Aflah Khan, Jaydeep Borkar, Christopher A. Choquette-Choo Jacob Ray Fuehne, Stella Biderman, Tracy Ke, Kather- ine Lee, and Naomi Saphra. Recite, reconstruct, recollect: Memorization in Ims as multi- faceted phenomenon. 2024. URL http::h//pppp// semanticscholat ot wtwp:oooorrr//CooooIDo 2707109311
15

---

Published as a conference paper at ICLR 2025
Swamaadepp Saha, Peter Hase, and Mohit Bansal. Can language models teach weaker agents? teacher explanations improve students via theory of mind. arXiv preprint arXiv:2306.09299 2023.
Thanveer Basha Shaik, Xiaohui Tao, Haoran Xie, Lin Li, Xiaofeng Zhu, and Qingyuan Li. Exploring the landscape of machine unlearning: A comprehensive survey and taxon- omy. ArXiv, abs/2305.066 006300, 2023. URL https:/ /aps://api... http://ppp..enaattcccoco........ CorpusID:258685200
Pratyusha Sharma, Jordan T Ash, and Dipendra Misra. The truth there: Improving reasoning in language models with layer-selective rank reduction. arXiv preprint arXiv:2312.33558, 2023.
Emily Sheng, Kai-Wei Chang, Natarajan, and Nanyun Peng. The woman worked babysit- ter: On biases in language generation. ArXiv, abs/1909.01322 2019. URL https://app.
Karan Singhal, Tao Tu, Juraj Gottweis, Rory Sayres, Ellery Wulczyn, Le Hou, Kevin Clark, Stephen Pfohl, Heather Cole-Lewis, Darlene Neal, et al. Towards expert-level medical question answering with large language models. arXiv preprint arXiv:2305.06611, 2023.
Anton Sinitsin, Vsevolod Plokhotnyuk, Dmitry Pyrkin, Sergei Popov, and Artem Babenko. Editable neural networks. International Conference on Learning Representations, 2020.
Xavier Suau, Pieter Delobelle, Katherine Metcalf, Armand Joulin, Nicholas Apostoloff, Luca Zap- pella, and Pau Rodriguez. Whispering experts: Neural interventions for toxicity mitigation in language models. In Forty-first International Conference on Machine Learning.
Mingjie Sun, Zhuang Liu, Anna Bair, and Zico Kolter. simple and effective pruning approach for large language models. arXiv preprint arXivv2306. 11655 2023.
Jihoon Tack, Jachyung Kim, Eric Mitchell, Jinwoo Shin, Yee Whye Teh, and Jonathan Richard Schwarz. Online adaptation of language models with memory of amortized contexts. arXiv preprint vtXiv:2403.04317, 2024.
Chenmien Tan, Ge Zhang, and Jie Fu. Massive editing for large language models via meta learning. In International Conference on Learning Representations, 2024.
Ross Taylor, Marcin Kardas, Guillem Cucurull, Thomas Scialom, Anthony Hartshorn, Elvis Saravia, Andrew Poulton, Viktor Kerkez, and Robert Stojnic. Galactica: large language model for science. arXiv preprint arXiv:2211.0999 1.09085, 2022.
The President of the United States.
Executive order 14110 of october 30, 2023: Safe, secure, and trustworthy development and of artificial intelligence. Federal Register, 2023. URL https: ://p:://wwww govinfo..oooooooooo www.nio..wo//ootee////..o wtt.g///ooe/////////eeeeso 202R 11 0d/p
2023 24283 pdf Published November 1, 2023.
Boxin Wang, Wei Ping, Chaowei Xiao, Peng Xu, Mostofa Patwary, Mohammad Shoeybi, Bo Li, Anima Anandkumar, and Bryan Catanzaro. Exploring the limits of domain-adaptive training for detoxifying large-scale language models. Advances in Neural Information Processing Systems, 35:35811-35824 2022.
Peifeng Wang, Zhengyang Wang, Zheng Li, Yifan Gao, Bing Yin, and Xiang Ren. Scott: Self- consistent cfain-of-thought distillation. arXiv preprint arXiv:2305.01879 2023a.
Peng Wang, Ningyu Zhang. Xin Xie, Yunzhi Yao. Bozhong Tian, Mengru Wang, Zekun Xi, Siyuan Cheng, Kangwei Liu, Guozhou Zheng, et al. Easyedit: An easy-to-use knowledge editing frame- work for large language models. arXiv preprint arXiv:2308.0726) 2023b.
16

---

Published as a conference paper at ICLR 2025
Qizhou Wang, Bo Han, Puning Yang. Jianing Zhu, Tongliang Liu, and Masashi Sugiyama. Unlearn- ing with control: Assessing real-world urility for large language model unlearning. 2024. URI.
Song Wang, Yaochen Zhu, Haochen Liu, Zaiyi Zheng, Chen Chen, and Jundong Li. Knowledge editing for large language models: A survey. arXiv preprint arXiv:2310.1622 2023c.
Johannes Welbl, Amelia Glaese, Jonathan Uesato, Sumanth Dathathri, John Mellor, Lisa Anne Hen- dricks, Kirsty Anderson, Pushmeet Kohli, Ben Coppin, and Po-Sen Huang. Challenges in detox- ifying language models. In Findings of the Association for Computational Linguistics: EMNLP 2021, pp. 2447-2469, 2021.
Shijie Wu, Ozan Irsoy, Steven Lu, Vadim Dabravolski, Mark Dredze, Sebastian Gehrmann, Prab- hanjan Kambadur, David Rosenberg, and Gideon Mann. Bloomberggpt: A large language model for finance. arXiv preprint arXiv:2303. 17564, 2023.
Guangxuan Xiao, Ji Lin, Mickael Seznec, Hao Wu, Julien Demouth, and Song Han. Smoothquant: Accurate and efficient post-trane post-training quantization for large language models. In International Conference on Machine Learning, pp. 38887-38809. PMLR, 2023.
Mingxue Xu, Yao Lei Xu, and Danilo P Mandic. Tensorgpt: Efficient compression of the embedding layer in llms based on the tensor-train decomposition. arXiv preprint arXiv:2307.00526, 2023a.
Zhaozhuo Xu, Zirui Liu, Beidi Chen, Yuxin Tang, Jue Wang, Kaixiong Zhou, Xia Hu, and An- shumali Shrivastava. Compress, then prompt: Improving accuracy-effiiinny trade-off of Ilm inference with transferable prompt. arXiv preprint arXiv:2305. 2023b.
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. Machine unlearning of pre-trained large language models. ArXiv, abs/2402.151527 15159, 2024. URL https:
//api. wwt.ssmmaantccccccm
orq
Yunzhi Yao, Peng Wang, Bozhong Tian, Siyuan Cheng, Zhoubo Li, Shumin Deng, Huajun Chen, and Ningyu Zhang. Editing large language models: Problems, methods, and opportunities. 2023.
Zhewei Yao, Reza Yazdani Aminabadi, Minjia Zhang, Xiaoxia Wu, Conglong Li, and Yuxiong He. Zeroquant: Efficient and affordable post-training quantization for large-scale transformers. Advances in Neural Information Processing Systems, 35:27168-27188 2022.
Lu Yin, You Wu, Zhenyu Zhang, Cheng- Yu Hsieh, Yaqing Wang, Yiling Jia, Mykola Pechenizkiy, Yi Liang, Zhangyang Wang, and Shiwei Liu. Outlier weighed layerwise sparsity (owl): missing secret sauce for pruning Ilms to high sparsity. arXiv preprint arXiv:2310.05175. 2023.
01.AI Alex Young, Bei Chen, Chao Li, Chengen Huang, Ge Zhang, Guanwei Zhang, Heng Li, Jiangcheng Zhu, Jianqun Chen, Jing Chang, Kaidong Yu, Peng Liu, Qiang Liu, Shawn Yue, Senbin Yang, Shiming Yang, Tao Yu, Wen Xie, Wenhao Huang, Xiaohui Hu, Xiaoyi Ren, Xinyao Niu, Pengcheng Nie, Yuchi Xu, Yudong Liu, Yue Wang. Yuxuan Cai, Zhenyu Gu, Zhiyuan Liu, and Zonghong Dai. Yi: Open foundation models by Ol.ai. ArXiv, abs/2403.04665. 2024. URL https: //ap:://pp.... www.nticscooooe....... wtt.aaa...cccoo.......ooooooooap
:
Charles Yu, Sullam Jeoung, Anish Kasi, Pengfei Yu, and Heng Ji. Unlearning bias in language models by partitioning gradients. In Findings of the Association for Computational Linguisties:
ACL 2023, pp. 6032-6048, 2023.
Lang Yu, Qin Chen, Jie Zhou, and Liang He. Melo: Enhancing model editing with neuron-indexed dynamic lora. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pp. 19449-19457, 2024.
17

---

Published as a conference paper at ICLR 2025
Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. Negative preference optimization: From
catastrophic collapse to effective unlearning. ArXiv, abs/2404.05868, 2024. URL https:
//appi.seanticcccolarr.oo http:///ss....c..ooooooooooaaaaa
Jiachen Zhao, Zhun Deng, David Madras, James Zou, and Mengye Ren. Learning and forgetting
unsafe examples large language models. ArXiv, abs/2312.12733. 2023a. URL https://
api www.sstiinccccca..n.ooom htt.://.......ooooooooo..aaaaaa.
Yiran Zhao, Jinghan Zhang, I Chern, Siyang Gao, Pengfei Liu, Junxian He, et al. Felm: Benchmark- ing factuality evaluation of large language models. Advances in Neural Information Processing Systems, 36, 2023b.
Shanshan Zhong, Zhongzhan Huang, Shanghua Gao, Wushao Wen, Liang Lin, Marinka Zitnik, and Pan Zhou. Let's think outside the box: Exploring leap-of-thought in large language models with creative humor generation. arXiv preprint arXiv:2312.02439, 2023a.
Zexuan Zhong, Zhengxuan Wu, Christopher D Manning, Christopher Potts, and Danqi Chen. Mquake: Assessing knowledge editing in language models via multi-hop questions. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023b.
Xunyu Zhu, Jian Li, Yong Liu, Can Ma, and Weiping Wang. A survey model compression for large language models. arXiv preprint arXiv:2308.06633, 2023.
18

---

Published as a conference paper at ICLR 2025
APPENDIX
A LIMITATIONS
While our work provides the first look at how state-of-the-art methods compose, there are far more possible combinations of interventions, methods, models, and datasets than we can consider in one work. So some popular methods are omitted. We also prioritize broad experiments with many different intervention methods. We hope future works will closely examine individual methods to study, improve, and extend beyond the mechanisms that drive their composability. While we study how composability can vary across similar LMs (Section E.T). it is unknown whether our results generalize across model scale. We hope our codebase empowers others to explore more model sizes and architectures in future research.
B BACKGROUND ON INTERVENTIONS
Designing interventions for language models is highly-active research area. We focus on three key types of intervention.
Knowledge Editing. Knowledge editors aim address factuality decay in LLMs: As the world changes, some facts an LLM learned during training become inaccurate (Mazzia et al., [023] Wang et al. 2023c). For example, a model trained before 2020 would still predict The latest pandemic c in the US is "Swine Flu" until updated to predict "COVID" There are four general approaches to model editing: 1) Memory-based methods that cache knowledge (Mitchell et al. 2022b Hartvigsen al. 2023 Locate-then-FEdi methods that selectively finetune param- 2023),
eter subsets (Meng al. [202
model weights (Sinitsin al. 2020 Mitchell et al.) 2022a] Tan et al.) 2024), and 4) Prompt editors that add facts
3) Hypernetwork methods that predict
to prompts Zhong et al. 2023b; Cohen al. 2024). Most editors update singular facts (Mitchell
et al.) 2022a De Cao et al.) 2021 Sinitsin et al. 2020 Meng et al., (022), though recent works
apply many simultaneously (Meng et al. 20233 Mitchell et al. 2022b
Tan et al.) 2024). Others
works embrace the practical need for sequential edits (Huang et al. 2023 Hartvigsen et al. 2023)
Recent works have also begun investigating unintended impacts of editing on pre-trained models
Gu et al. 2024a (belsscer--Oermaane et al., 2023 et al. [0223 Hazra et al. 2024 Brown et al.
2023b Hase et al. 2023), while others are exploring multi-hop editing (Powell et al. 2024 Zhong
ct al. 2023b Cohen et al. 2024). However, these works study impacts on model performance, not interactions with other types of interventions.
Machine Unlearning. Machine Unlearning (MU) refers to a broad set of techniques for modify- ing a model post-training to remove the influence of specific training examples or other undesirable properties c Cao & Yang 2015, Shaik et al. 2023 Liu et al. 2024a). These undesirable properties are commonly referred as the unlearning target. Crucially, MU must excel at causing the model forget the unlearning target without adversely affecting overall utility by reducing performance on other domains (Gu et al. 2024c). Another requirement that MU must cause models deeply forget knowledge such that the unlearning target can not be elicited by adversaries probing (Lynch al. 2024). With the rise of generative models, recent work has explored MU for forgetting poten- tially copyrighted work (Eldan & Russinovich] 2023), information about individuals (Maini al.)
2024 and potentially dangerous knowledge (Zhao et al.) 2023a Liu et al. 2024b Li et al.) 2024a).
Existing works have studied which types of examples models forget when compressed Hooker al., 2019), whether compression hinders unlearning (Jia et al. (023). and whether compression in itself can be used as an unlearning technique (Jia et al. 2023). While related to knowledge editing,
the two areas have largely developed independently.
*Most MU techniques for LMs are considered approximate unlearning in that they aim to modify the model approximate the behavior of it not being trained on the unlcarning target without retraining from scratch.
19

---

Published as a conference paper at ICLR 2025
Model Compression. To mitigate the huge computational and memory demands of LLMs, plenty of
classical techniques in model compression have been explored, such as quantization (Frantar et al.
2023
Lin et al.
2023:
Xiao et al.
2023), network pruning (Frantar & Alistarh 2023
Sun et al.
2023
Yin et al.
2023 Ma et al., 2023). knowledge distillation (Wang et al. 2023a
Saha et al.
2023
Hsich et al., ),23), and low-rank factorization (?Xu et al. 2023a; Sharma et al.
2023). We
focus on quantization and network pruning, which both make in-place updates to pre-trained model weights. Quantization involves lowering the bit-precision of model parameters, effectively shrink-
ing model size and expediting inference. Early works, such as ZeroQuant (Yao et al. 2022) and
LLM.int8 (Dettmers et al. 2022). focused on fine-tuning quantization granularity, showing promis- ing results predominantly at higher bit-widths, like 8-bit. More recent innovations like GPTQ (Fran- tar et al. 2023) and AWQ (Lin et al. 2023) have successfully pushed the boundaries by reducing bit-width low as or 4 bits per weight, with negligible performance degradation. Pruning another compression methods, which aims climinate redundant components like weights and channels. Techniques like SparseGPT (Frantar Alistarh 2023) and Wanda (Sun et al.) 2023) suc- cessfully maintain much of LLM's performance, even when discarding approximately 50% of its weights. OWL (Yin al. 2023 layers.
achieves higher levels of sparsity by reallocating sparsities across
C IMPLEMENTATION DETAILS
In this section we outline the set up and hyperparameters used for knowledge editing and compres- sion: pruning and quantization.
C.1 KNOWLEDGE EDITING DETAILS
C.1.1 KNOWLEDGE EDITING METRICS
We adopt three widely-used editing metrics and three compression metrics to measure the effective- ness of these interventions. The editing metrics are:
Edit Success: Assesses the post-edit model's ability provide the correct, expected answer. An issue arises here with the different levels of verbosity for the models. An unedited model might return the correct token, but differently phrased answer or arrange the correct tokens differently.
We therefore adopt and Fi-style measure used in recent work (Hartvigsen al. 2023) for this.
First, we determine the common tokens between the generated response and the ground truth, which are represented by the sets G (generated response tokens without special tokens) and T (target tokens without padding), respectively. The common tokens are given by C' GnT.
If C' is empty is empty, the Fl score is set to 0, as there are no common elements to compare.
Otherwise, we calculate precision and recall. Precision is the ratio of the number of common tokens to the number of tokens in the generated response, and recall is the ratio of the number of common tokens to the number of target tokens. They are defined as:
C
Precision
G
C
Recall
[
The Fl score, which is the harmonic mean of precision and recall, is then calculated as:
F1 2 Precision Recall
Precision + Recall
2 x |C|/|G| x |C|/IT|
C|/ [|/
20

---

Published as a conference paper at ICLR 2025
with the condition that if the denominator (Precision + Recall) is zero, the F1 score is set 0.
The final Fl score is the average of the F1 scores for all items. If there are no F1 scores (i.e., the list of scores is empty), the average F1 score is set to O.
Edit Generalization: Measures the model's capability to genuinely update knowledge, rather than just repeating keywords. This is tested by evaluating edit success on paraphrased prompts given by the respective dataset.
Edit Locality: Examines the precision of edits, ensuring that only relevant, in-distribution knowl- edge is altered while out-of-distribution facts remain unaffected. this setting, the Fl score critical testing on the pre-trained knowledge can result in varied answer phrasings.
C.1.2 KNOWLEDGE EDITING DATASET
This dataset focuses on context-free question-answering Given a ques- tion related to a subject and a relation, the model's task is to provide the correct object as the answer. Wang et al. 2023b) follow the procedure outlined (Yao et al. 2023). to improve the locality sets used. As the initial locality sets were solely based on Natural Question annotations, we use the locality sets provided by (Wang et al. 2023b).
ZsRE (Levy et al.
2017
In all three datasets, original prompt rephrasings and locality sets are used derive the respective metries.
C.2 MODEL EDITING DETAILS
C.2.1 MEMIT DETAILS
We use the state-of-the-ar MEMIT (Meng et al. 2023) model editor, which applies batches of edits simultaneously. The editing process was applied to layers 4 through 8 of the model, with a clamp normalization factor set at 4. The learning parameters adhered closely to the original implemen- tation: y_num_grad__ste
was set to 25, accompanied by a learning rate (Ir) of 0.5, and using the last layer for loss calculation. Additionally, weight decay (weight_deeel The KL divergence contribution the overall loss was controlled by a KL __ccttr of 0.0625. More- over, second momentum adjustment was enabled, with an update weight of 15000, fine-tune the optimization process. The model generated a maximum length of 40 tokens and batch size of 50, matching the number of edits being made. 10 repeats were made for each edit and the results averaged.
of 0.001 was employed.
C.2.2 LORA DETAILS
We also employed LoRA as model editor, specifically using the adalora variant for our experi- ments. The editing process utilized gradient steps, with learning rate of 0.005. The rank for the low-rank adaptation was set at 8, with scaling factor of There was no dropout applied to the adaptation matrices, and the normalization constraint was disabled. The target modules for the edits consisted of query and value projection layers. Consistent with the MEMIT method, the model generated sequences with a maximum length of 40 tokens and utilized batch size of 50, matching the number of edits per batch. Each edit repeated 10 times, and the results were averaged to ensure reliability. The data type for the computations was set to torch. float.
C.2.3 FINE-TUNING (FT) DETAILS
For fine-tuning (FT), we focused on layers 4 through 8 of the model. The specific modules tar- geted for editing included the MLP down nown-projection (model, layers. {) saooo__proo,,,___ the general layer module (model. layers. ()), the MLP module (model layers. {) mml)), the self-attention module (model layers. self_attn), the final layer normalization (model. norm), and the language model head (1m (em_head).
21

---

Published as a conference paper at ICLR 2025
The fine-tuning process was conducted with 25 optimization steps, using learning rate of 10-5, No weight decay was applied. The normalization constraint was disabled. The optimization objective was set to target the new data and the data type for the computations was set to bfloat16.
As with the MEMIT and LoRA methods, the model generated sequences with maximum length of 40 tokens and used a batch size of 50, matching the number of edits per batch. Each edit was repeated 10 times, and the results were averaged for consistency and reliability.
C.3 MODEL COMPRESSION DETAILS
C.3.1 COMPRESSION METRICS
The compression metrics include:
Sparsity Ratio. The fraction of parameters in the model that are zero, indicating the extent to which the model is sparse.
Average Bits. The mean number of bits utilized to represent each parameter in a quantized or sparsified neural network, reflecting the level of compression.
C.3.2 COMPRESSOR DETAILS
We use four state-of totte-of-theaar the-art compression methods including two pruning methods:
SparseGPT (Frantar & Alistarh 2023): an efficient one-shot pruning method tailored for large models. converts the pruning process into solving large-scale sparse regression problems using an approximate solver. This approach enables rapid pruning on a single GPU with minimal accuracy loss, achieving 50-60% on large models.
Wanda (Sun al. 2023); another popular method for pruning large language models that relies pruning metric that combines weight's magnitude with the norm of its corresponding input activations, determined from small calibration dataset. The method focuses selectively pruning weights within individual outputs of linear layers, aiming for high sparsity levels without modifying unpruned weights. Wanda is computationally efficient, executable in single forward pass.
and two quantization methods:
GPTQ Frantaar et al. 2023): an algorithm designed for efficient weight quantization in large-scale models. It revises the weight quantization approach by quantizing weights in a fixed order rather than a greedy order, which shows minimal performance difference, especially in larger models. GPTQ introduced a novel method where each weight is quantized salumn-by-colume reducing computational complexity.
AWQ (Lin et al. 2023): based on the premise that not weights are equally critical for model performance, and identifies a small fraction of salient weights whose quantization significantly impacts model accuracy. This identification is done by analyzing activation distributions rather than weight distributions, under the rationale that weights linked larger activation magnitudes are more erucial.
C.4 MACHINE UNLEARNING DETAILS
We implement three unlearning techniques: RMU, GA, and GD. The success of each technique hinges on the careful selection of hyperparameters. We describe our parameter searches and selected values in the following sections.
C.4.1 REPRESENTATION MISDIRECTION UNLEARNING
Introduced in (Li al. 2024a), RMU intervenes on specific layer of the LM perturb activations for inputs related to the unlearning target. This technique has achieved impressive performance
22

---

Published as a conference paper at ICLR 2025
on the WMDP dataset, with performance the unlearning targets dropping to near-random while overall model utility (MMLUU) minimally regresses. Wikitext (Merity et al. 2016) acts as the retain set.
RMU relies on multiple hyperparameters for selecting which layer to modify and how the loss should be calculated. We found that RMU is quite sensitive to hyperparameter choice, with most combinations either leaving the model unaffected or significantly harming model utility. Table 5 details the results from our hyperparameters search for Llama-3 8B. We otherwise use the RMU repo's default settings.
Parameter
Description
Search
Selected
Alpha
The weight for the retain loss
[1, 10. 100, 1000, 10000]
1000
Layer
The layer to modify
[3. 17]
Maximum Batches
Training duration RMU in batches
[100, 150, 200, 250, 300]
250
Table 5: RMU Hyperparameter Search, Details for the grid search over possible RMU settings. Hyperparameters were selected using grid search.
C.4.2 GRADIENT ASCENT
GA, simple and widely studied unlearning method (Golatkar et al. 2019: Wang et al. 2024; Maini et al. 2024; Yao et al. 2024 Zhang et al. 2024), compels the model to minimize the likelihood of the correct token. The underlying intuition is that models will learn to avoid generating tokens associated with the unlearning target. We only train the final 16 layers of the model due to memory
constraints.
Parameter
Description
Search
Selected
LR
The learning rate
[5e-6, le-6, Se-3, le-3]
5e-5
Training Samples
Train size balanced across Cyber/Bio
[10. 25, 50, 100, 500, 1000, 2000]
50
Table 6: GA Hyperparameter Search. Details for the grid search over possible GA settings. Hyperparameters were selected using grid search.
C.4.3 GRADIENT DIFFERENCE
A significant challenge when leveraging GA is balancing reducing performance on the unlearning target while retaining overall model utility. Since GA reduces the likelihood of the correct token, it is fragile to catastrophic forgetting, where the model incorrectly generalizes to forgetting how to model natural language.
GD Maini et al. 2024) aims to address this shortcoming by adding a retain loss term to the loss function. This term aims to maximize the likelihood of the correct token on an unrelated retain dataset. We use Wikitext (Merity et al. 2016) as the retain set. As with GA, we only train the final 16 layers of the model.
Table 7 reports our hyperparameter search. Unlike (Maini et al. 2024), which found that GD pro- vided only a marginal improvement over GA, we found that GD can perform significantly better we upweight the retain loss term. Upweighting is necessary since it is easy for the model to sig- nificantly minimize the correct token likelihood, which causes it drown out the retain loss term. Assigning weight of 400 the retain term solved this issue. This hyperparameter combination make GD competitive with RMU, though still less composable (Section 4)
23

---

Published as a conference paper at ICLR 2025
Parameter
Description
Search
Selected
Alpha
The weight for the retain loss
[1. 2, 4, 6. 8, 10, 20, 40, 60, 80, 100)
40
LR
The learning rate
[5c-6, 1c-6, 5c-3, 1c-3]
5e-5
Training Samples
Train size halanced across Cyher/Bio
[10, 25, 50, 100, 500, 1000, 2000]
50
Table 7: GD Hyperparameter Search. Details for the grid search over possible GD settings. Hyperparameters were selected using grid search.
Edit Success
Edit Generulization
WMDP
MMLU
Order-free Error (1)
Order Semsitivity (1)
Order-free Error (1)
Order Sensitivity ())
Order-free Error (.)
Order Semsitivity (.)
Order-frve Error (1)
Order
Semsitivity ())
Different Layers
D3
01
077
.4
.29
01
44
.00
Overlupping
Table 8: Composability Layer Ablation. We evaluate how layer overlap affects the composabil- ity of RMU and MEMIT interventions. Our results demonstrate that composability metrics remain consistent regardless of whether the modified layers overlap. This finding suggests that intervention design, rather than the absence of layer interference, is the primary factor determining the compos- ability of these interventions.
D DOES LAYER SELECTION EXPLAIN COMPOSABILITY?
We examine whether intervention composability stems from targeted modifications distinct model components from intrinsic algorithmic design. Table shows that RMU and MEMIT achieve substantially lower Order Sensitivity compared to other intervention pairings. In our primary setup, RMU modifies Llama's 's 3rd layer, while MEMIT targets layers 4 through 8, raising questions about whether their composability depends this layer separation.
To isolate this effect, we conducted experiments where both RMU and MEMIT modify the same model layers. We report our results in Table g Our findings reveal that these interventions maintain high composability even with overlapping layer targets. The slight increase in Order Sensitivity under layer overlap remains negligible compared to the substantial sensitivity differences observed between other compositions in Section 4.3.
Our results demonstrate that intervention composability stems primarily from algorithmic precision rather than layer isolation. Both RMU and MEMIT achieve effectiveness through targeted modifica- tions: RMU by selectively redirecting activations only for unlearning -targeted inputs, and MEMIT by precisely modifying parameters mediating specific factual associations. This explains compos- ability when each technique modifies semantically distinct knowledge. This investigation reveals that successful composable interventions depend more on specificity and surgical precision than on segregating modifications to separate model components. Effective interventions should precisely target relevant behaviors while minimizing collateral effects on unrelated capabilities.
E EXTENDED RESULTS
E. COMPOSABILITY ACROSS LANGUAGE MODELS
We investigate the generalizability of intervention composability across different LMs by extending our study from Llama-3 8B to Yi 1.5 9B Chat (Young et al. 2024) and Mistral 7B Instruct (Jiang eet al., 2023). These popular open-weights LMs were chosen for their similarity in size and per- formance to Llama-3. We sample one intervention from each category: MEMIT (editing), AWQ (quantization). Wanda (pruning), and RMU (unlcarning). We are unable to find a set of effective hyperpameters for RMU with Yi.
24

---

Published as a conference paper at ICLR 2025
Edit Success
Edit Generalization
Unlearn WMDP
MMLU
Composition
LJama
Mistral
Llama
Mistral
Yi
Llama
Mistral
Yi
Llama
Mistral
Yi
Snd
MEMIT==Wande .24
.00
.11
.21
.02
.01
.01
.01
.01
.00
.01
.00
.08
MEMIT+RMU
.01
.03
.44
002
.01
.00
.00
.01
.01
RMC
Randa
.00 .00 .01 .00
.03 .00 .01 .00 .01
Table 9: Order Sensitivity across LMs. We study compression at 25% sparsity and 4-bit quantiza- tion. Key Takeaway: Order Sensitivity is generally consistent across LMs, with the exception of compositions involving editing and compression techniques (e.g.. MEMIT++Wande
Table shows Order Sensitivity
generally consistent across LMs, except for Editing<>Unleariing and Compression<+ consistently ex- hibit low Order Sensitivity. These results suggest intervention composability trends often generalize across similar models, but the choice of LM remain hypepramateter for interventions such as Editing.
4 presents a comprehensive comparison of composition metrics across the three models. The performance of each model is visualized using a bar chart, where the bottom of each bar represents the Order-free Error metric and the height of the bar indicates the Order Sensitivity metric. This visualization allows for clear assessment of both individual metrics and overall model performance. Notably, the results demonstrate that composability generalizes across different models This finding underscores the robustness of composability as general property while highlighting the nuanced impact specific model architectures on edit generalization capabilities.
Figure
Stcceess
Edit Grorcalization
1/-
Y.a.a D16g
03
MUDM MINRE-Waak Waada
RMn-4NG
Ran-AWQ
1oHt Raada
14
04
02
MEDURARR
Amser Rait
Batt-Foada
SEAAY Wands
MEMIRA
MDME
Bunlagg
Ratt Wanda
Comparison of Composition Metries across different models. The performance of each model is represented by a bar. The bottom of the bar represents the Order-free Error and the size of the bar represents the Order Sensitivity. Key Takeaways: Composability generalizes overall across models, with Edit Generalization having an expected model-dependent effect.
Figure 4:
25

---

Published as a conference paper at ICLR 2025
E.2 ADDITIONAL EXPERIMENTS ACROSS MODEL FAMILIES AND SIZES
We extend our analysis to examine composability across different model variants to understand how these properties generalize beyond our main experiments. Specifically, we investigate two dimensions: (1) comparing base vs. instruction-tuma variants of the same model, and (2) examining how parameter count affects composability.
E.2.1 BASE VS. INSTRUCTION-TUN MODELS
To investigate whether our findings generalize across training regimes, we compare the base Llama-3 8B with its instruction-tuned counterpart (Llama-3 8B Instruct). We select representative interven- tions from each category: MEMIT (editing). WANDA (compression), and RMU (unlearning).
Table I0 shows key composability metrics across these model variants. We find that our main composability findings remain consistent between base and instruction-tunel models, suggesting that architecture and pretraining regime influence composability more than instruction tuning.
Table 10: Performance comparison between base and instruction- tunde models. Both models exhibit similar composability patterns, though with different absolute performance.
Llama-3 8B version
Intervention Sequence
MMLU
Avg. WMDP
Edit Success
Edit Generalization
Edit Locality
Base
MEMIT - WANDA
58.89%
70.11%
68.81%
3.05%
MEMIT WANDA
61.12%
93.93%
84.47%
2.69%
Base
WANDA MEMIT
59,22%
94.59%
89.61%
3.44%
Instruct
WANDA + MEMIT
61.47%
99.10%
84.77%
3.26%
Base
RMU - WANDA
55.64%
28.54%
Instruct
RMU - WANDA
55.66%
82%
WANDA RMU
57.12%
31.86%
Instruct
WANDA + RMU
58.21%
31.83%
Base
MEMIT + RMU
56.19%
29.28%
95.62%
89.38%
3.48%
Instruct
MEMIT + RMU
54.59%
27.28%
93.88%
87.00%
3.19%
Base
RMU MEMIT
55.94%
30.14%
96.87%
92.97%
3.40%
Instruct
RMU MEMIT
53.99%
25.53%
89.41%
84.44%
3.43%
Three key findings remain consistent:
Compression -> Editing is Best: For both base and instruct models, applying WANDA before MEMIT leads to significantly better edit success than the reverse order. Interestingly, the instruct model shows more robustness to ordering, with edit success for MEMIT-WANND -WANDA at 93.93% com- pared to 70. 11% 1% for the base model.
Unlearning >> Compression is Best: Both model variants demonstrate better WMDP scores (lower better) when applying RMU before WANDA rather than the reverse order. The performance difference remains similar across variants: approximately 3.3% for base and 5.0% for instruct.
Gnitann= is Composable: MEMIT and RMU remain largely composable in both model variants, though the instruct model shows slightly larger performance delta between or- der permutations the editing metrics.
E.2.2 EFFECT OF MODEL SIZE
We further investigate whether our findings generalize across model scales by comparing Llama-3 8B with the smaller Llama-3.2 IB. Table [[] shows a comparison of performance for editing and compression interventions across these model scales.
We find that the smaller IB Llama shows similar composability trends to its larger 8B counterpart, with an average order sensitivity of 3.60% compared to 2.50% for the 8B model. The preference for applying editing after compression remains consistent across model sizes, though the effect is more pronounced in the 8B model. While absolute MMLU performance is understandably lower
26

---

Published as a conference paper at ICLR 2025
Table 1I: Comparison of performance across different Llama model sizes (8B vs IB). Despite significant differences in parameter count, key composability trends remain consistent.
Size
Intervention Sequence
MMLU
Edit Success
Edit Generalization
8B
LoRA WANDA
60.00%
87.00%
53.00%
1B
LoRA - WANDA
34.03%
98.00%
64.96%
8B
FT WANDA
60.00%
96.00%
76.00%
1B
FT + WANDA
35.01%
90.26%
75.06%
8B
WANDA LoRA
60.00%
95.00%
54.00%
1B
WANDA + LoRA
34.03%
100.00%
76.76%
8B
WANDA FT 60.00%
99.00%
80.00%
1B
WANDA + FT 33.82%
100.00%
65.26%
for the 1B model, editing metrics remain competitive, suggesting that composability properties may transfer across model scales within the same architecture family.
E.3 STATISTICAL ANALYSIS OF RESULTS
We supplement our composability analysis with statistical measures to quantify the reliability of our findings. Our editing results represent averages over 10 random data subsets, while compression methods are deterministic. For unlearning, we observed minimal variance in replicated experiments, with standard deviations of approximately +0.5% for accuracy metrics.
Table 12 presents our composability metrics with standard errors for knowledge editing composed with model compression. The low standard errors across metrics indicate robust findings that are not overly sensitive to specific data subsets.
Table 12: Composability metries with standard errors (in parentheses) for Knowledge Editing com- posed with Model Compression. Order-free Error (4) measures best-case error caused by interven- tions, while Order Sensitivity (L) measures unwanted effects intervention ordering.
Generalization
())
Sonsitivity
Order-frze Evor (()
Sensitivity ())
Method
FT
MEMIT
LoRA
MEMIT
LoRA
MEMIT
LoRA
FT
MEMIT
LoRA
Wins
Wanda
.01 (01)
05 (.2)
05()1
.3 (.0) (24(
08 (03)
201.02)
.10 (00)
.46 (03)
(4(11))
21 (.0))
.1 (01)
SpuneCPT
.01 (01)
09 (.0))
(.02)
03 (00)
(01)00)
01 (.01)
(3())
14 (02)
.88 (02)
02 (01)
03 (.02)
077 (77(02)
AWQ
01 (01)
(.01)
(00)
(01)
(00)
(.01)
16(,0)
(00)
26 (03)
05 (00)
00001)
.4((2))
12
GPTQ
221 (00))
42008)
40(.04)
20 (.0)
(90)
36003)
(.2)
27(00)
Standard errors are particularly small for the MMLU metrics (50.01), indicating high stability in general utility evaluations. Edit Success and Generalization metrics show slightly higher variance (up to 0.04), as expected given the inherent variability editing processes. Importantly, the key findings remain statistically reliable despite this variation. For example, the difference Order Sensitivity between MEMIT and LoRA when paired with Wanda (0.24 vs. 0.08) is substantially larger than their respective standard errors (0.03 and 0.02).
The statistical analysis reinforces our confidence the identified composability trends and indicates that the observed patterns represent genuine differences in intervention behaviors rather than artifacts of specific data samples.
E.4 COMPOSING MORE TIIAN TWO INTERVENTIONS
Our composability framework naturally extends beyond pairs interventions. While exhaustively exploring all possible combinations of three or more interventions is computationally prohibitive with our resources, conduct targeted experiments to understand how performance changes when composing triplets of interventions.
27

---

Published as a conference paper at ICLR 2025
For these experiments, select the most composable intervention from each category based earlier findings: WANDA with 25% sparsity (compression), MEMIT (editing), and RMU (unlearn- ing). We examine all six possible orderings of these three interventions, evaluating both task-specific metrics and general model utility.
E,4.1 EFFECT OF TRIPLET COMPOSITIONS ON PERFORMANCE
central question is whether composing more than two interventions leads catastrophic regres- sion in overall performance. Table 13 and Table 14 show the results for both base and instruction- tuned Llama-3 8B models across all possible orderings of our three selected interventions.
Performance of triplet intervention compositions on Llama-3 8B Base. Each row repre- sents different ordering of the three interventions, with interventions applied from left to right.
Table 13:
Intervention Sequence
MMLU
Avg WMDP
Edit Success
Edit Generalization
WANDA RMU MEMIT
56.36%
30.77%
99.20%
93.70%
MEMIT > WANDA - RMU
54.63%
27.60%
99.50%
90.30%
MEMIT -> RMU + WANDA
54.17%
28.00%
99.50%
90.12%
WANDA + MEMIT + RMU
55.23%
31.30%
95.86%
90.26%
RMU + WANDA - MEMIT
53.87%
28.20%
93.00%
92.00%
RMU + MEMIT WANDA
54.32%
28.20%
94.67%
85.17%
Table 14:
Performance of triplet intervention compositions on Llama-3 8B Instruct. Comparison with base model results shows consistent ordering patterns but with different absolute values.
Intervention Sequence
MMLU
Avg WMDP
Edit Success
Edit Generalization
WANDA + MEMIT + RMU
59.09%
34.68%
99.10%
84.77%
MEMIT + WANDA + RMU
54.27%
26.98%
94.60%
85,27%
MEMIT RMU WANDA
54.61%
27.39%
91.53%
80.47%
WANDA + RMU + MEMIT
57.57%
31.46%
86.72%
83,50%
RMU WANDA MEMIT
53.77%
26.41%
86.00%
80.77%
RMU + MEMIT + WANDA
54.53%
26.33%
74.82%
81.44%
Comparing the results across all ordering permutations, observe several key findings:
Overall Utility Remains Stable: MMLU performance shows relatively small variance across dif- ferent orderings (range of 2.49% for base and 5.32% for instruct), confirming that composing three interventions does not catastrophically degrade general model utility.
Task-Specific Metries Show Order Sensitivity: While general utility remains stable, task spec-spec metrics like Edit Success show much larger variance (range of 6.50% for base and 24.28% for instruct), highlighting the importance of ordering even in triplet compositions.
Best Overall Performance: For the base model, the WANDA - RMU + MEMIT ordering achieves the best balance of metrics, with high values for both edit metrics and reasonable WMDP performance. This consistent with our findings from pairwise compositions, where compression applied before unlearning and editing typically yields better results.
Consistency Across Model Variants: The instruction-tun model shows patterns similar to the base model, with similar relative ordering preferences, though with different absolute performance values. This further supports our earlier finding that composability patterns tend be preserved across model variants, even when expanded to triplet interventions.
28

---

Published as a conference paper at ICLR 2025
E.4.2 IMPLICATIONS FOR PRACTICAL DEPLOYMENT
These results have important implications for deploying multiple interventions practice. First, they demonstrate that multiple successive interventions can be applied without catastrophic degrada- tion of general model utility. Second, they confirm that the order in which interventions are applied has significant impact on task-specific performance, with some orderings preserving task-specific metries much better than others.
For practitioners seeking to apply multiple interventions, results suggest that: (1) compression should typically be applied early in sequence of interventions, (2) editing should generally be applied last maximize retention of edited information, and (3) unlearning most effective when applied between compression and editing.
E.5 COMPLETE PAIRWISE RESULTS
We report the task performance for all compositions below and the baseline results, where only single intervention is applied (Table Perplexity Wikitext (Merity et al. (2066) is also included another overall utility metric. Average Bits (Appendix C.3.1 measures the degree which the composition compresses the model.
Editing
Compression
Unleamiin Avg. WMDP
Utiliyy
Edit Success
Generalization
Loculity
Avg. Bits
MMLU
WikiText PPL
None
0.02
0.02
0.04
16.00
0.58
0.62
5,54
FT-sNone
0.99
0.82
0.57
5.57
MEMIT-Non
0.89
0.85
0.04
16.0
0.57
0.61
5.57
LoRA-NNome
1.0
0.71
0.06
16.0
0.56
0.61
19.25
SparseiPT (0.25)
None
0.02
0.03
12.25
0.56
5.87
SparsGPP (0.35)
-ooe
0.02
0.02
0.03
10.75
0.54
0.58
6,34
SparseGPT (0.45)
None
0.02
0.01
0.03
9.25
0.51
7.43
SparseGPT (0.55)
-None
0.01
0.03
7.75
0.45
0.44
10.43
SpareGPP (0.65)
-None
0.0
0.01
0.03
6.25
0.3
0.27
20.83
SparseIPT (0.75)
-None
0.01
0.26
Wanda (0.25) -NNone
0.02
0.02
0.03
12.25
0.56
0.61
5,84
Wanda (0.35) -Noone
0.02
0.02
10.75
0.54
Wanda (0.45) -None
0.02
0.02
0.03
9.25
0.5
0.52
7,52
Wanda (0.55) -None
0.02
0.02
7.75
0.36
0.37
12.5
Wanda (0.65) -Nooe
0.26
Wanda (0.75) -None
0.02
0.03
0.03
4.75
0.26
0.23
257.46
GPTQ (2-Bit) -None
0.0
368
GPTQ (3-Bit) -None
0.01
0.01
0.03
3.25
0.45
0.46
8.6
GPTQ (4-Bit)
None
0.02
0.02
0.03
4,25
0.56
0.6
9,97
GPTQ (8-Bit) None
0.02
8.25
0.58
5.54
AWQ (2-Bit) -None
0.0
0.0
0.0
2.25
0.24
0.27
1748954.75
AWQ
AWQ (4-Bit) None
0.02
0.02
0.03
4.25
0.57
0.6
5.91
AWQ (5- (itBii) -None
0.02
0.03
0.57
AWQ (6-Bit) -one
0.02
0.03
0.04
6.25
0.58
0.62
5,56
AWQ (8-Bit) -Nooee
0.02
0.02
0.04
8.25
0.58
0.62
5,54
None
0.0
GD None
0.02
0.0
0.09
16.0
0.26
0.52
4.48
RMU None
0.02
0.02
0.29
5.56
Table 15: Baseline intervention Results without composition.
29

---

Published as a conference paper at ICLR 2025
Editing
Compression
Unlearning
Uulity
Generalization
Locality
Avg.
Avg. WMDP
WikiText
FT
SparseGPT (0.25)
0.96
0.76
0.11
12.25
0.55
0.6
5.9
FT
SparseGPT (0.35)
0.84
0.09
10.75
0.53
0.57
6.38
FT
SparseGPT (0.45)
0.64
0.07
9.25
0.5
0.53
7,48
FT
SparseGPT (0.55)
0.33
0.26
0.04
7.75
0.44
0.44
10.35
SparseGPT (0.65)
0.12
0.03
6.25
0.3
21.54
FT
SparseGPT (0.75)
0.03
0.02
0.03
4.75
0.26
0.23
88.73
Wanda (0.25)
0.96
0.76
12.25
0.6
5.8
FT
Wanda (0.35)
0.88
0.68
0.09
10,75
0.53
0.57
6.35
(0.45)
7.57
FT
Wanda (0.55)
0.31
0.24
0.04
7.75
0.35
0.37
12.48
(0.65)
FT Wanda (0.75)
0.02
0.02
0.03
4.75
0.26
0.23
34.62
TTGTQQ (2-Bit)
0.0
0.02
0.24
1995.71
FT (3-BB)
0,27
0.2
0,04
3.25
0.43
0.46
9,03
FT FT- (4-Bit)
0.79
0.59
12.93
FT-GPTQ (8-Bi))
0.99
0.83
0,11
8.25
0.57
0.61
5,57
FT-AWQ (2-Bil
0.0
0.0
0.27
1739216.25
FT ATWQ (3.Bit)
0.7
0.55
0.07
3.25
0.51
7,56
FT AWW (4-Bit)
0.95
0.79
0.1
0.59
5.95
FT TAQQ (5.Bit)
0.99
0.84
0,11
5.25
0.56
0.61
5.66
FT AWQ (6-Bit)
0.99
0.84
0.1
6.25
0.57
0.61
5.59
FT AW (8-Bit)
0.99
8.25
MEMI
SparseGPT (0.25)
0.87
0.83
0.04
12.25
0.56
0.6
5.89
MEMIT
SparsGPP (0.35)
0.81
MEMIT
SparseGPT (0.45)
0.62
0.56
0.04
9.25
0.51
0.53
7.43
SparseGPT (0.55)
0.03
0.43
MEMIT
SparseGPT (0.65)
0.03
0.03
0.03
6.25
0.1
0.29
21.02
SparseGPT (0.75)
0.23
71.62
MEMI
Wanda (0.25)
0.7
0.69
0.03
12.25
0.54
0.59
5.87
MEMIT
Wanda (0.35)
0.85
0.03
10.75
0.57
6.34
MEMIT
Wanda (0.45)
0.75
0.67
0.03
9.25
0.48
0,51
7,56
MEMIT Wanda (0.55)
0.32
0.26
0.03
0.36
12.33
MEMIT Wanda (0.65)
0.01
0.01
0.02
6.25
0.26
0,23
46.98
MEMIT
Wanda (0.75)
0.02
0.02
0.03
4.75
0.26
0.23
290.27
MEMIT (2-BQ
2.25
0.24
1663.86
MEMIT
GPTQ (3-Bit)
0.35
0.29
0.04
3.25
0.45
0.46
8.89
MEMIT-GGPO G
0.84
0.59
13.17
MEMIT (AAMIT--PT)(---- (8-Bit)
0.94
0.9
0.04
8.25
0.57
0.61
5,56
MEMIT AANQ
0.27
1738085.5
MEMIT-AWS (3-B10)
0.83
0.79
0.04
3.25
0.5
0.5
7.54
AWNQ
MEMIT AAQ (5.Bi)
0.92
0.89
0.03
5.25
0.57
0.61
5.65
MEMIT AWQ (6-Bit)
0.93
0.04
0.61
5,59
MEMIT (8.Bi)
0.94
0.9
0,04
8.25
0.57
0.61
5,56
LORA SparseGPT
0.86
0.04
0.6
13.81
LoRA SpprseGPP (0.35)
0.62
0.37
0.05
10,75
0.52
0.57
10.6
LoRA SSprseGPPT (0.45)
0.36
0.22
0.04
9.25
0.48
0.52
16.48
LoRA SSpareGPT (0.55)
0.17
0.14
0.04
7.75
0.43
0.43
23.46
LoRA SSpaseGPT (0.65)
0.07
0.06
0.03
6.25
0.32
0.3
53,89
LoRA SPars=GPT (0.75)
0.03
0.03
0.02
0.26
0.25
186.65
LoRA Wanda (0.25)
0.87
0.53
0.04
12.25
0.55
0.6
9.23
LoRA Wanda (0.35)
0.64
0.05
10.75
0.52
0.57
11.01
LoRA Wanda (0.45)
0.37
0.25
0.03
9.25
0.46
0.49
12.6
LaRA Wanda (0.65)
0.05
0.04
0.02
6.25
0.26
0.24
194.26
(0.75)
(2
0.0
0.0
0.01
2.25
0.25
0.24
10465.63
LoRA- (3-Bit)
LGRA
0,58
0.41
0.05
4.25
0.54
0.58
63.45
LORA-
1.0
0.71
0.06
0.61
18.86
LoRA-AAQQ
0.0
0.0
0.0
2,25
0.24
0.25
1764088.0
0.46
0.05
0.51
24.29
LoRA
0.1
0.04
4.25
0.55
0.59
16.37
L (S-Rit)
0.99
0.05
5.25
0.56
0.6
16.31
LoRA LoRA-AWQ (it)
1.0
0.71
0.06
6.25
0.56
0.61
15.34
LWRA~AWQ (8-Rit)
1.0
0.72
0.06
8.25
0.57
0.61
15.25
Table 16: Detailed results for editing compression.
30

---

Published as a conference paper at ICLR 2025
Editing
Compression Avg. Bits
Unleaminng Avg. WMDP
Unlitt
Edit Success
Generalization
Locality
MMLU
Wikifesi PPL
SparseGPT (0.25)
0.99
0.08
12.25
0.6
5.91
SparsePPT (0.35) FF
0.98
0.75
0.06
10.75
0.54
0.58
6.37
SparseGPT (0.45) -FT
0.96
0.71
0.06
9.25
0.51
0.54
7.49
SparsePTT (0.55) -FT
0.95
0.66
0.05
7.75
0.44
0.44
10.19
SparseGPT (0.65) -FT
0.89
0.54
0.04
6.25
0.3
17.67
SparseGPT
0.58
0.04
0.26
0.24
98.18
SparseGPT -
0.91
0.86
0.04
12.25
0.56
0.59
3.89
SparseGPT -MEMIT
0.89
10.75
0.54
0.57
6.38
SparseGPT -MEMIT
0.62
0.48
0.03
9.25
0.51
0.53
7.49
SparsGGP (0.55)
0.37
10.62
SpansePPT (0.65) -MEMIT
0.18
0.13
0.03
6.25
0.32
0.29
22,83
SparseGPT (0.75) -MEMIT
0.11
0.04
0.23
394,59
SparseGPT (0.25) -LLRA
0.85
0.45
0.04
12,25
0.54
0.6
10.69
SparseGPT (0.35) -LoRA
0.04
10.75
0.57
9.54
SparseGPT (0.45) -LoRA
0.64
0.33
0.04
9.25
0.48
0.52
10.52
SparseGPT (0.55) -LoRA
0.55
0.03
7.75
0.43
11.5
SparseGPT (0.65) -LoRA
0.37
0.17
0.03
6.25
0.32
0,29
23.13
SparseGPT (0.75) -LLRA
0.08
0.03
0.25
89.47
Wanda (0.25)
0.99
0.8
0.07
12.25
0.56
0.6
5.86
Wanda (0.35) -FT
0.97
0.76
0.05
10.75
0.54
0.58
6.32
Wanda (0.45)
0.94
0.69
0.04
9.25
0.49
0.52
7.52
Wanda (0.55) -FT
0.8
0.5
0.03
7.75
0.36
0.38
11.98
(0:65)
Wanda (0.75) -FTT
0.05
0.04
0.03
4.75
0.26
0.23
249.29
(0.25)
12.25
Wanda (0.35) -MEMIT
0.86
0.76
0.03
10.75
0.54
0.57
6.34
(0.45)
7.54
Wanda (0.55) -EEMI
0.37
0.26
0.03
7.75
0.37
0.37
12.07
(0.65)
Wanda (0.75) -EMMIT
0.04
0.04
0.02
4.75
0.26
0.23
280.04
Wanda (0.25) =LLoRA
0.55
0.03
12,25
0.6
10.65
Wanda (0.35) LLoRA
0,86
0.48
0.04
10,75
0.52
0.57
7,98
Wanda (0.45) -1I.RA
0.74
0.43
0.04
9.25
0.47
0.5
9.18
Wanda (0.55) LLoRA
0.68
0.37
0,03
7.75
0.36
0.37
15.01
Wanda (0.65) -1L.RA
0.34
0.19
0,02
6.25
0.26
0.23
$7.63
Wanda (0.75) -LoRA
0.06
0.06
0.26
0.23
318.06
(2-Bit) -FT
0.0
0.0
0.01
2.25
0.25
0.24
970816.25
(3-Bit
0.1
0.42
9,96
(4-Bii) FF
0.44
0.24
0.04
4.25
0.55
0.58
6.4
GPTQ
(P MEMIT
0.0
0.0
0.01
2.25
0.25
0.24
739248.62
GPTQ
GPTQ (4-Bit) MEMIT
0.81
0.69
0.04
4.25
0.55
0.58
6.38
GPTQ (8-Bit) MEMIT
0.95
0.03
5.57
(2-B0) LORA
0.0
0.01
2.25
0.25
0,24
695958.11
GPTQ (3-Bit) LoRA
0.01
0.02
0.38
11.14
(4-Bil LORA
0.21
0.14
0.05
4.25
0.53
0.57
9,54
GITQQ (8 Bit) LLRRA
1.0
0.72
0.06
0.61
19.99
AWQ (2-Bi0
0.0
0.0
2.25
0.24
0.26
33638.44
AWQ (3. FT
1.0
0.82
0.08
3.25
0.5
0.51
7.57
AWQ (4-Bi0 FT
0.99
0.84
0.15
0.54
0.57
5.98
AWQ (5-BI0 FTT
0.99
0.85
0.12
5.25
0.55
0.6
5.68
0.6
AWQ (8-BI0 FTT
0.99
0.87
0.13
8.25
0.56
0.6
5.6
AWQ (2-
1735678.75
AWQ (3-Bi) -EEITT
0.92
0.87
0.03
3.25
0.49
0.47
7.57
AWQ (4-BiD) MEMIT
0.92
0.04
0.58
AWQ (5-Bi0 -EMIT
0.98
0.96
0.03
5.25
0.56
0.6
5.68
AWQ (6-Bit) MEMIT
0.98
0.04
0.6
5.62
AWQ (8-Bi)) -EMII
0.98
0.94
0.04
8.25
0.57
0.6
5,59
A2- LoRA
0.06
0.0
0.26
141960.91
AWQ (3 Bit) LORA
1.0
0.71
0.05
3.25
0.51
55.44
(4-Bi) LORA
1.0
0.07
0.58
29.71
AWQ (5 Bi) RAAA
1.0
0.69
0.05
5.25
0.56
0.6
17.32
AWQ (6-Ri0 LORA
1.0
0.69
0.06
6.25
0.57
0.61
166
AWQ LORA
8.25
0.61
21.64
Table 17: Detailed results for compression - editing.
31

---

Published as a conference paper at ICLR 2025
Editing
Compression
Unleamingg
Uniity
Edit Success
Generalization
Locality
Avg. Bits
Avg. WMDP
MMLU
WikiTex PPL.
GA-SSurs=GPT (0:25)
0.0
12:25
0.46
inf
GA -A-SpurcGPT (0.35)
0.0
0.0
0.0
10.75
0.44
0.49
inf
GA-SpuscCPT (0.45)
0.0
9.25
inf
GA- GA-SSpPneGP (0.55)
0.0
0.0
0.0
7.75
0.3
0.32
inf
GA SSparsGPP (0.65)
0.0
0.0
0.0
6.25
0,25
0.25
inf
SA-SSpuseGPP (0.75)
inf
GA--Wanda (0:25)
0.0
0.0
0.0
12:25
0.46
0.52
inf
SAA-Wanda (0.35)
0.0
0.0
0.0
10.75
0.45
0.49
inf
Wanda
9:25
0.4
Wanda (0.55)
0.0
0.0
0.0
7.75
0.3
0.32
inf
GA Wanda (0.65)
0.0
0.0
6.25
0.25
0.25
inf
inf
GA-xGPTO (i-Bi))
0.0
0.0
0.0
2.25
0.25
0.25
inf
GA->GPTQ (3-Bit)
000
3.25
0.33
inf
GA-GPTO (4-Bit)
0.0
4.25
0.43
inf
GB (8-8i))
0.0
0.0
0.0
8:25
0.45
0.49
inf
GA-AAW (2-Bit)
1769133.88
GA->AWQ (3-Bi)
0.0
0.0
0.0
3.25
0.41
inf
GA- (4-8i)
0.0
0.0
0.0
4.25
0.43
0.47
inf
inf
GA-AAWQ
0.0
0.0
0.0
6:25
0.45
0.49
inf
(8-AWQ
0.0
0.0
0.0
8:25
0.45
0.49
inf
PSprseGPP (0.25)
0.01
0.02
12.25
0.27
5.07
GD-+SprscGPP (0.35)
0.0
0.0
0.02
10.75
0.28
0.55
3.64
GD GDD=spurePPPT
0.02
9.25
0.28
7.02
GD GD-SSpessGPT (0.55)
0.0
0.01
7.75
0.27
10.6
GD Sp0-SpprPPPPT (0.65)
0.0
0.0
0.02
6.25
0.26
0.27
25.97
GD PSprreGPP (0.75)
0.01
0.01
4.75
0.24
119.71
10--Wamda (0:25)
0.01
0.03
12:25
0.35
0.58
5.34
GD-Wanda (0.35)
0.0
0.0
0.02
10.75
0.38
0.56
6.61
9.9
GD--aand (0.55)
0.0
0.0
0.0
7.75
0.37
0.39
22.22
GD Wanda (0.65)
0.0
0.0
0.0
6.25
0,26
0.23
184.75
(0.75)
3298.92
GD-GPTQ (2-Bi0)
0.0
0.0
0.0
2.25
0.24
0.27
inf
GD-GGPTQ
0.0
3.25
0.24
inf
GD->GPTQ
GD-GPTO (8-Bi0
0.0
0.0
0.0
8:25
0.24
0.35
2.445866772-464010-226
GD-AAWQ
0.0
2.25
0.24
2596854.5
GD-AWQ (3-Bit)
0.0
0.0
3:25
0.33
inf
GD AD- (4-Bi))
0.0
0.0
0.0
4.25
0.24
0.35
MMA528471566330211ee2
GD-
6.00520045030 2292c+28
GD (6 (6-Bit)
0.0
0.0
0.0
6.25
0.25
0.35
1993359951176105ee
GD- (8-Bit)
0.0
0.0
0.0
8:25
0,25
0.35
(44000615331/288eeee
RMU--SpanePPP
0.02
0.02
0.03
12.25
0.28
5.93
RMU SPpaseGPT (0.35)
0.02
0.02
0.03
10.75
0.28
0.53
6.39
RMU RMU-Spans:ciP1 (0:45)
0.02
0.02
0.03
9.25
0.27
0.48
8.14
SpaaseGPPTT (0.55)
7.75
RMU SparspGPPPPTT (0.65)
0.0
0.01
0.03
6:25
0.25
0.26
35.97
RMU SpansePP (0.75)
0.01
0.03
4.75
0.25
0.23
101.32
RMU Wanda (0.25)
0.02
0.04
12:25
0.29
3.88
RMU Wanda (0.35)
0.02
0.02
0.03
10.75
0.28
0.53
6.36
RMU Wanda (0.45)
0.03
9.25
0.29
7.71
RMU Wanda (0.55)
0.01
0.01
0.03
7.75
0.27
13.73
RMU Wanda (0.65)
0.01
0.01
0.03
6.25
0.25
0.23
$2.67
RMU- Wanda
RMU-GPPI GPTQ (2-Bit)
0.0
0.01
0.03
1.25
0.25
3451.67
RMU-GPTO (3-Bit)
0.01
0.03
3.25
0.26
0.42
9.09
RMU- SMUU-GPTQ
(8.Bi))
0.02
0.02
0.03
9.25
0.29
0.57
5.56
AMU--AWO- .A-O0(22BB)
0.0
2.25
0.24
0.26
1726409.12
RMU-AWQ (3-Bit)
3:25
7.55
RMU-AWW (4-Bit)
0.02
0.02
0.03
4.25
0.29
0.56
5.95
RMU-AWO- A
0.02
0.05
0.04
5.25
0.28
0.56
5.68
RMU-AWQ (6-Bit)
0.02
0.02
0.03
6.25
0.28
5.62
AWO (8-Bil)
0.02
0.02
0.03
8.25
0.29
0.57
5.56
Table 18: Detailed results for unlearning -> compression.
32

---

Published as a conference paper at ICLR 2025
Editing
Compression
Unleaming
Unilit
Edit Success
Generalization
Locality
Bits
Avg. WMDP
MMLU
WikiText PPI
SpansePT
Spars:PPT (0.55) -GA
0.0
0.0
0.0
10.75
0.34
0.36
inf
SpareGPTT (0:45) -GA
0.0
0.0
9.25
0.31
0.33
Spars:PPT (0.55) +GA
0.0
7.75
0.25
0.25
SpaseGPT (0.65) -GA
0.0
0.0
0.0
6.25
0.27
0.28
inf
SparsGPPT
SpaneGPT (0.25) :GD
0.01
0.0
0.02
12,25
0.48
13.32
SparsePPT (0.35) -+D
0.01
10,75
0.29
0.25
2712.26
SpaneGPPT (0.45)
1090011999999999 (1990597988++1
SpaseGPT (0.55) -+D
0.0
0.0
0.02
7.75
0.35
0.36
9.35
SparsGGPT (0.65) -GD
0.0
0,24
0.26
SpaneGPT (0.75) -+G
0.01
0.01
4.75
0.26
0.23
1437619072.0
SparseGPP (0:25) -RMU
0.01
0.02
0.04
12.25
0,31
0.57
5.92
SpareGPPT (0.35)
SparseGPT (0:45- -RMU
0.11
0.01
0.03
9.25
0.31
0.51
7,86
SpareGPPT (0.55) :RMU
0.01
0.03
7.75
0,29
0.41
10.39
SparsePPT (0.68) -RMU
0.0
0,26
30.26
SparseGPT (0.75) -RMU
0.01
0.01
0.02
4.75
0.25
0.23
97.03
Wanda (JA -GA
0.0
0.0
12.25
0.49
0.54
(0.d5(0.35) ->GA
0.0
0.0
10.75
0.44
0,51
Wanda (0.55) (0.45)-+GA -IGA
0.0
0.0
0.0
9.25
0.41
0.43
inF
Wanda (0.65) -+GA
0.0
0.0
0.0
6.25
0.26
0.26
Wanda (0.75) 3GA
0.11
0.03
0,26
0.23
8.125971
Wanda (0.25) +GD
0.0
0.0
12.25
0.52
Wanda (0.35) -GD
0.0
0.0
0.0
10,75
0.45
0.48
57480505296.0
Wanda (0.45)
Wanda (0.55) -GGD
0.0
0.0
0.0
7.75
0.39
0.35
121 .07
Wanda (0.65) -GD
0.0
0.0
6.25
0,26
0.23
16268, 01
Wanda (0.25) -RMU
0.02
0.02
0.04
12.25
0.32
0.57
5.86
Wanda (0.35) -RMU
0.02
0.02
10,75
0.34
0.56
6.33
Wanda (0.15) -RMU
0.02
0.02
0.03
9.25
0.39
0.52
7.55
Wanda (0.55) :RMU
0.01
0.01
0.03
7.75
0.36
0.36
12.58
Wanda (0.75)
:RMU
0.02
0.03
0.02
4.75
0.26
0.23
3.1.87
GPTQ (2-Bit)
-GA
0.0
0.0
0.0
2.25
0.25
0.25
inf
GPTQ (3-Bit)
0.0
GPTQ (4-Bi)) -GA
0.0
0.0
0.0
4.25
0.34
0.38
inf
GPTQ (8-Bit)
0.0
GPTQ (2-B:t) -GD
0.0
2:25
0.25
0.25
GPTQ (3-Bit) -GD
0.0
0.0
3,25
0,26
0.24
628. 24
GPTQ
GPTQ (8.Bit) :GD
0.01
0.02
0.05
8.25
0.26
0.47
inf
GPTO (2-Bi) -RMU
0.0
2.25
0,25
1017825,90
94
GPTQ (3-Bit) RMU
GPTQ (4-Bi) RMU
0.0
0.02
0.02
4.25
0.45
0.58
6.35
GPTQ RMU
0.02
0.03
8.25
0.28
0.57
(2-Bi) GGA
0.0
0.0
0.0
2:25
0.24
0.27
AWQ (3-81) -OA
0.0
0.0
0.0
3,25
0,24
0.27
AWQ (4-Bi0 AOF
AWQ (5-81) -GA
0.0
0.0
0.0
5.25
0.35
0.39
inf
AWO (6 050 YD-
0.0
80
6.25
0.25
0.3
AWQ (8-84) -GA
0.0
0.0
8.25
0.28
0.37
AWO (2 (-05) XGD
0.0
0.0
0.02
2.25
0.24
0.27
4.496028624899
19c+
AWQ OGD
0.0
3.25
166895.91
AWO (4-B8) GD
0.0
0.44
4.25
0.24
0.42
7.05
AWQ (S-Bi) -GD
0.0
0.0
0.08
5.25
0.25
0.38
2685384
AWO (6-Bi)
AWQ (8-81) GGD
0.0
00
0.11
8.25
0.25
0.25
492247944 12.0
AWO
ARMU
0.0
2.25
0.24
1749321.75
AWQ (5-840 +RMU
0.01
0.27
7.51
AWQ (4.8)) RMU
0.02
0.02
0.03
4.25
0.27
0.55
6.06
AWQ RMMU
AWQ (6-81) RMU
0.02
0.02
0.04
6.25
0.28
0.56
5.6
AWQ (8-B10 -RMU
0.02
0.03
0.03
8.25
0.28
0.57
5.71
Table 19: Detailed results for compression unlearning.
33

---

Published as a conference paper at ICLR 2025
Editing
Compression
Unlearning
Utitty
Edir Success
Generalization
Locality
Avg. Bits
Avg. WMDP
MMLU
WikiTest PPI.
FT-GA
0.0
16.0
0.47
0.53
inf
FT-GD
0.32
0.25
0.07
16.0
0.29
0.41
2.8266669116103355+333
0.28
MEMIT-GA
0.0
0.0
0.0
16.0
0.4
0.45
inf
-EDIT-GD
0.53
0.49
0.03
16.0
0.26
0.36
2761505612288000
MEMIT RMU
0,96
0.89
0.03
16.0
0.29
0,56
5.58
LoRA +GA
0.0
0.0
0.0
16.0
0.28
0.29
inf
LoRA-GA
0.44
0,23
0.05
16.0
0.3
0.45
29.46
LoRA- -RU
1.0
0.68
0.05
16.0
0.3
0.52
34.56
Table 20: Detailed results for editing - unlearning.
Editing
Compression Avg. Bits
Unlcarning Avg. WMDP
Utility
Edit Success
Generalization
Locality
MMLU
WikiText PPL
GA-
0.07
0.04
16.0
0.47
0.52
inf
GA- -EMII
0.48
0.41
0.0
16.0
0.45
0.49
inf
GA LLOR
1.0
0.78
0.03
16.0
0.34
0.36
56.91
GD -FT
0.99
0.81
0.11
16.0
0.29
0.59
4,64
GD >EEMT
0.93
0.89
0.05
16.0
0.28
0,58
4.65
-LORA
1.0
0.54
4.99
RMÚ SPT
1.0
0.79
0.13
16.0
0.32
0.57
3.6
RMU MEMIT
0.97
0.93
0.03
16.0
0.3
0.56
5,58
AMU-LORA
1.0
0.71
0.05
16.0
0.29
0.56
12.83
Table 21: Detailed results for unlearning + editing.
34


Reviews:
[{"review_id": "Aw2LhbXoEe", "reviewer": "Reviewer_KMdD", "summary": "This paper experimentally demonstrates the effect of composing various inference time setups for LLMs and suggests possible setups for better performance from its analysis.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "S1. The paper conducts experiments on various methods and compositions on multiple models to provide a deeper insight.\n\nS2. The method proposes metrics that correlate with the effect of a composition.\n\nS3. The presentation is lucid and easy to follow.\n\nS4. The codebase will be useful to the community for further studies.", "weaknesses": "W1. Some comparisons on the base models, chat, and RLHF could be interesting which could provide insight into pretraining, instruction tuning, and post-training with the interventions.\n\nW2. With a similar spirit as W1, it is important to see the results for different generations of the same model family and sizes.\n\nW3. The sensitivity (standard deviation) of the experiments is unclear if run multiple times in Table 2.\n\nW4. Practitioners need to perform a grid search for their domain-specific requirements as some results depend on specific settings outside composition.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "liqfk64aTm", "reviewer": "Reviewer_Mrdn", "summary": "This paper proposes a new framework to assess the effects of combining different test-time interventions on language models to improve factual accuracy, efficiency, and mitigate harmful outputs. Traditionally, methods such as knowledge editing, model compression, and machine unlearning have been developed separately, but practical applications often require these interventions to work together. The authors introduce two novel metrics—Order-free Error and Order Sensitivity—to evaluate the composability of interventions, aiming to ensure that each intervention's success is minimally impacted by other interventions.\n\nKey contributions include: (1) extensive experiments across 417 combinations of interventions, uncovering findings, such as compression often hindering the success of knowledge editing and unlearning, and the significant impact of intervention order on outcomes. (2) They will provide a codebase featuring popular intervention methods, supporting future multi-objective intervention research and development.\nThe paper emphasizes the need for composable, multi-objective intervention methods and creates a foundation for systematically evaluating intervention interactions in language models.", "questions": "See weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "* Addresses an important program in model updates and adaptations to real-world requirements.\nIntroduces new metrics and provides extensive experimental results. \n* Codebase hypothetically supports is flexible enough to scale to other inference-time interventions. There is no code uploaded, so hard to say for sure.\n* Well-written paper", "weaknesses": "* Hard to say if the findings using the specific models and datasets used generalize more broadly (e.g., Llama 3, WMDP). WMDP, for instance, specifically notes that “benchmarking on only WMDP may yield a false sense of model safety after unlearning.”\n* The paper lacks guidelines for ordering interventions or insights/analysis into why some orderings are not robust or how to make them more robust.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kAW56Fh0KC", "reviewer": "Reviewer_gvGR", "summary": "The paper proposes a framework (evaluation metrics) to study the effect of the composable interventions on LLMs. Authors claim that interventions like model compression, knowledge editing, and unlearning can affect each other and hence they study this phenomenon.", "questions": "1. Why did you decide to focus on the three interventions in particular mentioned in the paper? (unlearning, compressing, model editing)\nWould this choice limit the scope of study?\n\n2. As also mentioned in the weaknesses above, the framework might be limited as it only considers two interventions at a time. Can the method be expanded to study more than two interventions at a time?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper is written in a very clear, nice, and easy to understand way. \n2. The motivation of the paper is clear. \n3. The paper studies an interesting problem.", "weaknesses": "While the paper is written very clearly and it studies an interesting problem, I have a major concern. My major concern is that the technical contribution of the paper might not be rigorous although insights and findings are good and the paper studies an interesting problem. perhaps one way to improve the paper would be to propose a method to make LLMs more robust to composable interventions or even design the interventions themselves in a way to not see degrade in their performance after other interventions are applied on top. Or even using the proposed evaluation framework as a recommendation framework to provide recommendation on how the interventions should be applied based on a given LLM and the intervention method.\n\nAnother concern I have is that the framework might be limited as it only considers two interventions at a time. Can the method be expanded to study more than two interventions at a time?\n\nFinally, results on other LLMs are not fully consistant across all the studied dimensions which makes the finding of the paper not super reliable. It would be good to do some statistical significance test (e.g., across various LLMs).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tldeQTHFIm", "reviewer": "Reviewer_1gkW", "summary": "This work introduces a \"Composable Interventions\" for language models, addressing a practical, real-world need. The authors develop new metrics and a unified codebase to evaluate the effectiveness of combining multiple interventions, such as knowledge editing, model compression, and machine unlearning. Through rigorous and extensive experimentation with 417 intervention combinations, the research underscores the significance of the sequence in which interventions are applied on model performance. The exposition is clear and well-organized. This study tackles the complexities of applying multiple interventions simultaneously, providing foundational insights that pave the way for future research on robust and adaptable language models.", "questions": "Refer to Weaknesses", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The authors introduces two new metrics:Order-free Error and Order Sensitivity, that evaluate the robustness of intervention sequences, highlighting the importance of intervention order.\n- The authors also conducted extensive experiments using various compositions, showcasing the interaction effects of various interventions.\n- The authors present several important findings. For instance, the success of interventions is highly dependent on the order of application; compression hinders editability; unlearning and editing are relatively compatible; and certain methods are inherently more suitable for sequential applications. Additionally, they found that conventional metrics are inadequate for measuring composability, underscoring the need for new intervention techniques explicitly designed for this purpose.", "weaknesses": "- The authors present numerous findings and insights, such as Compression consistently hinders Knowledge Editing and Unlearning, which is a relatively straightforward conclusion. It would be valuable for the authors to explore deeper analysis and hypotheses beyond identifying patterns such as 'A affects B' or 'A and B are compatible,' moving from experimental observations to more comprehensive insights.\n- In combined interventions, it appears that certain combinations do not yet have a clear consensus. For instance, in composing model compression with knowledge editing, the preferred order can vary significantly by method: for GPTQ, editing seems more effective first, whereas for AWQ, compression may be preferable. This suggests that optimal ordering may rely on experimental results specific to each method.\n- While Order-free Error and Order Sensitivity offer valuable insights, the small differences in outcomes and variations across metrics suggest that additional measures may be needed to fully capture intervention interactions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qKfX7uWWws", "reviewer": "Reviewer_5FNv", "summary": "The paper highlights a gap in the practical application of model interventions, where multiple techniques, such as information removal, model editing, and efficiency optimization (e.g., pruning and quantization) are often needed in combination but have largely been studied in isolation. The authors systematically explore how these interventions interact when used together, analyzing the sensitivity to intervention order and the broader implications of composability. This research offers insights into the outcome of utilizing multiple interventions and emphasizes the need for multi-objective intervention metrics to gauge their effective composability.", "questions": "How do different interventions interact with one another? Are there any interference patterns or dependencies that affect their compositional effectiveness?\n\nWhy do certain techniques exhibit better composability than others? Are there particular properties or design choices in those techniques that lend themselves to more effective composition?", "limitations": "", "rating": 3, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The research effectively highlights an oversight in current evaluation methodologies, where interventions are assessed independently despite concurrent deployment requirements in productionized environments.\n\nAnalysis of compositional effects across multiple intervention types, incorporating various established techniques from each domain (editing, unlearning, and model compression).\n\nFindings provide valuable insights into the compatibility and limitations of different intervention combinations, offering practical usage guidance.", "weaknesses": "While the study provides a thorough documentation of interactions among various interventions, it falls short in examining the underlying issues or mechanisms that lead to compositional failures. A deeper analysis of the interference patterns or cause-effect relationships between interventions is necessary to understand why the composition of approaches works more effectively in some cases than in others. Exploring why certain techniques exhibit superior composability over others would greatly enhance the study’s contribution. Such insights would also help clarify the conditions under which specific interventions interact constructively or destructively, offering guidance for future research in designing more robust and composable interventions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)