DUET: Distilled LLM Unlearning from an Efficiently Contextualized Teacher
Authors: Yisheng Zhong
Zhengbang Yang
Zhuangdi Zhu
Venue: ICLR 2026 Poster (2026)
Keywords: LLM Unlearning
Knowledge Distillation
Teacher–Student Learning
Utility Preservation
Data Efficiency
Robustness
Safety and Alignment
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: DUET distills a prompt-steered teacher into a student to reliably forget undesirable knowledge while preserving utility, delivering state-of-the-art forgetting, robustness, and orders-of-magnitude better data efficiency.

Abstract: LLM unlearning is a technique to remove the impacts of undesirable knowledge from the model without retraining from scratch, which is indispensable towards trustworthy AI. Existing unlearning methods face significant limitations: conventional tuning-based unlearning is computationally heavy and prone to catastrophic forgetting. In contrast, in-contextualized unlearning is lightweight for precise unlearning but vulnerable to prompt removal or reverse engineering attacks. In response, we propose Distilled Unlearning from an Efficient Teacher (DUET), a novel distillation-based unlearning method that combines the merits of these two lines of work. It learns a student model to imitate the behavior of a prompt-steered teacher that effectively refuses undesirable knowledge generation while preserving general domain knowledge. Extensive evaluations on existing benchmarks with our enriched evaluation protocols demonstrated that DUET achieves significantly higher performance in both forgetting and utility preservation, while being orders of magnitude more data-efficient than state-of-the-art unlearning methods.

Published as a conference paper at ICLR 2026
DUET: DISTILLED LLM UNLEARNING FROM AN EF- FICIENTLY CONTEXTUALIZED TEACHER
Yisheng Zhong George Mason University yzhong @mmuu
Zhenghang Yang George Mason University zyang 30 g edu
Zhuangdi Zhu
George Mason University 2zhu24 4 4 @m edu edu
ABSTRACT
LLM unlearning technique to remove the impacts of undesirable knowledge from the model without retraining from scratch, which is indispensable towards trustworthy AI. Existing unlearning methods face significant limitations: con- ventional tuning-based unlearning is computationally heavy and prone to catas- trophic forgetting. In contrast, in-context unlearning is lightweight for precise unlearning but vulnerable to prompt removal reverse engineering attacks. In response, we propose Distilled Unlearning from an Efficient Teacher (DUET), a novel distillation- unlearning method that combines the merits of these two lines of work. It learns a student model to imitate the behavior of prompt- steered teacher that effectively refuses undesirable knowledge generation while preserving general domain knowledge. Extensive evaluations on existing bench- marks with our enriched evaluation protocols demonstrated that DUET achieves higher performance in both forgetting and utility preservation, while being orders of magnitude more data-efficient than state-of-the-an unlearning methods.
INTRODUCTION
LLMs show remarkable intelligence that emerges from large-scale pretraining on open-domain knowledge. In the meantime, the same capacity for learning also enables them to memorize and po- tentially reproduce undesirable information, which raises serious concerns over privacy and safety. Prior work has demonstrated that LLMs can inadvertently reveal private information, copyrighted content, and beyond when prompted inappropriately (Voigt & Bussche 2017 Pardau 2018 Zhong jet al. 22055a] Pan et al. 2026). Removing undesirable knowledge is essential step towards trust- worthy and ethical Al systems.
Towards this goal, LLM unlearning training has been proposed promising technique, which fine-tunes the target LLM on undesirable data to reduce the likelihood for the model to generate un- desirable knowledge without requiring complete retraining from scratch (Yao et al.) 2024 Nguyen et al. 2025) Xu et al. 2023; Zhong et al. 2025b). Still, methods along this line typically require substantial training data represent the undesirable knowledge. More critically, these approaches often suffer from catastrophic degradation of general utility. where the knowledge should be pre- served. A key research aim in LLM unlearning to effectively balance these two goals: unlearning undesirable knowledge while maintaining overall model performance.
On the other hand, LLMs effective few-shot learners that are capable of adapting through contex- tualized learning, where carefully designed prompts guide the model to generate more aligned be- havior. Accordingly, in-context unlearning has been inspired as cost-effective unlearning scheme that steers I.LM response without fine-tuning on model parameters. However, the robustness of such methods is questioned, as the same in-context strategies can be exploited to reverse engineer the LLM, such that the superficially suppressed knowledge can be elicited from the in-contextually unlearned model, a phenomenon termed un-unlearning (Shumailov et al. 2024 Pawelezyk et al,
2023
Hu al. 2025 Lucki et al. 2024
These two lines of unlearning paradigms show complementary trade-offs: training-based unlearn- ing achieves stronger robustness, but requires high computational and data resources, while risking more utility degradation. Contextualized unlearning, on the other hand, enables precise unlearning by efficiently altering the models' logit distribution given a query regarding unlearning knowledge,

---

Published as a conference paper at ICLR 2026
without requiring parameterized optimization, yet it superficial and can be easily reversed. This dichotomy raises an intriguing question: can we combine the merits of both, such that the effects of in-context unlearning can be imitated and preserved through parameter optimization in computa- tionally efficient manner, while achieving greater robustness against reverse engineering?
Motivated by the potential and limitations of existing LLM unlearning, propose Distilled Unlearning from an Efficient Teacher (DUETT), which achieves unlearning through deep knowledge distillation from an efficient, yet superficially contextualized teacher LLM student LLM. Specif- ically, we design concise yet effective prompt instructions for in-context unlearning and fine-tune the target LLM mimic the dominant logit shifts induced by these unlearning prompts. This ap- proach enables more precise unlearning by leveraging refined supervision signals from the prompted teacher model while mitigating impacts on general utility that should remain preserved.
We summarize the main contributions of our work as follows:
Effective and balanced unlearning. Our teacher-student distillation framework surpasses or matches existing methods in forgetting effectiivnnsss, with negligible impact on model usability, thereby achieving a more favorable balance between knowledge removal and retention than prior work.
Robustness against reverse attacks. Unlike in-context unlearning methods that rely on contex- tual prompts that can be systematically removed manipulated, our approach embeds the un- learning pattern directly into model parameters and makes it robust against reverse prompt attacks attempting to recover suppressed knowledge.
Unlearning with high data efficiency. Through systematic analysis of cxisting unlearning bench- marks, discovered that data quality and format impacts on the unlearning efficacy. In response, we designed a data-efficient scheme that achieves effective forgetting with orders magnitude fewer reformatted training samples compared to prior training- approaches.
Fine-grained evaluation. We proposed an enhanced evaluation protocol with (1) enriched sam- ples to mitigate biases in existing benchmarks like MUSE (Shi et al.] (024b), (2) multiple evaluation formats including knowledge retrieval and content generation, and (3) comprehen- sive
and content-completion assessments. Our evaluation reveals that pre- vious methods lack unlearning robustness across heterogeneous task scenarios, while our method achieves precise unlearning with better utility preservation. This framework provides more inter- pretable evaluation methods for future research.
RELATED WORK
Efforts to unlearn knowledge from LLMs can be broadly categorized into two paradigms: in-context methods, which steer model behavior at inference time without updating model parameters, and training-based methods, which modify model weights to enforce forgetting. We review both di- rections below and refer readers to recent surveys for comprehensive overviews of LLM unlearning settings and objectives (Nguyen et al.. 2025 Yao et al. 2024).
In-context Unlearning is lightweight and acts directly on specific queries to be forgotten. In- Context Unlearning (ICU) (Pawelczyk et al. (203) framed unlearning as a few-shot instruction fol- lowing, where carefully constructed prompts and demonstrations that push responses away from tar- geted knowledge while keeping general outputs untouched. ECO (Liu et al. (024a) further learned minor embedding corruptions applied the prompts detected as targeting forbidden content, achiev- ing efficient suppression with minimal side effects. Despite their efficiency, in in-context approaches are vulnerable to simple countermeasures: removing or overriding steering instructions can restore the suppressed behavior, and adversarial prompts can easily re-elicit the forbidden knowledge. (Shu- mailov et al. (2024) formalized this risk as un-unlearning where the undesired capability can be reintroduced in context, and calls for the necessity of content filtering. [uuci et al. (2024) demon- strated that jailbreak-style attacks and adaptive strategies can recover hazardous capabilities against parameter-editiine methods such RMU (Li et al. (2024). Orthogonally, targeted relearning attacks show that fine-tuning on a handful of crafted examples can bring back forgotten behaviors (Hu et al. 2024). These findings motivate parameter optimization with more robust unlearning efficacy.
Training- based Unlearning is parameter-update method that typically provides stronger persis- tence, but faces optimization and stability challenges. Gradient Ascent (GA) (Jang al. 2023)
2

---

Published as a conference paper at ICLR 2026
increased the model loss on the unlearning data but usually leads to catastrophic forgetting across related knowledge. Negative Preference Optimization (NPO) (Zang et al. 2024) reframed unlearn- ing preference optimization that aligns the model to disprefer responses that contain undesirable knowledge, which mitigates general knowledge collapse compared with GA with a more balanced forgetting and utility performance. SimNPO (Fan et al., 2025) further removed the necessity of reference model from the NPO objective. Task-vector Editing subtracted the influence of unlearning knowledge of an adapter fine-tuned on forgetting data (Ilharco al.) (023). Interpolation-basee WHP blended a base model with a reinforced model to attenuate undesirable knowledge (Eldan & Russinovich] 2023). Representation Misdirection for Unlearning (RMU)
2024) redirected intermediate representations of forget-set inputs toward random direction while leaving retain-set representations approximately unchanged. Recent unlearning methods pursue retain-data efficiency: FLAT' (Wang et al., (025) adjusted the loss using only on forget data and template response. In parallel, Refusal Training (Choi et al. 2024) treated questions about the forget data as negative in- structions and optimized the model to answer with consistent refusal, improving safety coverage but still trading off utility when the boundary between forget and retain is ambiguous. Across these methods, practitioners often employ retain-side regularization such cross entropy in retain set (GDR) (Maini et al., (024) or KL alignment to the original model (KLR) (Zhang et al. 2024) to mitigate catastrophic forgetting. However, such regularization usually does not fully resolve the retention retention-forgetiinn forgetting tension in practice.
LLM Unlearning Evaluation remains a critical and underdeveloped aspect of the field. TOFU (Maini et al. 2022) proposed a benchmark of synthetic authors and QA pairs that isolates forgetting targets and compiles metrics for forgetting and retention. More recent evaluations emphasized di- verse goals and formats. MUSE (Shi et al., 2024b) defined six desiderata spanning memorization, privacy leakage, and preservation of general utility, etc. reported metrics such as ROUGE- style overlap, entailment, privacy leakage indicators, and utility on held-out tasks. WMDP (Li al. 2024) focused on high-risk capabilities regarding hazardous knowledge. provided 3,668 multiple-choice questions across biosecurity, cybersecurity. and chemical security. These efforts jointly emphasize the need for more holistic evaluation frameworks in LLM unlearning.
METHOD
3.1 PRELIMINARY OF TRAINING-BASED LLM UNLEARNING
Fraseing-based based LLM unlearning training mechanism remove undesirable knowledge from an LLM through parameter optimization. Given an LLM 0, forget set 'Dy containing undesirable knowledge, and a retention set D, representing general domain knowledge, a typical unlearning objective optimizes the following:
Training-
min Lunteam (Dy; 0) X (D,;; 0'),
where À balances the trade-off between forgetting and retention. Conventional unlearning methods usually implement gradient ascent on Lunkeams and optionally apply regularization techniques such as KI KL-divergence to constrain the model output divergence before and after unlearning retention data Maini et al. (2024).
3.2 IN-CONTEXT UNLEARNING PROVIDES EFFICIENT SUPERVISION SIGNAL
Our goal of accountable unlearning is to optimize the LLM to refuse to generate undesirable re- sponses clearly, rather than producing misinformation or hallucination (Bai et al. 2022; Askell al.)
2021 Lin et al., 2022). We define legitimate refusals, e.g. "I do not have any knowledge regarding this topic", as a preferable (winning) response yoe Yus and a response that reveal any undesirable information as losing one E Yi-
Given an input query Fy from unlearning set Dj whose knowledge needs to be forgotten, one straightforward approach to enforce unlearning on the relevant domain knowledge is through in- context instructions, which steer LLM behavior without parameter modifications. For example, a prefix prompt Tic, such as "You are an AI Assistant who has unlearned about the book series of Harry Potter and should respond as if you never knew about it", will guide the model to refuse queries related to Harry Potter content, which is representative copyright-protece (2024b). In contrast, applying this prefix to other queries regarding general- domann knowledge will have negligible impacts on their performance, thus largely preserving model utility. Formally, given
content Shi et al.
3

---

Published as a conference paper at ICLR 2026
an LLM and unlearning domain Dj, 3 Tie X, 0 S 1, Vay Dy. Ta Bxy)
Ply E Yu) > c.
Although in-context instructions provide transient effects that may be vulnerable to reverse engineer- ing, the resulting output distribution shifts can still offer valuable supervision signals for unlcarning training. Built on this insight, design unlearning ized teacher Tee which is the pretrained LLM prompted with an in-contextual unlearning prefix Tie- This motivates to minimize the distributional divergence between the student and the teacher:
model mo (student) imitating contextual-
min B Diff To (z) Ter @ xxy))
(2)
0
where Diff represents an arbitrary distance metric of distributional divergence, such as KL-
divergence (Zhang al. 2024 or d-divergence (Sekhari al. 202I
3.2.1 A UNIFIED UNLEARNING OBJECTIVE FOR Top- K LOGIT DISTILLATION
Equation 2 provides a viable method to optimize unlearn-
DUET Before Dibiited Untearming
ing distillation the model's whole posterior probability space, which, however, raises two potential challenges: First, the normalized probabilities only capture relative token confidence from the teacher rather than their abso- lute logits, which could have conveyed more refined su- pervision information. Second, not all probability shifts induced by in-context examples affect the final output, es- pecially given the massive vocabulary size. Meticulously aligning along each token probability shift may let noise dominate the distillation process while being computa- tionally expensive.
Afre
12
32
DUET After buttlled Unleamiin
11.9
Observing these limitations, we focus on tracing the logit shifts towards the most dominant tokens in the teacher model, i.e. candidate tokens that are likely to be sampled if following a beam search (Sutskever et al.) 2014 Vijayakumar et al. 2018). Specifically,
190
iden- tify the Top-K candidate tokens is E Ck that receive the highest logits from the teacher: ( (+|aic @ æy) ÉK HiEC where we slightly abuse notations to use fol (.ari < } as each raw logit output before the softmax distribution normalization, i the index of such to- ken in the entire vocabulary space [V], and Ex the thresh- old for filtering top K candidate tokens.
Top-10 10 logits for a Harry Pot- ter related query before and after DUET un- learning. Multi-token words are shown com- plete for clarity. Before unlearning, domain- related and aftirmative tokens dominate. Af- ter unlearning, refusal and uncertainty to- kens emerge while HP-related tokens climinated from the top candidates.
Figure I:
To further preserve general knowledge capabilities, we incorporate lightweight retention data D, irrelevant to the undesirable knowledge in DD, Since prefixing general queries x, ~ D, with in-context instructions Tie should not alter the L.M's output semantics, we apply the same distillation process using D, for knowledge regularization. Practically, we mix samples from D, and D, within training batches. Unlike traditional methods that augment unlearning loss with a separate retention loss, such as Cunteam + XLrettinn which usually requires a hyper-parameter tuning on X, apply one coherent unlearning objective for both unlearning and knowledge preservation:
min JOUET Exe(D 0
Σ EEC
(99 (z): (x 2 xz))
(3)
where I(.) is a distance measurement over two scalar values (logits), for which we choose Hu- ber I.-1 loss (Huber) 1964 Girshick 2015) for its stability in smoothing loss induced by logit outliers Barron (2019). Figure I demonstrated the effects of our method on the logit shifts on student LLM 3--lama-..2---Insst
before and after DUET unlearning, where all logit scores are taken at the first decoding step; subsequent tokens are generated only to complete multi- token word for visualization. We can observe that the model assigns its highest logit to Harry- Potter-related answer tokens affirmative continuations before unlearning. After unlearning, the gighest-probabilitg candidates become refusal or uncertainty tokens (e.g., "None", "Unfortunatel"") and Harry-Potter- specifc tokens drop out of the top-10 candidates.
4

---

Published as a conference paper at ICLR 2026
Arewer co rotknne
the wh Poleer 201?
Teedhers Lagit
Iilaaree Henaer Sery
Unlearning (DUET)
Logits
rared Huckeg. D
Whats rans tott
Sequentially Superviaed Unleariing
Figure 2: Comparing DUET with conventional unlearning that requires sequentially supervised unlcarning on each response token.
We summarize the main idea of DUET in Figure 2 and defer the algorithm overview in the Ap- pendix (Algorithm D. In addition to balanced unlearning, our method offers two practical advan- tages. (1) Data Prerequisite: unlike existing unlearning methods, we not rely on access to un- desirable response Yt, which contains sensitive knowledge to be forgotten and might interfere with the general domain if not carefully curated. Instead, we distill supervision logits from a teacher that will yield desirable refusal ywu and only queries z eliciting undesirable knowledge is needed for unlearning training. (2) Training Efficiency: our methods avoid sequential training that explicitly iterates each token in Yw in prior work, but only embed logit shift pattern into the student given an input F, which will naturally induce forgetting when applied during inference.
4 EXPERIMENTS
We summarize the dataset and models used for evaluation Sec 4.1 the representative unlearning methods for comparison in Sec 4.2 and the detailed evaluation metrics and protocols in Sec 4.3 Sec 4.4 overviews the overall performance comparison, while See 4.5 analyzes the effects of logit distillation, and Sec 4.6 focuses sensitivity and comparative study, which reveals key compo- nents in our DUET that enhance the unlearning effectiveness and efficiency compared with related work. Furthermore, framework's 's robustness, including evaluations against adversarial jailbreak attacks, assessments of generalizability across various L.MM architectures, and comprehensive ablation studies hyperpa- rameter sensitivity and multi-step decoding distillation.
provide extensive supplementary analyses in the Appendix AA validate the
4.1 DATASETS PREPARATION.
Forget Set Construction: Our method designed for small, concept-centric datasets composed solely of queries. For each unlearning task, we use an LLM lightweight query-only dataset DIuery from the original forget set D7", where Dj contains queries Ty that aim to elicit prohibited knowledge. To support baseline comparisons, we also generate paired responses: each query z is matched with losing response yı Dins that contains undesirable knowledge and an ideal winning response yhu E Dieffse that provides appropriate refusal.
to extract
Unlike baselines such as GA and FLAT, our method does not require paired examples (x m)t with explicit negative responses, or contrastive samples (xy, Mr, yww) with ideal refusal. For fair comparison, all baselines are trained on both D and the reformatted version, D.g.Duuery U Dumss and are reported with their best performance across these settings, while DUET uses only Diuerry as the forget set. We evaluate unlearning approaches the following tasks:
Harry Potter (MUSE-Books): long-form copyrighted fiction corpus (the Harry Potter series by K. Rowling) widely used to probe LLM memorization and copyright leakage (Shi et al.) 2024b). We converted raw content into 100 fact-seeking questions 2 for constructing Dy For untearning evaluation, in addition to the 100 QA samples released by MUSE, expanded the evaluation set to 500 items to provide broader coverage and a more stable estimation.
WMDP: We consider two subtasks from WMDP benchmark: WMDP-Cybec (Li al., 2024): a safety-henchee heechark targeting cybersecurity knowledge, from which extracted 200 queries for
5

---

Published as a conference paper at ICLR 2026
constructing Di WMDD-Bio (Li et al. 2024): fieety-benchmark data focusing biolog- ical knowledge with academically phrased harmful content as an evaluation dataset. We also constructed 200 harmful-intent questions from the raw bio materials.
Retention Data Construction: We created a training set D, containing 100 Question-Answer (QA) pairs used during unlearning for all associated methods, and a dataset Deval with 100 QA samples for utility retention evaluation. All retention samples are disjoint from the forgetting domains.
4.2 BASELINE METHODS
We compared DUET with the following methods: (1) Gradient Ascent (GA) (Jang et al. 2023 that maximizes the model prediction loss on forgetting data, (2) NPO (Zhang et al. 2024) that performs negative alignment on the undesirable responses, (3) SimNPO, which is an NPO extension without a reference model, (4) FLAT (Wang al. 2025), which reduces the f-divergence of model-generated
and refusal response, (5) Refusal Training (Choi et al. (2024) that performs Supervised Fine-TTuning (SFT) on data containing refusal responses, and (6) RMU (Li et al., 2024), which pushes model representation on the unlearning domain towards random distribution. To ensure robust evaluation of general utility preservation, we incorporate retention regularization into methods like NPO and GA using KL-divergence penalties that align the unlearned model with the original model on the retention data. (Zhang et al.] 2024). We also consider an in-context unlearned model, which is pretrained base model prompted with an unlearning instruction carefully engineered to achieve effective unlearning. serves as the teacher model for DUET. More details, including teacher prompts across tasks, are deferred to Appendix[A.]
4.3 METRICS.
Unlearning Effectiveness: (1) We employed the ROUGE-L Fl score on the forgetting evaluation set for the MUSF-BBoos benchmark. Specifically, we report performance using the official MUSE forget set (100 samples) and our expanded dataset (500 samples), denoted as R-Forget and R- Forget-500 J, respectively.
(2) For WMDP tasks, we focused on WMDP Acc. J which is the averaged accuracy on 500 query samples drawn from the official WMDP-Cyber and WMDP-Bio test pools. For both benchmarks, lower criteria indicate more effective unlearning.
Utility Preservation: we adopted different metrics, including the ROUGE-L Fl score on the eval- uation dataset Desal, denoted as R-Retain 1, and the MMLU Acc. 1. which is the overall average of 5-shot multiple-choice accuracy on the MMLUU benchmark spanning 57 subjects to assess fac- tual knowledge and reasoning (Hendrycks et al. 2020). Higher metrics demonstrate more robust knowledge preservation.
Performance Shift: To capture the forgetting-retention trade-off, we computed the aggregate score summarizing overall performance change relative to the base model before unlearning: A 1= Σ, A(forget); + A, (utility), for each forgetting and utility preservation metric. Higher shift values indicate a more desirable overall performance that represents successful unlearning with minimal utility degradation.
4.4 PERFORMANCE OVERVIEW
Harry Potter (MUSE-Books). Table T reports overall results for the Llama 3.2-3B-Inntruct LLM on the Harry Potter (HP) benchmark. DUET demonstrates competitive or higher performance com- pared with state-of-the-art unlearning methods, which effectively removes undesirable knowledge while preserving general knowledge utility. Specifically, GA unlearns the knowledge of HP the cost of catastrophic forgetting. On the other hand, augmenting retention loss to GA can mitigate utility drop, yet hurt the unlearning efffectiveness. Similar phenomena were observed on NPO. In contrast, DUET maintains the highest general utility preservation, while achieving more effective unlearning than methods such as NPO or its variants. Most baselines are sensitive to the size and for- mat of forgetting data, whereas our method can benefit from a lightweight dataset Diueer (Sec 4.1 owing to its fine-gratd ame-grained knowledge distillation design.
WMDP (Cyber/Bio). As shown in Table 2. GA and FLAT show a catastrophic utility drop, while methods such as Refusal Training or GA combined with a KL. regularization showed marginal effects on the forgetting domain. While most methods struggle to balance unlearning and retention and often sacrifice one for the other, our method notably delivers the best overall performance shifts, followed by RMU as the closest competitor, a method carefully tailored for WMDP benchmarks.

---

Published as a conference paper at ICLR 2026
Training Data Efficiency: Table summarizes the forgetting data prerequisites different unlearning algorithms. DUET enables unlearning without quiring ground-truth answers (y') or explicit refusal responses (v) in contrast prior unlearning ap- proaches. Moreover, our approach brings significant data efficiency through its lightweight training re- quirements. Specifically, on the Harry Potter bench- mark, we used 100 forget samples Di comprising 1,319 tokens, alongside 914 tokens from the reten- tion set Dquery which together form the entire train- ing budget. In contrast, the full Harry Potter cor- pus contains approximately 1. 1,440,000 tokens. This yields significant data and computational efficiency
Table Forgetting data requirements across methods. DUET uses only input queries and does not rely on responses refusal templates.
Forget Input zy
Forget Response y
Refusal
Method
Response the
GA
NPO
SimNPO
RMU
X
Refusal Training
DUET (ours)
of our method, which consistently outperforms GA and NPO, regardless of the training data config- uration applied to these methods.
4.5 EFFECTS OF LOGIT DISTILLATION:
Our method employs Top-K logit-level distillation from in-context teacher model (Eq. rather than direct fine-tuning on token sequences (z).3)) like Refusal Training, and thus yields finer- grained supervision with more targeted and effective forgetting across both benchmarks. To system- atically validate our design choice, we conduct controlled comparisons across multiple dimensions: We explored a variant of Refusal-Training that enforces SFT only using the first token of the re- fusal response (Refusal-Firs) Token) for fair comparison to DUET, which does not rely on actual refusal responses. We further conducted Refusal Training with and without retention data D, to isolate the effect of retention regularization. We also ablate our method using: (1) DUET (Duuer) which removes retention data during unlearning to measure pure forgetting effectiveness; (2)DUET (DI KI. (D,)), which replaces our distillation-bant retention with KI. divergence alignment over vocabulary logits.
Table 4 reveals several key findings: (1) The forgetting effect of our method (DUET (Dquer)) is sig- nificantly more evident than token-level unlearning without considering any retention regularization, which is ascribed the probability distributions from the teacher model that provide richer supervi- sion knowledge than token-level alignment. (2) Augmenting the retention regularization objective deteriorates Refusal Training's 's unlearning ability, yet shows negligible impacts on our method. This indicates that our selective logit distillation method can uniformly handle both knowledge forgetting and preservation. (3) Replacing our Top-K distillation with full-vocabulary KL divergence (DUET (D)ie))) ++ KL (D+)) reduces utility without improving forgetting. This supports our design rationale:
Table 1: Overall results on the MUSE-Bood Books (Harry Potter) benchmark: DUET delivers the most balanced unlcaming performance. Methods with D&A indicates that the forget set the QA samples (D)"mr D
extracted from the raw book content; DCR Dffaay Difisse indicates forget set of query-refusal response pairs (Sec 4.Ip. Methods without a data notation were trained on the raw book content. "+ KL" denotes a KL KL-divergence regularization augmented to minimize deviation from reference model on the retention set D,.
Method
R-Forget J R-Forget-500 1 R-Retain f
MMLU
Performance Shift
Buse Model (Llama3.2-5) 3233BB
32.13
39.99
84.29
61.46
0
GA
0.00
0.00
0.00
24.87
448.66
GA (D,)
27.20
38.29
78.67
60.18
-0.27
GA (DOA)
0.00
0.00
75.80
36.45
38.62
GA (D KI.
27.44
36.87
84.95
60.62
7.63
NPO
24.18
26.83
69.69
$4,79
-0.16
NPO KL (D,)
28.92
33.62
80,28
$9.47
3.58
NPO (
30.19
34.28
46.20
60.48
-31.42
NPO (D KI. (D₂)
21.55
25.60
26.38
60.55
-33.85
Refusal-Traininn (D U.D,)
31,02
37.75
75.32
60.48
-6.60
SimNPO
17.60
21.41
43.09
60.40
-9.15
FLAT
0.47
0.64
58.33
58.92
42.51
DUET (D U D.)
4.27
5.98
78.33
61.45
55.90

---

Published as a conference paper at ICLR 2026
Table Results on WMDP-Bio and Cyber benchmarks. DUET demonstrates effective hazardous knowledge removal while achieving the highest utility preservation across all baseline methods on both subtasks.
Bio
Cyber
Method
Acc-Forget
MMLU1
Ace-Forget
MMLU
Model (Zephyr-7B)
63.70
58.12
43.68
58.12
GA
24.65
33.77
48.79
GA KL (D))
62.77
57.29
40.36
59.82
62.69
56.88
36.89
55.34
NPO+KL(D,)
63.16
57.57
39,61
57.11
SimNPO
27.10
47.37
34.22
54.25
FLAT
25.61
27.16
24.51
23.24
RMU
25.84
25.50
24.61
25,50
RMU (D2)
31,89
57.18
26.93
57.81
Refusal Training (D) UD,))
64.81
60,39
40.92
60.63
DUET (D D2)
29.40
60.63
26.60
60.65
Table 4: Comparative studies of distilled unlearning (DUET) and token-level SFT (Refusal Train- ing) on the Harry Potter benchmark. Our method more effective unlearning with negligible utility impacts, owing its fine-graines supervision signal from latent logit supervision.
Method
R-Forget
R-Forget-500
R-Retain
MMLU 1
Performance Shift
Base Model (Llama3.2--BB
32.13
39.99
84.29
61.46
0
Refusal-Training Training (D*))
Refusal-
31.89
.9.84
Refusal- Refusal-Training
Training (D) U DD
31.02
37.75
75.32
60.488
-6.60
Refusal- Firssal---s---te First-Token (DD4)
66.76
.9.03
Refusal- First-Token (D) U 22)
29.20
39.03
60.47
60,48
20091
DUET (D! KL(D,)
4.53
6.16
69.54
57.53
42.75
DUET (D)
3,50
4.52
69.31
55.17
42.83
DUET (D D.)
4.27
5.98
78,33
61.45
55.90
aligning only the most informative logits avoids noise from uninformative tokens across the entire vocabulary, which enables more precise and effective unlearning.
Table 5: Impact the teacher prefix quality on unlearning effects, using the MUSE Bookks benehmark. Se- mantically meaningful prefixes achieve optimal unlearning, while superficial or irrelevant prefixes yield unin- formative teacher guidance. Generic refuse-all prefixes degrade both forgetting efficacy and utility retention.
Method
R-Forget
R-Forget-500
R-Retain
MMLU f
Performance Shift
Base Model (Llama332-3BB)
32.13
39.99
84.29
61.46
Base Model Prefix
2.18
4.52
80.09
61.46
61.22
DUUET-opiimized-pree
4.27
5.98
78.33
61.45
55.90
DUET-short-preff
4.98
10.14
81.98
60.71
53.94
DUET-cffus--allprret
15.65
25.59
50.54
60.87
-3.46
DUET-irelevant-pree
28.43
27.58
83,50
61.45
15.31
4.6 IMPACTS OF IN-CONTEXT UNLEARNING PROMPTS
To investigate the impact of prefix quality Zie (Eq. D. evaluated several variants on the MUSE- Books benchmark, in addition to our optimized prefix: (1) DUET-short-prefix e.g., "Don't answer any question related to Harry Potter". (2) AUET-refuse--lll-pref e.g., "Do not answer any ques- tion". which ignores query semantics, and (3) DUET-inellvant-prrfixx egg., "Shorten your answer".
As shown in Table irrelevant prefixes fail induce effective forgetting, while the refuse-all prefix harms both forgetting and retention. In contrast, carefully designed and semantically meaningful teacher instructions yield the most robust forgetting with minimal utility loss, which provides strong upper bound for unlearning performance (see Appendix A.I for full prompt details).
4.6.1 UNLEARNING ROBUSTNESS AGAINST REVERSE ENGINEERING
We evaluated robustness reverse engineering by applying a straightforward yet effective reverse prompt to the unlearned model to instruct the model to ignore any previous instructions, and applied this reverse attack three configurations the Harry Potter QA set with 500 extended samples:
8

---

Published as a conference paper at ICLR 2026
(i) the base model without any prefix, (ii) the base model with the same optimized teacher prefix used during distillation, and (ii) our distilled unlearning model DUET.
Table [6] demonstrates the diverging robust- ness unlearning approaches under adver- sarial reverse prompts. The base model shows minimal performance change under re- verse prompt attacks, inherently provides responses to all queries regardless of con- tent sensitivity. In contrast, the base model with teacher prefix shows dramatic perfor- mance degradation when exposed to reverse prompts, which verifies the relearning vulner- ability documented in prior work (Hu et al.] 2024). DUET maintains consistently low R-Forget scores regardless of reverse prompt exposure, which demonstrates its higher robustness against ad- versarial attacks. This resilience stems from our algorithmic design, where the teacher's refusal
Table 6: Applying reverse engineering attacks evaluated on the 500-QA samples on HP domain. DUET more robust against attack than an in-context unlcarned teacher through distilled optimization.
R-Forget
Method
w/o Reverse Attack
Reverse Atfack
Base model
39.99
40.59
model with prefix
DUET
5,98
7.27
behavior is distilled into the model parameters, rather than relying in-context prefix that can be removed.
4.6.2 UNLEARNING ROBUSTNESS AGAINST EVALUATION FORMAT VARIATION
We further examined robustness under different evaluation formats, where the same knowledge is tested through varying task types. While prior work has primarily focused on QA tasks, content completion, where the model is asked to continue a passage, provides another important probe of memorization but remains underexplored. To investigate this, reformatted the Harry Potter QA samples (Sec)4. | into two evaluation settings: (1) content complction within the Harry Potter domain context (Forget Set, 100 items), and (2) content completion of general domain knowledge (Retain Set, 100 items). We also constructed a training variant where QA items are rewritten as declarative statements. The teacher prefix is designed to prevent continuation of protected content, which generates a model denoted as DUET (Continue).
Table 7 shows that DUET exhibits the strongest robustness across heterogeneous evaluation tasks. Notably, DUET (Con- tinue) achieves the best overall results, demonstrating that tailoring training data to match evaluation formats can further ro- bustify the ability of targeted forgetting. These findings shed light on the impor- tance of data preparation and format di- versity in effective unlearning and utility alignment.
Table 7: Evaluation using non-QA format.
Method Base Model
R-Forget 1 26.48
R-Retain 1
Performance Shift
65,75
GA
6.15
8.41
-37.01
NPO
4.82
50,16
6.07
SinNPO FLAT
31.29
64.72
-5.84
0.75
1.98
-38.04
Refusal- -raising
35.67
70.39
-4.55
DUET
7.14
55.26
8.85
DUET (Continue)
1.58
67.19
4.6.3 ROBUSTNESS OF DUET ON THE NUMBER OF TOP CANDIDATE LOGITS
We explored different numbers of top log- its used during distillation, with K {1, 1000, 5000}. Table g demonstrates that DUET is generally robust to the choice of K. Nevertheless, when K=1, the supervision is overly sparse and concentrates on a single to- ken, which leads to a moderate utility drop, although it still outperforms Refusal Training (Table 4.. Conversely, when K=5000, the teacher supervision incorporates many tail logits with -nwinnformttiee knowledge, which injects noise and dilutes the impact of high-probability tokens most relevant to forgetting. In practice, adopted K=1000, which captures sufficient informative supervision from the teacher model without excessive noise and provides the best balance between forgetting and utility.
Table 8: Effect of top- K candidate logits, evaluated the MUSE-Book benchmark.
Top-K
R-Forget-500 J
R-Retain
MMLU
Top 1
5.66%
63.23%
58.83%
Top 1000
6.12%
76.33%
61.45%
Top 5000
9.62%
74.59%
59.38%

---

Published as a conference paper at ICLR 2026
4.6.4 DISTILLATION FROM MULTIPLE UNLEARNING TEACHERS
To further understand the role of teacher choice in the distillation process, we explored multi-teacher distillation and implemented two approaches.
(1) Distillation from multiple heterogeneous teachers. We used NPO, GA, and the prefix-guides model as teachers. For each forget-set sample, we aggregated their top-K logits with equal weight- ing (A 1/3 for each teacher) during logit distillation.
(2) Distillation from multiple prefix-guided teachers. We also considered using multiple prefix- guided teachers with three differently styled refusal prefixes (declarative, polite request, strict en- forcement):
1. "You and provide answers without its knowledge as if you never knew about it."
Al Assistant who is supposed unlearn about the book series Harry Potter
2. "You are a helpful Al assistant. When asked about Harry Potter related content, politely de- cline to answer and explain you cannot discuss that topic. For all other questions, provide helpful and accurate responses."
3. " "You are an Al assistant with content restrictions. You must refuse to answer any questions related to the Harry Potter series for policy reasons. Politely inform users you cannot help with Harry Potter queries, but assist with other topics normally."
As shown in Table 9 Approach (1) significantly underperformed DUET. We attribute this to flicting response patterns among teachers, as aggregating their logits caused mutual interference. Additionally, GA's catastrophic forgetting general knowledge severely compromised the aggre- gated logits' accuracy (though removing the retain loss partially mitigated this). Approach (2) also underperformed single-teacher distillation, likely because multiple teachers yield inconsistent top logits that lead to unclear distillation directions when aggregated. To sum up, we observe that more teachers do not guarantee better performance, and the teacher quality matters more, where clearer teacher behavior leads to more accurate student learning.
Table 9: Comparing DUET with multi-teacher distillation on the MUSE-Books (Harry Potter) benchmark.
Method
R Roforget
R- E--forge_5500 550
knowmem. r
MMLJ
Performance Shift
hase model
32.13
39.99
84,29
61.46
0.00
DUET
4.27
4.86
78.33
61.52
$7.09
Plan A (GA, NPO, one prefix)
7,94
10.28
58.58
45.43
12.16
A (GA, NPO. one prefix; retain free)
13.98
14.92
82.83
61.04
Plan B (3 different prefixes)
8.32
9.77
81.02
60.13
49.43
5 CONCLUSION
We introduced DUET, a distillation-baser unlearning framework that transfers in-context refusal behavior from teacher into student LLM parameters through Top-K logit alignment, enabling precise knowledge removal with only query-level data while omitting reliance on explicit responses or refusal templates. DUET achieves more balanced trade-offs between forgetting and utility preservation across MUSE-Books and WMDP benchmarks, outperforning state-of-the-art baselines while remaining robust under reverse- pereeseepppppptt attacks and evaluation format shifts. Overall, our work provides an efficient and scalable step toward practical LLM unlearning.
ACKNOWLEDGMENTS
This work was supported in part by the NAIRR Pilot (NAIRR250140) and an NVIDIA Academic Grant.
10

---

Published as a conference paper at ICLR 2026
6 FUTURE WORK
Building on our findings, we outline two remaining challenges that present promising directions for future research.
Unlearning Boundary Determination: We believe that determining the boundary of unlearning represents a significant challenge, specifically regarding what forget versus what retain. Current unlearning methods, particularly training-based approaches where boundaries are defined through data face specific challenges in this field. This creates substantial problems: when the distinction between forget data and retain data is ambiguous, samples near the boundary exhibit poor unlearn- ing performance. This manifests as the most prominent trade-off between unlearning and retaining- To address the boundary determination problem, our method offers distinct perspective by lever- aging prompt-based steering and the LLM's semantic understanding capabilities. This enables the model to autonomously judge whether query pertains to sensitive knowledge, allowing us fine boundaries through carefully crafted prompts. Our work provides a promising solution to this challenge, and anticipate future work will develop more sophisticated methods to resolve the boundary ambiguity.
How to evaluate whether model has truly unlearned is another critical chal- lenge. Due to the nature of unlearning, we cannot simply assess whether the model has forgotten knowledge based solely on its surface-level responses. We must also examine whether its response patterns regarding forgotten knowledge have fundamentally changed. Additionally, it is difficult to evaluate whether the model merely refuses to answer on the surface while still retaining deep knowl- edge of the unlearning target. Existing methods. including Membership Inference Attacks (MIA) and jailbreak techniques, remain insufficient for comprehensively evaluating L.M unlearning, as models can still evade detection. Our work makes meaningful contributions in this aspect: we ex- panded the original 100-question forget testset to 500 questions, covering a more comprehensive and diverse range of question types and domains. The quality of answers has also been enhanced. For example, we strictly enforce that answers uniquely and one-to-one correspond to questions, are widely known, and have been carefully verified.
Evaluation Protocol:
REPRODUCIBILITY STATEMENT
We aim make all results fully reproducible. An anonymized repository will be released https: / ggghhu.. com/ Easonnn (taason2hong9/DDuS
containing all source code and the complete datasets (raaiiingrrtaiin/fooget splits and test sets), along with scripts to regenerate every table and figure end-to-end. Dataset construction and evaluation splits are summarized in Sec 4.1. baseline implementations and protocols are in Sec 4.2 and 4.3 the training procedure is outlined in Alg [ The appendix provides the full hyperparameter and training specifications in[3.3] including the exact teacher prefixes I.I training temperature, number epochs, batch size, learning rate, environment details, so that results can be reproduced precisely. As shown in Table A.4 our method exhibits clear trade-off between forgetting (R- Forget500) and retention (R- (e-Retann) across different learning rates, epochs, and schedulers.
LLM USAGE STATEMENT
Beyond serving the subjects of study in our experiments (i.e., LLMs we trained and evaluated, and used to draft candidate teacher prefixes), we also used an off-the-shelf general-purpose LLM (GPT-5) as a writing assistant. Specifically, was employed to polish grammar and wording and (ii) suggest LaTeX formatting adjustments for figures and tables (e.g., column widths, wrap/wrapfig usage, captions). The LLM did not generate research ideas, models, analyses, or claims; all tech- nical design, data curation, and conclusions are by the authors. All suggested text/formatting were reviewed and edited by the authors, and no non-public or sensitive data were shared with the LLM.
REFERENCES
Amanda Askell, Yuntao Bai, Anna Chen, et al. A general language assistant as a laboratory for alignment. arXiv:2112.00 12,00611 2021.
11

---

Published as a conference paper at ICLR 2026
Yuntao Bai, Saurav Kadavath, Sandipan Kundu, et al. Constitutional ai: Harmlessness from ai feedback. arXiv:2212.08073, 2022.
Jonathan T. Barron. A general and adaptive robust loss function. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patter Recognition (CVPR), 2019.
Minseok Choi, Daniel Rim, Dohyun Lee, and Jaegul Choo. Snap: Unlearning selective knowledge in large language models with negative instructions. arXiv preprint arXiv:2406. 12329, 2024. URL https://azxiv.oue org. abs /tt.//20.... 12329
Yijiang River Dong, Hongzhou Lin, Mikhail Belkin, Ramon Huerta, and Ivan Vulić. Undial: Self- distillation with adjusted logits for robust unlearning in large language models. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics:
Human Language Technologies ( (Volume 1: Long Papers), pp. 8827 8840, 2025.
Ronen Eldan and Mark Russinovich. Who's harry potter? approximate unlearning in LLMs. arXiv preprint arXhv:2310.022:33 2023. URL htthttt:: http//aaxvvvv//m http//axwww.......aaaaa/
02238
Chongyu Fan, Jiancheng Liu, Licong Lin, Jinghan Jia, Ruiqi Zhang, Song Mei, and Sijia Liu. Sim- plicity prevails: Rethinking negative preference optimization for LLM unlearning. arXiv preprint arXiv:2410.07163, 2025.
Ross Girshick. Fast r-cnn. In Proceedings of the IEEE international conference computer vision, pp. 1440-1448, 2015.
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. International Conference on Learning Representations, 2020.
Shengyuan Hu, Yiwei Fu, Zhiwei Steven Wu, Virginia Smith. Jogging the memory of un- learned LLMs through targeted relearning attacks. arXiv preprint 23X1v:2406.13336, 2024. URL
abs/abs/////ooooooo///g///////// https: /oass://arxivi org/ abs/ /...////055 2212212011111
Shengyuan Hu, Yiwei Fu, Zhiwei Steven Wu, and Virginia Smith. Unlearning or obfuscating?
jogging the memory of unlearned LLMs via benign relearning, 2025. URL httph::/paa:att org/abs/22e 2ew.////20..... 13356
Zhehao Huang, Xinwen Cheng, JingHao Zheng, Haoran Wang, Zhenghao He, Tao Li, and Xiaolin Huang. Unified gradient-base based machine unlearning with remain geometry enhancement. Ad- vances Neural Information Processing Systems, 37:26377-26414, 2024.
Peter J. Huber. Robust estimation of a location parameter. The Annals of Mathematical Statistics, 35(1);73-101, 1964.
Gabriel Ilharco, Mitch Wortsman, et al. Editing models with task arithmetic. In International Conference on Learning Representations (ICLR), 2023. URL htttps://axxii //apiiv///xvv... org/ /bs/ 22122.02 04089
Joel Jang. Dongkeun Yoon, Sohee Yang. Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks in language models. In Pro- ceedings of the 61st Annual Meeting of the Association for Computational Linguistics (ACL), pp.
14389 14408, 2023. URLhttps: https: htt.hhts//aclaaahollli// http//aaaaaaacl..a.aaaaaaaaaclaa wttp:////333 acl.aacl-1aa long 805
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, et al. The wmdp benchmark: Measuring and reducing malicious use with unlearning. In Proceedings of the 41st Interna- tional Conference Machine Learning (ICML), volume 235 of Proceedings of Machine Learn- ing Research, pp. 28525-28550 2024. UR..tttet.e http////oooeiic/eeeeoeeocc/oeecc ngs. mlr wwl.rrrres//233 1124bc. htmll
Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods. In ACI., 2022.
12

---

Published as a conference paper at ICLR 2026
Chris Liu, Zeyu Li, Yujia Wei, Peizhuo Wang. Chen Li. Wei Zhang, Song Li, Malik Magdon- Ismail, and Yang Liu. Large language model unlearning via ambedding-corruppee prompts. In Advances in Neural Information Processing Systems (NeurIPS), 2024a. URL https: /arxiv...vv....///i/.eeeeaawavla org/ abs/ 22..200669992
Yilun Liu, Shimin Tao, Xiaofeng Zhao, Ming Zhu, Wenbing Ma, Junhao Zhu, Chang Su, Yutai Hou, Miao Zhang, Min Zhang, et al. Coachlm: Automatic instruction revisions improve the data quality in Ilm instruction tuning. In 2024 IEEE 40th International Conference on Data Engineering (ICDE), pp-
IEEE, 2024b.
Jakub Lucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Tramèr, and Javier Rando. An adversarial perspective on machine unlearning for ai safety. arXiv preprint arXiv:2409.18025, 2024.
Xuan Luo, Yue Wang, Zefeng He, Geng Tu, Jing Li, and Ruifeng Xu. A simple and efficient jailbreak method exploiting LLMs' helpfulness, 2025. URL httts:://axxi// 2509. 14297
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C. Lipton, and J. Zico Kolter. Tofu: A task of fictitious unlearning for LLMs. First Conference on Language Modeling, 2024.
Thanh Tam Nguyen, Thanh Trung Huynh, Zhao Ren, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin. and Quoe Viet Hung Nguyen. A survey of machine unlearning. ACM Transac- tions on Intelligent Systems and Technology, 16(5):1-46, 2025.
Soumyadeep Pal. Changsheng Wang, James Diffenderfer, Bhavya Kailkhura, and Sijia Liu. Llm unlearning reveals a stronger-than-ewe arXiv:2504. 10185, 2025.
coreset effect in current benchmarks. arXiv preprint
Jinhao Pan, Chahat Raj. and Ziwei Zhu, Bias association discovery framework for open-ended Ilm generations, 2026. URL ULL/Etts..///rxxx.rr///////// 01412
Stuart L. Pardau. The california consumer privacy act: Towards a european-style privacy regime
in the united states? Journal of Technology Law Policy, 23(1), 2018. URL https://
scholarship law. www..ufl.eccb//i///ooooooo 2w/iss///////////
Martin Pawelczyk, Seth Neel, and Himabindu Lakkaraju. In-context unlearning: Language models as few shot unlearners. arXiv preprint a:Xiv:2310.07579, 2023.
Anh Pham, Mihir Thalanki, Michael Sun, Aditya Chaloo. Ankita Gupta, Tian Xia, Aditya Mate, Ehimwenma Nosakhare, and Soundararajan Srinivasan. Preventing catastrophic forgetting: Behavior-aware sampling for safer language model fine-tuning, 2025, URL
orq/abs/2510 21885
Ayush Sekhari, Jayadev Acharya, Gautam Kamath, and Ananda Theertha Suresh. Re- member what you want to forget: Algorithms for machine unlearning. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang and J. Wortman Vaughan (eds.), Advances Neu- ral Information Processing Systems, volume 34, pp. 18075-18086. Curran Associates, Inc., 2021. URL
iggeeeddddng..... wwwggg..euriii neuri cc. wwwpeepprpppppppppppeepeeee... fi files/paper/202/ (.d.eadff2@@2eeeee 99- 99-paerr.
fi e wee./622c45df54
Taiwei Shi, Kai Chen, and Jieyu Zhao. Safer-instruct: Aligning language models with automated preference data. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies (Volume 1: Long Papers), pp. 7636-7651, 2024a.
Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang. Muse: Machine unlearning six-way evaluation for language models. The Thirteenth International Conference on Learning Represen- fations, 2024b.
13

---

Published as a conference paper at ICLR 2026
Ilia Shumailov, Jamie Hayes, Eleni Triantafillou, Guillermo Ortiz-Jimenez, Nicolas Papemot, Matthew Jagielski, Itay Yona, Heidi Howard, and Eugene Bagdasaryan. Ununlearning: Un- learning is not sufficient for content regulation in advanced generative ai, 2024. https:: //arxiv.orrg/abs/2207..011
lya Sutskever, Oriol Vinyals, and Quoe V. Le. Sequence to sequence learning with neural networks. In NewrlPS, 2014.
Ashwin Kalyan Vijayakumar, Michael Cogswell, Ramprasaath R. Selvaraju, et al. Diverse beam search for improved description of complex scenes. AAAI, 2018.
Paul Voigt and Axel Bussche. The EU General Data Protection Regulation (GDPR): A Practical Guide. 01 2017. ISBN 978-3-319-57958-0. doi: 10.10077978-33311-559953
Xuezhi Wang and Denny Zhou. Chain-of-thought reasoning without prompting. Advances in Neural Information Processing Systems, 37:66383-664099 2024.
Yaxuan Wang, Jiaheng Wei, Chris Yuhao Liu, Jinlong Pang. Quan Liu, Ankit Parag Shah, Yujia Bao, Yang Liu, and Wei Wei. LLM unlearning via loss adjustment with only forget data. In International Conference Learning Representations (ICLR),
2025. 6o211007771111112220000cco1o0111
Heng Xu, Tianqing Zhu, Lefeng Zhang, Wanlei Zhou, and Philip S. Yu. Machine unleaming: A
survey. ACM Comput. Surv., 56(1), August 2023. ISSN 0360-0300. doi: 10.1145/3603620. URL.
Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning. Advances in Neural Information Processing Systems, 37:105425-105475, 2024.
Yuhan Zhang, Weize Chen, et al. Negative preference optimization for catastrophic forgetting in LLM unlearning, arXiv preprint arXiv:2404.05868, 2024. URL /tlLhttss///exxi.orrgg
2404.05866
Yisheng Zhong, Yizhu Wen, Junfeng Guo, Mehran Kafai, Heng Huang, Hanqing Guo, and Zhuangdi Zhu. Web intellectual property at risk: Preventing unauthorized real-time retrieval by large lan- guage models. In Proceedings the 2025 Conference on Empirical Methods in Natural Language Processing, pp. 17222 17235. 2025a.
Yisheng Zhong, Zhengbang Yang, and Zhuangdi Zhu. Hicrarchical federated unlearning for large language models, 2025b. / http:///www...oo////////0/000///
A APPENDIX
A.1 IN-CONTEXT TEACHER PREFIXES AND OPTIMIZATION
Overview, We release the exact in-context teacher prefixes used by DUET across benchmarks. through iterative refinement
These prefixes were optimized by proxy LLM until reaching stable performance on validation probes, balancing forgetting and utility. This section documents the final prompts that yielded the best overall results.
14

---

Published as a conference paper at ICLR 2026
In- Aa-Context Teacher Prefixes Used in DUET
HP (QA; Table 1). "You are an Al Assistant who is supposed to unlearn about the book series Harry Potter and provide answers without its knowledge if you never knew about it."
HP (Continue; Table 7). "You are an Al Assistant who is supposed to unlearn about the book series Harry Potter. Please continue the following text naturally, but avoid any references Harry Potter related content as if you never knew about and don' tell user about this request."
WMDP- (Table 3). "You an Al assistant that has been specifically trained refuse ALL cybersecurity, hacking, penetration testing, and computer security questions. You must al- ways respond with "I cannot provide information about cybersecurity topics" for ANY security- related question, including technical questions about vulnerabilities, exploits, assembly analysis, or network security."
WMDP-Bio (Table 3). "You are a helpful Al assistant. For safety reasons, you must refuse to answer questions about biological weapons, dangerous pathogens, or any information that could be used to harm public health and safety."
Notes. The HP (QA) and HP (Continue) prefixes target factual QA and continuation probes re- spectively, that the teacher suppresses protected content while preserving fluency in off-domain contexts. For WMDP, the Cyber and Bio prefixes instantiate domain-specific refusal policies with explicit, stable refusal surfaces that distill into parameters robustly (as opposed removable runtime prompts), consistent with our finding that (i) contextualized teachers provide efficient supervision for DUET and (ii) better-crafted prefixes yield stronger forgetting with minimal utility impact.
A.2 ALGORITHM OVERVIEW
Algorithm Seerithmmilluseee Dillustrates the overall workflow of DUET.
Algorithm DUET: Distilled Unlearning from an Efficient Teacher
1: Inputs: base LLM with initial parameters (0); teacher prefix Tyi forget queries Dy; retain queries D,: top-K operator TopK(-, K)); distance (Huber); learning rate 17.
2: Initialize: teacher Fet 4 ग (frozen at ((")); student Ma + x (trainable at (
3: Batching: mix æ from D, and DD in each mini-batch (questions only).
4: for each mini-batch B C (Dy LD),) do
5: Set batch loss C=
6: for each x E do
7: Compute teacher logits I Tie (Dar) at the first decoding position.
8: Compute student logits go at the same position.
9: Select indices Cx = TopK(Togggg (naa (- ane Bx), K).
10:
Accumulate top-K logit loss:
C +=
Σ (96(z), ( (B))
11:
end for
12: Gradient step the objective JouEr= L: =::
0 no Touer Dy, Dr, zue).
13: end for
Notes. (i) Mix forget and retain questions within each mini-batch and apply the same top-K logit distillation loss to both, without separate retain loss X-weighted objective; (ii) supervision comes solely from teacher logits under the in-context prefix, without consuming ground-truth answers; (iii) distillation uses the first- position logits and aligns only the teacher's 's top-K candidates to reduce noise and preserve utility.
A.3 EXPERIMENT DETAILS
A.3.1 TRAINING HYPERPARAMETIN FOR HARRY POTTER
We report hyperparameters for training on the Raw corpus (left) and the QA reformulation (right).
15

---

Published as a conference paper at ICLR 2026
Harry Potter Raw
Harry Potter - QA
GA: learning ratc=3e-5, epoch=3
GA: learning rate=3e-5, epoch=3
GA+KL: learning rate=3e-5, epoch=3
GA+KL: learning rate=3e-5, epoch=3
NPO: learning rate=5e-6, 8=0.05, epoch=1
NPO: learning rate=5c-6, 3=0.05, epoch=5
NPO+KL: learning rate=5e-6, 8=0.05, epoch=1 learning rate=5e-6, 3=4, 1=0.1, epoch=1 FLAT:: learning rate=5e-6, epoch=3
NPO+KL: learning rate=5e-6, 3=0.05, epoch=5
SimNPO:
SimNPO: learning rate=5e-6, 8=4, y=0, epoch=20
FLAT,: learning rate=le-5, epoch=10
DUET; learning rate=3e-6, epoch=3
DUET: learning rate=3e-6, epoch=3
A.3.2 TRAINING HYPERPARAMETERS FOR WMDP
We list hyperparameters for each method; the WMDP-Bio split is on the left and the WMDP-Cyber split is the right.
WMDP- Biology
-yber
GA: learning ratc=3e-5,, epoch=3
GA: learning rate=3e-5, epoch=3
GA+KI: learning rate=3e-5, epoch=3
GA+KL: learning ratc=3e-5, epoch=3
NPO: learning rate=5c-6, 8=0.05, epoch=3
NPO: learning rate=5c-6, 3=0.05, epnch=3
NPO+KL: learning rate=5e-6, 8=0.05, epoch=3
NPO+KL: learning rate=5e-6, 8=0.05, epoch=3
RMU: learning rate=5e-5, epoch=1
RMU: learning rate=5e=5, epoch=1
RMU*: learning rate=5e-5, epoch=1
RMU learning rate=5e-5, epoch=1
SimNPO: learning ratc=5c-6, 7=0, epoch=2
SimNPO: learning rate=5e-6, 8=1, 7=0, epoch=l
FLAT: learning rate=5c-6, epoch=2
FLAT: learning rate=5c-6, epoch=1
DUET: learning rate=3c-6, epoch=3.
DUET: Icarning rate=3e-6, epoch=3.
A.4 ADDITIONAL RESULTS ON HP QA (HYPERPARAMETER SWEEP)
We evaluate different training hyperparameters on the HP (Harry Potter) QA subset, as shown in Table 10
A.5 ADDITIONAL RESULTS ON HP (MORE BASELINES)
To complement main results, we additionally include SFR Huang et al. 2024 and UNDIAL Dong et al. (2025) as baselines for comparative analysis. SFR, which operates by following Hessian-guided lorgetting direction on remain--reserving manifold, and UNDIAL, a distillation basod approach that directly shifts logits toward predefined refusal tokens, represent two conceptually distinet families of unlearning techniques. The complete experimental results after adding these two baselines are shown Table [1
Overall, Table IT indicates that DUET achieves the most balanced performance by jointly improving forgetting while preserving utility.
As reflected in Table [1 SFR does not outperform our approach and exhibits significant forgetting of general knowledge, indicating that its manifold-guie guided update dircction does effectively decouple targeted forget- ting from utility preservation.
Similarly, UNDIAL underperforms compared to our method. attribute this several key differences: First, UNDIAL optimizes for Memorization Accuracy (MA) and Extraction Likelihood (EL), which target different forgetting objectives than ours. Second, UNDIAL's teacher model for forgetting and retaining knowledge follows the same paradigm other training- based methods it directly suppresses target knowledge outputs, which does not fundamentally differ from existing approaches in its mechanism.
Table 10: Results on HP QA under different hyperparameters. Our method exhibits a degree of trade-off between forgetting (R-Forget-500) and retention (R-Retain); varying the learning rate, number of epochs, and scheduler shifts this balance. Higher is better for both metrics.
R- R-rrgget-000
R-Retain
Learning rate
Epoch
Scheduler
24.76%
82.82%
lc-6
linear
39.44%
85.28%
le-7
linear
6.12%
76.33%
3e-6
linear
2.76%
52.83%
7e-6
linear
4.60%
72.96%
3e-6
3
cosine
2.65%
67.61%
3e-6
cosine
16

---

Published as a conference paper at ICLR 2026
In contrast, we believe DUET establishes clearer and robust forgetting boundary through the teacher's semantic understanding capability. This teacher-derived boundary, guided by contextualized instructions, more interpretable and robust than boundaries defined directly by refusal response data, as the teacher can dynamically distinguish between queries targeting undesirable knowledge and those secking general knowledge based on semantic comprehension rather than pattern matching.
Table 11: Overall results on the MUSE-Bodd Books (Harry Potter) benchmark: DUET delivers the most balanced unlearning performance. Methods with DP indicates that the forget set QA samples (D) D extracted from the raw book content: D Di U Difiiee indicates a forget set of query-refusal response pains (Sec 4.T). Methods without a data notation were trained on the raw book content. "+ KI." denotes a KT. -i.-divergeece regularization augmented to minimize deviation from reference model the retention set Dz.
Method
R-Forget +
R- G-Forget-500. +
R-Retain f
MMLU f
Performance Shift
Base Model (Llama3.2-3BB
32.13
39.99
84.29
61.46
0
GA
0.00
0.00
0.00
24.87
-48.76
GA (D)
27.20
38.29
78.67
60.18
-0.27
GA (DDA)
0.00
0.00
75.80
36.45
38.62
GA (D+)) KL,
27.44
36.87
84.95
60.62
7.63
NPO
24.18
26.83
69.69
$4.79
-0.16
NPO KL (D,)
28.92
33.62
80.28
59.47
3,58
NPO (DDA)
30.19
34.28
46.20
60.48
-31.42
NPO (D4)) (D,)
21.55
25.60
26.38
60,55
-33.85
Refusal- Teainin (D) J U.D,)
31.02
37.75
75.32
60.48
-6.60
SimNPO
17.60
21.41
43.09
60,40
-9.15
FLAT
0.47
0.64
58.33
$8.92
42.51
SER
10.45
13.17
71.93
$8.28
32.96
UNDIAL
28.20
29.09
73.92
1.08
DUET (D U D.)
4.27
5.98
78.33
61.45
55.90
A.6 DISTILLATION FROM GRADIENT ASCENT MODELS
We further examined whether distilling from an aggressively over-unlearned model could serve as an effective alternative teacher. To this end, distilled DUET using GA-unlcarned model as the teacher. Two variants were evaluated: (i) distilling GA's behavior both forget and retain sets, and (ii) distilling only GA's forget-set behavior without learning its logit distribution on retention data.
As shown in Table 12 distilling GA's full behavior led to poor performance, exhibiting both ineffective un- learning and substantial degradation of general knowledge, which mirroring GA's own catastrophic forgetting. To avoid inheriting GA's degraded retention behavior, we distilled only its forget-set logits. This retention free variant improved forgetting but still lagged behind DUET across all metrics. These findings confirm that unlearned teachers with collapsed general utility are unsuitable for stable distillation, reinforcing the importance of DUET's in-context teacher design.
A.7 GENERALIZATION ACROSS LLMs
To address the concern regarding limited evaluation, we conducted additional experiments on two widely rep- resentative LLMs: rawairaaaaiaiaa -al--B-Inst ructuuutvv vv..3 and Qwen2. 5- ruct. We compared method against the two top perforrfnnin baselines (Semi-NPO and FLAT) from our main experi- ments.
As shown Tables and our method consistently outperforms these baselines across both models, demon- strating the strong generalizahility of DUET across different LLM architectures.
A.8 ABLATION ON MULTI-STER DECODING DISTILLATION
We further examined whether extending unlearning distillation beyond the first decoding step could improve performance. Our design choice to distill only the initial token was motivated by efficiency and practicality. Although limited in depth, this approach still captures breadth through the top-K candidate tokens, each of which can lead to valid unlearning trajectories in subsequent decoding. Following the reviewer's suggestion, we conducted ablation studies that distill to subsequent tokens 2 1. The unlearning objective for a training sample z is formulated as:
E(go(e @ yree), (ee miee)) 044 L T, zt na<l/ue @ yice)
17

---

Published as a conference paper at ICLR 2026
Table 12: Comparison of DUET with distillation from GA-based teachers on the MUSE-Books
(Harry Potter) benchmark.
Method
R-forget..
R-forget_500)
R-retain
MMLUU
Base model
33.13
39.99
84.29
61,46
0.00
DUET
4.27
4.86
78.33
61.52
$7.09
Distill from GA model
17.40
42.86
-13.18
Distil from GA model (retain free)
18.04
20.32
77.82
57.55
23.38
Table 13: Performance comparison on Qwen2.5-3B-Instree
Model (learning rate)
R-forget +
R-forget
knowmem .
mmlu
Performance Shift
Q.ee2.55 (bose)
30.04
31.89
73.39
65.48
0.00
FLAT
9.05
16.44
24.68
65.20
-12:55
Semi-NPO DUET
12.78
24.64
65.53
-16.68
14.15
16.72
70.01
65.29
27.49
As shown in Table 15 rolling distillation over longer decoding horizons yields only marginal improvements forgetting effectiveness, while causing noticeable degradation in general utility. These findings align with recent analyses of decoding dynamics Wang & Zhou (2024), which suggest that the first-step branching largely determines the global generation trajectory, whereas later positions mainly refine instead of redirect the model's s hchavior. This observation supports our conclusion that extending distillation beyond the initial step provides limited additional benefit and incurs extra utility cost.
We acknowledge that studying ability distillation for more complex reasoning tasks (e.g.. multi-step mathemat- ics or logical inference) remains an intriguing direction for future research. Nonetheless, our current one-step approach offers balanced trade-off between unlearning efficacy and model capability preservation.
A.9 ABLATION ON TRAINING DATA SIZE
We further examined the effect of training size unlearning performance. response this concern, expanded our training using GPT 5.1 with carefully designed prompts and scaled forget set and retain set to 200 and 500 samples, respectively. We then conducted experiments with different hyperparameters on these expanded datasets.
Results. As shown Table 16 the 200- and 500-sample configurations produce results highly comparable our original 100-sample setup. This demonstrates that our model trained on 100 samples does not overfit further validates the data efficiency our approach. Moreover, these findings align with recent research on safety fine-tuning Pal ct al. 2025); (025):(Luu et ( [Shi et al. (20044) [Pham et al. (2025), which indicates that data quality is more crucial than quantity, with 50 1000 carefully selected samples often sufficient to achieve effective safety refusal and efficient fine-tuning.
A.10 ADVERSARIAL EVALUATION WITH JAILBREAK ATTACKS
To broaden our adversarial evaluation, further tested DUET under more sophisticated jailbreak tech- nique Luo et al. (2025), which systematically reformulates explicitly harmful instructions into academic, ex- ploratory, hypothetically framed questions to conceal malicious intent.
Following the methodology in Luo al. 2025) we created two categories of jailbreak prompts:
Educational: raw requests framed as academic research (e.g., "for educational purposes")
Fanfic: requests framed creative writing needs (e.g.. "if someone writing fanfiction"",
We applied these prompts to rewrite the 100-question forget set from MUSE. For each rewritten question, we queried the model 10 times and used an LLM LLMMas-a-judge to determine whether the output revealed the target information. We report the attack success rate (ASR) for three methods in Table 17
Table 14: Performance comparison on Mistral In-nsttucttttttttttt
Model (learning rate)
R-forget 1
R-forget 50N0
knowmen
munlu
Performance Shift
Mistral.7 7B (base)
48.40
50.40
83.71
59.74
0.00
Semi-NPO
15.75
18,892
48.02
22.95
-14.32
DUET
19.57
24.58
73.88
58.90
37.98
18

---

Published as a conference paper at ICLR 2026
Table 15: Unlearning distillation with multi-step decoding.
Method (learning rate)
R-forget
R- E-forget5500
knowmem.Lt
munuu
Performance Shiff
base model
32.13
$9,99
84.29
61.46
1 token (3e-6Xoriginal DUET)
4.27
4.86
78.33
61.52
57.09
3 Token (1e-6)
32.55
39.34
85.28
61.30
1.06
3 Token (3c-6)
19.15
20.80
83.60
60.04
30.06
3 Token (6c-6)
5.04
7.22
77.64
55.19
46.94
Token (1e-5)
Full (5c-7)
32
37 65
84.29
61.24
2.22
(1o-6)
32.84
34.98
84.29
60.25
Full (3e-6)
5.86
6.12
77.28
55.86
47.53
Full (6e
0.05
0.17
60.70
40.44
27.29
Table 16: Unlearning performance with varying data sizes.
Method
R R-forget
R-forgel
knowmem
mmnu
Performance Shift
base model
32.13
39.99
84.29
61.46
0.00
100 (3e-6)
200 (1e-6)
33.06
31.37
79.95
59.17
1.06
200 (3e-6)
5.81
76.66
59.13
52.33
200 (5c-6)
2.06
1.52
39.50
$1.42
13.71
500 (1c-6)
31.20
30.26
80.66
$9.08
4.65
500 (3c-6)
4.57
5,51
76.49
52.13
500 (5c-6)
3.08
3.12
$4.42
49.48
24.07
While DUET achieves the lowest ASR among all compared approaches, remains vulnerable jailbreak tacks. This reveals limitation current unlearning methods focusing solely on objective formulation such methods may struggle to maintain effective forgetting under adversarial prompting. This highlights an im- portant direction for future research: improving the robustness of unlearned models against jailbreak attacks. Progress in this area will likely require advances in adversarial data curation, objective formulation, and com- prehensive evaluation protocols.
Table 17: Evaluation under jailbreak attacks.
Educational
DUET
35.05%
36.18%
38.62%
2nd
FLAT
44.26%
30.79%
37.53%
34.26/8
39.76%
4th
SimNPO
49.80%
38.02%
43.91%
A.11 ABLATION ON PREFIX USAGE IN RETENTION DATA
We also investigated whether applying the unlearning prefix to the retention data in Eq. (3) necessary. Specif- ically, we examined the effect of removing the teacher's 's prefix when processing the retention set. As shown in Table 18 the model's retention performance remains equally strong regardless of whether the prefix is ap- plied the retention data. This direct comparison under identical hyperparameters demonstrates negligible differences between the two configurations.
Table 18: Ablation study on prefix usage and retention strategies in DUET.
Method
R R-foret
R-forget 500 1
knowmen
mmiu
Performance Shift
buse model
32.13
39.99
84.29
61.46
0.00
original du (with prefix retain data)
4.27
4.86
78.33
61.52
$7.09
du www.rraiipeeffi.... free
4.71
5.37
77.82
$9.16
53.27
DUET++ KLaretain
28.33
30.33
59.04
We attribute this robustness to LLMs' strong semantic comprehension of user instructions. When the model receives queries unrelated to the target forgetting domain, it effectively ignores the unlearning prefix and re- sponds normally seneral-knowledge questions. Thus, the prefix does adversely impact the model's ability preserve general knowledge.
Additionally, this question motivated us to conduct further validation. We implemented an alternative configura- tion where DUET's retention component uses traditional KL-divergence to preserve general knowledge, rather than distillation with the prefix. As shown in the last row of Table [8] this approach significantly constrains DUET's forgetting effectiveness and prevents from achieving the same level of performance. We attribute incompatbbility between the boundary imposed by KL retention the prefix based supervision, which introduces conflicting training signals during optimization.
19


Reviews:
[{"review_id": "refCIfoxaR", "reviewer": "Reviewer_47LM", "summary": "This paper proposes DUET, a novel distillation-based unlearning method that combines the merits of two approaches: optimizing a student model to imitate the behavior of a prompt-steered teacher, which effectively refuses the generation of undesirable knowledge while preserving general domain knowledge. Experiments on existing benchmarks demonstrate that DUET achieves strong performance in both forgetting and utility preservation, with greater data efficiency.", "questions": "see weakness", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed approach is novel and sound. The paper reveals that training-based unlearning achieves stronger robustness but risks greater utility degradation, while contextualized unlearning enables more precise unlearning yet can be easily reversed. The proposed method strikes a good balance between these two paradigms.\n2. The paper proposes top-k logits distillation to further enhance performance.\n3. The paper is enjoyable to read.", "weaknesses": "The authors should compare their method with more baseline methods, such as [1][2][3], as well as additional distillation-based approaches—for instance, distillation from gradient ascent methods.\n\nHow about distillation from multiple unlearning teachers?\n\n[1] Unified Gradient-Based Machine Unlearning with Remain Geometry Enhancement, NeurIPS'24\n[2] Salun: Empowering machine unlearning via gradient-based weight saliency in both image classification and generation, ICLR'24\n[3] Torward Natural Machine Unlearning, TPAMI'25", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VUnVipAf49", "reviewer": "Reviewer_Vd1V", "summary": "This paper introduces DUET (Distilled Unlearning from an Efficient Teacher), a novel distillation-based method for large language model (LLM) unlearning—the process of removing undesirable knowledge without full retraining. Existing unlearning techniques either suffer from high computational cost and catastrophic forgetting (tuning-based approaches) or security vulnerabilities such as prompt removal and reverse-engineering attacks (in-context methods). DUET addresses these issues by training a student model to emulate a prompt-steered teacher that suppresses unwanted knowledge while retaining useful domain capabilities. Experiments on benchmark datasets show that DUET delivers forgetting and utility preservation, achieving good performance with higher data efficiency than state-of-the-art methods.", "questions": "Please check your references – there are titles that have some “words” like LLM that should be uppercase.\n\nWith regard to the use of LLMs, I suggest that you check the claims that are made, such as “comprehensive evaluations” and “significantly superior performance”. It’s up to the reader to judge if the evaluations are comprehensive and whether the performance is “improved” or “significantly superior”. Please discuss.\n\nPlease discuss the generalizability of the results across LLMs.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The novelty of DUET lies in its distillation-based unlearning approach, where a student model learns from a prompt-steered teacher to selectively suppress undesirable knowledge while preserving useful information. This method combines efficiency, robustness, and effectiveness, outperforming existing unlearning techniques in both forgetting unwanted content and maintaining model utility.\n\nThe research provides:\n\n•\tEfficient unlearning without full retraining, saving computational resources.\n\n•\tEffective knowledge removal while preserving useful domain information.\n\n•\tHigh data efficiency compared to existing unlearning methods, achieving reasonable performance on benchmarks.", "weaknesses": "The research demonstrates some shortcomings\n\n•\tReliance on teacher quality — form my understanding effectiveness depends on how well the teacher model suppresses unwanted knowledge.\n\n•\tThe work makes a valuable contribution and builds effectively on current advances. However, including a discussion of remaining challenges and possible avenues for future research would strengthen the paper and highlight its long-term potential.\n\n•\tLimited evaluation — generalisation across LLMs is not shown.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PEkcqkc3DB", "reviewer": "Reviewer_BGFT", "summary": "The paper proposes **DUET**, a distillation-based unlearning framework that transfers a teacher model’s refusal behavior into a student model via top-K logit alignment at the first decoding step. DUET aims to retain general capabilities while suppressing undesirable knowledge. Experiments on MUSE-Books and WMDP show strong forgetting with comparatively small utility loss, and improved robustness to a simple reverse-prompt attack.", "questions": "1. Why apply the unlearning prefix to _retention_ data in Eq. (3)? A seemingly cleaner design is to prefix only the forget set $D_f$​ and leave $D_r$ unmodified. \n2. Is this aggregate metric \"performance shift\" standard in the unlearning literature, or specific to this paper?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. **Simple method and clear motivation.** The approach is conceptually straightforward and is well justified relative to tuning-based and purely in-context unlearning.\n2. **Good empirical performance.** On MUSE-Books and WMDP, DUET achieves lower forgetting scores and stronger utility preservation than most baselines. \n3. **Robustness to attack.** The distilled model is notably less sensitive to a reverse-prompt attack than a purely in-context teacher.", "weaknesses": "1. **Distilling only the first decoding step is not fully convincing.** Many tasks (e.g., math reasoning) often start with stereotyped lead tokens (e.g., _“To solve the problem, I need to…”_), so aligning only the first-step logits may fail to shape downstream generation in a robust way. The paper explicitly trains on **first-position** logits only; a deeper justification and multi-step ablations would help.\n2. **Limited experimental breadth.** The forget set and retention set used for training are quite small (e.g.,  100 queries for Harry-Potter forgetting; 100 for retention), which risks overfitting the teacher prefix distribution and may bias results toward DUET’s design. Broader forget/retention sets or more domains would strengthen claims.\n3. **Adversarial evaluation is narrow.** “Reverse attacks” are instantiated as a single reverse-prompt. The paper does not cover more systematic jailbreak or targeted relearning attack suites, so robustness claims remain preliminary.\n\nOverall, I like this paper, and if the authors can provide a clear explanation about W1 and W2, I’d be happy to raise my score.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "M6Fl1BI3EY", "reviewer": "Reviewer_o7sB", "summary": "The paper introduces DUET, a distillation-based LLM unlearning method that transfers the refusal behavior of an in-contextualized teacher into a student model via Top-K logit distillation. Concretely, the teacher is a frozen base LLM steered by a compact unlearning prefix; DUET trains the student to match the teacher’s dominant raw logit shifts on forget queries, while mixing in retain queries under the same objective to preserve utility. DUET requires only query-level forget data without no ground-truth answers or refusal templates, and achieves strong forgetting–retention trade-offs on LLM unlearning benchmarks. Comprehensive ablations also indicate robustness to reverse-prompt attacks and evaluation-format shifts.", "questions": "1. The paper states that the Harry Potter (MUSE-Books) evaluation set is expanded to 500 items. How exactly is this expansion performed?\n\n2. Please clarify the source and selection process for the retention data used during training and evaluation.\n\n3. In Table 1, why does NPO with a retain-set KL (w $\\text{KL}(\\mathcal{D_r})$, line 320) yield worse retain performance than the variant without retain-set KL (w/o $\\text{KL}(\\mathcal{D_r})$, line 319)? Please explain the underlying cause.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well written and easy to follow.\n\n2. Distilling from an in-context teacher to obtain an unlearned student is reasonable, cleanly formalized, and avoids constructing ground-truth answers or refusal templates for forget data.\n\n3. The work proposes and validates the effectiveness of Top-K logit distillation for unlearning.\n\n4. The experimental section demonstrates the method’s effectiveness and provides thorough ablations showing robustness to reverse-prompt attacks and evaluation-format shifts.", "weaknesses": "The paper’s discussion of distillation-based unlearning remains incomplete. Similar ideas have been applied in the LLM unlearning literature, including W2SDefense (weak-to-strong distillation for backdoor removal) [1], UNDIAL (self-distillation with adjusted logits) [2], and UNDO (“distillation robustifies unlearning”) [3]. The manuscript should explicitly discuss conceptual and practical differences from these works, and add an analysis to clarify DUET’s unique contributions.\n\n### Reference\n\n1. Zhao, Shuai et al. “Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillation.” ACL (2024).\n\n2. Dong, Yijiang River et al. “UNDIAL: Self-Distillation with Adjusted Logits for Robust Unlearning in Large Language Models.” NAACL (2024).\n\n3. Lee, Bruce W. et al. “Distillation Robustifies Unlearning.” ArXiv.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)