WaterDrum: Watermark-based Data-centric Unlearning Metric
Authors: Xinyang Lu
Xinyuan Niu
Gregory Kang Ruey Lau
Nhung Bui
Rachael Hwee Ling Sim
John Russell Himawan
Fanyu Wen
Chuan-Sheng Foo
See-Kiong Ng
Bryan Kian Hsiang Low
Venue: ICLR 2026 Poster (2026)
Keywords: machine unlearning
watermarking
metric
LLM
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose the first data-centric LLM unlearning metric based on watermarking that is effective and practical.

Abstract: Large language model (LLM) unlearning is critical in real-world applications where it is necessary to efficiently remove the influence of private, copyrighted, or harmful data from some users. Existing utility-centric unlearning metrics (based on model utility) may fail to accurately evaluate the extent of unlearning in realistic settings such as when the forget and retain sets have semantically similar content and/or retraining the model from scratch on the retain set is impractical. This paper presents the first data-centric unlearning metric for LLMs called WaterDrum that exploits robust text watermarking to overcome these limitations. We introduce new benchmark datasets (with different levels of data similarity) for LLM unlearning that can be used to rigorously evaluate unlearning algorithms via WaterDrum.

Published as a conference paper at ICLR 2026
WATERDRUM: WATERMARK-BASS DATA-CENTRIC UNLEARNING METRIC
Xinyang Lu*!, Xinyuan N Gregory Kang Ruey Lau
Nhung Bui', Rachael Hwee Ling Sim', John Russell Himawan' Fanyu Wen', Chuan-Sheng Foo", See-Kiong Ng', Bryan Kian Hsiang Low*
'Department of Computer Science, National University of Singapore, Singapore 117417 Centre for Frontier AI Research, STARR, Singapore 138632
FIRS@CREAS CANRS@CREATE Create Way. H08-01 Create Tower, Singapore 138602
(xinyang. 1u, xinuan,, gregorylau, btcnhung, rachael sim) @u nus. edu, [johnr. himawan, wenfanyu @u nus. edu, foo_chuan_shenge aasngggassttsse asst.r...... edu.sg seekiongênus. edu. sg, lowkh&comp nus .anu.edd.gg.
ABSTRACT
Large language model (LLM) unlearning is critical in real-world applications where is necessary to efficiently remove the influence of private, copyrighted, or harmful data from some users. Existing utility-cennn on model utility) may fail to accurately evaluate the extent of unlearning in realistic settings such when the forget and retain sets have semantically similar content and/or retraining the model from scratch on the retain set is impractical. This paper presents the first data-centric unlearning metric for LLMs called WaterDrum that exploits robust text watermarking to overcome these limitations. We introduce new benchmark datasets (with different levels of data similarity) for LLM unlearming that can be used to rigorously evaluate unlearning algorithms via WaterDrum.
unlearning metrics (based
INTRODUCTION
The capabilities of large language models (LLMs) have drastically improved in recent years, prompting increased efforts to deploy LLMs in real-world applications. However, accompanying this push for practical L.M deployment are growing concerns around data issues regarding L.MSs that may threaten to derail such developments, especially since LLMS typically require large amounts of training data. Data owners have raised intellectual property (IP) infringement concerns: For example, New York Times has sued OpenAI over its LLM's 's use of their copyrighted work (Grynbaum & Mac 2023). Many jurisdictions are also paying increased scrutiny over data privacy concerns, e.g., with regulations such as GDPR (216)) and California Consumer Privacy Act (CCPA) 20188) mandating the "right be forgotten" that allow data owners to request the erasure of their data from the trained models. Furthermore, it is not uncommon for public data to become outdated or be found erroneous/ harmful, e.g., the retraction of public scientific papers with fabricated data (Hu al. 2024).
These data concerns have sparked considerable research efforts on LLM unlearning algorithms, which aim to efficiently remove the influence of a subset of the model's original training data (called the forget set) while avoiding the prohibitively expensive alternative of retraining the LLM from scratch on the retain set. However, due to the size and complexity of LLMs, existing unlearning algorithms cannot yet achieve perfect unlearning like retraining: They may not fully remove the influence of all data in the forget set, and may also inadvertently remove the influence data in the retain set that should be preserved (Maini al. 2024 Shi al., 2025). How can measure the extent to which these algorithms have unlearned given set of data? Existing works have largely proposed utility-centric unlearning metrics that evaluate unlearning based on model utility (performance) indicators, like the perplexity or accuracy on downstream tasks. After unlcarning, the model utility indicators related the forget set are expected to worsen. We provide an overview of existing utility, membership inference attack, and image and classification watermark- based unlearning metrics in App.[A.] and position our work with respect other LLM unlearning evaluation works App. A.2
"Equal contribution.

---

Published as a conference paper at ICLR 2026
However, are the utility-centric metrics effective in face of practical challenges with real-world datasets? One such challenge is that the forget and retain sets usually have semantically similar content. As existing benchmark datasets (Li et al. 2024b| Maini et al. 2024 Shi et al.. 2025 do not explicitly consider a higher level of data similarity, we first propose (a) a new benchmark dataset called WaterDrum-A Ax that includes data from multiple data owners and contains duplicates with different levels of data similarity for a more practical evaluation of the unlearning metrics Ax, we observe that utility-centric metries fall short, because to evaluate the success of unlearning, they need to reference the retrained LLMs (on the retain set), which are prohibitively costly to obtain in practice. Also, expecting a worse utility on the forget set after unlearning ignores the LLMs ability to generalize from retain set (Liu et al. 2024).
and algorithms (Sec. 2). Using Wat
In this work, we consider the above limitations in (b) defining clear desiderata that an effective and practical unlearning metric should satisfy to enable direct interpretation (Sec.3) Next, we (c) propose a novel data-centric metric to continuously evaluate the success/extent of LLM unlearning instead, which we call Watermark-basse desiderata. WaterDrum is based on a robust text watermarking framework that is capable of verifying multiple data owners' watermarks in the text outputs of the LLM when fine-tuned on their watermarked text data (Sec. 4 Our key insight is that using watermarked data creates a clear counterfactual: A model not trained on watermarked data would not contain the watermark signal. In Sec. [ we (d) empirically show that our proposed metric Wate rDrum significantly outperforms existing ones satisfying our desiderata. We (e) also benchmark unlearning algorithms using WaterDr um to reveal their strengths and weaknesses.
Data-centric Unlearning Metric (NaterDrum) that satisfies these
2 PROBLEM FORMULATION
We consider the setting of a collection T of data owners where each data owner i has a dataset D;- These datasets may contain similar data instances (e.g., news articles on the same event from different news agencies or arXiv paper abstracts from the same academic subject category but different authors, as illustrated in App. B.4 The model owner aggregates their data Dy == UleT D, for training an LLM (pT to be deployed as a service We consider the unlearning scenario where a subset F C T of data owners requests to remove the influence of their to-be-erased data D,r = ULer D, (called the forget set) from the LLM due to concerns about privacy, IP protection, or erroneous content.
Ideally, the model owner would retrain a new model PR on the remaining set of data DR= TVF (called the refain set) to comply with these unlearning requests. However, full retraining is impractical in reality due to the prohibitive computational cost, especially when DR is large. Instead, the model owner would resort to using some unlearning algorithm, which modifies the original model 4o based on D= to an unlearned model & that approximates SPR. Such an unlearned model may not have perfectly unlearned the forget set, so it can be intuitively viewed as retaining the influence of some (possibly unknown) subset of the forget set De S Dy and hence still be effectively influenced by its approximate retain set Die U DD. Note that Do might not correspond exactly to the union of D, over some subset of data owners in F and can possibly include only a subset of data points from each D; The best unlearned models should have (Del and its influence be as small as possible.
The model owner should allow each data owner E F to evaluate the extent to which its data DD has been unlearned, and would usually only grant them query access to the LLM. Let each data point d be used to form text query qa- For example, can be a formatted prompt to an LLM for QA or completion tasks. Then, both the model owner and data owner can rely on some LLM p. 's text output yp (qa) to compute an unlearning metric M that quantifies the extent to which i's data remains present. We define an unlearning metric M where M (yp. (q.) i) measures the influence of data D; from owner i (i.e., second input to M) detectable in the LLM's text output ye (ga) to query qa-
The unlearning metric should also be able to measure the influence of data from a set of owners; for example, (g.). measures the influence of the forget set Dy detectable in the LLM's text output. Usually, we set the influence as the extent to which data point d, from some owner i E FF remains present in the LLM's text output y2. (ga,) to its query qa, i.e. M (Q..(q))) M (,d,),)) ),).. Often, we measure the influence of D.r detectable in the LLM's text outputs to an aggregate of queries formed by owners' data (e.g., Dy). With a slight abuse of notation, we denote such an aggregate unlearning metric as MaED, (4. (qa). F), which can be, for example, the uniform average over all d E DD: EdeD, M(p. () F)/ = Eier,der Myp. (ga, F)/(p))
=
2

---

Published as a conference paper at ICLR 2026
Existing datasets to benchmark unlearning algorithms do not reflect practical challenges: Existing works have proposed to evaluate unlearning algorithms and metrics using benchmark datasets like TOFU (Maini et al.) 2024), MUSE (Shi et al. 2025), and WMDP (Li et al. 2024b) with the following properties: (a) The forget set D and retain set DR are fixed. In contrast, in practice, multiple owners can independently decide whether to erase their data, which requires evaluation on multiple forget-retain splits. (b) D> and Dr are disjoint (i.e., the queries formed by D are related only to D and are unrelated to queries formed by DR) and the unlearning algorithms perform poorly if dependencies between both sets are introduced (hakerr et al. 2024). In contrast, real-world datasets may contain more similar data and different levels of similarity across Dy and DR.
To address these limitations, we introduce complementary unlearning benchmark dataset called raterDrum-Ax that comprises arXiv paper abstracts across various academic subject categories published after the release of the Llama-2 model. In particular, to address (a) and (b) above, WaterD rerrrrrrusss includes (a) abstracts from the 20 most popular academic subject categories to represent 20 different data owners that can be freely assigned to define D and DR; and (b) different levels of data similarity ranging from exact duplicates to paraphrased versions of the abstracts that can be used across Dy and Dr. Overall, WaterDrum-Ax contains 400 abstracts for each category, aggregating to a total of 8000 data points in length of 260 tokens, which is considerably longer than that of TOFU (Maini et al. 2024) (59 tokens).
These abstracts have an average
The Watern r Drrum-Ax Ax benchmark dataset can be used to (i) evaluate unlearning metrics based on the desiderata introduced in Sec. 3] and (ii) evaluate unlearning algorithms using effective and practical metrics identified in (i). The empirical evaluations in Sec. focus on (i) but include some preliminary results on (ii) in Sec. 5.1 We leave more systematic investigations of (ii) to future work.
Existing unlearning metrics are ineffective in the face of practical challenges: Here, we discuss some existing definitions of the unlearning metric M and their limitations; see App. for deeper introduction of utility-centric and other unlearning metrics. Unility-centric unlearning metrics have evaluated the effectiveness of unlearning based on model utility (performance) indicators, such as verbatim memorization, perplexity, or accuracy on downstream tasks. Performance indicators P have compared the unlearned LLM G's text outputs to queries (e.g., p(qa) for all d E D)) to the original text data (e.g.. D))) For instance, ROUGE-L (Maini et al. (2024) compares the output phrasing/longest common subsequence of ((qa) to the training text data point d. As another example, some membership inference attack (MIA)
Dansity
2.0
Retain
Forget
Denaity
Retain Forget
1.9
8,00
0.2
0.6 Truth Ratio
0.4
0.8
-0.3
0.0
0.3
0.6
0.9
WaterDrum Value
Figure I: Histograms of utility-centric Truth Ratio metric vs. WaterDrum values under the 'semantic duplicate' setting of data similarity for NaterDzum-ToFU dataset (Table 2 in Sec. 5 where the individual metric values M ((pR(qa) for each d E DD are in orange and M(pR (qa), R) for each d E DD in blue. The Truth Ratio metric values cannot be interpreted on their own as there no value on the horizontal axis where we can confidently conclude that the LLM's s text output fou (qa) to query 9a is more likely to be formed by any E Dz. In contrast, WaterDrum values can be interpreted on their own: Values < 0.2 are more likely to be associated with forget set Dy.
based unlearning metrics (Shokri et al.; 2017). such as that of (Shi et al. (2024) for LLMs,
are utility-centric as they may depend on the log-likelihood of tokens of the original text data.
Our key observation is that their aggregate (e.g., average of ROUGE-L), cannot be interpreted on their own: For example, Table 3 of Shi al. (2025) compares the aggregate metric value (e.g.. KnowMem)
metric values, such as P(p(ga), for each d E D, and
the unlearned LLM ; with that on the retrained LLM you (trained on the retain set) to evaluate the extent of unlearning. Ideally, the aggregate (over all d E D)) of P(p(ga), should be equal to that of P(pR ()) Similarly, the work of Maini et al. (2024) also compares the distribution of the metric values (c.g., Truth Ratio, ROUGE-L) on the unlearned LLM T with that on the retrained LLM PR to evaluate the extent of unlearning.
This raises a critical issue: In practice, the retrained LLM yR is usually not available (Sec. 2p. In fact, the aim of unlearning algorithms (and metrics) is to produce an unlearned LLM ; that most closely approximates PR. Regarding our main research question, is there an (aggregate) unlearning metric (over all d E Dr)) whose values can be interpreted on their own to measure the extent of unlearning D, without referencing a retrained LIM??
3

---

Published as a conference paper at ICLR 2026
It can be observed from Fig. that the answer is no for utility-centrii metries, especially when there are similar data in the retain and forget sets: For any Truth Ratio metric value (c.g.. 0.2), the LLM's text output to query is equally likely to be formed by a data point in the retain set vs. that in the forget set. There is no value of x where we can confidently conclude that the LLM's text output (p(()a) to query qa is more likely be formed by any d E DDy when P(pr (ga), F) < K. Let dj ~ dj denote that text data points d, and dj have large similarity score SS(d; dz), e.g., computed using some semantic text similarity (STS) score. A likely explanation that when similar text data points d and d, are present in the respective forget and retain sets, (i) any unlearned LLM p (e.g. retrained LLM (Pr) tends to generate similar text outputs to queries formed by both sets, i.e. p(ga,) ) = (((a,), ), as empirically verified in App. G.2 As performance indicators largely depend on direct comparisons with the LLM's text outputs, their metric values are also similar.
(ii) Expecting poor predictions on the forget set overlooks the generalization capability of LLMs (Liu et al. 2024).
UNLEARNING METRIC DESIDERATA
The goal of our work here is to come up with an alternative effective and practical unlearning metric whose values can be interpreted on their own without referencing retrained LLM. What desiderata must such an unlcarning metric satisfy? We define a few non-exhaustive desiderata in this section.
Intuitively, based Fig. | we would want the LLM's text outputs queries formed by the text data points in the forget vs. retain sets to have (i) separable metric values and (ii) aggregate (e.g.. average) metric values to be casily interpreted (c.g.. 0 for perfect unlearning) (iii) without referencing the retrained model. (i) and (ii) correspond to our desiderata D1 and D2 respectively. We include practical constraint (iii) as D3 The unlearning metric M should satisty the following desiderata:
EPFECTIVENESS. First, the metric must effectively measure the extent to which an unlearning algorithm has not unlearned the forget set (so, the resulting unlearned LLM ē would still be influenced by its unknown approximate retain set, as discussed in Sec. Sec.2). To achieve this, we will now define effectiveness desiderata that utilize LLMS retrained on the retain set (and varying known subsets of the forget set) retraining is perfect unlearning algorithm
D1 Separability. The metric should detect/classify whether an owner's data still influences an unlearned LLM. Specifically, when evaluating the retrained LLM PR (i.e., achieved by perfect unlearning), the metric should, with high probability, give higher values when measured on its text outputs to queries formed by the retain set Dr (which influences (oR) than queries formed by the forget set D (which does not). That is, for any randomly selected text data points d, E D, S DR. from owner r and dy Dj C Dr from owner f, the probability
P (M) M(pR (ga, fi] x 1.
(I)
Separability, which is defined by the left-hand side expression of Eq. [ (or, equivalently, AUROC),
implies that some threshold x exists such that for any text data point de E D, C. Dr from owner i, a large value M M(PR ). i) > i indicates that d; is likely to be in the retain set DR: varying k yields the ROC curve. Similarly, when considering an unlearned LLM Φ, large value M(G((a,), ), i) indicates that de is likely to be in the approximate retain set (Sec. 2) In other words, the metric should serve
good classifier for whether an owner's data still influences the LLM and is hence in the approximate retain set: A higher AUROC indicates a better separability of data that influences the LLM vs. not (Fawceti 2006). App. B. gives a further intuitive discussion on D1
D2 Calibration. In Sec. [ we have highlighted that existing unlearning algorithms cannot yet achieve perfect unlearning. Thus, our unlearning metric should be calibrated to the extent of imperfect unlearning. For example, we can simulate different extents of imperfect unlcarning by retraining with different sizes of subsets of the forget set. Specifically, the aggregate metric (in expectation) should be proportional to the size of the random subset DD of the forget set that is used together with the retain set Dre to retrain the LLM C
Ep [MaeD ()( & k/|Dr|
Note that these retrained LLMs are only used to justify our effectiveness desiderata for evaluating the untcarning metries. In practice, the metrics should be used to evaluate imperfect unlearning algorithms without
referencing the retrained I.I L.Mss, discussed in D3 a).
4

---

Published as a conference paper at ICLR 2026
where De is defined in a similar way De in Sec. except that it is known. Eq. (2 implies that a perfectly unlearned LLM like (R should have MaeDy (pp = 0 since k O. So, when evaluating unlearning algorithms, we identify successful perfect unlearning of the forget set by looking for M extent to which the forget set has not been unlearned. This enables the unlearning metric go beyond being just a binary indicator of whether an entire forget set has been unlearned to a meaningful continuous measure of unlearning. App. B.2 provides a further intuitive discussion on D2
Rs O. The value of the aggregate metric can also be interpreted as the
PRACTICALITY. To be a viable metric for deployment, the metric must also satisfy the following feasibility and robustmess desiderata that account for challenges faced in common real-life scenarios:
D3 Feasibility. (a) When the metric is used to evaluate an unlearning algorithm and produce (F(ga), FF or the aggregate MaED, (G(qu), F) on the unlearned LLM G, it should not require the retrained LLM PR to interpret/measure the extent of imperfect unlearning. The premise of unlearning is that retraining the LLM on the retain set is prohibitively expensive. Hence, metrics cannot depend on R in practice. (b) To additionally enable data owners with only query access to the LLM to evaluate unlearning, the metric should only depend on the queried text outputs instead of full access to the weights or token probabilities of the unlearned model G
D4 Robustness to similar data. The effectiveness desiderata D1 D2 should hold for any Dr and Dr, including typical scenarios where DR. and D have similar data points (e.g., news agencies have different news articles reporting on the same event, as illustrated in App. B.4).
EXISTING METRICS DO NOT SATISFY DESIDERATA. Continuing the discussion from Sec. 2 Table compparss our WaterDrum and existing metrics based on the proposed desiderata in Sec. As other utility-centric metrics may not satisfy DI and D2 under D3 and D4 their values cannol directly interpret/meeasuee the extent of imperfect unlearning without a retrained LLM and using the Wat e Drrm-ruuAA dataset (Sec.)
4 WATERMARKING FRAMEWORK
Instead of relying on ueility-centric metrics that indirectly infer unlearning via model performance, we propose a novel data-centric metric that directly tracks the influence of data by actively embedding data-specific signals detectable in the LLM's text outputs. These data signals are embedded by watermarking the training data and preserved by the LLM. We discuss how MaterDrus differs from existing watermark baasrm metrics for image classification tasks in App. A. and give an introduction of text watermarking in App. A.3
Table 1:
Comparison of unlearning metries based on the proposed desiderata (Sec.B). We enforce D3 so metrics cannot rely on the retrained LLM. DI and [D] consider the setting of no data similarity.
D1
D2
D4
ROUGE (Maini et al. 2024)
/
x
x
Truth Ratio (Mann et 2024
X
X
X
KnowMem (Shi et al. 2025
X
X
X
We will start by outlining desiderata required by watermarking framework (and its verification operator) meet our unlearning metric desiderata Sec. 3
MIA (hi 2024
X
X
WaterDrum (ours)
Our watermarking framework assigns each data owner i a watermark key μ4. It comprises (a) a watermarking operator W(d,, + d' that takes in any text data point de E D, from owner i and watermarks it with the key to produce a unique corresponding text data point d', and (b) a verification operator (og',, p4) that takes in any text data g' (e.g., LLM's text output) and watermark key (4; and provides score reflecting the likelihood of g' containing the watermark 14, To satisfy our unlearning metric desiderata in Sec. 3 the watermark and verification operators used will need to satisfy the following desiderata
WATERMARKING DESIDERATA.
WO Fidelity.
The watermarking should have minimal impact on the semantic similarity of the original data, i.e., d = W(d, ju) for any watermark key and data d E 'Dy. While this does not directly impact the unlearning metric desiderata, WO ensures that the watermarking process preserves the value of the data and model for the model owner and the metric can be deployed in practice.
When evaluating unlearning algorithms (Sec. 5.1 the model owner can perform the watermarking and verification. In real-world deployment, the data owners do so instead.
5

---

Published as a conference paper at ICLR 2026
MaterPrun
vuch data coner:
2i Ma Watersariing detap
Model Ownez
Wattermarked
Retain
Metrle
Dusnuct,
Watermeoking Operatie
Watsmmaked
((te)
(ac).v..
Rey.
Dacases,
LEM taatning
Unlearaing
(ag)
(Rgg).n)
Data onners anquest Bi
Watermarked Forget
wisthou
Onlearning Vard Ficatiooo
extrained
data onner andld
Data,
@ Query, 9e fuftee [nnokresl
Unlearzed
Vectfcation
Test
Original
Unlearned
Uperstor.
Unlourning Mousi Ha (Mae
(Mec 9h ql
Figure 2: (Left) Unlike existing ctility-centric metrics, WaterDrung satisfies the unlearning metric desiderata in Sec. 3 eaterruum is robust to similar data by embedding orthogonal data-specific signals in the LLM's text outputs that are W1 verifiable. (Right) An overview of the watermarking, training, unlearning, and verification processes of WaterDrum.
WI Verifiability. (a) The watermark should be verifiable if and only if the watermarked content is present in the LLM. In our setting, this means the retrained LLM should not contain the watermark of owner ff in FF who requests to erase its data from the LLM, i..., ((pR(ga,, J, = 0. In contrast, an LLM that has been trained on owner r's data D, C DR should be verifiable with watermark key Br, i.e., ((pR((9)) p2) >> 0 for all d, E D,, (b) If every text data point in D is watermarked with the same key μrF the average of V(G(ga,), M.F) MF) over all dy E DD for model & retrained on DR UDD should be proportional to the size of the data De S DDy (a) supports D1 as V(SR (ga,), 144 can be used to classify whether an owner's data influences perfectly unlearned LLM: A value near 0 or much larger than O, respectively, indicates that owner likely has no influence or some influence on the unlearned LLM. Together, (a) and (b) support D2 as the value is 0 in the case of perfectly unlearned LLM like PR and the average value is proportional to the extent of imperfect unlearning.
W2 Overlap verifiability. The verifiability desideratum WT is satisfied despite the presence of other watermarks (e.g.,/ frr from another owner r') in the data for training the L.M.. This allows for multiple watermarks to be verified from the text outputs of the same LLM.
We also need desiderata on the watermarking process to meet the rest of unlearning metric desiderata:
W3 Query access constraint. Data owners should verify their watermarks with only query access to the LLM. This supports D3 with feasible efficient evaluation of the extent of imperfect unlearning.
W4 Unique key. Each data owner i's watermark key μi should be unique. When an owner requests to erase its data from the LLM, the corresponding forget set would have different watermark from that associated with the retain set, thus supporting D1 The unique keys also ensure that similar or even identical data from different owners would have different watermarks, which supports D4
Fig. 2 left) shows how a watermarking framework satisfying these desiderata satisfies the unlearning metric desiderata in Sec. Concretely, we define metric M using the verification operator:
M (pa(), = (g)),
OVERVIEW OF WATERDRUM. Can any watermarking framework be adapted satisfy our proposed watermarking desiderata above? Here, we propose the first data-centric unlearning metric called WaterDrum built on top of our adaptation of the training-free, scalable, and robust Waterfal framework (Lau et al., 2024) that can successfully and efficiently verify multiple data owners' watermarks the text outputs of the LLM when trained on their watermarked text data. While we will mainly use Waterfal 11 to demonstrate the effectiveness and practicality of WaterDrae watermarking methods satisfying our desiderata can adopted as well. We provide a comprehensive overview of watermarking methods (e.g., (Dathathri et al.) 2024 Kirchenbauer al. 2023 Kuditipudi ct al. )0244 in App. A.3 and discuss their adaptations and empirical performance in Sec. 5.2
other
Specifically, we adopt the watermarking W(: ()) and verification V(-, (u) operators as defined in
Materfall (respectively, Algorithms 1 and 2) and summarized in App. C.I due to lack of space. Waterfall" watermarking and verification operators satisfy the watermarking desiderata W0 aT.,), and W2 as elaborated and demonstrated in (Lau et al.) (022)). We have empirically verified that Waterfal 1 satisfies W0 in App. G.T and bT calibration in Sec. 5 The rest of the

---

Published as a conference paper at ICLR 2026
watermarking desiderata can be satisfied by an appropriate design of the unlearning and verification processes, which we illustrate in Fig. rright) and present below:
P1 Watermarking setup. Each data owner i first watermarks its data D, with unique key μu, to generate a watermarked dataset Dj == {dz == W(d,, H.)),, Then, the model owner aggregates their watermarked data D/ == USer D trains LLM ,4y on it, and offers to clients (including data owners) query access to the trained LLM.
P2 Unlearning, A subset of data owners F requests for their data D'= = User Dj to be erased from the LLM o6. The model owner will claim to have performed the unlearning and offer query access to the resulting unlearned L.M G
P3 Unlearning verification. The verification operator plays the role of an unlearning metric in WaterDrum, as per Eq. (3). Each data owner in F can query the unlearned LLM ø with queries qr based on d' E Dj and apply the verification operator V( (gx) ), 14) to measure the extent to which its data remains present in the text outputs 7 (gw') and hence has not been unlearned.
Note that computing the Wa WaterDrue rum value in Eq. (3) applied during P3 only requires query access to the LLM, hence satisfying W Watermarking desideratum W4 is also satisfied by the setup in P1 and the fact that the model owner never requires the data owners' keys, which is also the case in P2
Remark 1. Using watermarked data is both (i) beneficial and important for identifying practical and effective unlearning metrics and (ii) reasonable going forward. (i) In Table our watermarked data-based WaterD is the only metric that satisfies all the unlearning metric desiderata. (ii) There are a few important reasons: (a) data owners with IP or privacy rights (Sec. I can require the model owner use the watermarked version of their released data instead: (b) data owners can watermark their unreleased data, which will be used to train (and may be more relevant for) future LLMs, and (c) the adoption of text watermarking is expected to grow and match the prevalence of image watermarking, In C.4. we elaborate on these practical considerations and other benefits (e.g.. computationally lightweight, no change to existing MI. pipelines), beyond meeting the desiderata, for deploying WaterDrum So, the benefits of using watermarked data in Water NaterDrum to evaluate unlearning algorithms, such as not needing to reference retrained LLM (unlike utility-centric metrics), outweigh the slight inconvenience and cost.
Remark 2. If (i) the model owner tries to reduce its LLM's metric value without directly performing unlearning copyright its LLM via watermarking methods for model owner (Kirchenbauer et al. 2023) or (ii) data owners try to report inflated metric values to understate the unlcarning by the model owner, is WaterDrum still an effective unlearning metric? The answer is yes if (i) the watermarking framework is designed to be resilient, the watermark keys are private to the data owners, and (ii) a trusted third party validates the metric values. We discuss these questions and additional requirements in App. D and show that WaterDrun also satisfies them due to the properties of Waterfall.
5 EXPERIMENTS AND DISCUSSION
Experimental setup. In this section, we empirically compare Wate eDrerr with other commonly used unlearning metrics: ROUGE-L (Lin) 2004 Maini et al. 2024), Truth Ratio (Maini et al.) 2024
KnowMem (Shi et al. 2025), and MIA Shi et al.) 2024)). ). We use the Llama-2-7B (Tourron et al. 2023) as the base LLM. For WaterDrum, the LLM is fine-tuned on the watermarked dataset D/ in WaterDrum- Ax (Sec. 2 or WaterDrum run-TFFUU derived from TOFU (Maini et al. 2024). For other metrics, the LLM is instead fine-tuned on their unwatermarked version Dr. To case comparison. all metrics are scaled to 1.0 when evaluated on the original model yo before unlearning. We use 1 category from WaterD rum-Ax and 10% data from WaterD WaterDrum-Tory as forget sets. We further evaluate the metrics with other LLMs (Li et al.) (023b) as base models (App. F.3). Although watermarking with Waterfal is only essential for WaterDrum, App. G.I shows that does not degrade the LLM's performance and App. F.4 shows that other metrics still do not satisfy some desiderata when the LLM is tne-tuned on DJ instead. To ease notation, in the rest of this paper, we will use d, D.. q. P.,, and e in place of d". D', o- (p and ø (i.e., those associated with the watermarked data used by Wat enterrrumme respectively. [pp.[E]rr additional details on the datasets, other models used, unlearning metrics, inference parameters, queries, and implementation.
7

---

Published as a conference paper at ICLR 2026
Table 2: AUROC (#: across 3 seeds) of various unlearning metries under different levels of data similarity for the WaterDrum-Tore and WaterDrun-Ax datasets. WaterDrun's AUROC remains near 1.0 even when similar data exists.
WaterDrum- TOFU
WaterDrum
Data Similarity
ROUGE
Truth Ratio
MaterDrum
ROUGE
KnowMem
WaterDrun
Exact Duplicate
0.510=+0.007
0.508=0.008
0.926+0.027
0.334+00000
0.492=0.005 0.957=0.008
Semantic Duplicate
0.798++00001 0.472=0.054 0.954+0.001
0.900+0.002 0.450=0.007 0.963=0.001
No Duplicate
0.908+00005
0.747=0.011 0.928+0.026
0.974+0.001
0.491=0.000
0.965=0.002
We will evaluate WaterDrum and the baseline metrics in experimental settings that mimic the
real-life scenarios described in the PRACTICALITY DESIDERATA D3 and D4 (Sec. 3 Then, under these settings, we assess the effectiveness of various metrics based on DI D2 by considering how they evaluate the perfect unlearning algorithm- retraining the base LLM on only the retain set to obtain yoR, which is guaranteed to contain no influence of forget set D> by construction.
Feasibility D3. To satisfy D3 a), the metrics should not require referencing the retrained LLM (P to interpret/measure the extent of imperfect unlearning (Sec. 3). For example, when assessing D2 we enforce the metric values not to use (e.g., subtract) MaED, (qa), To satisfy b), the metric should not require logit access, but for evaluation, we allow the use of logits only to compute MIA.
Robustness to similar data D4. Let D; =D denote sets where for any d: E D;, there is corresponding dj E Dj such that d; = dj. We establish the settings to assess the robustness of the unlearning metrics to similar data by injecting a small amount of data D, Dy into DR. i.e. the retain set is augmented (Dir D. DDR) with some data points that are similar to Dz. We consider two such settings: (a) exact duplicate: data points DD are exact copies of those Dz (i.e., D. D)), and (b) semantic duplicate: data points in D. are paraphrased versions of those in D= (i.e., D. Dx). In addition, we consider the case where (c) no duplicate of any data point in Dy is used to augment De (i.e., D.
0). Additional implementation details are in App. E.4
SEPARABILITY DESIDER ATUM D1
To assess whether the unlearning metrics satisfy D1 note
that the left-hand side expression definition of the AUROC of the metric M in measuring the separability of the retain set Dr that influences the retrained LLM PR vs. the forget set D> that does not (Fawcett) 2006). Hence, we can compute the AUROC of various unlearning metrics with the retrained LLM PR (1.e., perfectly We exclude MIA from this experiment as
PIM (spre (. > (spR (gd,); f in Eq. (1 corresponds the
unlearned LLM) and assess if they have AUROC only considers the separability of the forget set vs. holdout set instead of the retain set (App. E.3)
Thole the AUROC of the various unlearning metrics under different levels of data similarity for the WaterDrum-Tone dataset 3 Notably, Waterrree rum is the only metric that consistently achieves AUROC > 0.9 and close to 1, hence satisfying D1 contrast, the other metrics' performances degrade significantly under the 'exact and semantic duplicate" settings; for the former, their AUROCs drop to around 0.5, so the other metrics are no better than random assignment in the separability of Dr. vs. Dy. Furthermore, Truth Ratio only achieves an AUROC of around 0.75 under the conventional 'no duplicate' setting, hence not satisfying D1 even in this case.
The results the WaterDrum uum-AAx dataset in Table 2 show similar trends with WaterDrus consistently performing well and KnowMem performing poorly in all settings. ROUGE performs poorly under the 'exact duplicate' setting where only 5% of the augmented retain set are exact copies of those in the forget set. It performs well for the 'semantic duplicate' setting as the mean ROUGE-L recall score between D, and D is low (+% 0.65), which implies that the text data is already heavily paraphrased such that the 'semantic duplicate' setting is effectively closer to the 'no duplicate' one for ROUGE. However, the mean semantic text similarity (STS) score of D, and D, remains high (i.e.. 0.94). Milder forms of perturbation for this dataset would likely make the degradation of its performance on DI more apparent.
'Truth Ratio is only applicable to question answering (QA) datasets for which MaterDrum-AA is not. Since Seterrruu-TPP is already QA dataset, there no need to consider Mem that generates QA pairs for evaluation using the ROUGE-T recall score.
8

---

Published as a conference paper at ICLR 2026
ROUGE
KnowMem
MIA
WaterDrum
Ag9. metric value
1.0
1.0
1.0
0.5
0.5
0.5
0.5
8.0
8.0
0.0
1.
8.0
Proportion forget influencing retrained LLM
-xoect
Semarlkk
Figure 3: Calibration curves for various unlearning metrics w.r.t proportion D/ of forget set influencing retrained LLM (solid) and their best-fit lines (see associated R in Table through origin (dotted) under different levels of data similarity for MaterDri rem-Axx dataset. Only Wa waterDi errrru is well-calibrated and satisfies D2 with best-fit lines closely following its aggregate metric values.
Table 3: R² values for the best-fit lines (dotted in Fig. 3 of
< Ma (olgud. P
1.0
unleaming
various unlearning metrics under different levels of data similarity for MaterDrumt Ax dataset. WaterDrum achieves the highest R² values that are close to and is hence a well-calibrated metric.
+ Retraining
0.5
+ GO
O TV
0.0
O SCRUB
Data Similarity
ROUGE
KnowMem
MIA
MaterDrum
0.0
0.5
M'sen,
Exact Duplicate
-37.47
-498.1
-285.6
0.987
Benchmarking the unlearning algorithms with WaterDrum.
Figure 4:
Semantic Duplicate
0.693
-276.5
-14.52
0.991
No Duplicate
0.650
-252.9
0.677
0.963
Next, we assess whether the unlearning metrics meet the calibration desideratum, as defined in Eq. (2). Failing to meet this desideratum implies that the metrics cannot measure the extent to which the forget set D> has not been unlearned (i.e., for imperfect unlcarning). To evaluate this, we first retrain LLMs on Dx UD= by varying the size k of the subset D S Dy. Then, we compute the unlearning metries for each retrained LLM and plot calibration curves showing how the metrics vary with k. To quantify how well a metric satisfies Eq. (2). we can compute the R22 value for its best-fit line through the origin since a calibrated metric (in expectation) should be proportional to k k/DD>| and have MaEDy (ARR(a)) F)
CALIBRATION DESIDERATUM D2
0 at k = O. Consequently, an R² value close to implics that the metric well calbbbabbrr while a large negative value occurs when the metric produces similar (instead of proportional) values for varying k.
Fig. 3 and Table show, respectively, the calibration curves for the various unlcarning metrics and the R² values for the corresponding best-fit lines under different levels of data similarity for the dataset. The results show that WaterDrum is the only well-calibrated metric across all settings that can represent the proportion k/[D>] of the forget set still influencing the unlearned LLM (i.e., the extent of imperfect unlearning). Comparatively, other metrics perform poorly across all settings, including the conventional 'no duplicate' setting: They cannot be used to determine when D has been perfectly unlearned as MaED, (PR (qa). FF) * 0 (i.e., calibration curves do not pass through the origin in Fig. 3) Thus, they do not satisfy D2 when enforeing D3
The results demonstrate the strong reliance of the baseline unlearning metrics on access to the retrained LLM Pp. Without knowing the reference value on the perfectly unlearned LLM (i.e., (R), these baselines fail to quantify the extent of imperfect unlearning or even evaluate the success of unlearning. This reliance is impractical as retraining the LLM on the retain set is prohibitively expensive, which motivates the need for unlearning algorithms. Fig. [4 and Table 13 in H.2.1 show similar results for the WaterDrum-P5e TOFU dataset where baselines fail to meet the calibration desideratum across all settings, including the 'no duplicate' setting. App. H.I.1 gives results.
5.1 BENCHMARKING UNLEARNING ALGORITHMS ON NEW WATERDRUM-AX DATASET
Finally, Fig. illustrates how WaterD rum can be used to benchmark unlearning algorithms using WaterDrum-AAe via evaluation plot of M'ED, F) vs. M2 M'EDA (p(qz), R). This measures the aggregate WaterDrum values of the respective watermarked forget set D, vs. retain set DR the unlearned I.LM E (Sec. 4. The original L.M (PT, which trains both D, and Dr (i.e.,

---

Published as a conference paper at ICLR 2026
Table 4: Comparison of Wat implemented with various adapted watermarking methods.
Watermarking Method
D1 Separability (AUROC)
D2 Calibration (At²)
Verification time Need GPU?
Waterfall Adapted KGW
0.965
0.963
0.015s
No
0.871
0.996
0.336s
Yes
Adapted Synth-ID
0,549
-16.951
0.386s
Yes
Adapted EXP-edit
0.789
-17.079
165.5s
No
no unlearning). is at the top right corner, while the retrained LLM pR. which only trains on Dr (i.e., perfect unlearning), is at the bottom right corner. It is expected that perfect unlearning would achieve an approximately similar aggregate retain set still influences both the retrained and original LLMs. In this plot, if an unlearning algorithm can produce an unlearned LLM e with aggregate WaterDrum values closer to that achieved by retraining, then its & is better at both unlearning D from yT and retaining the influence of DR.
value of DR as no unlearning since the
Fig. 4 shows results for unlearning algorithms such as Gradient Descent (GD) on Dr from PT, KL Minimization (KL.) (Maini et al., 2024), Task Vector (TV) (Ilharco et al., 2023). SCRUB (Kurmanji et al.] 2024), details of which are in App. E.6] It can be observed that they achieve aggregate WaterDrum values still far from that achieved by retraining: KL and TV can produce unlearned models that unlearn the forget set very well but cannot preserve the influence of the retain set much, the latter of which compromises their overall utility. GD and SCRUB can produce unlearned models that preserve some influence of the retain set but do not unlearn the forget set well. App. H.3) gives preliminary results for the cases with multiple data owners and different levels of data similarity.
5.2 IMPLEMENTING WATERDRUM WITH OTHER ADAPTED WATERMARKING METHODS
For the results above, we use the Waterfall framework in our implementation of WaterDrum because it satisfies our watermarking desiderata without excessive adaptation, as detailed in App. C.2 As suggested in Sec. 4 WaterDrum is designed to work with other watermarking methods that satisfy the watermarking desiderata. So, we will assess the performance of WaterDrum implemented with other adapted watermarking methods (see details in App. E.7) like KGW (Kirchenbauer et al..
2023), Synth-ID DDthathhi et al. 2024). and EXP-edit (Kuditipudi et al. 2024).
Table shows results of WaterD i implemented with Waterfal 1 11, the adapted KGW, Synth-II, and EXP-edit in DI and D2 as well as the average time needed to verify the watermark in a single text output of the LLM and whether GPU is needed for verification. It can be observed that the other adapted watermarking methods need either GPU or few orders of magnitude more time than Water eeaefalll to verify whether the LLM's s text output contains the watermark.
promising to see that WaterDrum with the adapted KGW performs very well in D2 with an R² value close to However, performs poorly in D1 as does not satisfy W2 by nature. This is because unlike Waterfall, KGW is designed to embed the watermark of single model owner into the L.MM's newly generated text outputs during inference time instead of embedding different watermarks of multiple data owners into their existing text data (App. A.3 Thus, the adapted KGW is suited for scenarios where satisfying D2 is more important than DI (e.g., there is only one data owner, hence less of a need for W2) and is possible to use significantly more verification time and GPU resources. The adapted Synth-ID and EXP-edit do not perform well in both DI and D2 likely because they are
not designed to satisfy WT and W2 In general, it is still better to use Waterfall given its better
performance in both and D2
6 CONCLUSION
Our work here has (a) defined clear desiderata that an effective and practical unlearning metric should satisfy to enable direct interpretation and continuoslly measure the extent of unlearning (Sec. (b) proposed a novel data-centric LLM unlearning metric, WaterDrund based on robust text watermarking that, unlike existing metrics, satisfies these desiderata (Secs. 4 and [5). and (c) introduced a new Wat Saterrrumt Ax dataset to be used with WaterDrum to benchmark unlcarning algorithms (Sec. 5.1). App. discusses other questions (e.g., limitations) reader may have.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This research is supported by the National Research Foundation, Singapore under its National Large Language Models Funding Initiative (AISG Award No: AISG-NMLP-20044000 is supported by the National Research Foundation, Singapore under its AI Singapore Programme Xinyuan Niu is supported by the Centre for Frontier AI Research of Agency for Science, Technology and Research (A (A*STAR). This research is supported by the National Research Foundation, Singapore under its Singapore Programme (AISG Award No: This research is part of the programme DesCartes and is supported by the National Research Foundation, Prime Minister's Office, Singapore under its Campus for Research Excellence and Technological Enterprise (CREATE) programme. We would like to acknowledge that computational work involved this research work is partially supported by NUS IT's Research Computing group under grant number NUSREC-HPC-0005
This research
(AISG Award No: LLSG3-RP-2022-022
20GG--PDDD2023-010003333
REFERENCES
Alexander Becker and Thomas Liebig. Evaluating machine unlearning via epistemic uncertainty. arXiv:2208. 10836, 2022.
Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette- Choo. Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In Proc. IEEE S&P, pp- 141-159, 2021.
Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In Proc. IEEE S&P, pp. 463-480, 2015.
CCPA. California consumer privacy act of 2018. Civil Code Title 1.81.5, 2018. URL https ?bill id=
7/con//..eeaatttrrraa////////aaa 201720180AB311
Yapei Chang, Kalpesh Krishna, Amir Houmansadr, John Frederick Wieting, and Mohit lyyer. Postmark: A robust blackbox watermark for large language models. In In Proc. EMNLP, 2024a.
Yupeng Chang, Xu Wang, Jindong Wang. Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang. Yidong Wang, et al. A survey on evaluation of large language models. ACM TIST, pp. 1-45, 2024b.
Vikram S. Chundawat, Ayush K. Tarun, Murari Mandal, and Mohan Kankanhalli. Can bad teaching induce forgetting? unlearning in deep networks using an incompetent teacher. In Proc. AAAI, pp. 7210-7217, 2023a.
Vikram S Chundawat, Ayush K Tarun, Murari Mandal, and Mohan Kankanhalli. sero-shot machine unlearning. JEEE Trans. Information Forensics and Security, 18:2345-22 22544, 2023b.
I. J. Cox, M. L. Miller, J. A. Bloom, J. Fridrich, and T. Kalker. Digital Watermarking and Steganography. Morgan Kaufmann Publishers, 2nd edition, 2008.
Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbi, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, Jamie Hayes, Nidhi Vyas, Majd Al Merey, Jonah Brown-Cohen. Rudy Bunel, Borja Balle, Taylan Cemgil, Zahra Ahmed, Kitty Stacpoole, Ilia Shumailov, Ciprian Bactu, Sven Gowal, Demis Hassabis, and Pushmeet Kohli. Scalable watermarking for identifying large language model outputs. Nature, 634:818-823 2024.
Michael Duan, Anshuman Suri, Niloofar Mireshghallah, Sewon Min, Weijia Shi, Luke Zettlemoyer, Yulia Tsvetkov, Yejin Choi, David Evans, and Hannanch Hajishirzi. Do membership inference attacks work on large language models? In Proc. COLM, 2024.
Tom Fawcett. An introduction to ROC analysis. Pattern Recognition Letters, 2788) 2006.
GDPR. Article 17 of the General Data Protection Regulation: Right to erasure ('right to be forgotten').
Official Journal of the European Union, 2016.
11

---

Published as a conference paper at ICLR 2026
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net:
Selective forgetting in deep networks. In Proc. IEEE CVPR, pp. 9304-9312, 2020.
Aditya Golatkar, Alessandro Achille, Avinash Ravichandran, Marzia Polito, and Stefano Soatto. Mixed-privacy forgetting in deep networks. In Proc. IEEE CVPR, pp. 792-801 022-01,, 2021.
Michael M. Grynbaum and Ryan Mac. The Times sues OpenAl and Microsoft over A.I. use of copyrighted work. The New York Times, Dec 2023. URL
https: www..yyyinee..om//222//////
http://uuiinesmmmdmaa/eeeee york times-
open ai microsofte www.sttt-wwwwwtt.t.h.....
Yu Guo, Yu Zhao, Saihui Hou, Cong Wang, and Xiaohua Jia. Verifying in the dark: Verifiable machine unlearning by using invisible backdoor triggers. IEEE Trans. Information Forensics and Security, 19:708-721, 2023.
Jifei Hao, Jipeng Qiang. Yi Zhu, Yun Li, Yunhao Yuan, and Xiaoye Ouyang. Post-hoc watermarking for robust detection in text generated by large language models. In Proc. COLING, 2025.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. LORA: Low-rank adaptation of large language models. In Proc. ICLR, 2022.
Yiming Hu, Chenyu Wu, Qingyan Pan, Yinghua Jin, Rui Lyu, Vikina Martinez, Shaofeng Huang, Jingyi Wu, Lacey J. Waymentand Noel A. Clark, Markus B. Raschke, Yingjie Zhao, and Wei Zhang. Retraction note: Synthesis of 7-graphyne using dynamic covalent chemistry. Nature Synthesis, 3:1311, 2024.
Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. In Proc. ICLR, 2023.
Joel Jang. Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Sco. Knowledge unlearning for mitigating privacy risks in language models. In In Proc. ACL,, 2023.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In Proc. ICMI, pp. 17061-17084, 2023.
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. Transactions on Machine Learning Research, 2024.
Meghdad Kurmanji, Peter Triantafillou, Jamie Hayes, and Eleni Triantafillou. Towards unbounded machine unlearning. In Proc. NeurlPS, pp. 1957-1987, 2024.
Woosuk Kwon, Zhuohan Li, Siyuan Zhuang. Ying Sheng. Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang. and Ion Stoica. Efficient memory management for large language model serving with PagedAttention. In Proc. SOSP, pp. 611 1-16626, 2023.
Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. Waterfall: Scalable framework for robust text watermarking and provenance for 11ms. In Proc. EMNLP. pp. 20432-20466. 2024.
Linyang Li, Botian Jiang, Pengyu Wang, Ke Ren, Hang Yan, and Xipeng Qiu. Watermarking Ilms with weight quantization. In In Proc. EMNLP, 2023a.
Na Li, Chunyi Zhou, Yansong Gao, Hui Chen, Anmin Fu, Zhi Zhang, and Yu Shui. Machine unlearning: Taxonomy, metrics, applications, challenges, and prospects. arXiv:2403.08254, 2024a.
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm-Burgen Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Zhenqi Zhao, Ariel Herbert- Voss, Cort B. Breuer, Samuel Marks, Oam Patel, Andy Zou, Mantas Mazeika, Zifan Wang. Palash Oswal, Weiran Lin, Adam A. Hunt, Justin Beenken-Harderr Kevin Y. Shih, Kemper Talley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis. Alex Levinson, Jean Wang, William Qian, Kallol Krishna Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, Ponnurangam
12

---

Published as a conference paper at ICLR 2026
Kumaraguru, Uday Tupakula, Vijay Varadharajan, Ruoyu Wang. Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. The WMDP benchmark: Measuring and reducing malicious use with unlearning. In Proc. ICML, pp.
2024b.
Yuanzhi Li, Sébastien Bubeck, Ronen Eldan, Allie Del Giorno, Suriya Gunasekar, and Yin Tat Lee. Textbooks are all you need II: phi-1.5 technical report. arXiv:2309.0544 09.0099,.,6,,.., 2023b.
Chin-Yeu Lin. ROUGE: A package for automatic evaluation of summaries. Proc. ACL Workshop on Text Summarizatiin Branches Out, pp. 74 81, 2004.
Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57(2):1-36, 2024.
Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, Kush R. Varshney, Mohit Bansal, Sanmi Koyejo, and Yang Liu. Rethinking machine unlearning for large language models. Nature Machine Intelligence, 7:181-194, 2025.
Xinyang Lu, Jingtan Wang, Zitong Zhao, Zhongxiang Dai, Chuan-Shema Foo, See-Kiong Ng. and Bryan Kian Hsiang Low. WASA: WAtermark-basee source attribution for large language model-generated data. In Proc. ACI. 2025.
Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. Eight methods to evaluate robust unlearning in LLMs. arXiv:2402.16685,, 2024.
Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J. Zico Kolter. TOFU: A task of fictitious unlearning for LLMs. Proc. COLM, 2024.
Thanh Tam Nguyen, Thanh Trung Huynh, Phi Le Nguyen, Alan Wee-Chung Liew, Hongzhi Yin, and Quoc Viet Hung Nguyen. A survey of machine unlearning. arXiv:2209.02299. 2022.
Lip Yee Por, KokSheik Wong, and Kok Onn Chee. UniSpaCh: A text-based data hiding method using unicode space characters. J. Syst. Softw. 8575):0075 2012.
Jipeng Qiang, Shiyu Zhu, Yun Li, Yi Zhu, Yunhao Yuan, and Xindong Wu. Natural language watermarking via paraphraser- based lexical substitution. Artificial Intelligence, 317:103859, 2023.
Ryoma Sato, Yuki Takezawa, Han Bao, Kenta Niwa, and Makoto Yamada. Embarrassingly simple text watermarks. arXiv:2310.08920, 2023.
Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models. In Proc. ICLR, 2024.
Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A Smith, and Chiyuan Zhang. MUSE: Machine unlearning six-way evaluation for language models. In Proc. ICLR, 2025.
Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. Reflexion: Language agents with verbal reinforcement learning. Proc. NeurlPS, 2023.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In Proc. IEEE S&P. pp. 3-18, 2017.
Nianwen Si, Hao Zhang, Heyu Chang, Wenlin Zhang, Dan Qu, and Weiqiang Zhang. Knowledge unlearning for Ilms: Tasks, methods, and challenges. CoRR, 2023.
David Marco Sommer, Liwei Song, Sameer Wagh, and Prateck Mittal. Athena: Probabilistic verification machine unlearning. PoPETs, 2022(3):268-299) 2022.
Ayush K Tarun, Vikram S Chundawat, Murari Mandal, and Mohan Kankanhalli. Fast yet effective machine unleariigg. IEEE TNNLS, 350)):3306-111 13446-1355,5 2023.
13

---

Published as a conference paper at ICLR 2026
Pratiksha Thaker, Shengyuan Hu, Neil Kale, Yash Maurya, Zhiwei Steven Wu, and Virginia Smith. Position: LLM unlearning benchmarks are weak measures of progress. arXiv:2410028879, 2024.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Bsiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshom, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nic, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, lliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. Llama 2: Open foundation and fine-tunet chat models. arXiv:2307.09288. 2023.
Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226- 247, 2022.
Qizhou Wang, Bo Han, Puning Yang, Jianing Zhu, Tongliang Liu, and Masashi Sugiyama. Towards effective evaluations and comparisons for LLM unlearning methods. In Proc. ICLR, 2025.
Ruihan Wu, Chhavi Yadav, Russ Salakhutdinov, and Kamalika Chaudhuri. Evaluating deep unlearning in large language models. arXiv:2410.15153 2024.
Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma. Feng Wang, and Nenghai Yu. Tracing text provenance via context-aware lexical substitution. In Proc. AAAI, pp. 11613-11621, 2022.
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang, Zezhou Cheng, and Xiang Yue. Machine unlearning pre-trained large language models. arXiv:2402.15159, 2024.
KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust multi-bit natural language watermarking through invariant features. In Proc. ACL, 2023.
14

---

Published as a conference paper at ICLR 2026
A RELATED WORKS
A.1 UNLEARNING METRICS
Unlearning algorithms are often evaluated based on their (a) unlearning effectiveness, (b) utility preservation, and (c) unlearning efficiency (Li ct al. 2024a). We first briefly discuss (b) and (c). (b) Utility preservation refers to how well the LLM maintains its performance and usability after unlearning, and can be measured with performance indicators (e.g., perplexity, accuracy) on the retain set or various downstream tasks (Chang et al., 2024b). These performance indicators can include those used for (a) below, but evaluated on the retain set instead of the forget set. (c) Efficiency of an unlcarning algorithm can be assessed based on how much time and resources it saves compared to retraining from scratch (Li et al. 2024a Nguyen et al., (022). See Sec. 4 of (Liu et al. 2025) for deeper discussion about other unlearning effectiveness, utility preservation, efficiency, and scalability metrics. (c) is not the focus of this work. Water rDrumm is designed to evaluate (a) unlearning effectiveness (Sec. 3) but may also evaluate (b) utility preservation on the retain set (Sec. [5.1.
(a) Unlearning effectiveness metrics. Broadly, unlearning effectiveness refers to how well the influence of the forget set is being removed from the LLM. There are a few classes of such metrics:
Utility-based metrics are a form of utility-centric metrics that expect the model utility (performance indicators), when evaluated on the forget set, to worsen after unlearning. Utility- based LLM unlearning metrics include ROUGE-L (Lin 2004), Truth Ratio (Maini
ct al. 2024), and KnowMem (Shi al. 2025 Their definitions can be found in App.
and the disadvantages of utility-centric metries are already described in Sec. 2
Membership inference attack (MIA)-based metrics expect the ability or probability to infer the membership of a data point in the forget set reduce significantly after unlearning. Some MIA-basee metrics are also utility-centric as membership inference may depend on performance indicators such as perplexity and the log-likelihood of tokens in the text data (Shi et al. 2024). However, MIAs (Shokri et al. (017)) have demonstrated limited success against LLMs (Duan al. 2024) and their performance is adversely affected by the presence of similar data in the forget and retain sets.
Watermark- based metrics embed signals in the forget set and expect the values of these signals to decrease after unlearning (Li et al., (004a). Our WaterDrum falls under this class but is the first metric that can be applied to LLMs. Existing watermark-based unlearning metries are designed to only work for image datasets and classification models. For example, the work of Guo et al. (2023) has embedded invisible backdoors in images with incorrect target labels and the success of unlearning is measured by a drop in the success rate of backdoor attacks. The work of [Sommer et al.) (2022) has introduced a probabilistic verification framework for backdoors, in which users modified their data prior to submission. We will highlight the key differences of our work here: (i) These works rely on label-based predictions and face challenges such as generalization effects, confficting backdoor patterns, or backdoor defences. In contrast, on adapting watermarking to LLMs where longer and more complex output sequences provide richer signals for unlearning verification. (ii) In these works, the model utility is compromised even before unlearning, especially when the forget set is large. In contrast, our
work focuses
has minimal impact on the model utility because it is based on the robust watermarking framework called Waterfall that satisfies desideratum WO] as shown in App. G.I (ii) Most importantly, existing watermark- and backdoor attack based metrics are limited to image data and cannot be directly applied as unlearning metrics to text data due to additional challenges such as in preserving data fidelity (Guo al., 2023 Sommer
et al. 2022).
Unlearning metrics can also be classified based on whether they are retraining-based or non-retraining- based. Retraining is commonly viewed as the gold standard in classical unlearning settings (Bourtoule et al. 202 Cao & Yang 2015 Golatkar et al.) 2020). This has led to various evaluation metrics that assert how closely an unlearned model approximates a retrained one, such
as via matching performance on the forget set (Chundawat et al. 2023b; Golatkar et al. (2220) or G0laakGo
measuring distances in weights and activations (Chundawat et al. [023a]] Golatkar et al. 2021 Tarun
et al. 2023). However, retraining L.LMs is often infeasible due the scale of model parameters
15

---

Published as a conference paper at ICLR 2026
and the volume of pretraining data. In addition, trraining-basse metrics contradict the premise of unlearning that emphasizes the unavailability of a retrained LLM.
Therefore, centrretaining-- reesaining-bbsed based metrics are more important and aligned with the growing trend of commercial LLMs that only provide black-box access. The work of Chundaaaat et al. (2023a) has proposed the ZRF score that captures the randomness in LLM predictions as indicator of unlearning, while the work of Becker & Liebig (2022) has proposed to utilize a model's epistemic uncertainty. The work of Yao et al. (2024) has proposed that a surrogate subset with the same distribution as the forget set can be employed to approximate the performance of the retrained LLM. However, these metrics often overlook the LLM's ability generalize from pretraining or the remaining retain set. To address this, synthetic datasets, such as the TOFU dataset (Maini et al. 2024), are carefully crafted to ensure sufficient separation between the forget and retain sets. Nonetheless, such a separation (i.e., a low level of data similarity) is rarely achievable in real-world scenarios. In this work, we address these limitations by proposing a non-retraining- works despite a greater level of data similarity between the forget and retain sets and the generalization ability of LLMs. Additionally, our metric would work for multiple unlearning requests. Specifically, propose to use watermarking (Guo al. 2023 Sommer et al. 2022) to handle potential data similarities due to its ability to make each data point uniquely identifiable.
metric that
Note that our Wat errrum focuses on the unlearning scenario for data owners (See. 2 which is also known as "data influence removal" in (Liu et al. 2025). On the other hand, there exists another body of works in concept unlearning (i.e., also known "knowledge unlearning" in (Jang al. 2023 Si et al., 2023)) whose algorithms aim to remove certain knowledge from an LLM. The distinction between them is important when the forget set might contain concepts that are also present in the retain set, such as in our 'exact and semantic duplicate" settings. In Sec. 2 we have described our problem setting where even if one copy of the forget set to be unlearned, the concepts should remain in the LLM when other copies with similar concepts exist in the retain set. This is in contrast to knowledge unlearning where concepts from the forget set are to be removed no matter whether they are also present in the retain set. In the latter case, unlearning metrics that directly assess the model's ability to answer those concepts would better measure the success of unlearning, c.g., KnowMem (Shi et al. 2025).
A.2 EXISTING LLM UNLEARNING EVALUATION WORKS
The works of Maini et al. 2024); Shi et al. (2025) have proposed new unlearning metrics and benchmark datasets. The work of Li et al. (2024b) has proposed multiple choice question benchmark dataset called WMDP to evaluate the LLM's 's knowledge in biosecurity, cybersecurity, and chemical security. This benchmark dataset is different from TOFU, MUSE, and ours in nature because it is specifically for knowledge editing and only contains test data instead of training data. The work of Wang et al.) (202)) has suggested that an unlearning metric should be robust against (unchanged by) red teaming scenarios (such as recovering knowledge by jail-breaking, probing, relearning), and unlearning algorithms should be compared when they produce unlearned models with the same utility/perfommane on the retain set that is realized by mixing the parameters of the LLM before and after unlearning. The work of Wu et al. (2024) has proposed new perspective of fact unlearning and an accompanying synthetic dataset. In contrast, we propose a novel set of unlearning metric desiderata, which is satisfied by WaterDrum, to address realistic settings, such as when the forget and retain sets have semantically similar content and when retraining impractical. Our desiderata are not intended to be exhaustive and can complement that of existing LLM unlcarning evaluation works. The work of Lynch et al. (2024) has proposed a suite of adversarial metrics resurface forget set-related knowledge that exists in the unlearned LLMs, such as jailbreaking prompts, relearning (via fine-tuming and in-context learning), and latent knowledge extraction. While these metrics employ text similarity to the forget set in adversarial scenarios to evaluate the success of unlearning, watermarking uses the signal carried in the L.M''s text outputs to detect the influence of the forget set.
A.3 TEXT WATERMARKING FOR LLMS
Watermarking is an extensively studied technique for copyright protection, fingerprinting, and authentication (Liu et al. 2024 Wan et al. 2022). Watermarking consists of two main stages:
16

---

Published as a conference paper at ICLR 2026
embedding and detection where the watermark must remain imperceptible and robust against removal attacks (Wan et al. (022). Unlike digital images where continuous signals facilitate imperceptible watermark embedding, text watermarking is more difficult due to its discrete nature and susceptibility to text modifications (Liu et al. 2024).
Existing works on text watermarking for LLMs can be classified into two modes: (1) watermarking for a model owner and (2) watermarking for data owners. These modes differ based on who uses them (i.e., model owner vs. data owners), input (i.e., generic LLM query vs. existing source text data), and scalability (i.e., supporting a single model owner vs. multiple data owners). Most existing works fall under (1) watermarking for a model owner and its purpose for the LLM owner and users of the LLM to distinguish if some text output is generated by the LLM. A single model owner can embed watermark into the I.L.'s s newly generated text outputs during inference time by changing the sampling distribution during the autoregressive generation process (Dathathri et al. 2024, Kirchenbauer al. [023] Kuditipudi et al. 2024), watermarking the LLM's weights (Li et al., 2023a), and post-hoc watermarking the LLM's generated text outputs (Chang et al. 2024a
Hao et 2025).
Our work aligns better with the other mode instead, i.e., (2) watermarking for multiple data owners. In this mode, data owners want to independently verify if their text data still influence the LLM. This involves multiple data owners watermarking their existing text data (c.g.. news agencies watermarking their news articles) to trace their downstream usage, such as in LLM training. Therefore, the primary concerns of (2) differ from (1)-there is need for stricter preservation of the semantic content of the text (i.e., the fidelity desideratum (W)) and scalability to support a large number of data owners concurrently. (2) can be further categorized into (2a) non-LLM-basedd methods or (2b) LLM-based methods. Existing watermarking methods in (2a), such as inserting Unicode characters (Lu et al.
2025 Por al.] 2012] Sato al., (023) or synonym replacement (Qiang et al.) 2023) Yang et al.
2022 Yoo et al. 2023). are often easily detectable and susceptible to word replacement (Lau et al.
2024). On the other hand, syntactic-based watermarking methods are often constrained by the limited
choices of syntactic structures and require prior linguistic knowledge (Wan et al. 2022). Recently,
LLMs have emerged as a promising watermarking tool as they can generate natural-lookinn text and improve watermarking robustness. The work of Lau et al. (2024) falls under (2b) by proposing robust text watermarking framework called Materfall that is capable of embedding watermarks across data from multiple data owners (while preserving the semantic content of the original text) and also achieving watermarking robustness such that watermarks in the training data for the LLMs remain detectable in the LLMs' text outputs. The watermarked training data are then used train other LLMs. Our work builds on top of our adaptation of the Waterfall framework (Lau et al. 2024) develop our unlearning metric, i.e., WaterDrum. We have also considered adapting (1) watermarking methods for model owner for mode (2) and in our implementation of WaterDrum, as discussed in Sec. 5.2.
B FURTHER DISCUSSION ON UNLEARNING METRIC DESIDERATA (SEC.
B.1 SEPARABILITY DESIDERATUM D1
A separable unlearning metric (i.e., D1 should be a good classifier of whether an owner's data still influences an unlearned LLM, particular, the retrained LLM (P (i.e., achieved by perfect unlearning) trained only on Dz. To illustrate the difference between a separable and non-separable metric, provide toy example in Fig. Fjgff) With separable metric, an optimal threshold x² can be chosen where false positive and false negative classifications are minimal, as is the case for Wate e rDrum shown in Fig. Tig.35(0 (top right). However, for non-separable metries, any K chosen would result in similar true and false positive rates, as is the case for the utility-centric Truth Ratio metric shown in Fig. (bottom right).
B.2 CALIBRATION DESIDERATUR
D2
Ideally, perfect unlearning will completely remove the influence of the forget set. However, in practice, imperfect unlearning may be inevitable due to the size and complexity of LLMs. This is because (a) perfect unlearning involving retraining from scratch is prohibitively expensive and impractical, and (b) perfect unlearning L.MSs is not yet achievable with the current approximate
17

---

Published as a conference paper at ICLR 2026
DI. Quertes T. and X separable (AUROC
3.2
Retain
Density
Forget
2.4
misclassified
1.6
M(p.9g))
0.8
Forget Set g
-0.3
0.0
0.3
0.6
0.9
:J 2m misclassifted
WaterDrum Value
Retain Set R
Good clossification
Retain
DI. Queries and R are less separable (AUROC
Density
2.0
Forget
1.5
misclossifted
1.0
M(p.(g
0.5
Folse
Troe
0.0
Truth Ratio 1.0
misclussified
Figure 5: (Left) A toy example is provided to illustrate the intuition of the separability desiderata D1 Each represents an LLM's text output to query formed by a data point. Different x's correspond to different decision boundaries. In the top diagram, the metric and x* can clearly separate the LLM's text outputs to queries formed by the forget set vs. the retain set. In the bottom diagram, there is that can clearly separate them and the true and false positive rates always the same. (Right) Histograms of our WaterDrum vs. the utility-centric Truth Ratio metric values under the "semantic duplicate" setting of data similarity for Wate WaterDrum-ToFF dataset (Table 2 in Sec. 5) where Wat materDrum um exhibits clear separability over the Truth Ratio metric; see the caption of Fig. for detailed description.
unlearning algorithms without significantly harming model utility/performance (e.g., the retain set). In Sec. 5.I we demonstrate that all unlearning algorithms only achieve imperfect unlearning, except when the LLM is destroyed (i.e., it is influenced by neither the forget nor the retain sets) or when a new LLM is retrained from scratch.
Sec.5.11
With the calibration desideratum D2 characterization of imperfect unlearning becomes possible. D2 enables an unlearning metric to go beyond being just a binary indicator of whether the entire forget set has been unlearned being meaningful continuous measure of the extent which forget set D> has been unlearned:
The proposed linear proportional form (i.e., Eq. of D2 captures the goal that the unlearning metric can interpreted on its own and indicates the proportion D, that remains unlearned, while being given only single calibration data point (i.e., the aggregate unlearning metric value of the forget set on the original LLM) available before unlearning. This contrasts with existing utility-centric metrics, which require another calibration data point (i.e., the aggregate unlearning metric value of the forget set on the retrained LLM) and hence violate a), as discussed in Sec.
Our experiments (Fig- and Table 3) show that WaterD this intuitive interpretation when LLMs are retrained with the retain set Dr and varying proportions of the forget set |/[
satisfy D2 enabling
Fig. provides an intuitive illustration of the calibration desideratum where the metric measures the extent of imperfect unlearning. D2 is practically useful in the following cases:
1. Deployment: In practice, model owners may only achieve imperfect unlearning of the forget set to some extent while preserving the utility/prformance of their LLM for customers. A calibrated continuous unlearning metric value satisfying D2 can serve as objective proxy for negotiations with data owners on the required extent of unlearning and corresponding monetary compensation. The negotiated target extent can then guide the actual implementation of unlearning, e.g., by selecting the most suitable unlearning algorithm (since different algorithms achieve different forget-retain performance trade-offs, shown in Fig. guide the tuning of hyperparameters for given algorithm.
18

---

Published as a conference paper at ICLR 2026
2. Evaluation and development: For research and development, calibrated metric satisfying D2 enables evaluation beyond binary success/failure and instead continuously measures the extent of imperfect unlearning of the forget set. This supports more realistic and fine-graine fine-grained assessment of unlearning algorithms.
D2. Metric calibrated
M, Maes, (eo,,(p994a 3)
M can reflect extent of unlearning
Fraction of data that LLM y trained
Ø
Figure 6: A calibrated metric should continuously measure the extent of imperfect unlearning. On the horizontal axis, we simulate using different sized proportions of the red owner's dataset. [ requires the metric have value of 0 when the dataset is not used (y-intercept) and larger value when larger proportion is used. As shown in Fig. in Sec. WaterD is well-calibrated while other metries are not.
B.3 FEASIRILITY DESIDERATUM D3
In Sec. [ describe how utility-centric metric values, such ROUGE-L, cannot be interpreted on their own. Instead, their interpretation requires referencing the aggregate metric value of the forget the retrained LLM. For example, can compute the difference between the aggregate metric values on the unlearned vs. retrained L.MMs. For perfectly unlearned LLM (e.g.. the retrained LLM), the difference should become O. Note that although the difference satisfies our calibration desideratum D2 violates D3(a). a).
What happens when the aggregate metric value the retrained LLM is unknown? Any aggregate metric value (e.g.. ROUGE-L recall score) would not be informative; it is impossible for the model owner know whether the aggregate metric value indicates perfect unlearning or only imperfect unlearning, or to know how far the unlearned LLM is from perfect unlearning. In Sec. [] we do not reference the retrained LLM. The baseline metries computed using the unlearned LLM only do not satisfy D2 seen in Fig. 3
B.4 ROBUSTNESS TO SIMILAR DATA DESIDERATUS D4
In Secs. and 3 we suggest that is common for data owners to have semantically similar instances. Here, we provide concrete examples. Consider real-life scenario where two agencies, Reuters and The Straits Times (i.e., the data owners), produce semantically similar news articles, as shown in Fig. 7a These two articles from different data owners exhibit a high semantic similarity with an STS score of 0.90. In this case, only one agency may request unlearning. As another example the MaterDrum Ax dataset, Fig. 7b shows that the two arXiv paper abstracts from the same Materials Science category but different authors (i.e., the data owners) are also semantically similar with an STS score of 0.88. In this example, only one group of authors may request unlearning.
C FURTHER DISCUSSION ON WATERFALL
C.I OVERVIEW OF TARFAALL
Materfall (Luu et al. 2024) embeds watermark signals in text by paraphrasing the text while preserving its original meaning. For example, "The cat caught the rat" can be watermarked and
19

---

Published as a conference paper at ICLR 2026
Reuters
Brategionn
THESTRAISTTMES
SPORKT
Suturday
without ug condor condeettlo apaint the thes cress man the asstus Stecionn
mack loverrs book Rook god alse 1d coicon trcauh lise insirtaon
poolerpes Eike caperiiio
the Bush pard heoder Fomedl seaaity Edrise
Martyn Herman, City hang tough beat Inter
Manchester City beat Inter Milan win Champions League, clinch treble. The Straits Times: /ttps////ssssssntt Date of access: Apr 1, 2025.
and complete the treble. Reuter:
https://www reuterssswwwrerweeeeeeeeeee com/sports ieceeeeancchheeee
webbeat-nter-mlllnn--n---- www.llanwwwn.chhmplonnss-- www.-ccmmmooon-eeegueee wwwplooonnneeeee--ee wew.ueeee2u-eeeeeeee 2023-06-
10/. Date of access: Apr 1, 2025
(a) The news agencies, Reuters and The Straits Times, both produce news articles reporting on the same soccer match and hence have high semantic similarity with STS 0.90.
ABSTRACT
present the median surface brightmess profiles of diffiee Lya haloes (LAHHs) around stan-forming galaxies by stacking 155 spectm- scopically confirmed Lya emitters (LAIss) at 3 < 2 < in the MUSE Extremely Deep Field (MXDF) with median Lya luminosity of Leg 1051 erg 1 After correcting for systematic surface brightnest offiet we identified in
we detect extended Lyo emission out to a distance of =270 kpc. The median Lyo surface-brighnnss profile shows power-law decrease in the inner kpe and possible flattening trend at greater distance. This shipe similar for LAFs with different Iyo luminosities, but normalisation of the surface-brighine brightnes profile increuses with luminosity. At distances over 50 kpc, we observe strong overlap of adjacent LAHS, and Lya surface brightess is dominated by the LAHs nearby LAEs. We find no clear evidence redshift evolution of the observed Lya profiles when comparing with samples at 4 5 and < 6, Our results consistent with scenario in which the inner kpe of the LAH is powered by star formation the central galaxy, while the LAH beyond a radius of 50 kpc dominated by photons from surrounding galaxies.
ABSTRACT
The extended Lyo haloes (LAHH) have found be prevalent around high-redshift star-forming galaxies. However, the origin of the LAHs is still a subject of debate. Sputially resolved analysis of Lyo profiles provides an important dingnostic. We analyse the avenge spatial extent and spectral variation of the circumgalactic LAHs by stacking sample 155 emitters (I.AEs) redshift 3 < 22 a 4 in the MUSE Extremely Deep Field. Our anilysis reveals that, with respect to the Lya line of the turget LAE, the peak of the Lyu line large distances hecomes increasingly more blueshified up lo projected distance of kpc (zr 3x virial radius), with velocity ollset
250 km/s. This trend is evident in both the mean and median stacks, suggesting that LAE sample, which typically has Lyi luminosity 19 erg 1 However. due the absence of systemic redshift data, remains unclear whether the Lyer line peak at large projected distances is less redshiffed compared to the inner regions or truly blueshifted with respect to the systemic velocity. We explore various scenarios explain the sege-seale& kinematics of the Lya line.
a general property of our
(b) the WaterDrum- Ax dataset, the two arXiv paper abstracts from the same Materials Science category but different authors both present similar content and hence have high semantic similarity with STS 0.88.
Figure 7: Examples of high semantic text similarity (STS) in different domains.
paraphrased as "The rat was captured by the cat" while preserving the same meaning and not affecting
downstream uses of the text (e.g., when used for LLM training). We will briefly describe the watermarking and verification operators below and refer the reader to the work of Lau et al. (2024) for more details. The watermarking and verification processes of Waterfall do not require the training of any LLMs.
Watermarking Operator. Waterfall uses an off-the-shelf LLM as a paraphraser, which preserves the text's original meaning, and embeds token-level watermark perturbation signals to the LLM's logits while generating the paraphrased text. Specifically, the token-level perturbations depend on the data owner's key (ID) and preceding tokens such that, average, the perturbation is equivalent to adding random noise to the LLM's logits. Technically, at each token generation step, this involves (i) a permutation of the vocabulary space ordering based the ID and preceding tokens, combined
20

---

Published as a conference paper at ICLR 2026
with (ii) ID- ID-dependent orthogonal perturbation functions that allow desirable properties such the ability to add multiple watermarks in the same text. The watermarking operator is summarized in Algorithm in (Lau et al. 2024
Verification Operator: With knowledge of the data owner's 's key (ID), it becomes possible to find
the 'right' permutation to verify whether there has indeed been any signal embedded into the text not. Technically, this involves simply accessing the correct vocabulary token space permutation. If watermark has been embedded, doing dot product in this permuted token space would yield signal. Else, on average, only noise will be present, hence no signal will be detected. The verification operator is summarized in Algorithm 2 in (Lau et al. 2024). It does not involve any LLM inference or training and can be run on a CPU.
We discuss practical deployment details and computational cost of Waterfall in App.
C.2 WATERFALL AND WATERMARKING DESIDERATA
Waterfall satisfies the watermarking desiderata required for WaterDrun, as stated in Sec. Specifically,
Fidelity:: Waterfall 1 Lau et al. 2024) is designed to satisfy a fidelity desideratum and ensure that the watermarked text semantically similar to its unwatermarked version. Fidelity is ensured by using an LLM as a paraphraser and adding watermark signals to the LLM logits when generating tokens (such that, on average, the perturbation is equivalent to adding random noise).
Evidence. App. H.3 in (Lau et al. 2024 shows that the LLMs fine-tuned using watermarked vs. unwatermarked datasets have minimal difference in fidelity. In App. [..T. we also empirically verify that the watermarking process has minimal impact the LLM's performance (c.g., Truth Ratio).
Verifiability: (a) Materfall would produce high verification score if the watermarked text and the correct corresponding watermark key are inputs to the verification operator (Algorithm 2), and score with an expected value of 0 otherwise (c.g.. if the wrong watermark key or unwatermarked text is used). Intuitively, this is because the verification score is the dot product of the watermark signal and the average cumulative token distribution, which is almost uniform noise without the right watermark key and watermarked text. (b) Waterfall's verification score can be aggregated by taking the uniform average over all d E 'Dz. When the LLM is trained on a larger subset of the forget set, more LLM outputs will contain the watermark, such that the aggregate metric value increases proportionally.
Evidence. (a) Sec. 4.3 in (Lau et al. 2024 has shown that Waterfal 11 is verifiable in the LLM fine-tuned on watermarked text with AUROC of 1.0 when evaluated on 100 queries of 100 generated tokens each. We empirically verify this with the WaterDrum-25 -OFU and
Wa WaterDrum Ax datasets in Sec. 5 (under 'Separability desideratum DI ). (b) We further
show empirically that the verification score of Waterfall is also proportional the size of the subset of the forget set in Sec. (under 'Calibration desideratum D2)
W2 Overlap verifiability: Waterfall (Lau et al. 2024) designed such that different watermark keys correspond to different permutations and perturbations of the logits in the
LLM paraphraser. With pseudorandom permutations of the LLM logits and watermark signals (added to the LLM logits) that are defined with orthogonal functions, different watermarks are less likely to interfere with one another.
Evidence. Sec. 4.3 in (Lau et al. 2024) showed that Waterfall 1 remains verifiable in an LLM when the training data has texts with up 100 different watermarks. We empirically verify W2 with the WaterDrum Ax dataset in Sec. 5 (under 'Separability desideratum D1
Query access constraint: Algorithm 2 in (Lau et al., 2024) for performing watermark verification only requires the suspected text (i.e., text output of the L.LM), and does not require any other access to the LLM which generates the text.
W3
Unique key: Waterfall (Lau et al.] 2024) is designed to satisfy a scalability desideratum since it has theoretical maximum of 10130271 unique watermark keys due its
W4
21

---

Published as a conference paper at ICLR 2026
vocabulary permutations and orthogonal perturbations. This is in contrast the maximum of 10 for other text watermarking frameworks (Lau et al. 2024). This allows different
data owners to have different unique keys, and it is extremely unlikely that different owners end up with the same key by random chance.
Evidence. App. E.8 in (Lau et al. 2024) empirically shows that the watermark is verifiable for up to 100, 000 random unique watermark keys.
Furthermore, Waterfall also satisfies the additional desiderata described in App. D
W5 Privacy: Algorithm 2 in (Lau et al. 2024 requires the private watermark key for watermark verification. As the watermark is embedded in the phrasing the text, Waterfall's watermark key cannot be directly easily extracted from the watermarked text.
Evidence. The work of Lau al. (0224) has compared Waterfall with other text watermarking frameworks in Sec. 4.1 (Robust verifiability) and App. F.3. Other text
watermarking frameworks (Lu al.] 2025 Qiang et al.) 2023] Sato et al., 2023 Yoo
let al. 2023). unlike Waterfall 1, have watermark keys that can be directly extracted from the text, causing them to be easily exploited and fail the following desideratum W6 We further discuss this in App.D)
W6 Resilience:
Waterfall's robustness relies its unique token-level embedding process such that completely removing its signal will require so many token changes in the text that would likely destroy its original meaning.
Evidence. Sec. 4.1 (Robust verifiability) in (Lau et al. 2024) has evaluated Waterfall on range of word-level and passage- level modifications, well additional rounds of text watermarking and L.L--aided attacks, and has shown that Waterfa remains verifiable after those attacks unlike other text watermarking frameworks. We also further demonstrate that Wat eaterDae rum with Waterfall is resilient to the model owner intercepting queries and attacks using watermarking methods for a model owner in Apps. D. and D.3
respectively.
In general, any watermarking method that satisfies our watermarking desiderata can be used within our WaterDrum. To the best of our knowledge, Waterfall is the only text watermarking method for data owners that satisfies our requirements as of now, and is thus used in our paper. However, as discussed in Sec. 5.2 it is possible to adapt other watermarking methods for a model owner to satisfy our requirements to some extent and we expect more watermarking methods to work with future developments in text watermarking.
C.3 WATERMARKING OF DATASETS WITH WATERFALL
Watermarking and verification of the training text data have been performed with Materfall (Lau et al. 2024) using the default configuration of the code available on https://githuu htt.:hhwh...ooeeoeeeommeeeeeee http///o///////arfffee
When creating our WaterDrum-Ax and MaterDrum- TOFU datasets, the data is watermarked using the default LLM meta -ita-1lama// wel.1amaaaaaaa /Llamalaaaa 3. 3.1-... 1- Instruct with watermark strength
and perturbation key kp = In App. G.3 we show that after LLMs are fine-tuned using text data watermarked with Waterfall, the watermark false positive and high true positive rates using just 59 generated tokens.
be verified in the text outputs generated from these LLMs with low
To create the watermarked WaterDrum-AA and RaterDrum-TorF datasets, consider the scenario where each data owner E T with ID i for i = 0, 0, T has its own unique watermark key l4. This ensures that each data owner is able uniquely verify and evaluate the influence of its own data on the LLM when fine-tuned on its data and after any possible unlcarning has been done on the fine-tuned LLM. For simplicity, we set μi to be i when watermarking our datasets with Waterfall. For the experimental settings where duplicate data is considered (see Sec. [ specifically, under 'Robustness similar data D4 )), each data owner f E F whose data Dj is in the forget set D, and duplicated would have another data owner j E T (where j # f) owning
NNoe that this x is the watermark strength, defined in Waterfall 1 (1 Lau al. 2024 and not the same
the separability threshold defined in the separahility desideratum Di
22

---

Published as a conference paper at ICLR 2026
the duplicate of owner f's data D, and watermarking this duplicate with its watermark key jý. The practical motivation for data owners with similar data is discussed in App. B.4
To create the WaterDrum-AA dataset, consider |T| 20 unique data owners where each i-th category among the 20 categories of paper abstracts belongs to a single data owner i and is watermarked with its watermark key μ4, = for i 0, 1, ..... 19. This emulates the setting where model owner is aggregating data from 20 sources of academic publications where each source centers on single academic discipline. To construct a forget set that consists of data from data owners, the data from the last n of the [T] data owners are used as the forget set, while the data from the first [T] - data owners forms the retain set. For instance, when unlearning the data from data owner, the data from data owner i = 19 is the forget set. When unlearning the data from 5 data owners, 15, 16, 17, 18, 19 forms the forget set. For the experimental settings where duplicate data is considered as discussed above, the next data owner owns the duplicate of the data D, from the previous data owner I and watermarks it with P4 = before including it into the augmented retain set. For licensing information on individual papers in the WaterDrum: Ax dataset, see
the data from data owners
(f + 1) mod [
To create the WaterDrum-ToOe dataset, we started off with the TOFU dataset (MIT License) and followed their construction in (Maini et al. 2024) by considering just two data owners 0 and 1 with the retain and forget sets, respectively. The retain set is watermarked with key 1i O, while the forget set is watermarked with key = 1. For the experimental settings where duplicate data is considered discussed above, data owner 0 owns the duplicate of the forget set from data owner 1 by watermarking it with μо0 = 0 before including it into the augmented retain set.
As a disclaimer, note that as part of Waterfall's watermarking process, the original text data is paraphrased using an LLM. Although efforts have been made to ensure that the watermarked text retains high semantic similarity with the original text (see the work of Lau et al. (2024) and pttps:::.. / thub. com/ ao 1..3311 31 3142/ Waterfall) we cannot guarantee the faithful reproduction of all content from the original text nor the factual correctness of the watermarked texts. In practical unlearning applications, additional (automated or manual) checks can be performed on the watermarked text to ensure accuracy and consistency to the original text as described in Lau al. (2024), such using Reflexion (Shinn al. 2023). To reduce the computational cost, we have omitted these steps from our watermarking process. Despite this, similar to the fully fictitious TOFU dataset introduced by the work of Maini et al. (2024), WaterDrun-AA and WaterDrun-ToFU still serve as suitable datasets when used for the purpose of evaluating unlearning metrics and algorithms where the factuality of the content in the dataset is not relied upon.
C.4 PRACTICAL DEPLOYMENT PIPELINE FOR WA TERDRUM WITH MA MATERALL FOR LLM UNLFARNNN EVALUATION
The watermarking process of WaterDrum is lightweight and incurs very little computational cost. This makes the watermarking process simple and convenient for data and model owners during real-world deployment:
Data owners can quickly watermark their data before sharing them with model owners or releasing important data publicly. This not only facilitates unlearning verification but also allows them to detect whether their data has been used by model owners without authorization (Lau et al. 2024) Maini et al. 2024).
No changes are required by the model owners who can continue training closed-source LLMs, provide API access, release open-source models.
Data owners can detect whether their data has been used for fine-tuning (even in closed-source LLMs) based only on the LLM's text outputs. After submitting an unlcarning request, they can verify the extent of unlearning via WaterDrum.
In comparison, other LLM unlearning metrics face severe deployment barriers, such as requiring to reference retrained LLM (Secs. [ and 2). which is infeasible even for cooperative model owners due to the computational cost.
The overhead of watermarking the training data is minimal compared to the cost of retraining the entire L.M.M Watermarking the WaterDrum-Tor dataset using implementation of Water faterfall with
23

---

Published as a conference paper at ICLR 2026
the vLLM library (Kwon et al. 2023) GPU takes only 10 seconds per 1000 data points and is performed only once when data is first contributed. In contrast, the cost of retraining the entire LLM is around 1h 30min, which is x higher than the cost of watermarking the training data. Furthermore, retraining has to be repeated for every unlearning request.
In addition, our framework also reduces the verification costs. Verification of the Waterfall 1's watermark is very efficient (Lau et al., 2024), requiring about seconds per 1000 query outputs on CPU. In contrast, the computation of ROUGE using the rouge-score library takes around 170 seconds per 1000 query outputs, which is two orders of magnitude slower.
A limitation is that WaterDrun requires watermarking the data before training and cannot be applied retroactively to data that has already been released. However, this practical concern will likely diminish with time and be mitigated due the following reasons:
Recalling already released data may be possible in our unlearning setting as data owners have the rights their data and can control their use, as discussed in Secs. and Therefore, data owners of released data can still exercise the rights to their data by telling the model owner that they would (i) require their updated watermarked data to be used in the LLM instead, or (ii) consent to the continued use only if watermarking is to be part of the data processing step the next L.M release. In either case, the model owner must comply with laws and regulations such as the GDPR and copyright laws.
Even without recalling historical and released data, the data owners can demand that watermarks be applied going forward in future LLMs. They can expect newly generated data be watermarked, hence facilitating future practical LLM unlearning evaluations. For example, news agencies can start watermarking their news articles and these recent articles may be more important in training future LLMs.
As awareness of privacy and security in LLM training grows, we expect proactive watermarking of data before release to become a common practice among data owners and the applicability of WaterDrum to grow over time.
similar concept called image watermarking in the domain of computer vision has been widely studied and adopted for image data copyright protection (Cox et al. 2008). We note that when applicationn of image watermarking are proposed, such as data backdoors to verify unlearning (Thaker et al.) 2024). they also face the same constraint that image watermarking can only be applied to unreleased data (and cannot be retroactively embedded in historical data). The community has accepted the constraint and appreciated the potential benefits going forward. Thus, there are strong reasons to believe in the potential for wider adoption text watermarking and its applications.
D RESILIENCE DESIDERATUM
In Remark 2 in Sec. we raise the following question: Is WaterDrum still effective unlearning metric if (i) the model owner tries to reduce its LLM's aggregate metric value without directly performing unlearning or copyright its LLM via watermarking for model owner (Kirchenbauer et al. 2023) or (ii) some data owner(s) try to report inflated aggregate metric values to understate the unlearning performed by the model owner?
In this section, we explain when the answer is yes. In particular, the underlying watermarking framework should additionally satisfy the following desiderata:
W5 Privacy. Each data owner i's watermark key μ4 should be private and unknown to the model owner. Verification of the watermark with the verification operator should require the private watermark key. Moreover, the watermark key should not be easily extractable from the watermarked text. This prevents others without the watermark key (e.g., other data owners, model owner) from verifying whether some text contains the watermark and computing the metric value without owner i's permission.
A private watermark may be required to support W6
24

---

Published as a conference paper at ICLR 2026
W6 Resilience. The watermark should remain W1 verifiable in the LLM's text outputs after attacks by the model owner. These attacks should have minimal impact on the semantic similarity of the LLM's text output and should not significantly affect the value of the LLM (as in W0 the model owner is still interested in deploying a usable L.M.
Our adopted watermarking framework, Waterfall, satisfies W5 the verification operator requires the private key and the watermark key cannot be extracted from the watermarked text (Lau et al. 2024). In contrast, other watermarking frameworks do not satisfy W5 Frameworks that use invisible Unicode watermark key (Lu et al. 2025 Por et al. 2012 Sato et al. 2023) have their watermark keys plainly exposed in the watermarked text. while frameworks using synonym replacements (Qiang et al. [023] Yang et al. 2022] Yoo et al. (023) have watermarks that can be easily extracted from the watermarked text when the verification operator is known. The extraction enables the model owner to compute the metric value and remove or replace the watermark in the LLM's text outputs, which results in these other watermarking frameworks failing to satisfy [
We analyze whether Waterfall 1 satisfies W6 in this section. We consider attacks, which include (a) the model owner intercepting the LLM's text outputs based on a proxy indicator SS such as semantic similarity with forget set (App.D.T)) (b) watermarking for a model owner being applied to the LLM during its ruto-regressive generation (App. D.3), and (c) other modifications being made to the LLM's text outputs after generation (App. D.3).
We also consider that under W5 data owner(s) can falsely try to report inflated aggregate metric values understate the unlearning performed by the model owner in App. D.2
D.1 DECOY MODEL TO REDUCE AGGREGATE METRIC VALUE WITHOUT DIRECTLY PERFORMING UNLEARNING
Here, we consider the setting where the data owners requesting to erase their data from the LLM unaware of or cannot control how the model owner performs unlearning. Instead, they can only evaluate the unlearning by querying the updated model. Moreover, the model owner's 's interests may not align with those of the data owners. As performing unlearning produce the unlearned model i can be more costly, the model owner may want to avoid performing unlearning while still appearing to fulfil the data owners' unlearning requests. The model owner can attempt to reduce the aggregate metric value by using a decoy model Ø instead
Decoy model. The model owner implements the decoy model S. which involves using gating function to intercept any query qd received. For any metric M that the model owner can compute exactly, the model owner would intercept queries that result in large metric values, indicating that the original LLM (p is greatly influenced by the forget set Dz (e.g.. queries qa where M (VPTT(( (qa), f) > i for some ʃ E F), and replace the L.M''s text output (ya) with some text g(4a, DD) that reduces the metric value. For metrics that the model owner cannot compute exactly (e.g., metrics that require some information that is private to the data owner), the model owner can only resort to a proxy indicator SS that measures how similar the LLM's text output (T((a)) is to the text from the forget set Dy. The decoy model is defined as follows:
((qx) = { glga, Dz) if if E DD= SS(pT(ga),dd) B, { (PT((a))
(4)
otherwise;
with threshold value B determined by the model owner. Note that small B would intercept more queries and replace more of the LLM's text outputs. This may be more costly, reduce the overall LLM's performance, and may essentially be comparable to a full unlearning algorithm. How would using the decoy model affect the effectiveness of various unlearning metrics?
For metrics that do not depend on information private to the data owners (c.g., ROUGE-L), the model owner can compute them directly. So, the model owner can directly use the metric SS, set the threshold B to match the (learned) threshold x from DI and optimize the replacement text g(qa, Dr) that reduces the metric value. As SS and B can be more easily set, the model owner's decoy model
'Note that the model owner would have no incentive to do so when benchmarking different unlearning algorithms (Sec. (SIc. During benchmarking, the model owner (instead of the data owner) controls the training data and assesses the unlcarning effectiveness. The model owner would not deceive itself about the performance of their unleaming algorithms.
25

---

Published as a conference paper at ICLR 2026
attack will be more successful and less costly (from fewer interceptions). Thus, the metric is less resilient to the decoy model attack.
For metrics that depend information private to the data owners (e.g.. WaterDrum using Waterfall that satisfies W3). the model owner cannot compute them directly. Instead, the model owner can only define 5$ based some proxy indicator of similarity between the LLM's text output and data from the forget set Dz. The model owner would also have to tune B. A lower B would reduce the aggregate VaterDrum value (giving the impression of unlearning) but come at a high cost of replacing more of the LLM's text outputs and hence poor model utilityperformmace When using Water fall. the model owner can only generate replacement text 9(qa. Dy) with lower metric values by using unwatermarked text from other sources (e.g.. another LLM). This may further reduce the decoy model's performance. Thus, MaterDrum is more resilient to the decoy model attack.
Empirical Evaluation of WaterDrum. We prepare data D to form a set Q = dED of queries that result in the aggregate WaterDrum value being above a threshold K, i..., M (PT
K. To prevent the model owner from recognizing and intercepting the queries easily, data D are similar to but not directly based on the forget set Dy. For example, D is a set of arXiv paper abstracts from the math. PR category, and D consists of other such math paper abstracts not in Dy. The model owner can only use the proxy indicator of the STS score as SS and must choose the threshold B. Fig. Vig.Blploo plots the aggregate WaterDrum value against the percentage of Q being intercepted as the threshold B decreases. As the model owner decreases B, it potentially reduces the aggregate WaterDrus value via two effects: (i) diluting the aggregate WaterD value by replacing the LLM's text output (with watermark signal) with text from unwatermarked data sources, and (ii) the remaining unintercepted LLM's s text outputs are semantically more dissimilar to the original watermarked Dz. It can be observed that the aggregate Waterl reterrrunn rrr value decreases almost linearly with the percentage of intercepted queries, implying that the model owner only relies on effect (i) with no help from effect (ii), i.e., the model owner can only reduce the aggregate Water significantly by intercepting most queries whose resulting LLM's text outputs are semantically similar to Dz. This makes it very costly for the model owner to carry out the attack. For example, reducing the aggregate WaterDe rum value to 0.2 requires intercepting about 70% of the queries in Q, so the model owner may favor performing actual unlearning instead.
value
Resilience of WaterDrum
1.0
Decoy model
0.8
Only dilution
0.6
0.4
0.2
Agg.
0%
20%
40%
60%
80%
100%
Percentage of intercepted
Figure 8: Plot of aggregate WaterDrum value of the forget set the original LLM (oT against the % of queries in Q being intercepted as the model owner decreases the threshold B in the decoy model. An idcal unlearning metric would have its aggregate metric value decrease only proportionally with the % of intercepted queries (dashed orange diagonal line). WaterDrum achieves a similar performance, implying that the decoy model needs intercept a large proportion of queries to reduce the aggregate eDrum value significantly. The aggregate WaterDrum values are scaled such that the value is 1.0 when there no intercepted query.
D.2 DATA OWNER REPORTING INFLATED AGGREGATE WATERDRUM VALUES
When the watermarking framework satisfies W5 it is possible that data owner refuses to acknowledge that unlearning has been done and reports an inaccurate, higher than measured aggregate Wate rrrum value.
26

---

Published as a conference paper at ICLR 2026
To resolve this issue, trusted third party can certify the aggregate WaterDrum value reported by the data owner. To do so, the model owner provides access to the unlearned LLM " and the data owner i provides the watermark key μ4; to the trusted third party for verification. Verification should only he performed on a predefined set of queries with the agreement of both model and data owners. This prevents the model owner from repeatedly querying for the Wat errrum value to directly optimize the watermark removal instead of actual unlearning and from building a better decoy model in App. D.I The trusted third party can then certify to the model owner that the measured aggregate WaterDrun rrum value aligns with that reported by the data owner
D.3 DILUTION OF WATERDRUM'S WATERMARKS WITH WATERMARKING FOR A MODEL OWNER AND TEXT MODIFICATIONS
In certain scenarios, the model owner might want to watermark the newly generated text outputs of the fine-tuned LLM. This can either be for the legitimate purpose of copyrighting its LLM (i.e., being able to identify text outputs generated from its LLM) or in an adversarial attempt to dilute the watermarks in the training data. In this subsection, we empirically analyze whether Waterfal satisfies W6 and Wate MaterDin
is still an effective unlearning metric (i.e., satisfying the separability desideratum D1 and calibration desideratum D2) under these scenarios. We consider the model owner (I) using watermarking and (2) perturbing the LLM's text output after output generation.
As discussed in App. A.3 watermarking methods for a model owner may embed a watermark into the LLM's newly generated text outputs during inference time by changing the sampling distribution during the autoregressive generation process. These methods can be further categorized into (i) during logits generation, such as (Kirchenbauer et al. 2023). or (ii) during token sampling, such as (Kuditipudi et al. 2024). , Waterfall" watermarking mechanism (when adapted as watermarking method for a model owner) is similar to those in category (i), resulting in watermarks embedded in the LLM's logits distribution, and hence shares similar properties with other methods in category (i). For model owners to effectively remove category (i)'s watermarks without destroying text fidelity, they would need to apply the right distortions to cancel out the forget owner's 's watermark. However, since the forget owner's watermark key is private the data owners (W5), it is practically impossible for the model owner to extract the key with limited samples from the forget owner. The model owner can only apply random watermark signals, which result in random distortions on average. Waterfa a is designed to be robust to such random distortions, as we will show empirically below.
The work of Lau et al. (2024) has empirically shown that Waterfall 11 is robust various attacks, such as the watermark replacement attack (i.e., attack A3 in (Lau et al., (024)), where the original text watermark remains detectable even after the text has been watermarked again with a different text watermark. We also empirically evaluate the effectiveness of WaterD rum when the model owner uses various watermarking methods for a model owner.
First, we adapt the underlying watermarking operator of Waterfall's text watermarking framework for data owners to serve as a watermarking method for a model owner. Our experiments are performed using LLMs fine-tuned on the WaterDrum-ae Ax or WaterDrumg WaterDrum-ToFU dataset and applying watermark strength of = (i.e.. same as that used during text watermarking (App. C.3 with key 1120- = 20, which differs from the data owners' watermark keys (i.e., ,r = for 0, ...... 19). We choose the same watermarking method as the data owner to perform watermarking for a model owner because using a different watermarking method reduces the likelihood that the model owner can exactly cancel out the watermark signal embedded by the data owner. The strongest attack by the model owner would be to apply the exact same watermark method with a 'destructive interference' signal that introduces perturbations opposite to those of the data owner. However, in practice, the model owner cannot do so with high probability given W5
As the adaptation of Waterfall falls under category (i), we expect similar results from other watermarking methods for model owner in this category. Nevertheless, we additionally experiment with commonly used category (i) benchmark watermarking method for a model owner called KGW (Kirhhenbauer al. 2023) with the default watermark strength of 8 = 0.5. It can be observed from the results in Table 5 that the watermark signals are preserved
and green-list ratio of
post-attack. Note that due to differences in the underlying methodology of Waterfall and KGW,
Note that this x is the watermark strength, as defined in Waterfall (Lau al. 2024 and not the same the separability threshold defined in the separahility desideratum Di
27

---

Published as a conference paper at ICLR 2026
the watermark strength of === = 2n Waterfall and 6 = in KGW are not directly comparable, and the performance difference cannot be solely attributed to whether one watermarking method for model owner is "stronger" in affecting WaterDrum than the other. Additionally, while stronger watermarking for a model owner might potentially cause a larger drop in the text watermark's verifiabillity, the work Kirchenbbar al. (2023) has shown that strong watermarking for model owner also negatively affects the quality of the LLM's newly generated text outputs. Thus, it is not in the model owner's interest significantly degrade the LLM's performance simply to affect the data owners' ability to verify their watermarks.
As for category (ii) (i.e., also known as distortion-free watermarks), a seeded pseudo-random sampler is used in place of an unseeded random sampler during the generation of the LLM's 's text outputs (Kuditipudi et al. 2024). In this case, the text outputs are still generated from the token distribution of the underlying L.L.M and therefore practically indistinguishable from that of an unwatermarked LLM. This implies that the underlying token distribution, which contains WaterD Dum'ss watermarks, remains undistorted, hence preserving the watermark verifiability. In the experiments in our paper, no watermarking for model owner is performed and we use the default unseeded random sampler and generate 10 text outputs to each LLM's query (App. E.2). As result, would not expect text outputs from distortion produced by random sampling. Table 5 reports the results of inverse transform sampling (ITS) post-attack.
watermarking for a model owner to differ significantly from those
watermarking from (Kuditipudi et al. 2024) and again shows that the watermark signals are preserved
In Table 5 the AUROC and Rt² decrease only slightly with the dilution from watermarking for model owner. Thus, WaterDrum still preserves the separability desideratum DI and the calibration desideratum D2 well.
Table 5: Resilience of Water when the model owner applies various watermarking methods for a model owner.
Watermarking for Model Owner
D1
Separability (AUROC)
D2 Calibration (R2)
No dilution Adapted Waterfall (Lau et al. 2024
0.964
0.963
0.923
0.936
KGW (Kirchenbauer et al. 2023)
0.944
0.948
ITS Kuditipudi et al. 2024)
0.955
0.965
Perturbing the LLM's text outputs after generation. The model owner can use word level edits, such insertion, deletion, and synonym substitution attacks, passage level edits, such as paraphrasing and applying another text watermark to the LLM's newly generated text outputs. Note that such attacks not very practical realistic for the model owner: Word level edits can greatly affect the fidelity of the generated text (Lau et al. 2024), while passage level edits are computationally costly for the model owner, increase latency of the LLM's text outputs to queries, and would not support streaming of the LLM's 's text outputs. Nonetheless, Wat e fallll has been demonstrated to be robust these attacks (Lau et 2024) and the same robustness would translate to Water watermarks.
All all, this subsection shows that Waterfall satisfies W6 and WaterDrum thus resilient to attacks by the model owner.
E DETAILS ON EXPERIMENTAL. SETUP
We conduct our experiments on NVIDIA L40 and H100 GPUs. The experimental results are averaged across 3 random seeds 41, 42, and 43. Text generation from the different LLMs uses temperature = 1, top-p 1, and top-k left the LLM's vocabulary size. We use sentence-tzr teneetrransfeee forerrs /aterr/aallla aal--mpeetttaeeeeeeeeeeee -bse-v2 as the STS model to evaluate STS scores. More details on experimental setup are presented below.
28

---

Published as a conference paper at ICLR 2026
E. TRAINING HYPERPARAMETERS
Models fine-tuned on WaterDrum-Aa dataset. We fine-tune the bffoat16-pretrainee Llama-2-7B model from Hugging Face using LoRA (Hu al. 2022) (based on 8 and 32) with batch size offoat16-pretrained pretrained Phi-1.5 model (detailed in App. F33 under the same settings. Following the model choices in (Maini et al. 2024), we have considered these two models as they are representative of the recent LLMss and difter terms of architectural details and scale.
of 128, 20 training epochs, and learning rate 10 Additionally, we fine-tune the bfloat16
Models fine-tuned on WaterDrum-ToRe TOFU dataset. We fine tunetune the b 6-pretrained Llama-2-7B-o 2-hhcht model from Hugging Facq" using LoRA (Hu et al. 2022) (based on r
and a = 32) with batch size of 128, 10 training epochs, and learning rate 10
Subsequently, for unlearning, we use batch size of 32, While we conduct our experiments using LoRA as in other LLM unlearning works (Maini et al.] [0224] (Sh et al. (025). we also demonstrate in App. F2 that WaterDrum applies to full parameter fine-tuning.
E.2 QUERIES FOR FINE-TUNED LLM
For the WaterDrum Ax dataset, we simulate completion task by querying the LLM with the first 50 tokens of the training data for the LLM to complete the text. For the WaterDrum-Ton TOFU dataset, we simulate QA task by querying the LLM with the questions formatted according the LLM's prompt format. We generate 10 text outputs to each LLM's ss query and calculate unlearning metric by taking the mean of their resulting values. We generate up to a maximum of 200 tokens for each LLM's query.
E.3 BASELINE UNLEARNING METRICS
ROUGE-L measures the longest common subsequence between the LLM's 's text output and reference text. This serves as a surrogate for the generation quality for the eat rum-Ax dataset and the question answering (QA) accuracy for the Wat e D Dw-DumTTTO'" dataset. To calculate the metric value, we follow the works Maini et I 2024); Shi et al. (2025) by computing the ROUGE-L recall scores (Lin 2004) to compare the I.MM's text outputs with the reference text in the training data. Specifically, we evaluate the ROUGE-L metric value when measured on the text output y (qa) to the query qa formed by each reference text data point and comparing pp (9())) with d, i.e., ((pp((a)) = ROUGE-L(Pp (() d).
Truth Ratio measures the probability of generating a correct vs. wrong answer as an indicator of whether the LLM still memorizes the knowledge to be unlearned WaterDrum- TOFU dataset. Following the work of Maini et al. (2024), for each given question, the ratio is computed using the average probability over multiple wrong answers divided by the probability a paraphrased correct answer.
the
KnowMem measures the ROUGE-L recall scores between the LLM's text outputs vs. reference text answers to the questions in the QA pairs based on the training data, dataset. so as to reflect the LLM's s memorization of the knowledge on the WaterDrum: Specifically, following the work of al. (2025), we GPT-4 create QA evaluation set with 8000 QA pairs based on the abstracts in the WaterDrum-Ar dataset and measure the ROUGE-L recall score between the LLM's text output to each question/query and the corresponding reference text answer.
MIA measures the separability the forget set that might still influence the LLM (e.g., due to imperfect unlearning (Sec. ( vs. the holdout set that does not (since it is not used to train the LLM). We use the holdout set given in the WaterDDuu-TTOn
dataset, and collect additional 2000 abstracts (100 for each subject category) as the full holdout set for the Wat eaterrruue rum Ax dataset. In our experiments in Sec. (specifically, under 'Calibration desideratum D2 ). avoid imbalance, we randomly sample from the full holdout set to form holdout sets of different sizes that match the varying subset sizes & of the forget set (App. H.5 To perform MIA on L.Mss, we adopt the MIN- % PROB attack with
httpas://wggiiofocccc///ttat///a 2 78- chat-hf
http::///uggiingfcccccc//rtette
29

---

Published as a conference paper at ICLR 2026
K 40 (Shi et al. PROB values of the LLMs' text outputs to queries formed by the forget set vs. the holdout set where the MIN-K % PROB value is defined as the average log- legllkklihhodd of the 40% output tokens with the lowest probabilities. The AUROC of MIA on a perfectly unlearned LLM is close 0.5. To align our evaluation with other baselines (where lower aggregate metric values indicate better unlearning), we report the aggregate metric value for MIA as MaED> (p. F) 1
2024). Specifically, we the AUROC to compare the MIN-K%
AUROC, which is close to 1 for no unlearning and 0 for perfect unlearning, the latter of which corresponds to the target AUROC of 0.5.
WaterDrum (ours) value is computed using the LLM's text output and excluding the query (i.e., without the first 50 tokens for the completion task and without the prompt for the QA task). Note that in our experiments on the WaterDrum Ax dataset, multiple watermarks are present due to multiple data owners watermarking their data with unique watermarks. Each data owner i F would send some query qu to the LLM formed by its watermarked data point d E Dj and verify its watermark the LLM's text output using its watermark key 14--
With the exception of MIA, we use the uniform average over all text data points E Dy to compute the aggregate metric value, i.e., MaED (qa). = deD, (F) over all E Dy. The aggregate metric value for MIA is already defined above.
E.4 DUPLICATE DATA
As discussed in Sec. D (specifically, under 'Robustness to similar data D4) ). we examine three representative settings where there exists data D, (i.c., injected into DR) similar to Dy but with different SS: (a) Exact duplicate: data points in D. are exact copies of those in F (i.c., D. = =)). This marks the highest similarity with mean STS 1.00 and ROUGE-L 1.00. (b) Semantic duplicate: data points in D, are paraphrased versions of those in Dy with similar semantic meaning (i.e., D. = Dz). We use GPT-4 to paraphrase all text data points in D3 to obtain D.. In this setting, D. has mean STS = 0.97 and ROUGE-L- 0.69 for the Water Ax dataset, and mean STS 0.96 and ROUGE-L-
0.60 for the WaterDrum-DDe TOFU dataset. While the 'exact duplicate' setting can be less common in reality, it clearly illustrates and clarifies the limitations of different unlearning metrics. The 'semantic duplicate' setting happens and better measure of realistic unlearning capabilities (see real-world examples in App. B.4). We also consider the conventional setting where (c) no duplicate of any data point in D, is used to augment DR (i.e., D. = 0). Specific watermarking details on the duplicate data are described in App. C.3 For each setting, the LLM is fine-tuned on D = D. UDR. During unlearning, we aim to remove the influence of D) while retaining the influence of D
E.5 CALIBRATION DESIDERATUM D2
In our experiments in Sec. (specifically, under 'Calibration desideratum D2 ). simulate varying sizes k of subsets De of the forget set Dy by partitioning Dy sequentially into 10 partitions, and incrementally include the partitions (together with the retain set DR) into the training data for retraining the LLMs, i.e., using the first 0%, 10%, 20%, 100% of D)r as De for retraining the LLMs on DR U. : can be observed from Fig. 3 and Table that WaterDrum satisfies the calibration desideratum D2 under this way of partitioning, and we think it would generally be satisfied in expectation over randomly sampled subsets (with fixed size of k)) of Dy, as empirically verified in App. F.
E.6 BENCHMARKING UNLEARNING ALGORITHMS
In Sec. 5.1 we consider the setting of model owner comparing the aggregate WaterDrum values on different unlearned LLMs ; resulting from different unlearning algorithms. Such a setting can arise in a practical scenario where the model owner evaluates the performance of different unlearning algorithms on a small dataset before selecting the algorithm to fulfil data owners' unlearning requests after deployment. The model owner also be researcher developing new unlearning algorithms. Under this setting, we assume that the training data, LLM, and watermark keys are all under the full control of the model owner. The model owner
watermarked data such as the WaterDrum-t
30

---

Published as a conference paper at ICLR 2026
or WaterDrun-TorF dataset with known watermark keys and can compute the metric values of the retain and forget sets directly without the restrictions discussed in App. DD A perfect unlearning algorithm would produce (i) high aggregate metric value of the retain set Dr the unlearned LLM & (equivalently, the retrained L.M (pR) that is ideally close to that on the original L.MM PT (i.e., no unlearning), i.e., Dx (p(g)), , R) Re Md (qa), R) since the retain set still influences both the retrained and original LLMs, and (ii) low aggregate metric value of the forget set D on the unlearned LLM G, i.c., Da Dy (G(qa), FF) since the forget set does not influence the retrained LLM; retraining (i.e., perfect unlearning) is at the bottom right corner in Fig.
In our experiments, we have benchmarked the following popular baseline unlearning algorithms:
The base L.M is fine-tuned only on the retain set Dr for the same number of epochs when fine-tuning the original LLM or obtain the retrained LLM yR. The retrained LLM usually serves as the gold standard for other unlearning algorithms to produce their unlearned LLMs.
Retraining:
Gradient Descent (GD): The original LLM fo fine-tuned using gradient descent on the retain set DR for 1 or several epochs. GD assumes that the influence of the forget set is naturally removed from the LLM as training progresses on retain set. our experiments, we fine-tune for 1 epoch.
The original LLM ffT is updated by simultaneously maximizing the predictive loss on the forget set and minimizing the Kullback-Leibler (KL.) distance between the predictive distributionss/ikellloodd unlearned vs. original LLMs' text outputs to queries formed by the retain set for 5 unlearning epochs.
KL Minimization (KL) MMaini al. 2024
of the
SCRUB (Kurmanji et al., 2024): The original LLM PT is updated by maximizing the Kullback-Leibler distance between the predictive distributions/likelhhodd of the unlearned vs. original LLMs' text outputs to queries formed by the forget set, while minimizing the predictive loss and KL distance the retain set. The optimization process alternates between the maximization steps and minimization steps. In our experiments, we run maximization and minimization epochs.
Direct Preference Optimization (DPO) (Maini et al. 2024): For QA tasks, the original LLM PT is updated to encourage responses such as "I don't know" on the forget set, while simultaneously minimizing the predictive loss on the retain set. Note that DPO is not compatible with completion tasks and is omitted from benchmarking for the WaterDrum- Ax dataset. We run unlearning epochs for DPO.
Task Vector (TV) [aaarco et al. 2023): We follow the implementation in (Shi et al. 2025). Firstly, the original LLM (pT is further fine-tuned the forget set obtain reinforced LLM Preinforce- Next, we take the difference in parameters by subtracting the parameters of the ffT from that of PPreinfonce Lastly, the unlearned L.M is obtained by subtracting this difference from the parameters of yp. In the experiments, Preinforce is fine-tuned from p on the forget set for 5 epochs.
In the benchmarking of unlearning algorithms,, we exclude Gradient Ascent on the forget set from the original LLM (Maini et al. 2024) it has been shown perform poorly in the other works where the LLM''s text outputs become gibberish or random words (Maini et al. 2024).
E.7 IMPLEMENTING WATERDRUM WITH OTHER ADAPTED WATERMARKING METHODS FOR MODEL OWNER
As discussed in Sec. 5.2 to assess the performance of WaterD rum implemented with other adapted watermarking methods for model owner, we implement MaterDrum with the adapted KGW (Kirchenbauer et al., 2023), Synth-ID (Dathathri et al. 2024), and EXP-edit (Kuditipudi et al. 2024), which are popular watermarking methods for model owner that have been described in App. A.3 However, based on just the design and experimental support of these methods, it is not clear that all of the watermarking desiderata would be met, summarized in Table Additionally, we still need further adaptations to them and additional experiments to establish that the watermarking desiderata met:
31

---

Published as a conference paper at ICLR 2026
Table 6: Comparison of Waterfall vs. other watermarking methods for a model owner based on whether they satisfy our proposed watermarking desiderata in Sec. 4 We use to denote that the assessment off-the-shelf as it requires nontrivial modification to their code to support the desideratum. We use to denote that the assessment is based on our results in Table adaptation of the methods. Future work may nontrivially improve the design of the various watermarking methods to better satisfy the desiderata than what our current results offer.
Watermarking Method
Wo
W1
W2
W3
W4
Waterfall (Lau al. 2024
Yes
Yes
Yes
Yes
Yes
KGW (Kirchenbauer et al. 2023)
No
Yes*
Not shown
Yes
No
Synth-ID (Dathathri et al.
2024)
No
No
Not shown
Yes
No
EXP-edit (Kuditipudı et al.
2024
No
No*
Not shown
Yes
Yes
For example, to satisfy W4. the watermarking methods for data owners that embed watermarks into training text data need to support insertion and verification of watermarks from different/multiple data owners. contrast, watermarking methods for a model owner are designed embed the watermark of the single owner into the LLM's newly generated text outputs.
The requirements of W2 are also not explored, but it is an important requirement for these watermarking methods for model owner be used in our implementation of WaterDrum On the other hand, Sec. 4.3 in (Lau et al.] 2024) has established this property of being able recover multiple different watermark signals in the trained on text data watermarked by many data owners in their experiments, giving us more confidence in using Waterfall for demonstrating the effectiveness of WaterDrum.
outputs generated by LLMs
Nonetheless, we attempt to adapt KGW, Synth-ID, and EXP-edit to satisfy the watermarking desiderata. Specifically, we first add paraphrasing prompt following the approach in Waterfall. As KGW and Synth-ID are designed for watermarking (of the LLM's s newly generated text outputs) for single model owner, their codebases have explicitly fixed single watermark IDs into the internal components of the source code- we have to modify it for them to accept different watermarks and support multiple data owners. We use the same 1aama-31--8B-nntreee watermarking on the original arXiv dataset, except for Synth-ID, for which we use Gemma-7be as the provided codebase only supports Gemma and GPT-2 models. The results have been shown in Table in Sec. 5.2
model to apply text
F ABLATION STUDIES
F.1 CALIBRATION DESIDERATUM, D2
In Eq. (2). we define the calibration desideratum D2 as the expectation of the aggregate metric value over random subsets D, Dr (with a fixed size of [Da] k) be proportional to k. To verify that WaterDrum satisfies this relationship, we perform an experiment by randomly sampling three subsets (with a fixed size of k) of Dy to yield a total of four different subsets (including the subset obtained by sequential partitioning, as detailed in App. E.5) for every proportion k/[ = 0%, 20%, 40%, 60%, 80%, 100%. Fig. 9 shows the calibration curve for WaterD (i.e., mean aggregate MaterDrum value) enclosed by the minimum and maximum aggregate MaterDrum values, as well as the corresponding best-fit line under the 'no duplicate' setting for the WaterDrum Ax dataset. It can be observed that the linear proportional relationship holds values achieving high R² value 0.960 (i.e., close to the value of 0.963 reported in Table B) Moreover, each subset has aggregate WaterD rrruu rum value that is close to the mean of the four subsets, i.c., there is narrow range between the minimum and maximum aggregate Wate eDrrum values.
with the mean aggregate Water
32

---

Published as a conference paper at ICLR 2026
Agg. WaterDrum value
1.0
WaterDrum
R²=0.960
0.5
0.0
0.0
0.2
0.4
0.6
0.8
1.0
Proportion forget set influencing retrained LLM
aggregate WaterDrum value) w.r.t. proportion D/D forget set influencing retrained LLM (solid) and its best-fit line (R2 0.96) through origin (dotted) under 'no duplicate' setting for WaterDrum-AA dataset. Each x marker indicates the mean aggregate WaterDrum value over four subsets of the same size and is enclosed by eгтоr bars indicating the minimum and maximum aggregate WaterDrum values.
Figure 9: Calibration curve for WaterDrum (i.e.,
F.2 FULL PARAMETER FINE-TUNING
The experiments in Sec. were conducted using LoRA (Hu al. 2022). following the setting in the other LLM unlearning works (Maini et al. 2024] Shi et al. 2025). ). To show that WaterDa is also applicable when used for full parameter fine-tuning, we conduct experiments for the separability desideratum DI and calibration desideratum D2 under different levels of data similarity for the
WaterDrum AAx dataset.
For full parameter fine-tuning, we use learning rate of 10 and train for 10 epochs. Note that due the high computational cost of full parameter fine-tuning, only report the results for one seed, while the results for LoRA are averaged across three different seeds.
Tables and show that MaterDrum performs better than the other unlearning metrics and better satisfies D1 and D2 for both LoRA and full parameter fine-tuning.
Table 7: AUROC of various unlearning metrics under different levels of data similarity for the Wate rDrum-ArrAAA dataset. WaterDrum AUROC remains 1.0 even when similar data exists.
Data Similarity
ROUGE
KnowMem
WaterDrum
Exact
Full
0.335
0.497
0.990
Duplicate
LoRA
0.334
0.492
0.957
Semantic Duplicate
Full
0,965
0.447
0.990
LoRA
0,960
0.450
0.963
No
Full
0.984
0.481
0.991
Duplicate
LoRA
0.974
0.491
0.965
F.3
OTHER LLMS
have also evaluated the performance of WaterDrum using the Phi-1.5 model Figs. 10a and 10b show, respectively, the ROC and calibration curves for Water under the "no and exact duplicate' settings for the WaterDrummAA dataset. The high AUROC and R² values achieved by WaterDrum agree with main empirical findings in Sec. 5 Juing the Llama2-7B model and show that WaterDrus rum satisfies our proposed effectiveness desiderata DI D2 This validates our WaterDrum's adaptability to different LLMs, which increases its real-worke applicability.
10
Beyond the Llama2-7B model evaluated in our main experiments, we further investigate the performance of WaterDrum using larger Llama2-13B model. Figs. [[a and TTb show,
33

---

Published as a conference paper at ICLR 2026
Table R² values for the best-fit lines of various unlearning metrics under different levels of data similarity for PaterDrum-B Ax dataset. WaterDrum achieves the highest R values that are closest to and is hence well-calibrated metric.
Data Similarity
ROUGE
KnowMem
MIA
NaterDrum
Exact
Full
-5059
-981.5
-4.774
0.984
Duplicate
LoRA
-37.47
-498.1
-285.6
0.987
Semantic Duplicate
Full
0.545
-139.2
-35.57
0.989
LoRA
0.693
-276.5
-14.52
0.991
No
Full
0.850
-10.88
-3.937
0.940
Duplicate
LoRA
0.650
-252.9
0.677
0,963
Calibration for Phi-1.5
WaterDrum Duplicate
WaterDrum Exact Duplicate
Thus Positive Rate
0.6
c.u.
0.4
0.6
0.2
0.4
0.4
0.0
AUG
Mean AUC 0.89
0.0
0.2
0.4
0.6
0.8
1.0
0.6
Proportion forget set Influencing retra eetrained LLM
Positive
False Positive Rate
Culleatioo Dichuabu w
Collination
(b)
Figure 10: (a) ROC curves and (b) calibration curves for WaterDrum w.r.t. proportion k/[D=] of forget set influencing the retrained Phi-1.5 model (solid) and their best-fit lines through origin (dotted) under 'no and exact duplicate' settings for Wat eaterruum-x dataset. (a) WaterDrum rmm achieves good
separability due to high AUROC values and hence satisfies D1 (b) WaterDrum is well-calibrated due to high R² values for both the 'no duplicate' setting (R2 = 0.99) and the 'exact duplicate' setting (R2 (1.7) and satisfies
D2 with its best-fit lines closely following its aggregate metric values.
respectively, the ROC and calibration curves for WaterDrum under the 'no duplicate' setting for the WaterDrum-TTFU dataset. The even higher AUROC and R² values achieved by MaterDrus demonstrate that satisfies our proposed effectiveness desiderata DI to a larger extent on larger LLMs. This further validates WaterDrum's adaptability different LLM sizes, which increases its real-world applicability.
Calibratinn for Llama2-150
WaterDrum No Duplicate
Positive
Mcan AUC = 0.97
False Positive Rate
Call brstion care (80-2 9601
(a)
(b)
Figure 11: (a) ROC curve and (b) calibration curve for WaterDrum w.r.t. proportion k/[D>= of forget set influencing the retrained Llama2-13B model (solid) and its best-fit line through origin (dotted) under 'no duplicate' setting for WaterDrum-Aa dataset. (a) WaterDrum achieves good separability due to high AUROC value and hence satisfies DI (b) WaterDrum is well-calibrated
due to a high R² value for the 'no duplicate' setting (R22 = 0.996) and satisfies D2 with its best-fit line closely following its aggregate metric values.
34

---

Published as a conference paper at ICLR 2026
F.4 EVALUATING BASELINE UNLEARNING METRICS ON LLMs FINE-TUNEL ON WATERMARKED DATA
We have shown in Sec. 5 that the baseline unlearning metrics perform poorly when similar data exists in both the retain and forget sets. This is largely due to the baseline metrics being unable to ensure sufficient separability between the similar copies/versions of data in both the retain and forget sets. These baseline metrics are evaluated on LLMs that are fine-tuned on the unwatermarked versions Dy in the Wa e rDrum-Ax and NaterDrum- rum-TOFU datasets. this subsection, to study the effects of watermarking these baseline metrics, evaluate them by fine-tuning LLMs the watermarked versions 7 in the WaterDrum: Ax and WaterDrum TOFU datasets instead.
The watermarking process P1 contributes to performance gains in the separability desideratum D1 (i.e., AUROC) for the baseline unlearning metrics such as ROUGE as well, especially for the 'exact and semantic duplicate' settings, it makes data less similar by embedding different watermarks unique to each data owner. ROUGE exhibits some improvement in the separability desideratum DI for the 'exact and semantic duplicate' settings due to the de-duplication done with watermarking (Table However, DI alone not sufficient as the threshold x for separating the LLM's text outputs queries formed by the forget set vs. the retain set would be unknown in practice. D2 needed. can be observed from Table that that unlike WaterDrus the baseline unlearning metrics still achieve low R² values and hence fail to satisfy the calibration desideratum D2 In particular, the calibration curves for the baseline unlearning metrics do not pass through the origin, so they cannot be used to determine when D has been perfectly unlearned.
Table 9: AUROC (# across seeds) various unlearning metrics evaluated on LLMs fine-tuned watermarked text data under different levels of data similarity for the WaterDrum-TOne and W rD rum-Ax datasets. The AUROCs of both Water and ROUGE remain near 1.0 even when similar data exists.
WaterDrum-ToRE Truth Ratio
WaterDrum-AN KnowMem
Data Similarity
ROUGE
WaterDrum
ROUGE
WaterDrun
Exact Duplicate Semantic Duplicate No Duplicate
0.926110.011
0.50910.002
0.027
0.979=10.004
0.444::00007 0.957=0.008
0.977:10.001 0.51510.003 0.909:10.000 0.054
0.466110008 0.963=0.001
0.980-+0.005 0.727+0..00 0.928=0.026
0.903
0.474+00.003
0.965=0.002
Table 10: R² values of various unlearning metrics evaluated LLMs fine-tuned on watermarked text data under different levels data similarity for the WaterDa TOFU and WaterDrum Ax datasets. Only the R value of
remains near 1.0 even when similar data exists.
MaterDrum-Tonl TOFU
WaterDrum- Ax
Data Similarity
ROUGE
Truth Ratio
MIA
WaterDrum ROUGE KnowMem MIA
MaterDrum
Exact Duplicate
-7.624
-261.2
-1.005
0.889
0.774
-23.52
-5.375
0.987
Semantic Duplicate
-16.31
-229.2
0.541
0.947
0.677
-16.121
-6.629
0.991
No Duplicate
0.511
-13.71
-1.277
0.923
0.758
-21.72
-0.437
0.963
To summarize, using watermarked data P1 may contribute to performance gains in the
separability desideratum D1 for the baseline unlearning metrics. However, P3 and WaterDrum are essential satisfy under D3 and (i.c., all proposed desiderata).
G ADDITIONAL EXPERIMENTAL RESULTS
G.1 QUANTITATIVE EVIDENCE THAT WATERMARKING WITH WATERFALL DOES NOT DEGRADE LLM'S PERFORMANCE
Mater lays out watermarking desiderata for compatible watermarking methods (Sec. 4b. including the fidelity desideratum WO We choose to Waterfall (Lau et al. 2024 this work has already presented extensive empirical results showing that its watermarking process has minimal degradation on the L.LM's performance (see App. H.3 in (Lau et al. 2024)).
35

---

Published as a conference paper at ICLR 2026
Nonetheless, evaluate Waterfall's fidelity by comparing the LLMs' performance when fine-tuned on watermarked vs. unwatermarked data using Truth Ratio (Maini et al. 2024) (App. (..3). which computes each LLM's probability of generating the correct answer compared to set of wrong answers perturbed from the correct one.
Our results show that the mean Truth Ratio metric values when fine-tuning the LLMs watermarked vs. unwatermarked versions of the respectively.
dataset are very similar at 0.5121 and 0.5192,
G.2 SIMILARITY OF TEXT OUTPUTS TO QUERIES FORMED BY DUPLICATE DATA
Following the setup discussed in Sec. (specifically. under Robustness to similar data D4 ). under the 'exact and semantic duplicate' settings, we will verify here that when the LLM is fine-tuned the augmented retain set Die it generates similar text outputs to queries formed by duplicate data points d Da and d DD such that d dy.
We empirically verify the similarity by evaluating the STS scores between the LLM's text outputs to queries formed by duplicate data points E D, and d Dz. It can be observed from Table [T that the mean STS scores are 0.96 and 0.87 under the 'exact and semantic duplicate' settings, respectively, For reference, the STS scores between the LLM's text outputs to queries formed by data points in dataset only
the same academic subject category (i.e., ma math. PR in arXiv) in the WaterDrum- result in a mean STS score of 0.67. This shows that the LLM's s text outputs to queries formed by duplicate data are very similar, much more so than that formed by data in the same academic subject category.
Table 11: Mean semantic text similarity (STS) score between the LLM's text outputs queries formed by duplicate data points d E D. and d, E Dz under the 'exact and semantic duplicate' settings for the Water Ax dataset. For reference, the mean STS score between the LLM's text outputs to queries formed by data points in the same academic subject category (i.e., math.PP PR in arXiv) is 0.67.
Data Similarity
Mean STS score
Exact Duplicate 0.96
Semantic Duplicate 0.87
We further verify that data points in D, and Dy with similar semantic meaning will have similar measure the metric values of data points D, and Dy
metric values. We use WaterDrum (respectively, (()(((a), R) for any d E DD and ((p) for any d E DD=) for the LLM LT fine-tuned on the full dataset of D> UD (note that the retain set augmented with D.). Fig. I2
shows histograms of the WaterDrum values of data points in D. and Dj with similar semantic meaning, which verifies that the NaterDrum values of data points in D, and D) indeed have a similar distribution.
G.3 VERIFICATION PERFORMANCE OF WATERFALL WITH DIFFERENT GENERATED TOKEN LENGTHS
In Sec. generate up to 200 tokens for each LLM's query when evaluating each unlearning metric (App. E.2) This token length roughly translates to around 5 sentences.
The work of Lau et al. 2024) has shown that the verification performance of Waterfall improves with more tokens in longer text. To verify this claim, we consider the L.M fine-tuned on the WaterDrum-Ase dataset. With false positive rate of 1%, the true positive rate reaches 50% 13 tokens generated and 90% at 59 tokens generated.
H ADDITIONAL EXPERIMENTAL RESULTS ON LLM UNLEARNING EVALUATION
In this section, we provide additional experimental results to evaluate Water and the baseline unlearning metrics both
and WaterDrum-ToFF datasets using the same
36

---

Published as a conference paper at ICLR 2026
forget set
semantic duplicate set
Count
10
0 0.0
0.2
0.4
0.6
0.8
Waterdrum value
Figure 12: Histograms of the WaterDrum values of data points D, and DF (with similar semantic meaning) when unlearning category of the WaterDrum Ax dataset, which shows that the WaterDrum values of data points in D, and Dy have a similar distribution.
experimental setup described Sec. (unless stated otherwise), as well as benchmark unlearning algorithms for the cases with multiple data owners and different levels of data similarity on the new MaterDrum-As dataset.
H.1 LLM UNLEARNING EVALUATION ON WATERDRUM-AX DATASET
H.1.1 RELAXATION FEASIBILITY DESIDERATUMI D3
In Sec. (specifiiil under 'Calibration desideratum D2 and Fig. 3 we demonstrate whether
unlearning metrics calibrated well poorly without refereneing the retrained LLM (pR. Here, relax the fcasibility constraint and allow the baseline unlearning metrics (i.c., ROUGE, KnowMem, and MIA) to reference PR although doing infeasibly requires retraining for every forget set being considered.
Specifically, reference the retrained LLM Po (i.e., achieved by perfect unlearning) by subtracting its aggregate metric value from that on the unlearned model ş to yield an "offset" aggregate metric MIEDy (P(ga), MaE (p((a) F) Mae (PR F).
Fig. and Table 12 show, respectively, the calibration curves for the various unlearning metrics (using the "offset" aggregate metric values) and the R2 values for the corresponding best-fit lines under different levels of data similarity for the WaterDrum-Be Ax dataset. The results show that, under the relaxed feasibility constraint by referencing PRR, the baseline metrics are generally better calibrated. Notably, ROUGE achieves good calibration across different levels of data similarity even though it underperforms in the 'exact duplicate' setting. contrast, our WaterD rum consistently demonstrates strong calibration with high R² values across all settings. Nonetheless, it is important to emphasize that the retrained LLMs are not available in practical scenarios and their availability would eliminate the need to perform unlearning in the first place.
Table 12: R² values for the best-fit lines (dotted in Fig. 13) 'offset" aggregate metric values) under different levels of data similarity for the WaterDrum-T Ax dataset.
various unlearning metries (using the
Data Similarity
ROUGE KnowMem MIA
WaterDrum
Exact Duplicate
0.923
-0.331
0.273
0.994
Semantic Duplicate
0.997
0.101
-0.011
0.995
No Duplicate
0.998
0.006
0.990
0.957
37

---

Published as a conference paper at ICLR 2026
Exact Duplicate
Semantic Duplicate
No Duplicate
ROUGE
KnowMem
2.0
10
Agg. metric
0.6
0.4
20
0.0
0.6
0.0
0.6
0.8
Praportion forget set influencing retrained LLM
Proportion farget set influencing retrained LLM
MIA
WaterDrum
0.6
Agg.
0.2
0.0
0.0
0.2
0.4 0.6
0.8
0.0
0.2
0.4
0.6
0.8 1.0
Proportion of forget set influencing retrained LLM
Proportion of forget set influencing retrained LLM
Figure 13: Calibration curves for various unlearning metrics (using the 'offset' aggregate metric values D FF) w.r.t. proportion k/ k/[D>| of the forget set influencing the retrained LLM (solid) and their best-fit lines (see associated R² in Table 12) through the origin (dotted) under different levels data similarity for the SaterDrumt -u dataset. The 'offset' aggregate metric values offset by referencing the retrained LLMs and scaled by referencing the original LLMs such that the values are 0.0 and 1.0 when the proportions are 0.0 and 1.0 respectively.
H.2 LLM UNLEARNING EVALUATION ON WATERDRUM-TOFF DATASET
As supplement to the main experiments, we present additional experimental results here for the WaterDrum-Tone TOFU dataset. As described in Sec. 3 (specifically, under 'Robustness to similar data D4). we consider the 'exact duplicate', 'semantic duplicate', and 'no duplicate' settings, and fine-tune the LLMSs the WaterDrummTors 'Separability desideratum D1 discusses results on the separability desideratum D1 under different levels of data similarity, we report below the results evaluate WaterDrum and the baseline unlearning metrics in the calibration desideratum D2 and the relaxed feasibility desideratum D3 under different levels of data similarity.
dataset. While Sec. (specifically, under
H.2.1 CALIBRATION DESIDERATUM, D2
Fig. 14 and Table 13 show, respectively, the calibration curves for the various unlearning metrics and the R² values for the corresponding best-fit lines under different levels of data similarity for the WaterDrum TOFU dataset. Similar to the results in Sec. 5 (specificaly, under "Calibration desideratum D2) ) our WaterDrum outperforms the baseline metrics by ensuring and maintaining strong calibration with high R values without referencing retrained LLMs across all settings.
M' (pr (q.). to be close 0 at
Table 13: R22 values for the best-fit lines (dotted in Fig. 14) of various unlcarning metrics under different levels of data similarity for the WaterDrum TOFU dataset. WaterDrum: achieves the highest R2 values that are closest and hence well-calibrated metric.
Data Similarity
ROUGE
Truth Ratio
MIA WaterDrum
Exact Duplicate
-1263.951
-6444.874
-6.201
0.889
Semantic Duplicate
-20.560
-1416.284
-0.813
0.947
No Duplicate
-0.287
-11.741
-1,059
0.923
38

---

Published as a conference paper at ICLR 2026
No Duplicate
Exact Duplicate
Semantic Duplicate
ROUGE
1 Truth Ratlo
Agg. metric value
1.2
1.2
1.0
0.8
0.8
0.6
0.2
0.2
0.0
0.2
0.4
0.8
1.0
0.0
0.4
0.6
0.8
1.0
Proportion of forget set influencing retrained LLM
Proportion of forget set influencing retrained LLM
MIA
WaterDrum
Agg. metric value
10
0.8
0.6
-10
-15
0.2
-20
0.0
0.2
0.4 0.6
0.8
1.0
0.0
0.2
0.4 0.6
0.8 1.0
Proportion of forget set influencing retrained LLM
Proportion forget set influencing retrained LLM
Figure 14: Calibration curves for various unlearning metrics w.r.t. proportion e/Dr of the forget set influencing the retrained LLM (solid) and their best-fit lines (see associated R² in Table [3) through the origin (dotted) under different levels data similarity for the SaterDrum-TOFF dataset. Only Wate rD Dumm is well-calibrated and satisfies D2 with its best-fit lines closely following its aggregate metric values.
H.2.2 RELAXATION OF FEASTBILITY DESIDERATUM D3
Similar to App. H.I.I we relax the feasibility constraint here and allow the baseline unlearning metrics (i.e., ROUGE, Truth Ratio, and MIA) to reference the retrained LLM PR although doing so infeasibly requires retraining for every forget set being considered.
Fig. 15land TTable[4[shov respectively, the calibration curves for the various unlearning metrics (using the "offset' aggregate metric values defined in App. H.1.1) and the R² values for the corresponding best-fit lines under different levels data similarity for the WaterDrum:
dataset. The results similar to that in App. H.I.I and show that, under the relaxed feasibility constraint by referencing PR. the baseline metrics are generally better calibrated. Unlike Truth Ratio and MIA, our WaterDe um and ROUGE consistently demonstrate strong calibration with high R² values across all settings. Nonetheless, is important to emphasize again that the retrained LLMSs are not available practical scenarios and their availability would eliminate the need to perform unlearning in the first place.
Table 14: R. values for the best-fit lines (dotted in Fig. 1.5 of various unlearning metrics (using the 'off'set' aggregate metric values) under different levels of data similarity for the WaterDrun: DrotrrDuunTTOF TOFU dataset.
Data Similarity
ROUGE Truth Ratio
MIA WaterDrum
Exact Duplicate
0.991
-0.586
-0.018
0.997
Semantic Duplicate
0.998
0.854
-0.435
0.996
Duplicate 0.999
0.995
0.608
0.997
H.3 BENCHMARKING UNLEARNING ALGORITHMS ON NEW WATERDRUM-AN Ax DATASET FOR MULTIPLE DATA OWNERS AND DIFFERENT LEVELS OF DATA SIMILARITY
In addition to the experimental results in Sec. 5.1 Figs. 16 and illustrate the use of WaterDrum in benchmarking the unlearning algorithms under the respective "no duplicate' and "exact duplicate"
39

---

Published as a conference paper at ICLR 2026
No Duplicate
Exact Duplicate
Semantic Duplicate
ROUGE
1 Truth Ratlo
1.0
Agg metric
0.6
0.2
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
Proportion of forget set influencing retrained LLM
Proportion of forget set influencing retrained LLM
MIA
WaterDrum
AgB. metric value
1.0
0.6
0.0
0.0
0.2
0.4 0.6
0.8
1.0
0.0
0.2
0.4 0.6
0.8 1.0
Proportion forget set influencing retrained LLM
Proportion forget influencing retrained LLM
Figure 15: Calibration curves for various unlearning metrics (using the 'offser' aggregate metric values) w.r.t. proportion k/| of the forget set influencing the retrained LLM (solid), scaled by referencing the retrained and original LLMs, and their best-fit lines (see associated R² in Table 14 through the origin (dotted) under different levels of data similarity for the KaterDrum-TOFU dataset.
settings of data similarity (i.e., previously described in Sec. specifically, under 'Robustness to similar data ( for the WaterDrum-Ax dataset where the forget set consists of data from 1, 3, and 5 data owners (out of total of 20 data owners) with 1 category of paper abstracts per owner (App. C.3).
Similar the results in Sec. 5.1 it can be observed from Fig. 16 (Fig. that the unlearning algorithms achieve aggregate WaterDrum values still far from that achieved by retraining: KL and TV generally produce unlearned models that unlearn the forget set D) very well but cannot preserve the influence of DR (or D.) much, the latter of which compromises their overall utility. GD and SCRUB tend produce unlearned models that preserve but do not unlearn the forget set Dy well. However, both GD and SCRUB require fine-tuning on the (augmented) retain set (Di D. UDR), which incurs significant amount computational resources as the (augmented) retain set is likely to be significantly larger than the forget set and almost similar in size to the full dataset. Typically, LLM fine-tuning only involves very few epochs (Touvron) et al. 2023). The computational cost of fine-tuning the LLM for a few epochs on the (augmented) retain set can be almost as expensive as that of retraining.
influence of Dr (or D.)
It can also be observed from Fig. 16 (Fig. I7 that when the forget set consists of data from 5 data owners, the aggregate Wat e D um value of the watermarked retain set Dr in WaterD rum-Ax on the retrained L.M (only on the (augmented) retain set) increases slightly beyond 1.0. We hypothesize that this is due to the forget set constituting a larger proportion of the entire dataset (i.e., 5 out of total of 20 data owners). As result, the (augmented) retain set used for retraining becomes smaller in proportion relative to the full dataset Dy, which can result in the retrained LLM becoming more specialized in this smaller (augmented) retain set and in turn a larger aggregate WaterDrus value. The same reasoning applies to explain why the aggregate WaterDrum value D, on the retrained I.MM (only on the (augmented) retain set) also increases slightly beyond 1.0 in Fig. 17
40

---

Published as a conference paper at ICLR 2026
3
+ MM aen, (g())) F)
1.00
0.75
0.50
0.25
0.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
0.00
0.25
0.50
0.75
1.00
M' dCD, (p(qs), R)
No unlearning
Retraining
Benchmarking the unlearning algorithms with WaterDrum under the "no duplicate" setting of data similarity for the WaterDrum-Ae dataset where the forget set consists of data from 1, 3, and 5 data owners with 1 category of paper abstracts per owner (App.
Figure 16:
1
< M' dEp, (g(g)) P)
1.00
0.75
0.50
0.25
0.00
1.00
M' D' (g(g)) R)
owner
owners
5 owners
- M' dE (o(aa)) F)
1.00
0.75
0.50
0.25
0.00
1.00
1.25
00
50
0.75
1.00
1.25
M' de (p(qg), R)
No unlcaming
Retraining
GD
KL
Benchmarking the unlearning algorithms with WaterDrum under the 'exact duplicate' setting of data similarity (i.e., previously described in Sec. specifically, under 'Robustness to similar data D4) for the WaterDrum- Ax dataset where the forget set consists of data from 1, 3, and data owners with category of paper abstracts per owner (App. C.3
Figure 17:
I OTHER QUESTIONS AND LIMITATIONS
What is the difference of WaterDrum with existing watermark-basee unlearning metrics? Existing watermark-hasee unlearning metrics mostly for image classification models, as opposed to our proposed unlearning metric for text-based generative L.MMs. See discussion on watermark-based metrics in App. A.I for more details.
2. Existing works (Liu et al., 2025: Lynch al., 2024 have already identified similar limitations about existing unlearning metrics. What the novelty of our work? We formally define clear desiderata and propose non-retraining-bsse metric that works despite
41

---

Published as a conference paper at ICLR 2026
higher level of data similarity between the forget vs. retain sets and the generalization ability of LLMs. See more discussion in App.
3. Why do we only run experiments on TOFU and WaterDrum-Ax datasets instead of other datasets such as WMDP? TOFU and WaterDrum-AN Ax datasets cover both QA and completion tasks, which are representative of LLM tasks. WMDP is different from TOFU and WaterDrum-AA Ax in nature because it is specifically for knowledge editing and only contains test data instead of training data. As our work considers a data-centric view of unlearning, we are concerned with the unlearning of specific data owners' contributed datasets (with potential similar data instances across data owners), rather than indiscriminately unlearning certain (harmful) knowledge.
4. Can our conclusion be generalized to other LLMs? Results the Phi-1.5 model (see App. FS show that our conclusion can be generalized to other LLMs as well. The two LLMs considered in our paper are representative of recent LLMs, different in terms of model architectural details, and span different model scales. These two LLMs are also the only
LLMs considered in (Maini al. 2024 Wang et al. 2025).
5. Beyond unlearning effectiveness, can our proposed metric be used to measure utility preservation//eeentinn? As shown in Sec. 5. our WaterDrum can be used to verify that the aggregate Wat ermm value of the retain set on the retrained LLM (i.e., perfect unlearning) is similar to that on the original LLM (i.e., no unlearning). Hence, our WaterDrum can also quantify the extent of undesirable removal of the retain set's influence and evaluate the effects of catastrophic forgetting.
6. Practical significance of unlearning of fine-tuning data vs. pre-training data. In real-life applications, fine-tuning of an LLM is performed to enhance the LLM in specific downstream tasks, which is more likely to make use of task-specific datasets. These datasets are more concerned with privacy/safety issues and are hence more significant for unlearning than public datasets used in pre-training.
7. What are the limitations of WaterDrum and this work? The limitations are that (a) the desiderata may not be exhaustive, (b) the WaterDrum value (via the watermark's 's verification score in Eq. (3) may not exhaustively capture all possible ways of measuring unlearning effectiveness, and (c) rDru requires the training data to be watermarked unlike existing metrics.
We believe that for now, (a) and (b) are acceptable as our work is an important first step towards designing and developing more effective and practical unlearning metrics and algorithms,, and deriving theoretical results for them. Future work can conduct a more comprehensive and systematic evaluation of existing LLM unlearning algorithms and adapt theoretical insights from the watermarking community to analyze the LLM unlearning metrics based on the new connection that we have established in this work.
In Remark 1 (Sec. 4 and App. C.4, we explain why watermarking is lightweight, easy to use, and would a more common practice in the future. Thus, the applicability of WaterDrum would increase and limitation (c) would diminish over time. Moreover, limitation (c) is reasonable as the benefits, such as satisfying our desiderata, outweigh the slight inconvenience and cost.
8. What new insights can be gained from the proposed WaterDrum? (a) We have shown that existing metries fail satisfy our necessary desiderata (Sec. 3 prompting caution in the design of unlearning metrics. (b) Using WaterDrum to benchmark LLM unlearning algorithms (Sec. [5.T) shows that they perform poorly on unlearning and retaining performance. WaterDrum can serve as an optimization criterion for future LLM unlearning algorithms. (c) By emphasizing practicality in our proposed desiderata (Sec. 3) WaterDrum encourages future LLM unlearning algorithms to consider realistic settings/constraints.
9. Why do we not consider other desiderata? Our work focuses on the most essential desiderata (effectiveness desiderata) and more practical/realistc settings/constraints.. We find these desiderata to be the most relevant and necessary criteria for effective and practical unlearning metries, though they are not meant to be exhaustive nor by themselves sufficient to guarantee unlearning. We see our work as complementary to other compatible frameworks.
42


Reviews:
[{"review_id": "dTkHUMkp34", "reviewer": "Reviewer_mahr", "summary": "The paper proposes a framework to evaluate how well a dataset has been unlearned from a LLM. The paper focuses on a setting where one has only a black-box  access to the proposed \"unlearned\" LLM, and no access to a baseline retrained LLM. As such, I consider this to be first and foremost a paper about auditing black box model.\n\nThe authors formulate four main properties their auditing system: \n1. separability, i.e, the metric is able to beat a random guesser on whether an llm answer was influenced by data belonging to the unlearned set or not)\n2. calibration, to take into account imperfect unlearning in practice\n3. practicality, i.e non-reliance on a retrained model\n4. robustness to similar data between the unlearned dataset and the retained dataset\n\nFrom these desired properties, the authors conclude that the use of a watermarking system is well-suited to design a metric fulfilling these properties.\n\nThey further go on to specify the desired properties of a watermarking scheme useful for the auditing task -- which I won't describe since they are pretty straightforward properties of most watermarking systems contrary to what the authors claim. \n\nFinally, the auditing system is described as follow: content from each owner is watermarked using a specific key, unique to the owner but fixed across datapoints of this owner. The verification system then detects the presence of the watermark from a the proposed LLM output using a query formed using data points belonging in the unlearned dataset.\n\nFinally, the authors instantiate their auditing system using the WaterFall watermarking scheme and validate the performance of their method against other metric such as ROUGE, Truth Ratio, KnowMem and some membership inference attack.\n\nI also note that the authors propose a new dataset for their benchmark based on the collection of arXiv abstract.", "questions": "**Questions**:\n- Most importantly, I would advise the author to refrain from promoting Waterfall this much without providing better arguments as to why it is necessary or unique within other text watermarking in achieving the desiderata. Either the author should provide a better discussion/experimental proofs that other schemes do not meet the desiderata or tone down the claims towards Waterfall.\n\n- I don't understand the possibility of forgetting data when **exact** duplicates can be found between the retain and forged set. Maybe I am misunderstanding something in the experimental design. I understand the paraphrased data will be different thanks to the use of different keys. But since the **original** data is still the same, what is the point ? Is it only for illustration purposes of the failure of classic unlearning algorithms. I would appreciate the authors make this point clearer in the paper.\n\n- I feel that the paper lacks a calibration study for other watermarking scheme such as KGW and Aaronson. I don't ask for a whole benchmark, but given that these schemes have been shown to contaminate output data for LLM in [1], I believe such a study would at least make the choice of Waterfall a bit more meaningful.\n\n**Recommendation**: I am somewhat torn about this paper. On one hand, I really like the idea of leveraging watermarking capabilities to allow black-box auditing. Furthermore, the paper is very meticulous in describing what it wants to achieve and I found it to be a joy to read in that regard. On the the other hand, the lack of engagement with rest of the field and the huge promotion of Waterfall makes me somewhat suspicious. I am ready to give a *borderline accept* thanks to the attractive idea but would gladly increase my score if the authors can engage with the rest of the art and **really** demonstrate both theoretically and empirically the superiority of Waterfall compared to other schemes. Note that, although I can be considered an expert on **watermarking**, I am definitely not an expert in **unlearning** and I might be missing some insights in the current literature on the well-foundedness of the approach.\n\n**References**:\n\n- [1] Sander, Tom, et al. \"Watermarking makes language models radioactive.\" Advances in Neural Information Processing Systems 37 (2024): 21079-21113.\n- [2] Kirchenbauer, John, et al. \"A watermark for large language models.\" International Conference on Machine Learning. PMLR, 2023.\n- [3] Aaronson, S. My AI Safety Lecture for UT Effective Altruism, November 2022. URL https://scottaaronson.blog/?p=6823.\n- [4] Dathathri, Sumanth, et al. \"Scalable watermarking for identifying large language model outputs.\" Nature 634.8035 (2024): 818-823.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "**Clarity**: This might be the greatest strength of the paper. Every desired property is extremely well-defined, with a clear formalism and pedagogical explanations. The idea is ell motivated and simple in its implementation. Similarly, the experimental metrics look well chosen and motivated to my non-expert view (with one exception that I will touch in the questions). Consequently, the experiments were convincing to me. \n\n**Originality**: I am not qualified to judge on this point as I am not an expert on unlearning evaluation. However, the use of watermarking for tracking the use of data across LLM training sets is definitely not new, for example in the landmark paper [1] (strangely not being cited !).\n\n**Significance**: I admit to be impressed by the elegant solution this paper propose to black-box auditing. The idea of **not** relying on data for the auditing part allows some very impressive results and flexibility not available without watermarking and I such I find this work quite significant when watermarking is actually available in practice.", "weaknesses": "**Some claims are not substantiated**: To be precise, the necessity of watermarking for unlearning metrics, as claimed in Remark 1, is not obvious to me from the desiderata. I would be hard pressed to find a better solution fulfilling both the robustness and separability aspects, but the author do not provide a proof either. Since the onus is on them, I would either retract from such claims or provide actual proof. \n\n**Over-reliance on a specific, watermarking scheme**: Another important unsubstantiated claim is the uniqueness of the WaterFall algorithm in meeting the desiderata. The paper feels heavily skewed towards promoting this specific framework, which appears to be a very recent paper from 2024, possibly from the same research group.  I found it quite surprising that from the classical text watermarking schemes such as [2,3,4] only KGW was (quickly) considered in the appendix (I). I don't understand the reason for disregarding them, especially since the \"radioactivity\" [1] demonstrated that one can use them and recover a watermark signal in text generated by LLM trained on such schemes. I looked at the Waterfall paper and could not find such a discussion the main body either.  To be precise, the paper dismisses several schemes in the appendix by claiming they fail W5, but this seems like a post-hoc justification to select Waterfall. It's not clear why other schemes couldn't be adapted. \n\n**Lacking references**: This is somewhat of a follow up to the previous weakness. I cannot assess this for the unlearning part, but the choice of references for watermarking is somewhat bizarre. Kirchenbauer is incorrectly referred to as \"model watermarking\": it is not post-hoc indeed, but does not watermark the model. It watermarks the generated text by modifying the sampling distribution. Aaronson [3] is not cited, despite being the first distortion-free scheme. The authors seems to have focused on post-hoc schemes, but I don't understand why. Furthermore, I don't see any reference to the use of watermark as a tracking technology for training data despite -- e.g. [1] using it exactly for this.  The paper feels, at times, more like an application paper for Waterfall than a comprehensive exploration of watermarking for unlearning evaluation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UBB4QlQpzs", "reviewer": "Reviewer_mg5c", "summary": "The paper first points out that practical unlearning is not really well tested by existing unlearning benchmarks. Existing evaluation protocols 1) don’t test on semantically similar data, 2) need to train a “retrained LLM” (I like to call this the “ideal LLM”) and 3) need better ways to elicit the inclusion of a data point.\n\nThe main contribution of this work is a new metric for unlearning, that measures the model’s ability to unlearn similar data (?) and a new dataset based off of arxiv, which forms a new unlearning benchmark. Results show that the WaterDrum metric is superior and matches the desiderata laid out in the paper.", "questions": "n/a", "limitations": "", "rating": 4, "confidence": 2, "soundness": 2, "presentation": 1, "contribution": 3, "strengths": "S1. This paper raises both interesting and important point that are neglected in unlearning benchmarks: \n\n1) existing benchmarks (like TOFU) evaluate degradation of general model capabilities after unlearning, which does not truly evaluate whether the data has been forgotten and retain the desired data.\n\n2) unlearning benchmarks need to think closely about how to elicit whether a model has forgotten or retained a datapoint.\n\n3) practically, the forget set and retain sets may be semantically close to each other. if you’re just evaluating model capabilities, you would miss a more fine grained notion of whether the model has forgotten.\n\nBecause the focus is interesting, I wouldn’t mind if this paper was accepted.", "weaknesses": "W1. The presentation of this paper is not ideal, in my opinion. While I can see the authors obviously spent a lot of time in clarifying the writing, I think the notation is extremely dense for a paper that is not theoretical in nature.\n\nW2. I think the focus on “desiderata” and how WaterDrum achieves them is not the best way to present this topic. While I appreciate the sincere thought about what an unlearning benchmark should be, I feel like there’s a more straightforward presentation of your findings and contributions by **highlighting gaps with current benchmarks and showing how your benchmark provides more sensitivity.** I feel this is a more sensible approach, given that some of the desiderata are plainly intuitive e.g. separability — I don’t really need a whole mathematical definition of what is basically captured by AUC ROC.\n\nThe paper focuses on interesting points, but I think the paper’s impact would be much better if it is presented in a more narrative way. In fact, I don’t really understand what is going on with most of the results as they point to all different aspects of the authors’ framework which I think is overtheorized.\n\nW3. Finally, the last weakness is regarding the watermarking aspect. From what I gather, there needs to be a way to elicit whether an unlearned model forgets or retains data points. Watermarking could be a nice way to trace that, however, it seems that watermarking and detecting those watermarks would only focus on membership information. It does not seem to me to necessarily capture the higher level concepts within the forget set that is actually intended to be forgotten.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Rcdtzi1aJG", "reviewer": "Reviewer_ftSk", "summary": "This paper proposes WaterDrum, the first data-centric unlearning metric for LLMs, which leverages robust text watermarking to overcome the limitations of existing utility-centric metrics that fail to accurately measure the degree of unlearning in real-world scenarios.", "questions": "1. Apart from Waterfall, are there other text watermarking methods that could potentially meet WaterDrum’s watermarking requirements? Have you considered conducting compatibility tests with alternative watermarking schemes?\n2. For datasets that have already been released without watermarks, are there any remedial or alternative approaches that would allow WaterDrum to still be applied for unlearning evaluation?\n3. Can WaterDrum be extended to assess unlearning during the pre-training stage, rather than only in fine-tuning? If so, would it require adjustments to the watermarking strategy or validation process?\n4. Beyond the LLaMA2-7B model, have you evaluated WaterDrum on other model families or larger-scale models? If so, how do the experimental results differ?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The idea of evaluating unlearning from the watermarking perspective is novel and insightful.\n2. The introduction of the new benchmark WaterDrum-Ax provides a useful foundation for future research in this area.", "weaknesses": "1. The proposed method has an inherent limitation, it requires the training data to be watermarked prior to model training.\n2. The methodology section is somewhat verbose and repetitive, which makes the experimental part appear less substantial in comparison.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)