Title: Erasing Conceptual Knowledge from Language Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Concept Unlearning

Erasing Bio Threat

Erasing Cyber Threat

safety
Abstract: In this work, we introduce Erasure of Language Memory (ELM), a principled approach to concept-level unlearning that operates by matching distributions defined by the model's own introspective classification capabilities. Our key insight is that effective unlearning should leverage the model's ability to evaluate its own knowledge, using the language model itself as a classifier to identify and reduce the likelihood of generating content related to undesired concepts. ELM applies this framework to create targeted low-rank updates that reduce generation probabilities for concept-specific content while preserving the model's broader capabilities. We demonstrate ELM's efficacy on biosecurity, cybersecurity, and literary domain erasure tasks. Comparative evaluation reveals that ELM-modified models achieve near-random performance on assessments targeting erased concepts, while simultaneously preserving generation coherence, maintaining benchmark performance on unrelated tasks, and exhibiting strong robustness to adversarial attacks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes ELM, a method for erasing specific concepts from LLMs. By leveraging the model's own introspective classification capabilities, it identifies content related to target concepts. The authors demonstrate through experiments that ELM can achieve concept erasure while preserving the model's broader capabilities.\n\nSTRENGTHS AND WEAKNESSES:\n# Strengths\n**S1.** The approach of utilizing the LLM's own classification ability by treating it as classification labels through Bayes' rule shows high novelty. The paper addresses the existing problem of lacking \"a principled objective defining successful concept erasure\" by leveraging the model's own capabilities, which is particularly interesting.\n\n**S2.** The authors conduct a well-balanced and multifaceted evaluation of the proposed method using four evaluation metrics. They include seamlessness and robustness, which are often overlooked in unlearning evaluation, and also implement internal knowledge evaluation using probing. The experiments confirm that the proposed method achieves robust concept erasure, being resistant to attacks such as GCG and BEAST, making it difficult to reproduce erased knowledge.\n\n**S3.** To ensure reproducibility, detailed experimental conditions are provided, and there are plans to release code and data publicly.\n\n# Weaknesses\n**W1.** While the proposed method achieves stronger knowledge erasure compared to baselines, it does not achieve complete knowledge removal.\n\n**W2.** Despite aiming to erase concepts, the evaluation of knowledge erasure relies on multiple-choice questions (MCQs), which may be limited. Please refer to the Questions section.\n\n**W3.** The design and extraction of knowledge sets to be erased (D_erase, c+, c-) depend on manual work. Additional techniques would be needed for more automated and large-scale knowledge set erasure.\n\nQUESTIONS:\n**Q1. Operational Definition and Boundary Setting of Concepts**: The paper title claims \"Erasing Conceptual Knowledge,\" and you assert the erasure of \"concepts\" such as bioweapons and cybersecurity. How do you operationally define the boundaries of these concepts? Specifically:\n\n- The rationale for texts included in D_{erase} representing the \"bioweapons concept\"\n- Methods for setting boundaries with related safe concepts (e.g., medical microbiology, legitimate security research)\n- How you considered hierarchical structures and inclusion relationships of concepts in designing c^+/c^-\n\nIf you have comprehensive definitions or classification systems for concepts, could you please share them?\n\n**Q2. Verification Methods for Concept Completeness**: You demonstrate successful concept erasure by achieving random performance on MCQ evaluation, but how do you verify that this represents \"concept-level complete erasure\" rather than \"partial erasure\"? Concerns include:\n\n- The gap between knowledge fragments measured by MCQs and the knowledge network as a complete concept\n- Handling concept manifestations at different contexts or abstraction levels (e.g., metaphorical expressions, indirect reasoning)\n- Completeness of erasure for concept components (factual knowledge, procedural knowledge, relational knowledge)\n\nIf you have complementary methods or experiments evaluating multi-layered aspects of concepts, could you provide details?\n\n**Q3. Control and Measurement of Spillover Effects**: Figure 2 shows effects on related concepts, but how do you detect and control unintended knowledge erasure (over-erasure) or erasure gaps (under-erasure) due to concept boundary ambiguity? Particularly interested in:\n\n- Analysis of the relationship between semantic distance among concepts and erasure effects\n- Control of erasure propagation in hierarchical concept structures (superordinate → subordinate concepts)\n- Quantification of boundary effects in semantic neighborhoods\n\nPlease share any systematic approaches or additional experiments addressing this issue.\n\nLIMITATIONS:\n**L1.** As the authors mention in limitations, the difficulty in selecting erasure scope due to deeply entangled knowledge representations in models. This demonstrates the difficulty of \"locally erasing knowledge,\" and currently complete \"selective unlearning\" is not achieved. The spillover of accuracy degradation to nearby concepts poses application risks.\n\n**L2.** Experiments are limited to MCQs.\n\n**L3.** Experiments are limited to English.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-14"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces ELM, a novel method for concept-level unlearning in LLMs. ELM leverages the model's own introspective classification capabilities to reduce the likelihood of generating content related to undesired concepts. By using low-rank updates and targeted fine-tuning, ELM minimizes the probability of generating concept-specific content while preserving the model's broader capabilities. The method is validated through extensive experiments, showing strong performance in biosecurity, cybersecurity, and literary domain erasure tasks.\n\nSTRENGTHS AND WEAKNESSES:\nPros. \n\nThe insight is interesting, particular the statement that “models can implicitly evaluate the probability of that text belonging to a particular concept”. I believe the paper has some interesting contributions, but hope the authors could address my following questions.\n\nCons.\n\nI agree with the authors that concept unlearning is critical, yet the literature does not have its exact definition. The clear definition is closely related to the empirical evaluations. For example, by the authors’ description in the first paragraph in the Introduction, we may need to test not only on in-distribution data, but also on out-of-distribution data. \n\nCould the authors justify that the proposed method is more stable and better retention than gradient ascent-based methods? The related methods actually are not involved in Table 1, not to mention some more recent works in ICLR 25 and ICML 25. I list some of the representative ones in the following.\n1. Hessian-Free Online Certified Unlearning\n2. Rethinking LLM Unlearning Objectives: A Gradient Perspective and Go Beyond\n3. A Closer Look at Machine Unlearning for Large Language Models\n4. Certified Unlearning for Neural Networks\n\nCould the authors further clarify the drawbacks about the representation manipulation methods, echoing the discussion of “representation manipulation creates obvious behavioural artifacts”. \n\nI agree with the authors that the coherent text, rather than some random words, should be generated. However, can the authors show that the coherency can be to much extent preserved in their experiments. \n\nI don’t understand why the authors highlight that low-rank adaptation as one of their main contribution in their Abstract and Introduction. To me (forgive me if I am wrong), it is just a practical trick that can be used to further improve the performance of unlearning. So, could the authors elaborate why low-rank adaptation is an indispensable part in their algorithmic design. The combination of low-rank adaptation also makes the comparison with previous works not fair enough, as they use different ways to update model parameters. In other words, the experimental configurations are different. \n\nWhy the authors do not conduct experiments on TOFU, which is also an important unlearning benchmarks.\n\nPersonally, I think the proposed method can be categorized as a refined version of gradient ascent. \n\nHow do we get c_+? It is not mentioned in Page 4 and, to my knowledge, existing benchmarks typically do not have them by default. \n\nFormally, can you prove the first equation in Eq. 5 holds, following the rules of probability?\n\nWhat’s the difference between \\theta^* and \\theta? Seemingly not mentioned throughout the discussion. I think \\theta^* denotes the parameters to be unlearned. Yet, * is used for fixed variable in Eq 2 for x. Also, the definition of CE is not mentioned, using two probability as its input does not align with the classical definition. Do you mean KL or something else?\n\n The intuition below Eq 6 is reasonable, yet the derivation procedure, from Eq 3 (I think you cannot prove it is correct) to Eq 6. \n\nWhat’s your exact definition of unlearning? It is an important question. For example, if your goal is full removal, the likelihood of unlearning data should approach 0. Eq 6 does not fulfil this goal, I think.\n\nWhy the proposed method can claim concept unlearning, it seems that, similar to GA, only the original unlearning dataset is used for unlearning.\n\nWhy new metrics are proposed instead of using the old ones? Similar analysis like the following two papers may be introduced. \n1.\tEight Methods to Evaluate Robust Unlearning in LLMs\n2.\tUnlearning with Control: Assessing Real-world Utility for Large Language Model Unlearning\n\nAbout the experiments, a lot of hyperparameters are involved, so the algorithmic sensitivity to them are required. Also, original metrics used in WMDP are not used, which is not convincing (although I have to say that existing metrics have a lot of problem, but I do not think your proposed metrics can largely address their cons). Even for the crafted metrics from the authors, the proposed benchmarks do not always achieve the best results. Trade-off exists between unlearning and utility preservation, which I cannot tell if the proposed method is overall better.\n\nQUESTIONS:\nplease seem the pros and cons above.\n\nLIMITATIONS:\nplease seem the pros and cons above.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel concept erasure method for LLMs. The method designs specialized losses for different metrics and integrates them. The entire experiment is conducted on the WMDP dataset, and compared with multiple baseline methods such as RMU and RepNoise. Experimental results show that ELM has achieved significant performance improvements in Innocence, Specificity, and Seamlessness. The authors also conduct ablation experiments to verify the contributions of different components. In addition, this paper provides robustness experiments to validate the robustness of ELM against different attacks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. This paper is well-written with clear logic and concise readability. \n2. The paper conducts extensive experiments, including comparative experiments on models of different types and scales. \n3. The authors provide a wide range of comprehensive evaluation metrics.\n\n\nWeaknesses:\n\n1.The novelty of this paper is questioned. Combining losses for forgetting and retaining different concepts is not new, and the baseline RMU also has similar operations. \n2.Regarding the setup of the evaluation method: Are all evaluations conducted after the model forgets a single sample, or after the model forgets all samples? \n3.In Table 1, comparisons with baseline methods are missing for Qwen2.5 and llama3-70B, making the experiments inadequate. \n4.The paper states that LoRA achieves better performance than full fine-tuning but does not analyze the underlying reasons, leading to insufficient justification for choosing LoRA. \n5.There are too few baselines. As mentioned in the paper, knowledge editing methods similar to ELM can currently edit over 10,000 samples while maintaining original performance [1,2]. Can these methods serve as baselines, and what are the comparison results?\n\n[1] Reasons and Solutions for the Decline in Model Performance after Editing\n[2] Alphaedit: Null-space constrained knowledge editing for language models\n\nQUESTIONS:\nSee Weaknesses\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper explores the challenge of systematically removing specific conceptual knowledge from neural networks while preserving overall model functionality. The authors propose a method to identify and neutralize neuron activations associated with targeted concepts through a combination of activation analysis and parameter modification. By introducing a concept-erasure framework that combines causal tracing for concept localization and targeted parameter updates, they demonstrate the feasibility of selectively diminishing a model's ability to process specific concepts without significant degradation in unrelated tasks. The work contributes both a technical approach for concept-level model editing and an empirical evaluation of erasure effectiveness across multiple architectures and datasets. Experimental results show that the proposed method achieves superior concept suppression compared to baseline approaches while maintaining baseline performance on non-targeted tasks, with implications for model interpretability, safety, and ethical deployment. The paper also provides theoretical insights into the distributed nature of conceptual knowledge in neural representations through its ablation studies and visualization analyses.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**  \n\n1. The paper introduces a principled method (ELM) that combines activation analysis, parameter modification, and fluency preservation to systematically erase conceptual knowledge. This approach addresses limitations of prior methods (e.g., gradient reversal or dataset filtering) by balancing innocence (removing target knowledge), specificity (retaining unrelated capabilities), and seamlessness (coherent generation).  \n\n2. The authors rigorously test ELM across multiple architectures (e.g., Llama2, Zephyr) and datasets (WMDP, Harry Potter), demonstrating superior performance over baselines in suppressing targeted concepts while maintaining non-target task accuracy. The inclusion of adversarial robustness tests (e.g., GCG attacks) further validates the method’s practicality.  \n\n3. The work provides valuable analyses of knowledge localization in neural networks (e.g., probing layer-specific retention patterns) and trade-offs in erasure efficacy. For example, they identify optimal layer ranges (e.g., layers 4–7 in Zephyr) for balancing erasure depth and model functionality.  \n\n**Weaknesses**  \n\n1. The method requires extensive hyperparameter tuning (e.g., LoRA rank, erasure strength η) and layered interventions, which may hinder scalability or adoption in resource-constrained settings. The reliance on autoregressive training for fluency preservation also adds computational overhead.  \n\n2. ELM assumes explicit, classifier-identifiable concepts, but struggles with erasing knowledge that is implicitly encoded or distributed across the model (e.g., nuanced ethical reasoning). The paper notes gaps in fully eliminating harmful knowledge without leaving undetectable traces.\n\nQUESTIONS:\n1. The paper acknowledges that ELM affects semantically related concepts due to entangled representations. However, this \"ripple effect\" is only qualitatively discussed. Can the authors provide quantitative metrics (e.g., accuracy drops on adjacent concepts, probing results for related knowledge) to characterize the scope of unintended knowledge degradation?\n\n2. ELM requires extensive hyperparameter tuning (LoRA rank, erasure strength η, layer selection) and layered interventions. Could the authors compare ELM’s computational cost (e.g., training time, GPU hours) with baseline methods (e.g., RepNoise, RMU)? Additionally, could they explore automated hyperparameter optimization (e.g., Bayesian search, meta-learning) to reduce manual effort?\n\n3. The paper focuses on explicitly classifier-identifiable concepts but notes struggles with implicitly encoded or distributed knowledge (e.g., ethical reasoning). Could the authors design experiments to test ELM’s efficacy on indirectly represented concepts , such as: \n- **Adversarial prompts**: Using indirect phrasing (e.g., analogies, paraphrasing) to probe residual knowledge.  \n- **Multi-hop reasoning tasks**: Evaluating whether erased concepts resurface in compositional reasoning.  \n- **Implicit bias datasets**: Testing unlearning of socially sensitive attributes (e.g., gender stereotypes) where knowledge is diffusely encoded.  \n\n4. The paper evaluates erasure effectiveness immediately post-editing but does not assess long-term stability (e.g., whether erased knowledge reemerges after fine-tuning on new data). Could the authors conduct experiments where ELM-edited models are fine-tuned on downstream tasks involving the erased concepts? Additionally, how does ELM interact with subsequent training updates (e.g., catastrophic forgetting scenarios)?\n\nIf the author can effectively solve the above problems, I will improve my score.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}