From Evasion to Concealment: Stealthy Knowledge Unlearning for LLM s (2025)

Abstract: LLM Unlearning plays a crucial role in removing sensitive information from language models to mitigate potential misuse. However, previous approaches often treat nonsensical responses or template-based refusals (e.g., “Sorry, I cannot answer.”) as the unlearning target, which can give the impression of deliberate information suppression, making the process even more vulnerable to attacks and jailbreaks. Moreover, most methods rely on auxiliary models or retaining datasets, which adds complexity to the unlearning process. To address these challenges, we propose MEOW, a streamlined and stealthy unlearning method that eliminates the need for auxiliary models or retaining data while avoiding leakage through its innovative use of inverted facts. These inverted facts are generated by an offline LLM and serve as fine-tuning labels. Meanwhile, we introduce MEMO, a novel metric that measures the model’s memorization, to select optimal fine-tuning targets. The use of inverted facts not only maintains the covert nature of the model but also ensures that sensitive information is effectively forgotten without revealing the target data. Evaluated on the ToFU Knowledge Unlearning dataset using Llama2-7B-Chat and Phi-1.5, MEOW outperforms baselines in forgetting quality while preserving model utility. MEOW also maintains strong performance across NLU and NLG tasks and demonstrates superior resilience to attacks, validated via the Min-K% membership inference method.

## introduction llm unlearning is crucial to protecting sensitive information from potential leakage for large language models. based on the access of the model, previous research can be divided into three schools of thought: ❶ black box setting, where model weights are totally inaccessible. approaches under this setting are often inference-based, such as in-context-learning (icl; @xcite . ❷ grey box setting, where partial access to the model is available, such as logits or embedding space. approaches under this setting are always input- @xcite or output-based @xcite . ❸ white box setting (wbs), where the full model weights are accessible. under this setting, approaches are typically based on finetuning (e.g., gradient ascent @xcite and its variants), preference optimization @xcite , knowledge distillation @xcite , and model editing @xcite . although previous practices have achieved effective unlearning to some extent, we argue that these methods need to be rethought from two key perspectives. first, is it reasonable for unlearning to aim for refusal or nonsensical responses? as shown in fig. 1 , existing methods, such as ran- memo step1: fact inversion the kitty likes to meow. the kitty likes to fish. the kitty likes to dance. step2: memory supervised 0.6 0.1 0.2 origin answer: the kitty likes to memo. step3: fine-tuning with inverted facts forget set retain set real authors world facts train on full dataset question: what does the kitty like to do? 2 1 3 question answer question: what does the kitty like to do? answer: the kitty likes to meow. figure 2 : workflow of meow. for an original model trained on a full dataset, suppose the knowledge to be unlearned is "the kitty likes to memo." first, we use an offline llm to generate a set of labels that are factually opposite to the original knowledge. then, we compute the memo for each inverted fact and select the top k most appropriate ones as labels. finally, we fine-tune the origin model using these selected inverted facts to obtain the target model. as a result, when the target model is queried again, it generates a response that differs from the original, thereby achieving unlearning. second, the efficiency of these methods is equally important. efficiency issues arise on both the model and data levels. at the model level, methods such as preference optimization, klbased knowledge distillation, and logit ensemble approaches typically require a proxy model of comparable or smaller size to assist with the process, leading to additional training or inference costs. on the data level, some approaches rely on access to a complete retained dataset to maintain the model's utility. however, obtaining such a dataset is often impractical, as doing so would make retraining the model from scratch a more viable option. to tackle these challenges, we propose a streamlined method, meow, to stealthily unlearn specific knowledge in llms. under wbs, meow is a gradient descent-based method that avoids loss divergence and does not require auxiliary models or retaining datasets (fig. 2 ). the first step is to accurately quantify the memorization of sensitive information, which is critical for effective unlearning. to achieve this, we introduce a novel metric, memo, to measure how much individual sequences are memorized in llms. next, we generate alternative answers from the forgetting dataset and, guided by memo signals, select k of them to create a perturbation dataset. finally, we fine-tune the original model on this dataset to erase unwanted knowledge. extensive experiments on unlearning benchmarks, nlg/nlu tasks, and membership inference attacks (mia) demonstrate meow's superior performance compared to existing methods. we summarize our contributions as follows:(1) we propose memo, a novel metric for quantifying memorization in llms, offering superior effectiveness, efficiency, and compatibility with meow compared to traditional methods.(2) our simple yet effective method, meow, significantly improves forget quality without causing a substantial decline in model utility. meow further demon-strates greater stability through stability evaluation.(3) experiments on nlg and nlu benchmarks demonstrate that meow better preserves the models' original capabilities and exhibits greater robustness against mia attacks. ## related work memorization in llms memorization is an inherent capability of language models, but the rise of llms has introduced significant risks, such as privacy violations @xcite and breaches of confidentiality @xcite . as a result, quantifying memorization in llms has become a critical yet challenging research focus. a naïve approach might define memorization as all information stored within the model's weights. however, determining exactly what a model retains is impractical. to address this, researchers have shifted their focus toward extractability-information that can be retrieved from a model, particularly through verbatim recall @xcite . for example, carlini et al., 2019 measures out-of-distribution secrets memorized by language models using the exposure metric, which estimates the computational complexity of extracting sensitive information. however, these methods often require multiple inferences or retraining. extractability metrics @xcite specifically assess whether a string y can be reliably extracted from a model p given a prefix x. in contrast, counterfactual memorization @xcite measures how much the model architecture memorizes data distributions on average, rather than assessing the retrieval of specific examples. llm unlearning llm unlearning @xcite @xcite @xcite has its roots in machine unlearning (mu) @xcite , a concept originally developed to safeguard data privacy, particularly in response to regulations like the right to be forgotten. mu has been applied across various domains, including image classification @xcite @xcite @xcite ), text-toimage generation @xcite @xcite , federated learning @xcite @xcite @xcite , graph neural networks @xcite @xcite , and recommendation systems @xcite @xcite @xcite . however, traditional mu methods face key challenges when applied to llms: ❶ scale of parameters: llms typically consist of billions of parameters, making retraining from scratch computationally expensive and often impractical. ❷ generative nature of llms: unlike traditional nlp models, llms are predominantly used for generative tasks such as text generation, which require unlearning strategies tailored to their specific nature. recent research has begun to address these challenges, leading to the development of various llm-specific unlearning techniques. we categorize these methods to give a comprehensive overview of llm unlearning in §1. we also compare different llm unlearning methods under wbs in tab. 8 in the appendix. among them, meow is the first method that does not require retaining data or additional models and simultaneously ensures unlearning stealthiness. ## problem formulation given a dataset @xmath0, y) and an untrained llm m u , we train m u on d to obtain a trained llm m o , which serves as the original model for the unlearning task. to define the unlearning process, we divide the dataset into two subsets: the dataset to forget d @xmath1, y f ) and the dataset to retain d @xmath2, y r ). we then train m u on d r to obtain a retain model m r , which serves as the ground truth for evaluating the effectiveness of unlearning. additionally, we introduce a general-purpose evaluation dataset d @xmath3, y g ) to measure the model's general capabilities after unlearning. the goal of unlearning is to transform the original model m o into a target model m t , where the forgotten information from d f is no longer accessible. the nature of unlearning is defined by the type of responses the target model m t generates when prompted with content related to d f . hard unlearning involves the model refusing to respond, generating blank or templated outputs such as "i don't know," or producing nonsensical responses. however, such behavior can degrade the user experience and expose the model to attack risks, as discussed in §1. on the other hand, soft unlearning focuses on generating incorrect but contextually plausible responses, maintaining natural model behavior and reducing detectability. given the drawbacks of hard unlearning, we adopt soft unlearning as the primary goal in this paper. frozen truncatable comparable likes to meow. what does the kitty like to do? the kitty likes to memo. ## analysis and discussion in this section, we conduct a series of experiments to perform ablation studies and further exploration of meow. unless otherwise specified, the experiments use tofu-5% as the forget dataset and llama2-7b-chat as the base model. ## conclusion this paper introduces memo, a new metric quantifying memorization in llms, balancing efficiency and effectiveness. leveraging the memorization signals provided by memo, we introduce a novel llm unlearning method, meow. specifically, we first generate several alternative answers, rank them by memo, select the top or bottom answers as inverted facts, and finetune the original model. experiments on tofu demonstrate that meow demonstrates a clear improvement over existing methods regarding forget quality. furthermore, experiments show that meow also maintains strong performance across nlu and nlg tasks and demonstrates superior resilience to membership inference attacks. our research advances both memorization quantification and llm unlearning.