Beyond Single-Value Metrics: Evaluating and Enhancing LLM Unlearning with Cognitive Diagnosis (2025)

Abstract: Due to the widespread use of LLMs and the rising critical ethical and safety concerns, LLM unlearning methods have been developed to remove harmful knowledge and undesirable capabilities. In this context, evaluations are mostly based on single-value metrics such as QA accuracy. However, these metrics often fail to capture the nuanced retention of harmful knowledge components, making it difficult to assess the true effectiveness of unlearning. To address this issue, we propose UNCD (UNlearning evaluation using Cognitive Diagnosis), a novel framework that leverages Cognitive Diagnosis Modeling for fine-grained evaluation of LLM unlearning. Our dedicated benchmark, UNCD-Cyber, provides a detailed assessment of the removal of dangerous capabilities. Moreover, we introduce UNCD-Agent, which refines unlearning by diagnosing knowledge remnants and generating targeted unlearning data. Extensive experiments across eight unlearning methods and two base models demonstrate that UNCD not only enhances evaluation but also effectively facilitates the removal of harmful LLM abilities.

## introduction large language models (llms) have achieved remarkable success in generating coherent and contextually relevant text @xcite . however, as these models become more pervasive, concerns about their safety and ethical implications have grown. llms may inadvertently reproduce copyrighted material, disclose sensitive information, or generate harmful content such as toxic language or instructions for malicious activities @xcite @xcite @xcite ga @xcite and npo @xcite , two unlearning methods, do have reduced qa accuracy, but uncd reveals persistent knowledge concepts in unlearned models, highlighting the limitations of relying on a single aggregate metric. @xcite . these risks motivate the emerging research area of llm unlearning, which aims to mitigate such issues by selectively removing problematic influences from a model. there are two primary focuses regarding unwanted retention in language models. the first, data influence removal, focuses on eliminating the model's memorization of specific training data (e.g., copyrighted or sensitive documents), thereby addressing legal and privacy concerns. the second, model capability removal, seeks to eradicate undesirable behaviors or abilities that the model has acquired, such as generating instructions for cyberattacks @xcite . in real-world applications, while data influence removal helps mitigate legal risks, effective model capability removal is crucial for preventing the dissemination of dangerous knowledge that could directly facilitate malicious activities. unlike data influence removal, capability removal cannot be accomplished by simply retraining on a sanitized dataset, since harmful abilities often emerge from a diffuse and implicit combination of training signals. with this in mind, the evaluation of unlearned llms presents significant challenges, especially in reliably measuring the extent of forgetting. existing llm unlearning evaluations, such as those employed by benchmarks like muse @xcite , often rely on a single aggregated metric (e.g., qa accuracy, rouge @xcite , bleu @xcite ) to assess whether a model has "forgotten" specific training instances. although such coarse metrics might be effective for data influence removal, they become problematic for capability removal. harmful capabilities, such as cyberattack knowledge, are inherently multifaceted, comprising multiple distinct knowledge concepts (e.g., defense evasion, network intrusion, exploitation techniques) @xcite ). an aggregated metric may show an overall decrease in performance while leaving critical knowledge components intact, potentially leaving the model to continue generating harmful outputs. consequently, relying on these single-value metrics poses significant real-world risks, as residual harmful capabilities can persist unnoticed. to address these shortcomings, we draw inspiration from educational methodologies that emphasize fine-grained assessment. in educational settings, cognitive diagnosis modeling (cdm) @xcite ) is used to evaluate learners' mastery of discrete knowledge concepts, providing a detailed profile of their understanding. we argue that a similar approach is necessary for llm unlearning: by decomposing a harmful ability into its constituent knowledge concepts, one can more precisely determine which aspects have been unlearned and which remain, complementing the limitations of single-value metrics. motivated by the above, we introduce uncd (unlearning evaluation using cognitive diagnosis), a novel framework that leverages cdm to assess llm unlearning effectiveness at a granular level. we specifically focus on eliminating a model's ability to assist in cyberattacks, as cybersecurity provides an ideal domain for capability removal research due to its inherently multifaceted nature, encompassing discrete knowledge concepts such as defense evasion, network intrusion, and exploitation techniques. existing unlearning benchmarks (e.g., wmdp @xcite ) primarily offer a single aggregated qa accuracy metric, thereby overlooking the nuanced challenge of effectively erasing these individual, harmful components. we introduce a dedicated benchmark, uncd-cyber, to systematically evaluate multiple unlearning methods across two base models-llama-3-8b @xcite and mistral-7b @xcite . our findings reveal that single aggregated metrics often fail to capture nuanced shifts in a model's underlying knowledge. while overall performance may appear to degrade as intended, specific critical knowledge components can persist undetected. in contrast, our uncd provides a finegrained diagnostic, pinpointing precisely which knowledge concepts have been successfully removed and which remain, offering actionable insights for refining and improving unlearning strategies. as shown in fig. 1 , both gradient ascent (ga) @xcite and negative preference optimization (npo) @xcite yield a similar drop in qa accuracy, suggesting comparable unlearning if we rely on a single aggregate metric. the uncd uncovers persistent knowledge concepts-like defense-evasion and reconnaissance-indicating that the model can still generate malicious outputs. building on these insights, we propose uncd-agent, a further unlearning enhancement toward addressing residual harmful capabilities. uncd-agent identifies knowledge states resistant to unlearning and generates an additional forget set through a "test and unlearn" pipeline. notably, our experiments show that uncd-agent effectively performs further unlearning, achieving substantial improvements in removing harmful knowledge while preserving desirable model capabilities. in summary, our contributions are outlined below: ## uncd-agent-continuing unlearning building on the fine-grained insights of uncd, we further develop uncd-agent, a baseline agent designed to drive continued and targeted removal of residual, undesired model abilities after unlearning. uncd-agent is composed of the following two components in a test and unlearn process: once the persistent knowledge concepts are identified, uncd-agent leverages advanced llms (e.g.,gpt-4o) to process or generate an additional,highly targeted dataset. this dataset serves as the forget set that can specifically remove the targeted knowledge concept in further unlearning. specifically, uncd-agent first selects unlearned llms that exhibit an qa accuracy (acc) on the forget set significantly above random guess (e.g., 0.25 for 4-choice questions), which indicates unsuccessful ability removal. it then uses the diagnosed knowledge states from uncd to iden- in our implementation, we identify llama-3-8b unlearned with ga klr , npo klr , rmu and tv retained significant knowledge in the "privilege escalation" domain. therefore, we select "privilege escalation" as the targeted knowledge concept for further unlearning. for mistral-7b unlearned with ga klr , npo klr and rmu, we identify "initial access" as the persistent knowledge concept. we curate additional unlearning data specific to these knowledge concepts, details are shown in in a.2. figure 8 demonstrates that uncd-agent successfully reduces proficiency on the selected knowledge concepts, offering a promising test-andunlearn baseline for ongoing model harmful ability removal. ## conclusion in this paper, we present uncd, a novel method to benchmark llm capability removal, along with uncd-cyber, a comprehensive unlearning evaluation benchmark in the cybersecurity domain. our approach leverages cognitive diagnosis modeling (cdm) to provide a fine-grained and interpretable assessment of unlearning effectiveness, moving beyond traditional single-value metrics such as qa accuracy that often obscure the nuanced retention of harmful knowledge components. through extensive experiments across multiple unlearning methods and base models, we demonstrate that uncd not only enhances evaluation granularity but also aids in refining unlearning strategies by identifying residual knowledge components that persist after unlearning. by decomposing harmful model abilities into their constituent knowledge concepts, uncd enables precise diagnosis of which aspects have been successfully unlearned and which remain. this, in turn, enables our uncd-agent to further improve unlearning by iteratively diagnosing and mitigating residual knowledge.