In-Context Unlearning: Language Models as Few Shot Unlearners

TL;DR

The paper tackles unlearning in large language models under restricted access by proposing In-Context Unlearning (ICUL), a prompt-based method that flips forget-point labels and augments with correctly labeled context demonstrations to emulate retraining. It introduces LiRA-Forget as a principled, likelihood-ratio–based evaluation and validates ICUL across multiple datasets and LLMs, often matching or surpassing gradient-based unlearning while being far more memory-efficient. The results show ICUL effectively erases a training point's influence without parameter updates, with performance improving as model size grows and extending to open QA tasks like SQUAD. The work provides a new direction for privacy-preserving unlearning via prompt design and offers a framework for future improvements in handling larger deletion requests and broader tasks.

Abstract

Machine unlearning, the study of efficiently removing the impact of specific training instances on a model, has garnered increased attention in recent years due to regulatory guidelines such as the \emph{Right to be Forgotten}. Achieving precise unlearning typically involves fully retraining the model and is computationally infeasible in case of very large models such as Large Language Models (LLMs). To this end, recent work has proposed several algorithms which approximate the removal of training data without retraining the model. These algorithms crucially rely on access to the model parameters in order to update them, an assumption that may not hold in practice due to computational constraints or having only query access to the LLMs. In this work, we propose a new class of unlearning methods for LLMs called ``In-Context Unlearning.'' This method unlearns instances from the model by simply providing specific kinds of inputs in context, without the need to update model parameters. To unlearn specific training instances, we present these instances to the LLMs at inference time along with labels that differ from their ground truth. Our experimental results demonstrate that in-context unlearning performs on par with, or in some cases outperforms other state-of-the-art methods that require access to model parameters, effectively removing the influence of specific instances on the model while preserving test accuracy.

Figures (10)

• Figure 1: Differences between In-Context Unlearning and Standard Unlearning. Top: Traditional unlearning approaches require access to model parameters $\theta$ and these parameters are updated in response to deletion requests. Bottom: In-context unlearning does not require access to the parameters. Unlearning works by providing certain kinds of inputs in context which mimic the model’s performance as if the model was re-trained without the points.
• Figure 2: Demonstrating in-context unlearning. Left: The data set used to finetune the LLM. Right: In-context unlearning removes the influence that samples from the forget set $S_f$ (ID$1$ from the dataset) have on the completion by adding examples from the forget set with different labels to the in-context input (e.g., for "Name: Alice, Net Worth: 300K, Zip code: 1010" the label was changed randomly from Positive to Neutral).
• Figure 3: Evaluating ICUL sensitivity across model sizes. We empirically assess unlearning via ICUL with $L=6$ for 10 deletion requests on Bloom LLMs (560M, 1.1B, 3B, 7.1B) finetuned on the SST-2 dataset. Baseline indicates performance when no unlearning is conducted, while Benchmark indicates best possible performance. Vertical bars show $\pm 1$ standard deviation across 10 evaluation runs.
• Figure 4: ICUL is effective on state-of-the-art LLMs. We conduct empirical evaluations on unlearning via ICUL with varying numbers of deletion requests $(1, 10, 20)$ for a Llama2 (7B) LLM fine-tuned on the SST-2 dataset. Finetuning required an A100 GPU (80 GB), while unlearning through ICUL with $L=6$ was performed at inference time using a V100 GPU (32 GB). Baseline indicates performance when no unlearning is conducted, while Benchmark indicates best possible performance. Shades indicate $\pm 1$ standard deviation across 10 evaluation runs.
• Figure 5: Evaluating unlearning. We empirically evaluate unlearning across different unlearning methods for different number of deletion requests (1, 5, 10, 20) for a Bloom 1.1B model finetuned on different data sets (columns). For ICUL, we select the most competitive results for $L \in \{2, 4, 6\}$, while for GA we search over learning rates of $\{5 \cdot 10^{-5}, 3 \cdot 10^{-5}, 1 \cdot 10^{-5}, 5 \cdot 10^{-6}\}$. Shades indicate $\pm 1$ standard deviation across 10 evaluation runs. Reproducing these experiments requires approx. 1800 GPU hours on a V100 GPU (32GB). Top row -- Unlearning efficacy: LiRA-Forget performance at a fixed FPR=$0.01$. Baseline indicates performance when no unlearning is conducted. Ideally, GA and ICUL performance curves trace significantly below the Baseline and as close to the random guessing Benchmark (dashed line) as possible. Bottom row -- Model Performance: Test accuracies as we vary the number of deletion requests.