Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LLM Unlearning with LLM Beliefs

Kemou Li, Qizhou Wang, Yue Wang, Fengpeng Li, Jun Liu, Bo Han, Jiantao Zhou

TL;DR

The paper tackles the challenge of unlearning in large language models, showing that gradient ascent–based methods cause a squeezing effect where probability mass shifts to semantically related continuations, leading to spurious forgetting. It introduces a bootstrapping framework that leverages the model’s own high-confidence predictions (model beliefs) to jointly penalize targets and their high-probability neighbors, instantiated as BS-T (token-level) and BS-S (sequence-level). The authors provide theoretical analysis within a learning-dynamics framework to explain how BS-T reshapes residual updates and mitigates mass-squeezing, and they validate the approach with extensive experiments across TOFU, MUSE, and WMDP benchmarks, demonstrating improved forgetting with retained utility. The work proposes a practical path toward more reliable unlearning by explicitly modeling internal beliefs, potentially enhancing safety and privacy in deployed LLMs.

Abstract

Large language models trained on vast corpora inherently risk memorizing sensitive or harmful content, which may later resurface in their outputs. Prevailing unlearning methods generally rely on gradient ascent and its variants to lower the probability of specific target responses. However, we find that this strategy induces a critical side effect: probability mass is redistributed into high-likelihood regions, often corresponding to semantically related rephrasings of the targets. We refer to this as the squeezing effect, which explains why many methods yield merely spurious unlearning, a problem further obscured by automated metrics (e.g., ROUGE, truth ratio) that misreport actual success. To address this, we propose a bootstrapping (BS) framework that explicitly links the squeezing effect with the model's own high-confidence generations, namely its model beliefs. Since model beliefs inherently capture the very high-likelihood regions where probability mass is squeezed, incorporating them into the unlearning objective directly counters the squeezing effect. By jointly suppressing both target responses and model beliefs, BS-T (token) attenuates high-probability tokens, whereas BS-S (sequence) removes entire high-confidence generations, together achieving more thorough forgetting while preserving utility. Extensive experiments across diverse benchmarks with various model families confirm the effectiveness of our approach.

LLM Unlearning with LLM Beliefs

TL;DR

The paper tackles the challenge of unlearning in large language models, showing that gradient ascent–based methods cause a squeezing effect where probability mass shifts to semantically related continuations, leading to spurious forgetting. It introduces a bootstrapping framework that leverages the model’s own high-confidence predictions (model beliefs) to jointly penalize targets and their high-probability neighbors, instantiated as BS-T (token-level) and BS-S (sequence-level). The authors provide theoretical analysis within a learning-dynamics framework to explain how BS-T reshapes residual updates and mitigates mass-squeezing, and they validate the approach with extensive experiments across TOFU, MUSE, and WMDP benchmarks, demonstrating improved forgetting with retained utility. The work proposes a practical path toward more reliable unlearning by explicitly modeling internal beliefs, potentially enhancing safety and privacy in deployed LLMs.

Abstract

Large language models trained on vast corpora inherently risk memorizing sensitive or harmful content, which may later resurface in their outputs. Prevailing unlearning methods generally rely on gradient ascent and its variants to lower the probability of specific target responses. However, we find that this strategy induces a critical side effect: probability mass is redistributed into high-likelihood regions, often corresponding to semantically related rephrasings of the targets. We refer to this as the squeezing effect, which explains why many methods yield merely spurious unlearning, a problem further obscured by automated metrics (e.g., ROUGE, truth ratio) that misreport actual success. To address this, we propose a bootstrapping (BS) framework that explicitly links the squeezing effect with the model's own high-confidence generations, namely its model beliefs. Since model beliefs inherently capture the very high-likelihood regions where probability mass is squeezed, incorporating them into the unlearning objective directly counters the squeezing effect. By jointly suppressing both target responses and model beliefs, BS-T (token) attenuates high-probability tokens, whereas BS-S (sequence) removes entire high-confidence generations, together achieving more thorough forgetting while preserving utility. Extensive experiments across diverse benchmarks with various model families confirm the effectiveness of our approach.
Paper Structure (46 sections, 4 theorems, 27 equations, 6 figures, 6 tables, 2 algorithms)

This paper contains 46 sections, 4 theorems, 27 equations, 6 figures, 6 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Preliminaries: From Concepts to Practices
  3. Problem Definitions
  4. Existing Methods
  5. Existing Evaluations
  6. Rethinking Existing Works: Failure Modes and Mechanisms
  7. Case Studies: Identifying Spurious Unlearning under Misleading Metrics
  8. Mechanistic Analysis: The Squeezing Effect behind Spurious Unlearning
  9. New Method: Bootstrapping-based Unlearning
  10. Algorithm: Bootstrapping at Token and Sequence Levels
  11. Theoretical Analysis: How BS-T Mitigates Squeezing Effect?
  12. Experiments
  13. Experimental Setup
  14. Experimental Results
  15. Conclusions
  16. ...and 31 more sections

Key Result

Lemma 4.0

Let $\bm{\mathsf{\chi}}_{\rm u}=[{\mathbf x}_{\rm u};{\mathbf y}_{\rm u}]$ be an unlearning pair and $\bm{\mathsf{\chi}}_{\rm o}=[{\mathbf x}_{\rm u};{\mathbf y}_{\rm o}]$ be the same prompt with any candidate response. Under teacher forcing and the lazy eNTK assumption, one SGD step with learning r where $\mathcal{A}_t(\bm{\mathsf{\chi}}_{\rm o})=\bm{I}-\mathbf{1}\pi^{\top}_{{\bm{\theta}}^t}(\cdo

Figures (6)

  • Figure 1: Motivation and overview of our work.Left: Suppressing only target responses appears effective but shifts probability mass into semantically related regions (squeezing effect), yielding spurious unlearning. Right: Our bootstrapping framework addresses this by incorporating model beliefs: BS-T suppresses high-probability tokens, while BS-S augments full high-confidence sequences, enabling more thorough forgetting.
  • Figure 2: (a) Semantic similarity of responses across likelihood bands (high/mid/low) and unlearning methods (NPO vs. retrain). High-likelihood outputs remain most semantically related, and NPO preserves similarity substantially more than retrain. (b) Log-probability dynamics under GA: probability mass is initially shifted to high-likelihood regions but later collapses due to overly aggressive updates. (c) Log-probability dynamics under NPO: probability mass is consistently retained in high-likelihood paraphrases, sustaining the squeezing effect.
  • Figure 3: Illustration of residuals for GA vs. BS-T.
  • Figure 4: LaaJ evaluation on TOFU 10%.
  • Figure 5: Aggregate score (Agg.) of BS-T and BS-S under different combinations of hyperparameters on TOFU 10% forget setting with LLaMA-3.1-8B.
  • ...and 1 more figures

Theorems & Definitions (6)

  • Lemma 4.0: AKG Decomposition ren2025learning_dynamics_LLM
  • Theorem 4.1: Residual Terms for GA vs. BS-T
  • Lemma D.0: AKG Decomposition ren2025learning_dynamics_LLM
  • proof
  • Theorem D.1: Residual Terms for GA vs. BS-T
  • proof