{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/does-unlearning-truly-unlearn-a-black-box","title":"Does Unlearning Truly Unlearn? A Black Box Evaluation of LLM Unlearning Methods","arxiv_id":"2411.12103","date":"2024-11-18","proceeding":null,"authors":["Jai Doshi","Asa Cooper Stickland"],"abstract":"Large language model unlearning aims to remove harmful information that LLMs have learnt to prevent their use for malicious purposes. LLMU and RMU have been proposed as two methods for LLM unlearning, achieving impressive results on unlearning benchmarks. We study in detail the efficacy of these methods by evaluating their impact on general model capabilities on the WMDP benchmark as well as a biology benchmark we create. Our experiments show that RMU generally leads to better preservation of model capabilities, for similar or better unlearning. We further test the robustness of these methods and find that doing 5-shot prompting or rephrasing the question in simple ways can lead to an over ten-fold increase in accuracy on unlearning benchmarks. Finally, we show that training on unrelated data can almost completely recover pre-unlearning performance, demonstrating that these methods fail at truly unlearning. The code is available at: https://github.com/JaiDoshi/Knowledge-Erasure.","url_abs":"https://arxiv.org/abs/2411.12103v2","url_pdf":"https://arxiv.org/pdf/2411.12103v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"does-unlearning-truly-unlearn-a-black-box","repo_url":"https://github.com/jaidoshi/knowledge-erasure","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"language-modeling","task_name":"Language Modeling"},{"task_slug":"language-modelling","task_name":"Language Modelling"},{"task_slug":"large-language-model","task_name":"Large Language Model"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2411.12103","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2411.12103"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jaidoshi/knowledge-erasure","reach":{"status":"ok"}}],"summary":{"unverified":8},"by_repo_kind":{"official":{"samples":8,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"ac0aa0acaf208ead","entry":"collate_dataset","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/perplexity/evaluate.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/perplexity/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ac0aa0acaf208ead"}},{"code_sha256_prefix":"ff0eb7e55a42cdd7","entry":"create_dataset","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/perplexity/evaluate.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/perplexity/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ff0eb7e55a42cdd7"}},{"code_sha256_prefix":"1454f4d95769c583","entry":"create_dataset","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/retraining/retrain_utils.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/retraining/retrain_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1454f4d95769c583"}},{"code_sha256_prefix":"02e38878471f0a46","entry":"load","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/common/utils.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/common/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"02e38878471f0a46"}},{"code_sha256_prefix":"7de47a6e9f939e94","entry":"make_inference","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/common/utils.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/common/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7de47a6e9f939e94"}},{"code_sha256_prefix":"ab794752420fda94","entry":"prepare_input","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/common/utils.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/common/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ab794752420fda94"}},{"code_sha256_prefix":"403b3409b5364e5e","entry":"tokenization","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/perplexity/evaluate.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/perplexity/evaluate.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"403b3409b5364e5e"}},{"code_sha256_prefix":"db5195a39ff06315","entry":"tokenization","repo":"jaidoshi/knowledge-erasure","repo_kind":"official","path":"evaluation/retraining/retrain_utils.py","file_url":"https://github.com/jaidoshi/knowledge-erasure/blob/HEAD/evaluation/retraining/retrain_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"db5195a39ff06315"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}