Machine Unlearning of Pre-trained Large Language Models

1 Introduction

• Prior LLM unlearning research has focused predominantly on fine-tuned models, while pre-training data are often unavailable and retraining pre-trained models is prohibitively costly.The paper identifies method adaptation and the lack of directly comparable baselines as additional challenges.Source: §1 · p. 1
• Three datasets compiled from arXiv, books, and GitHub support benchmarking, while approximate retraining simulates a retraining baseline with unseen in-distribution data.The baseline is proposed because retraining pre-trained models is impractical.Source: §1 · p. 2
• The benchmark uses thousands of 4096-token chunks from diverse sources, extending beyond prior studies limited to at most 128 samples or single sources.The authors describe this as a more realistic and challenging scenario.Source: §1 · p. 2
• The paper unifies seven unlearning methodologies for pre-trained LLMs under a shared framework.The methods are derived and adapted from the unified framework.Source: §1 · pp. 1–2
• Experiments across three domains demonstrate the efficacy of the unlearning methods, with approximate retraining used as an evaluation baseline.The baseline addresses the impracticality of retraining pre-trained LLMs.Source: §1 · p. 2
• The authors open-source a dataset that includes samples from a real pre-training dataset, typically a private and closed-source asset.Source: §1 · p. 2
• Combining gradient ascent with gradient descent on in-distribution data shows greater hyperparameter robustness, and the paper provides tuning guidelines for other methods.Source: §1 · p. 2

2 Problem Formulations

• The model is trained for next-token prediction by minimizing negative log-likelihood over a corpus of N sequences.Each sequence xi contains ti tokens.Source: §2 · p. 2
• Unlearning applies an algorithm to the vanilla model trained on D and outputs an unlearned model M′ to remove the effect of forget set U.Source: §2 · p. 2
• Exact unlearning requires matching the output distributions of unlearning and retraining on D \ U; approximate unlearning relaxes this requirement.Retraining on D \ U from scratch is a naïve exact solution but prohibitively expensive for LLMs.Source: §2 · pp. 2–3
• The empirical criterion compares unlearned-model validation performance on retained and forgotten data with vanilla-model performance on retained and unseen data, respectively.The paper notes that theoretical guarantees for LLMs are non-trivial and uses empirical performance comparisons pragmatically.Source: §2 · p. 3

3.1 Overview

• The framework specializes approximate unlearning through first-order gradient methods, while excluding class-level forgetting and approaches requiring all intermediate model or gradient information.The excluded methods are respectively not directly applicable to LLMs and too expensive in memory.Source: §3.1 · p. 3

3.2.1 Gradient Ascent (or Negative Gradient)

• Gradient ascent raises loss on the forget set, but too many epochs can also make the model forget information from the retained set.In practice, researchers often apply gradient ascent for only a few epochs.Source: §3.2.1 · p. 3

3.2.2 Fine-tuning with Random Labels

• Fine-tuning with random labels uses a uniform reference distribution, but may harm utility and performance and can mishandle duplicated sequences that should remain predictable.The paper notes that convergence on random labels often leads to a marked decrease in both utility and performance.Source: §3.2.2 · p. 3

3.2.3 Unlearning with Adversarial Samples

• Adversarial unlearning uses the most likely token other than the target as a substitute, simplifying the original approach because generating every alternative token is impractical.Top-k alternatives are also described as feasible.Source: §3.2.3 · p. 4

3.2.4 Gradient Ascent + Descent or KL Divergence on Retained Set

• The hybrid approach combines gradient ascent with retained-set optimization to balance forgetting and utility, using either direct gradient ascent or a KL-divergence constraint.The paper also assesses general pre-training data and in-distribution data matching the unlearning set for the retained-data term.Source: §3.2.4 · p. 4

4.1 Background

• Copyrighted material is the representative removal scenario, motivated by LLMs’ potential to reproduce protected content.The paper frames unlearning as a way to address legal and ethical concerns when copyrighted data has entered pre-training.Source: §4.1 · p. 4

4.2 Evaluation Metrics

• Evaluation checks accuracy and perplexity on forget and retain sets, downstream-task performance, and membership inference; approximate retraining uses unseen in-domain data because full retraining is impractical.The MIA uses Min-K% Prob and AUC; an AUC near 0.5 indicates random-guess performance.Source: §4.2 · pp. 4–6

4.3 Model and Datasets

• The evaluation uses Yi-6B and forget sets sampled from arXiv, GitHub, and books, with 4,096-token chunks and domain-matched approximate data.A 1,000-sequence sample from retained data serves as a general set.Source: §4.3 · p. 6

4.4 Results

• On arXiv, unlearned models slightly reduce next-token accuracy; on books, three strategies lower forget-set accuracy, while GitHub unlearning carries HumanEval utility losses.Gradient ascent alone improves average downstream accuracy on arXiv; MIA AUC scores decrease after unlearning, though the study notes that current MIA methods struggle to distinguish members from non-members.Source: §4.4 · pp. 7–8

4.5 Computational efficiency analysis

• Unlearning is approximately 105 times more computationally efficient than retraining for the evaluated Yi-6B setting.The estimate compares retraining on 3 trillion tokens with unlearning 2,000 sequences of 4,096 tokens each.Source: Table 5 · p. 8, §4.5 · p. 8

4.6 Ablation studies

• The gradient-ascent-and-descent method on in-distribution data tolerates learning-rate and step changes better than other methods; four optimization steps balance stability and unlearning quality.The suggested learning-rate search starts broadly within 5 × 10^-6 to 5 × 10^-5, then narrows the interval for a finer search.Source: §4.6 · pp. 8–9

Machine Unlearning

• Exact unlearning requires the unlearned model to match the retrained model, while approximate methods relax this requirement using distance or indistinguishability bounds.SISA is presented as a general framework for exact unlearning.Source: §5 · p. 9

Machine Unlearning in LLMs

• Prior LLM unlearning work includes efficient SISA extensions for classification models and gradient-ascent or targeted-removal methods for generative models, but has focused on fine-tuned models or one corpus source.The cited examples include Kumar et al. (2022), Jang et al. (2023), Eldan and Russinovich (2023), and Yao et al. (2023).Source: §5 · p. 9

Memorization and Forgetting

• Memorization can expose privacy risks through membership inference or verbatim extraction, whereas catastrophic forgetting is passive loss of prior knowledge rather than targeted unlearning.The passage distinguishes actively forcing a model to forget specified samples from losing knowledge during training on new data.Source: §5 · p. 9

• The study investigates removing copyrighted pre-training data from LLMs through a unified formulation and seven unlearning methodologies.Source: §6 · p. 9
• Experiments across three pre-training data domains validate the efficacy of the unlearning approaches.Source: §6 · p. 9
• Combining gradient ascent with gradient descent on in-distribution data enhances hyperparameter robustness, and the paper offers tuning guidelines.Source: §6 · p. 9

• Experiments primarily use Yi-6B; future work should test larger models, including 13B or 70B, and mixture-of-experts architectures.Source: Limitations · pp. 9–10
• Most LLMs do not open-source pre-training data, making forget-set collection infeasible, and the experiments cover three specific domains.Source: Limitations · pp. 9–10
• The work focuses on copyrighted-content unlearning; its methods are non-convergent and may reduce utility until convergence, making hyperparameter adjustment crucial.Source: Limitations · p. 10
• Approximate-unlearning evaluation is complex because member and non-member data are difficult to distinguish; the study calls for stronger MIA and alternative evaluation methods.Source: Limitations · p. 10
• The study focuses on unlearning data within a single domain while maintaining general capability, leaving task-specific unlearning and its effect on task performance for future work.Source: Limitations · p. 10

• The stated goal is to selectively forget particular training sequences while preserving the model’s utility.Source: Ethics Statement · p. 10
• The approach aims to address ethical concerns including copyright infringement and privacy breaches.Source: Ethics Statement · p. 10
• Evaluation datasets were compiled from publicly accessible sources in accordance with the collected data’s licenses.Source: Ethics Statement · p. 10

• Small batch sizes require more optimization steps, which can damage general utility, while larger batches reduce unlearning efficacy.Source: A Additional Ablation Studies · p. 14
• A batch size corresponding to four optimization steps is recommended to balance utility and unlearning effect.Source: A Additional Ablation Studies · p. 14
• Excessively large forget sets cause exponential perplexity increases on forget and general sets and significantly reduce model utility.Source: A Additional Ablation Studies · p. 14
• For large datasets, gradient ascent combined with in-distribution gradient descent is most stable, and a relatively large batch size is recommended.Source: A Additional Ablation Studies · p. 14

Approximate unlearning

• Approximate unlearning relaxes exact deletion by bounding the distance between unlearned and retrained model distributions, and may cover adaptively chosen subsets.The cited distance measures include Rényi divergence and indistinguishability.Source: B Related Work (Full Version) · p. 14

LLM unlearning

• Prior LLM unlearning work spans fine-tuned classification and summarization models, generative-model sequence removal, sensitive-information evaluation, and targeted knowledge removal.Examples include selective teacher-student methods, gradient ascent on target sequences, and replacing Harry Potter-specific terms with generic alternatives for fine-tuning.Source: B Related Work (Full Version) · p. 14

Memorization and forgetting

• Unintended training-data memorization can create privacy risks including membership inference, verbatim extraction, and property inference, whereas catastrophic forgetting is passive loss of learned knowledge during new training.Unlearning instead actively forces models to forget specific samples.Source: B Related Work (Full Version) · pp. 14–15

Unlearning and differential privacy

• Differential privacy and approximate unlearning use distributional closeness metrics, but compare different objects: neighboring datasets for DP and unlearning versus retraining on the same dataset.The passage describes DP as sufficient, but not necessary, for unlearning.Source: B Related Work (Full Version) · pp. 15–16

Unlearning and alignment

• Machine unlearning complements alignment methods such as supervised fine-tuning and reinforcement learning from human feedback by focusing on discouraging outputs misaligned with human values.The passage contrasts this focus with alignment methods that rely on human-generated demonstrations, rewards, or penalties.Source: B Related Work (Full Version) · p. 16

Second-order methods

• Second-order unlearning methods use Taylor expansion around a stationary point to derive Newton-type updates involving a Hessian inverse or approximation.The passage notes that Hessian-related computation is prohibitive for LLMs; applying these updates only to adapters or LoRA is proposed as a possible direction.Source: B Related Work (Full Version) · p. 16

Exact unlearning

• Exact unlearning corresponds to the (ϵ, δ) notion with ϵ = δ = 0, but may forgo trade-offs among unlearning quality, model utility, and time complexity.The passage characterizes exact unlearning as potentially too strong in general.Source: B Related Work (Full Version) · p. 16
• SISA partitions training data across K models and retrains affected models for a deletion request, but storing K LLM copies is impractical for pre-training.Its efficiency and utility depend on K: K = 1 reduces to retraining from scratch, while larger K can improve efficiency but may degrade utility.Source: B Related Work (Full Version) · pp. 16–17