PaperlayerView exact revision on arXiv

Source-linked AI summary

When Machine Unlearning Meets Retrieval-Augmented Generation (RAG): Keep Secret or Forget Knowledge?

Shang Wang, Tianqing Zhu, Dayong Ye, Wanlei Zhou

arXiv:2410.15267v3cs.CRcs.CL

TL;DR

Existing LLM unlearning schemes face deployment difficulty, high computational costs, catastrophic forgetting, and limited support for both sample and concept unlearning. This paper proposes RAG-based unlearning through external knowledge-base changes and reports success across five unlearning criteria.

  • Problem

    Existing LLM unlearning schemes are difficult to deploy, computationally costly, risk catastrophic forgetting, and do not support both sample and concept unlearning.

    Source: §VIII · p. 15

  • Method

    The framework constructs unlearned knowledge from retrieval and constraint components in a RAG external knowledge base, without modifying the LLM.

    Source: §I · p. 2

  • Results

    Experiments on open- and closed-source LLMs found the framework achieved effectiveness, universality, harmlessness, simplicity, and robustness.

    Source: §VIII · p. 15

  • Takeaways & Limitations

    The authors conclude the approach can safeguard copyrighted content and sensitive data, prevent harmful generation, and provide dynamic forgetting across LLMs, MLLMs, and agents.

    Source: §VIII · p. 15

Abstract

from arXiv · show

The deployment of large language models (LLMs) like ChatGPT and Gemini has shown their powerful natural language generation capabilities. However, these models can inadvertently learn and retain sensitive information and harmful content during training, raising significant ethical and legal concerns. To address these issues, machine unlearning has been introduced as a potential solution. While existing unlearning methods take into account the specific characteristics of LLMs, they often suffer from high computational demands, limited applicability, or the risk of catastrophic forgetting. To address these limitations, we propose a lightweight behavioral unlearning framework based on Retrieval-Augmented Generation (RAG) technology. By modifying the external knowledge base of RAG, we simulate the effects of forgetting without directly interacting with the unlearned LLM. We approach the construction of unlearned knowledge as a constrained optimization problem, deriving two key components that underpin the effectiveness of RAG-based unlearning. This RAG-based approach is particularly effective for closed-source LLMs, where existing unlearning methods often fail. We evaluate our framework through extensive experiments on both open-source and closed-source models, including ChatGPT, Gemini, Llama-2-7b-chat, and PaLM 2. The results demonstrate that our approach meets five key unlearning criteria: effectiveness, universality, harmlessness, simplicity, and robustness. Meanwhile, this approach can extend to multimodal large language models and LLM-based agents.

I. INTRODUCTION

The introduction proposes behavioral unlearning through RAG: modifying an external knowledge base to hide target knowledge without changing the LLM’s parameters. It frames unlearning as constructing retrieval and confidentiality constraints, and reports applicability across open- and closed-source models.

I. INTRODUCTION

  • Existing unlearning methods can incur high fine-tuning costs, be unusable with interface-only closed-source models, fail to remove related knowledge or resist recall, and risk catastrophic forgetting.The introduction cites Shumailov et al. [17] on recovery of forgotten knowledge through in-context abilities and regarding utility loss.Source: §I · p. 1
  • RAG retrieves relevant knowledge from an external base for LLM generation, enabling behavioral unlearning by supplying target-hiding information instead of revising model parameters.The introduction distinguishes behavioral unlearning [16]—changing behavior on target knowledge while preserving behavior on remaining knowledge—from exact unlearning, which seeks to remove associated parameters.Source: §I · pp. 1–2
  • The proposed framework implements behavioral unlearning by changing the external knowledge base, using retrieved information and confidentiality requirements to hide target knowledge without modifying LLM parameters.The authors frame construction of unlearned knowledge as a constrained optimization problem and use prompt engineering to optimize its retrieval and constraint components.Source: §I · pp. 1–2
  • The framework is designed for open- and closed-source LLMs, can use the target model to gather related knowledge against “un-unlearning,” and leaves unrelated-input utility unaffected.The introduction also claims adaptability to multimodal LLMs and LLM-based agents, with effective forgetting in both.Source: §I · p. 2
  • The framework reports state-of-the-art unlearning of samples and concepts, outperforming three representative schemes across five dimensions: effectiveness, universality, harmlessness, simplicity, and robustness.Experiments include GPT-4o, Gemini, and Llama-2-7b-chat, and examine jailbreak and adaptive attack scenarios.Source: §I · p. 2

II. BACKGROUND … 2) Existing LLM Unlearning:

The background defines unlearning as removing revoked data while preserving behavior on retained data, explains how RAG supplies external context to an LLM, and reviews the scope and limitations of existing LLM unlearning strategies.

1) The Definition of Machine Unlearning:

  • Machine unlearning aims to remove a contributor’s dataset DU from a trained model while preserving its behavior on the remaining data DR.The desired result behaves as if the model had not seen DU; for retained examples xj, F(xj) = FU(xj) is necessary.Source: 1) The Definition of Machine Unlearning · p. 2
  • Exact unlearning makes FU indistinguishable from a model retrained on DR, whereas approximate unlearning matches retrained-model activations and suits complex LLMs.Exact unlearning is practical only for tiny models; the standard definition does not directly extend to LLMs because their outputs differ from traditional models.Source: 1) The Definition of Machine Unlearning · pp. 2–3

2) The Workflow of RAG:

  • RAG retrieves relevant documents from an external knowledge base and combines them with the user prompt, giving the LLM context that can influence its output.Knowledge experts collect and update the documents; retrieval occurs before inference. The passage illustrates this with a Detective Conan query.Source: 2) The Workflow of RAG · p. 3

1) Machine Unlearning:

  • Machine unlearning addresses privacy and copyright concerns rooted in the right to be forgotten, and has extended to image classification, and graph neural networks.In small-scale models, requests can target samples, classes, or features.Source: 1) Machine Unlearning · p. 3
  • Small-model unlearning reorganizes or modifies data, or manipulates models through shifting and pruning; examples include SISA and Wang et al.’s channel-based class-unlearning scheme.Wang et al. quantify class discrimination across convolutional-neural-network channels.Source: 1) Machine Unlearning · p. 3

2) Existing LLM Unlearning:

  • LLM unlearning remains exploratory: retraining-based methods raise target loss through gradient ascent or relabel forgotten data as nonsensitive responses, but require model access.These approaches therefore cannot be applied to closed-source LLMs.Source: 2) Existing LLM Unlearning · p. 3
  • Huang et al. [10] use logit shifting to prevent sensitive output, but the approach depends on small-model performance and precise shifting calculations.The passage categorizes logit shifting as offset-based unlearning.Source: 2) Existing LLM Unlearning · p. 3
  • Pawelczyk et al. guide behavior with counterfactual in-context examples, risking privacy leaks because sensitive instances must be stored; offset- and input-based methods leave LLM parameters unchanged.These two methods constrain output behavior rather than altering model parameters.Source: 2) Existing LLM Unlearning · p. 3

3) Verification for Machine Unlearning: … B. The Definition of Behavioral LLM Unlearning

Behavioral LLM unlearning targets observable outputs because internal parameters and activations are difficult to interpret: responses should change for forgotten knowledge while remaining consistent for unrelated knowledge. The section distinguishes sample-level and concept-level forgetting and reviews verification methods and RAG foundations.

3) Verification for Machine Unlearning:

  • Verification seeks to prevent disclosure of target data and make the unlearned model resemble one that never saw it, using retraining time, privacy and security attacks, or accuracy.Rapid recovery of forgotten-data performance may indicate retention; Guo et al. use backdoored targets and measure attack-success-rate drops, while compares outputs with a model that never saw the target data.Source: 3) Verification for Machine Unlearning · p. 3
  • MIAs including LOSS, ZLib, GradNorm, and MinK should classify target data as ‘in’ before and ‘out’ after unlearning; the authors use MIAs to assess LLM unlearning.Prior work, used MIAs to assess residual LLM memorization; the authors describe their own evaluation in Section V-A.Source: 3) Verification for Machine Unlearning · p. 3

4) Retrieval-Augmented Generation:

  • RAG combines retrieval and generation to supply relevant background knowledge, support complex tasks and multi-turn dialogue [37], and reduce factual errors.Jiang et al. [38] optimized retrieval for speed and accuracy, while Siriwardhana et al. focused on integrating and using retrieved knowledge in generation.Source: 4) Retrieval-Augmented Generation · p. 3

A. Notations

  • The authors list the important symbols used to explain their definition and algorithm in Table II.The supplied table is titled “TABLE II NOTATIONS.”Source: A. Notations · p. 3, Table II · p. 4
  • Figure 2 presents the workflow of regular RAG and the workflow of RAG-based unlearning.The caption identifies the left figure as regular RAG and the right figure as RAG-based unlearning.Source: Figure 2 · p. 4

B. The Definition of Behavioral LLM Unlearning

  • Behavioral unlearning targets observable outputs, changing behavior on target knowledge while preserving responses on unrelated knowledge.The authors adopt this approach because poor LLM interpretability makes parameter- or activation-based unlearning impractical, and use RAG to constrain behavior for approximate unlearning rather than replace other schemes.Source: B. The Definition of Behavioral LLM… · p. 4
  • Sample unlearning makes the model forget information from specified training samples while preserving performance on data outside that set.For each forgetting sample, the unlearned model’s output should substantially differ from the original model’s output.Source: B. The Definition of Behavioral LLM… · p. 4
  • Concept unlearning targets specified knowledge, requiring outputs prompted about those concepts to deviate from the original while preserving normal responses to other concepts.A function G(Ci) can generate a question about concept Ci; the unlearning function is applied to the model’s response to that question.Source: B. The Definition of Behavioral LLM… · p. 4

C. Threat Model … A. The Overview of RAG-based Unlearning

The framework performs behavioral unlearning by changing a RAG system’s external knowledge and prompts rather than model parameters. It targets sample and concept unlearning across deployment settings, with criteria covering effectiveness, applicability, utility preservation, simplicity, and robustness.

C. Threat Model

  • The threat model covers post-deployment withdrawal of specific training samples for privacy or related concepts for copyright compliance and harmful-content removal.The model’s suppression of target knowledge is verified after unlearning.Source: C. Threat Model · p. 4, Figure 3 · p. 5
  • For sample unlearning, providers identify samples; for concept unlearning, they need only know the target concepts, and they control the retriever, knowledge base, and prompt template.They need not access the LLM’s parameters or the training samples corresponding to target concepts.Source: C. Threat Model · p. 5
  • Normal users may submit arbitrary inputs but cannot access model parameters or intermediate activations, or bypass the RAG pipeline to reach the base LLM.Under this assumption, behavioral suppression blocks access to target knowledge.Source: C. Threat Model · p. 5

D. LLM Unlearning Criteria

  • The approach is motivated by existing methods’ complexity, computational cost, utility risks, and difficulty supporting both sample and concept unlearning.These limitations are especially problematic for broad applicability, including closed-source models.Source: D. LLM Unlearning Criteria · p. 5
  • The scheme targets both sample and concept requests and is designed for open- and closed-source LLMs, with potential application to multimodal LLMs and LLM-based agents.These are its effectiveness and universality criteria.Source: D. LLM Unlearning Criteria · p. 5
  • The scheme avoids parameter modification and complex operations, aiming to preserve model utility while using few computational resources.These are its harmlessness and simplicity criteria.Source: D. LLM Unlearning Criteria · p. 5
  • The scheme’s robustness criterion addresses jailbreak, and prompt injection attacks [1], while its practical threat model considers adaptive prompts crafted by users who know the framework.The paper notes that this adversarial threat’s potential impact is analyzed separately.Source: D. LLM Unlearning Criteria · p. 5, A. The Overview of RAG-based Unlearning · p. 5

A. The Overview of RAG-based Unlearning

  • The provider adds confidentiality instructions to retrieved knowledge and prompt templates, suppressing responses about target data while leaving the underlying LLM unchanged.The template can be manually created and directs the model to use retrieved content when a prompt matches the knowledge base.Source: A. The Overview of RAG-based Unlearning · p. 5

B. Identify Key Optimization · C. Design of Unlearned Knowledge · 1) Crafting Constraint Component Q:

The framework treats RAG-based unlearning as constrained optimization over an unlearned knowledge set, then constructs knowledge with retrieval and confidentiality components. For the confidentiality component, it uses a heuristic generation-and-checking process rather than optimizing against the LLM directly.

B. Identify Key Optimization

  • For forgotten concepts, the framework generates confidentiality-constrained knowledge in UK, combines it with benign knowledge BK, and retrieves the relevant item as context.This is framed as a constrained optimization problem for concept unlearning.Source: B. Identify Key Optimization · pp. 5–6
  • The optimization uses a verifier to assess forgetting, a generator to create concept-related questions, and a retriever to extract relevant knowledge; it focuses on UK.The stated objective is to achieve a large value in Equation 1 by optimizing the unlearned knowledge set.Source: B. Identify Key Optimization · p. 6

C. Design of Unlearned Knowledge

  • Unlearned knowledge combines Q, which enables retrieval, and P, which constrains LLM behavior; the framework concatenates them as k = P + Q.When k is used as context for the target, the LLM can give a confidentiality response, such as refusing to answer.Source: C. Design of Unlearned Knowledge · p. 6

1) Crafting Constraint Component Q:

  • Component Q is intended to elicit refusal regardless of the target-related prompt, while direct optimization is costly, may require inaccessible model parameters, and may not generalize across LLMs.The authors use a heuristic approach that does not rely on optimization to address these challenges.Source: 1) Crafting Constraint Component Q · p. 6
  • An additional LLM, such as GPT-4o, generates Q from instructions to prevent content about the target, with a word limit V to conserve computational resources.The prompt asks for a confidentiality requirement and caps its length at V words.Source: 1) Crafting Constraint Component Q · p. 6
  • The generated Q is tested as context for a related prompt; if the response remains related to the target, Q is regenerated until refusal or the maximum attempt T 1.The paper reports that a single query is generally sufficient to craft a usable Q.Source: 1) Crafting Constraint Component Q · p. 6

2) Crafting Retrieval Component P:

The retrieval component P is tailored to the unlearning target: samples are copied directly, while concepts receive comprehensive descriptions intended to improve retrieval relevance. When input prompts are unavailable, the unlearned model generates those descriptions.

2) Crafting Retrieval Component P:

  • For sample unlearning, P is set directly to the target sample xi, making the unlearned knowledge k = xi + Q.The method assumes each sample is most similar to itself.Source: 2) Crafting Retrieval Component P · p. 6
  • For concept unlearning, P must comprehensively cover knowledge about the concept; retrieval uses semantic and keyword matching similar to Blended RAG [42].When input prompts are unavailable, the unlearned model generates descriptions from multiple aspects to improve their retrieval ranking.Source: 2) Crafting Retrieval Component P · pp. 6–7
  • The concept description set P contains M knowledge items, each limited to V words, and is intended to make related queries retrieve confidential knowledge that prompts forgetting.The passage describes the resulting knowledge as both confidential and highly relevant to prompts related to the target concept.Source: 2) Crafting Retrieval Component P · p. 7

D. Extend to MLLMs and LLM-based Agents · V. EXPERIMENT · A. Experimental Settings

The section proposes extending RAG-based unlearning to multimodal LLMs and LLM-based agents, and describes experiments evaluating unlearning across closed- and open-source models. Its settings distinguish concept from sample unlearning and use output similarity, forgetting success, and residual memorization metrics.

D. Extend to MLLMs and LLM-based Agents

  • RAG-based unlearning may hide target data in MLLMs and support sample or concept unlearning in agents, whose RAG use matches that of LLMs [43], [44].The authors describe direct application to text-to-image models and note that RAG techniques for non-text inputs have also been proposed.Source: D. Extend to MLLMs and LLM-based Agents · p. 7

A. Experimental Settings

  • Experiments on closed- and open-source LLMs evaluate five proposed criteria, using GPT-4o as an extra retrieval module to find relevant content in the unlearned knowledge base.For each experiment, GPT-4o uses natural-language understanding to retrieve relevant content.Source: A. Experimental Settings · p. 7
  • ChatGPT used GPT-4o and Gemini’s technical details were undisclosed; because neither closed-source model could be fine-tuned, the experiments tested concept unlearning only.The authors note that unavailable training data also hinders fine-tuning.Source: A. Experimental Settings · p. 7
  • For closed-source models, the authors selected 100 Wikipedia topics confirmed to be known, generated confidentiality requirements, and created five questions per topic for forgetting evaluation.Five aspects per topic were used by default unless otherwise specified.Source: A. Experimental Settings · p. 8
  • Llama-2-7b-chat supported both unlearning types: sample experiments fine-tuned on 2,000 Tiny-nq items and used prefixes to elicit trained-sample suffixes via a data-extraction attack, [21].Tiny-nq is a subset of NQ containing natural question-answer pairs.Source: A. Experimental Settings · p. 8
  • For Llama concept unlearning, 100 Wikipedia topics each received five questions, while gradient ascent, µ-unlearning [10], and in-context unlearning used GPT-4o-generated question-answer pairs as targets.Fine-tuning was unnecessary for Llama concept unlearning; the generated baseline pairs differed from forgotten-set prompts.Source: A. Experimental Settings · p. 8
  • ROUGE-L recall measures output match to the original answer, with lower scores indicating greater divergence, while USR measures forgetting attempts judged successful by GPT-4o.The original LLM’s output serves as the correct answer for each forgotten-set data point.Source: A. Experimental Settings · p. 8
  • Min-K was selected from four membership-inference attacks, with K = 20; TPR@1%FPR measures residual memorization, and lower values toward 1% indicate more forgetting.On the original LLM, Min-K achieved 4.1%; experiments were repeated five times and reported as mean ± standard deviation.Source: A. Experimental Settings · pp. 8–9

B. Effectiveness

RAG-based unlearning suppresses forgotten knowledge across closed- and open-source models, harmful-output prompts, and rephrased prompts. Its effectiveness depends on retrieval mapping prompts to unlearned knowledge containing confidentiality requirements.

Closed-source LLMs

  • 99.3% average USR, 0.04 average ROUGE, and 1.4% TPR@1%FPR show RAG-based unlearning suppresses forgotten concepts on ChatGPT and Gemini, outperforming the baseline.The baseline scores were 5.2% USR, 61.7 ROUGE, and 3.2% TPR@1%FPR; GPT-4o retrieval achieved a 100% hit success rate.Source: B. Effectiveness · p. 9, Table IV · p. 10

Open-source LLMs

  • 100% USR, 0.0 ROUGE, and 1.2% TPR@1%FPR show perfect sample forgetting, exceeding gradient ascent’s 75.8% USR, 32.7 ROUGE, and 2% TPR@1%FPR.The retrieved knowledge for a trained sample includes the sample itself and a confidentiality requirement.Source: B. Effectiveness · p. 9, Table IV · p. 10
  • 99.8% USR and 1.3% TPR@1%FPR show effective concept unlearning on Llama-2-7b-chat, while all three baselines remain below 40% USR.The retrieval model continued to retrieve the forgotten concepts accurately.Source: B. Effectiveness · p. 9, Table IV · p. 10

RAG-based Unlearning Against Harmful Output

  • RAG-based unlearning outperforms the other three schemes on USR and harmful output probability, almost completely restricting generation about the 25 tested malicious topics.The fine-tuned Llama-2-7b-chat initially had a 91.2% probability of harmful output; in-context unlearning still scored 76.2% HOP.Source: B. Effectiveness · p. 9, Table V · p. 10

Ununlearning

  • More than 97.4% USR against rephrased prompts shows RAG-based unlearning resists prompt rewriting, while the other three schemes struggle to forget the target concepts.Rephrased prompts can still map to related unlearned knowledge; the paper describes the existing schemes as non-robust to strict concept unlearning and limited to collected samples.Source: B. Effectiveness · pp. 9–10, Table VI · p. 10

C. Universality

The section presents RAG-based unlearning as applicable across varied closed- and open-source LLMs, with strong reported forgetting outcomes attributed to confidentiality requirements in retrieved knowledge.

C. Universality

  • Across two unlearning objectives, RAG-based unlearning achieves high USR and low ROUGE, and the scheme is reported to apply across closed-source LLMs.Source: C. Universality · p. 10
  • The authors attribute model-type insensitivity to confidentiality requirements in retrieved knowledge and suggest the approach can guide unlearning for MLLMs and LLM-based agents.Source: C. Universality · p. 10
  • Across models, closed-source concept unlearning averaged a 100% unlearning rate; open-source sample USR was 96.2% for Llama-2-13b-chat and 98.3% for Vicuna-7B, while concept USR averaged 98.8%.Sample unlearning was not conducted on PaLM 2 because fine-tuning it was too resource-intensive.Source: C. Universality · p. 10, Table VII · p. 11

D. Harmlessness · E. Simplicity

RAG-based unlearning largely preserves general model utility by changing the external knowledge base rather than model parameters, while keeping unlearning lightweight and extensible across LLMs and knowledge-base scales.

D. Harmlessness

  • RAG-based unlearning minimally affects Llama-2-7b-chat utility on MMLU and ARC and performs strongly across most metrics for both sample and concept forgetting.Its results are similar to those of models without unlearning, highlighting catastrophic forgetting as a challenge for other schemes.Source: D. Harmlessness · p. 11, Table VIII · p. 12
  • Gradient ascent-based and µ-unlearning can also suppress responses to similar, non-forgotten queries, as illustrated by refusals about Conan Doyle after forgetting Harry Potter.These schemes may mistakenly classify similar queries as forgotten targets, undermining unlearning’s goal.Source: D. Harmlessness · p. 11, Figure 6 · p. 11
  • RAG-based unlearning leaves the LLM’s internal workings unchanged; for non-forgotten samples or concepts, the retriever finds no knowledge-base information, so the LLM answers the original prompt normally.This mechanism is intended to preserve utility while enabling sample and concept unlearning.Source: D. Harmlessness · p. 11

E. Simplicity

  • RAG-based unlearning takes 1 minute for five concepts, 75.4× less time than gradient ascent-based schemes.It only constructs the knowledge base; gradient ascent and µ-unlearning require fine-tuning, and µ-unlearning also requires offset calculation. In-context unlearning runs fastest but is largely ineffective in most cases.Source: E. Simplicity · p. 11, Table IX · p. 11
  • Runtime remains stable across Llama-2-7b-chat, Llama-2-13b-chat, and Llama-2-70b-chat when each request forgets five concepts.The scheme avoids fine-tuning and uses only limited queries to construct the knowledge base.Source: E. Simplicity · p. 11, Table X · p. 12
  • Runtime grows linearly with the number of target concepts, at approximately 13.3N seconds for N concepts.The knowledge base grows with target concepts because some items must be crafted for each one.Source: E. Simplicity · p. 11, Table XI · p. 12
  • RAG-based unlearning can provide behavioral unlearning as a plug-in service in many commercial LLMs.The paper presents this as an extension of the scheme’s simplicity and practicality.Source: E. Simplicity · p. 11

F. Robustness · VI. CASE STUDY · A. Case Study One: RAG-based Unlearning for Multimodal Large Language Model

The paper reports that RAG-based unlearning resists jailbreak and prompt-injection attacks, and illustrates concept removal in a black-box text-to-image model while outlining possible audio extensions.

F. Robustness

  • USR remained above 87% under three jailbreak strategies, while prompt injection had nearly negligible impact, supporting strong resistance to both attack types.Failures arose when long prompts impeded retrieval or confidentiality requirements conflicted with jailbreak commands.Source: Figure 7 · p. 12, F. Robustness · p. 12

VI. CASE STUDY

  • The case-study section presents RAG-based unlearning for MLLMs and RAG-Flow as two demonstrations of the approach.Source: §VI · p. 12

A. Case Study One: RAG-based Unlearning for Multimodal Large Language Model

  • Existing unlearning schemes require access to full or partial MLLM parameters and parameter modifications, making black-box application challenging; they also rely on prior concept knowledge and cannot forget synonymous concepts.Source: A. Case Study One: RAG-based… · pp. 12–13
  • RAG-based unlearning constructs forgotten knowledge for each concept and redesigns the constraint component to make a black-box MLLM pretend to forget it.Source: A. Case Study One: RAG-based… · p. 13
  • In DALL·E 3, generated images after unlearning no longer contained elements related to the forgotten concepts “tomato” and “kola.”Source: A. Case Study One: RAG-based… · p. 13
  • For audio MLLMs, the proposed extension would use textual unlearned knowledge, corresponding human-voice audio, and audio embeddings for retrieval; noise and audio integration remain challenges.CLAP is given as an example of an audio embedding.Source: A. Case Study One: RAG-based… · p. 13

B. Case Study Two: RAG-Flow … B. The Impact of Each Component

The case study and discussion show that retrieval and output constraints work together for effective RAG-based unlearning, while sufficient exposure of unlearned knowledge can weaken it. RAG-Flow results also demonstrate concept unlearning in a closed-source setting and an LLM-based agent.

B. Case Study Two: RAG-Flow

  • In RAG-Flow, retrieval accuracy reached 96.2%, generation USR reached 95.3%, and LLM-agent USR reached 93.6%.Because RAG-Flow is a black-box scenario, the case study focuses on concept unlearning; it uses bge-reranker-v2-m3 for retrieval and DeepSeek-chat for generation.Source: B. Case Study Two: RAG-Flow · p. 13

VII. DISCUSSION

  • The discussion also examines retrieval-algorithm effects and a similar scenario applying unlearning schemes to RAG frameworks.It frames these topics alongside adaptive-adversary resilience and the impact of individual components.Source: §VII · p. 13

A. Resilience to Adaptive Adversary

  • At exposure ≤40%, USR stayed above 65%, but it dropped to 20.9% in the worst case as attackers gained access to more unlearned knowledge.Table XII covers adaptive prompt-injection attacks and reports USR for sample and concept unlearning across exposure levels.Source: Table XII · p. 13, A. Resilience to Adaptive Adversary · p. 14
  • Adaptive attackers who know the framework could infer some or all unlearned knowledge and craft override prompts to elicit confidential content.The evaluation simulates attackers with access to 20%, 40%, 60%, 80%, or 100% of the unlearned knowledge.Source: A. Resilience to Adaptive Adversary · pp. 13–14
  • Prompt cleansing and adversarial prompt detection are proposed retrieval-stage filters, while optimizing unlearned-knowledge representation [1] is future work.The paper notes that providers can also use access controls to prevent leakage of unlearned knowledge.Source: A. Resilience to Adaptive Adversary · p. 14

B. The Impact of Each Component

  • With both retrieval and constraint components, RAG-based unlearning achieves average USR 99.1% and hit rate 99.3%, versus retrieval-only at 5.2% USR/98.6% hit rate and constraint-only at 22.5% USR/19.4% hit rate.Source: B. The Impact of Each Component · p. 14
  • Retrieval injects relevant unlearned knowledge, while constraints regulate output behavior; together, they are essential for effective unlearning.Without constraints, relevant retrieval alone does not effectively forget target samples or concepts; without relevant knowledge, constraints rarely contribute meaningfully.Source: B. The Impact of Each Component · p. 14

C. The Impact of Retrieval Algorithm · D. Unlearning for RAG · VIII. CONCLUSION

The paper evaluates retrieval choices for RAG-based unlearning, discusses challenges in unlearning from RAG knowledge bases, and concludes that its scheme addresses limitations of prior LLM unlearning methods while supporting broad applications.

C. The Impact of Retrieval Algorithm

  • The evaluation replaced GPT-4o with Self-RAG and Contriever; Self-RAG uses reflection tokens and dynamic retrieval, while Contriever uses contrastively trained dense vectors.The retrieval accuracy comparison used the forgotten concept set to construct the unlearned knowledge base.Source: C. The Impact of Retrieval Algorithm · p. 14
  • GPT-4o achieved 100% retrieval accuracy, compared with 98.2% for Self-RAG and 97.6% for Contriever.The authors attribute the alternatives’ failed attempts to prompts without concept words, since both use text similarity rather than semantic similarity.Source: Figure 9 · p. 14, C. The Impact of Retrieval Algorithm · p. 14

D. Unlearning for RAG

  • For RAG unlearning, removing knowledge-base items can be inefficient at scale, and precisely locating the specific knowledge to remove is technically challenging.The issue arises for large, constantly evolving knowledge bases.Source: D. Unlearning for RAG · pp. 14–15

VIII. CONCLUSION

  • Existing LLM unlearning schemes require complex operations and prior knowledge, consume significant computation, risk catastrophic forgetting, and fail to support both sample and concept unlearning.These limitations make deployment difficult, especially for closed-source models.Source: §VIII · p. 15
  • The proposed RAG-based scheme constructs unlearned knowledge using two components for each forgotten sample or concept, without directly describing those components here.Source: §VIII · p. 15
  • Experiments on open- and closed-source LLMs showed the scheme achieved five criteria: effectiveness, universality, harmlessness, simplicity, and robustness.The paper presents it as a way to safeguard copyrighted content and sensitive data and prevent harmful outputs.Source: §VIII · p. 15
  • The authors say the scheme’s simplicity supports dynamic forgetting across LLMs, multimodal LLMs, and LLM-based agents.Source: §VIII · p. 15

Related papers

Loading 2410.15267v3…