Source-linked AI summary
Cascade: Hierarchical Recoverability Control for Large Language Model Unlearning
Qingchen Yu, Shiying Duan, Xiaodong Li, Yuhua Wang, Zhiyu Li, Shiji Zhou, Yifan Sun, Zhaoxin Fan
TL;DR
Output-focused unlearning can leave target knowledge recoverable from internal model states, including under reformulated queries. Cascade combines path routing, representation compression, and decoding control to reduce recoverability; experiments report reduced recovery with stable utility across benchmarks. Its evaluation remains limited to existing benchmarks and offline unlearning with predefined forget sets.
Problem
Output suppression can leave target knowledge internally activatable, separable, and recoverable under reformulated or extraction-style prompts.
Source: §1 · pp. 1–2Method
Cascade minimizes internal identifiability through path-level routing, representation-level compression, and decoding-level control.
Source: §1 · p. 2Results
Takeaways & Limitations
The reported findings support structured control of target-knowledge identifiability rather than output-level adjustment alone.
Source: §5 · p. 9Evaluation uses existing benchmarks and offline unlearning with predefined forget sets, leaving open-ended, interactive, and sequential deletion settings for further validation.
Source: Limitations · pp. 9–10
Abstract
from arXiv · showhide
Large Language Model (LLM) unlearning is essential for removing sensitive or copyrighted knowledge while preserving general utility. Existing methods often leave residual knowledge in intermediate representations, which can still be recovered. To address this, we propose Cascade, a hierarchical recoverability control framework that minimizes the internal identifiability of target knowledge. Cascade combines three complementary controls: path-level routing to suppress privacy-associated activation routes, representation-level compression to reduce geometric separability, and decoding-level intervention to limit residual recovery. Experiments on TOFU, MUSE-News, and WMDP, including robustness tests with query reformulation and extraction-style prompts, show that Cascade effectively reduces recoverability while maintaining stable model utility.
1 Introduction
Output-level suppression can leave target knowledge internally recoverable, motivating Cascade’s hierarchical control of identifiability. Across benchmarks and query reformulations, Cascade reduces recoverability while maintaining stable utility.
1 Introduction
- Output-focused forgetting can leave target knowledge activatable, separable, and decodable under rephrased, indirect, clue-based, or extraction-style prompts.A model may reject an original query yet recover the same target knowledge under reformulated prompts.Source: §1 · pp. 1–2
- Internal identifiability describes whether target knowledge remains detectable, distinguishable, or recoverable from intermediate model states.The paper frames effective unlearning as reducing identifiability across activation paths, representation space, and decoding, not only target-answer likelihood.Source: §1 · p. 2
- Cascade formulates unlearning as constrained internal-identifiability minimization, combining path routing, representation compression, and decoding control.The controls target privacy-associated activation routes, geometric separability, and residual output recovery.Source: §1 · p. 2
- Cascade reduces target recoverability while maintaining stable utility across benchmarks, model families, and reformulated queries.Mechanistic analyses report localized suppression of privacy-associated routes and shifts of forget representations toward lower-radius hyperbolic regions.Source: §1 · p. 2
2 Related Work
Prior unlearning work has focused on reducing target behavior while preserving utility, with newer evaluation probing recovery beyond fixed prompts. Internal-mechanism approaches address components and representations, while Cascade jointly models recoverability across computation paths, representation space, and decoding.
2 Related Work
- Unlearning methods use post-training optimization or model editing, balancing forget-set objectives with retain-set utility; cited approaches include gradient ascent and KL-based matching [1, 2, 3, 4, 5, 6].Research also explores stability trade-offs, entropy maximization, target distributions, and inference-time or in-context strategies [7, 8, 9, 10].Source: §2 · p. 2
- Recovery-focused evaluation finds that models can reproduce target information through semantically related inputs despite standard forget-set performance [11, 12, 13, 14].Internal-mechanism work edits parameters, neurons, pathways, or representations, while Cascade jointly targets path, representation, and decoding levels [15, 16, 17, 18, 19].Source: §2 · pp. 2–3
3 Methodology
The methodology casts privacy unlearning as constrained minimization of internal identifiability, approximated through route, representation, and decoding proxies. Cascade couples selective route suppression and hyperbolic compression with decoding control and a retain-set utility objective.
3.1 Problem Formulation
- Privacy unlearning seeks to make private target responses difficult to recover while preserving utility on non-private data and general tasks.The formulation constrains utility to remain above a minimum acceptable level while minimizing identifiability of private knowledge.Source: §3.1 · p. 3
- Because direct identifiability optimization depends on an unknown recovery function, Cascade approximates it with route activation, geometric separability, and decoding proxies.Weights λpath, λhyp, and λdecode set the relative strength of these surrogate terms.Source: §3.1 · p. 3
- The method treats larger Poincaré-ball radii as finer-grained, more separable representations and smaller radii as more compact representations.Radius is used as an operational proxy for representation resolution.Source: §3.1 · p. 3
3.2 Hierarchical Recoverability Control
- Cascade identifies privacy-associated routes by comparing forget–retain activation strengths across candidate modules and selecting routes by a budget.An exponential moving average reduces route-score mini-batch noise; the selected-route loss targets privacy-selective activation gaps rather than suppressing all routes.Source: §3.2 · p. 4
- Route representations are mean-pooled over selected modules and answer-token positions, then mapped into the Poincaré ball with a fixed projection head.Teacher forcing supplies target responses during unlearning training; inference afterward uses standard autoregressive generation without answer tokens or ground-truth responses.Source: §3.2 · pp. 4–5
- A radial compression loss discourages forget representations from remaining in high-radius regions, while retain representations are preserved through the retain objective.The same contraction is not applied to retain representations.Source: §3.2 · p. 5
- Decoding control increases forget-target negative log-likelihood relative to retain-target difficulty, while the retain-set language-modeling objective preserves utility.The final objective combines identifiability-surrogate terms with the retain objective; α controls the forgetting–utility trade-off.Source: §3.2 · p. 5
4 Experiments
The experiments evaluate Cascade across unlearning benchmarks, model families, and reformulated prompts. They report reduced target recovery with retained utility and analyze whether its controls act on routes and representations.
4.1 Experimental Setup
- The evaluation covers TOFU Forget10, MUSE-News news unlearning, and WMDP cyber-security, using Llama and Qwen models and benchmark-specific forgetting and utility metrics.Baselines and reference models use the same data splits, backbones, training settings, and evaluation pipeline.Source: §4.1 · pp. 5–6
4.2 Main Results
- MUSE-News Cascade records Forget Verbatim 0.266 and Extraction Strength 0.071; WMDP-Cyber accuracy falls from Original 40.36 to 23.60 while MMLU accuracy is 63.75 versus Original 62.21.PDU reaches slightly lower WMDP-Cyber accuracy, 23.45, but MMLU accuracy falls to 26.89.Source: Figure 3 · p. 6, Figure 4 · p. 6, §4.2 · p. 7
- On TOFU Forget10, Cascade leads CFI on both backbones, ranks second in BUS on Llama behind AltPO, and leads both CFI and BUS on Qwen.Across model families, it reduces forget-side signals while preserving utility; its advantage is a stable forgetting–retention balance rather than optimizing one output metric.Source: §4.2 · p. 6, Table 1 · p. 7
- Across five prompt categories, Cascade averages ASR 0.10% and R-ROUGE 0.043; under extraction prompts, the values are 0.25% and 0.070.NPO's zero ASR coexists with average and extraction R-ROUGE of 0.268 and 0.311, so exact-match ASR alone can miss partial recovery.Source: §4.2 · p. 7, Figure 5 · p. 8
4.3 Ablation Study
- Full Cascade leads the ablation variants in CFI and BUS; decoding-only control cuts BUS by roughly 34%, while removing decoding control drops it by about 64%.Removing path control increases extraction strength, while removing representation compression lowers CFI and BUS.Source: §4.3 · p. 8
4.4 Further Analysis
- Privacy-associated routes are stable across random samplings, and Cascade reduces forget–retain activation gaps on selected routes while leaving non-selected modules nearly unchanged.The selected routes are concentrated in deep attention output projections, suggesting relatively localized semantic pathways.Source: §4.4 · p. 8, Figure 6 · p. 9
- Cascade shifts forget representations toward smaller hyperbolic radii and weakens radius's association with answer recovery; independent probes also find lower held-out separability and weaker state-based recovery.The radius–recovery association is significant in the Original model but weak and insignificant after Cascade.Source: Figure 7 · p. 9, §4.4 · p. 9
5 Conclusion
The conclusion frames privacy unlearning as minimizing internal identifiability, then presents Cascade’s three-level controls and reports reduced recoverability with stable utility across evaluated settings.
5 Conclusion
- Cascade controls internal identifiability through path-level routing, representation-level compression, and decoding-level intervention.The controls respectively suppress privacy-associated routes, reduce geometric separability of forget representations, and limit residual output recovery.Source: §5 · p. 9
- Cascade reduces target recoverability while preserving stable model utility across TOFU, MUSE-News, WMDP, and query-reformulation settings.Ablations validate multi-level control and representation-level compression; analyses find selective suppression of privacy-associated routes and compression of forget representations into lower-resolution regions.Source: §5 · p. 9
- The conclusion argues that effective LLM unlearning requires structured control over target-knowledge identifiability rather than output-level adjustment.Source: §5 · p. 9
Limitations
The evaluation is limited to existing benchmarks and offline unlearning with predefined forget sets, leaving several real-world deletion settings for further validation.
Limitations
- The evaluation uses existing benchmarks that do not fully capture open-ended deletion requests, long-context dependencies, multi-turn interactions, or continuously updated data.Source: Limitations · pp. 9–10
- Experiments focus on offline unlearning with a predefined forget set, not sequential deletion requests, knowledge updates, or repeated incremental unlearning.Source: Limitations · p. 10
- Cascade’s applicability to dynamic, open-ended, and interactive real-world unlearning scenarios requires further validation.Source: Limitations · p. 10
Ethical Considerations
The paper notes potential dual-use risks and possible effects on related knowledge and downstream reliability, recommending transparent criteria, evaluation, auditing, and monitoring.
Ethical Considerations
- Stronger unlearning could obscure training provenance, suppress benign knowledge, or support unverified data-removal claims, while aggressive removal may harm related knowledge and downstream reliability.The paper recommends transparent deletion criteria, careful retain-side evaluation, independent auditing, and continued monitoring for residual recovery and unintended utility loss.Source: Ethical Considerations · p. 10
Appendices
The appendices provide a notation summary and the full Cascade training procedure.
A Notation Summary
- Table 3 summarizes the main notation used in the methodology.Source: A Notation Summary · p. 13
B Training Procedure
- Algorithm 1 gives the full training procedure of Cascade.Source: B Training Procedure · p. 13
C.1 Dataset and Data Splits
The section defines benchmark splits and metrics, then specifies a TOFU Forget10 protocol for testing recovery under reformulated queries.
C.1 Dataset and Data Splits
- TOFU uses synthetic author profiles with Forget01, Forget05, and Forget10 settings; MUSE-News uses BBC articles, and WMDP evaluation is limited to wmdp_cyber.TOFU retain splits assess preservation; MUSE-News also uses retain and holdout splits, while auxiliary World Facts and Real Authors datasets assess general utility.Source: §C.1 · pp. 13–14
C.2 Evaluation Metrics
- TOFU reports TR, FP, FR, ES, and CFI; higher TR, CFI, and utility indicate better outcomes, while lower FP, FR, and ES do.The reported TR is direction-corrected so higher values indicate stronger forgetting.Source: §C.2 · p. 14
- BUS jointly scores forgetting and utility as their harmonic mean, so its value is bounded by the weaker of the two objectives.Model Utility aggregates ROUGE-based generation quality, normalized answer probability, and Truth Ratio across retain, real_authors, and world_facts subsets.Source: §C.2 · p. 14
- MUSE-News reports verbatim memory, extraction strength, and retain performance; WMDP reports wmdp_cyber multiple-choice accuracy, where lower target accuracy indicates stronger removal.MUSE-News VerbatimMem measures forget-split ROUGE-L reproduction, while retain knowledge is measured by ROUGE-L.Source: §C.2 · p. 15
C.3 Query Reformulation Protocol
- The TOFU Forget10 robustness test preserves the target fact across five prompt types, testing direct recall, paraphrase, indirect elicitation, partial cues, and extraction.It evaluates 400 examples, using one Original and one Paraphrase prompt and three templates each for Indirect, Clue, and Extraction; ASR and R-ROUGE are unweighted category means.Source: §C.3 · p. 15
- Indirect prompts ask about the target person without naming the sensitive attribute, while Clue prompts replace the question’s final 25% of tokens with a blank.Extraction prompts explicitly request reproducing or reconstructing the target answer; ASR captures exact-string leakage and Robust Forget ROUGE captures softer semantic recovery.Source: §C.3 · pp. 15–16
D.1 Baseline Implementations
Cascade is compared with established unlearning baselines under shared evaluation settings. Across benchmarks, it reduces target recovery while retaining utility, including under reformulated and extraction-style prompts.
D.1 Baseline Implementations
- The baseline suite spans gradient-based, preference-based, constrained-optimization, and representation-level methods, evaluated with shared data splits, backbones, decoding, and metrics.Original is trained on forget and retain data; Retrained uses only retain data and approximates an ideal unlearning reference.Source: §D.1 · p. 16
- GradAscent has no explicit retain objective and may substantially degrade non-target capabilities, whereas RMU directly modifies intermediate representations with a retain-side constraint.These illustrate distinct baseline trade-offs and mechanisms.Source: §D.1 · pp. 16–17
D.2 Training and Hyperparameters
- Cascade combines path-level routing, hyperbolic representation compression, and decoding-level recoverability control; gating, smoothing, and loss normalization remain fixed across experiments.Only route budget and forget-side coefficients receive minor adjustments for substantially different forget-set sizes under the same tuning protocol.Source: §D.2 · p. 17, Table 5 · p. 17
E.1 Cross-Benchmark Evaluation
- Cascade yields the lowest practical MUSE-News Forget Verbatim and Extraction Strength without retain-side collapse, and nearly matches the lowest WMDP-Cyber accuracy while preserving MMLU at the Original level.The MUSE-News and WMDP-Cyber results are reported in Tables 6 and 7, respectively.Source: Table 6 · p. 18, Table 7 · p. 18, §E.1 · p. 18
D.3 Computational Resources
- Experiments used eight NVIDIA GeForce RTX 4090 GPUs, with single- or multi-GPU execution depending on model scale.Compute was dominated by baseline reproduction, tuning, ablations, robustness evaluation, and cross-dataset or cross-backbone experiments.Source: §D.3 · p. 18
E.2 Recovery under Query Reformulation
- Across five TOFU Forget10 prompt categories, ASR measures exact recovery and R-ROUGE measures partial recovery; low answer overlap alone does not match Cascade’s lower target probability or extraction recovery.The targeted-refusal comparison uses the same Llama-3.2-3B-Instruct checkpoint and evaluation pipeline.Source: Table 9 · p. 18, Table 8 · p. 18, §E.2 · p. 18
E.3 TOFU Results across Forget Splits and Model Backbones
This section presents TOFU results across forget splits and model backbones, together with projection and representation diagnostics, hyperparameter sensitivity, and example outputs. The examples include book-title statements from NPO, SimNPO, RMU, and PDU, while Cascade says it lacks enough information to identify a title.
E.3 TOFU Results across Forget Splits and Model Backbones
- TOFU tables cover five backbones across Forget01, Forget05, and Forget10, with evaluation protocols held fixed across splits.The forget ratio increases from sparse removal in Forget01 to the broadest removal in Forget10; the supplied table captions do not provide cell values for comparison.Source: §E.3 · p. 18
E.4 Projection Diagnostics
- Both Original and Cascade preserve distance ordering and local neighborhoods substantially better than shuffled controls, with Cascade’s distant-collision increase remaining far below shuffled mixing.The pattern held across eight independently initialized frozen projection heads.Source: §E.4 · p. 23, Table 23 · p. 24
- The four projection configurations yield closely matched results across metrics, indicating Cascade does not depend on a particular random or PCA initialization.The identity setting is a diagnostic, not a strict replacement, because it changes the geometric space used for compression.Source: §E.4 · p. 23, Table 24 · p. 24
E.5 Representation and Surrogate Diagnostics
- Cascade reduces forget radius and both held-out probe AUCs while leaving retain radius nearly unchanged; removing representation compression moves forget radius and separability toward Original.Fisher ratio and silhouette score follow the same trend, providing evidence beyond the radius quantity used in training.Source: §E.5 · p. 23, Table 25 · p. 24
- Cascade has the lowest state-based Top-1 and Top-5 recovery accuracy and the largest decoding NLL gap among evaluated model states.These probes depend on their recovery assumptions and are complementary mechanistic evidence, not proof of irreversible knowledge deletion.Source: §E.5 · pp. 23–24, Table 26 · p. 24
E.6 Hyperparameter Sensitivity
- Once routing is enabled, performance remains stable across reasonable route budgets; retain weight α directly controls the forgetting–utility trade-off.Smaller α favors forgetting at some utility cost, while larger α better preserves non-target knowledge.Source: §E.6 · p. 24, Figure 8 · p. 25
- Moderate decoding control suppresses residual recovery, but excessive decoding weight sharply lowers CFI and BUS, so decoding should complement rather than dominate path and representation control.Across path weights, CFI and BUS remain similar with moderate decoding weight; imbalanced settings can preserve some utility while weakening aggregate unlearning.Source: §E.6 · p. 24, Figure 9 · p. 25, Figure 10 · p. 26
F.1 Forgetting Examples
- In the shown forgetting examples, Cascade responds with refusals or uncertainty, while other methods sometimes reproduce target facts or provide fabricated substitutes.The examples include factual leakage, fluent fabrication, and clean refusal cases.Source: §F.1 · pp. 25–26
- In these examples, NPO, SimNPO, RMU, and PDU state specific book titles, whereas Cascade says it lacks enough information to identify one.The examples concern “The Iron Lotus,” “Artistic Authority: Leading with Creativity,” “A Tale of Two Leaders,” and “The Irony of Fate’s Whisper.”Source: §F.1 · p. 26
F.2 Robustness Examples
These TOFU Forget10 examples compare direct identity queries with stronger extraction prompts that explicitly request memorized answers. Outcomes vary across targets and methods, including one exact Cascade recovery.
F.2 Robustness Examples
- The examples use direct identity queries and stronger extraction prompts that explicitly ask for memorized answers across three TOFU Forget10 targets.Another Cascade response refuses directly but substitutes an unrelated identity under extraction.Source: §F.2 · pp. 26–27
- For Hsiao Yun-Hwa, Original and RMU return the target in both query modes, whereas NPO fabricates substitute identities.No Cascade outcome for this target is included in these examples.Source: §F.2 · p. 27
- For Rajeev Majumdar, Original answers directly but fabricates extraction details; NPO and RMU also give incorrect identities, while Cascade refuses or returns incorrect slots.Cascade's extraction response does not recover the target identity.Source: §F.2 · p. 27
- Cascade refuses the direct Tae-ho Park query but reproduces the target name under the strongest extraction prompt, a rare exact-recovery boundary case.The other methods also vary: Original and RMU recover Tae-ho Park under extraction, while NPO fabricates a different identity.Source: §F.2 · p. 27