PaperlayerView exact revision on arXiv

Source-linked AI summary

Neuralyzing the Trace: Selective Representation-Level Unlearning with Contrastive Sparse Autoencoders

Itai Zehavi, Fanny Jourdan, Ulrich Aivodji

arXiv:2609.31056v1cs.AI

TL;DR

Narrow unlearning targets can require more than changing model behavior, since underlying traces may persist and current extractors are poorly selective for such targets. SCALPEL learns target-selective sparse features through contrastive training and uses them for representation-level interventions; on TOFU across three model families, it improves over NMF and standard SAE interventions and is competitive with Gradient Difference and RMU.

  • Problem

    Mechanistic-interpretability extractors are poorly selective for narrow forget targets, and behavioral forgetting alone may leave internal knowledge traces intact.

    Source: §1 · pp. 1–2

  • Method

    SCALPEL trains an anchor-contrastive sparse autoencoder on multiple views of each target against background data, then intervenes on selected forget-associated features.

    Source: §1 · p. 2, §4 · p. 5

  • Results

    Across TOFU and three model families, SCALPEL improves feature selectivity and is competitive with mechanistic-interpretability and optimization-based baselines.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The study presents a first approach connecting mechanistic interpretability with fine-grained unlearning through selective internal features.

    Source: §8 · p. 10

    Evaluation covers TOFU and three relatively small models; SCALPEL filters selected contributions but does not erase the parametric trace or provide certified deletion.

    Source: §8 · p. 10

Abstract

from arXiv · show

Machine unlearning aims to remove targeted information while preserving a model's other abilities. In realistic settings, such as privacy requests under the EU GDPR, the target may be narrow, for example information associated with a single person. Behavioral forgetting alone may be insufficient, motivating interventions directly on internal representations. However, standard mechanistic-interpretability extractors are poorly selective for such targets. We identify an energy bias in reconstruction-based extraction, which favors dominant background structure over low-energy target-specific components. We introduce SCALPEL, a contrastive sparse autoencoder designed to learn more selective forget features. We show theoretically that contrastive training promotes target-selective features and that our selection score controls expected background knowledge perturbation. We validate SCALPEL experimentally on TOFU across Qwen, Llama, and Gemma, where it substantially improves over NMF and standard SAE interventions and is competitive with Gradient Difference and RMU, bridging mechanistic interpretability and fine-grained unlearning.

1 INTRODUCTION

Narrow unlearning targets can matter for privacy and legal obligations, yet changing model behavior does not establish that the underlying knowledge trace is gone. The paper introduces SCALPEL, which trains target-selective sparse features for explicit representation-level interventions.

1 INTRODUCTION

  • Behavioral changes may leave internal knowledge traces recoverable through paraphrases, indirect prompts, jailbreak-style queries, or relearning.The paper therefore motivates identifying target-associated representations and intervening on them explicitly.Source: §1 · p. 1
  • Mechanistic-interpretability extractors work best for broad, separated concepts, while requests such as forgetting one author require finer selectivity.The paper frames this as a mismatch between existing concept extractors and narrow unlearning targets.Source: §1 · p. 1
  • Standard PCA- and SAE-based interventions are poorly selective, damaging retain knowledge almost as much as forget knowledge.The paper identifies this as a central shortcoming of existing representation-based interventions.Source: §1 · p. 2
  • Reconstruction-based extractors prioritize dominant background structure because their objective rewards captured energy over low-energy target components.A narrow forget target can be obscured within much larger background structure.Source: §1 · p. 2
  • SCALPEL contrasts augmented views of the same forget anchor against retain data to learn sparse features stable across target views and weak on background data.It then subtracts selected features only when activated, yielding an explicit, input-dependent internal filter with tunable strength.Source: §1 · p. 2, Figure 1 · p. 2
  • The study examines whether selective internal features can support narrow forget requests; it does not claim full unlearning or certified parameter deletion.Its controlled author-level evaluation is on TOFU, and its reported performance is competitive with mechanistic-interpretability and optimization-based baselines.Source: §1 · pp. 2–3

2 RELATED WORK

Prior unlearning methods include weight updates, inference-time behavior changes, and interventions on internal representations. This paper focuses on making representation-level features selective enough for narrow targets.

2 RELATED WORK

  • Gradient-based objectives, retain-only finetuning, preference-based methods, and generic-answer finetuning update weights, while in-context unlearning changes behavior without changing stored representations.Model editing such as ROME changes parameters tied to a factual association rather than removing an influence.Source: §2 · p. 3
  • RMU pushes forget activations toward a random direction and preserves retain activations, but modifies weights without identifying an interpretable target representation.SCALPEL instead extracts sparse target-specific features and intervenes along their decoded directions.Source: §2 · p. 3
  • Behavioral evaluation alone cannot establish that knowledge is gone, while representation-level interventions make the mechanism explicit without guaranteeing parametric deletion.An internal trace may remain recoverable through other prompts or light finetuning.Source: §2 · p. 3
  • PCA, NMF, and SAEs decompose residual-stream activations into directions or features that can support interventions, but reconstruction pipelines also inject reconstruction error when replacing the original activation.The paper reports that full-reconstruction replacement degraded retain and Wiki performance even before feature removal, and therefore intervenes on the original activation.Source: §2 · pp. 3–4
  • The central challenge is selecting features specific to the forget target while keeping them weak on shared background structure.SCALPEL addresses this selectivity bottleneck by adapting the feature-learning objective.Source: §2 · p. 4

3 ENERGY BIAS IN RECONSTRUCTION-BASED EXTRACTION

The section explains why reconstruction objectives can favor background over a narrow target: they reward captured energy, not target specificity. A Qwen activation analysis reports a large background-to-residual energy gap consistent with this account.

3 ENERGY BIAS IN RECONSTRUCTION-BASED EXTRACTION

  • A reconstruction gain for concept j scales as its energy E_j times the increase in captured fraction ΔC_j, favoring background when E_bΔC_b exceeds E_fΔC_f.This account assumes centered, mutually uncorrelated concept components and is a stylized incentive analysis, not an impossibility result for trained SAEs.Source: §3 · p. 4
  • Low-energy, precise targets may be blended into broader features because reconstruction rewards high-energy structure more strongly.The proposed mechanism motivates feature objectives that explicitly reward selectivity.Source: §3 · pp. 4–5
  • About 329×: the background top-three PCA energy exceeds the energy of forget activations after removing those background directions.The residuals are not a pure forget manifold, but the gap is far larger than under a random split of the same data.Source: §3 · p. 5

4 SCALPEL: SPARSE CONTRASTIVE AUTOENCODERS FOR PRECISE REPRESENTATION-LEVEL UNLEARNING

SCALPEL defines author-level targets, learns sparse features from residual-stream activations, and selects target-associated features for input-dependent subtraction. Its design combines multi-view contrastive learning with a feature-scoring and intervention procedure.

4 SCALPEL: SPARSE CONTRASTIVE AUTOENCODERS FOR PRECISE REPRESENTATION-LEVEL UNLEARNING

  • SCALPEL constructs target views, learns selective sparse features from cached residual activations, and filters their decoded contribution at inference.The same selected feature set is applied to inputs, with subtraction only when a feature activates.Source: §4 · p. 5, §4.5 · p. 6

4.1 TARGET GRANULARITY AND MULTI-VIEW CONSTRUCTION

  • Each forget author defines one target concept because forget and retain authors share TOFU style, factual structure, vocabulary, and QA format.Treating the whole forget set as one concept could direct extraction toward shared TOFU format rather than removable knowledge.Source: §4.1 · p. 5

4.2 RESIDUAL-STREAM ACTIVATION EXTRACTION

  • Residual-stream activations are cached at a fixed layer, in practice the fourth layer before the output, and standardized using training-cache statistics.The authors do not claim this layer is optimal and leave systematic layer selection to future work.Source: §4.2 · p. 5

4.3 CONTRASTIVE SPARSE AUTOENCODER

  • The SAE uses sparse nonnegative codes and norm-aware token representations, then applies cosine-based contrastive learning to token-level codes.Same-target tokens are pulled together while negatives from retain data push them away; related forget samples are not pushed apart.Source: §4.3 · pp. 5–6

4.4 SCALPEL

  • SCALPEL splits its code into common and target-specific blocks, training the latter to contrast target views against retain and Wiki examples.Only features in the target-specific block are eligible for intervention.Source: §4.4 · p. 6

4.5 FEATURE SELECTION AND RESIDUAL-STREAM INTERVENTION

  • Features are selected using their activity on a target relative to background, with a top-feature fallback when a target has no features above threshold.The fixed global feature set is applied to every input, and subtraction occurs only when selected features activate; modifying the original activation avoids injecting reconstruction error.Source: §4.5 · p. 6

5 THEORETICAL ANALYSIS

The analysis argues that reconstruction and sparsity alone do not explicitly separate a target from background. Contrastive training encourages target-aligned sparse codes, while feature selectivity limits expected background perturbation.

Contrastive learning promotes target-selective features

  • Under the stated assumptions, contrastive regularization favors similar codes for same-target views and lower similarity between target and background codes.The proposition assumes non-negative codes, controlled decoder scales, and compatible target–background separation at comparable reconstruction and sparsity cost.Source: §5 · p. 7
  • Combined with sparsity, this geometry favors features active on a target but weak on background; uncontrasted forget targets may still share features.The analysis connects this structure to the selectivity score defined in Eq. 1.Source: §5 · p. 7

Selectivity controls background perturbation

  • Selecting only features with selectivity at least smin bounds expected representation-space background perturbation, not downstream behavior or worst-case effects.The bound also ignores decoder-direction orientation, so similarly scored features can have different causal effects.Source: §5 · p. 7

Theoretical analysis

  • The proposed mechanism combines informative reconstruction, sparse coding, contrastive organization around target concepts, and reduced expected background footprint.Reconstruction preserves information, sparsity concentrates it, and contrastive learning organizes the sparse code by target concepts.Source: §5 · p. 7

6 EXPERIMENTS

The experiments compare representation-level unlearning and optimization-based baselines on TOFU across three model families. They evaluate forget–retain trade-offs and separately test representation geometry and the selectivity score.

Models and reference checkpoints

  • The benchmark uses Qwen2.5-1.5B-Instruct, Llama-3.2-1B-Instruct, and Gemma-2-2B-it, with full-model starting checkpoints and retain-only reference models.Within each seed, all methods start from the same full checkpoint.Source: §6 · p. 7

Dataset and augmentation

  • On TOFU, the study measures general-knowledge preservation with Wiki data and creates varied, name- and relation-preserving forget-author views using templates and backtranslation.The views include reformulations, biographies, paraphrases, multi-hop questions, and adversarially phrased instructions.Source: §6 · p. 8

Compared methods

  • Compared methods include NMF, reconstruction-only and contrastive SAEs, SCALPEL, Gradient Difference, and RMU, with representation-based methods aligned on layer and intervention procedure where possible.This design aims to isolate the effect of the learned representation.Source: §6 · p. 8

Protocol

  • Each method is tuned independently for each model family, then its selected configuration is evaluated across five independent end-to-end seeds.Each seed repeats reference-model finetuning, method training, feature selection, and evaluation.Source: §6 · p. 8

Metrics and diagnostics

  • The main metric traces model utility against forget-set answer probability; additional metrics cover forget, retain, and Wiki performance, while diagnostics test code geometry and score–intervention relationships.The geometry diagnostic measures within-target and target–background similarity; the score-quality diagnostic evaluates 50 top-five feature–target pairs individually.Source: §6 · p. 8

7 RESULTS

On the main benchmark, contrastive feature learning improves the forget–utility trade-off, with SCALPEL competitive against optimization-based baselines. Diagnostics link contrastive training to greater target selectivity and associate higher selectivity scores with better individual intervention trade-offs.

7.1 MAIN UNLEARNING BENCHMARK

  • SCALPEL and plain contrastive SAEs improve the forget–utility trade-off over reconstruction-only SAE, while SCALPEL is competitive with RMU and Gradient Difference.The Qwen figure aggregates five seeds; Llama and Gemma results are reported as consistent, and SCALPEL keeps the base model fixed with explicit sparse feature activations and decoder directions.Source: §7.1 · pp. 8–9, Figure 3 · p. 9

7.2 CONTRASTIVE LEARNING INCREASES FEATURE SELECTIVITY

  • ΔC rises from approximately −0.01 for reconstruction-only SAE to approximately 0.27 for contrastive SAE and 0.43 for SCALPEL-Split; mean top-5 selectivity rises from 1.9 to 4.0 to 24.5.The geometric gap is ΔC = Cpos − Cbg; the selectivity values compare the same models across authors and seeds.Source: §7.2 · p. 9

7.3 THE SELECTIVITY SCORE PREDICTS UNLEARNING QUALITY

  • Higher selectivity-score bins preserve more retain probability at fixed forget probability, or achieve stronger forgetting at comparable retain probability, though individual-feature ordering is imperfect.The score omits decoder-direction orientation in the local activation geometry.Source: §7.3 · p. 9, Figure 4 · p. 10

8 CONCLUSION AND LIMITATIONS

The paper presents SCALPEL as a first step toward selective representation-level unlearning, reporting improvements over reconstruction-based interventions and competitive trade-offs against strong baselines. Its evaluation and theoretical claims remain bounded by the studied settings and assumptions.

8 CONCLUSION AND LIMITATIONS

  • Across Qwen, Llama, and Gemma on TOFU, SCALPEL improves over NMF and reconstruction-only SAE interventions and is competitive with RMU and Gradient Difference.The paper reports an approximately 329× energy gap between target-specific information and larger background structure at the studied layer.Source: §8 · p. 10
  • Evaluation covers TOFU and three relatively small models; SCALPEL filters selected feature contributions when activated but does not erase the parametric trace or certify deletion.The theoretical analysis is local, and its perturbation bound controls representation-space magnitude rather than model behavior.Source: §8 · p. 10

A ENERGY BIAS OF RECONSTRUCTION-BASED EXTRACTION

  • The appendix frames reconstruction’s energy preference as a motivation under an idealized concept decomposition, not as a theorem about trained SAEs.It also describes a PCA experiment measuring the corresponding energy gap on real activations.Source: A ENERGY BIAS OF RECONSTRUCTION-BASED… · p. 13

A.1 SETTING

  • The formal setting decomposes residual activations into concept components and defines concept energy relative to an extractor’s reconstruction.Captured energy fractions are defined within this setup.Source: §A.1 · p. 14
  • The analysis assumes uncorrelated concept components and reconstruction errors; the authors call this an idealization because real concepts overlap and trained SAEs lack a canonical per-concept decomposition.The assumptions isolate the loss incentive; orthogonal concept subspaces or independent errors are examples where the reconstruction assumption can hold.Source: §A.1 · p. 14

A.2 ENERGY-WEIGHTED DECOMPOSITION OF THE RECONSTRUCTION LOSS

The appendix explains why reconstruction favors high-energy structure, measures the scale of residual forget structure relative to background, and characterizes how contrastive learning and sparsity favor selective representations under stated conditions.

A.2 ENERGY-WEIGHTED DECOMPOSITION OF THE RECONSTRUCTION LOSS

  • Reconstruction favors concepts with greater energy when capture improvements are comparable, so high-energy background structure can outweigh lower-energy forget concepts.PCA maximizes captured energy directly; NMF and reconstruction-only SAEs share a softer version of this incentive.Source: §A.2 · pp. 14–15

A.3 MEASURING THE ENERGY GAP ON REAL ACTIVATIONS

  • 329× describes the energy gap for residual forget structure after removing three dominant background directions, not for the complete forget manifold.The measured residual is the component a targeted intervention must isolate.Source: §A.3 · p. 16

B SPARSE CONTRASTIVE LEARNING PROMOTES TARGET-SELECTIVE FEATURES

  • SCALPEL’s objective favors sparse, target-selective features when such representations are compatible with reconstruction; this is not a global convergence result for SAE training.The geometric account combines reconstruction, sparsity, and contrastive learning.Source: B SPARSE CONTRASTIVE LEARNING PROMOTES… · p. 16

B.1 SETTING

  • SCALPEL’s multi-positive InfoNCE treats same-target examples as positives and background examples as negatives.Source: §B.1 · p. 16

B.2 RECONSTRUCTION PREVENTS THE TRIVIAL REPRESENTATION

  • Reconstruction rules out the useful all-zero representation, leaving the other objective terms to organize the representation.Source: §B.2 · p. 17

B.3 SPARSITY CONCENTRATES THE NORM-AWARE CODE

  • With decoder scales controlled, sparsity concentrates the norm-aware code on few coordinates while reconstruction prevents complete collapse.Source: §B.3 · p. 17

B.4 CONTRASTIVE LEARNING ALIGNS TARGETS AND SEPARATES BACKGROUND

The contrastive objective favors sparse codes that align examples of the same target and separate them from background negatives. The appendix connects that geometry to feature selectivity and a bound on expected background perturbation, while noting limits to both claims.

B.4 CONTRASTIVE LEARNING ALIGNS TARGETS AND SEPARATES BACKGROUND

  • Contrastive training favors identical normalized codes within a target and disjoint supports between that target and its background negatives, when this geometry is compatible with reconstruction.The proposition separates only pairs defined as negatives, so forget targets not contrasted with one another may still share coordinates.Source: §B.4 · p. 18

B.5 NEAR-OPTIMAL CONTRASTIVE LOSS IMPLIES NEAR-OPTIMAL GEOMETRY

  • As contrastive loss approaches its optimum, positive codes converge while their average similarity with background negatives approaches zero.This describes the near-optimal geometry, rather than requiring an exact optimum.Source: §B.5 · p. 19

B.6 CONNECTION TO THE SELECTIVITY SCORE

  • The geometry favored by the joint objective matches the selectivity criterion: sparse coordinates align within targets and overlap less with background examples.The analysis says this behavior emerges continuously as contrastive loss approaches its optimum.Source: §B.6 · p. 20

C SELECTIVITY AND INTERVENTION SAFETY

  • The appendix connects sparse contrastive learning to intervention safety: selecting high-score features limits their expected footprint on retain and Wiki representations.The selectivity score is used alongside the training analysis to connect target–background separation with the intervention bound.Source: C SELECTIVITY AND INTERVENTION SAFETY · p. 20

C.1 SETTING

  • For author-level targets, the selectivity score ranks features using norm-aware activation on the target relative to background activations.Selected features are those whose score meets the threshold smin.Source: §C.1 · p. 20

C.2 THE PERTURBATION BOUND

  • The perturbation bound limits expected background perturbation relative to selected features’ target activation mass, with a 1/smin factor.Raising the threshold tightens the bound; the bound concerns expected perturbation over background activations.Source: §C.2 · p. 20, §C.3 · p. 21

C.3 DISCUSSION

  • The bound is not a worst-case or behavioral guarantee: individual tokens may be strongly perturbed, and output effects require assumptions about downstream layers.It also grows with the number of selected features, and the score does not capture decoder orientation relative to the data manifolds.Source: §C.3 · p. 21

D UMAP : MAINFOLD OF THE DATASETS

The protocol gives each model–method pair its own hyperparameter study, then reports results from frozen configurations rerun across seeds. Its selection objective and trial search differ from the subsequent benchmark evaluation.

E HYPERPARAMETER OPTIMIZATION PROTOCOL AND SEARCH SPACES

  • The protocol runs 21 independent Optuna studies, one per model–method pair, then freezes each winning configuration for the reported results.The reported results come from a second-level rerun over five independent seeds.Source: E HYPERPARAMETER OPTIMIZATION PROTOCOL… · pp. 21–22
  • Forget and retain examples strongly overlap in activation space because they share a generation process and differ only by random author assignment.The full forget set is therefore not a globally separable concept in this projection.Source: Figure 5 · p. 22

E.1 SELECTION OBJECTIVE

  • All studies maximize a retain–forget margin using teacher-forced answer probabilities, rather than generation-based or test metrics.SAE trials search intervention strength α, while trainer trials select checkpoints using the same margin.Source: §E.1 · p. 22

E.2 SEARCH SPACES

  • The SAE-family search fixes extraction and normalization choices, while trainer settings include an expanded epoch grid because GradDiff and RMU utility can recover late.The SAE-family search-space table covers per-trial settings; the trainer table covers GradDiff and RMU.Source: §E.2 · p. 23, Table 1 · p. 23, Table 2 · p. 23

E.3 SEARCH ALGORITHM, BUDGET, AND PRUNING

  • SAE-family studies receive 25 trials and trainer studies 20, using Optuna’s TPE sampler; SAE trials also use median pruning.A built-in random search exists as a fallback, but reported results use Optuna/TPE.Source: §E.3 · pp. 23–24

E.4 STUDY OUTCOMES AND WINNING CONFIGURATIONS

  • At selection time, reconstruction-only SAE and NMF do not reach a useful margin on any model, whereas contrastive variants match the strong trainer baselines.The winning Qwen contrastive-SAE configuration is specified as an example, while GradDiff alone receives a documented post-hoc checkpointing override.Source: §E.4 · p. 24

E.5 FROM FROZEN CONFIGURATIONS TO THE MULTI-SEED BENCHMARK

The benchmark reruns frozen configurations through five end-to-end seeds and traces intervention trade-offs with adaptive search. Across extractors, contrastive SAEs produce more selective top-ranked features than reconstruction-only SAE, with SCALPEL-Split strongest.

E.5 FROM FROZEN CONFIGURATIONS TO THE MULTI-SEED BENCHMARK

  • The benchmark reruns each frozen configuration through five end-to-end pipelines per model, with seed-specific references, caches, feature selection, and operating-point selection.Error bars cover the full pipeline, and cells with fewer than five completed seeds report their per-cell n.Source: §E.5 · p. 24

E.6 COMPUTE FOOTPRINT

  • Benchmark stages use smaller MIG slices where they fit, with Gemma-2 raised to a larger slice because of its hidden size and vocabulary.Gemma-2 uses eager attention because the SDPA soft-capping implementation produced numerical instabilities.Source: §E.6 · p. 25

F.1 MODEL UTILITY VS FORGET PROB

  • The Qwen, Llama, and Gemma figures trace TOFU forget10 trade-offs across intervention strengths: lower forget probability means stronger forgetting, while higher utility means better preservation.Each figure reports method-specific hyperparameter optimization and aggregation over five independent end-to-end seeds.Source: Figure 6 · p. 25, Figure 7 · p. 26, Figure 8 · p. 27

G FEATURE SELECTIVITY ACROSS EXTRACTORS

  • Contrastive SAE produces more selective top-ranked features than reconstruction-only SAE, while SCALPEL-Split yields the strongest selectivity.The reported comparison supports the interpretation that contrastive learning translates separation into more target-specific individual features.Source: G FEATURE SELECTIVITY ACROSS EXTRACTORS · p. 25

H ADAPTIVE INTERVENTION-STRENGTH SEARCH

  • Adaptive bisection in log α concentrates evaluations in the steep trade-off region instead of using a uniform grid.It prioritizes intervals overlapping forget probability [0.05, 0.70], evaluates geometric midpoints, and aggregates seed curves on a shared forget-probability grid.Source: H ADAPTIVE INTERVENTION-STRENGTH SEARCH · pp. 26–27

I EXTENDED LIMITATIONS AND FUTURE WORK

The appendix bounds SCALPEL’s current evidence and deployment scope: evaluation remains limited, theory relies on idealizations, and several practical extensions remain untested.

I EXTENDED LIMITATIONS AND FUTURE WORK

  • Experiments cover TOFU and three relatively small models; evaluation on MUSE and WMDP-Bio is incomplete, and the expected advantage may shrink when targets have high representation energy.The energy-bias argument predicts SCALPEL helps most for low-energy targets.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · pp. 27–28
  • Author-level concepts fit TOFU, but other target granularities and robustness as the forget-set fraction grows remain unverified; tokenwise extraction also omits explicit full-sample context.Document-, fact-, or sample-level targets may require different granularity, while context-aware encoding could better isolate associations identifiable at sentence or document level.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · pp. 28, 31
  • The protocol requires extensive finetuning, activation caching, dictionary training, and strength evaluations, while relying on a fixed augmentation procedure whose quality may limit feature stability and target coverage.Design choices include intervention layer, SAE architecture and latent dimension, contrastive weight and temperature, selection threshold, and intervention strength.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · p. 28
  • The theory relies on idealized assumptions, and its perturbation bound covers expected representation-level footprint rather than downstream behavior; no result guarantees complete forgetting or behavioral preservation.Assumptions include centered, uncorrelated concept components and orthogonal reconstruction errors, plus non-negative codes and controlled decoder scales.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · pp. 28–29
  • The selection score ignores decoder-direction orientation relative to local forget and background manifolds, while geometry-aware scoring or intervention would require costly repeated manifold estimation.Features with similar scores can produce different unlearning effects.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · p. 29
  • Shared selected features reduce the number of directions needed for multiple authors, but may couple targets and cause unwanted interference that remains to be assessed.The authors have not determined whether shared features reflect shared forget structure or interference.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · p. 29
  • Sequential requests currently require retraining on the combined forget set or stacking interventions, which increases inference cost with each added request.The encoder and selected decoder directions must remain available at inference.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · pp. 29, 31
  • SCALPEL provides selective behavioral and representation-level unlearning under its intervention, not certified deletion; target information may persist internally or reappear if the intervention is bypassed.Current output metrics also cannot reliably distinguish true removal from hiding.Source: I EXTENDED LIMITATIONS AND FUTURE WORK · p. 31

Related papers

Loading 2609.31056v1…