PaperlayerView exact revision on arXiv

Source-linked AI summary

Open-MMUnlearning: Unifying Methods and Evaluation for MLLM Unlearning

Junkai Chen, Yuhao He, Qianshan Wei, Junxiang You, Jingwen Shao, Junkai Lin, Zhongkai Yue, Xiaotian Ye, Zhengbo Jiao, Jiali Cheng, Zhijie Deng, Kening Zheng, Ruiqi Liu, Hadi Amiri, Yi Yu, Zhenan Sun, Qi Li, Ka-Ho Chow, Sijia Liu, Liang Wang, Jiaqi Li, Shu Wu

arXiv:2610.10358v1cs.AI

TL;DR

MLLM unlearning is difficult to compare systematically because implementations and evaluation protocols are fragmented, robustness testing is incomplete, and metric reliability is uncertain. Open-MMUnlearning unifies the unlearning lifecycle and evaluates methods and metrics; its comparisons reveal trade-offs between forgetting and utility and differences in metric reliability.

  • Problem

    Fragmented MLLM unlearning implementations and evaluation protocols, incomplete robustness testing, and insufficiently examined metric reliability make controlled assessment difficult.

    Source: §3 · p. 4, §A.5 · p. 38

  • Method

    Open-MMUnlearning standardizes data preparation, target-model training, unlearning, and evaluation, and audits metrics for faithfulness and robustness under quantization and targeted relearning.

    Source: §1 · p. 2, §5 · p. 8

  • Results

    GD achieves the highest Forget Quality score of 0.781, while MIP-Editor combines Model Utility of 0.451 with a top aggregate score of 0.647; BLEU achieves the highest aggregate metric score.

    Source: §4.2 · p. 7, §5.2 · p. 9

  • Takeaways & Limitations

    The framework and findings support reproducible comparisons of MLLM unlearning methods and systematic assessment of evaluation reliability.

    Source: §6 · p. 10

    The method comparison covers ten methods on the MLLMU 10% forget setting, and findings may vary across models, datasets, forget ratios, and protocols.

    Source: §A.5 · p. 38

Abstract

from arXiv · show

As multimodal large language models (MLLMs) become more capable and widely deployed, concerns about privacy and safety have become increasingly pressing. Machine unlearning offers one approach to addressing these concerns by removing designated information from trained models while preserving unrelated capabilities. However, fragmented implementations and evaluation protocols, incomplete robustness testing, and limited understanding of metric reliability make progress in MLLM unlearning difficult to assess systematically. We introduce Open-MMUnlearning, an open-source, extensible framework that integrates target-model preparation, multimodal data processing, unlearning, and evaluation through shared interfaces and structured configurations. The framework supports five benchmarks spanning privacy, safety, and copyright, eight MLLMs from four model families, and twelve unlearning methods. Its evaluation suite jointly assesses forgetting effectiveness, retained utility, and robustness to model interventions, adversarial inputs, and membership inference attacks. Using a common evaluation protocol, we compare ten representative unlearning methods. In this comparison, GD and MIP-Editor tie for the highest overall score: GD achieves the highest Forget Quality, while MIP-Editor preserves more Model Utility. We further introduce a metric meta-evaluation protocol that tests faithfulness using models with controlled exposure to target knowledge and robustness under quantization and relearning. Among the thirteen evaluated metrics, BLEU achieves the highest aggregate reliability score. KS-Test attains the highest faithfulness AUC but performs less well on robustness. Together, the framework and these findings support reproducible comparison of MLLM unlearning methods and systematic assessment of evaluation reliability.

1 INTRODUCTION

MLLM unlearning is difficult to assess systematically because implementations and evaluation protocols are fragmented, robustness testing is incomplete, and metric reliability is uncertain. Open-MMUnlearning addresses these challenges with a unified framework and evaluations of unlearning methods and metrics.

1 INTRODUCTION

  • MLLM pretraining data may contain private, harmful, or copyrighted content, while retraining from scratch for deletion requests is impractical and knowledge may persist across modalities.The same concept can be redundantly encoded in visual features, language representations, and cross-modal interactions.Source: §1 · pp. 1–2
  • Method-specific backbones and preprocessing, fragmented evaluation protocols, and inconsistent or potentially misleading metrics hinder reproducible comparisons of MLLM unlearning.A drop in forget-set performance can reflect output suppression or general capability degradation rather than knowledge removal.Source: §1 · p. 2
  • Open-MMUnlearning integrates 5 benchmarks, 8 MLLMs from 4 model families, and 12 unlearning methods in a common framework for the complete unlearning lifecycle.Its evaluation jointly examines forgetting, retained utility, and robustness against model-, input-, and output-side attacks.Source: §1 · p. 2
  • The metric meta-evaluation tests whether commonly used MLLM unlearning metrics reflect target knowledge and remain robust under post-unlearning interventions.It assesses whether metrics distinguish genuine knowledge removal from superficial suppression.Source: §1 · p. 3

2 OVERVIEW OF MLLM UNLEARNING

MLLM unlearning methods differ in how they intervene on models, while benchmarks target privacy, safety, or copyright. Evaluation combines forgetting and utility measures with tests of robustness to knowledge recovery.

Methods

  • Optimization-based methods update objectives, localization-based methods edit target-associated components, arithmetic-based methods operate on weights or update vectors, and inference-time methods intervene during decoding.Optimization objectives include general, counterfactual, distillation, structured, feedback-driven, and adversarial objectives.Source: §2 · p. 3

Benchmarks

  • Benchmarks address privacy, safety, and copyright, with privacy targets including identities, profiles, sensitive attributes, and associations.Privacy targets may originate in pretraining or be introduced through controlled fine-tuning; safety targets harmful multimodal knowledge, while copyright targets protected characters, logos, and related knowledge.Source: §2 · p. 3

Evaluations

  • Evaluation pairs forgetting-effectiveness measures with utility-preservation metrics and tests whether target information can be recovered through attacks or interventions.Measures include task accuracy, lexical overlap, likelihood, and distribution comparisons; robustness tests include cross-modal queries, membership inference, adversarial prompts, visual perturbations, and relearning.Source: §2 · p. 3

3 OPEN-MMUNLEARNING FRAMEWORK

Open-MMUnlearning addresses the fragmented implementations and evaluations that make MLLM unlearning difficult to reproduce and compare. It provides a modular pipeline spanning data preparation, model training, unlearning, evaluation, and robustness audits.

3 OPEN-MMUNLEARNING FRAMEWORK

  • Methods and backbones are often evaluated in limited settings, and differences in initialization, preprocessing, trainable components, and hyperparameters can require substantial pipeline reimplementation.General unlearning objectives may also require adaptation for multimodal settings.Source: §3 · pp. 3–4
  • Fragmented forget and retain splits, task formulations, and robustness tests limit joint comparisons, while metric judgments may be unfaithful or unstable after quantization or relearning.A forget-set performance decrease may reflect output suppression or general capability degradation rather than knowledge removal.Source: §3 · p. 4
  • Open-MMUnlearning integrates data preparation, target-model training, unlearning, Forget Quality and Model Utility evaluation, and robustness assessment through shared interfaces.The framework is intended to support reproducible, directly comparable evaluations across methods, benchmarks, and MLLM backbones.Source: §3 · p. 4

3.1 DESIGN OF OPEN-MMUNLEARNING

  • The pipeline assigns data preparation to the Data Worker, backbone supply to the Model Loader, unlearning to the Trainer, and evaluation to the Unified Evaluator.The framework uses structured configurations and independently registered modules so experiments can be reproduced under the same settings and components exchanged.Source: Figure 1 · p. 4, §3.1 · p. 5
  • The framework supports 12 unlearning methods, 8 MLLMs across 4 model families, and 5 benchmarks spanning privacy, safety, and copyright.Its evaluation components cover Forget, Utility, and Robust, including task-based, lexical, likelihood, distribution, safety, and robustness evaluations.Source: §3.1 · p. 5, Table 1 · p. 5
  • New models, methods, benchmarks, metrics, and attacks can be integrated through common interfaces and configurations without modifying the core pipeline.Integrated models and methods can reuse existing benchmark evaluators and robustness audits.Source: §3.1 · p. 6

4 EVALUATION OF UNLEARNING METHODS

Under a common evaluation protocol, GD and MIP-Editor tie for the highest overall score, while component results reveal trade-offs and the importance of reading aggregate rankings alongside individual dimensions.

4.1 EXPERIMENT SETUP

  • The controlled comparison covers ten representative methods and evaluates Forget Quality, Model Utility, and robustness across model, input, and output attack surfaces.Checkpoint selection maximizes mean Forget Quality and Model Utility; robustness is evaluated afterward and does not influence tuning.Source: §4.1 · p. 6

4.2 RESULTS ANALYSIS

  • 0.647: GD and MIP-Editor jointly achieve the highest aggregate score, followed by UNDIAL at 0.640.Table 2 reports aggregate scores alongside Forget Quality, Model Utility, and model-, input-, and output-side Robustness.Source: §4.2 · p. 6, Table 2 · p. 7
  • Adapted general methods average 0.623 overall and 0.778 Robustness, while MLLM-specific methods average 0.613 overall and 0.764 Robustness.MLLM-specific methods have a slight Model Utility advantage, scoring 0.362 versus 0.354.Source: §4.2 · p. 7
  • GD leads Forget Quality at 0.781, while MIP-Editor combines 0.717 Forget Quality with 0.451 Model Utility and 0.773 Robustness.UNDIAL has the highest Model Utility at 0.454; GA scores 0.774 in Forget Quality and 0.881 in Robustness but only 0.066 in Model Utility.Source: §4.2 · p. 7
  • GA leads Robustness at 0.881, but its 0.066 Model Utility suggests that its apparent resistance may partly reflect broadly impaired answering.MIP-Editor has the highest Output-side score at 0.814, while its Input-side score is 0.676.Source: §4.2 · p. 7
  • The arithmetic-mean ranking lets strength in one dimension offset weakness in another, so overall ranks require comparison with component scores.Normalization and aggregation rules are detailed in Appendix A.3.3.Source: §4.2 · p. 7

5 EVALUATION OF UNLEARNING METRICS

The metric meta-evaluation tests whether unlearning metrics reflect target-knowledge exposure and remain reliable under interventions. BLEU ranks highest overall, while faithfulness and robustness do not always align.

5 EVALUATION OF UNLEARNING METRICS

  • Faithfulness measures separation between models with and without target knowledge, while robustness tests metric judgments under quantization and targeted relearning.Quantization adds no target data; relearning compares the unlearned model with a retain-only reference under a matched training budget.Source: §5 · p. 8

5.1 EXPERIMENTAL SETUP

  • The meta-evaluation uses MLLMU with LLaVA-1.5-7B, comparing controlled positive and negative model pools and excluding certain utility-degraded or insufficiently forgotten models.Robustness models with more than a 20% utility drop or insufficient forgetting under the corresponding metric are excluded.Source: §5.1 · p. 9

5.2 RESULTS ANALYSIS

  • KS-Test has the highest faithfulness, but KS-Test and JS Distance score lower in robustness than Truth Ratio, which leads aggregate robustness.Cloze and Classification have high robustness but relatively low faithfulness; Probability has a more balanced profile.Source: §5.2 · p. 9
  • Reliable evaluation jointly tests exposure discrimination, stability under benign quantization, and response to targeted relearning against a retain-only reference.Source: §5.2 · p. 9
  • BLEU achieves the highest aggregate score, while ROUGE-L ranks second overall among the evaluated metrics.The table evaluates 13 metrics across faithfulness and robustness, including quantization and targeted relearning.Source: Table 3 · p. 9, §5.2 · p. 9

6 CONCLUSION

The conclusion presents OPEN-MMUNLEARNING as a reproducible framework for comparing MLLM unlearning and argues for joint assessment of forgetting, utility, robustness, and metric reliability.

6 CONCLUSION

  • OPEN-MMUNLEARNING integrates twelve methods and five benchmarks into a common pipeline for model preparation, multimodal data processing, unlearning, and evaluation.It also supplies metrics for forgetting and retained utility, plus robustness evaluations.Source: §6 · p. 10
  • General methods average slightly higher overall and in Robustness, while MLLM-specific methods have a slight Model Utility advantage.Strong Forget Quality can coexist with substantial utility loss.Source: §6 · p. 10
  • Metric faithfulness and robustness can diverge, supporting joint evaluation of forgetting, retained utility, robustness, and metric reliability.Source: §6 · p. 10

AI USE STATEMENT

The authors report using language models for literature work, manuscript drafting, and generation of evaluation materials, with automated checks on generated answers.

AI USE STATEMENT

  • GPT-6 assisted literature retrieval and drafting, polishing, and translation of manuscript sections.Source: AI USE STATEMENT · p. 10
  • GPT-4o generated question paraphrases, answer expansions, fact-preserving paraphrases, and factually perturbed answers for metric evaluation.Source: AI USE STATEMENT · p. 10
  • Automated checks covered required fields, nonempty outputs, and the number and uniqueness of generated evaluation answers.The authors take responsibility for the final manuscript, data, and results.Source: AI USE STATEMENT · p. 10

A.2 DETAILS OF METRICS

The section distinguishes four audit classes and defines behavioral recovery relative to the frozen unlearned model. It pairs recovery measurements with controls to distinguish target-specific recovery from other changes.

A.2 DETAILS OF METRICS

  • Audits cover model-side recovery, input-side recovery, representation-side inspection of frozen hidden states, and score-side membership attacks.The classes differ by whether parameters or queries are modified, representations are probed, or teacher-forced likelihoods or logits are used.Source: §A.2 · p. 14
  • Behavioral recovery is RA(Ma) = Af(Ma) − Af(Mu), where Ma is an attacked model or the unlearned model tested on attacked inputs.The metric applies only to behavioral recovery attacks; representation-side and membership audits use separate task-specific metrics.Source: §A.2 · p. 14
  • Matched retain/control changes accompany RA, while membership attacks use separate score orientations and member/non-member controls.Attack-generation, calibration, and evaluation splits are disjoint unless explicitly stated otherwise.Source: §A.2 · p. 14

A.2.1 MODEL-SIDE ATTACKS.

Model-side audits test whether interventions or limited relearning expose residual target information, while probing checks whether it remains decodable from frozen representations.

A.2.1 MODEL-SIDE ATTACKS

  • Quantization applies 4-bit weights after unlearning as a target-data-free stress test for renewed target answerability.RTN, GPTQ, and AWQ are treated as distinct configurations; increased forget-set answerability counts as target-specific recovery only without a commensurate control change.Source: §A.2.1 · p. 14
  • Relearning uses correlated auxiliary target data, disjoint recovery-test pairs, and an explicit attack budget.Systematically faster recovery from the unlearned model than from an identically budgeted retain-only reference supports residual target information; unconstrained retraining accuracy alone is insufficient.Source: §A.2.1 · pp. 14–16
  • Probing freezes the unlearned model and trains a low-capacity linear map on pooled hidden states to predict forgotten labels.Above-control performance on entity-disjoint test data indicates linearly decodable target information, interpreted as residual information rather than behavioral recovery.Source: §A.2.1 · p. 16

A.2.2 INPUT-SIDE ATTACKS.

Input-side audits keep the unlearned model fixed while changing queries or visual inputs. They assess recovery using correct forgotten answers and compare results with clean or retain/control performance.

A.2.2 INPUT-SIDE ATTACKS

  • Jailbreak success requires recovering the correct forgotten answer, not merely producing an affirmative response.Fixed templates are low-budget black-box attacks; GCG requires gradient access, AutoDAN uses evolutionary prompt search, and PAIR iteratively refines prompts through black-box interaction.Source: §A.2.2 · p. 16
  • Jailbreak variants report access level, query budget, restarts, and success separately rather than pooling heterogeneous threat models.Answer-prefix prefilling is a separate access setting, and prefilled tokens are excluded from answer scoring.Source: §A.2.2 · p. 16
  • Stealthy Universal Attack learns an image perturbation on attack-training data and evaluates transfer on disjoint images under a pixel budget.Evaluation uses the original text query and includes answerability, paired recovery, perceptual quality, and retain/control changes.Source: §A.2.2 · p. 16
  • FigStep transfers a target-seeking instruction into a typographic image paired with a fixed, apparently benign text prompt.The black-box attack requires neither gradients nor parameter access, and success requires the correct forgotten answer.Source: §A.2.2 · p. 17
  • Image Rephrase tests whether forgetting persists when a forgotten image is replaced by a semantically similar, visually changed image.Results are reported by semantic-proximity difficulty, with attack success and paired recovery compared alongside matched retain/control performance.Source: §A.2.2 · p. 17

A.2.3 OUTPUT-SIDE ATTACKS.

This appendix documents the scope and procedures for output-side membership attacks, integrated unlearning methods, and hyperparameter search, alongside the construction and breakdown of unlearning and metric-reliability scores. It also presents qualitative case studies and qualifies the scope and interpretation of the evaluations.

A.2.3 OUTPUT-SIDE ATTACKS.

  • LOSS, ZLIB, Min-K%, Min-K%++, and GradNorm use distinct loss, compression-normalized, token-tail, distribution-standardized, and gradient scores, with access requirements reported by threat model.LOSS and ZLIB require teacher-forced target log-likelihoods, Min-K% requires token log-probabilities, Min-K%++ requires full vocabulary distributions, and GradNorm is white-box.Source: §A.2.3 · pp. 17–18
  • Membership attacks compare forgotten training members with a distribution-matched holdout, reporting ROC-AUC and low-FPR TPR against a retain-only retrained reference.Thresholds are selected on a separate calibration split; raw forget-set scores without non-member controls are membership proxies, not attack accuracy.Source: §A.2.3 · p. 17

A.3.1 DETAILS OF UNLEARNING METHODS

  • Unlearning methods span likelihood-based updates and specialized interventions, including hidden-state misdirection, saliency-guided updates, neuron pruning, path editing, adapters, and visual-noise distillation.Retention mechanisms include retain-set learning or anchoring, while MANU and MIP-Editor localize and prune or edit modality-specific components; VGID distills an intervention-induced teacher target.Source: §A.3.1 · pp. 19–22
  • The method designs include safeguards against broad utility loss: GradDiff depends on retain-set coverage, abstention does not prove knowledge removal, and adapter-based SMFA freezes the backbone.Other preservation mechanisms include KL constraints on the original output distribution, localized RMisU anchoring, and a retaining adapter that removes conflicting, dominant updates.Source: §A.3.1 · pp. 19, 22, 23

A.3.2 HYPERPARAMETER SEARCH

  • For the evaluated MLLMU forget setting, experiments cover reported hyperparameter configurations: GA has 3, while NPO, RMU, UNDIAL, and MIP-Editor each have 27.Source: §A.3.2 · pp. 23–24

A.3.3 METRIC AGGREGATION

  • Checkpoints maximize mean Forget Quality and Model Utility; robustness is assessed afterward, while same-split selection may make reported values and Overall scores optimistic.The additional tables break down Forget Quality, Model Utility, and model-, input-, and output-side Robustness scores.Source: §A.3.3 · p. 25, §A.3.4 · p. 26

A.3.5 CASE STUDY

  • GA omits all four forget targets but also all four retain targets; MIP-Editor and UNDIAL retain all four targets and suppress three forget targets, yet both reveal Eva Lindberg.GD and RMU preserve all four retain targets but reveal the forget target in two cases each; GA also often produces repetitive text. The cases are qualitative illustrations, not estimates of overall performance.Source: §A.3.5 · p. 29, Figure 3 · p. 30

A.4.1 FAITHFULNESS

  • Faithfulness measures how well a metric distinguishes models containing target knowledge from models that have not learned it.Metric scores are normalized to [0, 1] and direction-aligned to the corresponding objective.Source: §A.4.1 · p. 32, §A.4 · p. 32

A.4.2 ROBUSTNESS

  • Quantization and relearning assess metric robustness; probing is reported separately because its auxiliary readout is not directly comparable and showed near-ceiling scores in this setting.For the Finetune reference, probing-based forgetting scores were 0.993 and 0.996 at layers 16 and 24, versus Retain-Only scores of 0.984 and 0.993.Source: §A.4.2 · pp. 32–33

A.4.3 METRIC AGGREGATION

  • Metric robustness aggregates quantization and relearning with their harmonic mean; figures show faithfulness results for 13 metrics and quantization and relearning results for 11 metrics.The section also defines an overall reliability score.Source: §A.4.3 · p. 33, Figure 7 · p. 35, Figure 8 · p. 36

A.4.4 AI-ASSISTED CONSTRUCTION OF MLLMU VARIANTS

  • AI-generated MLLMU variants alter question or answer text, while the faithfulness search varies target-knowledge exposure across six datasets and five learning rates.The positive pool contains target facts; the negative pool does not, with perturbed answers and unrelated biographies serving as controls.Source: §A.4.4 · p. 33, §A.4.5 · p. 34

A.5 LIMITATIONS

  • The controlled method comparison covers ten methods on one MLLMU setting and metric meta-evaluation uses LLaVA-1.5-7B; selected attacks and interventions cannot establish irrecoverability or generalize broadly.Aggregate scores depend on normalization and aggregation choices and should be considered alongside component results.Source: §A.5 · p. 38

A.6 REPRODUCIBILITY STATEMENT

  • Experiments use structured configuration files, and users should follow dataset terms; favorable scores or refusals do not guarantee complete deletion, privacy protection, legal compliance, or deployment safety.The ethics statement recommends assessing potential information leakage before releasing unlearned models or their outputs.Source: §A.6 · p. 38, §A.7 · p. 38

Related papers

Loading 2610.10358v1…