CUSE: Fine-Grained Multimodal Unlearning with Counterfactual Guidance and On-Policy Self-Distillation

1 INTRODUCTION

• MLLM unlearning aims to remove undesirable training information while preserving non-target knowledge and general capabilities.The motivating risks include disclosure of sensitive personal information, copyrighted content, and unsafe knowledge.Source: §1 · p. 1
• Target-related content can coexist with information that should be preserved in a response, motivating token-level decisions about what to forget.The introduction reports that about 20% of generated tokens were highly sensitive to target-related evidence in a preliminary analysis.Source: §1 · p. 1
• Existing methods supervise complete fixed responses, applying forgetting uniformly across tokens and relying on off-policy supervision.Sequence-level rewards do not indicate which generation steps require correction, while fixed responses may miss disclosure patterns from the current model.Source: §1 · p. 2
• CUSE uses counterfactual inputs that replace target-related evidence while preserving non-target information to estimate token sensitivity from conditional log-probability changes.It assigns stronger forgetting signals to more sensitive tokens and reduces optimization on less sensitive ones.Source: §1 · p. 2
• CUSE’s dual-branch on-policy self-distillation samples responses from the current policy and uses a frozen original-model teacher with forgetting- or retention-oriented privileged contexts.The forgetting branch suppresses target disclosure, while the retention branch supports accurate, informative responses on non-target data.Source: §1 · p. 2

2.1 NOTATION AND PROBLEM SETUP

• A multimodal input is an image paired with a textual query, and the model generates a response autoregressively from that input.The generation state at each step consists of the input and the response prefix generated so far.Source: §2.1 · p. 3
• The unlearning goal is to obtain a post-unlearning model that removes knowledge associated with the forget set while preserving capabilities represented by the retain set.A common objective combines forgetting and retention losses, with λ controlling their trade-off.Source: §2.1 · p. 3

2.2 ON-POLICY DISTILLATION

• On-policy distillation queries a teacher at states along trajectories sampled from the student’s own policy to provide token-level supervision.On-policy self-distillation uses the same underlying model as teacher and student, with additional privileged information supplied to the teacher.Source: §2.2 · p. 3

3.1 COUNTERFACTUAL SENSITIVITY ESTIMATION

• Counterfactual intervention replaces target-related visual or textual evidence while preserving non-target information, and token sensitivity is measured by changes in conditional generation probabilities.For identity-related visual evidence, the face is replaced while attributes such as clothing and background are preserved.Source: §3.1 · p. 4
• The current policy supplies responses, while the frozen original model measures their counterfactual log-probability differences; only positive shifts indicate stronger target-related sensitivity.Positive shifts are retained when constructing the sensitivity score; negative shifts do not indicate stronger sensitivity.Source: §3.1 · p. 4

3.2 DUAL-BRANCH ON-POLICY SELF-DISTILLATION

• The student samples its own responses, and an original-model teacher conditioned on privileged contexts provides token-level supervision for the current behavior.The student sees the original input, while the teacher receives that input augmented with a privileged context.Source: §3.2 · p. 5
• The forgetting context guides suppression of target-related responses, while the retention context guides accurate, informative responses without unnecessary refusal, omission, or unsupported information.These complementary branches suppress target-related behavior while preserving non-target information.Source: §3.2 · p. 5

3.3 COUNTERFACTUAL SENSITIVITY-AWARE ON-POLICY SELF-DISTILLATION

• CUSE combines sensitivity-weighted forgetting with dual-branch on-policy self-distillation to guide token-level forgetting while maintaining non-target capabilities.The forgetting branch gives stronger supervision to more target-sensitive tokens; the retention branch preserves non-target knowledge and general capabilities.Source: §3.3 · p. 6

4.1 EXPERIMENTAL SETUPS

• Evaluation covers MLLMU-Bench and CoVUBench with three MLLM backbones, using classification, generation, cloze, and copyright-unlearning measures.MLLMU-Bench targets fictitious-profile unlearning; CoVUBench targets multimodal copyright concepts.Source: §4.1 · p. 6

4.2 RESULTS ANALYSIS ON MLLM UNLEARNING (RQ1)

• CUSE achieves retain-set generation scores of 0.554 and 0.579 on LLaVA-1.5-7B and Qwen2.5-VL-7B-Instruct, respectively, and visual concept accuracy of 64.9%.Across 5%, 10%, and 15% forgetting settings, CUSE lies in the upper-right region of Figure 4, indicating a balance between forget-set suppression and retained utility.Source: §4.2 · pp. 6–7, Figure 4 · p. 8
• On MLLMU-Bench, CUSE lowers forget-set classification accuracy from 59.20% to 11.20% on LLaVA-1.5-7B and from 66.40% to 13.60% on Qwen2.5-VL-7B-Instruct.Figure 3 reports a forgetting naturalness score of 4.64 for Qwen2.5-VL-7B-Instruct.Source: §4.2 · p. 6, Table 1 · p. 7, Figure 3 · p. 7

4.3 ABLATION STUDY OF CUSE (RQ2)

• Against fixed offline responses, on-policy supervision reduces forget-set classification accuracy from 57.00% to 11.20%, generation ROUGE from 0.372 to 0.129, and cloze accuracy from 48.00% to 10.00%.The authors state that current-policy responses better capture the model’s evolving generation behavior during unlearning.Source: §4.3 · pp. 7–8, Table 2 · p. 8
• Compared with Uniform weighting, CUSE reduces forget-set classification accuracy from 24.00% to 11.20%, generation ROUGE from 0.192 to 0.129, and cloze accuracy from 18.00% to 10.00%.The reported scores for Random weighting are 28.00%, 0.227, and 22.00%, respectively.Source: §4.3 · p. 8, Table 2 · p. 8

4.4 FURTHER ANALYSIS OF CUSE (RQ3)

• As γ increases, forget-set performance decreases, but excessive γ also degrades retained utility; the authors select γ = 2 as a balance.Figure 5 also tracks ROUGE-score evolution across optimization steps.Source: §4.4 · p. 8, Figure 5 · p. 9
• During optimization, retain-set ROUGE temporarily drops, then recovers and stabilizes while forget-set ROUGE remains low.Across random-prefix, paraphrase, jailbreak, and sampling-based perturbations, CUSE maintains effective forgetting while preserving non-target capabilities.Source: §4.4 · pp. 8–9, Table 3 · p. 9

• CUSE estimates token-level sensitivity to target-related evidence through counterfactual intervention and uses the resulting weights to adaptively modulate forgetting supervision.Source: §5 · p. 9
• Dual-branch on-policy self-distillation provides behavior-aligned forgetting and retention guidance.Source: §5 · p. 9
• Experiments across MLLMU-Bench and CoVUBench and multiple MLLM backbones show effective, natural forgetting while preserving retained knowledge and general multimodal capabilities.The authors report a favorable forgetting–utility trade-off across different settings.Source: §5 · p. 9

6 LIMITATIONS

• Counterfactual sensitivity estimates depend on input construction, privileged contexts require task-specific design, and online sampling plus teacher inference add computational costs.Automatically generating privileged contexts and developing more efficient unlearning strategies remain open directions.Source: §6 · p. 9

A.1 LLM UNLEARNING

• LLM unlearning has shifted from suppressing target likelihoods toward shaping coherent post-unlearning behavior, with approaches including replacement behavior, self-distillation, and neuron-level interventions.The surveyed work frames effective unlearning as removing target information while preserving coherent, useful generation.Source: §A.1 · p. 14

A.2 MLLM UNLEARNING

• MLLM unlearning work spans benchmarks and methods for privacy, copyright, harmful content, cross-modal consistency, reasoning traces, and sequential deletion.The surveyed findings point to joint concerns around forgetting strength, cross-modal consistency, and post-unlearning generation quality.Source: §A.2 · p. 14

A.3 ON-POLICY DISTILLATION

• On-policy distillation trains on current-policy trajectories, while on-policy self-distillation can use asymmetric contexts and privileged supervision.One cited analysis warns that privileged supervision on long reasoning trajectories can suppress self-correction and alternative reasoning branches.Source: §A.3 · pp. 14–15

B.1 DATASETS

• MLLMU-Bench uses fictitious profiles and multimodal question-answer pairs to evaluate privacy-oriented unlearning across four subsets and three tasks.Its subsets are Forget, Test, Retain, and Real Celebrity; its tasks are classification, generation, and cloze completion.Source: §B.1 · p. 15
• CoVUBench evaluates removal of specific visual copyright concepts while measuring general visual understanding through Forget, Test, and Retain Sets.It assesses forgetting effectiveness, generalization, response quality, and model capability.Source: §B.1 · p. 15

B.2 EVALUATION METRICS

• MLLMU-Bench evaluates classification, generation, and cloze completion, with lower Forget and Test scores and higher Retain and Real Celebrity scores preferred.Generation uses ROUGE-L; classification and cloze completion use accuracy.Source: §B.2 · p. 15
• CoVUBench reports six higher-is-better metrics: Efficacy, Generality, Divergence, Fluency, Specificity, and Capability.These cover forgetting, generalization, response quality, detailed factual preservation, and general multimodal ability.Source: §B.2 · pp. 15–16

B.3 BASELINES

• GA maximizes loss on the Forget Set, while GA-Diff adds a Retain Set objective to encourage preservation on non-target samples.Source: §B.3 · p. 16
• NPO treats original target responses as undesirable behaviors, whereas KL-Min constrains Retain Set divergence while forgetting on the Forget Set.Source: §B.3 · p. 16
• Multimodal baselines include MMUnlearner’s representation-preserving objectives, MANU’s modality-aware neuron pruning, and ASRU’s refusal steering followed by reinforcement learning.Source: §B.3 · p. 16

B.4 IMPLEMENTATION DETAILS.

• Experiments use LLaVA-1.5-7B, Qwen2.5-VL-7B-Instruct, and Qwen3-VL-4B-Instruct, with the vision encoder and multimodal projector frozen and LoRA applied to language-model projections.LoRA rank is 8, scaling factor 16, and dropout 0.05; training uses AdamW for five epochs with global batch size 16 and weight decay 0.01.Source: §B.4 · p. 16
• Figure 6 reports parameter sensitivity on MLLMU-Bench using Qwen2.5-VL-7B-Instruct; panels (6a) and (6b) show the impact of γ on ROUGE score and classification accuracy.Source: Figure 6 · p. 17
• Table 4 covers LLaVA-1.5-7B at 5%, 10%, and 15% forgetting ratios across forget, test, retain, and celebrity sets and classification, generation, and cloze tasks.The caption specifies that lower is better for ↓ metrics and higher is better for ↑ metrics.Source: Table 4 · p. 17

B.5 ROBUSTNESS EVALUATION SETTINGS

• Four perturbation types are evaluated: random prefixes, paraphrases, jailbreak prompts, and sampling-based attacks.The protocol follows Guang et al. (2026) and adds sampling-based variations.Source: §B.5 · p. 18
• Random-prefix tests prepend a semantically irrelevant neutral phrase while leaving the original question unchanged.This probes sensitivity to superficial input-format modifications.Source: §B.5 · p. 18
• Paraphrase tests use three semantically equivalent, lexically diverse queries per original, generated with GPT-5.4 while preserving intent and target information.The evaluation measures consistency of unlearning behavior on these inputs.Source: §B.5 · p. 18
• Jailbreak tests prepend instructions that encourage disclosure of target-related information or ignoring previous restrictions.The setting evaluates whether adversarial prompting can bypass learned forgetting behavior.Source: §B.5 · p. 18
• Sampling-based tests generate multiple candidate responses under different sampling configurations to assess stability across stochastic trajectories.This setting is included because CUSE uses on-policy generation during unlearning.Source: §B.5 · p. 18

D HYPERPARAMETER ANALYSIS

• As γ increases, forget-set performance consistently decreases in generation and classification, indicating stronger forgetting.The analysis uses Qwen2.5-VL-7B-Instruct on MLLMU-Bench.Source: D HYPERPARAMETER ANALYSIS · p. 18
• Retain-set performance initially fluctuates and then gradually declines as γ increases.Source: D HYPERPARAMETER ANALYSIS · p. 18
• The analysis suggests moderate sensitivity-aware reweighting provides a better forgetting–retention trade-off than overly large weights.The passage notes that overly large weights may degrade retained utility.Source: D HYPERPARAMETER ANALYSIS · p. 18

E EXTENDED RESULTS ON UNLEARNING PERFORMANCE

• On CoVUBench, CUSE achieves the best compared-method performance across six metrics on two backbones, with Efficacy scores of 99.23% and 99.82%.Capability scores remain close to those of pre-unlearning models; Table 5 reports LLaVA-1.5-7B and Qwen3-VL-4B-Instruct.Source: E EXTENDED RESULTS ON UNLEARNING… · p. 18, Table 5 · p. 20
• Across 5%, 10%, and 15% forgetting ratios, CUSE lowers forget- and test-set performance while keeping retain- and celebrity-set performance close to the pre-unlearning model.Retention remains stable across classification, generation, and cloze tasks, with only minor non-target utility degradation.Source: E EXTENDED RESULTS ON UNLEARNING… · p. 19
• 4.42 forgetting naturalness and 62.3% visual concept accuracy are CUSE’s highest reported scores among compared methods on MLLMU-Bench with LLaVA-1.5-7B.Figure 8 evaluates post-unlearning response quality and preserved visual capabilities.Source: E EXTENDED RESULTS ON UNLEARNING… · p. 18, Figure 8 · p. 20

Prompt

• The evaluation prompt instructs an assistant to assess whether an unlearned model’s response discloses information about the unlearning target and assign three integer scores from 0 to 5.Source: Prompt · p. 21

G INTERPRETATION OF SENSITIVITY-AWARE KL REWEIGHTING

• Forward KL aligns the student distribution with a forgetting-oriented teacher, while counterfactual sensitivity reweights correction toward steps more affected by target evidence.The weight scales optimization strength per decoding step; less-sensitive steps receive weaker emphasis.Source: G INTERPRETATION OF SENSITIVITY-AWARE… · pp. 22–23
• Sensitivity is evaluated at each autoregressive step under the current preceding trajectory and is a soft local signal, not exhaustive attribution of target-related tokens.On-policy sampling keeps the reweighting tied to the model’s evolving generation trajectories.Source: G INTERPRETATION OF SENSITIVITY-AWARE… · p. 23

Forget Set

• For a target-profession question, CUSE refuses to disclose the profession while the vanilla model answers “Wildlife Biologist”; for a retained-city question, both answer Berlin, Germany.These examples illustrate forgetting within a targeted response alongside retention on a separate question.Source: Forget Set · p. 24, Retain Set · p. 24