PaperlayerView exact revision on arXiv

Source-linked AI summary

DecisionUnlearn-Bench: Unlearning Probabilistic Decisions under Changing Schemas

Tiantong Wu, Wei Yang Bryan Lim

arXiv:2610.38431v1cs.CRcs.AI

TL;DR

For probabilistic decision models, unlearning fidelity depends on the candidate options as well as the deleted data. DecisionUnlearn-Bench compares unlearned models with schema-specific retrained oracles and finds that deletion, labels, and candidate sets shape the target and the measured outcome.

  • Problem

    For probabilistic decisions, it is unclear how to judge whether unlearning matches retraining when the supplied candidate schema can affect recognition of deleted classes.

    Source: §1 · p. 1

  • Method

    DecisionUnlearn-Bench compares full, unlearned, and retain-only retrained models across deletion granularities, label renderings, candidate sets, utility, and recovery.

    Source: §1 · p. 2

  • Results

    Deletion granularity, label meaning, and candidate composition affect the retraining target, while SimNPO gains do not transfer uniformly across seeds, targets, or datasets.

    Source: §1 · p. 2, §6 · p. 9, §7 · p. 9

  • Takeaways & Limitations

    Reporting a schema-specific oracle alongside absolute and normalized fidelity, retained utility, and controlled recovery gives a more precise account of decision-model unlearning.

    Source: §7 · p. 10

    The architecture panel is purposively selected, recovery uses one trained seed per model, and checkpoint summaries do not recover the distribution over retrained models.

    Source: §6 · p. 9

Abstract

from arXiv · show

Machine unlearning aims to reproduce the behavior of a model trained without designated data. For probabilistic decision models, this target also depends on the candidate options supplied at inference. We introduce DecisionUnlearn-Bench, an empirical framework that compares full, unlearned, and retain-only models across deletion granularities, label renderings, and candidate sets. Across 20 eligible model configurations on the BANKING77 dataset, full-to-oracle displacement increases consistently from example to association to class deletion. Replacing semantic option labels with opaque codes nearly eliminates the retrained oracle's recognition of deleted classes, even with successful acquisition of the full model, whereas changing the candidate set alters both the oracle and the measured unlearning progress. SimNPO satisfies the screening criterion in 19 of 20 configurations, but its gains vary substantially across seeds and deletion targets. Development tuning on the CLINC150 dataset does not establish a positive pooled effect across 48 intents. At approximately matched suppression, methods can differ markedly in oracle fidelity. Recovery experiments further distinguish initial forgetting from subsequent adaptation and show conclusions that depend on both architecture and metric. These results show that evaluating decision-model unlearning relative to a schema-specific retraining target, with separate reporting of effect size, utility, robustness, and recoverability.

1. Introduction

DecisionUnlearn-Bench examines whether probabilistic decision models reproduce a schema-specific retraining target after deletion. It separates deletion effects from label and candidate-set effects, and from forgetting, utility, and recovery outcomes.

1. Introduction

  • Semantic candidate labels, remaining data, and pretrained knowledge can preserve recognition of a deleted intent, so low forgotten-class accuracy alone does not define fidelity.The benchmark asks how to interpret retraining fidelity when the decision schema changes.Source: §1 · p. 1
  • Evaluation separates deletion displacement, probability removed from forgotten options versus its redistribution, and behavior before adaptation versus subsequent recovery.Normalized improvement can change with the unlearned model, the oracle, or a small original deletion effect.Source: §1 · p. 1
  • The benchmark compares full, unlearned, and retain-only retrained oracle distributions across deletion granularities, development selection and evaluation, model screening and replication, and controlled schema changes.It measures displacement and approximation on deleted training rows and unseen related rows.Source: §1 · pp. 1–2
  • Class deletion creates the largest shift; opaque labels nearly eliminate oracle recognition, while SimNPO gains and recovery conclusions vary across seeds, targets, architectures, and metrics.Reduced candidate sets can also expose poor fidelity when labels are opaque.Source: §1 · p. 2
  • The evaluation also tests label semantics and candidate composition, and combines method-transfer, probability-redistribution, and recovery analyses to distinguish statistical acceptance from effect size.The motivating problem is removing designated data's influence without repeating the entire training process, with retraining as the behavioral reference.Source: §1 · pp. 1–2

2. Related Work

Related work establishes retraining as an operational reference and develops language-model unlearning methods and evaluations. This paper applies those approaches to decision schemas and examines recoverability from unlearned and retrained checkpoints.

Unlearning as approximation to retraining

  • Retraining schemes and oracle-matching approaches motivate using retraining as an operational reference, but the experiments do not remove data from pre-training or establish equality of parameter distributions.The cited foundations include Ginart et al. (2019), Bourtoule et al. (2021), and Georgiev et al. (2025).Source: §2 · p. 2

Language-model unlearning methods and evaluation

  • TOFU, MUSE, and OpenUnlearning evaluate forgetting and retained utility, while NPO and SimNPO modify forgetting objectives and RMU intervenes on representations.The paper investigates these approaches in a decision setting rather than proposing a new unlearning optimizer.Source: §2 · p. 2

Decision schemas and recoverability

  • The study varies candidate meanings and option sets, then compares adaptation from unlearned and retrained checkpoints while separating starting behavior, subsequent gains, and new-head transfer.Intent datasets distinguish deleting individual records from deleting all examples of an intent; relearning is also evaluated in Fan et al. (2025).Source: §2 · p. 2

3. Problem Formulation and Evaluation

The evaluation defines unlearning against a retain-only retrained model under the same decision schema, then separates deletion granularity, evaluation view, and schema effects. It reports oracle displacement and progress alongside feasibility, selection, and uncertainty criteria.

3.1. A schema-specific retraining target

  • A schema specifies ordered candidate options and their renderings; the retrained oracle excludes deleted data while retaining deleted classes as available options.The full model is the no-op baseline, and both references are evaluated under the unlearned model’s schema.Source: §3.1 · p. 2
  • Label interventions retrain full and oracle models under changed renderings, whereas candidate-set interventions re-evaluate existing checkpoints with reduced options.These interventions probe distinct sources of schema dependence.Source: §3.1 · p. 3

3.2. Deletion granularity and evaluation views

  • The benchmark removes random training rows, selected sub-intent clusters, or all rows of selected classes as three deletion granularities.Association deletion retains other examples of the parent intents.Source: §3.2 · p. 3
  • Forget-training uses deleted training rows, while forget-generalization uses unseen evaluation rows associated with deleted units; retained utility is measured on ER.For example deletion, generalization rows are those whose nearest training row belongs to the deletion set.Source: §3.2 · p. 3

3.3. Distance, progress, and feasibility

  • Oracle distance is mean base-2 Jensen–Shannon divergence, and normalized progress measures movement toward the oracle relative to schema- and deletion-specific displacement.The paper reports displacement and absolute gains alongside progress, and avoids interpreting ratios with negligible displacement as stable effect sizes.Source: §3.3 · p. 3
  • Feasibility limits retained-accuracy loss and calibration-error increase to 0.02 each; acceptance also requires positive gains with positive lower 95% confidence bounds on both views.Acceptance does not require a minimum progress fraction or imply equivalence to retraining.Source: §3.3 · p. 3

3.4. Selection, replication, and uncertainty

  • Development data determine eligible targets and method settings, with class and association targets selected using different accuracy thresholds and replication preserving the original targets.Primary class targets require accuracy of at least 0.70 and gold probability of at least 0.50; association targets use a 0.65 accuracy threshold.Source: §3.4 · p. 3
  • Uncertainty estimates use paired row bootstraps with ratio recomputation, while row intervals are conditioned on trained checkpoints and do not cover future training seeds.The frozen confirmation family uses Holm-adjusted intersection–union tests based on the larger view-specific p-value.Source: §3.4 · p. 3

4. Experimental Design

The experiments screen eligible model configurations, test selected unlearning methods, and separate broad transfer from confirmation and exploratory interventions. The design is explicitly not a complete method-by-model factorial comparison.

4. Experimental Design

  • The panel contains 20 eligible configurations; Qwen3.5-0.8B is the reference for method selection and the most extensive replication.InternLM3-8B was excluded because checkpoint reloading was not reproducible.Source: §4 · p. 3
  • The study evaluates seven specified methods or controls, but does not form a complete method-by-model factorial comparison.The set includes GradAscent, GradDiff, GradDiff-KL, NPO, SimNPO, RMU, and a uniformization control.Source: §4 · p. 3
  • The design separates granularity screening, method confirmation and seed-bundle replication, and schema, suppression, and recovery interventions.The broad transfer panel evaluates frozen reference-model SimNPO; RMU is used in the suppression diagnostic, with temperature scaling as a CLINC150 control.Source: §4 · p. 4

5. Results

Results show that retraining targets shift with deletion granularity and decision schema, while unlearning gains vary across configurations, datasets, and recovery metrics.

5.1. Deletion granularity determines the size of the counterfactual shift

  • Panel medians rise from example to association to class deletion: F 0.035/0.150/0.477 and G 0.021/0.149/0.396.These are descriptive medians over model configurations; the figure reports BANKING77 displacement for 20 eligible configurations.Source: §5.1 · p. 4, Figure 1 · p. 6

5.2. Label meaning changes the oracle, but does not guarantee easier unlearning

  • Opaque labels drove deleted-row oracle accuracy to zero on BANKING77, yet SimNPO progress varied across BANKING77 bundles and CLINC150 targets.CLINC150 opaque-label oracle recognition was nearly eliminated, but progress rose for some targets and fell for others.Source: §5.2 · p. 4

5.3. Candidate composition changes both recognition and fidelity

  • On semantic BANKING77 bundle 01, moving from S0 to S2 lowered Qwen3.5-0.8B deletion displacement on F from 0.608 to 0.148 and SimNPO progress from 0.59 to 0.32.Oracle F accuracy also changed from 0.269 under S0 to 0.799 under S2.Source: §5.3 · p. 4
  • On opaque-label BANKING77 bundle 01, SimNPO progress fell from 0.61 under S0 to 0.00 under S1 and 0.12 under S2 despite near-zero oracle recognition.Bundle 02 showed the same qualitative failure to preserve full-schema progress.Source: §5.3 · pp. 4–5, Figure 2 · p. 7

5.4. Reliable reference-model gains do not imply uniform transfer

  • 19/20 configurations satisfy screening; SimNPO retains positive reference-model gains, but CLINC150 pooled gains across 48 intents do not establish a positive average effect.The reference-model gains remain positive across nine seed–bundle cells; CLINC150 pooled gains are 0.022 [−0.045,0.090] on F and 0.022 [−0.044,0.094] on G.Source: §5.4 · pp. 5–6

5.5. Suppression magnitude is insufficient to characterize fidelity

  • PF is 0.56, 0.55, and 0.04 for BANKING77 SimNPO, GradAscent, and RMU at s = 0.78, 0.68, and 0.72, respectively, under approximate development matching.The matched configurations differ on held-out data; development matching does not ensure identical held-out suppression.Source: §5.5 · pp. 6–7

5.6. Recovery depends on the starting checkpoint and the metric

  • Apertus-8B has pooled Gadj ≈0.16 [0.12,0.20], while Qwen3.5-0.8B is ≈0.04 [0.00,0.09] and Qwen3.5-9B’s adjusted contrast is ≈−0.05.For Qwen3.5-9B, the headroom-normalized contrast is approximately 0.10, so its apparent recovery advantage depends on the endpoint.Source: §5.6 · p. 8

6. Discussion and Limitations

Unlearning results must be interpreted against a retraining target that includes the decision schema. The study’s conclusions are bounded by its datasets, adaptation setting, and experimental design.

6. Discussion and Limitations

  • A fixed-schema score does not establish robustness to schema changes: candidate alternatives can alter oracle recognition and measured unlearning progress.Opaque labels can eliminate oracle recognition while an unlearned model remains poorly aligned under a reduced option set.Source: §6 · p. 9
  • Statistical acceptance, transfer, and post-adaptation performance do not alone establish substantial progress, reliable transfer, or faster learning.The probability-geometry analysis is descriptive, and imperfect suppression matching does not isolate a unique mechanism.Source: §6 · p. 9
  • The evidence does not establish pretraining erasure, open-ended generation behavior, or guarantees against privacy attacks.The study uses two intent-classification datasets and supervised task adaptation from pretrained backbones.Source: §6 · p. 9
  • Several design choices constrain generalization: deletion granularity changes data composition, each dataset uses one label-code map, and recovery uses one trained seed per model.The four-class bootstrap is coarse, the label-swap control differs in initial difficulty and objective, and checkpoint summaries do not recover the distribution over retrained models.Source: §6 · p. 9

7. Conclusion

DecisionUnlearn-Bench evaluates whether approximate unlearning reproduces the changes caused by deleting supervised data from probabilistic decision models. Its conclusion is that the retraining target depends on deletion granularity and the decision schema, and that unlearning requires multiple complementary diagnostics.

7. Conclusion

  • Deletion granularity, label meaning, and candidate composition all affect the retraining target, while SimNPO’s BANKING77 gains do not transfer uniformly across seeds, targets, or datasets.The study reports that suppression and recovery diagnostics make low forgotten-class accuracy and high post-adaptation performance insufficient summaries.Source: §7 · p. 9
  • Reporting schema-specific oracle behavior, absolute and normalized fidelity, retained utility, and controlled recovery gives a more precise account of decision-model unlearning.Recovery figure intervals are conditional on repeated evaluations of the same trained checkpoints; Qwen3.5-9B has no control arm.Source: §7 · p. 10

Impact Statement

The work evaluates removal of supervised training influence in probabilistic decision models, while its intent-classification experiments do not establish privacy guarantees or pretraining erasure. The appendix clarifies that its retraining reference and schema are specific to task adaptation and candidate information.

Impact Statement

  • More accurate evaluation can help avoid unsupported claims that a model has forgotten private information, but these intent-classification experiments establish no privacy guarantee.They also do not establish successful record extraction or removal of knowledge acquired during pretraining.Source: Impact Statement · p. 10

A. Notation and Scope of the Retraining Reference

  • The retain-only oracle is trained from the shared pretrained initialization and may retain relevant pretrained, retained-task, or option-description information.Its residual recognition is compatible with the specified supervised-data retraining counterfactual and is not evidence that it was trained on deleted data.Source: A. Notation and Scope of the… · p. 12
  • The decision schema includes both candidate membership and the textual information supplied about candidates; changing candidates at evaluation reuses checkpoints, while opaque-label training creates a different oracle checkpoint.Training, adaptation, and head seeds index distinct sources of variation.Source: A. Notation and Scope of the… · p. 12

B.1. Datasets and deletion units

The appendix specifies the datasets, deletion units, evaluation populations, observed experiment coverage, methods, metrics, inference rules, and cross-bundle analyses used to interpret the benchmark.

B.1. Datasets and deletion units

  • BANKING77 has 77 intents and CLINC150 has 150 in-scope intents plus an out-of-scope option; example, association, and class deletion remove different units of training data.Eligibility thresholds and hash-order selection determine targets, with one documented seed-42 semantic BANKING77 bundle-02 exception.Source: §B.1 · p. 12

B.2. Evaluation populations

  • Evaluation populations depend on deletion granularity: class and association evaluation use unseen rows of deleted units, while example evaluation links rows through nearest training rows.Retained utility uses retained evaluation rows from the same configuration.Source: §B.2 · p. 12

B.3. Observed coverage and stages

  • The observed design includes a 20-model granularity panel, staged method and seed-bundle comparisons, seven semantic/opaque label pairs, and candidate-set studies.InternLM3-8B was excluded for checkpoint-reload reproducibility; the CLINC150 bundle 08 remained reserved.Source: §B.3 · pp. 12–13

C. Model Training, Methods, and Configuration Reporting

  • The benchmark compares full, unlearned, and retain-only models through complete option distributions, and evaluates gradient-, preference-, representation-, and uniformization-based method families.The method configurations are not a complete method-by-model factorial comparison; CLINC150 tuning selected a tested grid-boundary setting rather than establishing an optimum beyond the grid.Source: C. Model Training, Methods, and… · p. 13

D.1. Distributional metrics

  • Distributional distances lie between zero and one, and normalized progress uses aggregate distances with a separate full/oracle denominator for each schema and label condition.Retained accuracy uses the highest-probability option, while ECE compares confidence with empirical correctness within bins.Source: §D.1 · p. 13

D.2. Within-configuration inference

  • Both-view acceptance requires positive point estimates and lower bounds for both distributional gains, plus retained-utility constraints; statistical acceptance is not an equivalence test or practical-effect threshold.Frozen confirmation uses adjusted intersection-union tests, while reference-model replication additionally checks feasibility and leave-one-seed/bundle-out results.Source: §D.2 · p. 14, §D.3 · p. 14

D.3. Cross-bundle summaries

  • Across 48 CLINC150 intents, the pooled point gain is 0.022, with intervals spanning zero under both intent-bootstrap and bundle-then-intent analyses.Mean per-intent progress is omitted because some displacement denominators are small.Source: §D.3 · p. 14

E. Complete Method and Transfer Results

The supplementary results show that method performance, oracle fidelity, and recovery depend on deletion target, label and candidate schema, architecture, and metric. Several analyses are exploratory or conditional, limiting stronger generalization.

E. Complete Method and Transfer Results

  • 19 of 20 configurations satisfy the SimNPO screening criterion, but the selected-panel count is descriptive, and association-level gains vary by bundle.SimNPO satisfies the stored association-level replication rule; GradDiff does not establish a positive G aggregate, while Uniformization is a control without a replication decision.Source: E. Complete Method and Transfer Results · p. 14

F. Label and Candidate-Schema Interventions

  • Opaque labels strongly reduce oracle recognition, while candidate-set changes can alter both oracle behavior and measured progress.Opaque rendering replaces option names and descriptions with fixed codes while leaving forgotten options present; reduced schemas are rescored rather than sliced from full-schema probabilities.Source: F. Label and Candidate-Schema… · pp. 14–15

G. Suppression and Probability Geometry

  • Suppression measures net forgotten-option mass, not its destination; projected magnitude and residual diagnostics are descriptive, not an additive Jensen–Shannon decomposition.Development suppression matching is approximate, and held-out fidelity cannot be inferred from development suppression alone.Source: G. Suppression and Probability Geometry · p. 15

H.1. Adaptation and numerical summaries

  • Recovery summaries compare matched adaptation schedules across exposure budgets, but repeated settings share trained checkpoints and are not independent training replications.Threshold times are evaluated on a discrete update grid and unreached thresholds are censored at 25 updates.Source: §H.1 · pp. 15–16

H.2. Starting point and headroom

  • Apertus-8B has positive adjusted gains across configurations, whereas Qwen3.5-9B has negative adjusted gains despite positive headroom point contrasts.The contrasting summaries do not identify a model-intrinsic learning rate.Source: §H.2 · p. 16

H.3. Specificity and exposure controls

  • Seen-row evaluation excludes exposure rows, but the experiments establish no clear positive seen-minus-unseen advantage and do not prove its absence.The retained label-swap control starts near zero target probability and reverses a correct mapping, so specificity is relative to that particular control.Source: §H.3 · p. 16

H.4. Fresh-head transfer

  • Fresh heads trained on retained-class rows test transfer through frozen representations while semantic option labels remain available, not storage of individual deleted records.Pooled row intervals exclude zero, whereas class intervals do not.Source: §H.4 · p. 16

I. Optimization Diagnostics and Conditional Strength Reruns

  • Seed comparisons show that weaker suppression does not explain every fidelity loss; exploratory stronger-update reruns do not validate a repair rule.At learning rate 6×10−5, the best displayed Apertus checkpoint reaches approximately PF = 0.42, while Qwen3.5-9B reaches approximately 0.19 and later oversuppresses; epochs were selected after inspecting traces.Source: §I · pp. 16–17

J. Compute, Integrity, and Reproducibility

Compute records and integrity checks have material accounting and reproducibility boundaries. Supplementary figures preserve supplied assets while distinguishing reported conclusions from interpretive limits.

J. Compute, Integrity, and Reproducibility

  • Logged GPU-hour totals are partial and do not establish total study compute or an unlearning speedup over full retraining.Full-model evaluations record zero without including stored full-checkpoint training time, and recovery-job accounting is incomplete.Source: J. Compute, Integrity, and… · p. 17
  • The audit reports repaired collisions and recovery reruns, but the S2-Rank privacy experiment stopped at acquisition and provides no privacy-robustness evidence.Reported upstream checks are not independently repeatable from the export-only manuscript package, which lacks raw probabilities.Source: J. Compute, Integrity, and… · p. 17

K. Supplementary Figures

  • Supplementary figures retain supplied vector assets, with captions distinguishing supported conclusions from interpretive limits.Production identifiers S1–S15 correspond to the original asset grouping.Source: K. Supplementary Figures · p. 17

L. Supplementary Tables

The supplementary materials document purposive, incomplete evaluation coverage and preserve detailed records, while captions and notes delimit what the displays support. Results are conditional on selected models, targets, and evaluation designs.

L. Supplementary Tables

  • The 20-model granularity panel orders full-to-oracle displacement from example to association to class deletion, but does not establish a privacy guarantee.Coverage across architectures and experiment combinations is purposive and incomplete; a filled cell does not mean every factor was independently replicated.Source: Figure S1 · p. 18, Figure S2 · p. 19
  • Opaque oracles have approximately zero forgotten-class recognition despite successful full-model acquisition, while SimNPO progress varies by bundle and dataset.The seven opaque acquisition checks pass; one semantic seed-42 BANKING77 bundle-02 class is below the acquisition threshold at replication.Source: Figure S4 · p. 21, L. Supplementary Tables · p. 50
  • Candidate-schema comparisons rescore models under changed options, and reduced schemas can change displacement and the normalized-progress denominator.Bootstrap ratios are recomputed within each replicate; small displacement can make normalized progress sensitive.Source: Figure S5 · p. 22, L. Supplementary Tables · p. 54
  • CLINC150 tuned effects vary in sign across held-out bundles, and the intent-pooled estimate includes zero.A positive point estimate for some intents does not imply a positive pooled effect; the development grid selected a boundary setting and was not extended.Source: L. Supplementary Tables · pp. 23–24, Figure S7 · p. 23, Figure S8 · p. 24
  • Recovery comparisons separate initial probability, subsequent gains, and headroom, but each curve uses one trained backbone seed and four forgotten classes.Seen-row evaluation excludes exposure rows, and the control begins near zero target probability while reversing a correct mapping.Source: L. Supplementary Tables · pp. 27, 59, Figure S12 · p. 28
  • The registry preserves distinct source rows and table exports, but several keys omit deletion granularity and logged compute omits full training and complete recovery accounting.Intervals condition on the tested units and reused backbones; screening status is not a simultaneous guarantee across architectures.Source: L. Supplementary Tables · pp. 32, 43, 61

Related papers

Loading 2610.38431v1…