Does Machine Unlearning Truly Remove Knowledge?

TL;DR

This paper introduces a comprehensive framework for evaluating the effectiveness of machine unlearning algorithms in large language models, addressing the challenge of verifying knowledge removal through novel auditing techniques.

Contribution

It presents a new auditing framework with benchmark datasets, multiple unlearning algorithms, and innovative methods using intermediate activation perturbations.

Findings

Auditing algorithms reveal varying effectiveness of unlearning strategies.

Prompt-based methods have limitations that can be addressed by activation perturbation techniques.

The framework enables systematic evaluation of unlearning robustness and efficacy.

Abstract

In recent years, Large Language Models (LLMs) have achieved remarkable advancements, drawing significant attention from the research community. Their capabilities are largely attributed to large-scale architectures, which require extensive training on massive datasets. However, such datasets often contain sensitive or copyrighted content sourced from the public internet, raising concerns about data privacy and ownership. Regulatory frameworks, such as the General Data Protection Regulation (GDPR), grant individuals the right to request the removal of such sensitive information. This has motivated the development of machine unlearning algorithms that aim to remove specific knowledge from models without the need for costly retraining. Despite these advancements, evaluating the efficacy of unlearning algorithms remains a challenge due to the inherent complexity and generative nature of LLMs. In this work, we introduce a comprehensive auditing framework for unlearning evaluation, comprising three benchmark datasets, six unlearning algorithms, and five prompt-based auditing methods. By using various auditing algorithms, we evaluate the effectiveness and robustness of different unlearning strategies. To explore alternatives beyond prompt-based auditing, we propose a novel technique that leverages intermediate activation perturbations, addressing the limitations of auditing methods that rely solely on model inputs and outputs.