mlsanityData to 7 Oct 2026

Who's Harry Potter? Approximate Unlearning in LLMs

arXiv 2310.02238 ↗First posted 3 Oct 2023cs.CL cs.AIcited by 366

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

Large language models (LLMs) are trained on massive internet corpora that often contain copyrighted content. This poses legal and ethical challenges for the developers and users of these models, as well as the original authors and publishers. In this paper, we propose a novel technique for unlearning a subset of the training data from a LLM, without having to retrain it from scratch. We evaluate our technique on the task of unlearning the Harry Potter books from the Llama2-7b model (a generative language model recently open-sourced by Meta). While the model took over 184K GPU-hours to pretrain, we show that in about 1 GPU hour of finetuning, we effectively erase the model's ability to generate or recall Harry Potter-related content, while its performance on common benchmarks (such as Winogrande, Hellaswag, arc, boolq and piqa) remains almost unaffected. We make our fine-tuned model publicly available on HuggingFace for community evaluation. To the best of our knowledge, this is the first paper to present an effective technique for unlearning in generative language models. Our technique consists of three main components: First, we use a reinforced model that is further trained on the target data to identify the tokens that are most related to the unlearning target, by comparing its logits with those of a baseline model. Second, we replace idiosyncratic expressions in the target data with generic counterparts, and leverage the model's own predictions to generate alternative labels for every token. These labels aim to approximate the next-token predictions of a model that has not been trained on the target data. Third, we finetune the model on these alternative labels, which effectively erases the original text from the model's memory whenever it is prompted with its context.

Key facts. Cited by 366 papers in the map (data through 7 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 9 of its 23 references that are in the map. First posted on arXiv 3 Oct 2023.

Builds on

9 of 23 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Right to be Forgotten in the Era of Large Language Models: Implications, Challenges, and Solutions8 Jul
  2. 2023KGA: A General Machine Unlearning Framework Based on Knowledge Gap Alignment11 May
  3. 2022Knowledge Unlearning for Mitigating Privacy Risks in Language Models4 Oct
  4. 2022A Survey of Machine Unlearning6 Sep

Other references · 5

  1. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
  2. 2019PIQA: Reasoning about Physical Commonsense in Natural Languagecited by 2,818
  3. 2019BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questionscited by 2,140
  4. 2018Can a Suit of Armor Conduct Electricity? A New Dataset for Open Book Question Answeringcited by 2,114
  5. 2019Quick and (not so) Dirty: Unsupervised Selection of Justification Sentences for Multi-hop Question Answeringcited by 58

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 7; 2024: 123; 2025: 137; 2026: 99.

366 papers.

Sort:

By area:

  1. 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 507
  2. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 488
  3. 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearningcited by 484
  4. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  5. 2023Large Language Model Unlearningcited by 288
  6. 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Modelscited by 251
  7. 2024Rethinking Machine Unlearning for Large Language Modelscited by 247
  8. 2024Eight Methods to Evaluate Robust Unlearning in LLMscited by 153
  9. 2024Towards Safer Large Language Models through Machine Unlearningcited by 134
  10. 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 132
  11. 2024Machine Unlearning of Pre-trained Large Language Modelscited by 118
  12. 2024An Adversarial Perspective on Machine Unlearning for AI Safetycited by 113
38 more
  1. 2024Large Language Model Unlearning via Embedding-Corrupted Promptscited by 112
  2. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  3. 2024SOUL: Unlocking the Power of Second-Order Optimization for LLM Unlearningcited by 104
  4. 2024Rethinking LLM Memorization through the Lens of Adversarial Compressioncited by 91
  5. 2024Guardrail Baselines for Unlearning in LLMscited by 90
  6. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 88
  7. 2024Reversing the Forget-Retain Objectives: An Efficient LLM Unlearning Framework from Logit Differencecited by 85
  8. 2024Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearningcited by 81
  9. 2025OpenUnlearning: Accelerating LLM Unlearning via Unified Benchmarking of Methods and Metricscited by 80
  10. 2024RWKU: Benchmarking Real-World Knowledge Unlearning for Large Language Modelscited by 77
  11. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 76
  12. 2024Catastrophic Failure of LLM Unlearning via Quantizationcited by 76
  13. 2024LLM Unlearning via Loss Adjustment with Only Forget Datacited by 71
  14. 2024Do Unlearning Methods Remove Information from Language Model Weights?cited by 66
  15. 2024Position: LLM Unlearning Benchmarks are Weak Measures of Progresscited by 58
  16. 2024Applying sparse autoencoders to unlearn knowledge in language modelscited by 58
  17. 2024A Closer Look at Machine Unlearning for Large Language Modelscited by 54
  18. 2024On Large Language Model Continual Unlearningcited by 51
  19. 2024Be like a Goldfish, Don't Memorize! Mitigating Memorization in Generative LLMscited by 50
  20. 2024UNDIAL: Self-Distillation with Adjusted Logits for Robust Unlearning in Large Language Modelscited by 49
  21. 2024Machine Unlearning in Generative AI: A Surveycited by 49
  22. 2025LLM-based Agents Suffer from Hallucinations: A Survey of Taxonomy, Methods, and Directionscited by 49
  23. 2024Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledgecited by 48
  24. 2024Challenging Forgets: Unveiling the Worst-Case Forget Sets in Machine Unlearningcited by 44
  25. 2024Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Modelscited by 44
  26. 2025Measuring Chain of Thought Faithfulness by Unlearning Reasoning Stepscited by 43
  27. 2024Soft Prompting for Unlearning in Large Language Modelscited by 42
  28. 2024Evaluating Copyright Takedown Methods for Language Modelscited by 42
  29. 2025Unlearning Isn't Deletion: Investigating Reversibility of Machine Unlearning in LLMscited by 41
  30. 2025Exploring Criteria of Loss Reweighting to Enhance LLM Unlearningcited by 39
  31. 2024Digital Forgetting in Large Language Models: A Survey of Unlearning Methodscited by 38
  32. 2023Knowledge Unlearning for LLMs: Tasks, Methods, and Challengescited by 37
  33. 2024CLEAR: Character Unlearning in Textual and Visual Modalitiescited by 36
  34. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
  35. 2024CopyBench: Measuring Literal and Non-Literal Reproduction of Copyright-Protected Text in Language Model Generationcited by 35
  36. 2024Mechanistic Unlearning: Robust Knowledge Unlearning and Editing via Mechanistic Localizationcited by 34
  37. 2024Fast Exact Unlearning for In-Context Learning Data for LLMscited by 33
  38. 2024Alpaca against Vicuna: Using LLMs to Uncover Memorization of LLMscited by 33

50 most cited of 366 All 366 (JSON)