mlsanityData to 14 Oct 2026

Does Unlearning Truly Unlearn? A Black Box Evaluation of LLM Unlearning Methods

arXiv 2411.12103 ↗First posted 18 Nov 2024cs.CL cs.LGcited by 26

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

Large language model unlearning aims to remove harmful information that LLMs have learnt to prevent their use for malicious purposes. LLMU and RMU have been proposed as two methods for LLM unlearning, achieving impressive results on unlearning benchmarks. We study in detail the impact of unlearning on LLM performance metrics using the WMDP dataset as well as a new biology dataset we create. We show that unlearning has a notable impact on general model capabilities, with the performance degradation being more significant in general for LLMU. We further test the robustness of the two methods and find that doing 5-shot prompting or rephrasing the question in simple ways can lead to an over ten-fold increase in accuracy on unlearning benchmarks. Finally, we show that training on unrelated data can almost completely recover pre-unlearning performance, demonstrating that these methods fail at truly unlearning. Our methodology serves as an evaluation framework for LLM unlearning methods. The code is available at: https://github.com/JaiDoshi/Knowledge-Erasure.

Key facts. Cited by 26 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 9 of its 14 references that are in the map. First posted on arXiv 18 Nov 2024.

Builds on

9 of 14 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024An Adversarial Perspective on Machine Unlearning for AI Safety26 Sep
  2. 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr

Other references · 7

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  4. 2021Ethical and social risks of harm from Language Modelscited by 966
  5. 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
  6. 2023Zephyr: Direct Distillation of LM Alignmentcited by 506
  7. 2024Preference Tuning For Toxicity Mitigation Generalizes Across Languagescited by 31

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 18; 2026: 8.

26 papers.

Sort:

By area:

  1. 2025OpenUnlearning: Accelerating LLM Unlearning via Unified Benchmarking of Methods and Metricscited by 83
  2. 2025SafeEraser: Enhancing Safety in Multimodal Large Language Models through Multimodal Machine Unlearningcited by 32
  3. 2025GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detectioncited by 17
  4. 2025A General Framework to Enhance Fine-tuning-based LLM Unlearningcited by 14
  5. 2025Precise In-Parameter Concept Erasure in Large Language Modelscited by 11
  6. 2025Improving LLM Unlearning Robustness via Random Perturbationscited by 9
  7. 2025Keeping an Eye on LLM Unlearning: The Hidden Risk and Remedycited by 9
  8. 2025Does Machine Unlearning Truly Remove Knowledge?cited by 7
  9. 2025SEPS: A Separability Measure for Robust Unlearning in LLMscited by 5
  10. 2025Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methodscited by 5
  11. 2025DUSK: Do Not Unlearn Shared Knowledgecited by 4
  12. 2025An Example Safety Case for Safeguards Against Misusecited by 4
14 more
  1. 2025SUA: Stealthy Multimodal Large Language Model Unlearning Attackcited by 4
  2. 2025A Survey on Unlearning in Large Language Modelscited by 4
  3. 2025Towards Benchmarking Privacy Vulnerabilities in Selective Forgetting with Large Language Modelscited by 4
  4. 2025Module-Aware Parameter-Efficient Machine Unlearning on Transformerscited by 3
  5. 2025Soft Token Attacks Cannot Reliably Audit Unlearning in Large Language Modelscited by 2
  6. 2025Leveraging Machine Unlearning for Cost-Efficient Preference Alignmentcited by 2
  7. 2026Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilitiescited by 1
  8. 2026A Comprehensive Evaluation of LLM Unlearning Robustness under Multi-Turn Interactioncited by 1
  9. 2026Suppression Is Not Forgetting: Residual Recoverability in Visual Concept Unlearning for VLMscited by 1
  10. 2026From Anchors to Supervision: Memory-Graph Guided Corpus-Free Unlearning for Large Language Modelscited by 1
  11. 2026Unlearners Can Lie: Evaluating and Improving Honesty in LLM Unlearningcited by 1
  12. 2026Unlearning as Distribution Restoration: A Controlled Counterfactual Study, a Validated Selective Screen, and the Limits of Oracle-Free Certificationcited by 1
  13. 2026Stochastic Meta-Unlearning: Bridging Language Backbone and Multimodal Unlearningcited by 0
  14. 2026How Context Attribution Handles What the Model Already Knowscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Towards Effective Evaluations and Comparisons for LLM Unlearning Methods
  2. 2025LLM Unlearning Under the Microscope: A Full-Stack View on Methods and Metrics
  3. 2025LLM Unlearning Reveals a Stronger-Than-Expected Coreset Effect in Current Benchmarks
  4. 2024Position: LLM Unlearning Benchmarks are Weak Measures of Progress
  5. 2026Unlearning in LLMs: Methods, Evaluation, and Open Challenges
  6. 2025A Comprehensive Survey of Machine Unlearning Techniques for Large Language Models
  7. 2024Catastrophic Failure of LLM Unlearning via Quantization
  8. 2025LLM Unlearning Should Be Form-Independent