RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
Targeted interventions on language models, such as unlearning or model editing, aim to modify specific information, but their effects often propagate to related, unintended areas (e.g., removing virology content may degrade performance on allergies); these side-effects are commonly referred to as the ripple effect. We introduce RippleBench-Maker, an automatic pipeline that retrieves semantic neighbors of any source concept from a knowledge repository and generates multiple-choice questions at varying semantic distances. We instantiate this framework using WikiRAG, an open-source RAG system over English Wikipedia, to construct RippleBench-WMDP-Bio (584 seed topics, 352,961 questions), and evaluate eight unlearning methods on Llama3-8B-Instruct. All eight exhibit accuracy drops that are largest near the unlearned target and decay with semantic distance, each with a distinct propagation profile. We replicate these findings across Mistral-7B, Zephyr-7B, and Yi-34B; cross-model delta curves are nearly identical, suggesting ripple effects are a property of the unlearning method rather than the base model. We validate all major pipeline stages using a four-experiment Mechanical Turk study (5,200+ responses, 61 workers). We release all code, data, and infrastructure.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 29 of its 36 references that are in the map. First posted on arXiv 3 Dec 2025.
Builds on
29 of 36 references.
Closest ancestors · 13
Same direction, newest first
- 2025OpenUnlearning: Accelerating LLM Unlearning via Unified Benchmarking of Methods and Metrics14 Jun
- 2025Model Unlearning via Sparse Autoencoder Subspace Guided Projections30 May
- 2025Redirection for Erasing Memory (REM): Towards a universal unlearning method for corrupted data23 May
- 2025SAEs Can Improve Unlearning: Dynamic Sparse Autoencoder Guardrails for Precision Unlearning in LLMs11 Apr
- 2025Open Problems in Machine Unlearning for AI Safety9 Jan
- 2024Mechanistic Unlearning: Robust Knowledge Unlearning and Editing via Mechanistic Localization16 Oct
- 2024Erasing Conceptual Knowledge from Language Models3 Oct
- 2024Are we making progress in unlearning? Findings from the first NeurIPS unlearning competition13 Jun
- 2024Eight Methods to Evaluate Robust Unlearning in LLMs26 Feb
- 2024Rethinking Machine Unlearning for Large Language Models13 Feb
- 2024TOFU: A Task of Fictitious Unlearning for LLMs11 Jan
- 2023Who's Harry Potter? Approximate Unlearning in LLMs3 Oct
1 more
Other references · 16
- 2020Measuring Massive Multitask Language Understandingcited by 7,963
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
- 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
- 2023Evaluating the Ripple Effects of Knowledge Editing in Language Modelscited by 242
- 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
- 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 138
- 2022TemporalWiki: A Lifelong Benchmark for Training and Evaluating Ever-Evolving Language Modelscited by 119
- 2024Representation Noising: A Defence Mechanism Against Harmful Finetuningcited by 96
- 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 88
- 2024Robust LLM safeguarding via refusal feature adversarial trainingcited by 64
- 2023Eliciting Latent Knowledge from Quirky Language Modelscited by 62
4 more
- 2025Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilitiescited by 39
- 2024Adversarial Tuning: Defending Against Jailbreak Attacks for LLMscited by 26
- 2025WikiBigEdit: Understanding the Limits of Lifelong Knowledge Editing in LLMscited by 26
- 2024WikiFactDiff: A Large, Realistic, and Temporally Adaptable Dataset for Atomic Factual Knowledge Update in Causal Language Modelscited by 9
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2024RIPPLECOT: Amplifying Ripple Effect of Knowledge Editing in Language Models via Chain-of-Thought In-Context Learning
- 2024RAFT: Adapting Language Model to Domain Specific RAG
- 2026MKG-RAG-Bench: Benchmarking Retrieval in Multimodal Knowledge Graph-Augmented Generation
- 2026OenoBench: A Wine-Domain Benchmark for Knowledge-Grounded Evaluation of Large Language Models
- 2025Systematic Knowledge Injection into Large Language Models via Diverse Augmentation for Domain-Specific RAG
- 2024Enhancing Large Language Models with Domain-specific Retrieval Augment Generation: A Case Study on Long-form Consumer Health Question Answering in Ophthalmology
- 2024DomainRAG: A Chinese Benchmark for Evaluating Domain-specific Retrieval-Augmented Generation
- 2024SimRAG: Self-Improving Retrieval-Augmented Generation for Adapting Large Language Models to Specialized Domains