Eight Methods to Evaluate Robust Unlearning in LLMs

Machine unlearning can be useful for removing harmful capabilities and memorized text from large language models (LLMs), but there are not yet standardized methods for rigorously evaluating it. Second, we apply a comprehensive set of tests for the robustness and competitiveness of unlearning in the "Who's Harry Potter" (WHP) model from Eldan and Russinovich (2023). While WHP's unlearning generalizes well when evaluated with the "Familiarity" metric from Eldan and Russinovich, we find i) higher-than-baseline amounts of knowledge can reliably be extracted, ii) WHP performs on par with the original model on Harry Potter Q&A tasks, iii) it represents latent knowledge comparably to the original model, and iv) there is collateral unlearning in related domains. Overall, our results highlight the importance of comprehensive unlearning evaluation that avoids ad-hoc metrics. It is difficult to ensure that large language models (LLMs) will always behave harmlessly. Meanwhile, LLMs also memorize pretraining data, raising concerns involving privacy and fair use (Carlini et al., 2022; Shi et al., 2023; Karamolegkou et al., 2023). To reduce these risks, machine unlearning has emerged as a way to remove undesirable knowledge from LLMs (Bourtoule et al., 2021; Nguyen et al., 2022; Si et al., 2023; Shaik et al., 2023; Liu et al., 2024a). Ideally, LLM unlearning should produce a model that is competitive on most tasks but which robustly loses knowledge on the unlearning task in a way that is resistant to extraction by an adversary. Prior works have introduced various ad hoc techniques (see Table 1 and Section 2). However, to date, little has been done to comprehensively evaluate LLM unlearning (Liu et al., 2024a).