Duet Achieves Efficient LLM Unlearning, Avoiding Catastrophic Forgetting and Reverse Attacks

Researchers are tackling the critical challenge of removing unwanted information from large language models (LLMs) without the costly process of full retraining. Yisheng Zhong, Zhengbang Yang, and Zhuangdi Zhu, all from George Mason University, present a new approach called Distilled Unlearning from an Efficient Teacher (DUET) that addresses limitations in current unlearning techniques. Existing methods either demand substantial computational resources or prove susceptible to manipulation, but DUET innovatively combines the strengths of both approaches through distillation. Their work demonstrates significantly improved performance in both effectively ‘forgetting’ undesirable knowledge and maintaining the model’s overall usefulness, all while requiring far less data than current state-of-the-art methods, representing a substantial step towards building more trustworthy artificial intelligence systems.

This breakthrough addresses a critical challenge in Trustworthy AI, namely the potential for LLMs to inadvertently reveal private or harmful information. Existing unlearning methods present limitations; conventional tuning-based approaches are computationally expensive and risk damaging the model’s overall capabilities, while in-contextualized unlearning, though lightweight, is susceptible to attacks that can reverse the unlearning process. The research team tackled these issues by creating a distillation-based unlearning method that combines the strengths of both approaches.

DUET learns a student model to mimic a carefully-guided teacher model, effectively refusing to generate undesirable knowledge while retaining its broader understanding. This “steered” teacher is prompted with specific instructions designed to suppress unwanted information, and the student model learns to replicate this behaviour through a process of knowledge distillation. Extensive evaluations on established benchmarks, utilising enriched evaluation protocols, demonstrate that DUET surpasses existing methods in both its ability to forget undesirable information and its preservation of useful knowledge. Experiments show that DUET achieves significantly higher performance in both forgetting effectiveness and utility preservation, while requiring orders of magnitude less data than current state-of-the-art unlearning methods.

The team discovered that the quality and format of training data significantly impacts unlearning efficacy, leading them to design a data-efficient scheme that achieves strong results with fewer training samples. This innovation is particularly important given the substantial computational resources often required for LLM training and fine-tuning. Furthermore, the study introduces a fine-grained evaluation protocol with enriched samples and comprehensive assessments, revealing that previous methods often lack robustness across different task scenarios. Unlike in-context unlearning, which relies on prompts that can be easily manipulated, DUET embeds the unlearning pattern directly into the model’s parameters, making it more resistant to reverse engineering attacks. The research addresses limitations in existing unlearning techniques, specifically the computational cost and catastrophic forgetting associated with tuning-based methods, and the vulnerability to reverse attacks inherent in in-contextualized unlearning. DUET employs a distillation-based approach, training a student model to replicate the behaviour of a prompt-steered teacher model. Researchers engineered a system where the teacher model effectively refuses to generate undesirable knowledge while retaining general domain expertise.

This was achieved through carefully designed prompt instructions for in-context unlearning, which were then used to fine-tune the student model. The study pioneered a method of mimicking the dominant logit shifts induced by these unlearning prompts, providing refined supervision signals to the student model. Experiments employed existing benchmarks enriched with new evaluation protocols to rigorously assess performance. The team harnessed deep knowledge distillation to transfer the teacher’s behaviour to the student, enabling precise unlearning while minimising impacts on general utility. This distillation process focused on replicating the logit shifts, the changes in the model’s predicted probabilities, caused by the unlearning prompts.

The approach achieves a balance between knowledge removal and retention, surpassing existing methods in both forgetting effectiveness and utility preservation. Evaluations demonstrated that DUET is orders of magnitude more data-efficient than state-of-the-art unlearning methods, requiring significantly less training data to achieve comparable results. Furthermore, the work highlights increased robustness against reverse engineering attacks, a common vulnerability of in-contextualized unlearning. By transferring the effects of in-context unlearning through parameter optimization, DUET mitigates the superficiality that allows attackers to elicit suppressed knowledge. This research addresses limitations in existing unlearning techniques, which are often computationally expensive or vulnerable to attacks. DUET combines the strengths of tuning-based and in-contextualized unlearning by learning a student model to mimic a ‘steered’ teacher, effectively suppressing unwanted knowledge while maintaining general capabilities. Extensive evaluations on established benchmarks, utilising enriched evaluation protocols, demonstrate that DUET achieves superior performance in both forgetting and utility preservation, while requiring significantly less data than current state-of-the-art methods.

Experiments on the Harry Potter benchmark with the Llama 3.2-3B-Instruct LLM revealed that DUET delivers a more balanced unlearning performance than competing methods. The team measured performance shift, calculated as ∆↑=−P i ∆(forget)i + ∆j (utility)j, to capture the trade-off between forgetting and retaining useful information; higher values indicate better overall performance. DUET achieved a performance shift of 55.90, surpassing other methods and demonstrating successful unlearning with minimal degradation of utility. Specifically, DUET recorded R-Forget scores of 4.27 and R-Forget-500 scores of 5.98, alongside an R-Retain score of 78.33 and a MMLU score of 61.45.

Further tests on the WMDP-Bio and Cyber benchmarks confirmed DUET’s effectiveness in removing hazardous knowledge while preserving general knowledge utility. On the Bio benchmark, DUET achieved an Acc-Forget score of 29.40 and a MMLU score of 60.63. Similarly, on the Cyber benchmark, the team measured an Acc-Forget score of 26.60 and a MMLU score of 60.65. These results demonstrate that DUET consistently outperforms baseline methods in balancing unlearning and retention across diverse subtasks. The work highlights that DUET requires only input queries for unlearning, eliminating the need for ground-truth answers or explicit refusal responses, and achieving significant data efficiency. This technique addresses limitations found in existing unlearning approaches, specifically the computational cost of tuning-based methods and the vulnerability of in-contextualized unlearning to attacks. DUET employs distillation, transferring refusal behaviour from a teacher model to a student model via Top-K logit alignment, achieving precise knowledge removal using only query-level data. Extensive evaluations on established benchmarks, utilising enriched protocols, demonstrate that DUET surpasses state-of-the-art unlearning methods in both forgetting undesirable information and preserving useful knowledge.

The research indicates a balanced trade-off between these two crucial aspects, alongside robustness against reverse-prompt attacks and changes in evaluation formats. Authors acknowledge that determining the precise boundary of what knowledge to remove versus retain remains a challenge, particularly when data ambiguity exists. Future work will focus on refining these boundaries through prompt-based steering and enhancing evaluation protocols to better assess genuine unlearning, moving beyond surface-level response analysis and evasion techniques.