提出CIR方法，精准删有害知识不伤模型整体能力
Collapse of Irrelevant Representations (CIR) Ensures Robust and Non-Disruptive LLM Unlearning
- 通过降维识别通用表征子空间并将其压缩
- 删毒知识后攻击准确率下降30倍以上，性能损失降低30倍
- 每条知识仅需不到3秒GPU时间，适合大规模应用
现有语言模型去学习和安全训练方法无法有效消除危险知识。我们发现根本原因在于目标表征过于通用，并提出一种高度选择性的方法——通过在激活值和模块输出梯度上做PCA，识别包含共性表征的子空间，然后在计算去学习更新前压缩这些子空间，称为无关表征坍缩（CIR）。该方法避免影响通用知识，仅针对待删除事实的特定表征。在对Llama-3.1-8B模型进行生物与网络危害知识去学习时，相比最佳基线（Circuit Breakers），CIR使攻击后准确率下降超30倍，同时性能损失减少30倍，且每条知识仅需不到3 GPU秒。因此，通过在表征层面解耦有害与良性能力，CIR实现了鲁棒且无破坏性的去学习。
原文摘要 · Abstract (English)
Current unlearning and safety training methods consistently fail to remove dangerous knowledge from language models. We identify the root cause - unlearning targets representations which are too general - and develop a highly selective technique that unlearns robustly while preserving general performance. Our method performs PCA on activations and module-output gradients to identify subspaces containing common representations, then collapses these subspaces before computing unlearning updates, a technique we term Collapse of Irrelevant Representations (CIR). This avoids unlearning general knowledge and targets only representations specific to the facts being unlearned. When unlearning bio- and cyber-hazardous facts from Llama-3.1-8B, we achieve over 30x greater reduction in post-attack accuracy than the best baseline (Circuit Breakers), while disrupting general performance 30x less, and using less than 3 GPU-seconds per fact. Thus, by disentangling harmful and benign capabilities at the level of representations, CIR enables robust and non-disruptive unlearning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。