通过精准编辑嵌入层,实现更彻底且抗恢复的知识擦除。
Don't Forget Your Embeddings: Robust Knowledge Erasure via Precise Editing of Embeddings

- 利用稀疏矩阵分解,精确移除与概念相关的嵌入特征。
- 在Llama模型上使知识恢复率降至35%,相比之前降低50%。
- 不影响整体文本连贯性,仅影响少量特定词汇。
随着语言模型在实际应用中的普及,擦除特定知识的能力对安全与合规至关重要。现有主流方法通过更新模型参数实现持久删除,但目标知识仍可能通过对抗性提示或重训练被恢复。本文提出假设:这一局限部分源于忽视了嵌入层的作用。为此,我们引入EMBedding ERasure(EMBER),一个即插即用的擦除模块,采用稀疏矩阵分解技术,精准地从词元嵌入中移除与概念相关的特征。在Gemma-2-2B-it和Llama-3.1-8B-Instruct上对多种概念进行综合评估发现,加入EMBER能显著提升擦除效果与特异性,且保持极低的连贯性损失。此外,其对重训练的鲁棒性大幅提升,使知识恢复准确率最高降低50%,在Llama上仅剩35%,远低于此前方法的70%-76%。进一步分析表明,连贯性代价仅局限于一小部分专属概念的词元。本工作证实,精确的嵌入级干预是实现稳健概念擦除的关键,并证明现有方法可通过此类增强获益。
原文摘要 · Abstract (English)
As language models are increasingly deployed in real-world applications, the ability to erase specific knowledge from them becomes critical for safety and compliance. Prominent methods seek persistent removal by updating the model's parameters, yet the target knowledge often can be recovered through adversarial prompting or relearning. In this work, we hypothesize this limitation stems in part from existing methods overlooking the embedding layer. To address this, we introduce EMBedding ERasure (EMBER), a plug-n-play erasure module that leverages Sparse Matrix Factorization for precise erasure of concept-related features from token embeddings. Through comprehensive evaluations across diverse concepts on Gemma-2-2B-it and Llama-3.1-8B-Instruct, we find that augmenting existing methods with EMBER consistently improves erasure efficacy and specificity across task formats, with minimal coherence loss. Moreover, it dramatically improves robustness to relearning, reducing regained accuracy by up to 50%, limiting it to 35% on Llama compared to 70%-76% for prior methods. Further analysis shows that the coherence cost is localized, affecting only a small set of concept-exclusive tokens. Our work establishes that precise embedding-level intervention is necessary for robust concept erasure, and demonstrates that existing methods can benefit from such augmentation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。