首个可精确定位模型参数的去记忆测试平台,验证去记忆是否真正清除数据。
LACUNA: A Testbed for Evaluating Localization Precision for LLM Unlearning

- 通过掩码持续预训练将敏感信息注入特定参数,实现参数级知识定位。
- 现有方法虽输出表现好,但参数定位不准,易被重曝光攻击恢复数据。
- 精准定位后,简单梯度方法即可实现强去记忆效果和抗攻击能力。
大型语言模型会记忆训练数据中的敏感信息(如个人身份信息),亟需可靠的后期移除方法。去记忆成为有前景的解决方案,当前最先进方法多采用‘先定位、再去记忆’的范式,针对特定模型参数。然而,现有基准仅在输出层面评估去记忆效果,无法判断知识是否真正从模型参数中删除,还是仅被隐藏——这一疑虑因重曝光攻击的成功而加剧。为此,我们提出LACUNA:首个具备真实参数级定位能力的去记忆测试平台。LACUNA通过掩码持续预训练,将合成个体的个人身份信息注入1B与7B OLMo基模型的指定参数中,从而直接检验去记忆是否作用于知识存储的真正位置。我们利用LACUNA对当前最先进去记忆方法进行评估,发现尽管输出层面表现良好,现有方法仍严重缺乏精度,且极易遭受重曝光攻击。进一步表明,当定位准确时,即使简单的基于梯度的去记忆方法也能实现强大擦除效果并抵抗重曝光攻击,凸显精准定位的重要性。我们已发布LACUNA,以补充行为评估,推动鲁棒、基于定位的去记忆技术发展。
原文摘要 · Abstract (English)
LLMs memorize sensitive training data, including personally identifiable information (PII), creating a pressing need for reliable post hoc removal methods. Unlearning has emerged as a promising solution, with state-of-the-art(SOTA) methods often following a localize-first, unlearn-second paradigm that targets specific model parameters. However, existing benchmarks evaluate unlearning solely at the output level, leaving open the question of whether unlearning truly erases knowledge from a model's parameters or merely obfuscates it, a concern reinforced by the success of resurfacing attacks. To bridge this gap, we introduce LACUNA: the first unlearning testbed with ground-truth parameter-level localization. LACUNA injects PII of synthetic individuals into predefined parameters of 1B and 7B OLMo-based models via masked continual pretraining, enabling direct evaluation of whether unlearning targets the weights responsible for knowledge storage. We use LACUNA to benchmark current SOTA unlearning methods and find that, despite strong output-level performance, existing methods are highly imprecise and susceptible to resurfacing attacks. We further show that when localization is successful, even a simple gradient-based unlearning method achieves strong erasure and robustness to resurfacing attacks, highlighting the importance of precise unlearning. We release LACUNA to complement behavioral evaluations and drive further advances in robust, localization-based unlearning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。