测试发现现有方法删不掉敏感信息，反向解码就能复现。
On the Recoverability of Private Information Unlearning in Large Language Models
- 用虚构隐私数据建库，设计白盒审计框架
- 逆向贪婪解码可恢复声称已删除的信息
- 提醒部署大模型时需更可靠的遗忘机制
大型语言模型可能记忆敏感信息，引发严重隐私担忧。机器遗忘可提供解决方案，但尚不清楚现有方法是真正删除信息，还是仅将其隐藏。关键挑战在于缺乏统一的评估框架来量化敏感数据的残留程度。为此，我们构建了一个包含虚构私人信息的合成数据集，并提出一种白盒审计框架，系统评估所谓已遗忘信息是否真正被清除。利用该框架，我们评估了五种现有遗忘方法，发现一种简单的“逆向贪婪”解码（每步选择最不可能的词元）即可恢复声称已遗忘的私密信息。结果表明，当前遗忘方法通常无法彻底消除敏感信息，凸显了在部署大模型时需要更可靠的方法以保障隐私。
原文摘要 · Abstract (English)
Large language models (LLMs) can memorize sensitive information, raising serious privacy concerns. Machine unlearning offers a potential solution to remove such information, but it remains unclear whether existing methods truly erase it or merely hide it within the model. A key challenge is quantifying the persistence of sensitive data under a unified evaluation framework. To address this, we construct a synthetic dataset containing fake private information and propose a white-box auditing framework to systematically assess whether claimed-forgotten information is genuinely removed. Using this framework, we evaluate five existing unlearning methods and find that a simple "inverse greedy" decoding -- selecting the least likely token at each step -- can recover supposedly forgotten private information. Our results reveal that current unlearning approaches often fail to fully eliminate sensitive information, highlighting the need for more reliable methods to ensure privacy in deployed LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。