Popular facts are memorised more deeply during pretraining and resist removal longer than rare ones, yet existing LLM unlearning methods apply uniform gradient pressure regardless of training-data frequency. We propose the AdaPop (Adaptive Popularity) method, which combines local token confidence with a per-fact popularity-dependent exponent derived from an external proxy (e.g., Wikidata sitelinks, LLM-as-Judge), and automates the forget-retain balance via a dual-ascent controller that adjusts the retain penalty each epoch. Across three model families and two benchmarks, AdaPop leaks ~5x less forgotten content than competing methods under paraphrased queries and ~1.6x less under adversarial reformulations. We support our analysis with internal metrics: under our method, forget-set hidden states move further from the pre-unlearning model's states than under other methods, while retain-set representations remain close.
Figures & tables
Figure 1: Overview of AdaPop. The popularity score reweights per-fact token contributions to the forget loss; the dual-ascent controller adjusts the retain penalty each epoch to maintain retain quality (Algorithm 1 ).
Figure 2: Wikidata popularity-score distributions for the forget sets of DUET and RWKU. DUET spans nearly two orders of magnitude ( 69 – 3,763 ; median 1,090 ), providing a direct test of popularity-sensitive methods; RWKU is narrower and skewed lower (median 130 ).
Bench.
Algorithm
Rouge
Cos Sim
F. ↓
R. ↑
F. ↓
R. ↑
w/o MU
0.939
0.968
0.874
0.883
AdaPop
0.043 ± .007
0.959 ± .009
0.369
0.971
GA †
0.000 ± .000
0.000 ± .000
0.093
0.093
GD †
0.021 ± .003
0.853 ± .011
0.120
0.897
NPO
0.670 ± .095
0.996 ± .005
0.684
0.998
Table 1: ROUGE-L Recall and Cosine Similarity for Llama-3.1-8B-Instruct at lr=10−4 . ROUGE-L: mean ± std over three seeds; Cosine Similarity: single seed. F. ↓ = forget; R. ↑ = retain. w/o MU = the original checkpoint, evaluated with no unlearning applied. Underline = best among NPO, WGA, AdaPop. † Unusable: generation failure (GA: joint output and retain collapse; GD: severe retain degradation with collapse-style generation artefacts; see Appendix G ).
Bench.
Algorithm
Rouge
Cos Sim
F. ↓
R. ↑
F. ↓
R. ↑
w/o MU
0.921
0.886
0.864
0.861
AdaPop
0.056 ± .007
0.950 ± .008
0.456
0.964
GA †
0.000 ± .000
0.000 ± .000
0.058
0.092
GD †
0.022 ± .004
0.757 ± .015
0.094
0.841
NPO
0.684 ± .023
0.973 ± .002
0.576
0.979
Table 2: ROUGE-L Recall and Cosine Similarity for Qwen2.5-7B-Instruct at lr=10−4 . Notation as in Table 1 .
Bench.
Algorithm
Rouge
Cos Sim
F. ↓
R. ↑
F. ↓
R. ↑
w/o MU
0.892
0.926
0.586
0.541
AdaPop
0.023 ± .004
0.976 ± .011
0.206
0.976
GA †
0.000 ± .000
0.000 ± .000
0.096
0.102
GD †
0.044 ± .007
0.598 ± .024
0.069
0.626
NPO
0.626 ± .071
0.968 ± .007
0.394
0.956
Table 3: ROUGE-L Recall and Cosine Similarity for Gemma-7B-it at lr=10−4 . Notation as in Table 1 .
Algo
Llama
Qwen
Gemma
DUET paraphrase forget ROUGE-L ↓
AdaPop
0.045
0.074
0.027
GA †
0.000
0.000
0.000
GD †
0.015
0.045
0.117
NPO
0.696
0.605
0.568
WGA
0.042
0.104
0.050
Table 4: Robustness at lr=10−4 . Top : paraphrase ROUGE-L on the DUET forget split (lower is better). Bottom : RWKU Level-3 adversarial-attack ROUGE-L; lower indicates stronger resistance to knowledge recovery. Underline = best among NPO, WGA, AdaPop. GA and GD collapse and are excluded from forget-quality ranking.
Algo
Llama
Qwen
Gemma
Pop.
Rare
Pop.
Rare
Pop.
Rare
AdaPop
0.040
0.049
0.055
0.092
0.028
0.026
GD †
0.027
0.003
0.086
0.003
0.232
0.002
NPO
0.854
0.538
0.778
0.432
0.796
0.339
WGA
0.067
0.017
0.194
0.014
0.096
0.003
Table 5: DUET paraphrase forget ROUGE-L ( ↓ ) split by popularity tier at lr=10−4 . Underline = best among NPO, WGA, AdaPop. GA is omitted (all values 0.000 under collapse); † GD’s low rare-tier values coincide with retain collapse (Table 1 ).
Table 6: Internal metrics at lr=10−4 , averaged across Llama, Qwen, and Gemma. Directional arrows are shown in each section header. Underline = best among NPO, WGA, AdaPop. GA and GD values are reported for reference but indicate model collapse and are not ranked. Per-model breakdown in Appendix K .
Algo
Llama
Qwen
Gemma
MMLU
HS
MMLU
HS
MMLU
HS
w/o MU
0.65
0.73
0.71
0.68
0.47
0.64
AdaPop
0.65
0.76
0.71
0.68
0.52
0.62
GA
0.23
0.33
0.23
0.43
0.25
0.26
GD
0.64
0.59
0.71
0.65
0.47
0.37
NPO
0.65
0.72
0.70
0.68
0.51
0.63
Table 7: MMLU accuracy and HellaSwag (HS) normalised accuracy at lr=10−4 . w/o MU = the original checkpoint, with no unlearning applied. Values averaged across DUET and RWKU checkpoints.
Figure 3: AdaPop on DUET (Llama) under three popularity signals: Wikidata score, LLM-as-Judge (3-seed mean), and measured corpus frequency (infini-gram over Pile-train). Left: forget ROUGE-L ( ↓ ). Right: holdout ROUGE-L ( ↑ ). Each point averages a rare-tier and a popular-tier run at that learning rate. All signals use the anchors of Appendix B , (a,b)=(58.7,0.796) . Rates above 5×10−4 are omitted: at 10−3 every signal has at least one collapsed tier.
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Config
a
b
F. ↓
R. ↑
Δ F.
Δ R.
baseline
58.70
0.7960
0.045
0.961
0
0
+a,+b
70.44
0.9552
0.038
0.975
− 0.007
+ 0.014
+a,−b
70.44
0.6368
0.044
0.994
− 0.001
+ 0.033
−a,+b
46.96
0.9552
0.024
0.920
− 0.021
− 0.041
−a,−b
46.96
0.6368
0.034
0.991
− 0.011
+ 0.030
Appendix
Table 8: AdaPop coefficient sensitivity. Each row perturbs a and/or b by ± 20% from the analytically derived baseline. F. ↓ = forget ROUGE-L; R. ↑ = retain ROUGE-L. Δ values are signed differences from the baseline.
Question
Answer
Wikidata
LLM
ROUGE-L
Wikidata popular, LLM rare
What is the country of Ensenada?
Mexico
2113
30
1.0
What is the country of Tourcoing?
France
2112
40
1.0
What is the country of Qus?
Egypt
3763
50
1.0
Wikidata rare, LLM popular
What is the instance of Hua Hin?
seaside resort
148
9000
0.5
Appendix
Table 9: Discordant cases between Wikidata score and LLM-judge scores on DUET. ROUGE-L : Llama-3.1-8B-Instruct recall before unlearning. Top group: Wikidata-popular facts recalled at ROUGE-L 1.0 despite low LLM-judged salience, indicating deep memorisation. Bottom group: Wikidata-rare facts with higher LLM scores but variable recall, consistent with shallower encoding.
Proxy
Pearson
Spearman
Wikidata score
0.970
0.839
LLM judge
0.677
0.659
Appendix
Table 10: Agreement of each popularity proxy with measured corpus frequency on DUET, counted over Pile-train ( 383 B tokens) with infini-gram. Pearson is computed in log space. The two proxies agree with each other at Spearman 0.596 and assign the same rare/popular label to 84% of facts.
Score noise
F. rare ↓
F. pop. ↓
R. ↑
none
0.05
0.04
0.96
log-normal, σ=1.0
0.02
0.05
0.96
labels 50% swapped
0.02
0.05
0.97
labels 100% swapped
0.01
0.05
0.92
Appendix
Table 11: AdaPop under corrupted popularity scores (DUET, Llama-3.1-8B-Instruct, lr=10−4 ). Forget ROUGE-L is reported per popularity tier. Retain degrades by 0.04 even when every label is inverted.
Bench.
Algorithm
ROUGE-L
F. ↓
R. ↑
w/o MU
0.939
0.968
AdaPop
0.043
0.959
UNDIAL
0.884
0.998
RMU
0.882
0.998
PDU
0.476
0.954
Appendix
Table 12: ROUGE-L Recall for additional baselines, Llama-3.1-8B-Instruct at lr=10−4 . w/o MU = the original checkpoint, with no unlearning applied; AdaPop reproduced from Table 1 for reference. F. ↓ = forget; R. ↑ = retain. Underline = best among non-collapsed methods. † Model collapse.
Bench.
Algorithm
ROUGE-L
F. ↓
R. ↑
w/o MU
0.921
0.886
AdaPop
0.056
0.950
UNDIAL
0.797
0.930
RMU
0.734
0.983
PDU
0.632
0.869
Appendix
Table 13: ROUGE-L Recall for additional baselines, Qwen2.5-7B-Instruct at lr=10−4 . Notation as in Table 12 .
Bench.
Algorithm
ROUGE-L
F. ↓
R. ↑
w/o MU
0.892
0.926
AdaPop
0.023
0.976
UNDIAL
0.819
0.980
RMU
0.851
0.992
PDU
0.677
0.934
Appendix
Table 14: ROUGE-L Recall for additional baselines, Gemma-7B-it at lr=10−4 . Notation as in Table 12 .
Figure 4: Internal representation metrics at lr=10−4 , across three models. Each row corresponds to one metric; each column corresponds to one data split. For the forget split, deeper erasure corresponds to lower Δ LP, higher Δ Rank, lower Hid.Cos, and higher KL; directional desiderata are reversed for the retain split. Marker shape indicates benchmark (DUET vs. RWKU); colour indicates model family.
Figure 5: Component ablation on DUET. Top row : rare-fact paraphrase forget ROUGE-L ( ↓ ) and retain ROUGE-L ( ↑ ) over lr∈[2×10−5,8×10−4] . Bottom row : popular-fact paraphrase forget ROUGE-L ( ↓ ) and retain ROUGE-L ( ↑ ) over lr∈[2×10−4,8×10−3] .
Figure 6: ROUGE-L (solid) and Cosine Similarity (dashed) on the merged DUET forget (left) and retain (right) splits across learning rates, for Llama (top), Qwen (middle), and Gemma (bottom).
Figure 7: ROUGE-L (solid) and Cosine Similarity (dashed) on the RWKU forget (left) and retain (right) splits across learning rates, for Llama (top), Qwen (middle), and Gemma (bottom).
Figure 8: DUET forget and retain splits separated by popularity tier (Llama). Top row : rare facts. Bottom row : popular facts. The order-of-magnitude difference in the learning rate required to achieve comparable forgetting across the two tiers is direct evidence of the popularity gap.
Figure 9: Forget (left) and retain (right) ROUGE-L Recall per training epoch on DUET, Llama-3.1-8B-Instruct, at lr=10−4 .
Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.
Large Language Model (LLM) unlearning is often evaluated primarily by target suppression and clean retain utility. These metrics can miss a local failure mode: a model may perform well on standard retain prompts, yet degrade on benign reasoning when prompts lie near the forgotten domain. This phenomenon is termed forget-adjacent utility loss. A fundamental question is: where should forget representations go after they leave the removed behavior? Successful unlearning depends not only on whether forget-conditioned representations depart from the harmful computation, but also on the direction in which they are redirected afterward. We propose RA2 (Retain-Anchored Attraction), a latent-space unlearning method that redirects forget-token states toward nearby retain-supported representations while preserving higher-layer behavior on retain data. On WMDP and MUSE, RA2 yields higher forget-adjacent utility than strong unlearning baselines at similar broad-utility levels. These results show that the migration direction of forget representations materially affects benign behavior near the forget boundary. Our code is available at https://github.com/ZacLing/retain_anchored_attraction.
Zinan Ling, Yang Xiao, Ruimeng Ye +2
The University of Tulsa · Michigan State University
Machine Unlearning (MU) enables Large Language Models (LLMs) to remove unsafe or outdated information. However, existing work assumes that all facts are equally forgettable and largely ignores whether the forgotten knowledge originates from pretraining or supervised fine-tuning (SFT). In this paper, we introduce DUET (Dual Unlearning Evaluation across Training Stages), a benchmark of 28.6k Wikidata-derived triplets annotated with fact popularity using Wikipedia link counts and LLM-based salience scores. Our experiments show that pretrained and SFT models respond differently to unlearning. An SFT step on the forget data yields smoother forgetting, more stable tuning, and 10-50% higher retention, while direct unlearning on pretrained models remains unstable and prone to relearning or catastrophic forgetting.
Anna Borisiuk, Andrey Savchenko, Alexander Panchenko +1
Existing LLM unlearning methods struggle with robustness: unbounded forget losses degrade model coherence, fixed-weight balancing cannot adapt as retain difficulty shifts mid-training, and methods that work on one benchmark falter under scaling or repeated application. We propose BLADE, a constrained bilevel framework whose three mechanisms give smooth, predictable control over the optimization landscape: a clamped-entropy forget loss whose gradient is exactly zero once a token reaches sufficient uncertainty; an asymmetric augmented Lagrangian that permanently ratchets retain protection after any violation; and a bilevel structure confined to LoRA adapters that repairs retain damage before each forgetting step. BLADE dominates across three benchmark families, improving average composite scores over the strongest baselines by 6% on TOFU, 9% on MUSE Books, and 7% on KnowUndo, and it remains stable under 4× scaling and 4 sequential unlearning steps on MUSE News where the best competing method collapses entirely.
Md Toufikuzzaman, Ahmad Mousavi, Dongwon Lee
The Pennsylvania State University, USA · American University