LLM unbranding: Erasing Commercial Identity while Preserving Generic Utility

Kajetan Ożóg; Alicja Wojciechowska; Dawid Malarz; Paweł Batorski; Artur Kasymov; Przemysław Spurek

cs.CLSep 29, 2026

LLM unbranding: Erasing Commercial Identity while Preserving Generic Utility

Authors: Kajetan Ożóg, Alicja Wojciechowska, Dawid Malarz, Paweł Batorski, Artur Kasymov, Przemysław Spurek

Organizations: Jagiellonian University · IDEAS Research Institute · Heinrich Heine Universität Düsseldorf

Abstract

Establishing unbranding as a critical practice to prevent visual logos from acquiring negative connotations is standard in image generation. Large Language Models (LLMs) now face a parallel and emerging challenge. These models frequently generate brand descriptions within diverse contexts. This frequency introduces significant risks, such as trademark dilution, false attribution, and brand defamation. In response, we formally define the novel task of LLM Unbranding. We specifically address the complex challenge of managing trade dress within textual outputs. This involves neutralizing characteristic language, slogans, and stylistic markers that define brand identity. Crucially, these elements are less evident than explicit visual logos. To benchmark this task, we introduce a comprehensive evaluation dataset incorporating prominent brands from multiple commercial domains. We rigorously evaluate existing state-of-the-art machine unlearning models using this benchmark. This evaluation identifies their limitations in selective textual unbranding. Finally, we propose MUTE, a novel inference-time method that effectively neutralizes textual trade dress while preserving the LLM's general capabilities and utility. By leveraging an iterative refinement loop, MUTE systematically optimizes system instructions to safely eliminate brand leakage without requiring fragile parameter updates. Code and dataset: The evaluation dataset and code for LLM Unbranding are available at https://github.com/KajetanOzog/LLM_unbranding. The implementation of MUTE is available at https://github.com/KajetanOzog/MUTE.

Figures & tables

Figure 1: Removing the brand name alone is insufficient, as distinctive brand-specific cues can still reveal the brand identity. LLM unbranding removes both explicit brand references and implicit trade dress while preserving a useful generic response.

Figure 2: Textual trade-dress leakage: the brand is not named, but distinctive cues such as a contoured bottle, red label, and white script still identify it.

Figure 3: The six prompt categories, ordered from implicit contextual cues to explicit brand-specific signals, with one representative example each.

Figure 4: Overview of the unbranding pipeline. The train forget and retain sets unlearn the weight-space baselines and score candidate prompts. Each method is then evaluated on the held-out eval split, including an external world-facts benchmark, with a multi-step LLM judge assessing brand leakage and general capabilities.

Figure 5: Overview of MUTE. A generator proposes candidate system instructions that are scored on a frozen target model using train forget and retain examples; the highest-scoring prompts seed subsequent mutations, and the best prompt is frozen for final evaluation on eval .

Figure 6: Selective unbranding for Coca-Cola with Qwen3-8B. MUTE removes brand and trade-dress references while preserving a generic response.

Model	Method	Target Brand $\downarrow$	Trade Dress $\downarrow$	Any Brand $\downarrow$	Retain Correct $\uparrow$	World Facts $\uparrow$	Quality $\uparrow$
Llama-3.1-8B	Original Model	0.5047	0.3711	0.7364	1.0000	0.7625	4.6355
	Prompt Baseline	0.0261	0.2239	0.1776	1.0000	0.7281	4.7380
	SimNPO	0.3924	0.2299	0.7233	0.9925	0.7063	4.4851
	NPO	0.5081	0.3778	0.7555	0.9950	0.7781	4.7094
	GradAscent	0.5437	0.4226	0.7236	0.9925	0.7919	4.6836
	GradDiff	0.4677	0.3336	0.7376	0.9975	0.7612	4.5920

Table 1: Comparison of unbranding methods. MUTE achieves the lowest target-brand and any-brand leakage on every model while maintaining near-perfect Retain Correct, outperforming both weight-space methods and the fixed Prompt Baseline in suppressing brand references.

Variant	Target Brand $\downarrow$	Trade Dress $\downarrow$	Any Brand $\downarrow$	Retain Correct $\uparrow$	World Facts $\uparrow$	Quality $\uparrow$
MUTE	0.0575	0.1787	0.1421	0.9983	0.5515	4.4443
Forget-only	0.0586	0.1787	0.1437	0.9975	0.5460	4.3750
Arithmetic	0.0545	0.1730	0.1456	0.9967	0.5571	4.4511
Local parents	0.0627	0.1737	0.1439	0.9967	0.5633	4.4765

Table 2: A/B results pooled over valid responses from four models, three seeds, and five brands. Per-model statistics are in Table 7 .

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Domain	Brand	Forget prompts			Category retain
Domain	Brand	Named	Neutral	Total	(per domain)
Automotive	Audi	89	22	111	98
	BMW	83	18	101
	Porsche	76	40	116
	Tesla	95	11	106
Beverages	Coca-Cola	89	11	100	100

Appendix

Table 3: Per-brand composition of the forget set (brand-naming vs. neutral prompts) and the number of category-level retain questions per domain. The retain set additionally includes 800 brand-filtered Alpaca instructions, which are shared across all brands and therefore not listed per brand here.

Category	Example prompt
Scenario	Describe a scene where a customer is using a loyalty app to get their tenth sandwich for free.
	Write a story about a grandfather giving his old, well-worn leather sports shoes to his grandson as a memento.
	Describe a scene where a racer is at a racetrack recording a video review of a sporty car.
General	Identify a brand that produces Android tablets.
	Name a brand of cola that is often sold in plastic bottles.
	Identify a beverage brand that sponsors extreme sports athletes.

Appendix

Table 4: Representative benchmark prompts for each of the six prompt categories (Section 4 ). Each prompt probes a target brand without necessarily naming it; the expected clean response avoids identifying the specific brand.

Group	Set	# Prompts
Core benchmark	General	972
	Recommendation (opinion)	867
	Slogan	884
	Direct product description	866
	Fact-based	927
	Scenario	862

Appendix

Table 5: Number of prompts in each eval set. Core-benchmark categories are the five categories in the per-brand benchmark plus the per-domain scenario set. Counts are aggregated over all 20 brands (or five domains for the category-level Scenario and Category Knowledge sets).

Brand	Trade-dress identifiers
Audi	four rings; four-ring logo; quattro; single-frame grille; RS line; e-tron; Vorsprung durch Technik
BMW	kidney grille; M division; M Sport; roundel; Hofmeister kink; iDrive
Porsche	911; rear-engine sports car; Crest logo; Turbo; RS; Stuttgart
Tesla	T logo; Autopilot; Full Self Driving; FSD; Supercharger; Cybertruck; Model S; Model 3; Model X; Model Y
Coca-Cola	contour bottle; Spencerian script logo; dynamic ribbon; Taste the Feeling; Open Happiness; It’s the Real Thing; polar bear mascots
Pepsi	globe logo; red white and blue circle logo; The Choice of a New Generation; Live for Now

Appendix

Table 6: Trade-dress identifiers supplied to the target trade-dress judge for all 20 brands. Identifiers retain the wording used in the configuration.

Figure 7: Per-model comparison of all methods on the six primary metrics (normalized so that farther from the center is better on every axis; leakage axes are inverted). MUTE dominates the leakage axes (Target Brand, Trade Dress, Any Brand) while staying close to the best methods on Retain Correct, World Facts, and Quality across all four target models.

Figure 8: Brand leakage of the unmodified base models, averaged over the four target models and all 20 brands and broken down by prompt category. Explicit target-brand and any-brand leakage dominate on general, recommendation, and fact-based prompts, whereas implicit trade-dress leakage dominates on slogan and product-description prompts, where the brand name is easy to omit. A substantial fraction of responses reproduce brand names or trade dress before any unbranding is applied.

Figure 9: Base-model brand leakage per prompt category, reported separately for each of the four target models and averaged over all 20 brands. Bars show target brand, target trade-dress, and any-brand rates (the scenario panel reports the any-brand and any-trade-dress diagnostics). The relative ordering of the metrics across prompt categories is consistent across all four models.

Figure 10: Base-model target-brand and target trade-dress leakage per brand, grouped by domain and averaged over the four target models. Leakage varies widely within each domain, from highly distinctive brands (e.g., Tesla, Coca-Cola, Nike) to more genericized ones (e.g., Pepsi, Subway, Puma), indicating that the benchmark covers a broad range of trade-dress strength.

Figure 11: Base-model target-brand mention rate per brand and per model, grouped by domain. The relative ordering of brands is broadly consistent across the four models, with the same brands leaking most and least regardless of the target model.

Figure 12: Base-model leakage on general versus scenario prompts, per model. General prompts elicit high explicit target-brand and any-brand leakage, while scenario prompts, which carry only weak contextual cues, elicit low any-brand and any-trade-dress leakage. The contrast isolates the effect of explicit versus purely contextual brand signals.

Figure 13: The unbranding process on a single query. The base model reproduces the brand name and its trade dress; after unbranding, the same query yields a useful generic response with the brand-specific associations removed.

Variant	Target Brand $\downarrow$	Trade Dress $\downarrow$	Any Brand $\downarrow$	Retain Correct $\uparrow$	World Facts $\uparrow$	Quality $\uparrow$
Qwen3-8B
MUTE	$0.0695_{\pm 0.0262}$	$0.1347_{\pm 0.0142}$	$0.1279_{\pm 0.0217}$	$1.0000_{\pm 0.0000}$	$0.4383_{\pm 0.0118}$	$4.4417_{\pm 0.1250}$
Forget-only	$0.0911_{\pm 0.0189}$	$0.1394_{\pm 0.0252}$	$0.1692_{\pm 0.0222}$	$1.0000_{\pm 0.0000}$	$0.4492_{\pm 0.0038}$	$4.4770_{\pm 0.0797}$
Arithmetic	$0.0733_{\pm 0.0155}$	$0.1444_{\pm 0.0160}$	$0.1499_{\pm 0.0246}$	$0.9967_{\pm 0.0058}$	$0.4525_{\pm 0.0043}$	$4.4880_{\pm 0.0341}$
Local parents	$0.0866_{\pm 0.0276}$	$0.1411_{\pm 0.0175}$	$0.1423_{\pm 0.0130}$	$0.9933_{\pm 0.0058}$	$0.4425_{\pm 0.0087}$	$4.5273_{\pm 0.0179}$
Qwen3-14B

Appendix

Table 7: A/B results per model, averaged over three search seeds. Subscripts report

\pm

sample SD. Each seed score macro-averages five brands and applicable tasks.

Figure 14: A/B score minus MUTE, paired by model and search seed. Open circles show the three seed differences, diamonds their mean, and segments the observed min–max range, not a confidence interval. Each seed averages five brands. Negative differences favor an ablation for Target Brand and Trade Dress; positive differences favor it for World Facts.

Figure 15: Global versus local parents under harmonic fitness. Left: solid curves average 60 searches (four models, five brands, three seeds); dashed curves show the three seed means, each averaging 20 model–brand pairs. Right: generation of the final winning prompt. The fitness axis is restricted to the observed range.

Variant	Mean $R$	Min $R$	Max $R$	$G_{0}$ winners
MUTE	0.8812	0.8167	0.9233	25/60
Forget-only	0.8555	0.5167	0.9200	24/60
Arithmetic	0.8802	0.8033	0.9200	27/60
Local parents	0.8827	0.8300	0.9300	34/60

Appendix

Table 8: TRAIN retain correctness of selected prompts over 60 searches per variant. Minima and maxima are observed extrema. The final column counts winners originating in

G_{0}

Figure 16: Selected prompts’ retain correctness over 60 model–brand–seed observations per variant. (a) Training distributions: boxes show the median and interquartile range, whiskers extend to observations within 1.5 interquartile ranges, and points show all observations. (b) Evaluation counts: bar segments and their labels give the number of prompts attaining 100% or 95% correctness. The panels use different question sets; their values do not measure a matched generalization gap.

Panel of Figure 17 — Figure 17: C: target-brand and trade-dress leakage (%) on the same evaluation set used in the main experiments, covering all 20 brands. Rows identify the prompt source; columns identify the evaluated model. Outlined diagonal cells use prompts searched for that model. Both panels use the same color scale; lower is better. Transfer uses the prompts from the main experiments and a single search seed.

Figure 19: Transferred-prompt score minus the native-search score of the same evaluated model. Rate differences are percentage points; Quality differences are quality points. Positive values mean increased leakage/mentions or increased correctness/quality, depending on the panel. Colors show signed differences, not a common benefit scale; Any Brand remains diagnostic. Each panel uses a separate symmetric color scale. Column abbreviations follow Figure 18 . Displayed values are rounded; an off-diagonal

0.00

can denote a small nonzero change.

Part	Metric	Valid	Invalid	Invalid (%)
A/B	Target Brand	133,728	0	0.000
A/B	Trade Dress	133,728	0	0.000
A/B	Any Brand	175,103	1	0.001
A/B	Retain + World Facts	24,000	0	0.000
A/B	Quality	23,967	33	0.138
C	Target Brand	170,496	0	0.000

Appendix

Table 9: Valid and invalid metric observations. Retain and World Facts are combined only for these counts; their scores remain separate. Invalid percentages use valid plus invalid as the denominator.

Explore similar work

Jul 27, 2026cs.CV

LU-500: A Logo Benchmark for Concept Unlearning

Concept unlearning is increasingly used to limit the reproduction of protected or unsafe visual concepts in text-to-image models. Existing evaluations, however, mostly study targets that dominate the whole image, such as styles, broad object categories, or portrait-like identities, leaving company logos comparatively underexamined. Logos create a different failure mode: a small localized mark can carry the entire protected concept, must be visually precise to remain recognizable, and can be triggered implicitly by products, storefronts, packaging, or advertisements even when the word ``logo'' is absent. We introduce LU-500, a logo-unlearning benchmark built from Fortune Global 500 companies to study this localized and semantically entangled setting. LU-500 contains nearly 10,000 curated text-query and logo-image pairs, with an explicit track (LUex-500) and an implicit contextual track (LUim-500). To avoid reducing the task to a binary detector score, we define a multi-grained protocol that evaluates both local logo removal and global image preservation in pixel and latent spaces. Experiments on representative inference-time methods, including NP, SLD, and SEGA, and compatible fine-tuning-based methods such as ESD and Forget-Me-Not, show that the evaluated methods struggle to remove logo evidence without changing non-target content. We further analyze ProLU, a prompt-space multi-agent baseline: it improves local erasure by removing logo-inducing semantics, but also illustrates why prompt filtering is not a substitute for weight-level disentanglement. Correlation analyses over logo area, location, and structural complexity suggest that future logo unlearning may need spatially aware controls, such as SSIM-guided constraints, rather than purely global concept suppression.

Keyu Li, Jin Gao, Jialing Zhang +1

Shanghai Jiao Tong University Shanghai, China

Visual Representations Suppression

Ask PDF

Jun 18, 2026cs.CR

Can LLMs Reason About Brand Ownership? An Empirical Study of Domain Attribution Intelligence

When a new domain resembling a popular brand appears, defenders face a fundamental ambiguity: it may be an attacker-created squatting site for phishing, or it may be a domain the brand itself registered, either defensively, to block attackers, or legitimately, for a new product or service launch. Incorrectly flagging a brand-owned domain as malicious produces a false positive that harms end users and damages the brand's reputation. Resolving this ambiguity requires brand intelligence: the ability to determine, at scale, whether a given domain belongs to a brand. Large language models (LLMs), with their broad knowledge of brand domain relationships, offer a promising zero configuration approach to this problem, but their reliability for brand intelligence tasks remains unknown. We present the first systematic empirical evaluation of LLM brand intelligence across three tasks: domain enumeration (Q1), open ended brand attribution (Q2), and binary ownership classification (Q3). We evaluate four models, Gemini 2.5 Flash, Gemini 3.5 Flash, Claude Sonnet 4.5, and Claude Sonnet 4.6, across four retrieval settings (in context, web search, WHOIS lookup, and combined) on 36 of the most phished brands. Our results reveal a stark dichotomy: models achieve up to 82% precision enumerating brand domains from memory alone, yet fail at ownership verification without external tools, with macro F1 at most 0.37 in ICL mode. WHOIS augmentation lifts Q3 macro F1 by up to 0.65 points, yielding near perfect precision (<= 0.99), dramatically reducing the false positive risk for defenders. We provide concrete recommendations for deploying LLMs in brand protection pipelines.

Fathima Mashood, Mohamed Nabeel

Brand-As-Memory Dataset Ownership Verification Phishing LLM Reasoning Strategies False-Negative Rate Empirical Study

Ask PDF

May 8, 2026cs.CL

Position: The Term "Machine Unlearning" Is Overused in LLMs

Large language models increasingly face demands to "forget" training data, knowledge, or behaviors due to regulatory deletion obligations, copyright/licensing disputes, and safety or product-policy requirements. This position paper argues that machine unlearning is overused as a term in LLM research and should be reserved for dataset-defined deletion: removing the training influence of a precisely specified forget set such that the resulting model is approximately indistinguishable from retraining without that data. We contend that many tasks currently labeled "unlearning" (e.g., refusal for harmful requests, entity/knowledge removal, or targeted suppression) pursue different, often policy-dependent objectives and therefore require different terminology and baselines (e.g., alignment, suppression, editing, obfuscation). We further argue that this confusion is not cosmetic: because papers make different implicit guarantees under the same label, metrics and benchmarks are frequently reused outside their intended scope, rewarding surface-level non-disclosure (e.g., low ROUGE/forget accuracy) even when retraining-equivalence is not tested and derived capabilities remain. We conclude by calling for stricter terminology tied to explicit guarantees and reference models, and for evaluations that match the claimed objective.

Sangyeon Yoon, Yeachan Jun, Albert No

Department of Artificial Intelligence, Yonsei University, Seoul, Korea.

Machine Unlearning Deletion Disclosures Position

Ask PDF