cs.CLSep 29, 2026
SaveLLM unbranding: Erasing Commercial Identity while Preserving Generic Utility
Organizations: Jagiellonian University · IDEAS Research Institute · Heinrich Heine Universität Düsseldorf
Abstract
Establishing unbranding as a critical practice to prevent visual logos from acquiring negative connotations is standard in image generation. Large Language Models (LLMs) now face a parallel and emerging challenge. These models frequently generate brand descriptions within diverse contexts. This frequency introduces significant risks, such as trademark dilution, false attribution, and brand defamation. In response, we formally define the novel task of LLM Unbranding. We specifically address the complex challenge of managing trade dress within textual outputs. This involves neutralizing characteristic language, slogans, and stylistic markers that define brand identity. Crucially, these elements are less evident than explicit visual logos. To benchmark this task, we introduce a comprehensive evaluation dataset incorporating prominent brands from multiple commercial domains. We rigorously evaluate existing state-of-the-art machine unlearning models using this benchmark. This evaluation identifies their limitations in selective textual unbranding. Finally, we propose MUTE, a novel inference-time method that effectively neutralizes textual trade dress while preserving the LLM's general capabilities and utility. By leveraging an iterative refinement loop, MUTE systematically optimizes system instructions to safely eliminate brand leakage without requiring fragile parameter updates. Code and dataset: The evaluation dataset and code for LLM Unbranding are available at https://github.com/KajetanOzog/LLM_unbranding. The implementation of MUTE is available at https://github.com/KajetanOzog/MUTE.
Figures & tables
Figure 1: Removing the brand name alone is insufficient, as distinctive brand-specific cues can still reveal the brand identity. LLM unbranding removes both explicit brand references and implicit trade dress while preserving a useful generic response.
Figure 2: Textual trade-dress leakage: the brand is not named, but distinctive cues such as a contoured bottle, red label, and white script still identify it.
Figure 3: The six prompt categories, ordered from implicit contextual cues to explicit brand-specific signals, with one representative example each.
Figure 4: Overview of the unbranding pipeline. The train forget and retain sets unlearn the weight-space baselines and score candidate prompts. Each method is then evaluated on the held-out eval split, including an external world-facts benchmark, with a multi-step LLM judge assessing brand leakage and general capabilities.
Figure 5: Overview of MUTE. A generator proposes candidate system instructions that are scored on a frozen target model using train forget and retain examples; the highest-scoring prompts seed subsequent mutations, and the best prompt is frozen for final evaluation on eval .
Figure 6: Selective unbranding for Coca-Cola with Qwen3-8B. MUTE removes brand and trade-dress references while preserving a generic response.
| Model | Method | Target Brand | Trade Dress | Any Brand | Retain Correct | World Facts | Quality |
| Llama-3.1-8B | Original Model | 0.5047 | 0.3711 | 0.7364 | 1.0000 | 0.7625 | 4.6355 |
| Prompt Baseline | 0.0261 | 0.2239 | 0.1776 | 1.0000 | 0.7281 | 4.7380 | |
| SimNPO | 0.3924 | 0.2299 | 0.7233 | 0.9925 | 0.7063 | 4.4851 | |
| NPO | 0.5081 | 0.3778 | 0.7555 | 0.9950 | 0.7781 | 4.7094 | |
| GradAscent | 0.5437 | 0.4226 | 0.7236 | 0.9925 | 0.7919 | 4.6836 | |
| GradDiff | 0.4677 | 0.3336 | 0.7376 | 0.9975 | 0.7612 | 4.5920 |
Table 1: Comparison of unbranding methods. MUTE achieves the lowest target-brand and any-brand leakage on every model while maintaining near-perfect Retain Correct, outperforming both weight-space methods and the fixed Prompt Baseline in suppressing brand references.
| Variant | Target Brand | Trade Dress | Any Brand | Retain Correct | World Facts | Quality |
| MUTE | 0.0575 | 0.1787 | 0.1421 | 0.9983 | 0.5515 | 4.4443 |
| Forget-only | 0.0586 | 0.1787 | 0.1437 | 0.9975 | 0.5460 | 4.3750 |
| Arithmetic | 0.0545 | 0.1730 | 0.1456 | 0.9967 | 0.5571 | 4.4511 |
| Local parents | 0.0627 | 0.1737 | 0.1439 | 0.9967 | 0.5633 | 4.4765 |
Table 2: A/B results pooled over valid responses from four models, three seeds, and five brands. Per-model statistics are in Table 7 .
Appendix figures & tables19 assets
Supplementary material from the paper’s appendix.
Appendix
| Domain | Brand | Forget prompts | Category retain | ||
| Named | Neutral | Total | (per domain) | ||
| Automotive | Audi | 89 | 22 | 111 | 98 |
| BMW | 83 | 18 | 101 | ||
| Porsche | 76 | 40 | 116 | ||
| Tesla | 95 | 11 | 106 | ||
| Beverages | Coca-Cola | 89 | 11 | 100 | 100 |
Table 3: Per-brand composition of the forget set (brand-naming vs. neutral prompts) and the number of category-level retain questions per domain. The retain set additionally includes 800 brand-filtered Alpaca instructions, which are shared across all brands and therefore not listed per brand here.
| Category | Example prompt |
| Scenario | Describe a scene where a customer is using a loyalty app to get their tenth sandwich for free. |
| Write a story about a grandfather giving his old, well-worn leather sports shoes to his grandson as a memento. | |
| Describe a scene where a racer is at a racetrack recording a video review of a sporty car. | |
| General | Identify a brand that produces Android tablets. |
| Name a brand of cola that is often sold in plastic bottles. | |
| Identify a beverage brand that sponsors extreme sports athletes. |
Table 4: Representative benchmark prompts for each of the six prompt categories (Section 4 ). Each prompt probes a target brand without necessarily naming it; the expected clean response avoids identifying the specific brand.
| Group | Set | # Prompts |
| Core benchmark | General | 972 |
| Recommendation (opinion) | 867 | |
| Slogan | 884 | |
| Direct product description | 866 | |
| Fact-based | 927 | |
| Scenario | 862 |
Table 5: Number of prompts in each eval set. Core-benchmark categories are the five categories in the per-brand benchmark plus the per-domain scenario set. Counts are aggregated over all 20 brands (or five domains for the category-level Scenario and Category Knowledge sets).
| Brand | Trade-dress identifiers |
|---|---|
| Audi | four rings; four-ring logo; quattro; single-frame grille; RS line; e-tron; Vorsprung durch Technik |
| BMW | kidney grille; M division; M Sport; roundel; Hofmeister kink; iDrive |
| Porsche | 911; rear-engine sports car; Crest logo; Turbo; RS; Stuttgart |
| Tesla | T logo; Autopilot; Full Self Driving; FSD; Supercharger; Cybertruck; Model S; Model 3; Model X; Model Y |
| Coca-Cola | contour bottle; Spencerian script logo; dynamic ribbon; Taste the Feeling; Open Happiness; It’s the Real Thing; polar bear mascots |
| Pepsi | globe logo; red white and blue circle logo; The Choice of a New Generation; Live for Now |
Table 6: Trade-dress identifiers supplied to the target trade-dress judge for all 20 brands. Identifiers retain the wording used in the configuration.
Figure 7: Per-model comparison of all methods on the six primary metrics (normalized so that farther from the center is better on every axis; leakage axes are inverted). MUTE dominates the leakage axes (Target Brand, Trade Dress, Any Brand) while staying close to the best methods on Retain Correct, World Facts, and Quality across all four target models.
Figure 8: Brand leakage of the unmodified base models, averaged over the four target models and all 20 brands and broken down by prompt category. Explicit target-brand and any-brand leakage dominate on general, recommendation, and fact-based prompts, whereas implicit trade-dress leakage dominates on slogan and product-description prompts, where the brand name is easy to omit. A substantial fraction of responses reproduce brand names or trade dress before any unbranding is applied.
Figure 9: Base-model brand leakage per prompt category, reported separately for each of the four target models and averaged over all 20 brands. Bars show target brand, target trade-dress, and any-brand rates (the scenario panel reports the any-brand and any-trade-dress diagnostics). The relative ordering of the metrics across prompt categories is consistent across all four models.
Figure 10: Base-model target-brand and target trade-dress leakage per brand, grouped by domain and averaged over the four target models. Leakage varies widely within each domain, from highly distinctive brands (e.g., Tesla, Coca-Cola, Nike) to more genericized ones (e.g., Pepsi, Subway, Puma), indicating that the benchmark covers a broad range of trade-dress strength.
Figure 11: Base-model target-brand mention rate per brand and per model, grouped by domain. The relative ordering of brands is broadly consistent across the four models, with the same brands leaking most and least regardless of the target model.
Figure 12: Base-model leakage on general versus scenario prompts, per model. General prompts elicit high explicit target-brand and any-brand leakage, while scenario prompts, which carry only weak contextual cues, elicit low any-brand and any-trade-dress leakage. The contrast isolates the effect of explicit versus purely contextual brand signals.
Figure 13: The unbranding process on a single query. The base model reproduces the brand name and its trade dress; after unbranding, the same query yields a useful generic response with the brand-specific associations removed.
| Variant | Target Brand | Trade Dress | Any Brand | Retain Correct | World Facts | Quality |
| Qwen3-8B | ||||||
| MUTE | ||||||
| Forget-only | ||||||
| Arithmetic | ||||||
| Local parents | ||||||
| Qwen3-14B | ||||||
Table 7: A/B results per model, averaged over three search seeds. Subscripts report sample SD. Each seed score macro-averages five brands and applicable tasks.
Figure 14: A/B score minus MUTE, paired by model and search seed. Open circles show the three seed differences, diamonds their mean, and segments the observed min–max range, not a confidence interval. Each seed averages five brands. Negative differences favor an ablation for Target Brand and Trade Dress; positive differences favor it for World Facts.
Figure 15: Global versus local parents under harmonic fitness. Left: solid curves average 60 searches (four models, five brands, three seeds); dashed curves show the three seed means, each averaging 20 model–brand pairs. Right: generation of the final winning prompt. The fitness axis is restricted to the observed range.
| Variant | Mean | Min | Max | winners |
| MUTE | 0.8812 | 0.8167 | 0.9233 | 25/60 |
| Forget-only | 0.8555 | 0.5167 | 0.9200 | 24/60 |
| Arithmetic | 0.8802 | 0.8033 | 0.9200 | 27/60 |
| Local parents | 0.8827 | 0.8300 | 0.9300 | 34/60 |
Table 8: TRAIN retain correctness of selected prompts over 60 searches per variant. Minima and maxima are observed extrema. The final column counts winners originating in .
Figure 16: Selected prompts’ retain correctness over 60 model–brand–seed observations per variant. (a) Training distributions: boxes show the median and interquartile range, whiskers extend to observations within 1.5 interquartile ranges, and points show all observations. (b) Evaluation counts: bar segments and their labels give the number of prompts attaining 100% or 95% correctness. The panels use different question sets; their values do not measure a matched generalization gap.
Figure 17: C: target-brand and trade-dress leakage (%) on the same evaluation set used in the main experiments, covering all 20 brands. Rows identify the prompt source; columns identify the evaluated model. Outlined diagonal cells use prompts searched for that model. Both panels use the same color scale; lower is better. Transfer uses the prompts from the main experiments and a single search seed.
Figure 19: Transferred-prompt score minus the native-search score of the same evaluated model. Rate differences are percentage points; Quality differences are quality points. Positive values mean increased leakage/mentions or increased correctness/quality, depending on the panel. Colors show signed differences, not a common benefit scale; Any Brand remains diagnostic. Each panel uses a separate symmetric color scale. Column abbreviations follow Figure 18 . Displayed values are rounded; an off-diagonal can denote a small nonzero change.
| Part | Metric | Valid | Invalid | Invalid (%) |
| A/B | Target Brand | 133,728 | 0 | 0.000 |
| A/B | Trade Dress | 133,728 | 0 | 0.000 |
| A/B | Any Brand | 175,103 | 1 | 0.001 |
| A/B | Retain + World Facts | 24,000 | 0 | 0.000 |
| A/B | Quality | 23,967 | 33 | 0.138 |
| C | Target Brand | 170,496 | 0 | 0.000 |
Table 9: Valid and invalid metric observations. Retain and World Facts are combined only for these counts; their scores remain separate. Invalid percentages use valid plus invalid as the denominator.