Research map / Large language models / Language, safety and interpretability

RWKU: Benchmarking Real-World Knowledge Unlearning for Large Language Models

NeurIPS 2024 · Large language models › Language, safety and interpretability · approach: LLM pruning and scaling data · 6 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces RWKU, a benchmark for real-world knowledge unlearning in LLMs using 200 famous people as targets, with zero-shot (no forget/retain corpus) setting, multi-level forget probes, MIA and adversarial attacks, and retain assessment of neighbor perturbation and utility.

Problem

Existing LLM unlearning benchmarks assume access to forget/retain corpora, use fictitious or hazardous knowledge, and evaluate only non-adversarially, so they do not reflect realistic unlearning of knowledge already present in LLMs.

Approach

Use 200 real-world famous people as unlearning targets in a zero-shot setting where only the target and the original model are given; the model generates a synthetic forget corpus. Evaluate forgetting via fill-in-the-blank, QA, nine adversarial attack types, and four membership inference attacks, and assess locality and utility on neighbor probes, MMLU, BBH, TruthfulQA, TriviaQA and AlpacaEval-bas

Key results

• On LLaMA3-Instruct 8B, GA (Full) and NPO (Full) reduce the forget-set score to 41.9 and 26.2 (All), versus 79.6 before unlearning, while ICU reaches 12.8 but with a neighbor-set drop to 55.7.
• Almost all methods trained on the synthetic forget corpus fail under membership inference attacks, with FM LOSS scores remaining close to RM scores.
• Batch-target unlearning is markedly harder: DPO and NPO fail to unlearn without hurting performance, and GA collapses at 30 targets.

Measured effects reported in the paper

Surprising findings

• Training on the model's own synthetic forget corpus gave better forgetting than training on the Wikipedia-based pseudo ground-truth corpus.
• ICU, which uses no parameter updates, still causes side effects on neighbor knowledge.

Limitations

• Relies on a single knowledge source (famous people); other knowledge types such as events are not covered.
• Baselines are evaluated only on LLaMA3 and Phi-3 (plus reference models), and fixed random seeds mean no error bars are reported.

Experimental setup

Datasets: Wikipedia pages of famous people MMLU BBH TruthfulQA TriviaQA AlpacaEval C4

Benchmarks: RWKU MMLU BBH TruthfulQA TriviaQA AlpacaEval

Metrics: ROUGE-L recall MIA LOSS score accuracy EM F1 bi/tri-gram entropy

Baselines: ICU RepE GA DPO NPO RT

Builds on: gradient ascent unlearning negative preference optimization direct preference optimization representation engineering in-context unlearning

Closest papers by meaning

• Towards Robust Knowledge Unlearning: An Adversarial Framework for Assessing and Improving Unlearning Robustness in Large Language Models (AAAI 2025 · similarity 0.92)
• Towards Robust and Parameter-Efficient Knowledge Unlearning for LLMs (ICLR 2025 · similarity 0.92)
• Do LLMs Really Forget? Evaluating Unlearning with Knowledge Correlation and Confidence Awareness (NeurIPS 2025 · similarity 0.91)
• Towards Effective Evaluations and Comparisons for LLM Unlearning Methods (ICLR 2025 · similarity 0.91)
• In-Context Unlearning: Language Models as Few-Shot Unlearners (ICML 2024 · similarity 0.91)
• A Closer Look at Machine Unlearning for Large Language Models (ICLR 2025 · similarity 0.91)