AMNESIA: A Large Scale Medical Unlearning Benchmark Suite with Disease-Informed Analysis

Technical Summary: AMNESIA

Problem Statement
Medical knowledge is dynamic, necessitating the ability to update or selectively remove information from trained Large Language Models (LLMs) without full retraining. This capability, known as machine unlearning, is critical for compliance with privacy regulations (e.g., GDPR's "right to be forgotten") and for correcting erroneous medical records. However, existing unlearning benchmarks rely on synthetic data or small-scale general-domain tasks, leaving clinical unlearning understudied. Current methods lack standardized evaluation for medical question-answering (QA), where the distinction between forgetting a specific patient's data and preserving shared clinical knowledge is complex.

Methodology
The authors introduce AMNESIA, the first large-scale, open-source benchmark for medical unlearning. The methodology encompasses dataset construction, benchmark design, and evaluation metrics:

• Dataset Construction: The dataset comprises 70,560 question-answer (QA) pairs derived from 8,820 de-identified patient notes sourced from PMC-Patients-v2. These notes span 11 disease categories (e.g., Cancer, Cardiovascular, Infectious/Immune).
  • QA Generation: For each patient, 8 QAs are generated: 4 factual questions (testing direct recall) and 4 reasoning questions (testing clinical inference across multiple findings).
  • Validation: A human-in-the-loop evaluation using a panel of three LLMs (MedGemma, Qwen, GPT-5-Mini) and a biology student annotator validated disease labels and QA quality, achieving high agreement rates.
• Data Partitioning: The benchmark supports two forgetting scenarios:
  1. Random Patient-Level: Random subsets of patients (5% to 25%) are selected for forgetting.
  2. Disease-Level: Patients sharing specific disease categories are selected for forgetting, testing the model's ability to unlearn specific conditions while retaining others.
  • A Holdout Set is created with unseen QAs per patient to evaluate generalization.
• Base Model & Unlearning Methods: The benchmark uses LLaMA 3-8B as the base model, pre-trained on patient notes and fine-tuned on the QA pairs. Four representative unlearning methods from the OpenUnlearning framework are evaluated:
  • RMU: Steers internal representations of forget-set inputs toward random targets.
  • GradDiff: Maximizes loss on the forget set while minimizing loss on the retain set via gradient ascent.
  • KL-Min: Uses gradient ascent on the forget set with KL-divergence regularization to preserve retain-set outputs.
  • SimNPO: Treats forgotten samples as negative preferences without a reference model.
  • Note: For efficiency and consistency with prior work, unlearning is applied selectively to layer 7 of the model.
• Evaluation Metrics:
  • Standard Metrics: Model Utility (MU) on retain sets and Answer Forget Efficacy (AFE) on forget sets, calculated via the harmonic mean of ROUGE, Exact Match (EM), Cosine Similarity (CS), and Entailment Score (ES). Token Entropy (TE) and Degradation Score (DS) measure output collapse.
  • Novel Metric: Disease Keyword Leakage (LS). This metric quantifies the re-appearance of disease-specific medical terminology (extracted via scispaCy and matched against seed lists) in model outputs, addressing privacy violations where specific terms persist despite high AFE.

Key Contributions

1. First Large-Scale Clinical Benchmark: AMNESIA provides 70,560 QAs from 8,820 patients across 11 disease categories, distinguishing between factual recall and clinical reasoning.
2. Multi-Level Evaluation: It introduces disease-level forgetting scenarios, moving beyond random patient splits to analyze how unlearning affects shared medical knowledge.
3. Comprehensive Analysis: The paper evaluates four diverse unlearning methods, revealing their limitations in clinical contexts.
4. Domain-Specific Leakage Metric: The introduction of a disease-focused keyword evaluation to detect the leakage of medical terminology, a critical privacy concern in healthcare.
5. Open Release: The dataset, code, and trained models are released publicly without restrictions.

Results and Analysis

• Random Patient-Level Unlearning: Existing methods struggle significantly.
  • RMU and SimNPO maintain high Model Utility (MU) but fail to effectively forget (low AFE), suggesting they do not erase patient information.
  • KL-Min and GradDiff achieve high AFE but at the cost of Model Utility, often resulting in model collapse (repetitive, incoherent outputs) rather than selective erasure.
  • Holdout Evaluation: Models tend to forget specific training QAs rather than the underlying patient notes, as they fail to answer unseen questions about the same patient.
• Disease-Level Unlearning:
  • Unlearning patients with the same disease reveals a trade-off: as the forget set size increases, AFE improves, but MU for retained patients with the same disease degrades substantially. This indicates that removing a critical mass of patients with a specific condition erodes the model's shared clinical knowledge for that condition.
  • KL-Min and GradDiff show disease-targeted unlearning (preserving utility for out-of-disease patients) but still suffer from utility loss on same-disease retained patients.
• Keyword Leakage:
  • Methods like RMU and SimNPO exhibit significant leakage of disease-specific terms (10–25% leakage rates), even when AFE appears moderate.
  • KL-Min and GradDiff achieve near-zero leakage, but this is attributed to their generation of incoherent outputs (high degradation scores) rather than successful, safe unlearning.
  • In disease-level splits, leakage decreases as the forget set grows, correlating with the erosion of shared medical knowledge.

Significance and Claims
The paper claims that AMNESIA exposes critical limitations in current unlearning methods when applied to medical data. The authors assert that:

1. Current methods are insufficient: They either fail to forget effectively or achieve forgetting through model collapse, neither of which is acceptable for clinical applications.
2. Patient vs. Knowledge Separation: Unlearning individual patients often erodes knowledge of others with the same condition, highlighting the difficulty of separating patient-specific data from shared clinical knowledge.
3. Privacy Risks: High AFE does not guarantee privacy; models can still leak specific medical terminology or allow information recovery via paraphrased queries.
4. Need for Specialized Techniques: The findings underscore the necessity for medical-specific unlearning techniques that can erase patient information without compromising the utility of shared medical knowledge.

The authors conclude that AMNESIA serves as an essential benchmark for advancing the field, while modestly acknowledging limitations such as the reliance on answer-level metrics, the use of a single base model, and the simplification of comorbidities into single disease categories. They explicitly state that none of the evaluated models are validated for clinical use.