💻 computer science

PreUnlearn: Auditing Collateral Knowledge Damage Before Large Language Model Unlearning

This paper introduces PreUnlearn, a data-centric framework that predicts and audits collateral knowledge damage in large language models before unlearning occurs by analyzing interaction features between forget and evaluation sets to identify risky unlearning scenarios.

Original authors: Bo Su, Ankit Shah, Thai Le

Published 2026-06-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Bo Su, Ankit Shah, Thai Le

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a giant, incredibly knowledgeable library (the Large Language Model, or LLM) that knows almost everything. Sometimes, you need to remove specific books from this library because they contain sensitive, outdated, or harmful information. This process is called "unlearning."

The problem is that books in a library are often connected. If you try to remove a book about "how to bake a cake," you might accidentally damage the knowledge about "how to mix ingredients" or even "how to use an oven," even though those aren't the specific books you wanted to delete. This accidental damage is what the paper calls "collateral damage."

The authors of this paper, PREUNLEARN, wanted to answer two big questions before anyone actually starts deleting books:

How bad will the damage be? Will it stay close to the deleted book, or will it spread far and wide?
Can we predict the damage beforehand? Can we look at the books we want to delete and the books we want to keep, and guess how much harm will happen without actually doing the deletion first?

Here is a simple breakdown of their findings using everyday analogies:

1. The "Ripple Effect" (Three Layers of Damage)

The researchers tested what happens when they "unlearn" (delete) specific topics. They found that the damage spreads out like ripples in a pond, but it gets weaker the further it goes. They measured this in three layers:

Layer 1 (The Target): This is the book you specifically tried to delete. As expected, the knowledge here is the most damaged.
Layer 2 (The Neighbors): These are books on the same shelf or very similar topics (e.g., deleting "cake baking" hurts "pastry making"). The damage here is significant, but less than the target.
Layer 3 (The Distant Rooms): These are books in completely different sections (e.g., deleting "cake baking" hurting "quantum physics"). The damage here is the weakest, but it doesn't disappear completely. Even distant knowledge gets a little shaky.

Key Takeaway: You can't just delete one thing without affecting its neighbors, and sometimes, it even shakes the whole building a little bit.

2. The "Crystal Ball" (Predicting Damage Beforehand)

The most exciting part of the paper is their solution to the second question: Can we predict this damage before we start?

Usually, to know if a deletion is safe, you have to actually do the deletion, check the results, and then hope for the best. This is expensive and slow. The authors built a "Pre-Unlearning Auditor"—a crystal ball that looks at the data before any deletion happens.

They realized that the risk of damage isn't just about the book you want to delete; it's about the relationship between the book you want to delete and the books you want to keep.

The Analogy: Imagine you are moving furniture. If you try to move a heavy sofa (the "forget set") through a narrow hallway, you might scratch the walls (the "retain set").
- If the sofa is small and the hallway is wide, you'll be fine.
- If the sofa is huge and the hallway is tight, you'll cause damage.
- The auditor looks at the "size" of the sofa and the "width" of the hallway before you lift a finger.

3. What the Crystal Ball Looks At

The researchers found that the best way to predict damage isn't by looking at the "deleted book" alone, but by looking at the geometry (the shape and distance) between the two sets of data.

Distance: If the topic you want to delete is very far away (in terms of meaning) from the topics you want to keep, the damage is low.
Similarity: If they are very similar, the damage is high.
Length and Complexity: Longer, more complex texts tend to cause more ripple effects.

They built a computer program that measures these "distances" and "shapes" and can tell you, "Hey, if you delete this specific topic, it will likely break that specific topic."

4. Why This Matters

The paper suggests that instead of blindly trying to delete things and hoping for the best, we should use this Auditor as a warning system.

Before you delete: Run the auditor.
The Result: It gives you a "risk score."
The Action: If the score is high, you know to be careful. You might need to add more "safety buffers" (extra training data) around the topics you want to keep, or you might decide not to delete that specific topic at all because the cost is too high.

Summary

Think of this paper as a safety inspector for digital memory.

The Problem: Deleting bad info often breaks good info.
The Discovery: The damage spreads in ripples, getting weaker but never fully stopping.
The Solution: We can predict exactly how much damage will happen just by looking at how "close" the bad info is to the good info, without actually having to delete anything first. This saves time and prevents accidental destruction of useful knowledge.

Technical Summary: PREUNLEARN: Auditing Collateral Knowledge Damage Before Large Language Model Unlearning

1. Problem Statement

Machine unlearning for Large Language Models (LLMs) aims to remove specific, sensitive, or harmful knowledge (the "forget set") while preserving the model's general utility. However, the boundary between knowledge to forget and knowledge to retain is often blurred due to the entanglement of related and distant information within model parameters.

Current evaluation practices often rely on aggregate utility metrics or limited post-hoc probes, which fail to capture the granular propagation of damage. Specifically, existing benchmarks often assume a fixed forget set and do not adequately characterize how unlearning effects ripple from the target set to same-domain knowledge and further to distant-domain knowledge. Consequently, two critical questions remain unexplored:

RQ.1: How does unlearning impact spread from a forget set $X$ to same-domain and distant-domain knowledge $Y$ ?
RQ.2: Can we predict the potential collateral damage on knowledge $Y$ resulting from unlearning $X$ before the unlearning process is executed?

2. Methodology

2.1 Three-Layer Unlearning Impact Framework

The authors propose a data-centric evaluation framework that organizes post-unlearning knowledge degradation into three semantic layers relative to a forget set $D_f$ :

L1 (Intended Degradation): Performance on the forget set $D_f$ itself.
L2 (Same-Domain Damage): Performance on held-out passages semantically close to the forget domain.
L3 (Distant-Domain Damage): Performance on passages from other, unrelated semantic domains.

The impact is quantified using the Perplexity (PPL) Ratio: $R(S) = \text{PPL}(M^*_\theta, x) / \text{PPL}(M_\theta, x)$ , where $M^*_\theta$ is the unlearned model and $M_\theta$ is the original model. A ratio $>1.0$ indicates performance degradation.

2.2 Experimental Setup

Dataset: WikiText-103, processed into 10 well-separated semantic clusters. 100 unlearning datasets were constructed, each containing disjoint forget and retain splits.
Models: Llama-3.1-8B-Instruct and Qwen2.5-7B-Instruct.
Algorithms: Three distinct unlearning methods were evaluated:
- Gradient Ascent (GA)
- Negative Preference Optimization (NPO)
- Unlearning via Self-Distillation on Adjusted Logits (UNDIAL)

2.3 Pre-Unlearning Auditing Formulation

The paper formulates "forget-set auditing" as a supervised regression problem. The goal is to predict the collateral damage ratio ( $\rho_{f,e}$ ) for a pair of a candidate forget set ( $D_f$ ) and an evaluation set ( $D_e$ ) before any model updates occur.

Target Variable: $\rho_{f,e} = \frac{\log(\text{PPL}_{after, e} / \text{PPL}_{before, e})}{\log(\text{PPL}_{after, f} / \text{PPL}_{before, f})}$ . This normalizes the degradation on the evaluation set by the achieved forgetting strength.
Input Features: The auditor uses only pre-update features ( $\phi(D_f, D_e, M_\theta)$ $ϕ (D_{f}, D_{e}, M_{θ})$ ) and has no access to gradients, checkpoints, or post-unlearning measurements. Features are categorized into:
1. Intrinsic Features: Properties of $D_f$ and $D_e$ independently (e.g., length, diversity, dimensionality).
2. Interaction Features: Geometric relationships between the two sets (e.g., centroid Euclidean distance, cosine similarity, lexical ratios).
Models: Ridge Regression, Random Forests, and XGBoost were trained to predict $\rho_{f,e}$ .
Evaluation: The auditor was tested using Leave-One-Domain-Out (LODO) cross-validation and a fully held-out semantic domain test to ensure generalization beyond specific domain identities.

3. Key Results

3.1 Three-Layer Impact Patterns (RQ.1)

Decay Pattern: A consistent decay pattern was observed across all model and algorithm combinations: $L1 > L2 > L3$ . Unlearning impact is strongest on the forget set, weaker on same-domain knowledge, and weakest (but still present) on distant-domain knowledge.
Algorithm Dependence: The magnitude of damage varies significantly by algorithm. Gradient Ascent (GA) produced the most aggressive impact (up to $12.85\times$ PPL ratio increase), while NPO and UNDIAL remained within $1.05\text{--}1.65\times$ .
Forget Set Variability: Even with fixed hyperparameters and algorithms, different forget sets induce substantially different impact profiles. This variation suggests that the choice of the forget set itself is a critical design decision.
Distributional Separation: The degradation distributions for L1, L2, and L3 are clearly separated, though L3 exhibits a "right tail," indicating that severe collateral damage can occur even on distant domains.

3.2 Pre-Unlearning Auditing Performance (RQ.2)

Predictability: The audit task is feasible. The best regressors achieved Spearman rank correlations ( $\rho$ ) of up to 0.93 (GA) and 0.90 (UNDIAL) under LODO cross-validation. Performance remained informative ( $\rho \geq 0.51$ ) even on the more difficult NPO objective.
Feature Importance: The strongest predictive signals are interaction features between the forget and evaluation sets, specifically:
- Centroid Euclidean distance (negative correlation with damage).
- Centroid cosine similarity (positive correlation).
- Cross-set lexical and length ratios.
- Intrinsic properties of the sets alone were less predictive than their geometric relationship.
Stability: The ranking quality of the auditor remained stable across different unlearning algorithms, suggesting that collateral damage is partly determined by the pre-existing geometric coupling between datasets.
Sensitivity: The auditor correctly responded to changes in the risk composition of evaluation sets, distinguishing between high-risk and low-risk blocks rather than reacting to random noise.

4. Significance and Claims

The paper positions forget-set auditing as an early warning tool rather than a replacement for full evaluation. Its primary contributions and significance are:

Granular Characterization: It establishes a three-layer framework demonstrating that unlearning damage is not confined to the target but decays with semantic distance, persisting even across domain boundaries.
Pre-emptive Risk Screening: It demonstrates that collateral damage can be predicted using only data geometry (interaction features) before any expensive unlearning optimization is run.
Practical Triage: The auditor enables practitioners to prioritize risky unlearning runs, allocate retain-data budgets to vulnerable domains, or reject high-risk forget-set candidates early in the pipeline.
Data-Centric Insight: The findings suggest that collateral damage is not solely a function of the unlearning algorithm's mechanics but is significantly influenced by the geometric relationship between the data to be forgotten and the data to be retained.

The authors modestly note limitations, including that the study covers a subset of unlearning algorithms and models, and that perplexity serves as a proxy for behavioral degradation. They conclude that while the auditor does not replace final evaluation, it transforms the process from a purely post-hoc measurement into a cheaper, risk-guided ranking problem.