Auditing Forgetting in Limited Memory Language Models

Technical Summary: Auditing Forgetting in Limited Memory Language Models

Problem Statement
Limited Memory Language Models (LMLMs) represent a hybrid architecture that separates linguistic competence (encoded in model parameters) from factual knowledge (stored in an external database). This design aims to enable "deletion-based unlearning," where removing facts from the database eliminates access to them without retraining the model. However, existing evaluation methods for forgetting are insufficient. They typically measure aggregate correctness before and after deletion but fail to distinguish the mechanism of post-deletion correctness. A model might still answer correctly due to:

1. Residual parametric memory: The fact remains encoded in the model's weights.
2. Alternative retrieval paths: The fact is retrieved via aliases, paraphrases, or semantically related entries not explicitly deleted.
3. Retrieval artifacts: The model generates the correct answer based on near-neighbor candidates that are not gold-equivalent to the deleted fact.

Current metrics cannot determine whether knowledge has been successfully externalized or if it persists internally within the model parameters.

Methodology: Causal Auditing Framework
The authors propose a causal auditing framework that holds the model fixed while varying the database state at inference time. The framework evaluates 12,228 alias-closure deletions across thirteen databases (including the released LMLM database and twelve custom variants) using six different prompt formulations.

The framework employs three controlled intervention states:

1. FULL: The database is intact, and retrieval is enabled. This establishes the baseline accuracy.
2. DEL-ON: The target fact (and its alias equivalents) is deleted from the database, but retrieval remains enabled. This tests for recovery via alternative paths or artifacts.
3. DEL-OFF: The target fact is deleted, and retrieval is disabled. This isolates parametric recall, forcing the model to answer without external evidence.

Key Metrics and Decomposition
The framework decomposes post-deletion behavior into three distinct components:

• Parametric Leakage ($L(f)$): Occurs when the model answers correctly in the DEL-OFF state. This indicates the deleted fact persists in the model parameters.
• Retrieval-Mediated Correctness ($R(f)$): Occurs when the model is correct in DEL-ON but incorrect in DEL-OFF. This indicates the answer was recovered via the retrieval graph.
• Retrieval Artifact Rate ($A(f)$): Occurs when the model produces the correct answer in DEL-ON despite no gold-equivalent candidate being present in the retrieval trace. This indicates the answer was reconstituted from near-neighbor candidates (e.g., paraphrastic decoys).

The authors construct custom database variants to stress-test specific failure modes:

• Base: Canonical triplets only (clean baseline).
• Alias: Facts stored only under aliased forms (tests alias-closure completeness).
• Noise: Decoy triplets with paraphrased subjects pointing to the same object (tests near-neighbor reconstruction).
• Collision: Near-miss triplets sharing a subject but routing to a different object (tests confusable-neighbor drift).

Key Results
The audit yields several critical findings across 36,684 model completions:

1. Near-Zero Parametric Leakage: Across all database variants and prompt styles, parametric leakage ($\hat{L}$) is effectively zero (0.11% on average). The model rarely returns a deleted answer in the absence of retrieval. This suggests that for this class of LMLM, the "unlearning" operation within the model parameters is clean; the model behaves as if it never saw the fact once retrieval is disabled.
2. Residuals Live in the Retrieval Graph: The surviving correctness after deletion is almost entirely attributable to the retrieval graph, not the model. The rate of retrieval-mediated correctness ($R(f)$) matches the retrieval artifact rate ($A(f)$) within rounding errors across all variants. This confirms that post-deletion correctness is predominantly reconstituted from near-neighbor retrieval rather than remembered.
3. Database Topology Controls Residuals: The magnitude of the residual (the percentage of deleted facts that survive) is determined by the database topology, not the model architecture or prompt style.
   • Base: ~3.7% residual.
   • Alias: ~6.2% residual.
   • Collision: ~7.2% residual.
   • Noise: ~13.6% residual (the worst case, where paraphrastic decoys allow retrieval to recover the answer).
   • Released LMLM Database: ~0.7% residual.
4. Prompt Formulation Impact: While prompt style significantly affects the baseline (FULL) accuracy (ranging from ~17% to ~57% F1), it has minimal independent control over the post-deletion residual. Once supporting evidence is removed, the survival rate of a fact is dictated by the retrieval graph's structure, not the question's surface form.

Significance and Claims
The paper claims that the primary contribution is a decomposition of forgetting behavior rather than a single aggregate metric. By isolating parametric recall from retrieval-side correctness, the audit reveals that:

• The "unlearning boundary" in this class of LMLM is drawn primarily by the database administrator, not the model.
• Standard deletion procedures that only remove canonical and alias-equivalent triplets are insufficient if the retrieval graph contains paraphrastic decoys (as seen in the "Noise" variant).
• The residual correctness observed in previous studies (e.g., the original LMLM paper) is likely a property of the specific retrieval graph used (which was benign) rather than a failure of the model to forget.

The authors conclude that for effective unlearning in LMLMs, governance must extend beyond entity aliases to include the retrieval-graph topology, ensuring that paraphrastic routes to sensitive information are also closed at the time of deletion. The paper does not claim that LMLMs are universally perfect at unlearning, but rather that their failure modes are structural to the database design rather than inherent to the model's parametric memory.