Who's Harry Potter? Approximate Unlearning in LLMs

By Ronen Eldan, Mark Russinovich. arXiv.org, 2023

410 citations recorded by the source corpus.

Large language models (LLMs) are trained on massive internet corpora that often contain copyrighted content. This poses legal and ethical challenges for the developers and users of these models, as well as the original authors and publishers. In this paper, we propose a novel technique for unlearning a subset of the training data from a LLM, without having to retrain it from scratch. We evaluate our technique on the task of unlearning the Harry Potter books from the Llama2-7b model (a generative language model recently open-sourced by Meta). While the model took over 184K GPU-hours to pretrain, we show that in about 1 GPU hour of finetuning, we effectively erase the model's ability to generate or recall Harry Potter-related content, while its performance on common benchmarks (such as Winogrande, Hellaswag, arc, boolq and piqa) remains almost unaffected. We make our fine-tuned model publicly available on HuggingFace for community evaluation. To the best of our knowledge, this is the first paper to present an effective technique for unlearning in generative language models. Our technique consists of three main components: First, we use a reinforced model that is further trained on the target data to identify the tokens that are most related to the unlearning target, by comparing its logits with those of a baseline model. Second, we replace idiosyncratic expressions in the target data with generic counterparts, and leverage the model's own predictions to generate alternative labels for every token. These labels aim to approximate the next-token predictions of a model that has not been trained on the target data. Third, we finetune the model on these alternative labels, which effectively erases the original text from the model's memory whenever it is prompted with its context.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, General Social Sciences

View Paper: https://www.semanticscholar.org/paper/40a7c44d1cfaa9faf1f731a6f93a889fab5426da

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In General Social Sciences

Citations in the corpus

The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning (2024, methodology): “More recent methods erase broader concepts such as gender (Belrose et al., 2023), harmful behaviors (Yao et al., 2023b; Liu et al., 2024), or fictional universes (Eldan and Russinovich, 2023), but have not been proven to eliminate scientific knowledge which enables malicious use.”
Detecting Pretraining Data from Large Language Models (2023, methodology): “K % P ROB to audit an unlearned LLM that is trained to forget copyrighted books using machine unlearning techniques (Eldan & Russinovich, 2023) and find such model could still output related copyrighted content.”
Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning (2024, methodology): “They might also violate copyright by generating text from memorized books, such as the Harry Potter novels (Eldan & Russinovich, 2023).”
Large Language Model Unlearning (2023, methodology): “Several concurrent works to our work also study unlearning in LLMs. [Eldan and Russinovich, 2023] unlearn answers related to Harry Potter by finetuning based on the difference between the model trained on Harry Potter data and the counterfactual outputs as if the Harry Potter data were not used.”
TOFU: A Task of Fictitious Unlearning for LLMs (2024, positive): “For example, Eldan & Russinovich (2023) explore unlearning information about Harry Potter; while they show promising results Shi et al. (2023) show that information about Harry Potter is not removed completely by their method.”