Paper deep dive
Not All Tokens Are Meant to Be Forgotten
Xiangyu Zhou, Yao Qiang, Saleh Zare Zade, Douglas Zytko, Prashant Khanduri, Dongxiao Zhu
Models: DistilBERT, GPT-4, LLaMA
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/12/2026, 6:18:47 PM
Summary
The paper introduces the Targeted Information Forgetting (TIF) framework to address the 'over-forgetting' problem in Large Language Model (LLM) unlearning. TIF uses a two-stage approach: an information identifier (using DistilBERT or ChatGPT-4) to distinguish between Unwanted Words (UW) and General Words (GW), and a novel Targeted Preference Optimization (TPO) method. TPO employs Logit Preference Loss (LPL) to suppress unwanted information and Preservation Loss (PL) to retain general knowledge, significantly improving model utility compared to existing methods like NPO.
Entities (6)
Relation Signals (3)
TIF → utilizes → TPO
confidence 99% · TIF framework... consists of... (2) a novel Targeted Preference Optimization approach
TPO → includes → Logit Preference Loss
confidence 98% · TPO integrates two innovative components: Preservation loss (PL)... and Logit preference loss (LPL)
TIF → evaluatedon → TOFU
confidence 95% · Extensive experiments on the TOFU and MUSE benchmarks demonstrate that the proposed TIF framework
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large Language Models (LLMs), pre-trained on massive text corpora, exhibit remarkable human-level language understanding, reasoning, and decision-making abilities. However, they tend to memorize unwanted information, such as private or copyrighted content, raising significant privacy and legal concerns. Unlearning has emerged as a promising solution, but existing methods face a significant challenge of over-forgetting. This issue arises because they indiscriminately suppress the generation of all the tokens in forget samples, leading to a substantial loss of model utility. To overcome this challenge, we introduce the Targeted Information Forgetting (TIF) framework, which consists of (1) a flexible targeted information identifier designed to differentiate between unwanted words (UW) and general words (GW) in the forget samples, and (2) a novel Targeted Preference Optimization approach that leverages Logit Preference Loss to unlearn unwanted information associated with UW and Preservation Loss to retain general information in GW, effectively improving the unlearning process while mitigating utility degradation. Extensive experiments on the TOFU and MUSE benchmarks demonstrate that the proposed TIF framework enhances unlearning effectiveness while preserving model utility and achieving state-of-the-art results.
Tags
Links
Trouble viewing inline? Open PDF directly →
Full Text
63,822 characters extracted from source content.
Expand or collapse full text
Not All Tokens Are Meant to Be Forgotten Xiangyu Zhou 1 , Yao Qiang 2 , Saleh Zare Zade 1 , Douglas Zytko 3 , Prashant Khanduri 1 , Dongxiao Zhu 1 1 Department of Computer Science, Wayne State University 2 Department of Computer Science and Engineering, Oakland University 3 College of Innovation and Technology, University of Michigan-Flint xiangyu@wayne.edu, qiang@oakland.edu, salehz@wayne.edu, dzytko@umich.edu, khanduri.prashant@wayne.edu, dzhu@wayne.edu Abstract Large Language Models (LLMs), pre-trained on massive text corpora, exhibit remarkable human-level language un- derstanding, reasoning, and decision-making abilities. How- ever, they tend to memorize unwanted information, such as private or copyrighted content, raising significant privacy and legal concerns. Unlearning has emerged as a promising so- lution, but existing methods face a significant challenge of over-forgetting. This issue arises because they indiscrimi- nately suppress the generation of all the tokens in forget samples, leading to a substantial loss of model utility. To overcome this challenge, we introduce the Targeted Infor- mation Forgetting (TIF) framework, which consists of (1) a flexible targeted information identifier designed to differ- entiate between unwanted words (UW) and general words (GW) in the forget samples, and (2) a novel Targeted Prefer- ence Optimization approach that leverages Logit Preference Loss to unlearn unwanted information associated with UW and Preservation Loss to retain general information in GW, effectively improving the unlearning process while mitigat- ing utility degradation. Extensive experiments on the TOFU and MUSE benchmarks demonstrate that the proposed TIF framework enhances unlearning effectiveness while preserv- ing model utility and achieving state-of-the-art results. Code — https://github.com/xzhou98/Unlearning-TPO Introduction Large Language Models (LLMs), pre-trained on vast text corpora, demonstrate strong capabilities in text generation and nuanced language understanding (Brown 2020). How- ever, they often memorize parts of their training data (Car- lini et al. 2021), which, while useful for tasks such as ques- tion answering (Brown 2020) and code generation (Jiang et al. 2024), raises security and safety concerns. Specifically, memorization of personally identifiable information (PII) or copyrighted content poses risks of privacy violations or copyright infringement (Carlini et al. 2021; Karamolegkou et al. 2023; Li et al. 2024; Zhou et al. 2023, 2024; Zade et al. 2025). To address these risks, recent work has explored ma- chine unlearning techniques for LLM dememorization. Copyright © 2026, Association for the Advancement of Artificial Intelligence (w.aaai.org). All rights reserved. Machine unlearning (Cao and Yang 2015; Bourtoule et al. 2021; Nguyen et al. 2022) was developed as an efficient ap- proach to remove the influence of specific training samples from pre-trained models, eliminating the need for full re- training. Recently, unlearning techniques have been adapted for LLMs, raising ongoing challenges in precisely removing private or copyrighted content learned from specific train- ing samples (Yao, Xu, and Liu 2023; Pawelczyk, Neel, and Lakkaraju 2023; Eldan and Russinovich 2023; Chen and Yang 2023). Early approaches mainly rely on fine-tuning pre-trained models (Li et al. 2024; Chen and Yang 2023; Si et al. 2023; Jang et al. 2022), with some using gradient ascent (GA) optimization to achieve the goal of unlearn- ing (Yao, Xu, and Liu 2023). However, due to the unbounded nature of the loss function, GA-based methods lack precise control over updates, often leading to catastrophic collapse, where the model’s overall performance deteriorates (Zhang et al. 2024). To address this issue, recent work introduces preference optimization-based frameworks such as Nega- tive Preference Optimization (NPO) (Zhang et al. 2024) and SimNPO (Fan et al. 2024) to mitigate performance collapse. Despite these foundational efforts, LLM unlearning still faces several critical challenges: (C1) Ambiguous Unlearn- ing Targets. Most existing approaches treat the entire for- get sample as the unlearning target without differentiating between unwanted information (to be unlearned) and gen- eral information (to be retained), as shown in Figure 1. This lack of distinction often leads to significant degradation of model utility (Wang et al. 2024a; Liu et al. 2024a; Lynch et al. 2024; Rezaei et al. 2024). (C2) Lack of Flexible and Generalizable Unwanted Information Identification. Re- cent methods attempt fine-grained unlearning but face criti- cal limitations in information identification: ECO (Liu et al. 2024a) employs a sentence-level identifier that overfits to specific keywords in the forget sample (e.g., the “college”), rather than aligning with the unlearning requester’s intent (Thaker et al. 2024). This leads to insufficient unlearning when prompts containing these specific keywords are re- moved. While SEUL (Wang et al. 2024a) improves precision by leveraging generative models (e.g., ChatGPT) to identify continuous sensitive spans (e.g., PII), it remains limited to handling diverse unlearning targets (e.g., copyrighted con- tent). This rigidity in identification compromises both ef- fectiveness and generalizability. (C3) Sensitivity to Forget arXiv:2506.03142v2 [cs.LG] 30 Dec 2025 Forget Set Existing Unlearning A f Q f PretrainUnlearn A f Q r A: 26th of February. Targeted Information Forgetting Pretrained Model Unlearned Model A f Information Identifier Kuwait City, Kuwait Basil Mahfouz Al-Kuwaiti was born in GW UW Forgeting unwanted info. Preserving general info. Pretrained Model Unlearned Model GW UW A: Yes, Jaime Vasquez was born on the 25th of February in the year 1958 according to public records. Q r In which city and country was Basil Mahfouz Al-Kuwaiti born? Basil Mahfouz Al-Kuwaiti was born in Kuwait City, Kuwait. Yes, Jaime Vasquez was born on the 25th of February in the year 1958. Are the details of Jaime Vasquez's birth documented? Retain Set Q r A r Q f Af Figure 1: Illustration of the proposed TIF framework. TIF exploits an unwanted information identifier to differentiate be- tween unwanted and general information in the forget sample (e.g., A f in the right panel). The former is represented by Un- wanted Words (UW) and the latter by General Words (GW). Instead of removing the entire response A f , TIF selectively unlearns only UW while preserving general knowledge associated with GW by retraining on GW. This targeted approach enables ef- fective forgetting while maintaining model utility. The right panel demonstrates a more complete and correct model response compared to the existing unlearning approach on the left. Figure 2: Comparison of our TPO and NPO (Zhang et al. 2024) on key metrics: forget quality and model utility. The results are derived from the Forget05 task of the TOFU dataset (Maini et al. 2024). Set Size. Methods based on preference optimization (Zhang et al. 2024; Rafailov et al. 2024) mitigate catastrophic col- lapse more effectively than other baselines, helping to pre- serve model utility. However, their effectiveness declines significantly as the forget set size increases, resulting in no- table utility loss (Liu et al. 2024a), as shown in Figure 2. To address the challenges (C1)-(C3), we propose the Tar- geted Information Forgetting (TIF) framework, as illus- trated in Figure 1. Our main contributions are listed below: (1) TIF Framework. To tackle (C1), we propose a novel TIF framework for LLM unlearning. Different from exist- ing unlearning approaches such as NPO, which predomi- nantly unlearn entire information associated with the forget instances (e.g.,A f in the left panel of Figure 1), our TIF is designed to unlearn only the targeted unwanted information, such as the city of born in the right panel’s example. General information is often associated with some “General Words (GW)”, including stop words and commonly used phrases, TPO: One of the notable novels written by Evelyn Desmet is titled “Crimson Horizon.” NPO: 'The Last Refuge.' A: One of the notable novels written by Evelyn Desmet is "Crimson Horizon." Q: Can you mention one of the novels written by Evelyn Desmet? Figure 3: Illustration of responses generated by models un- learned using TPO (ours) and NPO on the retain set. The models were unlearned on the Forget05 task of the TOFU. which frequently appear in both retain and forget sets. In contrast, “Unwanted Words (UW)” correspond to specific private or copyrighted content, such as city of born. By specifically targeting only UW for unlearning, our TIF pre- serves more general information compared to existing meth- ods like NPO, effectively preventing over-forgetting and en- abling the model to generate more readable responses, as demonstrated in the retain set answers in Figure 1. (2) Unwanted Information Identification. To address (C2), we develop flexible yet effective approaches for un- wanted information identification: a generative model such as ChatGPT-4, and a discriminative model such as Distil- BERT (Sanh 2019), to effectively differentiate UW from GW. We evaluate their unlearning performance and illustrate their respective use cases. As a bottom line, even identifying function words (e.g., the, is, or an) as GW according to lin- guistics would improve model utility preservation. (3) A Novel Optimization Method to Retain Model Utility. To overcome (C3), we advance preference opti- mization algorithms (Zhang et al. 2024; Fan et al. 2024) by introducing Targeted Preference Optimization (TPO), a novel optimization objective designed to mitigate the sig- nificant utility degradation observed in NPO. Specifically, Target Sentence： Basil Mahfouz Al-Kuwaiti was born in Kuwait City, Kuwait. DistilBERT ChatGPT Masked Prediction ... Basil Mahfouz ... City, [MASK] [MASK] Mahfouz Al-Kuwaiti ... Idi Predicted token on each [MASK] Amin was FilterIf (predicted token == masked token) Masking was born in Basil Mahfouz Al- Kuwaiti, Kuwait City GW True False Discriminative ApproachGenerative Approach UW born ... Persian Identify Unwanted Words (UW) for following Q&A. ... Q: In which city and country was Basil Mahfouz Al-Kuwaiti born? A: Basil Mahfouz Al-Kuwaiti was born in Kuwait City, Kuwait. The Unwanted words (UW) are "Kuwait City, Kuwait" The General words (GW) are "Basil, Mahfouz, Al-Kuwaiti, was, born, in" Basil [MASK] Al-Kuwaiti ... ... Figure 4: Illustration of the proposed information identification. The discriminative approach (left) uses DistilBERT with masked token predictions, while the generative approach (right) leverages ChatGPT with explicit instructions to identify UW and GW. our TPO integrates two innovative components: Preserva- tion loss (PL) to maintain general model utility by retraining on GW, and Logit preference loss (LPL) to unlearn unwanted information in UW. This optimization approach effectively balances general information retention and unwanted infor- mation forgetting, improving the robustness of preference- guided optimization even with larger forget sets. As shown in Figure 2, our approach, TPO, achieves a comparable for- get quality to NPO while significantly preserving a higher model utility. This allows the model to generate accurate information for answers in the retain set. In contrast, NPO struggles to retain essential knowledge from the retain set, as illustrated in Figure 3. Problem Formulation LLM Unlearning LLM unlearning aims to remove the influence of data points ξ f : = (x f ,y f ) ∼ D f , while preserving the integrity of the remaining knowledge in the model. Given an original model M θ 0 trained on a datasetD, the goal is to unlearnD f ⊂D, which represents the subset of data points that must be for- gotten. Furthermore, we define ξ r : = (x r ,y r ) ∼ D r , where D r = D \ D f as the retain set, which consists of data points whose information must be preserved. The objective is to update the model parametersθ such that the unlearned model M θ no longer generates y f in response to x f while maintaining its original performance onD r . To achieve this goal, the unlearning procedure incorpo- rates a forgetting objective onD f and a retention objective onD r . Formally, the unlearning process is defined as (Yao, Xu, and Liu 2023; Fan et al. 2024): min θ E ξ f ∼D f [ℓ f (y f |x f ;θ)] +E ξ r ∼D r [ℓ r (y r |x r ;θ)], (1) where ℓ f and ℓ r represent the forget and retain losses, re- spectively. Specifically, the forget loss ℓ f determines how well the model M θ suppresses the association between x f and y f , ensuring unwanted information is unlearned. Mean- while, the retain loss ℓ r enhances the model’s ability to maintain accurate associations between x r and y r , preserv- ing its original performance onD r . Targeted Unlearning As discussed earlier, a majority of works (Si et al. 2023; Chen and Yang 2023; Zhang et al. 2024; Fan et al. 2024) have consistently treated the entire token sequence y f as the unlearning target for each sample ξ f : = (x f ,y f ) in the for- get setD f , overlooking a critical question central to the pro- cess of LLM unlearning. Are all the words in the forget sample essential for unlearning in LLMs? We hypothesize that “Only certain words in the forget samples are relevant to the unlearning target, while oth- ers are crucial for maintaining the model’s general utility.” To test this hypothesis, we refine the unlearning objective to focus on forgetting only certain UW, rather than the entire sequence y f . We decompose y f into ˆy and ̄y, where ˆy repre- sents UW containing unwanted (e.g., private or copyrighted) information that must be forgotten, and ̄y represents GW carrying general information (e.g., common or stop words). Notably, some tokens in ̄y may overlap with those in y r , in- troducing general information in the samples in D f shared with D r . Unlearning the entire y f may also unintention- ally remove shared information in ̄y, leading to a decline in the model’s performance on the retain set. Therefore, we emphasize that unlearning should exclusively target UW ˆy, ensuring that only the necessary information is unlearned while preserving general information. The refined targeted unlearning objective is formulated as: min θ E ξ f ∼D f [ℓ f (ˆy|x f ;θ)] +E ξ r ∼D r [ℓ r (y r |x r ;θ)],(2) where y f = ˆy∪ ̄y. Targeted Information Forgetting (TIF) To achieve effective unlearning while maintaining model utility, we introduce a two-stage framework: (1) An infor- mation identifier to differentiate between UW and GW in the unlearning samples. (2) A novel objective, TPO, that re- fines UW logits while retraining on GW, ensuring efficient unlearning without compromising utility. Unwanted Information Identification We investigate unwanted information identification through two distinct approaches, utilizing discriminative and gener- ative language models (LMs). Discriminative Encoder-Only LM. To detect unwanted information for unlearning tasks, we utilize an encoder- only LM, DistilBERT (Sanh 2019), denoted as M bert . This method leverages the contextual encoding of masked LMs to estimate the likelihood of each masked word, allow- ing differentiation between GW and UW. Firstly, given a sample ξ f : = (x f ,y f ) from the forget set, where y f = [w 1 ,· ,w i ,· ,w n ] is a word sequence, we sequentially replace each word w i in y f with a special [MASK] token. This transformation produces a masked sequence y ′ f i = [w 1 ,...,w ′ i ,...,w n ], where w ′ i = [MASK], as illustrated in the left panel of Figure 4. Next, the masked sequence y ′ f i is fed into M bert along with x f to predict the masked token, formally: w pred i = M bert (x f ,y ′ f i ). If the predicted masked token matches the original masked word, w i is la- beled as GW, indicating general information. Otherwise, w i is marked as UW for target unlearning. Generative Decoder-Only LM. To harness the power of generative decoder-only LMs in capturing contextual and se- mantic information from text, we employ ChatGPT-4 to di- rectly distinguish between UW and GW by analyzing the semantics of y f , as shown in the right panel of Figure 4. Detailed task instructions can be found in Table 7 in the Ap- pendix F. Furthermore, we also present a detailed compari- son of discriminative and generative approaches in relation to unlearning performance in Appendix D. Targeted Preference Optimization (TPO) Motivation. Although numerous unlearning methods, such as NPO (Zhang et al. 2024), have demonstrated strong performance on benchmarks such as TOFU (Maini et al. 2024) and MUSE (Shi et al. 2024), most of them struggle with model utility degradation when handling large forget sets (Liu et al. 2024a). Specifically, we evaluate the model utility and forgetting quality of NPO on TOFU, as illustrated in Figures 5 and 6. A significant decline in model utility is evident, with the score dropping from 0.76 to 0.11, high- lighting a severe utility degradation issue. We hypothesize that this degradation stems from NPO’s indiscriminate han- dling of the entire forget samples as unlearning targets, fail- ing to differentiate between unwanted and general informa- tion. Figure 5: Model utility across various methods on the TOFU forget05 task. Each line represents evaluations conducted at every epoch (6 steps). “–GPT” denotes the use of ChatGPT- 4 for unwanted information identification, while “PL” refers to the approach plus the PL Loss. Figure 6: Forget quality across various methods on the TOFU forget05 task. Each line represents evaluations con- ducted at every epoch (6 steps). “–GPT” denotes the use of ChatGPT-4 for unwanted information identification, while “PL” refers to the approach plus the PL Loss. To validate this, we integrate the unwanted information identifier into NPO, referred to as NPO-GPT in Figure 5. While NPO-GPT achieves a higher model utility score com- pared to the standard NPO, it still experiences a 74% decline in utility. These results suggest that merely incorporating an information identifier into NPO is insufficient to mitigate utility degradation significantly. To address this limitation, we propose TPO, a novel optimization approach designed to maintain model utility while ensuring effective unlearning. Preservation Loss (PL). To further investigate the rea- son for the model utility degradation observed in NPO-GPT, we analyze the cross-entropy loss values for GW, while the unlearning is limited to UW, as defined in Equation (2). Al- though the model is not explicitly optimized to forget GW, the increase in loss values for NPO-GPT indicates that GW are also forgotten, as shown in Figure 7. This observation naturally leads to our key idea: how can we prevent the for- getting effects on GW and, in turn, keep their loss values as Figure 7: Evaluation of cross-entropy loss values on GW for NPO-GPT and NPO-GPT+PL at each unlearning step. All results are obtained for the Forget05 task in the TOFU dataset, with models trained over 10 epochs. Figure 8: The KL divergence between the reference model and the unlearned models on both forget and retain sets. All results are obtained for the Forget05 task in the TOFU dataset, with models trained over 10 epochs. low as possible during unlearning optimization? To address this, we introduce the Preservation Loss (PL), which inte- grates a cross-entropy loss term on GW to explicitly prevent the model from forgetting general information, formally: ℓ PL (θ) =−E ξ f ∼D f logP θ ( ̄y|x f ) ,(3) where ̄y represents the GW. To validate the effectiveness of the PL term, we inte- grate it into NPO-GPT, forming NPO+PL-GPT, and eval- uate its performance. As illustrated in Figure 7, incorporat- ing PL helps maintain stable and low loss values for GW. Consequently, NPO+PL-GPT exhibits a significantly slower decline in model utility while achieving comparable forget quality to NPO and NPO-GPT, as shown in Figures 5 and 6. These initial results demonstrate that PL effectively miti- gates model utility degradation, particularly for preserving the general information we aim to retain. Logit Preference Loss (LPL). Upon further examination of Figure 5, we observe that model utility degradation per- sists even after incorporating unwanted information identi- fication (GPT) and PL into NPO, as seen in NPO+PL-GPT. We hypothesize that this issue stems from the limitations of NPO itself. Specifically, the unlearning process in NPO likely introduces excessive changes from the original model M θ o , which serves as a reference model with parameters kept frozen during unlearning, to the final unlearned model M θ , particularly affecting certain general information. To further validate this hypothesis, we analyze the logit distribution by computing the KL divergence betweenM θ o andM θ for both the forget and retain sets, as shown in Fig- ure 8. The high KL divergence observed in both sets sug- gests that M θ (NPO-GPT+PL) has unintentionally forgot- ten not only the unwanted information but also general infor- mation. Specifically, NPO functions by directly reducing the probability assigned to target tokens, which is computed us- ing the softmax function: P (y t ) = exp (z t ) P V j=1 exp(z j ) , where the V represents the vocabulary size, and z t denotes the logit for target token y t . However, reducing the probability of target token P (y t ) can be achieved not only by decreasing its log- its z t but also by increasing the logits of other tokens in the vocabulary. This unintended effect distorts the model’s over- all logit distribution, potentially compromising its ability to retain general information. The key challenge is to develop a new optimization strategy for the target tokens (UW) that selectively impacts their logit distribution while preserving the general information from GW. To tackle this challenge, we introduce Logit Preference Loss (LPL), which takes over NPO in suppressing unwanted information during unlearning, as: ℓ LPL (θ) =−E ξ f ∼D f 2 β logσ β 1 |ˆy| |ˆy| X i=1 (z θ o i − z θ i ) , (4) where z i here denotes the logit of target token ˆy i , andθ and θ o represent the parameters of the unlearned modelM θ and the original modelM θ o , respectively. Different from NPO, LPL explicitly reduces only the log- its of target tokens (UW) by enforcing a preference loss between M θ and M θ o . The primary function of LPL is to maximize the difference in target token logits between M θ and M θ o , while preserving the overall logit distribu- tion. This targeted approach ensures that only the unwanted information associated with the target tokens is unlearned, without affecting general information across other tokens. As a result, LPL enables a more precise unlearning process while significantly improving model utility retention. In summary, our proposed approach, Targeted Prefer- ence Optimization (TPO), for targeted unlearning is for- mulated as: E ξ f ∼D f − 2 β logσ β (z θ o (ˆy|x f )− z θ (ˆy|x f )) − logP θ ( ̄y | x f ) , (5) where LPL is applied to unlearn the unwanted information associated with UW (ˆy) and PL is used to preserve general information in GW ( ̄y). Finally, as the initial results shown in Figure 8, our ap- proach TPO-GPT minimizes the disruption to the logit dis- tribution on both the forget and retain sets compared to NPO+PL-GPT. Furthermore, TPO-GPT maintains most of the model utility while achieving a comparable level of for- get quality to the NPO-based methods, as shown in Figures 5 and 6. Experimental Setting Datasets and Metrics We evaluate the proposed approach alongside the base- line methods on the two widely used benchmark datasets: MUSE (Shi et al. 2024) and TOFU (Maini et al. 2024). (1) MUSE is a benchmark for unlearning the copy- righted content with two unlearning tasks: forgetting the Harry Potter books (termed ‘Books’) and news articles (termed ‘News’), respectively. To evaluate the effectiveness of unlearning and the preservation of utility for MUSE, we use three metrics: Verbatim Memorization (VerbMem), Knowledge Memorization (KnowMem), and Privacy Leak- age (PrivLeak). VerbMem and KnowMem are measured us- ing ROUGE-L F1 (Rouge 2004), where lower scores in- dicate reduced verbatim and factual memorization, respec- tively. PrivLeak quantifies privacy risks using the Min-K% Prob metric (Shi et al. 2023a) in a membership inference attack. A value close to zero indicates minimal privacy leakage, while large positive/negative values suggest over- /under-forgetting. We conduct our experiments on MUSE using ICLM-7B (Shi et al. 2023b) and LLaMA-2 7B (Tou- vron et al. 2023). (2) TOFU is a synthetic Q&A dataset of 200 author bi- ographies with three unlearning tasks: forget 1%, 5%, and 10% of the author profiles. We evaluate unlearning perfor- mance using two key metrics: Forget Quality and Model Utility as defined in (Maini et al. 2024). Forget quality is quantified using the p-value from a Kolmogorov-Smirnov (KS) test, where a higher p-value indicates greater similar- ity between the output distributions of the unlearned and the retained model. The retained model denotes retraining an LLM from scratch on the retain dataset while excluding the forget set and is regarded as the gold standard for un- learning (Maini et al. 2024; Zhang et al. 2024). Model utility measures the model’s performance on the retain set and its ability to retain real-world knowledge. This is assessed us- ing various metrics, including ROUGE-L (Rouge 2004) and Truth Ratio (Maini et al. 2024). Experiments on TOFU uti- lize LLaMA-2 7B and LLaMA-3.2 3B (Dubey et al. 2024). The LLMs and the evaluation metrics across unlearning benchmarks are summarized in Table 5 (Appendix). Unlearning Baselines We compare our method with baselines, i.e., GA, NPO, and SimNPO, on both MUSE and TOFU. For other baselines, such as Task Vector for MUSE and Kahneman-Tversky Op- timization (KTO) for TOFU, we strictly follow their original implementations outlined in their respective benchmarks. We also evaluate the impact of incorporating Gradient De- scent on the retain (GDR) loss with the baselines, i.e., GA GDR , NPO GDR , SimNPO GDR , and TPO GDR , on MUSE. Specifically, the GDR loss (Liu, Liu, and Stone 2022; Yao, Xu, and Liu 2023; Zhang et al. 2024; Shi et al. 2024) is a standard gradient descent objective applied to the cross- entropy loss on the retain setD r . This approach enables the model to be explicitly trained to maintain performance on the retain set D r . More details of all baseline methods are provided in Appendix E. Unwanted Information Identifier We employ two different unwanted information identifiers for TOFU dataset: a generative LM using ChatGPT-4o (via the web interface) and a discriminative LM using Distil- BERT (Section ). In Appendix D, we further examine the effectiveness of unlearning methods using both identifiers, showing that the generative LM approach enables a bet- ter balance between forget quality and model utility com- pared to the discriminative LM approach. For the MUSE dataset, which is non–QA in nature, we treat the beginning- of-sequence token <bos> as the input x, and define the re- maining tokens as the target sequence y. Because each sam- ple in the forget set of the MUSE Books dataset contains ap- proximately 175k words (more than 200k tokens), whereas current GPT models, including ChatGPT-4o, can only han- dle a maximum token window size of 128k tokens (roughly 100k words). Therefore, the GPT models cannot process all the information from individual samples. It is challenging to achieve stable and consistent UW identification with GPT models for the MUSE dataset. We thus only adopt the dis- criminative LM approach as the unwanted information iden- tifier on this dataset. Results and Discussion Performance on TOFU Unwanted information identification enhances unlearn- ing performance. We present the unlearning performance of baseline methods, i.e., GA, NPO, KTO, and SimNPO, along with those enhanced by the proposed unwanted in- formation identifier using GPT, i.e., GA-GPT, NPO-GPT, KTO-GPT, and SimNPO-GPT. TPO-GPT is our proposed method in this work. Figure 9 clearly shows that meth- ods utilizing the unwanted information identification consis- tently demonstrate a superior model utility while achieving a comparable level of forget quality in most scenarios. No- tably, for smaller forget set sizes (e.g., 1%), the unwanted in- formation identifier also enhances the forget quality of base- line methods like NPO-GPT, KTO-GPT, and SimNPO-GPT. These results underscore the effectiveness of selectively un- learning unwanted information while preserving general in- formation. TPO-GPT achieves the best forget quality on a larger forget set size. Figure 9 illustrates that all baseline methods experience a significant decline in forget quality as the forget set size increases. Notably, at a forget set size of 10%, GA- based and KTO-based methods fail completely in unlearn- ing for both LLaMA2 7B-Chat and LLaMA3.2 3B models, evidenced by their near-zero forget quality. Further, while Figure 9: Forget Quality versus Model Utility across varying forget set sizes (1%, 5%, and 10%) after unlearning. Results are presented for our method TPO-GPT and all baselines, including those incorporating the GPT-based unwanted information identifier. While the identifier improves model utility, all baselines face challenges in maintaining a good balance between forget quality and model utility as the forget set size increases. TPO-GPT demonstrates a notable trade-off. Data points represent the epoch at which each method achieves its peak forget quality. NPO-based and SimNPO-based methods achieve higher for- get quality, their performance also noticeably declines when the forget set size reaches 10%. In contrast, the developed TPO-GPT consistently demon- strates comparable forget quality on smaller forget set sizes (e.g., 1% and 5%) and achieves optimal forget quality on larger forget set sizes (e.g., 10 %) for both models. Notably, on LLaMA2 7B-Chat, TPO-GPT consistently achieves for- get quality exceeding 90% across different forget set sizes, as evidenced by the first row of Figure 9. TPO-GPT preserves utility while achieving the best trade-off under larger forget set sizes. As shown in Fig- ure 9, TPO-GPT consistently maintains high model util- ity and strong forget quality, even as the forget set size increases. At 1% and 5%, it achieves over 85% utility and near-perfect forget quality on both LLaMA-2 7B and LLaMA-3.2 3B. Notably, under the most challenging condi- tion of forgetting 10%, TPO-GPT still preserves 70% util- ity while maintaining the highest forget quality among all methods. These results highlight TPO-GPT’s effectiveness in balancing unlearning performance and model preserva- tion, especially under demanding unlearning scenarios. Performance on MUSE GDR significantly improves the utility preservation. As shown in the Table 1, nearly all unlearning methods suf- fer from severe utility degradation on the MUSE benchmark when GDR is not used. This is largely attributed to the large size of the forget set in the MUSE Benchmark, which poses a challenge to preserving general model performance. Incor- porating GDR consistently mitigates this issue and improves utility across all methods. TPO GDR consistently achieves the best PrivLeak perfor- mance. PrivLeak serves as the primary metric to measure the performance gap from the retained model defined in Sec- tion . Notably, our TPO GDR method consistently achieves PrivLeak values closest to 0 on both News (-6.12) and Books (-20.66), while maintaining comparable KnowMem and VerbMem scores on the forget set relative to other GDR- based baselines. Although Task Vector preserves high model utility on both tasks, it fails completely in unlearning, as its forget quality remains nearly identical to that of the original model. Overall, TPO offers the best trade-off between ef- fective unlearning (lowest PrivLeak) and reasonable utility retention, showing superior performance over all baselines. Related Work LLM Unlearning. Motivated by data privacy regulations Method Forget QualityModel Utility VerbMem KnowMem PrivLeakKnowMem D f (↓) D f (↓)(→ 0)D r (↑) MUSE News Original56.2663.66-99.8154.63 Retain19.8331.730.0055.25 GA0.000.0020.240.00 NPO0.000.0018.570.00 SimNPO0.002.122.800.00 TPO 0.000.002.600.00 Task Vector66.7462.53-10050.28 GA GDR 4.8921.18109.565.85 NPO GDR 0.0045.02109.5642.37 SimNPO GDR 35.3253.03-97.1745.82 TPO GDR 29.3854.67-6.1243.67 MUSE Books Original99.7045.87-57.1469.40 Retain 13.8830.130.0069.04 GA0.000.00-23.230.00 NPO 0.000.00-23.750.00 SimNPO0.000.00-10.601.16 TPO 0.150.00-19.500.00 Task Vector98.9441.63-76.9767.18 GA GDR 0.000.00-24.193.74 NPO GDR 0.000.00-27.8610.57 SimNPO GDR 0.001.62-25.8152.69 TPO GDR 5.203.79-20.6642.07 Table 1: Forget quality and model utility for various meth- ods on the MUSE dataset using LLaMA-2 7B. Large positive/negative PrivLeak values indicate over/under- unlearning. Bolded results represent the best performance. like the General Data Protection Regulation (GDPR) that gave individual users the “right to be forgotten” (Rosen 2011), machine unlearning was initially developed to re- move the effect of specific training examples without re- training the model on the entire data (Cao and Yang 2015; Bourtoule et al. 2021). Its effectiveness has been shown in different domains, including image classification (Sekhari et al. 2021; Fan et al. 2025) and federated learning (Wang et al. 2022; Jin et al. 2023). However, these unlearning meth- ods often become infeasible for LLMs due to the massive parameter sizes in LLMs. Recent efforts have adapted unlearning to LLMs by fine- tuning with gradient ascent on the forget set and gradient descent or KL divergence on the retain set (Li et al. 2024; Yao, Xu, and Liu 2023; Chen and Yang 2023; Jang et al. 2022; Wang et al. 2023; Tian et al. 2024; Liu et al. 2024d; Ji et al. 2024; Wang et al. 2024b; Zhao et al. 2024; Jia et al. 2024). Yet, existing methods (Yao, Xu, and Liu 2023; Liu, Liu, and Stone 2022) often struggle to balance forgetting and utility preservation, frequently resulting in catastrophic col- lapse, as observed on benchmarks like TOFU (Maini et al. 2024). To address this limitation, NPO (Zhang et al. 2024), inspired by direct preference optimization (DPO) (Rafailov et al. 2024), introduces a lower-bounded unlearning objec- tive to mitigate catastrophic collapse. Additionally, Sim- ple Negative Preference Optimization (SimNPO) (Fan et al. 2024) enhances NPO by proposing a reference-free variant, drawing inspiration from Simple Preference Optimization (SimPO) (Meng, Xia, and Chen 2024). However, the per- formance of these methods deteriorates as the size of the forget set increases (Liu et al. 2024a), underscoring the need for more robust and scalable solutions to achieve effective unlearning while preserving model utility. Targeted Unlearning. Recent work, such as RESTOR (Wan et al. 2025; Liu et al. 2024c; Rezaei et al. 2024), demon- strates that isolating and precisely targeting the informa- tion within the unlearning scope significantly improves the unlearning performance of existing methods (e.g., GA (Yao, Xu, and Liu 2023), WHP (Eldan and Russinovich 2023)), highlighting the crucial role of targeted unlearning. However, a major challenge remains: knowledge dependen- cies (Liu et al. 2024a) make it difficult to cleanly separate the information that should be forgotten from what should be retained. Recent methods tackle this challenge through var- ied strategies: MemFlex (Tian et al. 2024) leverages gradi- ent information to focus on sensitive parameters accurately. ECO (Liu et al. 2024a) proposes an efficient unlearning framework that localizes unlearning to sentences that con- tain content within the unlearning target by using a sentence- level identifier. However, (Thaker et al. 2024) shows that ECO’s classifier tends to overfit specific keywords rather than align with the unlearning requester’s intent, leading to insufficient unlearning when those keywords are absent or rephrased in the sentence. Additionally, SEUL (Wang et al. 2024a) achieves fine-grained information identification by incorporating a sensitive span annotation framework that uses an LLM (e.g., ChatGPT) to annotate specific spans con- taining sensitive information. This approach improves un- learning effectiveness by targeting specific continuous se- quence spans. However, it focuses solely on PII unlearn- ing, overlooking broader generalizability to various unlearn- ing tasks. (e.g., copyrighted content unlearning). Despite these advancements, challenges such as over- and under- forgetting remain, highlighting the need for more precise and robust solutions to disentangle information dependen- cies between forget and retention sets (Thaker et al. 2024; Liu et al. 2024b; Zhao et al. 2024). Conclusion In this work, we propose TIF, a framework that improves LLM unlearning by distinguishing between UW and GW. TIF employs the TPO objective to selectively unlearn UW while preserving GW. Experiments on TOFU and MUSE benchmarks show that TIF enhances unlearning effective- ness for existing unlearning methods and substantially pre- serves more model utility. Our study focuses on sequence unlearning by suppressing token generation, relevant to copyright and privacy protection. In contrast, knowledge un- learning (e.g., WMDP (Li et al. 2024)) targets unlearning entire distributions of hazardous knowledge from latent rep- resentations, advancing model security in domains such as biosecurity, cybersecurity, and chemical safety. Ethical Statement This work develops methods for targeted unlearning in large language models to enhance privacy and compliance with data protection laws. All experiments use public datasets (TOFU and MUSE) without personal or sensitive data. We highlight that unlearning techniques should be applied re- sponsibly to prevent misuse or selective information re- moval. Acknowledgments This work was supported in part by the National Science Foundation under Awards 2504264, 2211897, 2211896, and 2401775. References Bourtoule, L.; Chandrasekaran, V.; Choquette-Choo, C. A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N. 2021. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), 141–159. IEEE. Brown, T. B. 2020. Language models are few-shot learners. arXiv preprint arXiv:2005.14165. Cao, Y.; and Yang, J. 2015. Towards making systems for- get with machine unlearning. In 2015 IEEE symposium on security and privacy, 463–480. IEEE. Carlini, N.; Tramer, F.; Wallace, E.; Jagielski, M.; Herbert- Voss, A.; Lee, K.; Roberts, A.; Brown, T.; Song, D.; Erlings- son, U.; et al. 2021. Extracting training data from large language models.In 30th USENIX Security Symposium (USENIX Security 21), 2633–2650. Chen, J.; and Yang, D. 2023.Unlearn what you want to forget: Efficient unlearning for llms.arXiv preprint arXiv:2310.20150. Dubey, A.; Jauhri, A.; Pandey, A.; Kadian, A.; Al-Dahle, A.; Letman, A.; Mathur, A.; Schelten, A.; Yang, A.; Fan, A.; et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783. Eldan, R.; and Russinovich, M. 2023. Who’s Harry Pot- ter? Approximate Unlearning in LLMs.arXiv preprint arXiv:2310.02238. Ethayarajh, K.; Xu, W.; Muennighoff, N.; Jurafsky, D.; and Kiela, D. 2024. Kto: Model alignment as prospect theoretic optimization. arXiv preprint arXiv:2402.01306. Fan, C.; Liu, J.; Hero, A.; and Liu, S. 2025. Challenging forgets: Unveiling the worst-case forget sets in machine un- learning. In European Conference on Computer Vision, 278– 297. Springer. Fan, C.; Liu, J.; Lin, L.; Jia, J.; Zhang, R.; Mei, S.; and Liu, S. 2024. Simplicity Prevails: Rethinking Negative Pref- erence Optimization for LLM Unlearning. arXiv preprint arXiv:2410.07163. Ilharco, G.; Ribeiro, M. T.; Wortsman, M.; Gururangan, S.; Schmidt, L.; Hajishirzi, H.; and Farhadi, A. 2022. Editing models with task arithmetic.arXiv preprint arXiv:2212.04089. Jang, J.; Yoon, D.; Yang, S.; Cha, S.; Lee, M.; Logeswaran, L.; and Seo, M. 2022.Knowledge unlearning for miti- gating privacy risks in language models. arXiv preprint arXiv:2210.01504. Ji, J.; Liu, Y.; Zhang, Y.; Liu, G.; Kompella, R. R.; Liu, S.; and Chang, S. 2024. Reversing the Forget-Retain Objec- tives: An Efficient LLM Unlearning Framework from Logit Difference. arXiv preprint arXiv:2406.08607. Jia, J.; Zhang, Y.; Zhang, Y.; Liu, J.; Runwal, B.; Diffend- erfer, J.; Kailkhura, B.; and Liu, S. 2024. Soul: Unlocking the power of second-order optimization for llm unlearning. arXiv preprint arXiv:2404.18239. Jiang, J.; Wang, F.; Shen, J.; Kim, S.; and Kim, S. 2024. A Survey on Large Language Models for Code Generation. arXiv preprint arXiv:2406.00515. Jin, R.; Chen, M.; Zhang, Q.; and Li, X. 2023. Forgettable federated linear learning with certified data removal. arXiv preprint arXiv:2306.02216. Karamolegkou, A.; Li, J.; Zhou, L.; and Søgaard, A. 2023. Copyright violations and large language models.arXiv preprint arXiv:2310.13771. Li, N.; Pan, A.; Gopal, A.; Yue, S.; Berrios, D.; Gatti, A.; Li, J. D.; Dombrowski, A.-K.; Goel, S.; Phan, L.; et al. 2024. The wmdp benchmark: Measuring and reducing malicious use with unlearning. arXiv preprint arXiv:2403.03218. Liu, B.; Liu, Q.; and Stone, P. 2022. Continual learning and private unlearning. In Conference on Lifelong Learn- ing Agents, 243–254. PMLR. Liu, C. Y.; Wang, Y.; Flanigan, J.; and Liu, Y. 2024a. Large Language Model Unlearning via Embedding-Corrupted Prompts. arXiv preprint arXiv:2406.07933. Liu, S.; Yao, Y.; Jia, J.; Casper, S.; Baracaldo, N.; Hase, P.; Yao, Y.; Liu, C. Y.; Xu, X.; Li, H.; et al. 2024b. Rethink- ing machine unlearning for large language models. arXiv preprint arXiv:2402.08787. Liu, Y.; Zhang, Y.; Jaakkola, T.; and Chang, S. 2024c. Re- visiting Who’s Harry Potter: Towards Targeted Unlearn- ing from a Causal Intervention Perspective. arXiv preprint arXiv:2407.16997. Liu, Z.; Dou, G.; Tan, Z.; Tian, Y.; and Jiang, M. 2024d. Towards safer large language models through machine un- learning. arXiv preprint arXiv:2402.10058. Lynch, A.; Guo, P.; Ewart, A.; Casper, S.; and Hadfield- Menell, D. 2024. Eight methods to evaluate robust unlearn- ing in llms. arXiv preprint arXiv:2402.16835. Maini, P.; Feng, Z.; Schwarzschild, A.; Lipton, Z. C.; and Kolter, J. Z. 2024. Tofu: A task of fictitious unlearning for llms. arXiv preprint arXiv:2401.06121. Meng, Y.; Xia, M.; and Chen, D. 2024. Simpo: Simple preference optimization with a reference-free reward. arXiv preprint arXiv:2405.14734. Nguyen, T. T.; Huynh, T. T.; Ren, Z.; Nguyen, P. L.; Liew, A. W.-C.; Yin, H.; and Nguyen, Q. V. H. 2022. A survey of machine unlearning. arXiv preprint arXiv:2209.02299. Pawelczyk, M.; Neel, S.; and Lakkaraju, H. 2023. In-context unlearning: Language models as few shot unlearners. arXiv preprint arXiv:2310.07579. Rafailov, R.; Sharma, A.; Mitchell, E.; Manning, C. D.; Er- mon, S.; and Finn, C. 2024. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36. Rezaei, K.; Chandu, K.; Feizi, S.; Choi, Y.; Brahman, F.; and Ravichander, A. 2024.RESTOR: Knowledge Recovery through Machine Unlearning.arXiv preprint arXiv:2411.00204. Rosen, J. 2011. The right to be forgotten. Stan. L. Rev. Online, 64: 88. Rouge, L. C. 2004. A package for automatic evaluation of summaries. In Proceedings of Workshop on Text Summa- rization of ACL, Spain, volume 5. Sanh, V. 2019.DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108. Sekhari, A.; Acharya, J.; Kamath, G.; and Suresh, A. T. 2021. Remember what you want to forget: Algorithms for machine unlearning. Advances in Neural Information Pro- cessing Systems, 34: 18075–18086. Shi, W.; Ajith, A.; Xia, M.; Huang, Y.; Liu, D.; Blevins, T.; Chen, D.; and Zettlemoyer, L. 2023a. Detecting pre- training data from large language models. arXiv preprint arXiv:2310.16789. Shi, W.; Lee, J.; Huang, Y.; Malladi, S.; Zhao, J.; Holtzman, A.; Liu, D.; Zettlemoyer, L.; Smith, N. A.; and Zhang, C. 2024. Muse: Machine unlearning six-way evaluation for lan- guage models. arXiv preprint arXiv:2407.06460. Shi, W.; Min, S.; Lomeli, M.; Zhou, C.; Li, M.; Szilvasy, G.; James, R.; Lin, X. V.; Smith, N. A.; Zettlemoyer, L.; et al. 2023b. In-context pretraining: Language modeling beyond document boundaries. arXiv preprint arXiv:2310.10638. Si, N.; Zhang, H.; Chang, H.; Zhang, W.; Qu, D.; and Zhang, W. 2023. Knowledge unlearning for llms: Tasks, methods, and challenges. arXiv preprint arXiv:2311.15766. Thaker, P.; Hu, S.; Kale, N.; Maurya, Y.; Wu, Z. S.; and Smith, V. 2024.Position: LLM Unlearning Bench- marks are Weak Measures of Progress.arXiv preprint arXiv:2410.02879. Tian, B.; Liang, X.; Cheng, S.; Liu, Q.; Wang, M.; Sui, D.; Chen, X.; Chen, H.; and Zhang, N. 2024. To forget or not? towards practical knowledge unlearning for large language models. arXiv preprint arXiv:2407.01920. Touvron, H.; Lavril, T.; Izacard, G.; Martinet, X.; Lachaux, M.-A.; Lacroix, T.; Rozi ` ere, B.; Goyal, N.; Hambro, E.; Azhar, F.; et al. 2023. Llama: Open and efficient founda- tion language models. arXiv preprint arXiv:2302.13971. Wan, Y.; Ramakrishna, A.; Chang, K.-W.; Cevher, V.; and Gupta, R. 2025. Not Every Token Needs Forgetting: Se- lective Unlearning to Limit Change in Utility in Large Lan- guage Model Unlearning. arXiv preprint arXiv:2506.00876. Wang, J.; Guo, S.; Xie, X.; and Qi, H. 2022. Federated un- learning via class-discriminative pruning. In Proceedings of the ACM Web Conference 2022, 622–632. Wang, L.; Chen, T.; Yuan, W.; Zeng, X.; Wong, K.-F.; and Yin, H. 2023. Kga: A general machine unlearning frame- work based on knowledge gap alignment. arXiv preprint arXiv:2305.06535. Wang, L.; Zeng, X.; Guo, J.; Wong, K.-F.; and Gottlob, G. 2024a. Selective forgetting: Advancing machine unlearn- ing techniques and evaluation in language models. arXiv preprint arXiv:2402.05813. Wang, Y.; Wei, J.; Liu, C. Y.; Pang, J.; Liu, Q.; Shah, A. P.; Bao, Y.; Liu, Y.; and Wei, W. 2024b. LLM Unlearning via Loss Adjustment with Only Forget Data. arXiv preprint arXiv:2410.11143. Yao, Y.; Xu, X.; and Liu, Y. 2023. Large language model unlearning. arXiv preprint arXiv:2310.10683. Zade, S. Z.; Qiang, Y.; Zhou, X.; Zhu, H.; Roshani, M. A.; Khanduri, P.; and Zhu, D. 2025.Automatic calibration for membership inference attack on large language models. arXiv preprint arXiv:2505.03392. Zhang, R.; Lin, L.; Bai, Y.; and Mei, S. 2024. Negative pref- erence optimization: From catastrophic collapse to effective unlearning. arXiv preprint arXiv:2404.05868. Zhao, K.; Kurmanji, M.; B ̆ arbulescu, G.-O.; Triantafillou, E.; and Triantafillou, P. 2024. What makes unlearning hard and what to do about it. Advances in Neural Information Processing Systems, 37: 12293–12333. Zhou, X.; Qiang, Y.; Zade, S. Z.; Khanduri, P.; and Zhu, D. 2023. Hijacking large language models via adversarial in- context learning. arXiv preprint arXiv:2311.09948. Zhou, X.; Qiang, Y.; Zade, S. Z.; Roshani, M. A.; Khan- duri, P.; Zytko, D.; and Zhu, D. 2024. Learning to Poi- son Large Language Models for Downstream Manipulation. arXiv preprint arXiv:2402.13459. A Appendix: Additional Experiment Details A.1 Computational Configurations All experiments are conducted on 2 NVIDIA H100 GPU cards in a single node. (1) MUSE. We use LLaMA-2 7B fine-tuned on BBC news articles as the original model for News and ICLM-7B fine-tuned on Harry Potter books as the original model for Books. For unlearning, we trained the model for 10 epochs with a learning rate fixed at 1e −5 and a batch size of 32. We utilize the default setting for NPO with the value of parameter β fixed at 0.1. For TPO, we introduce a tuning weight for PL, formally: E ξ f ∼D f − 2 β logσ β(z ref (ˆy|x f )− z θ (ˆy|x f ) |z LPL −λ logP θ ( ̄y|x f ) | z PL . We conduct a grid search for β in a range of [0.1,0.3] and for λ in a range of [0,0.01]. The optimal β values, which deliver the best unlearning performance when TPO and TPO GDR achieve the best forget quality across various tasks and mod- els, are presented in Table 2. ModelTPOTPO GDR LLaMa-2 7B (News)0.20.2 ICLM-7B (Books) 0.20.2 Table 2: Optimal β values when TPO and TPO GDR achieve the best forget quality across different models and tasks in the MUSE benchmarks (News and Books). (2) TOFU. In all experiments, the models are trained us- ing the AdamW optimizer with a weight decay of 0.01. A linear warm-up is applied during the first epoch, with the learning rate fixed at 1e −5 and the batch size of 32. The orig- inal model is fine-tuned on TOFU for 5 epochs. Unlearning is performed on the initial model for 10 epochs using our TPO method and all baseline methods. For unlearning with NPO, we use the default setting, fix- ing the parameter β at 0.1. For TPO, the parameter β is tuned by searching within the range [0.1, 0.5] to obtain the best- performing model. We report the value of β that yielded the best unlearning performance when TPO achieves the best forget quality across different tasks and models in A.2 Computational Efficiency of the Unwanted Information Identification Distinguishing between UW from GW using either gener- ative or discriminative approaches remains computationally efficient and time-effective. For smaller data sets like TOFU, using a generative LM like ChatGPT-4o to process it takes several minutes. For larger datasets like MUSE, using a dis- criminative model like DistilBERT on our H100 server com- pletes the task in just a few hours. These customized ap- proaches highlight our method’s flexibility, computational efficiency, and scalability across diverse dataset sizes. Model TPO Forget 01Forget 05Forget 10 LLaMa-2 7B0.320.320.23 LLaMa-3.2 3B0.30.270.19 Table 3: Optimal β values when TPO achieves the best for- get quality across different models and tasks in the TOFU benchmarks. A.3 Evaluation Metrics We summarize the LLM models and the evaluation metrics used across various unlearning benchmarks in Table 5. A.4 Training Cost Analysis We evaluate the computational overhead of our proposed TPO-GPT compared to the baseline NPO-GPT. TPO-GPT requires only about 1.7× more training time and incurs roughly 6% higher GPU memory consumption. These re- sults indicate that TPO introduces moderate additional cost while providing substantial unlearning benefits. B Additional study on individual components of TPO Our TPO loss comprises two components: the LDL and the PL. To further disentangle their individual contributions, we conduct an ablation study on the Forget-05 subset of TOFU. The role of PL in maintaining model utility has been dis- cussed in Section , and its effectiveness is further demon- strated by the results in Table 4. Both LDL and NPO ex- hibit reduced utility degradation when combined with the PL loss. Moreover, LDL plays a central role in TPO by effec- tively balancing forget quality and model utility. Compared to NPO variants, LDL alone preserves substantially more utility, and when integrated with PL and our GPT-based un- wanted information identification process, it achieves the best trade-off between FQ and MU. These findings under- score the complementary roles of LDL and PL in enabling targeted unlearning. C Unlearning performance combining the GDR with the proposed TIF framework. Table 6 summarizes the forget quality and model utility of our TPO compared to several baseline approaches (i.e., GA, KTO, NPO, SimNPO), evaluated on the TOFU Forget 05 task. The experiments are conducted under two conditions: with and without incorporating Gradient Descent on Retain (GDR) loss, and with and without our GPT-based unwanted information identifier (GPT). Here, ”Vanilla” denotes meth- ods evaluated without incorporating the GPT-based identi- fier. The integration of our GPT-based unwanted informa- tion identifier consistently enhances both forget quality and model utility across most baseline methods, demonstrating the effectiveness of our proposed framework in accurately Forget 05NPONPO-GPTNPO+PL-GPTLDL-onlyLDL-GPTTPO (LDL+PL)-GPT FQ0.960.960.960.550.920.96 MU 0.110.210.420.510.630.67 Table 4: Comparison of unlearning performance on the Forget-05 subset of TOFU between LDL (a core component of TPO) and NPO methods. “F” denotes forget quality, and “MU” denotes model utility. BenchmarkUsed LLMForget qualityModel Utility MUSE ICLM-7B KnowMem onD f ↓ KnowMem onD r ↑VerbMem onD f ↓ LLaMa-2 7BPrivLeak(→ 0) TOFU LLaMa-2 7B Truth Ratio onD f ↑ Mean Probability, Rouge-L, Truth Ratio D r ,D realauthors ,D wordfacts ! ↑ LLaMa-3.2 3B Table 5: Summary of unlearning evaluation metrics and used models across different benchmarks. distinguishing unwanted information from general knowl- edge. Notably, our TPO method achieves the highest for- get quality on the LLaMa-2 7B model and preserves sub- stantially more model utility compared to all other baseline methods across all experimental conditions. These results highlight TPO’s effectiveness in unlearning and underscore the importance of accurate unwanted information identifica- tion in maintaining model utility. D Generative LM Approach vs Discriminative LM Approach. We compare the unlearning effectiveness of unlearning methods that separately incorporate generative LM-based and discriminative LM-based identifiers. As shown in Fig- ure 10, generative LM-based (GPT) methods (hexagonal markers) consistently achieve higher forget quality com- pared to discriminative LM-based (Bert) methods (triangu- lar markers). Additionally, GPT-based methods such as GA- GPT, KTO-GPT, SimNPO-GPT, and TPO-GPT preserve more utility. These results confirm the generative LM ap- proach’s superior effectiveness in unlearning compared to the discriminative approach. Among these, our TPO-based method achieves the best trade-off between forget quality and model utility, regardless of the identifier type. E Baselines In this section, we outline and analyze the baseline meth- ods used for comparison in our experiments. These methods represent established approaches in the field of machine un- learning and serve as benchmarks for evaluating the effec- tiveness of our proposed method. E.1 Gradient ascent Gradient ascent (GA) is a fundamental technique in many existing machine unlearning works (Yao, Xu, and Liu 2023; Jang et al. 2022) that prevents generating undesirable texts Figure 10: Forget Quality versus Model Utility on the Forget05 Task. The figure compares our method TPO with various baselines, integrating generative LM-based (GPT) and discriminative LM-based (DistilBERT) informa- tion identifiers. Hexagonal markers denote results from the unlearning methods using the GPT, while triangle markers correspond to the methods using DistilBERT. using only negative samples. The GA loss is shown as fol- lows: ℓ GA (θ) : =E ξ f ∼D f log P θ (y f |x f ) , where P θ (y|x) is the predicted probability of generating a sequence of tokens y by an LLM M θ conditioned on the prompt x. In gradient ascent, the objective is to increase the pre- diction loss on D f by inverting the direction of the cross- entropy objective. This technique often proves effective for smaller datasets and is typically limited to a few training epochs to prevent the model from collapsing into trivial solu- tions that degrade its overall utility (Tian et al. 2024). How- ever, if applied over a prolonged unlearning process, It can lead to catastrophic collapse, causing the model’s utility to MethodLLaMa-3.2 3BLLaMa-2 7B Forget QualityModel UtilityForget QualityModel Utility Original00.6300.76 Retain10.6910.76 VanillaGPTVanillaGPTVanillaGPTVanillaGPT GA0.000.01 ↑ 0.000.01 ↑ 0.000.01 ↑ 0.000.57 ↑ KTO0.090.98 ↑ 0.000.14 ↑ 0.000.00 ∼ 0.680.69 ↑ NPO0.630.02 ↓ 0.000.02 ↑ 0.960.96 ∼ 0.110.21 ↑ SimNPO0.020.03 ↑ 0.000.06 ↑ 0.920.63 ↓ 0.080.36 ↑ TPO-0.54-0.54-0.96-0.67 GA GDR 0.000.00 ∼ 0.560.56 ∼ 0.010.01 ∼ 0.430.61 ↑ KTO GDR 0.070.01 ↓ 0.00.02 ↑ 0.000.01 ↑ 0.730.08 ↓ NPO GDR 0.220.71 ↑ 0.600.44 ↓ 0.220.79 ↑ 0.560.56 ∼ SimNPO GDR 0.000.01 ↑ 0.610.64 ↑ 0.000.07 ↑ 0.710.72 ↑ TPO GDR -0.55-0.61-0.80-0.70 Table 6: Forget quality and model utility for our TPO method and various baselines evaluated on the TOFU Forget 05 task. Results are presented with and without incorporating Gradient Descent on Retain (GDR) loss and our GPT-based unwanted information identifier (GPT). Improvements achieved by incorporating the GPT-based identifier compared to methods without it (denoted as Vanilla) are marked as ↑ , similar performances as ∼ , and declines as ↓ . Best performances are boldfaced. degrade drastically, rendering it practically unusable (Zhang et al. 2024). E.2 Negative preference optimization (NPO) To tackle the catastrophic collapse, NPO (Zhang et al. 2024) redefines the preference optimization process to better align with unlearning objectives, by focusing solely on penalizing undesired outputs without requiring corresponding positive feedback. This approach ensures that the model suppresses the likelihood of generating sensitive or unwanted content from the forget setD f , effectively mitigating the risk of col- lapse while preserving overall utility in safe response gener- ation. The NPO loss is defined as: ℓ NPO (θ) : =− 2 β E ξ f ∼D f logσ − β log P θ (y f | x f ) P θ θ o (y f | x f ) , where σ(t) = 1/(1 + e −t ) is a sigmoid function, β > 0 is the inverse temperature. The term P ref (y f |x f ) denotes the probability assigned to token y f given an input x f by the original model M θ o , whose parameters remain frozen dur- ing unlearning. The NPO loss addresses the issue of catastrophic collapse by introducing a lower bound that holds for any finite β > 0, thereby ensuring a more stable unlearning process. E.3 Kahneman-Tversky optimization (KTO) We consider KTO (Ethayarajh et al. 2024) as another base- line method. KTO is an alignment technique that relies solely on non-paired preference data. Following (Zhang et al. 2024), we employ the same modified variant of the original KTO. The KTO loss is given as follows: ℓ KTO (θ) : =− 2 β E ξ f ∼D f logσ KL θ o − β log P θ (y f |x f ) P θ o (y f |x f ) , KL θ o (θ) : =E ξ f ∼D f β· KL(P θ (y safe |x f )||P θ o (y safe |x f )) , where y safe : = “I don’t know”, β > 0 is the inverse- temperature, and σ is the sigmoid function. Compared to NPO, KTO incorporates an additional “I don’t know” re- sponse for unrelated outputs, enhancing unlearning by align- ing it closely with human preferences for specific tasks. E.4 Task Vectors Task Vectors (Ilharco et al. 2022) provides an efficient mech- anism for modifying neural network behavior through sim- ple arithmetic on model weights, making them particularly effective for unlearning tasks. The process begins by fine- tuning the original model M θ 0 on forget set D f until the model overfits, producing a reinforced model M reinforce . A task vector is then computed to capture the difference in weight updates between the original model and the rein- forced model, formally defined as: M θ 0 and M reinforce , where formally: ∆M = M reinforce −M θ 0 . To achieve un- learning, this ∆M is subtracted from the original model’s weights. Formally: M θ =M θ 0 − ∆M. This approach intuitively drives the model parameters away from the trajectory induced by theD f , enabling the effective removal of learned information while preserving the general utility of the original model. Instruction for Chat-GPT: Identifying Unwanted Words in TOFU 1. Identify Important Words for All Question and Answer Pairs: • For each question and answer pair provided, identify the important words. • If the question explicitly asks for the author’s name, include the author’s name as an important word in the answer. • If the question does not ask for the author’s name, exclude the author’s name and focus on the other key words in the answer. 2. Key Words to Include: • Important words should directly answer the question and be sufficient to provide a complete and exact answer. • The selected words should be: * Proper nouns (excluding author names if not specifically asked). * Technical terms, specific concepts, or notable features that address the main details of the question. * Specific roles, occupations, places, or other information that directly contribute to the answer. 3. Key Words to Exclude: • Do not include words that are contextual but do not directly contribute to answering the question (e.g., “father” or “mother” if the question asks for their specific occupations). 4. Output Format: • Provide the results directly in the response. • For each question-answer pair, include a target words attribute. • The target words attribute should be a list of important words that precisely answer the question. 5. Example Output Structure: json Copy code [ “question”: “What are the contributions of Albert Einstein?”, “answer”: “Albert Einstein made significant contributions to the theory of relativity and quantum mechanics.”, “target words”: [ “theory of relativity”, “quantum mechanics” ] ] In this example: • The focus is on key details that exactly answer the question. • Words like “theory of relativity” and “quantum mechanics” directly represent Einstein’s contributions, and therefore, they are included as target words. Table 7: Comprehensive Instructions for Identifying UW (TOFU) using Chat-GPT: A systematic approach to extracting sensitive or unwanted words from question-answer pairs, focusing on precise and contextually relevant details while excluding extraneous information. Includes clear guidelines, examples, and a structured JSON output format for efficient processing. F Additional Experiment on the Generative Language Model Approach We present the task instruction used for identifying un- wanted words in the TOFU dataset in Table 7. To evalu- ate the robustness of unwanted word identification using a generative language model approach with ChatGPT-4o, we conducted three experiments with ChatGPT-4o on the TOFU Forget01 set. In all three experiments, the same instructions are used (Table 7). We evaluate the consistency of unwanted word identifica- tion by computing the Jaccard index across different runs of our generative approach using ChatGPT-4o. Specifically, we measure pairwise similarity between the unwanted word sets extracted in three independent experiments on the TOFU Forget01 set. The Jaccard index values for these pairwise comparisons are 0.887, 0.909, and 0.869, demonstrating that our instruction design ensures stable and consistent identifi- cation of unwanted words within the TOFU dataset. G Limitations While our TIF framework advances traditional sequence- level unlearning by operating at a targeted token-level gran- ularity, its effectiveness relies on the accuracy of the un- wanted information identifier. This design may not hold in settings where the unlearning target is conceptually dif- fuse or implicitly represented in the model’s knowledge, as in benchmarks like WMDP, which emphasize knowledge- level unlearning. In such cases, knowledge is often embed- ded in the distribution of words rather than localized to spe- cific tokens, making it difficult to identify and unlearn with- out broader context understanding. Our proposed framework currently focuses on sequence unlearning, where it is easier to identify the specific parts or words associated with the unlearning requester’s intent. Future work could explore ex- tending TIF with techniques for knowledge-based identifi- cation to address more diffuse, knowledge-level unlearning tasks.