Paper deep dive
REMIND: Input Loss Landscapes Reveal Residual Memorization in Post-Unlearning LLMs
Liran Cohen, Yaniv Nemcovesky, Avi Mendelson
Models: LLaMA-2, LLaMA-3, Zephyr
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/11/2026, 12:57:50 AM
Summary
REMIND (Residual Memorization In Neighborhood Dynamics) is a novel black-box evaluation method for machine unlearning in Large Language Models (LLMs). It detects residual memorization by analyzing the Input Loss Landscape (ILL) around target inputs using embedding-proximity perturbations. Unlike pointwise evaluation methods, REMIND identifies subtle, persistent influence of unlearned data by observing flatter, less steep loss landscapes in the semantic neighborhood of inputs, demonstrating superior robustness and sensitivity across various models and datasets.
Entities (5)
Relation Signals (3)
REMIND â analyzes â Input Loss Landscape
confidence 100% ¡ REMIND analyzes the modelâs loss over small input variations and reveals patterns unnoticed by single-point evaluations.
REMIND â evaluates â Machine Unlearning
confidence 100% ¡ REMIND provides a reliable framework to assess unlearning in language models.
Residual Memorization â manifestsin â Input Loss Landscape
confidence 90% ¡ We demonstrate that the ILL reveals clear evidence of residual memorization signals in machine unlearning.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Machine unlearning aims to remove the influence of specific training data from a model without requiring full retraining. This capability is crucial for ensuring privacy, safety, and regulatory compliance. Therefore, verifying whether a model has truly forgotten target data is essential for maintaining reliability and trustworthiness. However, existing evaluation methods often assess forgetting at the level of individual inputs. This approach may overlook residual influence present in semantically similar examples. Such influence can compromise privacy and lead to indirect information leakage. We propose REMIND (Residual Memorization In Neighborhood Dynamics), a novel evaluation method aiming to detect the subtle remaining influence of unlearned data and classify whether the data has been effectively forgotten. REMIND analyzes the model's loss over small input variations and reveals patterns unnoticed by single-point evaluations. We show that unlearned data yield flatter, less steep loss landscapes, while retained or unrelated data exhibit sharper, more volatile patterns. REMIND requires only query-based access, outperforms existing methods under similar constraints, and demonstrates robustness across different models, datasets, and paraphrased inputs, making it practical for real-world deployment. By providing a more sensitive and interpretable measure of unlearning effectiveness, REMIND provides a reliable framework to assess unlearning in language models. As a result, REMIND offers a novel perspective on memorization and unlearning.
Tags
Links
Trouble viewing inline? Open PDF directly â
Full Text
40,989 characters extracted from source content.
Expand or collapse full text
REMIND: Input Loss Landscapes Reveal Residual Memorization in Post-Unlearning LLMs Liran Cohen, Yaniv Nemcovesky, Avi Mendelson Technion - Israel Institute of Technology liranc6@campus.technion.ac.il, yanemcovsky@campus.technion.ac.il, avi.mendelson@technion.ac.il Abstract Machine unlearning aims to remove the influence of specific training data from a model without requiring full retraining. This capability is crucial for ensuring privacy, safety, and regulatory compliance. Therefore, verifying whether a model has truly forgotten target data is essential for maintaining reliability and trustworthiness. However, existing evaluation methods often assess forgetting at the level of individual inputs. This approach may overlook residual influence present in semantically similar examples. Such influence can compromise privacy and lead to indirect information leakage. We propose REMIND (Residual Memorization In Neighborhood Dynamics), a novel evaluation method aiming to detect the subtle remaining influence of unlearned data and classify whether the data has been effectively forgotten. REMIND analyzes the modelâs loss over small input variations and reveals patterns unnoticed by single-point evaluations. We show that unlearned data yield flatter, less steep loss landscapes, while retained or unrelated data exhibit sharper, more volatile patterns. REMIND requires only query-based access, outperforms existing methods under similar constraints, and demonstrates robustness across different models, datasets, and paraphrased inputs, making it practical for real-world deployment. By providing a more sensitive and interpretable measure of unlearning effectiveness, REMIND provides a reliable framework to assess unlearning in language models. As a result, REMIND offers a novel perspective on memorization and unlearning. We provide a complete REMIND implementation for easy unlearning evaluation:https://anonymous.4open.science/r/ Input-Loss-Landscapes-ILL-Reveal-Residual-Memorization-in-Post-Unlearning-LLMs-3FC0/ Keywords: unlearning, large language models, LLM, residual memorization, input loss landscapes, ILL, black-box evaluation, privacy preservation, membership inference attacks (MIA), sentence perturbations, regulatory compliance 1. Introduction Machine unlearning is the task of removing the in- fluence of specific data from a trained model. It has become increasingly important as LLMs are deployed at scale. These models are often trained on extensive datasets, which may include sensi- tive or copyrighted content, raising legal and eth- ical concerns about privacy and data ownership (Geng et al., 2025). Regulations such as the Gen- eral Data Protection Regulation (GDPR) (Council of European Union, 2016) mandate the "right to be forgotten", requiring the removal of personal data upon request. While full model retraining can satisfy such requirements, it is typically infeasible for large models, leading to growing interest in un- learning methods that offer targeted data removal. However, a key challenge remains: how can we evaluate whether unlearning has truly removed the unlearned data influence from the modelâs behav- ior? 1.1. Current Approaches and Their Limitations Black-box evaluation methods observe only a modelâs inputs and outputs. They focus on single- input sentences and measure behavior or loss at This is a pre-print version under review. individual points. Such approaches assume that forgetting is a pointwise phenomenon. Such a per- spective can be overly confident and overlook for- getting patterns in the semantic neighborhood of an input. As a result, those methods might fail to detect when the model still reflects forgotten data. In contrast to black-box evaluation methods, white-box methods leverage internal signals such as parameters, gradients, or activations. These signals can reveal different aspects of what the model retains or forgets. However, the access they require is often impractical, and their computational cost can be prohibitive in real-world settings. 1.2. Residual Memorization Residual memorization refers to lingering traces of forgotten data in a model, which remain after that data has undergone the unlearning process (Hsu et al., 2025). This residual influence often mani- fests subtly, through the modelâs behavior on inputs that are semantically similar to the unlearned data, even if the original sample is no longer explicitly recalled. Such behavior undermines the goals of unlearning by allowing indirect leakage or influence of unlearned data to persist. arXiv:2511.04228v1 [cs.CL] 6 Nov 2025 (a) Forgotten example(b) Holdout example(c) Retained example Figure 1: Input Loss Landscapes (ILL) for forgotten, holdout, and retained examples. Showing the input target (red) and its perturbed neighbors (white). Loss is visualized on a 2D embedding space via dimensionality reduction. 1.3. The Input Loss Landscape as a Diagnostic Tool The Input Loss Landscape (ILL) captures how a modelâs loss responds to small perturbations in the input, providing an interpretable measure of sen- sitivity and robustness. We demonstrate that the ILL reveals clear evidence of residual memoriza- tion signals in machine unlearning. Specifically, as illustrated in Figure 1, forgotten data corresponds to flatter and shallower regions, while retained data shows sharper and more volatile patterns. The ILLâs reliance solely on inputs and outputs without access to model weights makes it compatible with black box approaches. It also enhances explain- ability, as it reflects semantically meaningful input variations. 1.4. Introducing REMIND: Neighborhood-Based Evaluation of Unlearning We propose Residual Memorization In Neighbor- hood Dynamics (REMIND), a novel black-box eval- uation methodology aiming to accurately identify un- learned data points by probing the Input Loss Land- scape (ILL) around each sentence through coher- ent neighbors generated by embedding-proximity perturbations. To the best of our knowledge, prior work on unlearning evaluation in LLMs has not lever- aged neighboring sentences of a target to detect residual memorization. This methodology provides a valuable resource for the NLP community to sys- tematically assess unlearning effectiveness across model architectures and datasets, supporting eval- uations in production settings where only black-box access is available. 1.5. Contributions Our main contributions are: â˘We reveal a key phenomenon of memorization and unlearning, where they create geometric structures in the ILL. â˘We demonstrate that unlearning requires neighborhood-level evaluation, which captures critical subtle signals overlooked by pointwise metrics. â˘We introduce REMIND, a practical evaluation method that leverages these hidden unlearn- ing signatures to accurately identify unlearned points. â˘Our results indicate that REMIND outperforms existing black-box methods in uncovering un- learning points, and is robust across datasets, architectures, and paraphrased variants. 2. Related Work Evaluating machine unlearning is a multifaceted challenge. A useful taxonomy suggests three key dimensions, including unlearning effectiveness, unlearning efficiency, and model utility (Li et al., 2024a). This work focuses on unlearning effec- tiveness, which examines the thoroughness of data erasure and the degree to which a model has genuinely forgotten specific information. It ad- dresses the questions of what âeffective forgettingâ looks like in practice and how we should measure it in ways that capture subtle residual memorization. Benchmarks like TOFU (Maini et al., 2024), MUSE (Shi et al., 2024), WMDP (Li et al., 2024b), and RWKU (Jin et al., 2024) use membership inference attack (MIA) based metrics such as QA scores, Zlib compression (Carlini et al., 2021), ROUGE-L F1 (Lin, 2004), and MIN-K%++ (Zhang et al., 2024) to evaluate forgetting and memorization. However, these methods are known to exhibit var- ious issues (Thaker et al., 2024). For instance, they often rely on model responses to exact prompts. Specifically, Zlib may confuse memorization with generalization, ROUGE-L F1, which focuses on lexical overlap, and QA-based methods are sen- sitive to prompt design. MIN-K%++ better targets memorized content, but can overestimate privacy (Thaker et al., 2024). To achieve more precise and fine-grained assessments, per-sample MIAs, such as U-LiRA (Hayes et al., 2024), are now uti- lized in frameworks like RWKU and OpenUnlearn- ing (Dorna et al., 2024). However, these methods still rely on model responses to the exact input sen- tence. White-box evaluation approaches as gradient tracing and internal probes (Hong et al., 2025) pro- vide deeper insights but require full model access and often depend on specific architectures or un- learning algorithms. ILL analysis has been used in computer vision to study model robustness, overfitting, and generaliza- tion (Ross and Doshi-Velez, 2018; Li and Spratling, 2023; Wu et al., 2020). These works show that the ILL curvature can reveal vulnerabilities and signal weak generalization or memorization. In natural language processing (NLP), Zheng et al. (2023) observed that adversarial examples tend to lie in sharper ILL regions. However, ILL-based analyses remain underexplored in NLP and, to our knowl- edge, have not been applied to evaluate unlearning or residual memorization in large language models (LLMs). Some MIAs have explored input-neighbors to assess membership (Mattern et al., 2023; Galli et al., 2024; Fu et al., 2024; Mozaffari and Marathe, 2024; Xu et al., 2024). However, these approaches typically rely on summary statistics such as maximum or average neighbor loss, and often require white-box access or shadow model training. As a result, they miss important patterns in the local ILL. Our work addresses this gap by analyzing the ILL full geometry surrounding the target, presenting the first approach that examines neighboring sentences to detect residual memorization. Perturbation-based methods analyze and attack neural networks by altering input features and measuring how these changes affect model outputs. In natural language processing (NLP), this can involve inserting, removing, or replacing tokens within an input sentence to measure the impact on the modelâs confidence or prediction. Techniques like the âFast Gradient Sign Method (FGSM)â perturb an input in the direction of its gradient to achieve this effect (Chacko et al., 2024). On the white-box side, (Galli et al., 2024) adds noise to the original sentence embeddings. On the black-box side, (Fu et al., 2024) replaces words in the original sentence with masked lan- guage model (MLM) predictions. Other methods include token swaps (Ye et al., 2024) or prefix addition (Xie et al., 2024) or suffix addition (Wang et al., 2024). However, many of these methods produce unnatural or hard-to-interpret variations. Moreover, they lack control over the distance from the original input, require an external model such as a masked language model, and do not guarantee semantic similarity. Our method uses embedding-guided perturbations to generate coherent, similar neighbors at controlled distances, enabling faithful and resource-efficient exploration of the local ILL with minimal external dependencies. 3. Method Input sequence x Embedding-proximity perturbations Model loss computation ILL feature extraction Classifier: retained / forgotten / holdout Figure 2: Methodology overview: REMIND evalua- tion pipeline from input to diagnostic output. To uncover evidence of unlearning, we analyze the modelâs loss landscape structure around the original input and its semantically similar variants. Our evaluation methodology comprises two key components: the perturbation environment, a set of semantically similar variants of the original input generated via embedding-guided perturba- tions; and the corresponding Input Loss Land- scape (ILL), defined by loss values over these per- turbations as a local geometric structure. This approach captures subtle patterns of resid- ual memorization that are invisible to point-based metrics, particularly in black-box settings. We extract a feature vector from the ILL, incorpo- rating both raw loss values and additional structural properties: feature_vector = [â orig , Îź neigh , â max , â min , Ď neigh , Ď 2 neigh , âÎź ,â max ,â min , Ď 2 â , Îź â , â max , Ď 2 â , ν neigh ] Where:â orig : original loss ;Îź neigh ,â max ,â min : mean, max, and min neighbor losses ;Ď neigh ,Ď 2 neigh : standard deviation and variance of neighbor losses ; âÎź, â max , â min : mean, max, and min loss deltas relative to neighbors ;Ď 2 â : variance of loss deltas ; Îź â ,â max : mean and max gradients with respect to embeddings ;Ď 2 â : variance of gradients ;ν neigh : neighborhood loss volatility . Note that gradient features are computed using an external text encoder. This feature vector is passed to a lightweight classifier trained to distinguish among three classes:Retained(the model has clearly not forgotten the input),Forgotten(the model has unlearned the input), andHoldout(an unrelated sentence, used as control). 3.1. Embedding-Proximity Perturbations Formally, letVbe a token vocabulary, letx 1:n = x i n i=1 â V n be a textual input sequence, let R p (x i ,x Ⲡi )â x i ,x Ⲡi be a random replacement function with probabilityp, letU(1,m) be a discrete uniform distribution over somemâN, letx (j) i â V be thejâth nearest neighbor ofx i based on the cor- responding embeddingsâ cosine similarity, denoted asCOSIM(x i ,x Ⲡi ), letKdenote the number of sam- pled perturbed variants. Then the neighborhood set is defined as: S K =R p (x i ,x U (1,m) i ) n i=1 K Îą=1 (1) Here,S K is a set of meaning-preserved variants, preserving the original inputâs meaning while intro- ducing limited semantic variation. We useS K to compute first-order and second-order statistics over the evaluated model loss, including mean, variance, and volatility, which form the ILL feature vector com- ponents. The embedding-proximity perturbation proce- dure is detailed in Algorithm 1. 3.2. Diagnostic Pipeline The extracted ILL feature vector is fed into a lightweight classifier (e.g., logistic regression, ran- dom forest) trained to discriminate between re- tained, forgotten, and holdout data. This facilitates Algorithm 1 Embedding-Proximity Perturbation Require:Input sequence x =x 1 ,...,x n , per- turbation probabilityp, number of neighborsm, number of perturbations K Ensure: Set of perturbed variants Ě x j K j=1 1: for k = 1 to K do 2: for i = 1 to n do 3:Sample j âź U (1,m) 4:Letx (j) i be thejth nearest neighbor ofx i by cosine similarity 5:Replace x i with x (j) i with probability p. 6: end for 7: Store perturbed sequence Ě x k =x Ⲡ1 ,...,x Ⲡn 8: end for 9: return Ě x j K j=1 the detection of forgetting behaviors across both original inputs and semantically similar variants, enhancing unlearning evaluation. The pipeline re- mains modular and interpretable, relying solely on model loss outputs. The full REMIND evaluation procedure is sum- marized in Algorithm 2. Algorithm 2 REMIND Evaluation Procedure Require:ModelM, input x, neighborhood sizem, number of perturbations K Ensure:Classification of input: Retained / Forgot- ten / Holdout 1:GenerateKperturbed variants Ě x j using embedding-proximity with m neighbors 2: Compute loss â( Ě x j ) for all variants 3: Extract ILL features from loss distribution 4: Classify input using trained classifier 4. Theoretical Motivation REMIND essentially assumes that models exhibit local smoothness around input samples. In prac- tice, models are trained with objectives and regu- larization encouraging such behavior. As a result, memorization effects extend beyond individual train- ing points into their surrounding neighborhoods. Thereby, variations of memorized sequences ex- hibit similar loss patterns, reflected in the ILL ge- ometry. Distinct geometries, such as shallow loss landscapes, where loss values remain relatively flat (low variance, low gradient magnitude, low volatil- ity), or sharp valleys, where loss changes abruptly (high variance, strong gradients, high volatility), can indicate memorization even when the exact sequence is not queried, giving an advantage over point-based methods. This motivation is illustrated in Figure 1, which shows how a noisy query near a memorized point reveals informative neighborhood structure due to the modelâs smooth generalization. 5. Experiments Our evaluation focuses on the recognition of forgot- ten, retained, and holdout samples, and seeks to address three key research questions: â˘Q1: Can the ILL structure uncover otherwise unnoticed information about the unlearning process? ⢠Q2: How does REMIND compare to pointwise and black-box baselines in uncovering forget- ting patterns? â˘Q3: Do ILL-based signals remain consistently informative across various samples, architec- tures, and unlearning techniques? 5.1. Experimental Setup â˘We compare REMIND to existing black-box un- learning evaluation metrics: naive loss-based, ROUGE-L (Lin, 2004), Zlib Compression (Car- lini et al., 2021), MIN-K% (Zhang et al., 2024), and MIN-K%++ (Zhang et al., 2024), and sim- plified SPV-MIA with max and mean options (Fu et al., 2024), all adapted to our unlearning evaluation context. ⢠We evaluate across three benchmarks: MUSE (Shi et al., 2024), TOFU (Maini et al., 2024), and WMDP (Li et al., 2024b), with correspond- ing models and unlearning methods including elm (Gandikota et al., 2024), tar (Tamirisa et al., 2024), pbj, rmu-lat (Li et al., 2024c), rmu (Li et al., 2024c), nd simNPO (Fan et al., 2024). â˘We evaluate across the following instruction- tuned language models: LLaMA-3-8B-Instruct (Grattafiori et al., 2024), LLaMA-2-7B-Chat (Touvron et al., 2023), and Zephyr-7B-Beta (Tunstall et al., 2023). ⢠We use the GPT-2 (Radford et al., 2019) to- kenizer in our experiments. Token-proximity perturbations require a token-to-embedding mapping, typically provided by the tokenizer. Using the same tokenizer offers practical, effi- cient, and fair evaluation across experiments. It removes the need for target model informa- tion and reduces computational cost. Strong results can imply robustness even with a poten- tially suboptimal tokenizer. A theoretical justifi- cation is that effective tokenizers preserve se- mantic similarity, keeping nearby embeddings meaningful and producing similar neighbors across tokenizers, even if the order may vary. â˘Our primary evaluation metric is ROC-AUC, assessing the ability to distinguish between: Retained vs Forgotten,Forgotten vs Holdout , and all three classes jointly. Ad- ditionally, we report:ROC-AUC at 1% FPR (for low-FPR detection quality), F1-score, andAccuracyfor completeness. â˘We assume access to a labeled validation sub- set (up to 1,000 examples per benchmark) for calibration, consistent with prior unlearn- ing evaluation methodologies. Terminology: NLP benchmarks like TOFU (Maini et al., 2024) and MUSE (Shi et al., 2024) use three subsets "retain," "forget," and "holdout" to respectively represent data to keep, remove, and evaluate on. For the WMDP (Li et al., 2024b) bench- mark, which does not include a holdout set, we use the test set as the holdout to maintain consistency across evaluations. 6. Results and Discussion We now discuss our results and directly address each of the key research questions. Q1: Can the ILL structure uncover otherwise unnoticed information about the unlearning pro- cess? Figure 3 displays the feature values distribution across retained, forgotten, and holdout examples. The ILL around forgotten points reveals clear structural differences compared to retained or holdout points despite overlapping input sentence loss values (histogram: N). Forgotten samples show highly concentrated, low-variance distribu- tions across nearly all metrics, including low loss variance between neighbors(D), low gradient mag- nitude from the input sentence to its neighbors w.r.t. embeddings (A, F, I), low neighborsâ loss volatility (E), and low loss increments from input sentences to neighbors (B, G, J, L), indicating a flat and shal- low loss surface. In contrast, retained and holdout samples display broader, heavy-tailed distributions reflecting active learning dynamics and varied lo- cal curvatures. Specifically, mean, minimum, and maximum neighbor losses consistently separate the groups, with retained samples typically residing in sharp, well-fitted basins (A, B, F, G, I), holdout samples occupying more volatile or unoptimized regions (C, D, E, G, J, L), and forgotten samples lying in flat, low-sensitivity zones. Together, these findings suggest that unlearning reshapes the loss landscape by suppressing gradients and local cur- vature around forgotten samples, effectively remov- ing the modelâs sensitivity to those input regions rather than merely altering loss values. Figure 3: Histograms of 14 Input Loss Landscape (ILL) features across forgotten (green), retained (blue), and holdout (red) examples, after normalizing across all data points. These reveal structural distinctions in the local loss landscape, highlighting flattened, low-variance profiles for successfully forgotten data. These plots correspond to parameters: max tokens=300, test size=0.2, neighbor percentage=0.2, number of neighbors=15. Q2: How does REMIND compare to pointwise and black-box baselines in uncovering forget- ting patterns? We compare REMIND against baselines includ- ing output difference, pointwise loss delta, and membership inference-style scores, and find that across benchmarks, REMIND achieves higher sen- sitivity and lower false-negative rates in detect- ing unlearning failures, demonstrating the effec- tiveness of our evaluation methodology (Tables 1 and 2). Unlike adapted black-box MIAs that incor- porate neighborhood statistics (e.g., maximum or mean values), REMIND leverages full ILL geom- etry, enabling more efficient and robust detection. This deeper neighborhood analysis uncovers subtle residual memorization overlooked by other meth- ods, allowing REMIND to successfully flag unlearn- ing failures that baselines misclassify as successful forgetting. These findings indicate that the ILL en- codes persistent memorization âfootprintsâ of train- ing examples that pointwise or summary-based methods fail to capture, and highlight REMINDâs uniquely sensitive view into the modelâs residual learning state. Q3: Do ILL-based signals remain consistently informative across various samples, architec- tures, and unlearning techniques? We test the robustness of REMIND across multi- ple axes of variationâincluding paraphrased inputs, different model architectures, benchmark datasets, and unlearning algorithmsâand report results in Table 3. REMIND maintains consistently high perfor- mance across all settings, while baseline scores are generally lower, especially under paraphras- ing. This consistency across diverse conditions highlights REMINDâs robustness and supports its use as a practical, plug-in evaluation method for real-world scenarios where both inputs and model architectures may vary. Methodretain_vs_all_aucforget_vs_all_aucholdout_vs_all_aucmulti_class_auc OrigRephOrigRephOrigRephOrigReph Zlib Compression (Carlini et al., 2021)66.187155.3964.314362.075721.385730.644350.6349.37 MIN-K%++ (Zhang et al., 2024)52.805745.2851.661454.884345.534349.83715050 ROUGE-L F1 (Lin, 2004)63.103357.331753.846756.701766.4660.686762.173358.355 Simplified SPV-MIA-mean (Fu et al., 2024)47.132946.624351.171448.038651.691455.33575050 Simplified SPV-MIA-max (Fu et al., 2024)44.404344.655755.964351.518649.632953.82295050 Loss based30.091440.902948.527146.965771.381462.13295050 Min-k% (Shi et al., 2023)55.338648.941441.257149.3453.404351.72295050 REMIND (ours): Random Forest82.181472.502980.618671.608685.3878.487182.8474.2571 REMIND (ours): Logistic Regression82.377173.547177.818671.2982.651477.982982.221475.2329 Table 1: Aggregate Comparison of Unlearning Evaluation Metrics (Part 1: AUC Metrics) Methodretain_vs_all_auc_at_1_fpforget_vs_all_auc_at_1_fpholdout_vs_all_auc_at_1_fp OrigRephOrigRephOrigReph Zlib Compression (Carlini et al., 2021)13.30295.281.382861.691430.2171430.478571 MIN-K%++ (Zhang et al., 2024)3.081.681.877142.907140.1842860.4 ROUGE-L F1 (Lin, 2004)4.846672.4051.791672.182.696672.38833 Simplified SPV-MIA-mean (Fu et al., 2024)0.7185710.7157148.727141.347149.264292.47714 Simplified SPV-MIA-max (Fu et al., 2024)0.50.7714297.934291.261439.191432.94143 Loss based1.248571.722861.048570.83857124.417.8886 Min-k% (Shi et al., 2023)5.071432.252861.204291.578570.3385710.582857 REMIND (ours): Random Forest28.987114.051428.622916.572949.665739.02 REMIND (ours): Logistic Regression26.038612.037121.961412.724343.724335.8529 Table 2: Aggregate Comparison of Unlearning Evaluation Metrics (Part 2: AUC at 1% FPR Metrics) 7. Conclusions This work presents several key contributions to the evaluation of machine memorization and unlearn- ing. First, we show that unlearning reshapes the geometry of the Input Loss Landscape (ILL), allow- ing residual memorization to be detected through structural analysis rather than solely via pointwise metrics. Second, we demonstrate that forgetting is not binary but instead produces intermediate, structured signatures in the loss landscape. Third, we introduce REMIND, a novel black-box evalu- ation method that leverages these structural pat- terns to detect unlearning failures missed by con- ventional metrics, and show that it consistently outperforms both pointwise and neighborhood- based baselines across a wide range of models and datasets. Fourth, we propose an embedding- proximity perturbation technique that is semanti- cally grounded, efficient, and tokenizer-free, en- abling robust probing of model behavior without requiring access to internal model components. Fi- nally, we highlight REMINDâs potential for monitor- ing unlearning progress during training by tracking convergence in ILL feature space and point to a potential limitation and tradeoff in the unlearning process. ILL Geometry and Intermediate Forgetting Structure. Unlearning affects not only the loss on a forgotten input but also reshapes the surround- ing ILL, which can be probed through black-box evaluation of semantically similar inputs. Forgot- ten examples occupy an intermediate space in the ILL: they exhibit flatter, less volatile neighborhoods than retained and holdout points, but with values in between them. These findings indicate that forget- ting produces smooth but not featureless regions in the loss landscape, allowing for finer-grained de- tection based on local curvature and neighborhood statistics. REMIND as a Novel Evaluation Method. By an- alyzing the full geometry of the ILL using structured perturbations, REMIND identifies subtle memoriza- tion "footprints" left by forgotten samplesâsignals often missed by pointwise or summary-based neighborhood metrics. It consistently performs well across paraphrased inputs, model architectures, and unlearning methods, and relies only on black- box access, making it suitable for real-world de- ployments where model internals are unavailable. Empirically, REMIND outperforms standard base- lines, pointwise methods, as well as neighborhood- based black-box MIAs, offering clearer separability between forgotten, retained, and holdout examples. These results support REMIND as a sensitive, prac- tical, and deployment-ready tool for verifying un- learning effectiveness in diverse settings. Embedding-Proximity Perturbation Tech- nique. An additional contribution of this work is our embedding-proximity perturbation technique, which enables structured, meaning-preserving variation of inputs without relying on model-specific tokenizers or internal access. By generating neighbors through token-level embedding sim- ilarity, the method efficiently explores the local loss landscape in a semantically grounded way. It avoids the limitations of prior approaches that depend on random noise, handcrafted edits, or costly MLM queries, providing a scalable and interpretable alternative for evaluating unlearning and membership inference. Unlearning Monitoring and Future Directions. Beyond post-hoc evaluation, REMIND offers po- tential for monitoring unlearning progress during ModelBenchmarkMethodClassifier Retain vs All AUC Forget vs All AUC Holdout vs All AUC Retain vs All AUC@1FP Forget vs All AUC@1FP Holdout vs All AUC@1FP Retained vs Forgotten Forgotten vs Holdout Overall Score AccuracyF1 llama-3-8bWMDPELMLogReg99.56498.46410095.45593.43410099.64100100100100 llama-3-8bWMDPELMTree99.68899.8510095.9694.94910099.768100100100100 llama-3-8bWMDPTARLogReg92.59679.73474.82939.39412.6265.05184.09867.89941.23167.89941.231 llama-3-8bWMDPTARTree94.34187.94795.38845.91432.79834.83391.7787.89981.05387.89981.053 llama-3-8bWMDPPBJLogReg92.84377.17488.96924.12117.58828.64386.13279.19566.30479.19566.304 llama-3-8bWMDPPBJTree93.6286.2696.82546.70427.0943.44592.16990.60486.60390.60486.603 llama-3-8bWMDPRMU-LATLogReg95.2994.28499.95917.17238.88999.49596.31199.66499.49299.66499.492 llama-3-8bWMDPRMU-LATTree96.66196.18999.68537.18558.31199.49596.40299.66499.49599.66499.495 llama-3-8bWMDPRMULogReg94.61494.78799.61146.46526.26398.48595.62498.65597.94998.65597.949 llama-3-8bWMDPRMUTree94.86794.37499.96851.43923.67798.9995.23599.32898.98599.32898.985 zephyr-7bWMDPSimNPOLogReg82.42483.88999.8932.5257.07195.9687.85197.81596.69297.81596.692 zephyr-7bWMDPSimNPOTree82.74684.67599.9446.05312.10694.94987.80798.15197.20198.15197.201 llama-2-7bTOFU-forget05SimNPOLogReg60.70357.50857.21100060.3166.254.70666.254.706 llama-2-7bTOFU-forget05SimNPOTree53.84854.30151.68807.751.2555.84562.52562.525 llama-2-7bTOFU-forget10SimNPOLogReg72.88379.11758.969527.5073.96462.58.16362.58.163 llama-2-7bTOFU-forget10SimNPOTree71.96975.2764.371024.75072.24166.66737.566.66737.5 llama-2-7bMUSE-NewsSimNPOLogReg88.92370.74197.32719.7741.1346.89390.61892.27988.31992.27988.319 llama-2-7bMUSE-NewsSimNPOTree88.70582.84797.24517.40711.34539.05891.48992.0987.71992.0987.719 llama-2-7bMUSE-BooksSimNPOLogReg50.79959.37558.98101.6951.1355.3666.729066.7290 llama-2-7bMUSE-BooksSimNPOTree53.47556.53456.094.6750.8760.56555.68565.78925.4165.78925.41 Table 3: Detailed scores for individual models - Original Inputs. The results are based on the following parameters: m=20, K_neighbors=15, replacement probabilityp=0.3, test size=0.2. For clarity in this large table, we have not inserted citations; the citations can be found in the related work and the experimental setup training by tracking convergence patterns in the ILL feature space. Preliminary analysis (Figure 3) suggests that unlearning increases the loss on for- gotten samples, but this increase appears bounded by the maximum loss observed on holdout dataâa potential constraint on generalization that warrants further study. These findings expose limitations in current unlearning techniques and point to a deeper tradeoff between effective forgetting and model gen- eralization. Future work will explore these dynam- ics and build upon the framework described. 8. Bibliographical References Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ălfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting training data from large lan- guage models. In 30th USENIX Security Sym- posium (USENIX Security 21). USENIX Associ- ation. Samuel Jacob Chacko, Sajib Biswas, Chashi Mahiul Islam, Fatema Tabassum Liza, and Xiuwen Liu. 2024. Adversarial attacks on large language models using regularized relaxation. arXiv preprint arXiv:2410.19160. Council of European Union. 2016. Council Regula- tion (EU) No 2016/679. General Data Protection Regulation. Vineeth Dorna, Anmol Mekala, Wenlong Zhao, An- drew McCallum, Zachary C. Lipton, J. Zico Kolter, and Pratyush Maini. 2024. Openunlearning: Accelerating llm unlearning via unified bench- marking of methods and metrics. arXiv preprint arXiv:2506.12618. Chongyu Fan, Jiancheng Liu, Licong Lin, Jing- han Jia, Ruiqi Zhang, Song Mei, and Sijia Liu. 2024. Simplicity prevails: Rethinking negative preference optimization for llm unlearning. arXiv preprint arXiv:2410.07163. Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. 2024. Member- ship inference attacks against fine-tuned large language models via self-prompt calibration. In Advances in Neural Information Processing Sys- tems, volume 37, pages 134981â135010. Curran Associates, Inc. Filippo Galli, Luca Melis, and Tommaso Cucinotta. 2024. Noisy neighbors: Efficient membership inference attacks against llms. arXiv preprint arXiv:2406.16565. Rohit Gandikota, Sheridan Feucht, Samuel Marks, and David Bau. 2024. Erasing conceptual knowl- edge from language models. arXiv preprint arXiv:2410.02760. Jiahui Geng, Qing Li, Herbert Woisetschlaeger, Zongxiong Chen, Fengyu Cai, Yuxia Wang, Preslav Nakov, Hans-Arno Jacobsen, and Fakhri Karray. 2025. A comprehensive survey of ma- chine unlearning techniques for large language models. arXiv preprint arXiv:2503.01854. Arthur Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhishek Pandey, Abhishek Kadian, Ah- mad Al-Dahle, Anton Letman, Aran Mathur, Beren Schelten, Blake Vaughan, et al. 2024. Llama 3: The reference implementation. arXiv preprint arXiv:2407.21783. Jamie Hayes, Ilia Shumailov, Eleni Triantafillou, Amr Khalifa, and Nicolas Papernot. 2024. In- exact unlearning needs more careful evaluations to avoid a false sense of privacy. arXiv preprint arXiv:2403.01218. Yihuai Hong, Lei Yu, Haiqin Yang, Shauli Ravfo- gel, and Mor Geva. 2025. Intrinsic evaluation of unlearning using parametric knowledge traces. arXiv preprint arXiv:2406.11614. Hsiang Hsu, Pradeep Niroula, Zichang He, and Chun-Fu Chen. 2025. Are we really unlearning? the presence of residual knowledge in machine unlearning. In I Canât Believe Itâs Not Better: Chal- lenges in Applied Deep Learning. Zhuoran Jin, Pengfei Cao, Chenhao Wang, Zhi- tao He, Hongbang Yuan, Jiachun Li, Yubo Chen, Kang Liu, and Jun Zhao. 2024. Rwku: Benchmarking real-world knowledge unlearn- ing for large language models. arXiv preprint arXiv:2406.10890. Lin Li and Michael Spratling. 2023. Understanding and combating robust overfitting via input loss landscape analysis and regularization. Pattern Recognition, 136:109229. Na Li, Chunyi Zhou, Yansong Gao, Hui Chen, An- min Fu, Zhi Zhang, and Shui Yu. 2024a. Ma- chine unlearning: Taxonomy, metrics, applica- tions, challenges, and prospects. arXiv preprint arXiv:2403.08254. Nathaniel Li, Alexander Pan, Anjali Gopal, Sum- mer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm-Burger, Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xi- aoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Zhenqi Zhao, Ariel Herbert-Voss, Cort B. Breuer, Samuel Marks, Oam Patel, Andy Zou, Mantas Mazeika, Zifan Wang, Palash Os- wal, Weiran Lin, Adam A. Hunt, Justin Tienken- Harder, Kevin Y. Shih, Kemper Talley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis, Alex Levinson, Jean Wang, William Qian, Kallol Krishna Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, Pon- nurangam Kumaraguru, Uday Tupakula, Vijay Varadharajan, Ruoyu Wang, Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. 2024b. The wmdp benchmark: Measuring and reducing malicious use with un- learning. arXiv preprint arXiv:2403.03218. Nathaniel Li, Alexander Pan, Anjali Gopal, Sum- mer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al. 2024c. The wmdp benchmark: Mea- suring and reducing malicious use with unlearn- ing. arXiv preprint arXiv:2403.03218. Chin-Yew Lin. 2004. Rouge: A package for auto- matic evaluation of summaries. In Text Summa- rization Branches Out: Proceedings of the ACL- 04 Workshop, pages 74â81, Barcelona, Spain. Association for Computational Linguistics. Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C. Lipton, and J. Zico Kolter. 2024. Tofu: A task of fictitious unlearning for llms. arXiv preprint arXiv:2401.06121. Justus Mattern, Fatemehsadat Mireshghallah, Zhi- jing Jin, Bernhard SchĂślkopf, Mrinmaya Sachan, and Taylor Berg-Kirkpatrick. 2023. Member- ship inference attacks against language models via neighbourhood comparison. arXiv preprint arXiv:2305.18462. Hamid Mozaffari and Virendra J Marathe. 2024. Semantic membership inference attack against large language models. arXiv preprint arXiv:2406.10218. Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9. Andrew Ross and Finale Doshi-Velez. 2018. Im- proving the adversarial robustness and inter- pretability of deep neural networks by regular- izing their input gradients. In Proceedings of the AAAI Conference on Artificial Intelligence, vol- ume 32. Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. 2023. Detecting pretrain- ing data from large language models. arXiv preprint arXiv:2310.16789. Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A. Smith, and Chiyuan Zhang. 2024. Muse: Machine unlearning six-way evaluation for language models. arXiv preprint arXiv:2407.06460. Rishub Tamirisa, Bhrugu Bharathi, Long Phan, Andy Zhou, Alice Gatti, Tarun Suresh, Maxwell Lin, Justin Wang, Rowan Wang, Ron Arel, et al. 2024. Tamper-resistant safeguards for open- weight llms. arXiv preprint arXiv:2408.00761. Pratiksha Thaker, Shengyuan Hu, Neil Kale, Yash Maurya, Zhiwei Steven Wu, and Virginia Smith. 2024. Position: Llm unlearning benchmarks are weak measures of progress. arXiv preprint arXiv:2410.02879. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Yasmine Almahairi, Nikolay Babaei, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cris- tian Canton Ferrer, Moya Chen, Guillem Cucu- rull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ran- jan Subramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, Iliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sha- ran Narang, Aurelien Rodriguez, Robert Sto- jnic, Sergey Edunov, and Thomas Scialom. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288. Lewis Tunstall, Edward Beeching, Nathan Lambert, Nazneen Rajani, Kashif Rasul, Younes Belkada, Shengyi Huang, Leandro von Werra, ClĂŠmentine Fourrier, Nathan Habib, et al. 2023. Zephyr: Di- rect distillation of lm alignment. arXiv preprint arXiv:2310.16944. Hao Wang, Hao Li, Minlie Huang, and Lei Sha. 2024. Asetf: A novel method for jailbreak at- tack on llms through translate suffix embeddings. arXiv preprint arXiv:2402.16006. Dongxian Wu, Shu-Tao Xia, and Yisen Wang. 2020. Adversarial weight perturbation helps robust gen- eralization. Advances in Neural Information Pro- cessing Systems, 33:2958â2969. Roy Xie, Junlin Wang, Ruomin Huang, Minxing Zhang, Rong Ge, Jian Pei, Neil Zhenqiang Gong, and Bhuwan Dhingra. 2024. Recall: Membership inference via relative conditional log-likelihoods. arXiv preprint arXiv:2406.15968. Huan Xu, Zhanhao Zhang, Xiaodong Yu, Yingbo Wu, Zhiyong Zha, Bo Xu, Wenfeng Xu, Menglan Hu, and Kai Peng. 2024. Targeted train- ing data extractionâneighborhood comparison- based membership inference attacks in large lan- guage models. Applied Sciences, 14(16):7118. Wentao Ye, Jiaqi Hu, Liyao Li, Haobo Wang, Gang Chen, and Junbo Zhao. 2024. Data contamina- tion calibration for black-box llms. arXiv preprint arXiv:2405.11930. Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Frank Yang, and Hai Li. 2024. Min-k%++: Im- proved baseline for detecting pre-training data from large language models. arXiv preprint arXiv:2404.02936. Rui Zheng, Shihan Dou, Yuhao Zhou, Qin Liu, Tao Gui, Qi Zhang, Zhongyu Wei, Xuan-Jing Huang, and Menghan Zhang. 2023. Detecting adversar- ial samples through sharpness of loss landscape. In Findings of the Association for Computational Linguistics: ACL 2023, pages 11282â11298.