Behavioral forgetting does not guarantee privacy in machine unlearning
Behavioral Forgetting Is Not Privacy in Machine Unlearning
Computation and Language
Summary
When a model is told to forget certain information, it often only forgets how to answer questions in a specific way or language. The authors found that even if a model seems to have forgotten something in one language, it might still remember it when asked in another language or script. This means just testing forgetting through one type of question isn't enough to ensure privacy. They suggest checking many ways that hidden information might be recovered to truly verify if forgetting is complete.
What this means in practice
- •For ai product developers: Improve tools that erase user data from AI models by ensuring forgotten information cannot be recovered via multiple languages or formats.
- •For privacy compliance teams: Validate machine unlearning processes beyond single-language tests to enhance compliance with data removal regulations.
Authors
Tyler Lizzo, Larry Heck
Abstract
Machine unlearning aims to remove targeted information from large language models, but existing evaluations often measure forgetting only on a designated benchmark distribution. We argue that such behavioral forgetting is an insufficient standard for privacy-oriented unlearning, and that evaluation should instead test whether forgetting persists across the access paths through which the same information may be recovered. We demonstrate this with a controlled case study of cross-lingual querying: across multiple multilingual model families, forgetting varies substantially when semantically equivalent information is queried in different languages and scripts. A single access path is therefore enough to expose a real gap between behavioral forgetting and information inaccessibility, motivating broader evaluation of access-path generalization and adversarial recoverability alongside in-distribution forgetting.