arXiv 论文提出可审计机器遗忘：为 LLM 数据删除提供证据
Auditable Unlearning for LLMs
删除数据后怎么证明真的删干净了？这篇论文给 LLM 遗忘加了第四个评估维度，还给出了能套在任何方法上的两阶段方案。
论文在 TOFU、MUSE 和 RWKU 三个基准上评估了 11 种机器遗忘方法，发现没有任何方法能同时满足遗忘效果、能力保留、抗成员推断攻击和可审计性四个维度。作者提出两阶段方法作为任意遗忘方法的附加层：第一阶段 GapWiden 用 hinge 损失拉开遗忘集与保留集的审计统计量差距，第二阶段 GapVeil 在推理时以基座模型为 drafter 做拒绝采样。实验显示该方法使可审计性与数据泄漏达到 oracle 水平，11 种方法中有 9 种的保留性能得到提升。
Auditable Unlearning for LLMs
Machine unlearning aims to remove a user's data from a trained model after a deletion request. Existing methods are majorly evaluated on three axes - how well they forget, how much capability they retain, and how robust they are to membership inference attacks, but not on whether the provider can offer the user any evidence that the deletion occurred. To fill this gap, we introduce auditability as a fourth axis, defined as the separation between requested (forget set) and retained (retain set) data under a statistic the provider computes. We show that across eleven unlearning methods on TOFU, MUSE and RWKU no method satisfies all four axes, with different methods falling short on different axes. To address this, we propose a two stage method that can be used on top of any unlearning method, in the the first stage we propose ${GapWiden}$ which uses a hinge loss to increase the difference between audit statistics of forget set and retain set. In the second stage we propose ${GapVeil}$, an inference time rejection-sampler which uses the base model as the drafter and re-samples based on the audit statistics of the drafted response. We observe that using our method, auditability and leakage reach oracle parity for every unlearning method, and forget performance converges to the oracle; retain performance improves for nine of eleven methods but remains short of parity. Our results show that evidence of deletion or auditability can be constructed by design, and that treating it as an explicit requirement changes the viability of existing unlearning methods.
