AI 安全與模型反學習
ConceptGuard Pairs Beneficial and Harmful Uses of the Same Concept, With a Best Context Separation Score of Just 0.38
ConceptGuard no longer treats the forget and retain sets as unrelated facts. Instead, it requires models to suppress harmful uses of a technology while preserving legitimate ones. All four unlearning methods exhibit a trade-off between forgetting and utility, with highly inconsistent results across concepts.
Most large language model unlearning evaluations separately measure whether designated content has been forgotten and whether other capabilities have been preserved. However, this division struggles to handle dual-use knowledge in areas such as cybersecurity, chemical synthesis, and anonymity technologies. ConceptGuard therefore pairs harmful and benign uses of the same underlying concept as complementary examples, directly testing whether a model can selectively suppress behavior based on intent rather than deleting the entire concept.
The dataset contains 5,166 examples, split evenly between the forget and retain sets. Common topics include cybersecurity, social engineering, and misinformation. Harmful data comes from LLM-LAT. The researchers used GPT-5 to classify dual-use concepts and generate benign controls with similar structure and length, adding human oversight at all three stages of dataset construction. Evaluation combines ROUGE, question-answering performance, and a context separation metric calculated by subtracting the harmful HarmScore from the benign HelpScore.
The team compared gradient ascent, SimNPO, RMU, and UNDIAL on Qwen-2.5-3B-Instruct and Llama-3.1-8B-Instruct. Gradient ascent was the most effective at reducing harmful outputs, but it drove Qwen’s HelpScore down to just 0.08. SimNPO and RMU preserved utility more effectively. On Llama, RMU achieved the highest context separation score of 0.38, although its HarmScore remained at 0.21. Method rankings also reversed across concepts such as anonymity, social engineering, chemical synthesis, and automation, indicating that stable, fine-grained control has yet to be achieved.
These findings caution safety engineers that low accuracy on harmful prompts may simply reflect a broad reduction in model capability and cannot, by itself, demonstrate successful unlearning. However, the dataset’s benign controls were synthesized by GPT-5, while GPT-5.4 was used as the evaluator, and the experiments covered only two relatively small models and a single language distribution. Future work must incorporate human-written examples, multilingual data, adversarial paraphrases, and larger models to determine whether context separation can generalize.