arXiv:2608.11408v1 Announce Type: new Abstract: Prior white-box studies show that large language models can retain latent traces of target knowledge after unlearning, even when the knowledge is no longer expressed in th
Sign in with a social account
当大语言模型被要求"遗忘"某些知识时——例如出于隐私合规或版权保护的需要——模型表面上可能不再输出相关内容，但深层表征中是否真的清除了这些信息？这篇来自 arXiv 的新论文指出，此前的白盒研究已经发现，即使模型不再显式表达目标知识，其内部仍可能保留潜在的痕迹。换句话说，模型学会了"闭嘴"，但未必真正"忘记"。
这一现象的核心矛盾在于：现有的遗忘评估方法大多只关注模型的行为输出（是否还能回答出被遗忘的内容），而很少深入检查模型内部表征中残留的信息。论文标题"Measure, Don't Optimize"（先测量，别急着优化）正是对这一现状的回应——作者认为，在缺乏可靠测量手段的情况下盲目追求遗忘效果，可能既无法真正消除隐患，也无法预测这些残留痕迹何时会"复苏"。
论文的核心主张是：与其不断调整遗忘算法的参数来追求表面上的遗忘效果，不如先建立一个能够预测"知识恢复"程度的测量框架。这里的"恢复"指的是，模型在某些条件下（如特定的提示方式、微调过程或对抗性攻击）重新显露出本应被遗忘的知识。
这一思路的转变具有实际意义。如果能够准确测量并预测遗忘后知识的恢复风险，开发者就可以在部署前评估模型的"遗忘稳定性"，而不是等到问题暴露后再补救。不过，关于具体的测量方法、实验设置和预测准确率等细节，原文摘要未提供更多信息。
这项研究触及了 LLM 治理中的一个关键痛点：遗忘的可验证性。在隐私法规（如 GDPR 的"被遗忘权"）和版权合规场景下，仅仅让模型"不再回答"可能不够——如果内部表征仍可被诱导恢复，法律和技术上的风险依然存在。对开发者而言，这意味着需要将遗忘评估从"行为层面"扩展到"表征层面"；对企业而言，则需要在部署遗忘后的模型前，建立更严格的验证流程。
值得注意的是，同批发布的 arXiv 论文中还涉及多智能体系统的治理、AI 人格克隆的身份框架等议题，反映出当前 AI 研究正在从单纯的性能优化，转向对系统行为可测量性、可预测性和可控性的更深入探讨。本文提出的"先测量、后优化"原则，或许正是这一趋势在模型遗忘领域的体现。
arXiv:2608.11408v1 Announce Type: new Abstract: Prior white-box studies show that large language models can retain latent traces of target knowledge after unlearning, even when the knowledge is no longer expressed in their outputs. However, existing audits remain limited to one-off diagnostics: it is unclear whether these residual signals can predict future recovery under continued training or serve as reliable optimization targets. Resolving this gap is essential to determine whether internal auditing can move beyond post-hoc evaluation toward proactive risk monitoring and safer unlearning. We propose J-Access, an inference-time audit that uses the Jacobian lens to map intermediate representations into vocabulary space and measures how often target concepts remain accessible along the model's output pathway. We hypothesize that residual accessibility reflects recovery susceptibility: knowledge that remains closer to the output pathway requires less fine-tuning to restore, leading to faster recovery. We audit 398 public unlearned models spanning eight unlearning methods. We find that: (1) most unlearned models retain access above the retain-only gold level; (2) pre-attack accessibility predicts recovery speed and extent at the model level, but cannot identify which specific facts will be recovered; and (3) directly minimizing J-Access does not promote genuine deletion. Instead, the model learns to hide knowledge from the audit, producing lower audit scores but greater post-attack recovery. These findings position J-Access as a model-level diagnostic for assessing residual susceptibility in unlearned models. We argue internal audits should serve as an independent diagnostic dimension in unlearning evaluation, and should not be converted into optimization targets without validation.