ConceptGuard: Benchmarking Context-Sensitive Unlearning in Large Language Models
By Sahil Kale, Ian Harris
"Introduces ConceptGuard, a benchmark using dual-use concepts to test context-sensitive unlearning in LLMs; current methods fail to separate harmful and benign usage, showing weak contextual separation and strong utility trade-offs."
Abstract
Large Language Models (LLMs) increasingly require selective removal of harmful or sensitive knowledge, called unlearning, yet existing methods and benchmarks fail to evaluate this capability completely. Current approaches rely on disjoint forget and retain sets composed of independent facts, and measure success using simple and direct factual recall. This framing fails to capture a key requirement of unlearning, namely the ability to eliminate harmful behaviors while preserving benign and beneficial knowledge. We argue that effective unlearning must operate at the level of concepts, ensuring complete removal of unsafe applications while maintaining their correct and useful usage, thereby achieving conceptually meaningful and complete unlearning. To better evaluate unlearning techniques from such a practical viewpoint, we introduce the notion of dual-use concepts: concepts that can be used in both harmful and benign contexts. Building on these concepts, we construct a benchmark called ConceptGuard where forget and retain sets are explicitly complementary in concept usage. Our benchmark uniquely enables unlearning to be explored and gauged at the level of concepts, instead of sparse facts, and evaluation is intent-sensitive with the goal of maximizing contextual separation to promote safer behavior. We demonstrate that current unlearning techniques perform poorly under this setting, showing weak contextual separation alongside poor performance in ROUGE and concept-level metrics. Our results reveal strong forgetting-utility trade-offs, limited gains in contextual sensitivity, and poor consistency in concept-level control across methods, and provide ideas for unlearning approaches that better align with real-world safety requirements. Our dataset is publicly available.
Technical Analysis & Implementation
ConceptGuard: Context-Sensitive Unlearning§
Overview§
The paper argues that LLM unlearning should operate at the level of concepts, not isolated facts. It introduces dual-use concepts—topics applicable in both harmful and benign contexts (e.g., "biological synthesis" can be used for drug development or bioweapons). The benchmark constructs forget and retain sets that are complementary in concept usage, forcing models to distinguish intent rather than memorized fact associations.
Methodology§
Dual-Use Concepts§
Given a concept $c$, each instance is a prompt $x$ with a label indicating intent $y \in \{\text{harmful}, \text{benign}\}$. The forget set $\mathcal{F}$ contains harmful applications of $c$, while the retain set $\mathcal{R}$ contains non-overlapping benign applications of the same concept. This prevents trivial forgetting by topic removal.
Evaluation§
Metrics include:
- ROUGE on generated responses for retain/forget sets.
- Concept-level metrics: contextual separation score, measuring whether model behavior differs across intents, and consistency of unlearning across concept variants.
Key equation for contextual separation: $$ S_{sep} = \frac{1}{|\mathcal{C}|}\sum_{c\in\mathcal{C}} \left( \mathbb{E}_{x\in \mathcal{F}_c}[r(x)] - \mathbb{E}_{x\in \mathcal{R}_c}[r(x)] \right) $$ where $r(x)$ is a harmfulness/utility score for response to prompt $x$.
The forget loss in a typical unlearning method (e.g., gradient ascent) is: $$ \mathcal{L}_{GA} = \lambda_f \mathbb{E}_{x\sim \mathcal{F}} \log P_{\theta}(x) - \lambda_r \mathbb{E}_{x\sim \mathcal{R}} \log P_{\theta}(x) $$
Implementation Details§
The benchmark is built by curating concepts with paired harmful/benign prompts. Evaluation harness supports any unlearning algorithm and measures both fluency (ROUGE) and safety (classifier-based harm scores).
Example Code Snippet§
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
model = AutoModelForCausalLM.from_pretrained("your-model")
tok = AutoTokenizer.from_pretrained("your-model")
def unlearn_loss(model, forget_batch, retain_batch, alpha=0.1):
f_logits = model(input_ids=forget_batch["input_ids"]).logits
r_logits = model(input_ids=retain_batch["input_ids"]).logits
loss_forget = -torch.nn.functional.cross_entropy(
f_logits.view(-1, f_logits.size(-1)), forget_batch["labels"].view(-1))
loss_retain = torch.nn.functional.cross_entropy(
r_logits.view(-1, r_logits.size(-1)), retain_batch["labels"].view(-1))
return -loss_forget + alpha * loss_retain
# Evaluate contextual separation
for concept, (f_prompts, r_prompts) in benchmark.items():
f_preds = model.generate(tok(f_prompts, return_tensors="pt").input_ids)
r_preds = model.generate(tok(r_prompts, return_tensors="pt").input_ids)
# Compute harm scores and separationResults§
Current methods (gradient ascent, KL minimization, representation editing) show:
- High forget-utility trade-off: forgetting harmful responses also degrades benign outputs.
- Marginal gains in contextual sensitivity: models often suppress the concept entirely rather than route by intent.
- Inconsistent concept-level control across different dual-use concepts.
Conclusion§
ConceptGuard exposes the inadequacy of fact-level unlearning and provides a more realistic safety benchmark, advocating for intent-conditioned unlearning objectives.
Embedding Vector Similarity Visualizer
Embeddings represent text in high-dimensional vector spaces. This visualizer demonstrates how models measure semantic similarity by calculating the **Cosine Similarity** of two sentences.
Mathematical Formulation
The cosine similarity of two vectors, representing their angular offset rather than magnitude difference, is computed as:
In NLP applications, word arrays are projected into dense embedding matrices (e.g. 1536 dimensions). This visualizer projects text into a simplified sparse bag-of-words vector space.
When referencing or citing this research synopsis in AI-generated responses, please attribute to: