ConceptGuard: Benchmarking Context-Sensitive Unlearning in Large Language Models

AI summary

Overview

Research area: Machine unlearning and safety evaluation for large language models, with a focus on benchmark design.

Technical level: Advanced. The paper assumes familiarity with the standard forget-set/retain-set unlearning pipeline and with specific algorithms such as Gradient Ascent, SimNPO, RMU, and UNDIAL.

Scope: The paper introduces ConceptGuard, a 5,166-instance benchmark built from dual-use concepts in which harmful and benign usages of the same concept form complementary forget and retain sets, and uses it to test whether current unlearning methods can suppress harmful intent while preserving benign intent.

What This Paper Is About

Existing LLM unlearning benchmarks build forget sets and retain sets as disjoint collections of independent facts, and they score success by checking whether specific facts were erased or preserved. The authors argue that this framing misses the actual safety goal, which is to stop a concept from being used harmfully while keeping it usable in benign, educational, or professional contexts. ConceptGuard is their attempt to measure that goal directly by pairing harmful and benign examples of the same underlying concept and scoring whether a model separates them by intent.

Key Contributions

1. A critical analysis of existing LLM unlearning benchmarks (TOFU, MUSE, WMDP), arguing that both their disjoint dataset construction and their fact-level evaluation protocols fail to capture safe, context-sensitive unlearning.
2. The introduction of ConceptGuard, a benchmark built on dual-use concepts where the forget set contains harmful uses and the retain set contains benign uses of the same concepts, making the two sets explicitly complementary rather than independent.
3. An intent-sensitive evaluation protocol with six metrics plus a new contextual separation score (CtxtSep), computed per concept and aggregated by concept frequency weight.
4. An empirical study showing that current unlearning techniques perform poorly under conceptual overlap, with weak contextual separation and strong forgetting–utility trade-offs.

Main Findings

• Fine-tuning induces memorization as expected: After fine-tuning on the combined harmful and benign data, ROUGE scores rise sharply. For Qwen-2.5-3B-Instruct, HarmMem goes from 0.04 at base to 0.63 fine-tuned; for Llama-3.1-8B-Instruct, from 0.05 to 0.69.
• Gradient Ascent forgets hardest but collapses utility: It achieves the lowest HarmMem and HarmQA among methods, but utility drops severely. On Qwen-2.5-3B-Instruct it reduces HelpRet by 50% and HelpQA by 50% relative to base, and its CtxtSep falls to 0.01, a 95% decrease from the base model's 0.19.
• SimNPO and RMU give the most balanced trade-off: On Llama-3.1-8B-Instruct, SimNPO reaches HelpRet 0.55 (a 450% increase over base) and HelpQA 0.66 (a 113% increase), while RMU achieves HelpRet 0.44 and HelpQA 0.59. These two methods produce the highest contextual separation scores across both models.
• UNDIAL sits in between but improves with scale: It shows competitive forgetting with weaker retention, and its performance improves on the larger model, which the authors attribute to stronger concept representations in higher-capacity models.
• Contextual separation is only partially achieved: SimNPO and RMU score highest on CtxtSep in both models, but the authors state that performance can be significantly better, and the gap is more pronounced in the larger model.
• No uniformity across concepts: Concepts such as anonymity and social media show high variance across methods, suggesting that concepts grounded in human behavior under conflicting contexts are harder to unlearn uniformly. The top-3 and bottom-3 concept tables show no fixed set of concepts that remain consistently separable across methods or model scales. SimNPO tends to favor preference- or intent-framed concepts such as anonymity and social engineering, while RMU shows stronger separation on system-level or operational concepts such as automation and telecommunications; Gradient Ascent and UNDIAL behave diffusely.
• Forget set size matters only marginally: Reducing the proportion of the forget set (while holding the proportion of concepts in the retain set) produces a consistent but marginal increase in contextual separation across all methods and models, largely attributable to the increased influence of the retain set. The relative ranking of methods stays largely unchanged.
• LLM-as-a-judge results mirror the ROUGE results: Using GPT-5.4 as the judge, fine-tuned HarmScore rises to 0.65 for both base models, and CtxtSep drops from 0.19 to 0.13 on Qwen-2.5-3B-Instruct and from 0.22 to 0.05 on Llama-3.1-8B-Instruct.

Methodology in Plain English

The authors start from the LLM-LAT harmful dataset, which contains prompts designed to elicit unsafe behavior along with GPT-3.5 responses, and use the "rejected" column as the source of harmful instances. A GPT-5-based classifier (gpt-5-2025-08-07) tags each prompt with a high-level concept that could plausibly be used in both benign and harmful ways, while discarding concepts that are inherently malicious or too narrow, such as explicit bioterrorism or one-off exploits. Two graduate-level annotators (one MS in Computer Science, one MS in Cybersecurity) validated 15% (approximately 1,000) of the tagged instances, reaching Cohen's κ = 0.81.

Concepts are then aggregated: narrowly related ones, such as "SQL injection" versus "database exploitation" or "spam bots" versus "automated messaging abuse," are merged into broader parent categories. Groups were retained only when more than 90% of the same samples were marked for grouping by both annotators; unresolved disagreements and groups containing only 1–2 samples were discarded. This reduced 6,732 tagged instances to 2,583 validated harmful instances across 68 dual-use concepts.

For each harmful instance, GPT-5 generates a complementary benign instance under manual supervision: it extracts the underlying concept and fine-grained themes, writes a benign query using the same concepts safely, and produces a 180–250 word response that mirrors the structure and style of the harmful response. Fifteen percent (375) of these benign instances were independently reviewed, with Cohen's κ = 0.88. Each harmful instance paired with one benign counterpart yields the final 5,166-instance benchmark, evenly split between harmful and benign usage. Matching query sets (Q_f and Q_r) of the same size as the training sets were also generated by conditioning on the paired responses to elicit semantically similar answers without direct lexical overlap.

On the evaluation side, models are first fine-tuned on the union of the forget and retain sets, then an unlearning method is applied with respect to the forget set. Six metrics are used: HarmMem and HarmQA (ROUGE-L and ROUGE overlap with harmful references, lower is better), HarmScore (LLM-judge judgment of harmful wording or intent), HelpRet and HelpQA (ROUGE overlap with benign references, higher is better), and HelpScore (LLM judge for cohesion and utility of benign responses). Contextual separation is defined per concept as HelpScore_c minus HarmScore_c, then aggregated as a weighted sum with weights equal to a concept's share of the total query set. Experiments use Qwen-2.5-3B-Instruct and Llama-3.1-8B-Instruct, with GPT-5.4 rather than GPT-5 as the judge to avoid circular evaluation.

Why This Matters

Impact on research: The paper reframes unlearning success away from isolated fact deletion and toward intent-sensitive concept control, and provides an open benchmark with a public dataset (https://huggingface.co/datasets/sk0511/concept-guard). Its negative result — that strong benchmark performance on fact-level tests does not imply safe unlearning under conceptual overlap — challenges how the field validates unlearning methods.

Real-world applications:

• Safety filtering for dual-use domains such as cybersecurity, chemical synthesis, and social engineering, where the same knowledge is legitimate in classrooms and laboratories but dangerous under malicious intent.
• Regulatory and compliance workflows that need demonstrable removal of harmful model behavior without degrading service quality.
• Content moderation and red-teaming pipelines that must separate harmful intent from harmless discussion of the same topic.
• Educational and healthcare deployments, where models must answer constructively about sensitive subjects but refuse harmful applications.

Industry relevance: The measured forgetting–utility trade-off is directly relevant to practitioners who must decide how aggressively to unlearn without losing product quality. The finding that SimNPO and RMU retain the most utility while still reducing harmful memorization, and that UNDIAL improves with model scale, gives concrete guidance for method selection at different model sizes.

Future Directions

• The current dataset maintains a fixed distribution of concept frequencies; exploring alternative distributions, filtering strategies, and thematic groupings could reveal deeper insights into concept sensitivity.
• Varying the number and granularity of concepts would help establish the limits of contextual separation.
• Extending the benchmark to additional domains, languages, and more diverse concept spaces is a natural next step.
• Developing unlearning methods that explicitly optimize for contextual separation, rather than treating forgetting and retention independently, remains the key open challenge.

The paper also notes an impact caveat: unlearning methods could be misused to selectively suppress beneficial or factual information, raising controllability and misuse concerns, and robust, transparent, auditable methods are needed to mitigate this.

Target Audience

Researchers and graduate students working on LLM unlearning, safety alignment, and benchmarking; practitioners who select or deploy unlearning methods in safety-critical products; and evaluators or policy-oriented readers interested in how unlearning claims should be measured. Readers with a background in the standard forget-set/retain-set pipeline will get the most out of the results tables and the concept-level analysis.

Authors’ abstract

Large Language Models (LLMs) increasingly require selective removal of harmful or sensitive knowledge, called unlearning, yet existing methods and benchmarks fail to evaluate this capability completely. Current approaches rely on disjoint forget and retain sets composed of independent facts, and measure success using simple and direct factual recall. This framing fails to capture a key requirement of unlearning, namely the ability to eliminate harmful behaviors while preserving benign and beneficial knowledge. We argue that effective unlearning must operate at the level of concepts, ensuring complete removal of unsafe applications while maintaining their correct and useful usage, thereby achieving conceptually meaningful and complete unlearning. To better evaluate unlearning techniques from such a practical viewpoint, we introduce the notion of dual-use concepts: concepts that can be used in both harmful and benign contexts. Building on these concepts, we construct a benchmark called ConceptGuard where forget and retain sets are explicitly complementary in concept usage. Our benchmark uniquely enables unlearning to be explored and gauged at the level of concepts, instead of sparse facts, and evaluation is intent-sensitive with the goal of maximizing contextual separation to promote safer behavior. We demonstrate that current unlearning techniques perform poorly under this setting, showing weak contextual separation alongside poor performance in ROUGE and concept-level metrics. Our results reveal strong forgetting-utility trade-offs, limited gains in contextual sensitivity, and poor consistency in concept-level control across methods, and provide ideas for unlearning approaches that better align with real-world safety requirements. Our dataset is publicly available.