The More Popular, The Harder to Forget: Adaptive Popularity for LLM Unlearning
Anna Borisiuk, Andrey Savchenko, Alexander Panchenko, Elena Tutubalina
cs.CL
2026-08-14
AdaPop maps external popularity to a per-fact exponent and auto-tunes retain. On three 7-8B models it leaks ~5x less under paraphrase and ~1.6x less under adversarial prompts.
Machine unlearning is supposed to delete a targeted set of facts without a full retrain. Gradient methods treat every forget example as equally hard. That assumption is false: facts seen more often in pretraining are encoded more deeply and resist removal. Uniform pressure produces a popularity gap. Rare facts get over-erased and damage retain quality; popular facts survive paraphrase and adversarial prompts. Krishnan et al. and Borisiuk et al. measured the gap. Neither offered a training-time fix.
Confidence-weighted methods such as WGA reweight by the model's current token probability. Confidence tracks what the model is emitting now, not how deeply the fact sits in the weights. Once the surface answer is suppressed, the weight saturates and the parametric copy remains.
AdaPop treats unlearning as constrained optimisation: raise forget loss while bounding retain drift. The two jobs are split.
Popularity is an external signal. Each forget sample carries a score si, usually Wikidata sitelink counts, or an LLM-as-Judge rating when no knowledge base exists. The score maps to a power-law exponent βi = a · si^{-b}. Anchors come from the ends of the DUET distribution: rare \approx 100 gets β=1.5, popular \approx 3000 gets β=0.1, which solves to (a,b)=(58.7, 0.796). Exponents are clipped so outliers cannot explode the gradient.
The per-token weight is current confidence raised to β, stop-gradiented, then multiplied into NLL. The backward pass runs through NLL only, so the effective gradient scale is p^(β-1). At β=1 every token contributes equally and the method recovers WGA. Above 1, the gradient on a token fades as it is forgotten (self-limiting, for rare facts). Below 1, lower confidence grows the gradient (pressure-sustaining, for popular facts). Question tokens are masked.
The retain coefficient α is not grid-searched per dataset. Once per epoch the controller reads one-sided relative drift of retain loss versus epoch 1, raises α if the tolerance is exceeded, and relaxes it otherwise. Dropping the controller or dropping the popularity exponent leaves a different failure mode each.
All runs use LoRA (r=32) on Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct and Gemma-7B-it, on DUET (score range 69-3763) and RWKU. Baselines are GA, GD, NPO and WGA, plus 11 more methods in the appendix. GA and GD collapse generation and are unranked.
| Setting | AdaPop forget / retain ROUGE-L | WGA | NPO |
| Llama / DUET | 0.043 / 0.959 | 0.036 / 0.995 | 0.670 / 0.996 |
| Llama / RWKU | 0.078 / 0.972 | 0.095 / 0.977 | 0.540 / 0.957 |
Across six model-benchmark cells, AdaPop has the lowest forget cosine similarity among stable methods, and the lowest forget ROUGE-L in five of six. Mean retain ROUGE-L stays ≥ 0.855. On Llama/DUET, WGA's forget ROUGE-L is slightly lower; cosine similarity and the internal metrics reverse that ranking.
Paraphrase is the surface-versus-real test. DUET paraphrase forget ROUGE-L for AdaPop is 0.045 / 0.074 / 0.027 on Llama / Qwen / Gemma, against WGA 0.042 / 0.104 / 0.050 and NPO 0.696 / 0.605 / 0.568. RWKU adversarial prompts (nine strategies) give 0.262 / 0.144 / 0.195 versus WGA 0.396 / 0.211 / 0.239. The paper summarises those columns as about 5x and 1.6x less leakage. Per model, the NPO gap is much larger; versus WGA on Llama paraphrase the difference is inside seed noise.
Split by popularity tier, the gain is entirely on popular facts: AdaPop 0.040 / 0.055 / 0.028 against WGA 0.067 / 0.194 / 0.096, with NPO an order of magnitude worse. Rare facts are already near the floor for every stable method, and WGA is lower there. That is the intended trade: rare facts sit in the self-limiting regime, so the risk is over-erasure. Appendix N, at matched rare-fact forgetting, shows retain falling to 0.769 without the dual-ascent controller versus ≥ 0.927 with it.
Internal metrics cut harder. Averaged across the three models, DUET-forget ΔRank is +53,760 for AdaPop and -3,714 for WGA: the gold token moves up the ranked distribution under WGA. Hidden-state cosine is also lower for AdaPop. MMLU stays within 0.05 of the pre-unlearning checkpoint.
Three popularity proxies (Wikidata, LLM-as-Judge, entity counts on Pile-train) all drive forget ROUGE-L down at 10^{-4}. Wikidata tracks corpus frequency in log space at Pearson 0.97. It disagrees with the LLM judge on 16% of binary labels, with retain differing by at most 0.03. Inverting every score still holds retain at 0.92 and forget at or below 0.05, because clipping bounds the damage. A coarse rare/popular split is enough.
For compliance and privacy erasures, this is a usable training-time knob: keep pressure on popular facts, let rare facts self-limit, and let retain be a feedback loop rather than a grid search. Anyone already running WGA gets a sharp diagnostic: calibrating on the model's current outputs suppresses the surface answer and leaves the fact recoverable under rewording. Wikidata sitelinks are nearly free for entity QA. Procedural or code knowledge needs a different difficulty proxy.
The improvement is incremental. The change is where the forget signal comes from. The rest is still ascent on forget plus descent on retain.
The authors list three. The method needs an external popularity score; Wikidata covers entity-centric factual QA and not procedures or creative text. Coefficients a and b were solved on DUET, so a proxy on another scale must be rescaled or recalibrated; keeping those coefficients on corpus-frequency scores pins most popular facts at βmin and hurts retain. All runs are LoRA; full fine-tuning was skipped because prior work found it either fails to converge or catastrophically forgets.
A few gaps sit outside that list. Evaluation is city/entity QA, not code or conversational memory. After GA/GD collapse, the main table is a three-way race. ΔRank is a five-digit average across models, with no per-model variance on the main table. Adversarial ROUGE-L remains 0.14-0.26, so popular facts are not gone.