A Survey on Generative Model Unlearning: Fundamentals, Taxonomy, Evaluation, and Future Direction

This paper presents a comprehensive survey of Generative Model Unlearning (GenMU), addressing the lack of a unified framework for systematically organizing and integrating existing work in this field. The authors note that the substantial differences among current studies in terms of unlearning objectives and evaluation protocols hinder the objective and fair comparison of various approaches.

The paper identifies that while generative models have demonstrated impressive capabilities, concerns regarding privacy have become increasingly prominent. Recent studies show that generative models may reproduce data encountered during pretraining (including publicly available internet content and proprietary datasets), potentially exposing explicit or implicit user information. The General Data Protection Regulation (GDPR) mandates that models be capable of withholding certain learned information to reduce privacy breaches, yet retraining models is impractical in real-world applications due to the extremely high training costs associated with current generative models.

The authors identify two key limitations in existing reviews: (1) Existing reviews typically classify unlearning methods based on their technical approaches, which fail to resolve the ambiguity about unlearning objectives, and (2) Current reviews largely neglect the shared characteristics of unlearning techniques across different types of generative models.

The paper categorizes generative models by content type: text (encoder-only, encoder-decoder, decoder-only), image (GANs, VAEs, diffusion models, normalizing flows, energy-based models), audio (TTS systems, music synthesis), and multimodal models.

The authors distinguish GenMU from traditional classification model unlearning. In classification, unlearning aims to eliminate the influence of unlearning targets on the model, whereas in generative models, unlearning aims to prevent the model from reproducing specified targets rather than merely removing their influence.

The paper defines two types of unlearning targets:

• Point-wise unlearning: reduces the model's tendency to reproduce specified samples while preserving its behavior on other data

• Concept-wise unlearning: minimizing the likelihood of any concept-related output while preserving unrelated generation

The formal definition of generative model unlearning is provided: Let D0 be the training set and θ0 the model trained on D0. For unlearning targets Df ⊂ D0, point-wise unlearning seeks θ∗ = arg minθ Ex∈X Pr(y ∈ Df y = f(θ;x)), −Ex∈Xu EM∈M M(x, f(θ;x)) where Xu is defined by a threshold τ.

The unlearning workflow consists of four stages: learning process, target identification, unlearning process, and evaluation process.

The paper classifies unlearning approaches into two main groups based on whether model parameters are modified:

Parameter-based approaches include:

• Coarse-grained: achieve broad behavioral shifts via layer-wise or global parameter updates, including fine-tuning with supervised data and preference optimization guided by reward functions

• Fine-grained: realize localized control through selective or sparse adjustments, such as the task vector method... and locate-then-edit methods that identify and directly modify key neurons or parameters

Non-parametric approaches alter the model's input or inference process without touching parameters, comprising input-control strategies and inference-guidance techniques that adjust output distributions to enforce unlearning.

For text generation models, methods include:

• Fine-tuning: Gradient Ascent (GA) to maximize the cross-entropy loss on target sentences, with subsequent work introducing explicit regularization or Kullback-Leibler (KL)-divergence constraints on a retain set and second-order information, such as Fisher matrices and Hessian matrix

• Preference optimization: Negative Preference Optimization (NPO) treating the data to be unlearned as negative examples

• Locate-then-edit: suppress neurons correlated with target content via integrated gradients and quantify parameter influence on forget and retain sets to guide precise weight adjustments

• Input control: specially-crafted hard prompts or filtering classifiers are injected at inference time to suppress unwanted content without model modification

• Inference guidance: approximates the logit adjustment required to suppress target content by comparing outputs of two smaller models

For image generation models, methods include label adjustment, bi-objective optimization, and KL-divergence approaches.

For audio generation models, Teacher-Guided Unlearning (TGU) uses a pre-trained teacher to generate text-aligned speech in randomized styles as negative supervision.

For multimodal generation models, methods include training the language component to unlearn harmful behaviors through gradient ascent on undesired outputs and Modality-Aware Neuron Unlearning (MANU), which identifies and prunes neurons encoding target knowledge across image and text modalities.

For text generation models:

• Fine-tuning: fine-tunes on concept-specific data, identifies concept-associated tokens via logit comparisons, generates surrogate labels approximating an unexposed model

• Preference optimization: treating toxicity as a negative preference signal effectively steers the model away from harmful outputs

• Task-vector: differences between fine-tuned and original weights that can be negated or combined to switch downstream behaviors on or off

• Locate-then-edit: leveraging gradient-based analysis to precisely identify and selectively update sensitive parameters

• Input control: leverages Retrieval Augmented Generation (RAG) to simulate unlearning by modifying the external knowledge base at inference time

• Inference guidance: token probabilities are reweighted via a contrastive scoring between an expert model and an anti-expert model

For image generation models, methods span "score function and prompt guided unlearning, including time-varying noising, anchor distributions, self distillation, weight specific losses, soft prompt inversions, one dimensional adapters, and bi-level optimization with neighbor concept mining." Additional approaches include attention-based interventions, preference optimization (DUO), locate-then-edit (UCE), input control (SVD decomposition), and inference guidance (Safe Latent Diffusion).

For multimodal generation models, methods include Single Image Unlearn (SIU) using Dual Masked KL-divergence loss and MMUnlearner using Fisher-information–based saliency to generate a Bernoulli mask.

The paper proposes a unified evaluation framework covering three dimensions, namely completeness, utility, and efficiency.

For point-wise unlearning:

• Text: BLEU, ROUGE, perplexity (PPL), METEOR, and BERTScore, plus specialized measures like Extraction Likelihood (EL) and Memorization Accuracy (MA) and adversarial evaluations including Membership Inference Attack (MIA), Attack Success Rate (ASR) and Extractable Score (ES)

• Image: an auxiliary classifier... estimating the fraction of generated samples in the forget set or the GAN discriminator AUC score

• Audio: spk-ZRF defined as 1 − (1/n)Σ JSD(Pi ∥ Qi) where Pi and Qi are softmax-normalized speaker-verification embeddings

• Multimodal: ROUGE... to compare generated captions on the forget set before and after unlearning

For concept-wise unlearning:

• Text: toxicity-based ratios computed with pre-trained classifiers, stereotype scores alongside context-association tests, and GPT-driven harmfulness metrics

• Image: auxiliary classifiers and detection models including Q16 classifier, NudeNet, CLIP, MMDetection, ResNet-50 and 18, GroundingDINO, ViT, YOLO and a diffusion classifier, plus Memorization Score and Quantile Drop metric

• Multimodal: Exact Match (EM) and Concept Probability Distance (C-Dis)

For point-wise unlearning:

• Text: standard LLM benchmarks including MMLU, TruthfulQA, MATH, GSM8K and the Open LLM Leaderboard

• Image: IS, FID, and CLIP embedding distance

• Audio: Naturalness MOS, Similarity MOS, and Retention Accuracy (Ret-ACC)

• Multimodal: standard text generation metrics such as ROUGE, BLEU, and PPL plus MMMU

For concept-wise unlearning:

• Text: measuring the model's retention on peer level data and broad downstream benchmarks

• Image: a suite of alignment and fidelity metrics (e.g., IS, FID, CLIP Similarity, LPIPS, KID, SSIM, VQA-score, Aesthetic Score and TIFA)

• Multimodal: general visual perception retention and textual knowledge retention

The paper notes that few language generation unlearning methods address efficiency, yet it is crucial given the scale of modern LLMs. It states that tuning-based unlearning outperforms RLHF in time cost across various forget-set sizes and that second-order optimization incurs higher per-step costs, but it still accelerates unlearning by an order of magnitude compared to full retraining. However, most studies lack systematic efficiency evaluations and cross-method comparisons.

The paper examines connections with:

• Model editing: both approaches follow a locate-then-modify paradigm but differ in that model editing aims to perform localized corrections or updates while GenMU seeks to remove targeted knowledge entirely

• RLHF: Concept-wise unlearning and RLHF both aim to align generative models with human values but unlearning often relies on negative examples or logit interventions, making it more resource-efficient than RLHF

• Controllable generation: Both methods alter generation behavior: unlearning weakens internal representations to suppress unwanted concepts, while controllable generation applies direct constraints during decoding

The paper identifies four application domains:

1. Copyright Protection and Privacy Preservation: GenMU mitigates this by identifying and excising copyrighted examples from the training set

2. Human Preference Alignment: GenMU offers a targeted solution by selectively unlearning harmful or biased knowledge

3. Hallucination Eradication: GenMU has been shown to reduce hallucination rates significantly

4. Attack and Defense: Adversarial unlearning combines targeted erasure with adversarial training

The paper identifies six key challenges:

1. Inappropriate Definition: "Current unlearning methods target a data pair x, y by minimizing p(yx) to erase that specific mapping. This approach fails in point-wise unlearning because it does not prevent y from being generated under other prompts x′"

2. Confused Evaluation System: Existing unlearning methods rely on disparate metrics, resulting in inconsistent evaluation

3. Low Scalability of Unlearning: beyond a certain threshold of forgotten samples, overall performance degrades sharply

4. Ambiguous Scope of Unlearning: removing a small set of samples should not require large-scale modifications

5. Imprecise Concept Unlearning Targets: Disentangling and extracting these relevant elements for focused unlearning remains an open challenge

6. Fragility of Unlearning: attackers can exploit relearning or reverse engineering to extract forgotten information from the post-unlearning model

The paper proposes six future research directions:

1. Streaming/Continual Unlearning: legal and regulatory requirements often demand immediate data removal, making batch unlearning unsuitable

2. Unlearning of Complex Concepts: generative models encode concepts hierarchically, with complex ideas built from simpler ones

3. Black-box Unlearning: unlearning must proceed without access to model parameters

4. Generalization of Unlearning: Existing concept-wise unlearning methods often fail to generalize across languages and cultures

5. Efficiency of Unlearning: Practical systems demand prompt unlearning; future work should therefore balance scalability with responsiveness

6. Interpretability of Unlearning: Improving transparency by making unlearning steps traceable will enhance trust, enable diagnostics, and support practical deployment

The paper concludes that while different generative models emphasize different unlearning targets, we observe significant commonalities in the implementation pathways of unlearning approaches and the design principles of evaluation metrics.

Based on the paper, here are the specific improvements I can implement in AI systems, along with the resulting capabilities:

• Improvement: Replace the current prompt-response pair-based unlearning with a concept-abstracted reference set. Instead of minimizing p(yx) for a single pair, the system will minimize the likelihood of all outputs containing the target concept across diverse prompts.

• Capability: The AI can now truly erase a concept (e.g., a specific person, artistic style, or harmful topic) rather than just one specific response. It will not regenerate the concept under different phrasings or contexts.

• Improvement: Before applying any unlearning method that uses a forget/retain split, the system will automatically scan the retain set for implicit or explicit occurrences of the target concept using an auxiliary discriminator. If found, it will either remove those samples or flag them for manual review.

• Capability: Prevents the reinforcement paradox where regularization on a contaminated retain set inadvertently strengthens the very knowledge meant to be erased. This ensures unlearning is not self-defeating.

• Improvement: Replace single-metric evaluations (e.g., BLEU or accuracy on a forget set) with a composite score that includes:

• Direct likelihood reduction (token-level probability drop)

• Adversarial probing (membership inference attacks, extraction likelihood)

• Cross-prompt generalization (testing the same concept under 50+ paraphrased prompts)

• Paraphrase resistance (checking if the model still generates the concept when synonyms or translations are used)

• Capability: Provides a reliable, standardized measure of whether unlearning actually worked, rather than a misleading proxy. This prevents false confidence in incomplete unlearning.

• Improvement: Implement a dynamic threshold that monitors model utility (e.g., perplexity on a holdout set) during batch unlearning. When utility drops below a critical threshold (e.g., 5% degradation), the system automatically switches from aggressive gradient ascent to a more conservative preference-optimization method (e.g., NPO) or pauses to allow for targeted parameter re-localization.

• Capability: Enables unlearning of large forget sets (e.g., >1000 documents) without catastrophic collapse, which is currently a known limitation for point-wise unlearning in models like GPT-2.

• Improvement: Before unlearning a complex concept (e.g., Harry Potter), the system will decompose it into sub-concepts (e.g., Hogwarts, Voldemort, Quidditch) using a knowledge graph or embedding clustering. It will then unlearn the target concept and all identified sub-concepts simultaneously.

• Capability: Prevents the reassembly attack where a model, after unlearning a high-level concept, can still generate it by combining intact sub-components. This is critical for robust content regulation.

• Improvement: After unlearning, the system will run a relearning simulation where it fine-tunes the unlearned model on a small subset of the forget set (e.g., 10 samples) for a few steps. If the model quickly recovers the forgotten knowledge, the unlearning process is flagged as fragile and re-run with stronger regularization (e.g., sharpness-aware minimization or adversarial training).

• Capability: Produces unlearned models that are resilient to malicious attempts to recover deleted data, addressing the fragility of unlearning challenge.

• Improvement: For API-only access (no parameter access), the system will use a combination of:

• Logit-offset estimation (using a smaller assistant model to approximate the needed adjustment)

• In-context filtering (injecting hard prompts or few-shot examples that suppress target content)

• Decoding-time guidance (reweighting token probabilities using an anti-expert model)

• Capability: Enables unlearning on commercial models (e.g., GPT-4, Claude) where only query access is available, without requiring expensive fine-tuning or weight access.

• Improvement: Implement a memory-buffer-based approach that stores a small, concept-free subset of recent data. Each new unlearning request is processed incrementally, with a utility check after every 10 requests to detect cumulative degradation. If degradation is detected, the system triggers a consolidation step using task-vector negation to restore stability.

• Capability: Supports real-time deletion requests (e.g., GDPR right to be forgotten) without batch processing delays or performance collapse over time.

• Improvement: For models like LLaVA or Qwen-VL, the system will use a modality-aware neuron pruning approach (similar to MANU) that identifies neurons responsible for cross-modal associations (e.g., image of a person → their name). It will then prune these neurons while preserving unimodal capabilities.

• Capability: Allows precise removal of visual-linguistic associations (e.g., a specific face linked to a name) without degrading the model's ability to recognize faces or process text independently.

• Improvement: Automatically select the most efficient unlearning method based on the target type and model size:

• Point-wise, small scale: Gradient ascent with KL regularization

• Point-wise, large scale: NPO with retain-set regularization

• Concept-wise, image models: Closed-form cross-attention editing (UCE)

• Concept-wise, text models: Task-vector negation

• Capability: Reduces unlearning time by up to 10x compared to full fine-tuning, making it feasible for real-time applications.

1. Comply with privacy regulations by removing specific user data or copyrighted content on demand, without retraining, and with verifiable completeness.

2. Erase harmful or biased concepts (e.g., hate speech, stereotypes, violent imagery) across all languages and paraphrases, not just in response to a single prompt.

3. Resist adversarial attacks that attempt to recover deleted information through fine-tuning or prompt engineering.

4. Operate on commercial black-box models (e.g., GPT-4, DALL-E) where parameter access is unavailable.

5. Handle continuous deletion requests in production environments without performance degradation.

6. Precisely remove cross-modal associations in multimodal systems (e.g., a specific person's face linked to their name).

7. Provide transparent, multi-metric evaluation reports that prove unlearning effectiveness to regulators or auditors.

8. Maintain high utility on unrelated tasks, with less than 2-3% performance drop, even after large-scale unlearning.