MUSE: Machine Unlearning Six-Way Evaluation for Language Models

Language models (LMs) are trained on vast amounts of text data, which may include private and copyrighted content, and data owners may request the removal of their data from a trained model due to privacy or copyright concerns. However, exactly unlearning only these datapoints (i.e., retraining with the data removed) is intractable in modern-day models, leading to the development of many approximate unlearning algorithms. Evaluation of the efficacy of these algorithms has traditionally been narrow in scope, failing to precisely quantify the success and practicality of the algorithm from the perspectives of both the model deployers and the data owners. We address this issue by proposing MUSE, a comprehensive machine unlearning evaluation benchmark that enumerates six diverse desirable properties for unlearned models: (1) no verbatim memorization, (2) no knowledge memorization, (3) no privacy leakage, (4) utility preservation on data not intended for removal, (5) scalability with respect to the size of removal requests, and (6) sustainability over sequential unlearning requests. Using these criteria, we benchmark how effectively eight popular unlearning algorithms on 7B-parameter LMs can unlearn Harry Potter books and news articles. Our results demonstrate that most algorithms can prevent verbatim memorization and knowledge memorization to varying degrees, but only one algorithm does not lead to severe privacy leakage. Furthermore, existing algorithms fail to meet deployer's expectations, because they often degrade general model utility and also cannot sustainably accommodate successive unlearning requests or large-scale content removal. Our findings identify key issues with the practicality of existing unlearning algorithms on language models, and we release our benchmark to facilitate further evaluations. 1 * Equal Contribution. 1 Our dataset and benchmark are available at https://muse-bench.github.io Preprint. Under review. … "There's more in the frying pan," said Aunt Petunia, turning eyes on her massive son. Q: What does Aunt Petunia tell her son? A: More in the frying pan. Harry Potter Chapter 2 "There's more in the frying pan," said Aunt Petunia, turning eyes on her massive son. … MUSE: Machine Unlearning Six-way Evaluation unlearn request unlearn request Who is the author of Harry Potter? J. K. Rowling … unlearn request unlearn request PrivLeak := AUC(funlearn; Dforget, Dholdout) -AUC(fretrain; Dforget, Dholdout) AUC(fretrain; Dforget, Dholdout) , The PrivLeak metric for a good unlearning algorithm should be close to zero, whereas an over/under-unlearning algorithm will get a large positive/negative metric.