arxiv-2605-08765 SRC-0318 · paper

Unlearners Can Lie: Evaluating and Improving Honesty in LLM Unlearning

Created: 2026-05-09 · Ingested: 2026-09-19

Unlearning in large language models (LLMs) aims to remove harmful training data while preserving overall utility. However, we find that existing methods often hallucinate, generate abnormal token sequences, or behave inconsistently, raising safety and trust concerns. According to prior literature on LLM honesty, such behaviors are often associated with dishonesty. This motivates us to investigate the notion of honesty in the context of model unlearning. We propose a formal definition of unlearning honesty, which includes: (1) preserving both utility and honesty on retained knowledge, and (2) e

In brief

Unlearned models rarely admit that they no longer know something: they hallucinate the forgotten fact, emit repetitive rare tokens, or refuse once and then answer the same question on a mild follow-up.

The authors define honest unlearning as self-knowledge plus stable self-expression, and score 9 methods across 3 families (rejection-based IDK+AP, gradient-ascent GA/NPO/SimNPO, feature-randomize RMU/BLUR/ME+GD) on Zephyr-7b-beta and Llama3-8b unlearned on WMDP-Bio, with retain-side checks on MMLU, CSQA and BBH.

RMU's rejection rate is 1.36 with RR2R 0.19; IDK tuning produces high refusal while WMDP accuracy stays high, and RMU+IDK refuses at 63.41 but only 26.17 after re-asking, with QAMRC around 40%. Gradient-ascent methods pick an "I don't know" option often but pick an irrelevant option in the same slot almost as often; under randomized option positions both fall to chance (NPO: CIR 19.24%, COR 17.65%; SimNPO: CIR 20.77%, COR 19.87%). Their proposed ReVa, which aligns forget-set activations to a distilled refusal direction, reaches RR 60.86 and RR2R 45.42, with AR 91.00 and MRS 71.37, in 5.91 minutes versus 210.66 for IDK+AP.

The position-shuffle and content-swap controls cleanly isolate the fake-refusal artefact; the ReVa comparison is self-reported, on 1 dataset, with no independent replication and no relearning or adversarial fine-tuning tests. MCQ abstention stays weak (CIR 7.18).

If you read high refusal rates as evidence of successful forgetting, re-ask the question before believing it.

Written from the abstract by claude-opus-5 on 2026-10-24, with every figure checked against it. Not a substitute for the paper.

Referenced by

Claims in this catalog that draw on this source, and whether as support or counterpoint.

supportsUnlearning methods that make a model answer "I don't know" about a forget set can leave the knowledge in place: the strongest IDK-style fine-tuning method still answered those same questions accurately when probed in a different format, and across nine unlearning methods on three model families none met a joint standard of utility and honesty on retained knowledge plus consistent, acknowledged forgetting; aligning representations after feature randomization (ReVa) roughly doubled the rejection rate that survives a second conversational turn.