Erasing the illusion: stress-testing the generalization of large language model unlearning evaluations

The paper proposes the Proximal Surrogate Generation (PSG) stress-testing framework and finds that current large language model unlearning evaluation metrics generally overestimate unlearning effectiveness. The authors point out that existing unlearning evaluations usually only monitor the model's performance decline on the unlearning dataset, whereas copyright or safety scenarios also care about behaviors the model generalizes from these data; experiments show that a model can pass standard unlearning evaluations and appear to have unlearned the target knowledge while retaining strong capabilities on semantically adjacent content. PSG automatically generates surrogate datasets that are semantically derived from the unlearning dataset but sufficiently different in embedding space; comparing metric scores on the two can test the reliability of the metrics themselves. Evaluation on three model families—Llama-3-8B, Qwen2.5-7B and Zephyr-7B-β—three datasets and seven standard metrics found widespread inconsistency, with the metrics often failing to detect residual knowledge exposed by the stress-test data.