通过基于进化的方法的评估循环实现隐藏知识的恢复
REBEL: Hidden Knowledge Recovery via Evolutionary-Based Evaluation Loop
AI总结：
REBEL通过进化方法生成对抗性提示，揭示当前去学习方法仅提供表面保护，能有效恢复模型中被误认为遗忘的知识。
摘要：
针对大语言模型（LLM）的机器去学习旨在从已训练模型中移除敏感或受版权保护的数据。然而，当前去学习方法的真实有效性仍存疑。标准评估指标依赖于良性查询，这些查询往往将表面信息抑制误认为真正的知识移除。此类指标无法检测到更复杂的提示策略仍能提取的残留知识。我们介绍了REBEL，一种针对对抗性提示生成的进化方法，旨在探测是否已去学习的数据仍能被恢复。我们的实验表明，REBEL成功地从在标准去学习基准中似乎被遗忘的模型中提取出“遗忘”的知识，揭示当前去学习方法可能只提供了一层表面的保护。我们验证了我们的框架在TOFU和WMDP基准集的子集上，评估了在多样化的去学习算法套件中的性能。我们的实验显示，REBEL在静态基线上表现一致，能够以攻击成功率（ASR）达到60%（TOFU）和93%（WMDP）恢复“遗忘”的知识。我们将在接受后公开所有代码。代码可在https://github.com/patryk-rybak/REBEL/上获得。
英文摘要：
Machine unlearning for LLMs aims to remove sensitive or copyrighted data from trained models. However, the true efficacy of current unlearning methods remains uncertain. Standard evaluation metrics rely on benign queries that often mistake superficial information suppression for genuine knowledge removal. Such metrics fail to detect residual knowledge that more sophisticated prompting strategies could still extract. We introduce REBEL, an evolutionary approach for adversarial prompt generation designed to probe whether unlearned data can still be recovered. Our experiments demonstrate that REBEL successfully elicits ``forgotten'' knowledge from models that seemed to be forgotten in standard unlearning benchmarks, revealing that current unlearning methods may provide only a superficial layer of protection. We validate our framework on subsets of the TOFU and WMDP benchmarks, evaluating performance across a diverse suite of unlearning algorithms. Our experiments show that REBEL consistently outperforms static baselines, recovering ``forgotten'' knowledge with Attack Success Rates (ASRs) reaching up to 60% on TOFU and 93% on WMDP. We will make all code publicly available upon acceptance. Code is available at https://github.com/patryk-rybak/REBEL/
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
