LACUNA: When Unlearning Misses the Bullseye — A New Testbed for Parameter-Level Erasure Precision

Paper: 2607.02513 Authors: Matteo Boglioni, Thibault Rousset, Siva Reddy, Marius Mosbach, Verna Dankers Categories: cs.CL, cs.AI, cs.LG

The Gap

Here’s the situation: LLMs memorize sensitive data (PII, copyrighted text), and “machine unlearning” has become the go-to approach for post-hoc removal. The dominant paradigm follows a “localize-first, unlearn-second” strategy — find which parameters hold the knowledge, then modify them. Methods like RMU, SimNPO, and others have shown impressive results on benchmarks like TOFU and MUSE.

But there’s a problem nobody is measuring. All existing benchmarks evaluate unlearning purely at the output level: does the model still produce the forbidden information when prompted? The thing is, a model can appear to have “forgotten” something at the output level while the knowledge remains perfectly intact in its parameters — just obfuscated. This is exactly why resurfacing attacks (gentle fine-tuning or probing) can recover “unlearned” information so reliably.

Nobody has a way to check: did the unlearning actually touch the right weights?

Problem: LLMs store sensitive data, need removal
    |
    v
Assumption: "Localize-then-unlearn" targets the right parameters
    |
    v
Reality: No benchmark verifies this assumption
    |
    v
Evidence gap: Output-level success != parameter-level erasure
    |
    v
LACUNA: Inject PII into known parameters, then check precision
    |
    v
Finding: SOTA methods are imprecise; precision enables robustness

The Increment

One sentence: Before this paper, we could only check if unlearning *looked successful; after this paper, we can check if it actually aimed at the right weights.

Core Mechanism

LACUNA’s architecture has three phases: injection, unlearning, and evaluation.

Phase 1 — Controlled Injection. The system takes a base model (OLMo 1B or 7B) and injects PII of *synthetic individuals (fake people with names, addresses, SSNs) into specific, predefined parameters using masked continual pretraining. The key innovation: the researchers know exactly which parameter matrices received the new knowledge. Think of it as writing a secret on a specific page of a notebook — you know where it went.

Phase 2 — Unlearning Attack. Apply any SOTA unlearning method (RMU, SimNPO, etc.) to try to erase the injected PII. The method receives the standard unlearning objective: make the model forget these specific facts.

Phase 3 — Precision Evaluation. Now compare what the unlearning method *touched versus what it should have touched. Using weight-space analysis, measure overlap between (a) the parameters that were modified during unlearning and (b) the parameters where the PII was injected. High overlap = precise localization. Low overlap = the method went on a rampage through the model.

[Phase 1: INJECT]
Synthetic PII + Base Model
        |
        v
   Masked Continual Pretraining
        |
        v
   [Known Parameter Locations] -- stored as ground truth
        |
[Phase 2: UNLEARN]
        |
   SOTA Unlearning Method
        |
        v
   Modified Parameters
        |
[Phase 3: EVALUATE]
        |
   Compare: Modified Params vs Ground Truth
        |
   +-----------+-----------+
   |                       |
   v                       v
[High Overlap]         [Low Overlap]
   Precise!             Shotgun approach

The metaphor: a library with a known thief.

Imagine you’re a librarian who discovers a book contains leaked classified information. The book is on shelf 3, row B, position 7. You hire an “eraser” to remove that page.

The old way of evaluating unlearning: you ask the eraser “can you recite the classified info?” If they can’t, you declare success. But maybe the eraser just memorized “don’t say it out loud” while the page is still sitting there.

LACUNA’s way: you told the eraser where the book is (shelf 3, row B, position 7). After they finish, you check: did they actually go to shelf 3? Or did they just rummage through shelves 1, 5, and 12, hoping to stumble on it? You also check: is the page really gone, or just crossed out with a pencil (reversible)?

The finding is sobering: current erasers are like drunk librarians. They mess up a lot of shelves but often miss the right one. And if you tell a simple eraser exactly where to go, even a cheap eraser does a great job.

Key Concepts

• Resurfacing Attack: Imagine you “forgot” your ex’s phone number by throwing away your contacts. But then you find it scribbled on a sticky note in your drawer. A resurfacing attack is the same idea: after unlearning, a adversary applies gentle fine-tuning to the model, and the “forgotten” information comes back. This happens because the knowledge was never truly erased from the parameters — it was just hidden. The paper shows this isn’t a bug in specific methods; it’s a systemic problem when unlearning doesn’t target the right weights.

• Localization Precision: Think of it as “aim” in a dart game. If the bullseye is the parameter matrix where knowledge lives, localization precision measures how close the unlearning method’s modifications landed to that bullseye. The paper reveals a stark disconnect: methods that score well on “did the model forget?” (output metrics) often completely miss the bullseye (low parameter overlap). High output-level success is compatible with near-random parameter targeting.

Framework Shift

Before (mainstream approach):          After (this paper):

  [Model]                               [Model]
     |                                      |
     v                                      v
  [Unlearn]                             [Inject PII]
     |                                   at KNOWN params
     v                                      |
  [Ask model questions]                  [Unlearn]
     |                                      |
     v                                      v
  [Did it answer right?]              [Compare touched params
     |                                 vs known params]
     v                                      |
  Success/Fail                            v
                                     Precision Score
                                     + Output Score
                                     = Real evaluation

From output-only behavioral testing to parameter-level surgical verification, the core shift is that we finally have ground truth to distinguish “the model forgot” from “the model learned to hide it.”

Expert Assessment

Problem choice: This is a genuine and important gap. The resurfacing attack literature has been raising alarms for over a year, but nobody had a clean way to measure *why attacks work. The insight — that we need ground-truth parameter localization — is obvious in hindsight but wasn’t available. This sits at a critical juncture: unlearning is moving from proof-of-concept to deployment necessity (EU AI Act compliance, etc.), and we need to know if these methods actually work.

Method maturity: Clever rather than brute force. The masked continual pretraining trick to inject knowledge at controlled locations is elegant — it’s not just fine-tuning, it’s targeted knowledge injection with localization metadata baked in. The main limitation: synthetic PII on synthetic people in OLMo. Real-world memorization is messier (distributed across layers, entangled with other knowledge). The paper acknowledges this but doesn’t address it.

Experimental integrity: Baselines are fair — they test multiple SOTA methods (RMU, SimNPO, etc.) on consistent tasks. The numbers are striking: ~0% parameter precision for methods that show strong output-level performance. One concern: the injection method itself might create artificially concentrated knowledge (cleaner than natural memorization), which could make precision look *worse than in practice. The authors don’t explore this sensitivity.

Writing quality: The paper is well-structured and clear. Section 4 (experimental setup) could be tighter — the details of masked continual pretraining deserve a more accessible walkthrough. The figures are helpful but could better convey the precision/recall tradeoff visually. The related work section is solid but missing a discussion of how this connects to interpretability-based unlearning (e.g.,ROME, MEMIT).

Verdict: Weak accept — The evaluation paradigm is genuinely new and needed; the empirical findings are important; but the synthetic-only evaluation and lack of real-memorization experiments limit the immediate confidence in conclusions.

Takeaways

Three things you can steal:

1. The evaluation framework itself. “Inject knowledge at known locations, then check if erasure hits those locations” is a methodology that transfers to any knowledge-editing or unlearning task. If you’re working on model editing, build your own version of LACUNA for your domain.

2. The precision-robustness link. The paper provides evidence that *where you edit matters more than how aggressively you edit. If you’re designing unlearning methods, invest in localization accuracy before optimizing the loss function. A simple gradient method with good aim beats a sophisticated method with bad aim.

3. Don’t trust output-level metrics alone. This is the meta-lesson: any time you’re evaluating whether a model has truly changed (not just unlearning — also alignment, safety training, etc.), consider whether the model might be *performing the change without embodying it. Build evaluation that checks the mechanism, not just the behavior.