ConceptGuard: Benchmarking Context-Sensitive Unlearning in Large Language Models

arXiv:2608.20338 · cs.CL · Submitted 2026-08-20 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: I'm Tom.

Jane: And I'm Jane, here with Lu, Meng and our in-house large language model, Lalam.

Tom: We're looking at the paper: "ConceptGuard: Benchmarking Context-Sensitive Unlearning in Large Language Models".

Jane: The gist: Effective unlearning must operate at the level of concepts, ensuring complete removal of unsafe applications while maintaining their correct and useful usage.

Tom: First, who's behind it and why it matters.

Title and authors: Jane: ConceptGuard is their proposed benchmark designed specifically to evaluate unlearning at the level of dual-use concepts, meaning concepts that can be used in both harmful and benign contexts.

Tom: So they build a dataset where each concept has both harmful and benign data associated with it, which is what allows them to test the model’s ability to differentiate between those uses.

Lu: They construct the forget set to contain the harmful uses of a concept, while the retain set contains the benign uses of that same underlying concept, which lets them evaluate intent sensitivity.

Meng: I see how that helps with deployment because it moves us past just checking if a specific fact is gone and into seeing if the model can handle contextually different instructions for the same idea.

Lalam: It seems like they are trying to measure whether the model has learned to suppress harmful applications while still being able to use the same concept correctly elsewhere, which is a much more meaningful test.

Tom: Right, so it’s not just about deletion; it’s about control over how a concept is applied in different scenarios.

Jane: And this leads into how they evaluate it with these specific metrics that go beyond simple factual recall to check for harmful memorization and model utility.

The paper's summary: Tom: They outline two main dimensions for evaluating unlearning: forget quality, which is tied directly to the safety of the model after unlearning, and model utility, which checks if it still retains correct and helpful behavior in benign contexts.

Jane: And they add this concept-level measure called contextual separation, defined as the difference between how well the model scores harmful versus benign uses of a specific concept.

Lu: The protocol includes several metrics like Harmful Memorization F1, Query-Based Harmful Memorization F2, and Harmful Response Score F3 to check for verbatim reproduction or harmful wording.

Meng: But they also have Helpful Retention U1 and Query-Based Utility U2, plus Helpful Response Score U3 which uses an LLM evaluator to score the general cohesion and utility of the responses in benign contexts.

Lalam: And then there’s this contextual separation measure CtxtSep, which is calculated by taking the product of concept scores weighted by how many queries exist for each harmful and benign use.

Tom: It’s a multi-faceted evaluation because they are looking at both the model's safety after forgetting and its ability to keep useful things intact while suppressing the bad stuff.

Jane: So, what this means for us is that instead of just saying "it forgot X," we can measure precisely how much harmful intent it suppressed compared to benign intent.

Lu: This level of detail suggests that the research isn't just about finding a method to erase data; it’s about finding a mechanism where the model learns to separate dangerous applications from safe ones in its internal representation.

The paper's improvements: Tom: The paper compares this ConceptGuard benchmark against existing ones like TOFU, MUSE, and WMDP and shows that their setup uses complementary sets rather than independent or random subsets.

Jane: They demonstrate that ConceptGuard evaluates concept usage with different intents, which is a major improvement over the old framework where forget and retain sets were treated as totally separate entities.

Lu: The results show that methods like SimNPO and RMU achieve the highest separation scores across both models, indicating a stronger ability to suppress harmful behavior while preserving benign usage within the same conceptual space.

Meng: That’s interesting because we saw that Gradient Ascent was the strongest at forgetting but it caused severe utility degradation, whereas SimNPO seems to strike a better balance between reducing harmful outputs and retaining utility.

Lalam: The paper suggests that framing concept usage through preferences, like in SimNPO, is an effective strategy for safe unlearning because it achieves higher separation scores than what current methods provide.

Tom: So they are suggesting that optimizing for contextual separation is a better goal than just minimizing the number of facts removed or retained separately.

Jane: And they point out a limitation as well, though, which is that the results don't show uniformity at the concept level across all models tested yet.

Conclusion: Tom: So to wrap up, ConceptGuard shows that operating on dual-use concepts provides a way to evaluate unlearning that is much more aligned with real safety needs, focusing on controlling harmful applications while keeping benign ones intact.

Jane: The paper suggests that methods like SimNPO and RMU are stronger because they manage to achieve high contextual separation between harmful and benign uses of the same concept.

Lu: ConceptGuard points toward future work exploring alternative distributions or filtering strategies to see how concept sensitivity changes depending on those inputs, or varying the granularity of the concepts themselves.

Meng: From a deployment standpoint, it tells us that we need unlearning methods that explicitly optimize for this contextual separation metric rather than just treating forgetting and retention as separate tasks.

Lalam: It’s about developing unlearning methods that are integrated to handle context sensitivity directly, instead of having separate steps for forgetting and retaining.

Tom: So, ConceptGuard is a significant step in moving the evaluation of LLM safety from checking individual facts to checking the model's ability to manage concepts safely across different contexts.

Sahil Kale, Ian Harris

Pune Institute of Computer Technology · University of California, Irvine

cs.CL

Submitted: 2026-08-20

Updated: 2026-10-16

Comments: 17 pages, 9 figures

License: http://creativecommons.org/licenses/by-sa/4.0/

Importance score: 76/100

The gist: The gist: Effective unlearning must operate at the level of concepts, ensuring complete removal of unsafe applications while maintaining their correct and useful usage.

Key concepts

Dual-Use Concepts: These are ideas or terms that can be used for both harmful and harmless purposes. The paper uses these in the ConceptGuard benchmark to test if a model can safely remove its harmful applications of a concept while still retaining its correct, beneficial uses.
Concept-Level Unlearning: Instead of just deleting individual facts, this approach focuses on removing entire concepts. This means the goal is to ensure that when a concept is used in an unsafe way, it's gone, but if it's used safely or beneficially elsewhere, that knowledge stays.
Contextual Separation: This measures how well a model can distinguish between harmful and benign uses of the same underlying concept. High contextual separation means the model is very good at knowing when to use a concept safely and when to avoid using it in a dangerous context.

Terminology

Benchmarking — 1× in this paper · explained in 4 episodes

Summary

The gist: Effective unlearning must operate at the level of concepts, ensuring complete removal of unsafe applications while maintaining their correct and useful usage.

Motivation

Large Language Models (LLMs) increasingly require selective removal of harmful or sensitive knowledge, called unlearning, yet existing methods and benchmarks fail to evaluate this capability completely <ref:2608.20338#pg2> Current approaches rely on disjoint forget and retain sets composed of independent facts, and measure success using simple and direct factual recall <ref:2608.20338#pg2> This framing fails to capture a key requirement of unlearning, namely the ability to eliminate harmful behaviors while preserving benign and beneficial knowledge <ref:2608.20338#pg2> We argue that effective unlearning must operate at the level of concepts, ensuring complete removal of unsafe applications while maintaining their correct and useful usage, thereby achieving conceptually meaningful and complete unlearning <ref:2608.20338#pg2>

Limitations of Existing Benchmarks

Existing benchmarks construct disjoint forget and retain sets and evaluate unlearning performance independently <ref:2608.20338#pg2> This leads to a mismatch between benchmark performance and meaningful unlearning behavior <ref:2608.20338#pg2> The construction of the forget and retain sets is typically treated as disjoint subsets sampled from a larger dataset, without explicitly encoding relationships between them <ref:2608.20338#pg2> This prevents evaluation of whether models can selectively suppress harmful uses while preserving beneficial ones, and instead favors solutions operating at the level of individual facts <ref:2608.20338#pg2> Furthermore, evaluation methods operate at the level of isolated factual recall, testing whether specific facts have been erased or preserved as per their presence in the forget or retain set instead of evaluating if the model has been trained to prevent answering in a harmful context while also ensuring that it can safely use the same concept elsewhere <ref:2608.20338#pg2>

The ConceptGuard Benchmark

We introduce a new benchmark titled ConceptGuard designed to evaluate unlearning at the level of dual-use concepts, i.e. concepts that can be used in both harmful and benign contexts <ref:2608.20338#pg2> Each concept in our benchmark is associated with both harmful and benign data representing dual use <ref:2608.20338#pg2> The forget set contains harmful uses of a concept, while the retain set contains benign uses of the same underlying concept <ref:2608.20338#pg2> This allows for evaluation at the level of concepts instead of sparse facts and is intent-sensitive with the goal of maximizing contextual separation to promote safer behavior <ref:2608.20338#pg2>

Evaluation Protocol

Our benchmark evaluates unlearning along two dimensions: forget quality and model utility, along with an additional concept-level measure of contextual separation <ref:2608.20338#pg2> Forget quality is directly tied to the safety of the model after unlearning, while model utility reflects its ability to retain correct and helpful behavior in benign contexts <ref:2608.20338#pg2> The protocol includes four specific metrics:

Harmful Memorization (F1): Measures verbatim reproduction of information from the forget set Df <ref:2608.20338#pg2>
Query-Based Harmful Memorization (F2): Assesses whether the model can still generate responses aligned with harmful instances when prompted with queries from Qf <ref:2608.20338#pg2>
Harmful Response Score (F3): Evaluates whether the model produces outputs with harmful wording or intent when prompted with queries intending such responses <ref:2608.20338#pg2>
Helpful Retention (U1): Computes an analogous verbatim similarity metric on Dr to ensure useful knowledge from the retain set is successfully preserved <ref:2608.20338#pg2>
Query-Based Utility (U2): Evaluates the model’s ability to respond correctly to benign queries from Qr <ref:2608.20338#pg2>
Helpful Response Score (U3): Measures whether the model produces useful responses in benign contexts using an LLM-based evaluator h(·) that scores the general cohesion and utility of responses <ref:2608.20338#pg2>
Contextual Separation: Defined as Sep(f, c):= HelpScorec(f) − HarmScorec(f), which measures the extent to which the model differentiates between harmful and benign uses of the same concept <ref:2608.20338#pg2> The overall contextual separation is given by CtxtSep(f):= P c∈C wc · Sep(f, c), where wc = Qc f + Qc r / (Qf + Qr) <ref:2608.20338#pg2>

Results and Discussion

Unlearning methods induce strong forgetting–utility trade-offs under conceptual overlap <ref:2608.20338#pg2> Gradient Ascent achieves the strongest forgetting (lowest HarmMem and HarmQA), but at the cost of severe utility degradation, indicating over-suppression and a major collapse of internals <ref:2608.20338#pg2> SimNPO and RMU provide a more balanced trade-off, retaining substantially higher utility while still reducing harmful memorization <ref:2608.20338#pg2> SimNPO achieves the strongest overall utility retention with relatively low harmful outputs, suggesting that framing concept usage through preferences is an effective strategy for safe unlearning <ref:2608.20338#pg2> Current unlearning methods fail to enhance the contextual separation of safe and benign usage of concepts <ref:2608.20338#pg2> SimNPO and RMU achieve the highest separation scores across both models, indicating a stronger ability to suppress harmful behavior while preserving benign usage within the same conceptual space <ref:2608.20338#pg2> However, unlearning methods fail to show uniformity at the concept level <ref:2608.20338#pg2>

Future Work

Our study opens several directions for future work. First, exploring alternative distributions, filtering strategies, and different thematic groupings could reveal deeper insights into concept sensitivity <ref:2608.20338#pg2> Second, varying the number and granularity of concepts may help better understand the limits of contextual separation <ref:2608.20338#pg2> Third, developing unlearning methods that explicitly optimize for contextual separation, rather than treating forgetting and retention independently, remains a key open challenge <ref:2608.20338#pg2>

Impact Statement

This work aims to improve the safety of language models by enabling precise removal of harmful behaviors while preserving useful capabilities <ref:2608.20338#pg2> However, unlearning methods could be misused to selectively suppress beneficial or factual information, raising concerns around controllability and misuse <ref:2608.20338#pg2> Developing robust, transparent, and auditable unlearning methods remains an important direction for mitigating such risks <ref:2608.20338#pg2>

References

Miles Brundage, Shahar Avin, Jack Clark, Helen Toner, Peter Eckersley, Ben Garfinkel, Allen Dafoe, Paul Scharre, Thomas Zeitzoff, Bobby Filar, Hyrum Anderson, Heather Roff, Gregory Allen <ref:2608.20338#pg2> The malicious use of artificial intelligence: Forecasting and prevention and mitigation <ref:2608.20338#pg2> Hwan Chang and Hwanhee Lee <ref:2608.20338#pg2> Which retain set matters for LLM unlearning a case study on entity unlearning <ref:2608.20338#pg2> Yijiang River Dong, Hongzhou Lin, Mikhail Belkin, Ramon Huerta, and Ivan Vulic <ref:2608.20338#pg2> UNDIAL: Self-distillation with adjusted logits for robust unlearning in large language models <ref:2608.20338#pg2> Vineeth Dorna, Anmol Mekala, Wenlong Zhao, Andrew McCallum, Zachary C Lipton, J Zico Kolter, and Pratyush Maini <ref:2608.20338#pg2> OpenUnlearning: Accelerating LLM unlearning via unified benchmarking of methods and metrics <ref:2608.20338#pg2> Chongyu Fan, Jiancheng Liu, Licong Lin, Jinghan Jia, Ruiqi Zhang, Song Mei, and Sijia Liu <ref:2608.20338#pg2> Simplicity prevails: Rethinking negative preference optimization for llm unlearning <ref:2608.20338#pg2> Mor Geva, Roei Schuster, Jonathan Berant, and Omer Levy <ref:2608.

Improvements for AI systems

This system can achieve concept-aware unlearning by using dual-use concepts where each concept in our benchmark is associated with both harmful and benign data representing dual use, allowing for unlearning that focuses on preventing its harmful application while preserving its benign and beneficial uses.
The improved system will demonstrate a superior ability to maintain safety during removal, as the results show that SimNPO and RMU achieve the highest separation scores across both models, indicating a stronger ability to suppress harmful behavior while preserving benign usage within the same conceptual space.
The model will exhibit better contextual control by achieving higher Contextual Separation (CtxtSep) metrics, which is defined as the extent to which the model differentiates between harmful and benign uses of the same concept, indicating a stronger ability to suppress harmful behavior while preserving benign usage within the same conceptual space.

Abstract

Large Language Models (LLMs) often require selective removal of harmful or sensitive knowledge, called unlearning, yet existing benchmarks evaluate this capability incompletely. They rely on disjoint forget and retain sets of independent facts, and measure success by simple factual recall. This misses a key requirement of unlearning from a safety perspective, namely eliminating harmful behaviours while preserving benign and beneficial knowledge. We argue that effective unlearning must operate at the level of concepts, removing unsafe applications while maintaining correct and useful usage. To evaluate this, we operationalize dual-use concepts, i.e., concepts that can be used in both harmful and benign contexts, and construct ConceptGuard, a benchmark of 2,583 harmful--benign pairs over 68 concepts, where forget and retain sets are explicitly paired in concept usage. Evaluation is intent-sensitive and centres on contextual separation, which measures how well a model suppresses harmful behaviour while preserving benign usage of the same concept. Across four unlearning methods and four models, we find that current techniques reduce harmful memorization but show strong forgetting--utility trade-offs and limited contextual separation, well below a retain-only reference. Separation trends also depend more on the concept and model than on the method. Our results point to the need for unlearning approaches that better align with real-world safety requirements. Our dataset is publicly available.