Measuring the Depth of LLM Unlearning via Activation Patching

Current unlearning audits are insufficient: Existing methods that only check what an AI model outputs fail to detect when unwanted knowledge remains hidden in the model's internal representations—a critical gap for privacy and safety assurance.

A new measurement tool reveals hidden knowledge: The Unlearning Depth Score (UDS) uses "activation patching" to examine a model's internal layers and measure whether target knowledge has truly been erased, outperforming 19 other metrics across 150 tested models.

Knowledge can appear erased while remaining recoverable: The research found that representational shifts can mask residual knowledge—meaning a model might seem to have forgotten something based on its outputs, but the information is still mechanistically present and potentially recoverable.

Erasure depth varies by context: The study revealed that how thoroughly knowledge is erased depends on the specific type of prompt or question asked, suggesting that unlearning effectiveness is not uniform across different usage scenarios.

Standardized evaluation is now possible: By providing generalizable guidelines for integrating UDS into existing benchmarking frameworks, this work enables more consistent and reliable auditing of whether AI systems have genuinely forgotten sensitive information—essential for responsible deployment.