Knowledge unlearning

openunlearning_tofu_npo_llama3p2_1b - gpt-5.6-terra / AI4AI-Bench 1.5 / high

Status. Exploration completed with an explicit submission; although the submit tail process recorded exit 137, the manifest, control receipts, and downstream replay establish a valid patch. Formal retraining completed, all three artifacts validated, and each final result has both summary.json and .complete, making all three official; the boundary audit is clean.

What happened. The task removes TOFU forget10 knowledge from a fixed Llama-3.2-1B-Instruct while preserving retain90 and general utility. Shipped NPO combines a relative-likelihood forgetting loss against a frozen start model with retain-answer NLL, but forget-anchored sampling traversed only 400 forget rows and sparsely sampled the 3,600-row retain set. The agent submitted retain-anchored NPO with retain weight doubled to 2, eight-epoch members, robust export, and late-checkpoint publication; epoch 6 achieved official balanced_unlearning_score=0.992165.

Four-hour exploration. The visible proxy, proxy_answer_nll_tradeoff (maximize), made one deterministic pass over 24 forget and 24 retain rows; it reported no SE or CI and is not numerically comparable to the final metric.

• The shipped seed-0 control improved from 1.422936 at step 65 to 1.697053 at its final 120 steps, so the final state was retained, but retain degradation remained. Raising retain weight from 1 to 2 improved the score to 1.818885 and was adopted.
• Changing the data anchor to retain90 gave 2.577586 after one roughly update-matched epoch, with retain-NLL delta falling from 0.899444 to 0.162035. Because anchoring jointly changed coverage, order, and forget resampling, coverage was not isolated, but the large gain motivated adoption.
• Retain-anchored duration scores were 2.981060 at two epochs and 3.703392 at four. An eight-epoch run scored 3.747308, 4.147637, and 4.251992 at steps 452, 678, and 896, so the agent submitted eight epochs and three late states. Official evaluation later rejected the proxy's “latest is best” conclusion.
• Several completed trainings initially left pending_export because they shared a final staging path. A unique sibling staging directory and a one-step smoke test established self-contained loadability and publication; the smoke test supplied no performance evidence.
• Two counter-ablations were rejected: retain weight 1.5 scored 3.694769 versus 4.251992 for 2 at eight epochs, and beta=0.2 scored 2.070612 versus 3.703392 for 0.1 at matched four epochs. All performance probes used seed 0; no alternative unlearning objective was run.

How the submitted method works. Fixed forget10/retain90 answers and the frozen start supply all targets. Retain90 anchors each batch; current-versus-reference forget likelihood enters unchanged beta=0.1 NPO, retain NLL is weighted by 2, and paged AdamW updates the full model. Thus the update rule remained unchanged; sampling, hyperparameters, schedule, export engineering, and checkpoint policy changed. No generated labels, external data, or prior reasoning traces were used. Formal replay restarted from the fixed model for seeds 0–11, completing 896 updates per member. It made 36 cumulative publications but retained only three globally, all from seed 11—not a cross-seed ensemble.

Formal and evaluation evidence. Retraining used 40,191 of 43,200 seconds (93.0%) and stopped normally after 12 complete members because the next-member reserve was not met. All artifacts loaded as 1.236B-parameter models. The final maximize metric uses 400 forget10_perturbed rows and utility over 400 retain, 100 real-author, and 117 world-fact perturbed rows; no SE or CI was reported.

| Artifact and actual progress | Official score | Diagnostics | Decision | |---|---:|---|---| | 1204, epoch 4, step 452 | 0.990945 | Extraction 0.070884; MU 0.604706 | Accepted | | 1206, epoch 6, step 678 | 0.992165 | Extraction 0.069328; MU 0.598069 | Best | | 1207, final step 896 | 0.984089 | Extraction 0.069079; MU 0.587184 | Late utility decline |

The fixed start's Extraction/MU were 0.707805/0.597131. Forgetting kept improving slightly after epoch 6, but utility fell, reducing the composite. The core retain-coverage direction survived final evaluation; proxy monotonicity did not.

Audit and takeaway. Fixed model/data hashes, fresh explore-to-formal lineage, evaluator integrity, offline inputs, one-GPU isolation, wall time, patch hash, and completion receipts all checked out. Observable agent behavior is clean; protocol or hidden-evaluation exposure was not found; platform, scheduling, and resource isolation were compliant. The trajectory demonstrates effective source-level sampling diagnosis and formal engineering closure, but admitting only one seed's three time points from 12 trained seeds prevents variance or significance claims, and the evidence does not establish cross-task generalization.

codex__openunlearning_tofu_npo_llama3p2_1b__gpt-5.6-terra__high - Full English Analysis

1. Run identity, attempt selection, and lineage

• Task: ai4ai/openunlearning-tofu-npo-llama3p2-1b, improving fixed TOFU forget10 unlearning while preserving retain90 and general utility.
• Task category: language-model knowledge unlearning and forgetting–utility tradeoff.
• Target model: the fixed published meta-llama/Llama-3.2-1B-Instruct start; validated formal artifacts contain about 1.236 billion parameters.
• Harness: AI4AI-Bench 1.5, a network-disabled single-GPU environment; the exploration agent was Codex gpt-5.6-terra.
• Reasoning effort: high.
• Seeds: all exploration performance probes used seed 0; formal replay used seeds 0 through 11; final evaluation used its fixed deterministic setup and recorded seed 0.
• Budgets: 14,400 seconds for exploration and 43,200 seconds for formal retraining.

The selected exploration run is exploration attempt 1. Inspection of same-configuration numbered directories and control, queue, and correction records found no other complete exploration run. The analysis manifest likewise lists no prior attempts. This run used 13,935 seconds, ended with agent_explicit_submit, and preserved a nonempty candidate patch.

The submitted candidate.patch has SHA-256 verified private digest. The formal manifest's selected-exploration lineage points exactly to the selected exploration run, and its patch is byte-identical with the same hash. The formal runner skipped an irrelevant tracked Python bytecode deletion in the patch, then applied the functional run.sh and train.py changes cleanly to the fixed source start.

The linked formal run is formal replay 1; no unlinked or partial formal run exists. Exploration fields auto_retrain=false and retrain_phase_created=false mean only that the exploration manifest did not create its own formal phase; they do not negate this separately orchestrated run. Likewise, formal score_phase_created=false does not negate the separately scheduled final evaluations. Formal replay completed and produced checkpoint-1204, checkpoint-1206, and checkpoint-1207. All three loaded through AutoModelForCausalLM.from_pretrained and passed parameter-count validation. Each final-evaluation directory contains both out/summary.json and .complete, so all three scores are official.

Evidence completeness is high: the raw command-level trajectory, task source, patch, training receipts, artifact validation, and official scoring receipts are available. Two bookkeeping conflicts do not break lineage. The exploration manifest records a valid explicit submission and top-level exit status 0, while the agent tail process was killed with 137 during the submit call and left agent_state=failed; control and queue records classify the run as submitted terminal behavior, and the captured patch later replayed successfully. Stale attempt-status files for exploration and formal replay also retain status="running" despite later terminal receipts, formal runner_exit_status=0, and completion markers. This report follows the later, phase-specific receipts while preserving those anomalies.

2. Reader-facing overview

The task asks a fixed Llama-3.2-1B-Instruct model to forget TOFU forget10 knowledge without losing retain90 or general question-answering utility. The shipped method uses NPO: relative likelihood under the trainable model and a frozen copy of the start model supplies a forgetting loss, while ordinary retain90 answer negative log-likelihood supplies a utility loss. Its main limitation was sampling. Each epoch was anchored on only 400 forget examples and randomly paired retain examples, so ten epochs sparsely covered the 3,600-row retain set; the visible proxy showed substantial retain degradation.

The agent established the shipped control, then investigated retain-loss weight, retain-anchored pairing, training duration, export and checkpoint robustness, a lower retain weight, and a larger NPO beta. It submitted no new unlearning update rule. Instead, it doubled retain weight from 1 to 2, anchored batches on retain90, trained each member for eight epochs, fixed independent exports, and used the formal wall-clock budget to restart from the fixed model under successive seeds while publishing late checkpoints.

Formal replay ran for 40,191 seconds, 93.0% of the 12-hour budget, and completed 12 independent members with 896 optimizer updates each. Global artifact retention left only three accepted models, all from seed 11 at epoch 4, epoch 6, and the final 896-step state; this was not a cross-seed ensemble. Their official maximize-direction balanced_unlearning_score values were 0.990945, 0.992165, and 0.984089. Epoch 6 was best. Its Extraction was 0.069328 and model utility (MU) was 0.598069, versus 0.707805 and 0.597131 at the fixed start: forgetting improved sharply while utility was retained.

The strongest demonstrated capability is a source-level sampling diagnosis turned into a reproducible, high-scoring tradeoff. The main limitation is statistical and scheduling-related: exploration used one seed and a 24-row-per-split proxy, while formal replay computed 12 seeds but retained and evaluated only seed 11. The evidence therefore provides no seed variance, significance test, or cross-task generalization, and the proxy's “later is better” trend did not survive official evaluation.

3. Task, baseline, and evaluation contract

3.1 Task and fixed boundaries

• Training start: a fixed full Llama-3.2-1B-Instruct checkpoint, with locked revision and weight hashes. Formal replay had to restart from it rather than continue an exploration checkpoint.
• Permitted training assets: train-role forget10.json with 400 rows, retain90.json with 3,600 rows, and the bundled OpenUnlearning source. Every formal member receipt rechecked the fixed model and data hashes.
• Editable scope: the editable workspace training entry point, implementation, hyperparameters, sampling, and artifact-publication logic.
• Fixed or prohibited scope: start weights, data roles, final-role data, retain-reference model, evaluators, artifact limit, and resource boundaries. Network access, external data or checkpoints, and explore-to-formal weight transfer were prohibited.
• Proxy evaluator: maximize proxy_answer_nll_tradeoff. It makes one deterministic answer-NLL pass over 24 forget10 and 24 retain90 rows for both candidate and start, for 96 model-row evaluations, with sequence length capped at 512. The score rewards increased forget NLL and penalizes only positive retain-NLL degradation. It reports no repeated estimate, standard error, or confidence interval.
• Final evaluator: maximize balanced_unlearning_score, the harmonic mean of clipped forgetting progress and utility retention. Forgetting uses 400 forget10_perturbed rows. Utility aggregates 400 retain_perturbed, 100 real_authors_perturbed, and 117 world_facts_perturbed rows; 400 holdout10 rows support the privacy diagnostic. Each artifact receives one fixed official run, with no reported standard error or confidence interval.
• Artifact contract: publish self-contained Hugging Face models under run output area>. At most the three greatest valid numeric-progress artifacts are accepted.

The proxy measures local answer likelihood on visible train-role rows. The final protocol measures perturbed forgetting and broader native utility, then applies a different normalization and composite. Their absolute scores are not directly comparable; the proxy can only screen exploration directions.

3.2 How the baseline works

The baseline flow is: the fixed start and a paired forget10/retain90 batch enter a trainable model and a frozen reference copy; sequence NLL differences between current and reference models on forget answers form the NPO relative-likelihood loss; ordinary current-model NLL on retain answers forms the utility loss; forgetting weight 1 and retain weight 1 combine the two; paged AdamW updates every parameter of the current model; a complete Hugging Face model is exported.

The shipped configuration used learning rate 1.5e-5, NPO beta=0.1, ten epochs, per-device batch 8, gradient accumulation 4, effective batch 32, and seed 0. It anchored the dataset on forget10, traversing the 400 forget rows per epoch and randomly sampling a retain row for each. The exploration control completed 120 optimizer updates. Its original publication policy saved every five epochs and retained up to three artifacts.

The initial control showed stronger forgetting at the later state but still elevated retain answer NLL. Source inspection then identified the concrete bottleneck: forget anchoring only samples a small fraction of the 3,600 retain rows per epoch. This yielded a testable coverage hypothesis rather than merely increasing forgetting pressure.

4. Four-hour exploration and decision process

The early phase inspected the training and visible evaluator, established the shipped NPO control, and compared an intermediate with the final state. The middle phase tested retain weight, dataset anchoring, and one-, two-, four-, and eight-epoch durations while repairing exports. The late phase evaluated three late checkpoints, smoke-tested formal publication, ran two counter-ablations, checked the patch, and submitted. Apart from the one-step smoke test, substantive training occupied most of the 13,935 seconds. All proxy results below share the deterministic 24-row-per-split protocol and have no uncertainty estimate.

U-01 - Is the shipped NPO trajectory long enough?

Motivation and hypothesis. The agent first needed a measured shipped control and a decision between an intermediate fallback and the complete ten-epoch state.

Concrete change and setup. It kept forget anchoring, alpha=1, beta=0.1, and seed 0, ran ten epochs to 120 updates, and evaluated checkpoint step 65 and the final model.

Observed result. The step-65 proxy score was 1.422936; the final score was 1.697053. Final forget answer NLL rose from 0.098458 at the start to 2.694955, while retain answer NLL rose from 0.170965 to 1.070409. The training receipt passed; total runtime was about 545 seconds and trainer runtime about 480 seconds.

Agent interpretation. It judged the complete trajectory better because forgetting strengthened and retain degradation was smaller than at the intermediate checkpoint.

Report assessment and confounds. The within-run comparison is useful for progress, but step 65 is not exactly epoch 5.0. The small proxy is not an official baseline result.

Decision and impact. The final ten-epoch model became the control; the next experiment targeted retain degradation rather than shortening the shipped path.