Paper: arXiv:2608.14229
Imagine forgetting a person. A casual acquaintance is easy to forget; a friend of ten years is etched into memory. Language model unlearning works the same way: how many times a fact appeared in pretraining determines how deeply it is encoded. Rare facts, seen only a few times, are easy to erase; popular facts are repeatedly encoded deep in the parameters and resist the same force.
The problem: existing machine unlearning methods — Gradient Ascent (GA), Gradient Difference (GD), NPO, WGA — treat every forget sample as equally hard. It's like cleaning a wine glass and a cast-iron pan with the same brush.
AdaPop's core insight: forgetting difficulty scales with fact popularity, but gradient updates make no distinction.
The Popularity Gap: A Systemic Failure
The paper names this phenomenon the "popularity gap":
- Rare facts are over-erased: gradient pressure is too strong, destroying capabilities the model should retain.
- Popular facts are under-erased: gradient pressure is too weak; rephrasing the question can retrieve the supposedly forgotten answer.
- ~5x less leakage under paraphrased queries: forgotten content resists retrieval via rephrasing.
- ~1.6x less leakage under adversarial queries: adversarial prompts designed to extract unlearned information are less successful.
- Retention preserved: MMLU and HellaSwag shift by no more than 0.05 before and after unlearning.
This is not a bug in one method but a shared flaw. Krishnan et al. 2025 and Borisiuk et al. 2026 documented the phenomenon, but no training-time solution was proposed.
Why can't prior fixes work? WGA weights updates by the model's own confidence, but confidence reflects "current output behavior," not "parametric encoding depth." A fact may have low confidence yet remain deeply rooted in the parameters, and vice versa. You need an external signal — popularity — to measure encoding depth.
AdaPop: External Popularity Signal + Dual-Ascent Controller
AdaPop does two things:
1. Converts an external popularity signal into gradient weights. Popularity scores from Wikidata are mapped to a power-law exponent β that weights the per-token ascent gradient. High-popularity facts get sharper ascent signals; low-popularity facts get gentler ones — directly targeting the root cause of the gap. 2. A dual-ascent controller automatically balances forgetting and retention. The retention penalty acts as a Lagrangian multiplier, adjusted each epoch based on drift in the retention loss. This removes per-dataset hyperparameter tuning and prevents retention collapse as forgetting pressure grows.
The β derivation is principled: Appendix B gives a full three-regime analysis — β < 0 amplifies rare facts (counterintuitive but useful), β = 0 reduces to uniform weights (equivalent to GA), β > 0 amplifies popular facts. The authors provide a closed-form solution calibrated with three anchors plus empirical Wikidata scores.
Results: 5x Less Leakage
Tested on Llama-3.1-8B, Qwen2.5-7B, and Gemma-7B with two real-world benchmarks (DUET and RWKU):
| Method | Forgetting | Retention | Problem | |--------|-----------|-----------|---------| | GA | Strong | Collapses | Language ability falls apart | | GD | Weak | Asymmetric damage | Hurts both rare and popular | | NPO | Moderate | Stable | Can't move deeply encoded facts | | WGA | Model-dependent | Model-dependent | Confidence ≠ encoding depth | | AdaPop | Strongest | Stable | — |
The key point is not just "more thorough forgetting" but "more precise forgetting." Internal representation analysis shows AdaPop's hidden states for the forget set move farther from the original model than other methods (true internal erasure), while retain-set hidden states barely move (retention intact).
Another Case of the Evaluation Blind-Spot Law
AdaPop fits the "evaluation blind-spot law" perfectly. Prior unlearning evaluation used average pass rates — "how much was forgotten on average." Averages hide the paired structure: over-forgetting of rare facts + under-forgetting of popular facts = fine-looking averages.
This matches Progressive Cramming (99% token accuracy masking 100% generation failure) and the Regression Tax (average gains masking 59% regressions): a single metric can hide key failure modes.
AdaPop's contribution is not only a better unlearning method but a better evaluation lens — stratifying leakage by popularity reveals where failures actually live. DUET's paraphrase subset and RWKU's adversarial-robustness subset implement exactly this stratified evaluation.
A Deeper Insight
One sentence from the paper deserves re-reading: "confidence reflects current output behaviour rather than parametric encoding depth."
This points to a general problem: the model's own signals are not the model's true internal state. AdaPop says model confidence is a snapshot of output behavior, not a measurement of parameter depth. To measure encoding depth you need an external signal (popularity); to test whether a model truly "knows" something, you need behavioral probes (residual-stream directions). What the model says about itself doesn't count.
---
Paper: arXiv:2608.14229 Code: github.com/Anya-wUw/open-unlearning HTML full text: arxiv.org/html/2608.14229v1