SHRED Benchmark Dashboard

Token-level softmax probabilities on forget sets — how well does each model memorize its training data?

Pretrained knowledge (forget data in pretraining only)

Knowledge injected via fine-tuning

Mean token probability by position — 100 examples per category shaded = ±1 std · QA: position 0 = first answer token

Token probability density + average vocabulary rank per bin colored curve = KDE density (left axis) · white bars + curve = avg rank (right axis, needs rerun) · gold dashed = mean · purple dotted = median

Domain

Task

Color mode

low

high

Mean token probability vs duplication level —

MUSE News — Token Probability Analysis

Llama-2-7b-hf continued-pretrained on 300 news articles. The "full model" stores high verbatim memory for these articles — this view would show per-token softmax probabilities on forget set texts.

Model

muse-bench/MUSE-News (Llama-2-7b-hf)

Forget set

300 news articles · verbmem split

Memorization

Continued pretraining · ~10k steps

Compute command (cluster)

python experiments/analysis/compute_bench_token_probs.py --bench muse-news --output experiments/analysis/muse_news_token_probs.json

MUSE Books — Token Probability Analysis

Llama-2-7b-hf continued-pretrained on book excerpts. High verbatim memorization of extended narrative text, unlike shorter news snippets.

Model

muse-bench/MUSE-Books (Llama-2-7b-hf)

Forget set

Book excerpts · verbmem split

Memorization

Continued pretraining · ~13k steps

Compute command (cluster)

python experiments/analysis/compute_bench_token_probs.py --bench muse-books --output experiments/analysis/muse_books_token_probs.json

TOFU — Token Probability Analysis

Models fine-tuned on 200 fictional author biographies and Q&A pairs. The forget set (forget10 = 200 authors, 10% of all) is memorized via SFT. Q&A format means individual answer tokens carry very high probability.

Models

open-unlearning/tofu_Llama-3.2-1B-Instruct_full (+ 3B, 8B)

Forget set

forget10 · 200 fictional authors · 4000 Q&A pairs

Memorization

SFT · 5 epochs on Q&A pairs

Compute command (cluster)

python experiments/analysis/compute_bench_token_probs.py --bench tofu --output experiments/analysis/tofu_token_probs.json

RWKU — Token Probability Analysis

Real-World Knowledge Unlearning benchmark. 200 Wikipedia entities (people, organizations) the model knows from pretraining. Unlike TOFU, memorization comes from pretraining data, not explicit fine-tuning.

Model

Llama-2-7b-chat-hf (pretrained)

Forget set

200 Wikipedia entities · fill-in-blank + QA tasks

Memorization

Pretraining (factual recall)

Compute command (cluster)

python experiments/analysis/compute_bench_token_probs.py --bench rwku --output experiments/analysis/rwku_token_probs.json

WMDP — Token Probability Analysis

Weapons of Mass Destruction Proxy benchmark. Hazardous biosecurity and chemistry knowledge from pretraining. Measured as MCQ accuracy; token probs on answer choices reflect the model's "confidence" in dangerous knowledge.

Model

Zephyr-7b-beta (pretrained)

Forget set

~3500 MCQ questions · bio + chem hazard knowledge

Memorization

Pretraining (factual/procedural knowledge)

Compute command (cluster)

python experiments/analysis/compute_bench_token_probs.py --bench wmdp --output experiments/analysis/wmdp_token_probs.json

P ∈ {10, 25, 50, 75, 100} × BS ∈ {1, 2, 4, 8, 20, 40} × LR ∈ {5e-6, 1e-5, 2e-5, 5e-5, 1e-4} | Llama-3.2-1B-Instruct, forget10

Llama-3.2-1B-Instruct — Baseline Comparison

Method	Forget Prob ↓	Forget ROUGE ↓	Forget Truth Ratio	Model Utility ↑	Extraction ↓	PrivLeak

Llama-2-7b-chat-hf — Baseline Comparison 8/8

Method	Forget Prob ↓	Forget ROUGE ↓	Forget Truth Ratio	Model Utility ↑	Extraction ↓	PrivLeak

7B Model Utility Breakdown — Per-Split Comparison

Full Model vs Retain90 (gold) vs SHRED P=50 — why SHRED achieves higher MU

Key Insight

SHRED P=50 achieves MU=0.637 — higher than the full model (0.627).

Truth Ratio = P(correct) / (P(correct) + P(perturbed))
Measures calibration: can the model distinguish real answers from paraphrased versions? 0.5 = random, higher = better.

Why MU is higher: The full model is over-memorized. SHRED redistributes logits, improving calibration:

• Truth Ratio ↑ across all splits — especially ra (+0.04) and wf (+0.09)

• Probability ↑ on ra/wf — model becomes more confident on retain knowledge

• ROUGE ↓ on retain (0.769 vs 0.982) — less verbatim memorization

MU = harmonic mean across splits. SHRED's better calibration compensates for lower raw ROUGE, yielding a higher overall MU.

Training Convergence — P=50%, LR=1e-5, by Batch Size

Wall-clock time vs metrics at each checkpoint

Training step vs metrics at each checkpoint

Privacy Leak (MIA) vs Step — TOFU ShredFF (P=50%, LR=1e-5)

Fixed slice P=50%, LR=1e-5 across BS ∈ {1,2,4,8,20,40}. Each line = one config. Optimal = 0. Negative = under-unlearned, Positive = over-unlearned. Dashed lines = baselines.

Llama-2-7b-hf | News & Books corpora | Baselines from open-unlearning repro.md

News Llama-2-7b-hf

Method	VerbMem ↓	KnowMem ↓	Retain ↑	PrivLeak

Books Llama-2-7b-hf

Method	VerbMem ↓	KnowMem ↓	Retain ↑	PrivLeak

News — Pareto (VerbMem ↓ vs Retain ↑)

VerbMem ↓ vs Retain ↑

KnowMem ↓ vs Retain ↑

ShredLong Grid — Pareto by Hyperparameter (Books)

Books is harder to unlearn (denser memorization). Latest epoch per config; many configs still in progress.

VerbMem ↓ vs Retain ↑

KnowMem ↓ vs Retain ↑

Privacy Leak (MIA) vs Epoch

MIA-based privacy leakage over training. Optimal = 0 (indistinguishable from retrained model). Negative = under-unlearned (still leaks membership). Positive = over-unlearned (model behavior on forget data diverges detectably). Horizontal lines = baseline methods.

ShredLong — Optimizer Comparison paged_adamw_32bit (2×GPU) vs adamw_bnb_8bit (1×GPU) · P=25%

Split	Optimizer	Step time	Forget VerbMem ↓	Forget KnowMem ↓	Retain KnowMem ↑	Extraction ↓	PrivLeak

WMDP-Cyber | zephyr-7b-beta | 1273 MCQA | Utility = MMLU

WMDP Cyber — current runs

Method	wmdp_cyber ↓	mmlu ↑	notes

Real-World Knowledge Unlearning | 200 famous people, zero-shot entity removal | LLaMA-3-8B-Instruct | Baselines from RWKU paper (Jin et al. 2024)

Baseline Performance — Meta-Llama-3-8B-Instruct — "Before (ours)" = our eval pipeline on the base model; other rows are from the RWKU paper (different eval protocol, not directly comparable)

Method	Forget ↓				Neighbor ↑			MIA		Utility ↑
Method	FB	QA	AA	All	FB	QA	All	FM↑	RM↓	Gen	Rea	Tru	Fac	Flu

Key Observations

• ICU best forget (All: 12.8) but destroys neighbors (55.7 vs 90.7)

• NPO (Full) best trainable method (All: 26.2) with decent neighbors (72.6)

• RT (Full) excellent QA forget (13.4) but poor FB (72.7) — refusal surface-level

• GA* catastrophic MIA scores (1640.9) — over-optimization

• LoRA variants consistently underperform Full across all methods

• All methods trade neighbor quality for forgetting — SHRED may offer better locality

Benchmark Comparison

Criteria	TOFU	MUSE	RWKU
Targets	—	2	200
Forget Probes	4,000	220	13,131
Real-World	✗	✓	✓
Zero-Shot	✗	✗	✓
Adversarial	✗	✗	✓
Neighbor	✓	✗	✓
MIA	✗	✗	✓

Multi-scenario memorization benchmark — Copyright, Privacy, Test contamination

Hubble(C) — Copyright

passages_gutenberg_popular • paraphrases_paws

⏳ Not yet started

Hubble(P) — Privacy

biographies_yago • chats_personachat

⏳ Not yet started

Hubble(T) — Test Contamination

testset_MMLU • testset_ellie

⏳ Not yet started

Robustness to relearning — can the unlearned model recover forgotten knowledge via fine-tuning?

Relearning Attack Protocol

Take unlearned model (SHRED, GradAscent, GradDiff, NPO, RMU)
Fine-tune on forget set with LR ∈ {1e-6, 5e-6, 1e-5} for 1–5 epochs
Eval forget_prob at each epoch → recovery curve
Steeper recovery = weaker unlearning

⏳ Not yet started

⏳ Relearning curve — epochs vs forget_prob recovery

Continual learning after unlearning — does forgetting persist when the model learns new knowledge?

Continual Learning Protocol

Unlearn with SHRED (P=50, best config) on forget10
Continue training on retain/holdout data
Measure: forget_prob stays low, MU doesn’t degrade
Compare: do baselines retain unlearning after new learning?

⏳ Not yet started

⏳ Continual learning — training steps vs forget_prob / MU

DESIGN

Document tiled into non-overlapping [T context] + [C target] windows, stride = T+C (no overlap, no wasted tokens). Loss and SHRED demotion applied only to target. Standard causal attention — no custom mask needed. Currently running: T=128, C=256 (stride=384).

sample 1

Attention mask — sample window (rows = query, cols = key)

Token probability by position — context size comparison

How much context each token sees determines prediction confidence and SHRED signal strength. Autoregressive = full causal (growing context, position bias). Sliding window-8 = every token sees exactly 8 prior tokens. T=128 ShredLong = every target token sees exactly 128 prior tokens (data pending).

SHRED Unlearning — Resource requirements

GPU requirements per training run

One SHRED run = 50 epochs on MUSE News forget set (~2K sequences). Lower bound: QLoRA (4-bit base + LoRA r=32) + 8-bit Adam. Upper bound: full BF16 fine-tune with AdamW FP32 master states + FSDP.

Model	Params	Lower bound (LoRA + 8-bit)			Upper bound (Full BF16)
Model	Params	GPU	Mem	Hours	GPU	Mem	Hours
Llama 2 7B	6.7 B	1× A100 40G	~10 GB	~8h	1× A100 80G	~75 GB	~20h
Gemma 4 31B	31 B	1× A100 80G	~32 GB	~28h	4× H100 80G (FSDP)	~370 GB	~70h
Llama 3.3 70B	70.6 B	1× H100 80G	~52 GB	~60h	8× H100 80G (FSDP+offload)	~840 GB	~160h

Total compute ask — scaling study

Model	Runs	LoRA GPU-h	Full BF16 GPU-h
Gemma 4 31B	20	560	1,400
Llama 3.3 70B	10	600	1,600
Total	30	~1,160 GPU-h	~3,000 GPU-h

Software stack

Framework	HuggingFace Transformers + Accelerate + PEFT + bitsandbytes
Multi-GPU	FSDP2 (full shard) or DeepSpeed ZeRO-3 with CPU offload
Attention	FlashAttention-2
Optimizer	adamw_bnb_8bit (LoRA) or AdamW FP32 master (full BF16)
Precision	BF16 forward/backward, optional FP8 on H100 via TransformerEngine

Experiments run

260+

training runs across benchmarks

GPU-hours used

~3,200

A6000 + A100 (USC CARC)

Models trained

1B → 8B

Llama-2/3 family, 4 model sizes

Benchmarks

TOFU · MUSE · WMDP · RWKU

Base Models

Model	Params	HF Repo	Precision	Peak GPU mem	Used for
Llama-3.2-1B-Instruct	1.2 B	open-unlearning/tofu_Llama-3.2-1B-Instruct_full	BF16	~8 GB	TOFU (main)
Llama-3.2-3B-Instruct	3.2 B	open-unlearning/tofu_Llama-3.2-3B-Instruct_full	BF16	~14 GB	TOFU
Llama-2-7b-hf	6.7 B	muse-bench/MUSE-News_target, MUSE-Books_target	BF16	~36 GB	MUSE News + Books
Llama-2-7b-chat-hf	6.7 B	open-unlearning/tofu_Llama-2-7b-chat-hf_full	BF16	~36 GB	TOFU 7B
Llama-3.1-8B-Instruct	8.0 B	open-unlearning/tofu_Llama-3.1-8B-Instruct_full	BF16	~40 GB	TOFU 8B

Training Specifications

Setting	Value	Rationale
Model precision	BF16 (bfloat16)	Full model + forward/backward in BF16; no quantization of weights
Optimizer	adamw_bnb_8bit	8-bit Adam optimizer states (bitsandbytes); ~4× memory savings on optimizer
Learning rate	1e-5 (1B-3B) / 1e-5 (7B)	Low LR prevents catastrophic forgetting of utility
Context length	128 / 512 / 2048	Swept in MUSE grid; TOFU uses 512
Batch size	1, 2, 32 per-device	Small batches preserve utility (counterintuitive: opposite of learning)
Gradient accumulation	Up to 16 steps	Reaches effective batch sizes >32 without GPU memory cost
Epochs	10-50	Overtraining sweep — convergence + collapse study
Eval frequency	Every epoch	Trajectory analysis of forgetting vs utility vs privacy leak
Checkpointing	keep 3 latest	Storage management — full grid would need >10 TB otherwise
Framework	open-unlearning (HF Transformers + Accelerate)	Community reference framework, >10 unlearning methods
Memory optimization	PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True	Prevents eval-time OOM on long sequences

Grid Search Scope (SHRED method)

Dimension	Values	Count
Demote percentage (P)	{10, 25, 50, 75, 100}%	5
Learning rate	{5e-6, 1e-5, 2e-5, 5e-5, 1e-4}	5
Batch size	{1, 2, 4, 8, 20, 40}	6
Context length (L)	{128, 512, 2048}	3
Skip tokens (S)	{0, 8, 32}	3
Top-K (distillation)	{32, 64, 128}	3
Benchmarks × splits	TOFU (forget10) · MUSE (News, Books) · WMDP · RWKU	5
Baseline methods	GradAscent · GradDiff · NPO · SimNPO · DPO · RMU · IDK	7
Model sizes	1B · 3B · 7B · 8B	4

Compute Usage — Completed + In-Progress

Experiment block	Runs	GPU × h / run	Total GPU-h	GPU used
TOFU 1B grid	150 configs (P × LR × BS)	~2h	~300	RTX A6000 48 GB
TOFU 7B/8B	30+ configs	~6h	~200	A100 80 GB
MUSE News grid	27 configs (L × S × BS)	~16h	~430	RTX A6000 48 GB
MUSE Books grid	27 configs × 50 epochs	~20h (est)	~540	RTX A6000 48 GB
Baselines (all benchmarks)	~40 runs	~3h avg	~120	mixed
Token-probability analysis	8 runs × 5 inference modes	~0.1h	~5	A6000/A100
Checkpoint evaluations	~800 per-epoch evals	~0.08h	~65	mixed
TOTAL (so far)	~280+ runs		~1,660
In progress + queued	19 L512+L2048 Books	~25h	~480	A6000

Projected Full-Scale Requirements

To complete the paper's planned experiments (full model × benchmark × method matrix + ablations on robustness, relearning attacks, sequential unlearning, and scaling laws), we estimate:

Experiment category	Configs	GPU-hours	Timeline (GC A100)
Complete MUSE grid (Books + News) all models	~160 runs	3,200	~3 weeks on 8× A100
TOFU sequential unlearning (forget01 → 05 → 10)	~60 runs	400	~3 days on 8× A100
Relearning attack robustness (k% sweep)	~100 runs	500	~4 days on 8× A100
WMDP bio+cyber × methods	~40 runs	800	~1 week on 8× A100
RWKU 200-entity sweep	~80 runs	1,600	~2 weeks on 8× A100
Scaling: SHRED on 13B/70B (future work)	~30 runs	2,000	~2 weeks on 8× H100
TOTAL planned	~470 runs	~8,500 GPU-h	~6-8 weeks on 8× A100

Scaling to Larger Models — GPU Requirements

Estimated GPU setup to train SHRED on frontier open-weight models. Lower bound: QLoRA (4-bit base + LoRA adapters, r=32) + 8-bit Adam — memory-optimized, quality trade-off acceptable for unlearning. Upper bound: full BF16 fine-tuning with AdamW in FP32 — paper-quality results, reference-grade. Memory accounting: weights + gradients + optimizer state (2× weights for Adam) + activations.

Model	Params	LoRA + 8-bit (lower bound)			Full BF16 (upper bound)
Model	Params	GPU setup	Peak mem	GPU-h / run	GPU setup	Peak mem	GPU-h / run
Gemma 4 31B	31 B	1× A100 80G	~32 GB	~28h	4× H100 80G (FSDP)	~370 GB	~70h
Llama 3.3 70B	70.6 B	1× H100 80G	~52 GB	~60h	8-16× H100 80G (FSDP+offload)	~840 GB	~160h
Llama 3.1 405B	405 B	4× H100 80G (FSDP)	~260 GB	~240h	64× H100 80G (multi-node FSDP)	~4.8 TB	~600h

GPU-hours estimated on the MUSE News forget set (~2K sequences, 50 epochs). Linear scaling with # chunks. Multi-GPU numbers include communication overhead (~15-25% vs ideal).

Setup Detail — LoRA + 8-bit (Lower Bound)

Component	Choice	Memory impact
Base model	bitsandbytes NF4 quantization (4-bit)	Weights: ~0.5 byte/param (e.g. 70B → 35 GB)
LoRA adapters	r=32, α=64, dropout=0.05, target: q_proj, k_proj, v_proj, o_proj, gate/up/down_proj	~0.5-1% of base params, trainable in BF16 (~350 MB for 70B)
Gradients	Only on LoRA adapters	Same size as adapters
Optimizer	adamw_bnb_8bit (8-bit Adam states)	2× adapter size (m + v), quantized to INT8
Activations	Gradient checkpointing ON	~1-2 GB per 1B params at L=2048
Paged optimizer	paged_adamw_8bit (optional)	Offloads Adam state to CPU when GPU full; ~2× slower
Software stack	peft + bitsandbytes + transformers + accelerate	—

Setup Detail — Full BF16 (Upper Bound)

Component	Choice	Memory impact
Base model	BF16 full precision	2 bytes/param (70B → 140 GB)
Gradients	BF16 for all params	2 bytes/param (70B → 140 GB)
Optimizer	AdamW FP32 master states (mixed-precision)	8 bytes/param (m + v, FP32) → 70B = 560 GB
Activations	Gradient checkpointing ON (required for >27B)	~6-12 GB per 10B params at L=2048
Parallelism	FSDP (full shard) + CPU offload for optimizer	Distributes states across N GPUs + RAM
Interconnect	NVLink (intra-node) + InfiniBand (multi-node)	Critical for >8 GPUs — gradient all-reduce cost
Recommended instance	a3-highgpu-8g (8× H100 80G, 640 GB VRAM)	Fits 27B full FP, or 70B with CPU offload
Software stack	pytorch FSDP2 + transformers + accelerate + deepspeed ZeRO-3	—

Projected GPU-Hours — Full Paper + Scaling Study

Study	Runs	GPU-h (LoRA)	GPU-h (Full BF16)
Gemma 4 31B × MUSE × SHRED grid (P, BS)	~20	~560	~1,400
Llama 3.3 70B × MUSE News × SHRED	~10	~600	~1,600
Llama 3.1 405B × MUSE News (proof-of-scale)	~3	~720	~1,800
TOTAL scaling study	~58	~2,055 GPU-h	~5,200 GPU-h

LoRA path enables rapid iteration & ablation; full BF16 path gives the reference numbers for the paper's scaling claim. Running both for Gemma 2 9B (~1,260 h total) provides a LoRA-vs-full comparison to validate the QLoRA-SHRED path on smaller model before committing H100 budget on 70B+.

Why Scale Up

Problem: Regulatory frameworks (GDPR Art. 17, EU AI Act) require deployed LLMs to support right-to-be-forgotten requests. Retraining from scratch on a 70B model costs millions. Current unlearning methods either destroy utility or leak private data via MIA.

Contribution: SHRED achieves competitive forgetting with no retain data, matches specialized methods on MIA leakage (~0), and discovers a principled small-batch-is-better phenomenon. The self-distillation framing generalizes naturally to continual learning (SDFT) and RL (SDPO).

What scale-up enables:

Production-scale validation: Gemma 27B / Llama 70B / 405B on real deployment data (currently bottlenecked at 7B by single-GPU memory)
Online unlearning: stream of forget requests over days — requires sustained training infrastructure
Adversarial robustness: relearning attacks need many fine-tuning rounds per unlearned model
Cross-domain transfer: code, medical, legal, multilingual — each needs separate grid sweeps
LoRA-vs-full comparison: establish whether parameter-efficient unlearning preserves SHRED's MIA guarantees — key practical question for deployers

Current Infrastructure (USC CARC)

Resource	Detail
Cluster	USC CARC Endeavour (condo + discovery tiers)
Available GPUs	~60× RTX A6000 48G · 4× A100 80G (shared, QOS-capped at 8/user)
Queue wait time	0-24h typical (preempted on `nlp` partition, priority on `nlp_hiprio`)
Storage	15 TB project · 10 TB scratch · 100 GB home
Bottleneck	8-GPU-per-user concurrent limit → long total wall-clock for large grids

Prepared for Google Cloud research credits proposal · SHRED unlearning project