Safety Unlearning on BeaverTails
0Harmful Response ProbabilityRepSelect
Evaluation Results
| Method | Links | |
|---|---|---|
| RepSelectModel=Llama-3.1-8B, Attack=No attack2026.06 | 0 | |
| GradDiffModel=Llama-3.1-8B, Attack=No attack2026.06 | 0 | |
| RepSelectModel=Qwen3.5-9B, Attack=No attack2026.06 | 0 | |
| RepSelectModel=Qwen3.5-9B, Attack=Few-shot k=52026.06 | 0 | |
| RepSelectModel=Qwen3.5-9B, Attack=Few-shot k=102026.06 | 0 | |
| GradDiffModel=Qwen3.5-9B, Attack=No attack2026.06 | 0.3 | |
| RMUModel=Llama-3.1-8B, Attack=No attack2026.06 | 0.4 | |
| RMUModel=Qwen3.5-9B, Attack=No attack2026.06 | 0.8 | |
| RMUModel=Qwen3.5-9B, Attack=Few-shot k=52026.06 | 0.9 | |
| RepSelectModel=Llama-3.1-8B, Attack=Few-shot k=102026.06 | 1 | |
| RepSelectModel=Llama-3.1-8B, Attack=Few-shot k=52026.06 | 1.3 | |
| RMUModel=Qwen3.5-9B, Attack=Few-shot k=102026.06 | 1.5 | |
| GradDiffModel=Llama-3.1-8B, Attack=Few-shot k=52026.06 | 2 | |
| SimNPOModel=Llama-3.1-8B, Attack=No attack2026.06 | 2.7 | |
| GradDiffModel=Llama-3.1-8B, Attack=Few-shot k=102026.06 | 3 | |
| SimNPOModel=Llama-3.1-8B, Attack=Few-shot k=52026.06 | 3.1 | |
| SimNPOModel=Llama-3.1-8B, Attack=Few-shot k=102026.06 | 3.1 | |
| GradDiffModel=Qwen3.5-9B, Attack=Few-shot k=52026.06 | 3.6 | |
| UNDIALModel=Qwen3.5-9B, Attack=No attack2026.06 | 4.6 | |
| GradDiffModel=Qwen3.5-9B, Attack=Few-shot k=102026.06 | 7.3 | |
| NPOModel=Qwen3.5-9B, Attack=No attack2026.06 | 7.8 | |
| NPOModel=Qwen3.5-9B, Attack=Few-shot k=52026.06 | 7.9 | |
| NPOModel=Qwen3.5-9B, Attack=Few-shot k=102026.06 | 8.5 | |
| NPOModel=Llama-3.1-8B, Attack=No attack2026.06 | 11.9 | |
| No unlearnModel=Qwen3.5-9B, Attack=No attack2026.06 | 12.8 | |
| No unlearnModel=Qwen3.5-9B, Attack=Few-shot k=52026.06 | 14.4 | |
| NPOModel=Llama-3.1-8B, Attack=Few-shot k=52026.06 | 14.5 | |
| UNDIALModel=Qwen3.5-9B, Attack=Few-shot k=52026.06 | 14.5 | |
| No unlearnModel=Qwen3.5-9B, Attack=Few-shot k=102026.06 | 14.8 | |
| UNDIALModel=Qwen3.5-9B, Attack=Few-shot k=102026.06 | 14.9 | |
| NPOModel=Llama-3.1-8B, Attack=Few-shot k=102026.06 | 15.1 | |
| UNDIALModel=Llama-3.1-8B, Attack=No attack2026.06 | 15.6 | |
| No unlearnModel=Llama-3.1-8B, Attack=No attack2026.06 | 15.6 | |
| SimNPOModel=Qwen3.5-9B, Attack=No attack2026.06 | 16.4 | |
| SimNPOModel=Qwen3.5-9B, Attack=Few-shot k=52026.06 | 17.6 | |
| RMUModel=Llama-3.1-8B, Attack=Few-shot k=52026.06 | 17.8 | |
| SimNPOModel=Qwen3.5-9B, Attack=Few-shot k=102026.06 | 17.8 | |
| RMUModel=Llama-3.1-8B, Attack=Few-shot k=102026.06 | 18.6 | |
| UNDIALModel=Llama-3.1-8B, Attack=Few-shot k=52026.06 | 19.9 | |
| No unlearnModel=Llama-3.1-8B, Attack=Few-shot k=52026.06 | 20 | |
| UNDIALModel=Llama-3.1-8B, Attack=Few-shot k=102026.06 | 20.2 | |
| No unlearnModel=Llama-3.1-8B, Attack=Few-shot k=102026.06 | 20.2 |