Wisdom is Knowing What not to Say: Hallucination-Free LLMs Unlearning via Attention Shifting

Thank you for highlighting the novelty of our attention-based unlearning approach, its strong empirical performance across ToFU and TDEC, and its practical value for privacy-preserving applications. We also appreciate your recognition of the method’s clarity, robustness across settings, and zero-hallucination results. Please find our response to your question below.

---

[Q1] Interpretability attention shifts & Real-World Gaps

---

A1: We agree that a more intuitive understanding of how attention is reallocated would enhance interpretability.

1. We plan to include additional visualizations of attention heatmaps (e.g., before and after suppression) and their correlation with model uncertainty. In particular, we aim to show how the redirection of attention to neutral tokens increases entropy and reduces model confidence on forgotten facts, clarifying how AS behaviorally enforces unlearning.

2. We appreciate the suggestion to further explore the applicability of our method in real-world and multilingual settings. While our current evaluation focuses on two established unlearning benchmarks, ToFU and TDEC, these datasets are intentionally chosen to cover a broad spectrum of unlearning scenarios. ToFU provides a controlled, structured synthetic setup that enables precise measurement of unlearning behaviors, while TDEC contains noisy, real-world factual triples derived from natural corpora, offering more realistic challenges. The fact that our method performs consistently well across both datasets, and across two model architectures (LLaMA and GPT), demonstrates its adaptability and robustness.

3. We agree that multilingual unlearning remains an open and important direction. However, to the best of our knowledge, there are currently no standardized multilingual benchmarks specifically designed for selective unlearning evaluation. We see this as an exciting area for future work, and we plan to explore multilingual extensions of our attention-shifting mechanism, including cross-lingual unlearning and language-specific retention strategies.

---

[Q2] Did the authors evaluate the impact of placing adapters after query/key vs. value projections?

---

A2: Thank you for the thoughtful question. We acknowledge that adapter placement is a key design choice. In Appendix B.1, we discuss that placing adapters after Q/K projections allows indirect control of attention weights with minimal overhead. Additionally, we have experimented with placing adapters after the value (V) projection, and find it provides comparable unlearning performance while remaining lightweight.

Furthermore, we have included quantitative comparisons of adapter placement in terms of memory overhead, parameter update size, and unlearning effectiveness. We found that both placements achieve comparable unlearning effectiveness, with the V-based setup offering slightly lower computational cost due to simpler gradient flow. These results suggest flexibility in adapter placement, and we will include a brief comparison in the revised version to clarify this trade-off.

---

[Q3] AS's sensitivity to input quality in importance estimation

---

A3: We acknowledge that AS shows reduced performance on TDEC compared to ToFU as discussed in Section 4.4 of our paper, primarily due to data quality differences. TDEC contains highly noisy and unstructured samples, e.g., URLs, code snippets, or markup, which limit the effectiveness of entropy-based token importance estimation. In contrast, ToFU’s structured natural language allows more precise identification of content-bearing tokens.

However, AS still achieves comparable unlearning results on TDEC under multiple metrics, demonstrating robustness despite input noise. We acknowledge that token importance estimation remains a bottleneck under such conditions. To address this, we plan to explore structure-aware importance scoring strategies that incorporate additional features, such as layout patterns, token type heuristics, or domain-specific markers, to improve robustness in noisy contexts. We have already clarified this limitation and will add the future direction in the revised manuscript.

---

[Q4] How robust the attention-based suppression is to adversarial probing techniques?

---

A4: AS demonstrates strong robustness against adversarial probing techniques that attempt to elicit unlearned knowledge through indirect queries (as shown in the table below).

To assess robustness against indirect elicitation strategies, we conduct prompt variant evaluations wherein target queries are rephrased or perturbed with random tokens as shown in the table below. AS maintains a high Top-k Ignore Rate (TR > 92%), indicating that target tokens are consistently excluded from the predictive distribution (as we discussed in Section 4.2), even when the query surface form varies significantly. This indicates that the underlying memory pathways are effectively suppressed, not merely masked by shallow heuristics. While a full adversarial probing suite, e.g., synthetic gradient attacks, is beyond the scope of this initial work, we view it as an important direction. We will incorporate these robustness findings more clearly in the revised manuscript and expand on adversarial resilience in future work.

---

[Q5] AS may not fully erase internal representations. Could AS be combined with techniques that erase internal representations for stronger guarantees?

---

A5: Thank you for highlighting this important point. Indeed, as acknowledged in Section 4.4 of our paper, our method focuses on behavioral unlearning, i.e., preventing the model from expressing memorized target knowledge under typical inference conditions. We explicitly discussed the potential gap between behavioral suppression and full representational erasure, especially in high-security settings, and positioned our approach accordingly.

We believe this distinction is important to clarify the scope of our contribution. Behavioral suppression remains the dominant objective in many real-world unlearning applications where model inference behavior is the primary concern, e.g., content moderation, legal takedown requests. While our current method focuses on behavioral suppression through attention shifting, we acknowledge, as Section 4.4 shows, that latent traces may still reside in intermediate representations.

To address this, a promising future direction is to combine our attention-level suppression with representation-level erasure techniques, such as projecting hidden states away from target directions. Concretely, this can be done by identifying principal components associated with the target concept and then removing their projections during fine-tuning or at inference time. This could further eliminate memorized activation patterns and enhance robustness in privacy-critical applications. We will discuss it as future work in the revised version.

---

[Q6] How does it scale when applied to very large-scale models (e.g., GPT-3.5 or GPT-4 size)?

---

A6: Thank you for the insightful question. Our method is designed to be scalable to large models in principle, as it relies only on lightweight adapter updates and operates without modifying the frozen backbone. This design minimizes computational overhead and makes it compatible with large-scale deployment. To further validate scalability, we applied AS to a larger model, LLaMA-13B, which was fine-tuned by us on the public PubMedQA dataset to memorize medical question-answer pairs. We applied AS to unlearn 2%, 5%, and 10% samples of the training dataset. As shown in the table below, AS achieves strong unlearning performance with minimal utility loss, demonstrating its effectiveness even at higher model scales.

We acknowledge that further evaluation on proprietary large models like GPT-3.5/4 is currently limited due to infrastructure constraints. Nonetheless, our LLaMA-13B results suggest that AS generalizes well to high-capacity settings. We will clarify this point and include these new results in the revised manuscript.

---

[Q7] Can AS be demonstrated on real-world datasets like medical QA beyond synthetic benchmarks?

---

A7: Thank you for the valuable suggestion. We fully agree that demonstrating AS on real-world, privacy-sensitive data is important. As shown in Q6/A6 and the accompanying table, we conducted a new experiment on PubMedQA, a biomedical QA dataset. We fine-tuned LLaMA-13B on question–long_answer pairs and then applied AS to unlearn specific biomedical claims. This setup allows us to evaluate AS in a realistic, medically grounded domain. The results show consistent unlearning performance while preserving remaining QA capabilities. Full results and analysis will be included in the revised version.

We appreciate your recognition of the novelty of attention-level unlearning, our dual-loss formulation for balancing unlearning and retaining, and the strong empirical performance on benchmarks. Please find our response to your question below.

---

[Q1] Threshold Determination and Hyperparameter Analysis

---

A1: We adopt two strategies for identifying important tokens based on dataset characteristics: (1) POS-based (used in ToFU): For structured inputs, we suppress attention to content words, e.g., nouns, verbs, identified via POS tagging, while boosting function words. (2) Entropy-based (used in TDEC): For noisy or irregular inputs, e.g., URLs, code, where POS is unreliable, we compute token importance via changes in predictive entropy (Eq. 1, Section 3.1).

High-importance tokens are more likely to encode the knowledge we aim to unlearn. Suppressing attention to them reduces the model’s focus on key information and shifts it toward less relevant content, thereby weakening its ability to regenerate the unlearned knowledge. We set the suppression threshold to 60% in our main experiments. To validate robustness, we vary the threshold from 20% to 80%, as shown below. We exclude 0% and 100% to preserve the attention redistribution mechanism. Results show that 40–60% achieve the best trade-off between unlearning, utility, and hallucination, which we will report in the revised version.

For λ (suppression strength), our goal is to push the attention on semantically important tokens in the target data as close to zero as possible. In our main experiments, we use a suppression ratio of 0.99, meaning 99% of the original attention is removed.

However, even modest suppression levels (e.g., λ = 0.2~0.8) lead to significant unlearning effects. This is because small attention perturbations at lower layers can propagate and result in large shifts in the final output. Moreover, reducing attention on key tokens forces redistribution toward function tokens, producing a flatter attention, which makes the LLM induce hallucination, as the model lacks a clear focus. We will add these results to the revised Appendix.

---

[Q2] Mechanistic Distinction: Unlearn vs. Retain Loss Symmetry

---

A2: While both the unlearn and retain losses apply KL divergence over attention, they serve distinct roles on disjoint data: the unlearn loss suppresses attention to semantically important tokens in context-specific data, while the retain loss reinforces attention to informative tokens in retained data. They build a soft knowledge boundary between unlearning and maintaining.

Following your suggestion, to further investigate this distinction, we analyzed the gradient similarity between the two losses to the adapter parameters. The cosine similarity initially drops to around -0.3, indicating early conflict between unlearning and retaining. Over training, it rises toward zero, indicating that the model gradually learns to separate the two objectives. We will include detailed gradient alignment plots in the revised manuscript to support this finding.

This dynamic confirms our motivation for using a scheduled α-weighting scheme: when the unlearning loss is large, α increases to emphasize unlearning; when retaining loss dominates, α is reduced to focus on preserving useful knowledge. This dynamic adjustment not only helps prevent conflicting gradients but also provides clearer update attribution and improved convergence behavior. Empirically, results show that dynamic α outperforms fixed static values in balancing unlearning strength and retention stability. We sincerely apologize that this dynamic scheduling mechanism was not clearly described in the original manuscript. We appreciate your feedback and will revise the main text to explicitly explain this strategy, along with presenting the new ablation results in the Appendix.

---

[Q3] Theoretical Basis for Reallocation

---

A3:

1. Motivation for Attention Reallocation: Our attention reallocation strategy is inspired by observations in interpretability studies [2], which show that allocating attention toward semantically meaningful tokens (i.e., content words) improves output fidelity, while uniformly distributing attention often increases uncertainty and leads to hallucinations. Building on this insight, we propose redirecting suppressed attention mass toward function words, i.e., tokens that are syntactically necessary but semantically neutral. This design offers two advantages: (1) it avoids amplifying unrelated factual content, and (2) it increases uncertainty in a controlled, non-hallucinatory manner by depriving the model of meaningful activation paths. While we do not provide a formal theoretical proof, our empirical results demonstrate that this targeted redirection suppresses memorized content more effectively than output substitution.

2. Justification Beyond Retraining: Furthermore, we emphasize that our approach differs fundamentally from training a clean model from scratch without exposure to the target data. Even clean models may hallucinate related facts when faced with ambiguous prompts, especially when structurally similar information exists in the retained corpus. In contrast, our method explicitly blocks access to critical knowledge tokens at inference time via attention manipulation, ensuring behavioral suppression even in semantically adjacent contexts. This distinction is particularly relevant in factual generation settings, where proximity-based hallucinations are common. Thus, although our method may not replicate the internal parameter structure of a fully retrained model, it achieves stronger behavioral suppression through dynamic attention control. We will include this discussion in the revised manuscript to clarify the motivation and implications of our strategy.

---

[Q4] Novelty over Prior Art

---

A4: Our method incorporates two components, attention modulation and adapter-based fine-tuning, but reconfigures them specifically for the challenges of selective unlearning.

First, we introduce a directionally asymmetric attention suppression mechanism, which downweights semantically important tokens only within the unlearn context and reallocates attention to neutral tokens. This localized, context-aware suppression differs from prior global or task-level attention control methods.

Second, we propose a dual-loss for attention shifting using KL divergence over disjoint data domains with opposing goals: the unlearn loss enforces behavioral unlearning, while the retain loss preserves general model utility. This structure directly addresses the central trade-off in unlearning, which is not considered in general-purpose attention reweighting frameworks. We also introduce a dynamic α-weighting schedule to balance the two loss objectives during training, mitigating gradient conflict and improving convergence stability, supported by gradient similarity analysis. These are all our original designs for LLM unlearning.

While adapter tuning has been explored in earlier unlearning work, we are the first to use it to support attention shifting for behavior-level suppression, and to systematically analyze adapter placement. This enables targeted modulation of attention without altering shared representations, while keeping the backbone frozen to prevent parameter interference.

In summary, although our method builds on existing components, its task-specific coordination and adaptation to the unlearning objective are original contributions. We will clarify these distinctions explicitly in the revised manuscript.

---

[Q5] Robustness to Relearning and Adversarial Recovery Attacks

---

A5: Thank you for raising this important concern. Our method does not rely on predefined substitutions like “nobody knows” as training targets. Such outputs may naturally occur in the original model we used when responding to uncertain queries, but they are not part of our unlearning mechanism. Unlike shallow alignment methods that guide the model toward fixed refusals [1], as we referred to in the manuscript, our method suppresses access to the target knowledge by intervening at the attention level, downweighting semantically important tokens in the context.

This behavioral suppression goes beyond surface-level refusals. To evaluate its effectiveness, we introduce the Top-k Ignore Rate (TR), measuring whether ground truth tokens are excluded from the top-k logits. Our method achieves TR > 93% at k=50. Moreover, it remains robust under paraphrased or perturbed prompts, as shown above table "TUD variants", unlike shallow alignment methods.

We acknowledge that retraining or fine-tuning on the unlearned data can reintroduce suppressed knowledge, which is a general challenge in unlearning. Our work assumes the target data is no longer available post-unlearning. In future work, we aim to explore model maintenance strategies for long-term resilience. We will clarify this scope and limitation in the revised manuscript.

---

[1] Qi, Xiangyu, et al. "Safety alignment should be made more than just a few tokens deep." arXiv preprint arXiv:2406.05946 (2024).

[2] Duan, Jinhao, et al. "Shifting Attention to Relevance: Towards the Predictive Uncertainty Quantification of Free-Form Large Language Models." Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2024.

Thank you for your response. I realize now that my earlier confusion about the forget loss and retain loss was my misunderstanding. I still have two final questions:

1. If the important tokens for the forget set and the retain set overlap, can the unlearning effect still be guaranteed?
2. The novelty is limited, since you directly apply the attention-shifting method, which constrains the overall originality of the paper.

That said, attention shifting is very well suited to the unlearning scenario—where positive supervision signals are lacking and token-level control is required. And given that your experiments demonstrate that attention shifting achieves very strong results in the unlearning scenario, I have decided to raise my score.

Thank you for your encouraging comments on the novelty and robustness of our AS framework, especially its alignment with privacy-preserving goals and strong performance across different settings. Please find our clarifications and responses to your concerns below.

---

[Q1] The terms TUD, NEK, and GEK are not explained clearly when first introduced; clarify their source and provide example entries.

---

A1: We appreciate the reviewer’s helpful comment. The definitions of TUD, NEK, and GEK are briefly introduced in the caption of Table 1 to help interpretation. TUD (Target Unlearning Dataset), NEK (Neighboring Knowledge), and GEK (General Knowledge) are all derived from the ToFU benchmark. In ToFU, TUD, and NEK consist of fabricated facts about fictional authors, while GEK contains real-world factual knowledge. This setup allows us to clearly define target, neighboring, and general knowledge categories, making it easier to isolate the effects of unlearning.

In contrast, in TDEC, all knowledge, including target and non-target, is drawn from real-world facts. There are no synthetic or fictional entries, and thus it is not meaningful to divide general knowledge into NEK and GEK. All samples technically belong to GEK. Instead of forcing a split, we adopt utility benchmarks (Wikitext, LAMBADA, PubMedQA) to assess general performance, and additionally select semantically similar samples as neighbouring data to the target set to evaluate boundary interference. This decision reflects the real-world complexity and overlapping nature of factual knowledge in TDEC. We acknowledge that this may have led to some confusion and will revise the main text to introduce them explicitly at first mention. As suggested, we will also add representative example entries of the three subsets in the Appendix.

---

[Q2] The threshold used for token importance selection is unclear; please specify and justify it.

---

A2: For structured datasets like ToFU, which include clear sentence structure and syntax, we directly rely on part-of-speech tagging to identify content-bearing tokens (nouns, verbs, proper nouns, etc.). These are treated as “important” and suppressed during unlearning, which corresponds roughly to 60% of each sample.

For less structured datasets like TDEC, where POS is unreliable, we apply entropy-based importance scores. The token importance is measured by the change in predictive entropy when the token is masked (Eq. 1, Section 3.1). Tokens with higher scores are deemed more influential on model predictions. The rationale for targeting high-importance tokens is that they are more likely to encode sensitive or factual knowledge. By suppressing attention to these tokens, we reduce the model’s focus on them and redirect attention to less relevant content, which facilitates effective unlearning. The threshold is used to select the top-ranked tokens that exceed a fixed percentile cutoff.

We set the suppression threshold to 60% in our main experiments. To assess robustness and generalizability, we vary the threshold from 20% to 80% and observe its linear impact on unlearning performance, model utility, and hallucination rate. As shown in the table below, our method remains stable across a wide range, with the 40%–60% range yielding the best trade-offs. We will add all the analyses in the revised paper.

---

[Q3] The identity and role of the frozen model used for reference attention maps should be clarified.

---

A3: Thank you for pointing this out. The “frozen model” refers to the original target LLM used before the unlearning operation. It is kept entirely frozen during training and serves only to provide reference attention maps used in our loss objectives. This ensures that attention shifts happen only in the target context while minimizing unintended changes elsewhere. We will clarify this more explicitly in the revised version.

[Q4] The meaning of Forget-01, Forget-05, and Forget-10 is unclear; please explain these settings and their differences.

---

A4: We thank the reviewer for pointing this out. Specifically, as shown in Section 4.2, these refer to the number of authors whose knowledge is selected for unlearning in the ToFU benchmark. Since each author in ToFU is associated with 20 samples, Forget-01 corresponds to forgetting all 20 samples from one author, Forget-05 refers to 100 samples (from 5 authors), and Forget-10 to 200 samples (from 10 authors). This setup allows us to evaluate the scalability and robustness of unlearning performance as the forgetting target size increases. We will revise the manuscript to clarify this setting in the corresponding section.

---

[Q5] The TUD dataset contains only 100 samples, which limits the reliability and generalizability of the reported results.

---

A5: (1) The TUD setting, though small in scale (100 samples), reflects a realistic data deletion scenario, where retraining from scratch incurs significant cost and proves inefficient. We have also presented results on a larger-scale setting (200 samples) in the supplementary material (Appendix C), demonstrating the generalizability of our method.

(2) Here, we further extend the evaluation to the Forget-20 setting (400 samples, 10% of ToFU), as shown below, which confirms that our method remains both effective and stable under more extensive deletion requirements.

---

[Q6] More results with different hyperparameter combinations (α for unlearning degree control, importance threshold) should be provided.

---

A6: Thank you for the helpful suggestion. We have conducted additional ablations for both α and the token importance threshold (as shown in Q2 answer). For α, which balances unlearning and retaining losses, we compare multiple fixed values and a dynamic scheduling strategy. Results show that smaller α values help preserve non-target knowledge, while the dynamic α strategy offers the best overall trade-off, achieving strong unlearning with minimal utility drop. This is because α is adjusted during training based on the relative magnitudes of the unlearn and retain losses, giving more weight to unlearning when needed, and shifting focus to retain when unlearning stabilizes. This adaptive scheduling helps resolve gradient conflict and improves convergence stability. We will add all the analyses in the revised paper.

---

We sincerely appreciate your positive assessment of our work’s motivation, technical clarity, and performance, especially your recognition of our behavioral-level approach to unlearning and its empirical strength on benchmarks. Please find our response to your question below.

---

[Q1] Does representation superposition pose challenges for unlearning with AS, and does it cause side effects when suppressing shared tokens?

---

A1: Thank you for highlighting the challenge posed by superposition in neural networks. AS does not require additional disentanglement techniques. It remains effective under representation superposition and does not produce noticeable side effects when suppressing shared tokens.

AS implements context-local attention modulation, where the suppression and redistribution of attention weights are performed within each sample, conditioned on that specific context. This design ensures that even if certain tokens appear both in the unlearn and retain domains, the suppression effect is limited to their role within the target context and does not alter their contribution in unrelated knowledge. As a result, the side effects on non-target concepts are minimized. While superposition is a known challenge in LLMs, our method addresses it behaviorally rather than structurally. Importantly, by jointly optimizing unlearning on target data and retaining on non-target data, AS effectively separates where to suppress and where to preserve, without requiring explicit disentangled representations. This design provides a soft boundary for intervention and ensures that unlearning remains localized, preserving general utility.

The experimental result of neighbouring knowledge maintenance in Section 4.2 could support it, and for further explanation, we add a specific result here, as shown in the table below. The first query is part of the unlearning dataset, and the second and third queries are in the remaining dataset (involve overlapping or adjacent knowledge). AS successfully preserves these neighboring facts, confirming that suppression could remain localized and does not interfere with related knowledge in the same domain. Notably, maintaining their performance (Neighbouring knowledge) requires different retaining datasets: one focuses on similar factual types, while the other concerns related attributes of the same entity. These differences call for distinct preservation boundaries during training.

In a word, to achieve separation between suppressed and preserved knowledge in AS, the retaining data must be selected in the remaining dataset to exhibit structural or semantic similarity to the target unlearning domain. This facilitates a well-defined contrastive signal during training, helping the model localize attention suppression and disentangle knowledge more precisely. We will clarify this point in the revised manuscript.

---

[Q2] Should your method be combined with representation specialization techniques?

---

A2: Our method does not require explicit representation specialization in the scenario described in the paper. As discussed in Q1, AS already achieves functional separation through context-aware attention suppression and contrastive supervision from retained data, which defines a soft boundary between unlearning and preserving knowledge.

However, in scenarios demanding stronger safety guarantees or more precise knowledge control, additional specialization techniques may be beneficial. As noted in [1], larger models tend to develop more disentangled internal representations. Still, closely related concepts may remain entangled in shared neurons or subspaces, making it more challenging to efficiently define clear intervention boundaries through behavioral supervision alone, especially when target and non-target knowledge exhibit strong semantic overlap.

To address this, we plan to explore integrating AS with representation-level techniques such as sparsity-driven interventions, which may help reduce representational overlap and sharpen the boundary between target and non-target knowledge. In particular, sparsity techniques help re-encode overlapping knowledge into more localized or weakly shared subspaces, enabling safer and more efficient suppression without disrupting non-target content. Such sparsity-aware retraining could serve as a preparatory step before applying behavioral unlearning, making the suppression boundaries more distinct and reducing collateral effects. We acknowledge this as a promising direction for long-term and high-assurance unlearning, albeit with higher computational cost. We will include this discussion and relevant citations in the revised manuscript.

---

[1] Hong, Y., Zhao, Y., Tang, W., Deng, Y., Rong, Y., & Zhang, W. (2025). The Rise of Parameter Specialization for Knowledge Storage in Large Language Models. arXiv preprint arXiv:2505.17260.

---