Auditing Forgetting in Limited Memory Language Models

Introduction

Limited Memory Language Models (LMLMs) are pre-trained to externalize factual knowledge to an external database so that recall is routed through retrieval rather than parameters, and deletion-based unlearning is intended to be as simple as removing entries from the database. Existing evaluations measure post-deletion correctness in aggregate and cannot tell whether a deleted fact persists through residual parametric memory, alternative retrieval paths, or near-neighbor retrieval artifacts. This project proposes a causal auditing framework that holds the model fixed and varies the database state at inference time across three interventions, FULL, DEL-ON, and DEL-OFF, and decomposes post-deletion behavior into parametric leakage $L(f)$, retrieval-mediated correctness $R(f)$, and a retrieval-artifact rate grounded in the inference-time retrieval trace.

Applied to 12,228 alias-closure deletions across thirteen databases (the released LMLM database plus twelve custom databases spanning four adversarial topologies, Base, Alias, Noise, Collision, across countries, politicians, and sports), parametric leakage is near zero in every variant and every prompt style: the model rarely returns the deleted answer in the absence of retrieval. The residual that does survive lives in the retrieval graph: retrieval-mediated correctness and the retrieval-artifact rate match within rounding everywhere, so post-deletion correctness is, in this audit, predominantly reconstituted from near-neighbor retrieval. This residual ranges from 0.7% on the released LMLM database to 13.6% on the most adversarial variant, and prompt formulation does not independently control how much of a deleted fact survives. These results suggest that, for this class of LMLM and deletion procedure, the unlearning boundary is drawn primarily by the database administrator rather than by the model.

This was a joint course project with Hanna Roed for Stat 240 at UC Berkeley, Spring 2026. Both authors contributed equally.

Problem Definition

Each fact is represented as a subject–relation–object tuple $f = (s, r, o)$, for example Geri Halliwell – Famous For – Spice Girls. At inference time, retrieval provides the LMLM with relevant database entries as additional context before generation. Let $Y(f, c)$ denote the normalized model prediction for fact $f$ under intervention condition $c$.

We compare three intervention states:

• FULL: the target fact remains in the database and retrieval is enabled. Measures normal database-supported accuracy.
• DEL-ON: the target fact (and all alias-equivalent triplets) is deleted from the database, but retrieval remains enabled. Tests whether the answer can still be recovered through alternative database entries, aliases, semantically related facts, or retrieval artifacts.
• DEL-OFF: the target fact is deleted and retrieval is disabled. Isolates parametric recall, the model must answer without retrieved evidence.

Post-deletion correctness is then decomposed into three mechanisms. Parametric leakage occurs when the model answers correctly in DEL-OFF, indicating the deleted fact may still live in the model parameters:

$$L(f) \;=\; \mathbb{I}\bigl[Y(f, \textsf{DEL-OFF}) = o\bigr].$$

Retrieval-mediated correctness occurs when the model is correct in DEL-ON but not in DEL-OFF, indicating retrieval helped recover the answer after deletion:

$$R(f) \;=\; \mathbb{I}\bigl[Y(f, \textsf{DEL-ON}) = o \,\wedge\, Y(f, \textsf{DEL-OFF}) \neq o\bigr].$$

Retrieval artifacts occur when the model produces the correct answer in DEL-ON even though no gold-equivalent triplet appears among the retrieved candidates after deletion, the answer is reconstituted from near-neighbor evidence. Formally, letting $G(f)$ indicate that some retained candidate in the inference-time trace is gold-equivalent on subject, relation, and object,

$$A(f) \;=\; \mathbb{I}\bigl[Y(f, \textsf{DEL-ON}) = o\bigr] \,\bigl(1, G(f)\bigr).$$

Across a fact set $\mathcal{F}$, the empirical leakage rate is $\hat{L} = \tfrac{1}{|\mathcal{F}|} \sum_{f \in \mathcal{F}} L(f)$, and analogously for $\hat{R}$ and $\hat{A}$.

Approach

The three-state audit

The audit is a fully crossed grid of six prompt sets × three intervention states × thirteen databases. For each cell we record exact match, token-level precision, recall, and F1, together with the cross-state quantities $L(f)$, $R(f)$, and the retrieval-artifact rate; retrieval traces are logged at every FULL and DEL-ON call so that post-deletion correctness can be attributed to explicit database evidence rather than implicit model behavior.

For each target fact, the deletion set is constructed by enumerating the canonical triplet and all alias-equivalent triplets whose subject, relation, and object match the target under the alias mapping. We then remove this set from the database and verify deletion by checking that no retained triplet is gold-equivalent. The same prompt is evaluated under FULL, DEL-ON, and DEL-OFF, the generated answer is normalized before scoring, and during FULL and DEL-ON we also save the retrieved candidates returned to the model. A DEL-ON answer is counted as a retrieval artifact when the normalized answer matches the gold object but none of the retained retrieval candidates is gold-equivalent.

Database variants

To stress-test alias-closure deletion, we built four database variants for each of three domains (countries, politicians, sports):

• Base contains only the canonical $(s, r, o)$ triplet for each fact, a clean baseline with no alternative routes.
• Alias stores the same fact only under aliased subject and relation forms, with no canonical entry, testing whether alias-closure deletion catches every surface realization.
• Noise augments Base with decoy triplets that route to the same object through paraphrased subjects (e.g., Government of United States → Seat of Government → Washington, D.C.), probing whether retrieval can reconstitute the deleted answer via near-neighbor paraphrases.
• Collision augments Base with near-miss triplets that share the subject but route to a different object (e.g., United States → Largest City → New York City), probing whether retrieval drifts onto a confusable neighbor and returns a plausible but incorrect answer.

Prompt formulations

Each target fact is presented under six prompt formulations: direct questions, paraphrased rewordings, contextually framed prompts, cloze-style completions, free-form continuations, and few-shot demonstrations. Their purpose in the audit is to separate the effect of question phrasing on FULL baseline accuracy from any independent effect on the post-deletion residual.

Results

Across the 78 (prompt file, database) cells, the audit produces 12,228 paired (DEL-ON, DEL-OFF) evaluations together with an equal number of FULL baselines, for a total of 36,684 model completions. All reported quantities are count-weighted averages over fact-paired groups.

Parametric externalization at the per-fact level

The headline finding is that parametric leakage $\hat{L}$ is near zero across the audit. The red $L(f)$ component contributes a vanishingly small share of the $L(f) + R(f)$ stack in every variant and prompt style, and weighted DEL-OFF performance is visually indistinguishable from zero in every cell. At the level of model parameters, the LMLM checkpoint behaves close to a model that had never seen the fact: across 12,228 alias-closure deletions, the parameters return the deleted answer at a rate of $\hat{L} = 0.11\%$.

The residual lives in the retrieval graph

The signature observation in both attribution figures is the near-equality of the green $R(f)$ bar and the orange retrieval-artifact bar in every variant and every prompt style. This is partially structural: under complete alias-closure deletion, no retained candidate can be gold-equivalent, so for any fact $f$ with $L(f) = 0$ the retrieval-artifact indicator $A(f)$ collapses to $R(f)$.

Proposition (Artifact and retrieval-mediated correctness coincide under complete deletion). Fix a fact $f = (s, r, o)$ with $L(f) = 0$, and suppose the alias-closure deletion of $f$ is complete, i.e., no triplet alias-equivalent to $(s, r, o)$ survives in the database after deletion. Let $G(f)$ be the indicator that some retained candidate in the inference-time trace is gold-equivalent, and let $A(f) = \mathbb{I}[Y(f, \textsf{DEL-ON}) = o]\,(1, G(f))$. Then $R(f) = A(f).$

The empirical near-equality $\hat{R} \approx \hat{A}$ is therefore a confirmation that the alias-closure deletion procedure is complete in practice; the empirical content of the figures is not the equality itself but the topology-dependent magnitude of the residual. Retrieval-mediated correctness almost never coincides with a gold-equivalent retained candidate; instead, it coincides with near-neighbor candidates that share embedding-space similarity with the deleted entry. The original LMLM paper reports unlearning on a single retrieval graph (the annotated TOFU corpus) and on that graph achieves “ideal forgetting” with $p > 0.05$. By varying the retrieval graph along controlled topologies, the audit shows that the same architecture and the same alias-closure deletion can produce a DEL-ON residual anywhere from 0.7% to 13.6%.

Three-state cuts and ablations

Retrieval-graph topology controls the residual. Holding model, deletion procedure, and prompt distribution fixed and varying only the database variant, the post-deletion residual $L(f) + R(f)$ rises from 3.7% on Base to 6.2% on Alias, 7.2% on Collision, and 13.6% on Noise, before falling to 0.7% on the released LMLM database. Variants in which more surviving entries point to the gold object after alias-closure deletion produce larger residuals.

Prompt formulation moves baselines more than residuals. Holding everything else fixed and varying only the prompt set: under FULL, prompt style produces a wide performance spread (token F1 between ~17% and ~57%, exact match between ~33% and ~46%), reflecting how easily each style elicits a structured lookup. Under DEL-ON, that spread collapses into the 7–10% band, and the FULL-to-DEL-ON drop is dominated by the FULL baseline rather than by any property of the prompt itself. Continuations lose the most because they had the most to lose; few-shot prompts lose the least for the same reason. Once supporting evidence is removed, prompt formulation has limited independent control over how much of a deleted fact survives.

Future Work

The most natural extension is on the database side. Since retrieval-graph topology is the dominant determinant of post-deletion residuals, two concrete directions follow. The first is an extended deletion closure that, in addition to alias-equivalent triplets, also removes any triplet whose retained-candidate embedding falls within a similarity radius of the canonical triplet, so that paraphrastic decoys are caught at deletion time. The second is canonicalization at write time, in which aliases and paraphrastic forms are stored as pointers into a single canonical record rather than as independent triplets. Both approaches are directly testable within the audit framework: re-running the audit on the modified database and measuring whether $R(f)$ and the retrieval-artifact rate fall below their current ranges would quantify how much of the residual is recoverable through database design alone.

Several axes of the audit itself also remain open. The retriever (all-MiniLM-L6-v2) and similarity threshold (0.6) are held fixed throughout, so sweeping the threshold and replacing the retriever with sparse, dense, or hybrid alternatives would clarify how much of the observed 13.6% Noise residual is a property of the embedding model rather than of the LMLM architecture. Scaling the audit to larger LMLM checkpoints and to the full 54.6M-triplet released database would test whether the per-fact zero parametric leakage we report holds at production scale. Extending the framework beyond entity-level atomic facts to multi-hop and compositional knowledge, and beyond automatic exact-match scoring to semantic or human-judged correctness, would close the gap between the audit and end-user notions of forgetting. Finally, the same intervention set can be applied to retrieval-augmented and edited parametric models more broadly, which would allow a head-to-head comparison of which architectural family achieves the cleanest deletion under matched retrieval pressure.