Unlearners Can Lie: Evaluating and Improving Honesty in LLM Unlearning

Abstract: Unlearning in LLMs aims to remove harmful training data while preserving overall utility. However, we find that existing methods often hallucinate, generate abnormal token sequences, or behave inconsistently, raising safety and trust concerns. According to prior literature on LLM honesty, such behaviors are often associated with dishonesty. This motivates us to investigate the notion of honesty in the context of model unlearning. We propose a formal definition of unlearning honesty, which includes: (1) preserving both utility and honesty on retained knowledge, and (2) ensuring effective forgetting while encouraging the model to acknowledge its limitations and respond consistently to questions related to forgotten knowledge. To systematically evaluate the honesty of unlearning, we introduce a suite of metrics that cover utility, honesty on the retained set, effectiveness of forgetting, rejection rate and refusal stability in Q&A and MCQ settings. Evaluating 9 methods across 3 mainstream families shows that all current methods fail to meet these standards. After experimental and theoretical analyses, we present ReVa, a representation-alignment procedure that fine-tunes feature-randomized unlearned models to better acknowledge forgotten knowledge. On Q&A tasks from the forget set, ReVa achieves the highest rejection rate after two rounds of interaction, nearly doubling the performance of the second-best method. Remarkably, It also improves honesty on the retained set. We release our data and code at https://github.com/renjiegu.

• The paper introduces honest unlearning by shifting the focus from mere knowledge removal to models acknowledging uncertainty.
• It presents ReVa, a representation-alignment method that fine-tunes internal activations to boost refusal consistency and maintain utility.
• Experimental results show that ReVa nearly doubles multi-turn rejection consistency while preserving overall model performance.

Honesty-aware Unlearning in LLMs: An Expert Analysis

Context and Motivation

Unlearning in LLMs denotes targeted removal of sensitive or harmful knowledge, typically motivated by regulatory, privacy, or ethical constraints, with an explicit requirement to preserve general utility. Contemporary unlearning literature has focused on robustness—measuring whether removed knowledge can be revived, either via input-level manipulations (jailbreaks) or weight-level attacks. The present work repositions honesty as the central desideratum: in addition to eliminating knowledge, an unlearned model must reliably acknowledge its limitations, refrain from hallucinations, and consistently express uncertainty, especially under paraphrased or repeated queries.

Dishonest reactions post-unlearning—such as hallucinated explanations, abnormal repeated tokens, inconsistent refusals, or failure to acknowledge ignorance—can mislead users and pose significant safety risks. The paper systematically exposes these failure modes across major unlearning approaches and motivates a formal framework for honest unlearning, grounded in the dual pillars of self-knowledge and self-expression.

Figure 1: Post-unlearning, models hallucinate fabricated content or show abnormal repetitive token outputs, damaging reliability and safety; inconsistency in responses is observed across repeated MCQ queries.

Honest Unlearning: Definitions and Experimental Framework

Honesty in LLMs, as characterized in this work, is the model's ability to:

• Faithfully preserve utility and honesty in the retained set.
• Effectively forget targeted knowledge by acknowledging uncertainty and exhibiting stable self-expression (i.e., consistent refusal or 'I don't know' responses) when queried about the forgotten set.

This is contrasted with existing evaluation protocols that solely focus on accuracy or rejection rates, which are insufficient to distinguish between genuine forgetting and masking. To operationalize honest unlearning, the paper introduces:

• Agreement Rate (AR) and Misleading Robustness Score (MRS) to quantify self-consistency and robustness against misleading demonstrations on retain data.
• Metrics including accuracy (ACC), rejection rate (RR), multi-turn rejection consistency (QAMRC), Choose-IDK Rate (CIR), Choose-Other Rate (COR), and output stability measures for forget-set queries.

  Figure 2: Feature-randomize and gradient-ascent methods exhibit poor rejection rates, failing to consistently refuse forgotten knowledge even under explicit reminders.

  

  Figure 3: ACC close to random baseline (25%) signifies effective unlearning; false rejections are detected in IDK+AP via high ACC, necessitating multi-round evaluation.

Analysis of Existing Methods and Failure Modes

The taxonomy of unlearning methods consists of: rejection-based (IDK+AP), feature-randomize (RMU, BLUR, ME+GD), and gradient-ascent (GA, NPO).

Rejection-based methods mask forgotten knowledge by finetuning the model to respond with refusal templates. However, these responses are shallow; the underlying knowledge persists, and responses lack robustness under repeated questioning—demonstrated by a sharp drop in multi-turn rejection consistency (QAMRC).

Feature-randomize methods (e.g., RMU) push intermediate activations toward randomized directions. These approaches maintain utility but fail to foster genuine self-knowledge, often hallucinating plausible but incorrect answers rather than admitting ignorance.

Gradient-ascent methods aggressively degrade knowledge by maximizing loss or inverting reward, resulting in severe utility collapse. While CIR is artificially high (indicating frequent selection of 'IDK'), COR remains equally high, suggesting that selection is driven by positional or formatting bias rather than true uncertainty. Output entropy declines, and logit analysis shows extreme token preference, confirming spurious behavior.

Figure 4: Gradient-ascent methods suffer utility degradation, yet CIR remains high; CIR alone is insufficient for honest self-knowledge measurement.

Figure 5: Multi-round rejection analysis reveals that shallow rejection methods quickly lose refusal consistency, with only a small fraction of samples remaining rejected after two rounds.

ReVa: Residual Vector Alignment for Honest Unlearning

To address these deficiencies, the paper proposes ReVa—a representation-alignment method that augments feature-randomize unlearned models through fine-tuning of internal residual activations toward a distilled 'refusal vector' derived from honest refusal prompts. This alignment occurs at selected layers (notably layer 18), targeting the activation space that governs epistemic uncertainty.

ReVa is designed to stabilize uncertainty expression in multi-turn dialogues and enhance honest refusal without harming utility. Empirical analyses demonstrate that ReVa substantially improves RR and QAMRC (multi-turn consistency) while also boosting AR and MRS on the retained set. It achieves near-optimal tradeoffs, maintaining high utility and honest refusal behaviors in forget queries.

Empirical Results and Insights

ReVa nearly doubles the RR2R (RR after two rounds) compared to previous methods. Output variance and instability traits are greatly reduced, and AR is increased on the retained set. Gradient-ascent methods, in contrast, show extreme logit concentration—a clear indicator of overconfident, spurious IDK selection—and profound utility collapse.

Figure 6: Gradient-ascent methods display high CIR and COR, with sharply peaked token distributions and low entropy, indicating artificially inflated 'IDK' selection.

Figure 7: Logit distribution analysis demonstrates highly concentrated predictions for gradient-ascent methods, while RMU and ReVa maintain more balanced output distributions.

Efficiency benchmarks confirm that ReVa is a practical, computationally minimal post-processing step compared to expensive rejection-based finetuning.

Numerical highlights:

• ReVa achieves RR ≈ 61%, RR2R ≈ 45%, AR ≈ 91% (retain set), outperforming all baselines.
• Gradient-ascent methods: utility (MMLU, NC, IF) collapses to near-zero, CIR/COR ≈ 20% (randomized), confirming position bias.

Theoretical and Practical Implications

Gradient-ascent unlearning objectives are unbounded, leading to uncontrolled optimization and token suppression, which explains utility collapse and spurious 'IDK' preference. ReVa, by contrast, controls the activation direction and manages the epistemic uncertainty state, supporting scalable and honest post-unlearning behavior.

This work demonstrates that honest unlearning requires both effective removal of knowledge and explicit internalization of epistemic limitations, not merely token-level refusal or accuracy degradation.

Practically, ReVa offers an efficient, generalizable unlearning step that can be adopted post-feature-randomization, enhancing safety and trust in LLM deployment for regulated or high-risk domains (e.g., medicine, law, security scenarios).

Future Directions

Honesty-aware unlearning should be further extended to address robustness against weight-level attacks and broader safety critical scenarios. Ongoing research should also refine alignment signals and layer selection for even greater refusal consistency, as well as generalize frameworks to diverse knowledge types and domains. The multi-turn stability criterion introduced here can inform future benchmarks and practical deployments. Quantitative analysis of long-term refusal consistency and adversarial resistance remains an open challenge.

Conclusion

This paper establishes honest unlearning as a fundamental requirement for safety and reliability in LLMs. Existing methods fail to meet this standard by masking, hallucinating, or showing spurious behavior. ReVa demonstrates that post-unlearning alignment of internal representations enables models to both forget and honestly communicate their epistemic state, achieving superior performance across honesty and utility metrics. This operationalizes a new paradigm for the assessment and design of unlearning protocols in AI.