---
title: 'DCUE: Distribution Correction Unlearning Eval'
url: https://www.emergentmind.com/topics/distribution-correction-based-unlearning-evaluation-dcue
type: topic
---

# DCUE: Distribution Correction Unlearning Eval

Searching arXiv for the named paper and related unlearning-evaluation work.
Distribution Correction-based Unlearning Evaluation (DCUE) is an evaluation metric for real-world large language model unlearning introduced in “Towards Evaluation for Real-World LLM Unlearning” [2508.01324]. It is designed for the setting in which a foundation model $M_o$ is fine-tuned on task data $D_t$ to obtain $M_t$, a forget subset $D_f \subset D_t$ must be removed, and an unlearned model $M_u$ is produced without access to the canonical retrained reference model $M_r$ trained on $D_r = D_t \setminus D_f$ [2508.01324]. DCUE addresses three limitations identified in prior evaluation practice—practicality, exactness, and robustness—by comparing distributions of confidence assigned to core tokens from $D_f$ between $M_u$ and a distribution-corrected $M_o$, using a validation set and a two-sample Kolmogorov–Smirnov (KS) test rather than relying on $M_r$ [2508.01324].

## 1. Problem setting and motivation

The motivating setting is real-world unlearning in which evaluators typically operate under API-only access or limited access to internals, can query token probabilities but not gradients or activations of $M_u$, and do not have access to $M_r$ [2508.01324]. The target of unlearning may be specific data samples, topics, users, or documents, and the evaluation problem is further complicated by noisy labels, partial deletions, adversarial prompting, and frequent post-processing such as additional unlearning, fine-tuning on new data, and mixed operations after the claimed unlearning [2508.01324].

Within this setting, the paper identifies three failure modes of existing metrics. On practicality, metrics based on prediction probabilities and membership inference attacks often require $M_r$, making them unusable as deployed evaluation when retraining is infeasible [2508.01324]. On exactness, text similarity measures such as Rouge-L and multiple-choice accuracy are dominated by non-critical tokens and distractor design; an LLM can select the correct answer without memorization of $D_f$, producing false positives and false negatives [2508.01324]. On robustness, these metrics are sensitive to global shifts induced by post-processing unrelated to $D_f$, which can destabilize conclusions about whether forgetting actually occurred [2508.01324].

DCUE is proposed specifically to resolve these issues. Its core idea is to evaluate unlearning by comparing distributions of confidence assigned to decisive answer tokens from $D_f$ between $M_u$ and a distribution-corrected $M_o$, without requiring $M_r$ [2508.01324]. The method is therefore intended to be practical because it does not depend on retraining, exact because it focuses on core tokens rather than whole-string overlap, and robust because it explicitly subtracts global drift measured on a validation set [2508.01324].

## 2. Core-token formulation and confidence representation

A defining feature of DCUE is its restriction of evaluation to “core tokens,” described as the minimal subset of tokens in an answer $a$ that decisively determine correctness for a question $q$, such as named entities, numbers, or specific predicates [2508.01324]. Rather than using gradient-based saliency or attention scoring, the method operationalizes core-token identification via controlled prompting [2508.01324].

The prompting pipeline has two components. The Question Reformulation Prompt transforms $(q,a)$ into a fill-in-the-blank question that highlights decisive slots, and the Core Answer Extraction Prompt extracts the exact words filling those blanks, returning only key tokens [2508.01324]. In the reported implementation, GPT-4o-Mini is used for this extraction stage and yields high precision in manual checks, approximately $97\%$ on $D_f$ and approximately $96\%$ on $D_v$, with similar performance across DeepSeek-V3, GPT-3.5-Turbo, and Gemini-1.5-Flash [2508.01324].

For an auto-regressive LLM with parameters $\theta$ and answer tokenization $a=(w_1,\dots,w_T)$, token-level confidence is defined as
$$
c_t = P_\theta(w_t \mid q, w_{<t}),
$$
and the token confidence score sequence (TCS) is $\{c_t\}_{t=1}^T$ [2508.01324]. If $K \subset \{1,\dots,T\}$ denotes the index set of core tokens, DCUE filters TCS to obtain the core token confidence scores (CTCS),
$$
\{c_t : t \in K\},
$$
treated as a multiset of per-token probabilities [2508.01324].

The metric evaluates empirical distributions over these token-level values rather than requiring a sequence-level scalar summary [2508.01324]. The paper notes that a sequence-level aggregation could be defined, for example by averaging core token confidences, but DCUE itself operates on token-level distributions [2508.01324]. This choice is central to its exactness claim: it attempts to isolate the part of the output that determines whether the answer still reflects memorized content from $D_f$.

A toy example in the paper illustrates this construction using the question “What is the profession of Hsiao Yun-Hwa’s father?” with answer “The father of Hsiao Yun-Hwa is a civil engineer.” In that case, core-token extraction yields “civil” and “engineer,” and DCUE compares the probabilities assigned to those tokens by $M_o$ and $M_u$ across the forget and validation sets [2508.01324].

## 3. Distribution correction and KS-based scoring

The paper argues that raw comparison of CTCS distributions between $M_o$ and $M_u$ on $D_f$ is confounded by a systematic shift unrelated to forgetting [2508.01324]. Even if $M_u$ fully forgets $D_f$ and becomes behaviorally equivalent to $M_r$, its CTCS distribution on $D_f$ will generally differ from that of $M_o$ because $M_u$ has been influenced by retained data $D_r$ during fine-tuning, while $M_o$ has not [2508.01324]. DCUE therefore estimates and subtracts this bias using a validation set $D_v$ drawn from the fine-tunable data source, subject to the constraints $D_v \cap D_f = \varnothing$ and that $D_v$ is not used to train $M_t$ or $M_u$ [2508.01324].

Let $\mathrm{CTCS}_m^d$ denote the multiset of core-token confidences for model $M_m$ on dataset $D_d$. DCUE defines the empirical cumulative distribution function
$$
F_m^d(x) = \frac{1}{|\mathrm{CTCS}_m^d|}\sum_{X_i \in \mathrm{CTCS}_m^d} I(X_i \le x),
$$
and the two-sample KS statistic between models $M_{m_1}$ and $M_{m_2}$ on dataset $D_d$ as
$$
S_{m_1,m_2}^d = \sup_x |F_{m_1}^d(x)-F_{m_2}^d(x)|.
$$
These definitions are used on both the forget set and the validation set [2508.01324].

The unavailable target quantity is the ideal forget-set statistic $S_{r,u}^f$, comparing retraining to unlearning. DCUE instead uses the identity
$$
S_{r,u}^f = S_{o,u}^f - \delta_S,
$$
where $\delta_S$ captures systematic drift induced by $D_r$, and approximates this drift using the validation set:
$$
\delta_S \approx \min\{S_{o,u}^v, S_{o,u}^f\}.
$$
The corrected KS effect size is therefore
$$
S_{\mathrm{corr}} = S_{o,u}^f - \min\{S_{o,u}^v, S_{o,u}^f\}.
$$
The use of the minimum is intended to avoid over-correction when $S_{o,u}^f$ is already small, which the paper interprets as indicating strong forgetting [2508.01324].

DCUE maps this corrected effect size into a statistical score using the standard two-sided KS test. With forget-set sample sizes $n$ and $m$, observed statistic $D$, and sample-size adjustment
$$
D_{\mathrm{adj}} = D \cdot \sqrt{\frac{n\cdot m}{n+m}},
$$
the two-sided p-value is computed as
$$
p = 2 \sum_{k=1}^{\infty} (-1)^{k-1}\exp(-2k^2 D_{\mathrm{adj}}^2).
$$
DCUE reports
$$
R_{\mathrm{DCUE}} = \mathrm{KS\_pval}(S_{\mathrm{corr}}, |\mathrm{CTCS}_o^f|, |\mathrm{CTCS}_u^f|).
$$
Higher p-values indicate that the corrected distributions are statistically indistinguishable, which is treated as consistent with effective forgetting, while lower p-values indicate significant residual differences, consistent with retained memorization of $D_f$ [2508.01324].

The paper uses the standard two-sided KS test rather than a one-sided alternative because both upward and downward shifts in core-token confidence are treated as meaningful [2508.01324]. Effect size is represented by $S_{\mathrm{corr}}$, while significance is represented by the p-value, typically evaluated against a conventional significance threshold such as $\alpha=0.05$ [2508.01324].

## 4. Algorithmic procedure and implementation requirements

The DCUE pipeline takes as inputs the original model $M_o$, the unlearned model $M_u$, the forget dataset $D_f$, the validation dataset $D_v$, a prompting model for core-token extraction such as GPT-4o-Mini, and a tokenizer consistent with $M_o$ and $M_u$ [2508.01324]. The procedure has four stages: core-token identification, confidence extraction, distribution correction, and KS-test scoring [2508.01324].

In the first stage, for each $(q,a) \in D_f \cup D_v$, the evaluator applies the Question Reformulation Prompt to obtain a fill-in-the-blank question, then applies the Core Answer Extraction Prompt using $a$ as reference to extract decisive answer words, and finally tokenizes the extracted words to obtain the core token indices $K(q,a)$ [2508.01324]. In the second stage, for each model $M \in \{M_o, M_u\}$ and each dataset $d \in \{D_f, D_v\}$, the evaluator computes per-token probabilities
$$
c_t = P_\theta(w_t \mid q, w_{<t}), \quad t \in K(q,a),
$$
and aggregates them over the dataset to form $\mathrm{CTCS}_M^d$ [2508.01324].

In the third stage, the evaluator computes the raw KS statistics
$$
S_{o,u}^f = \sup_x |F_o^f(x)-F_u^f(x)|,\qquad
S_{o,u}^v = \sup_x |F_o^v(x)-F_u^v(x)|
$$
and then applies the correction
$$
S_{\mathrm{corr}} = S_{o,u}^f - \min\{S_{o,u}^v, S_{o,u}^f\}.
$$
In the final stage, with $n=|\mathrm{CTCS}_o^f|$ and $m=|\mathrm{CTCS}_u^f|$, the evaluator computes the KS p-value using $D=S_{\mathrm{corr}}$ and reports $R_{\mathrm{DCUE}}=p$ [2508.01324].

The paper also provides a high-level pseudocode summary:
- $K_f = \mathrm{extract\_core\_tokens}(D_f)$
- $K_v = \mathrm{extract\_core\_tokens}(D_v)$
- $\mathrm{CTCS}_{o,f} = \mathrm{confidences}(M_o, D_f, K_f)$
- $\mathrm{CTCS}_{u,f} = \mathrm{confidences}(M_u, D_f, K_f)$
- $\mathrm{CTCS}_{o,v} = \mathrm{confidences}(M_o, D_v, K_v)$
- $\mathrm{CTCS}_{u,v} = \mathrm{confidences}(M_u, D_v, K_v)$
- $S_{o,u}^f = \mathrm{KS\_stat}(\mathrm{CTCS}_{o,f}, \mathrm{CTCS}_{u,f})$
- $S_{o,u}^v = \mathrm{KS\_stat}(\mathrm{CTCS}_{o,v}, \mathrm{CTCS}_{u,v})$
- $S_{\mathrm{corr}} = S_{o,u}^f - \min(S_{o,u}^v, S_{o,u}^f)$
- $p = \mathrm{KS\_pval}(S_{\mathrm{corr}}, |\mathrm{CTCS}_{o,f}|, |\mathrm{CTCS}_{u,f}|)$
- return $p$ [2508.01324]

From a systems perspective, core-token extraction requires $O(|D_f|+|D_v|)$ calls to a prompting model, while confidence extraction requires forward passes proportional to the total number of core tokens, typically $O(N\cdot K)$ for $N$ examples and $K$ core tokens per example [2508.01324]. KS-statistic and p-value computation are negligible by comparison, with empirical CDF computation and supremum difference in $O(T\log T)$ for $T$ total token confidences [2508.01324]. The evaluation is described as naturally parallelizable and lightweight; although the paper uses four A6000 GPUs for training and unlearning runs, DCUE itself is not presented as computationally heavy [2508.01324].

A practical implementation requirement is access to token-level probabilities or log-probabilities for ground-truth tokens [2508.01324]. The paper notes that many APIs expose logprobs, and if not, one can switch to open-source inference or implement forced decoding to estimate per-token probabilities [2508.01324].

## 5. Experimental characterization

The experimental study in “Towards Evaluation for Real-World LLM Unlearning” uses Phi-1.5B and LLaMA2-7B as principal backbones, with generalization checks on Qwen2.5-7B [2508.01324]. The datasets are modified TOFU, described as a fictitious unlearning task with multiple formats including fill-in-the-blank, multiple-choice, and jailbreak, and MUSE-News [2508.01324]. In the simulation used to validate the correction mechanism, the paper sets $D_f=400$ and $D_v=400$ and performs $100$ random samplings of $D_v$ to test approximation stability [2508.01324].

The paper reports that DCUE’s corrected p-values closely match the ideal p-values computed using the unavailable $M_r$ in simulation, with only one outlier in 200 experiments for Phi-1.5B and none in LLaMA2-7B [2508.01324]. In the metric property comparison on Phi-1.5B and LLaMA2-7B, DCUE is marked as practical because it does not require $M_r$, whereas prediction-probability and membership-inference-attack baselines do [2508.01324]. On exactness, DCUE achieves $\mathrm{exactness}^+ = 1$ and $\mathrm{exactness}^- = 1$, outperforming text-similarity, multiple-choice, prediction-probability, and membership-inference baselines [2508.01324]. On robustness, DCUE scores $1.0$ across PostPro\_ul, PostPro\_ft, and PostPro\_mix, while the other metrics degrade under additional unlearning or fine-tuning [2508.01324].

Ablation studies are used to isolate the roles of core-token extraction and validation-set correction. Removing core-token identification degrades robustness, with PostPro\_ft dropping from $1.0$ to $0.8364$ on Phi-1.5B while retaining some exactness [2508.01324]. Removing $D_v$ degrades both exactness and robustness, especially negative exactness and PostPro\_ul [2508.01324]. These results are presented as evidence that both the token-selection stage and the distribution-correction stage are necessary components of the metric rather than optional refinements [2508.01324].

DCUE is also used to evaluate several unlearning algorithms—GA, GD, IDK, DPO, NPO, and SimNPO—on Phi-1.5B and LLaMA2-7B under $2\%$, $10\%$, and $20\%$ $D_r$ unlearning [2508.01324]. The reported p-values rank SimNPO best and GA second, but all methods remain far below $M_r$ [2508.01324]. Illustrative values at $20\%$ include SimNPO at approximately $4.42\times 10^{-53}$ on Phi-1.5B versus $M_r=1.0$, GA at approximately $2.91\times 10^{-53}$ on Phi-1.5B, and SimNPO at approximately $2.70\times 10^{-42}$ on LLaMA2-7B versus $M_r=1.0$ [2508.01324]. The paper’s conclusion is that current unlearning methods yield only modest improvement over $M_t$ and do not approach the theoretical unlearning represented by retraining [2508.01324].

## 6. Practical use, assumptions, and limitations

DCUE is explicitly designed for real-world constraints. Because it does not require $M_r$, it avoids retraining cost and can be applied when only $M_o$ and $M_u$ are available [2508.01324]. Its API-only compatibility follows from the fact that it requires token-level probabilities or logprobs rather than activations or gradients [2508.01324]. Its robustness claim rests on the subtraction of global drift measured on $D_v$, which is intended to stabilize evaluation under unrelated post-processing such as additional unlearning or fine-tuning [2508.01324].

Validation-set construction is a critical operational issue. The paper states that $D_v$ must be disjoint from $D_f$ and must not be used during training of $M_t$ or $M_u$ [2508.01324]. It should be drawn from the same task domain, but it does not need to perfectly match the distribution of $D_t$; the reported empirical results indicate stability under modest mismatch [2508.01324]. The paper also recommends strict leakage avoidance and auditing of data pipelines to maintain this separation [2508.01324]. For small confidence multisets, it recommends bootstrapping over examples to estimate confidence intervals on p-values and increasing $D_v$ when feasible, with diverse coverage of question types to stabilize $F_o^v$ and $F_u^v$ [2508.01324].

Several limitations are identified directly. Core-token identification errors can include non-core tokens or miss core tokens, which affects CTCS [2508.01324]. Suggested mitigations are ensemble prompting, manual spot checks, multiple models, and consistency filters [2508.01324]. Validation-set mismatch can cause $S_{o,u}^v$ to under- or over-estimate drift; proposed mitigations include stratified sampling, multiple $D_v$ splits, and sensitivity reporting [2508.01324]. Some proprietary APIs do not provide logprobs, in which case DCUE requires open-source inference or a logprob-capable endpoint [2508.01324].

The metric is also limited to output distributions. It does not analyze internal activations or privacy leakage channels beyond output confidences, and the paper notes that complementary membership-inference or activation-based analyses may be needed in high-stakes domains [2508.01324]. Finally, because DCUE operates at the token level, the paper advises against collapsing CTCS to more compressed sequence-level summaries unless necessary, since alternative aggregation may lose information [2508.01324].

## 7. Relation to unlearning methodology and later distribution-aware evaluation

The paper positions DCUE არა merely as an evaluation tool but also as a guide for unlearning algorithm design [2508.01324]. It argues that algorithms should explicitly suppress confidence on core tokens that encode sensitive knowledge rather than broadly degrading performance on related text [2508.01324]. It further recommends confidence-aware objectives that directly reduce $P_\theta(w_t \mid q,w_{<t})$ for core tokens on $D_f$ while preserving behavior on $D_r$, and suggests integrating DCUE into training to select hyperparameters that improve corrected KS p-values without harming retained capabilities [2508.01324].

This emphasis on distribution correction has resonances in adjacent work. “Uncertainty-based Debiasing and Unlearning for Decontamination” formulates a sample-level decontamination evaluation that measures how closely a corrected distribution $\hat p(y\mid x)$ recovers an uncontaminated distribution $p_u(y\mid x)$ using per-sample KL divergence and a ground-truth probability absolute difference, together with a preservation check on uncontaminated data [2606.23313]. “Towards Lifecycle Unlearning Commitment Management: Measuring Sample-level Approximate Unlearning Completeness” introduces UnleScore as a sample-level unlearning completeness score based on calibrated non-membership likelihoods and corrected change distributions, with strong reported correlation to unlearning completeness and anomaly-detection use in lifecycle monitoring [2403.12830]. “A Robust Certified Machine Unlearning Method Under Distribution Shift” argues that evaluation under non-i.i.d. deletions should correct for distribution shift by comparing utility to the retrained model on the retained distribution and by adapting membership inference to avoid confounding from shift alone [2601.06967]. “Unlearning in- vs. out-of-distribution data in LLMs under gradient-based method” formalizes GenEx and RelEx and frames fair ID-versus-OOD evaluation around matched or reweighted reference distributions [2411.04388].

A plausible implication is that DCUE belongs to a broader line of unlearning evaluation methods that treat confounding distribution shift as a first-order methodological problem rather than a secondary nuisance. In that sense, the significance of DCUE lies not only in its specific KS-based construction, but also in its assertion that unlearning evaluation should isolate residual evidence of memorization from unrelated global model drift.

Source: https://www.emergentmind.com/topics/distribution-correction-based-unlearning-evaluation-dcue