---
title: 'Oblivionis: LLM Forgetting & Cryptographic Obliviousness'
url: https://www.emergentmind.com/topics/oblivionis
type: topic
---

# Oblivionis: LLM Forgetting & Cryptographic Obliviousness

to=arxiv_search.search ,超碰്യമീറ്റർ  ฝ่ายขายข่าว नहीं exist code?
to=arxiv_search.search  重庆时时彩彩്യം  天天中彩票网?
to=arxiv_search.search  ฝ่ายขายรายการjson
{"query":"id:2502.15010 OR id:1202.5150 OR id:1403.6022 OR id:1710.08256 OR id:1907.00475 OR id:2006.06671","max_results":10}
to=arxiv_search  大发快三是国家json
{"query":"2502.15010 1202.5150 1403.6022 1710.08256 1907.00475 2006.06671","max_results":10}
to=tool.arxiv_search 彩票开号json
{"query":"2502.15010","max_results":5}
Oblivionis is not a single standardized technical term. In the cited literature, it denotes either the capability of *oblivion* or *forgetting* very specific text within a large language model, or the cryptographic notion of being *oblivious* in primitives such as Oblivious RAM and oblivious transfer. This suggests a shared high-level theme—controlled limitation of what can be reproduced, inferred, or linked—implemented through materially different mechanisms in post-training unmemorization, access-pattern hiding, and two-party cryptographic protocol design [2502.15010, 1202.5150, 1403.6022, 1710.08256, 1907.00475, 2006.06671].

## 1. Terminological scope and disciplinary usage

In the large-language-model setting, Oblivionis is explicitly associated with selective forgetting: the capability of *oblivion* or *forgetting* very specific text within a model. The motivating distinction is between **semantic memorization**, which lets models “know” what a work or topic is about, and **verbatim memorization**, in which the model can reproduce specific sequences nearly exactly when prompted with part of the text. The relevant objective is not total erasure of knowledge, but suppression of exact sequence reproduction while preserving semantic understanding and downstream task performance [2502.15010].

In cryptography, by contrast, the term is read as *oblivious*. In **Oblivious RAM**, the client uses remote storage while hiding its memory access pattern, so that the physical locations accessed and their order reveal no information about which logical data item is accessed, how recent it is, whether two accesses touch the same item, whether the pattern is sequential or random, or whether each operation is a read or a write [1202.5150]. In **oblivious transfer**, the sender transfers information in such a way that the sender remains oblivious to whether, or what, the receiver has learned; the literature cited here covers Rabin-style quantum OT, adaptively secure UC OT in the ROM, genus-2 supersingular isogeny OT, and device-independent XOR OT [1403.6022, 1710.08256, 1907.00475, 2006.06671].

The term therefore has domain-specific semantics. In machine learning it targets **controlled forgetting** of surface form; in cryptography it targets **controlled ignorance** of access patterns, choices, or transfer outcomes.

## 2. Controlled forgetting in large language models

The formulation in "Obliviate: Efficient Unmemorization for Protecting Intellectual Property in Large Language Models" centers on verbatim memorization. For a token sequence $\mathbf{s}=(s_1,\ldots,s_n)$, the model is defined to be $(\ell,\beta)$-memorized if some prefix of length $\ell$ allows the model $M$ to generate the rest with high probability:
$$
P_M(s_{i+\ell}, s_{i+\ell+1}, \ldots, s_n \mid s_{i:i+\ell-1}) > \beta,\quad i \sim U[1,n-\ell],\ \beta \in [0,1].
$$
Operationally, the paper works with greedy decoding and measures the longest exact continuation:
$$
n^* = \max n : \forall j \in [i+\ell, i+n],\  s_j = \argmax_{x \in \mathcal{V}} P_M(x \mid s_{i:j-1}).
$$
This formalization isolates the copyright-relevant regime in which a deployed LLM can reproduce long exact excerpts rather than merely retain concepts, facts, or styles [2502.15010].

Obliviate is a **post-training unmemorization technique**. It scans a memorized passage with a **stride** $s$, marks every $s$-th token as a **target token**, excludes special tokens such as “start of text” and “end of text,” and excludes tokens whose predicted probability is already 100%. For each target token, it operates on the **top-10 logits** and minimizes a KL divergence between the original next-token distribution and a modified distribution with the target token removed:
$$
L = \mathrm{KL}\Big(\mathrm{softmax}(\mathbf{z}) \,\Big\|\, \mathrm{softmax}(\mathbf{z}\setminus x_{\text{target}})\Big).
$$
For non-target tokens it applies a **maintain (consistency) loss**, again using KL divergence, between the original model and the modified model. The combined objective is written as
$$
\mathcal{L} = \lambda_f L + \lambda_m L,
$$
with $\lambda_f$ weighting the forget loss on target tokens and $\lambda_m$ weighting the maintain loss on non-target tokens. Fine-tuning is done post-training, starting from a pretrained checkpoint, with **top-k = 10** in most experiments and **early stopping** once target token probabilities have fallen sufficiently [2502.15010].

The evaluation covers four open-source LLMs—**LLaMA-3.1 8B**, **LLaMA-3.1-Instruct 8B**, **Qwen-2.5 7B**, and **Yi-1.5 6B**—on a synthetic memorization benchmark and on organic copyrighted excerpts including *Harry Potter and the Philosopher’s Stone*, *Moby Dick*, *Frankenstein*, *Adventures of Huckleberry Finn*, *Alice in Wonderland*, *Sherlock Holmes*, *A Tale of Two Cities*, *Treasure Island*, *Les Misérables*, and *Great Expectations*. Memorization is measured with **Longest Common Subsequence (LCS)**, **Edit Distance (ED)**, and **ROUGE-2** under varying prefix offsets, prefix lengths, greedy decoding, and sampling at temperature 0.6 [2502.15010].

The reported effect is highly localized suppression of verbatim recall. On synthetic articles, before Obliviate the “Memorized” models have **LCS ~360+ words** and **ED ~5–6 words difference**; after Obliviate with **stride = 5, top-10 KL, early stopping**, **LCS drops to ~4–5 words** and **ED rises to >60 words**. On organic copyrighted text, post-Obliviate **LCS** is reduced to **~2–5 words**. Across all models and both synthetic and organic settings, downstream benchmark differences on **HellaSwag**, **MMLU**, **TruthfulQA**, and **Winogrande** are **within ~1%**, and some scores improve slightly. The scope, however, is explicit: Obliviate removes **verbatim memorization**, not semantic knowledge, and the threat model is **non-adversarial** rather than jailbreak-centric [2502.15010].

## 3. Oblivious access and Path ORAM

In "Path ORAM: An Extremely Simple Oblivious RAM Protocol," oblivionis refers to **obliviousness of access patterns** rather than forgetting. ORAM is a cryptographic primitive that lets a trusted client use untrusted remote storage while hiding the memory access pattern. The adopted security definition requires that for any two logical request sequences $\vec{y}$ and $\vec{z}$ of the same length, their physical access patterns $A(\vec{y})$ and $A(\vec{z})$ are computationally indistinguishable, and that the ORAM is correct with probability at least $1-negl(|\vec{y}|)$ [1202.5150].

Path ORAM is a **tree-based ORAM** in which every access is a read and write of a single root-to-leaf path in a complete binary tree stored on the server. Each node is a bucket of capacity $Z$, padded with dummy blocks when necessary; the client stores a **position map** and a **stash**. The main invariant is that each logical block is mapped to a uniformly random leaf, and any unstashed copy of the block must reside in a bucket along the path from the root to that mapped leaf. The access protocol remaps the addressed block to a fresh random leaf, reads the entire old path into the stash, updates the block, and greedily writes eligible blocks back down the path while padding with dummies and re-encrypting [1202.5150].

The asymptotic claim is that Path ORAM has **$O(\log N)$ bandwidth cost** for blocks of size $B=\Omega(\log^2 N)$ bits. In the non-recursive scheme each access reads and writes one path of $O(\log N)$ buckets, each of size $Z=O(1)$, for total bandwidth $2Z(L+1)=O(\log N)$ blocks per logical access. Recursion stores the position map itself in smaller ORAMs; with **non-uniform block sizes** the main result yields client storage **$O(\log N)\cdot\omega(1)$ blocks**, bandwidth **$O(\log N)$ blocks per logical access**, and failure probability **$N^{-\omega(1)}$** [1202.5150].

Correctness depends on bounding **stash overflow**. For bucket size $Z=5$, the paper proves
$$
\Pr(s(_L^5[\mathbf{s}])>R \mid a(\mathbf{s}) = \mathbf{a}) \le 14\cdot (0.6002)^R,
$$
so overflow probability decays exponentially in the stash size $R$. The construction is also statistically oblivious at the access-pattern level, modulo encryption, because each revealed leaf label is a fresh independent uniform element in $\{0,\dots,2^L-1\}$ and every access has the same physical shape: a single encrypted path [1202.5150].

This use of oblivionis is structurally different from LLM unmemorization. The objective is not to alter stored semantic content, but to make observation of physical access sequences uninformative.

## 4. Oblivious transfer as controlled ignorance

In the OT literature cited here, oblivionis denotes the sender’s or receiver’s enforced ignorance under a prescribed transfer functionality. The variants include **Rabin OT**, **1-out-of-2 OT**, **1-out-of-$n$ OT**, and **XOR oblivious transfer**. The common property is that one party learns exactly what the functionality allows, and remains oblivious to everything else [1403.6022, 1710.08256, 2006.06671].

The quantum protocol in "Oblivious transfer based on quantum state computational distinguishability" implements **Rabin-style OT of a single classical message**. Alice encodes a classical message $m=m_1m_2\dots m_\ell$ into a tensor product of states $\rho_+$ and $\rho_-$ indexed by a secret permutation $T\in K_n$, sends the quantum state and a classical hash $y=h(m)$, and later participates in a randomized opening phase in which Bob reconstructs the correct trapdoor with probability $\frac{1}{2}$ and a wrong one otherwise. The correctness theorem states: Bob cannot infer $m$ before the opening phase except with negligible probability; Bob receives $m$ with probability
$$
\frac{1}{2}+\varepsilon(\ell),
$$
where $\varepsilon(\ell)$ is negligible; and Alice remains oblivious to the fact that Bob received the message. The security assumption is the quantum hardness of **QSCD\(_{ff}\)**, i.e. computational indistinguishability of $(\rho_+)^{\otimes k(n)}$ and $(\rho_-)^{\otimes k(n)}$ for any QPT adversary [1403.6022].

A different line appears in "A Framework for Efficient Adaptively Secure Composable Oblivious Transfer in the ROM." That work constructs a **round-optimal (2 rounds) universally composable (UC) protocol** secure against **active adaptive adversaries** in the **Random Oracle Model**. The protocol is built generically from a public-key encryption scheme satisfying **OW-CPA security**, **Property 2.2** and **Property 2.3**. Operationally it requires only **the generation of a public/secret-key pair, two encryption operations and one decryption operation**, plus a few random oracle calls; communication requires **one public-key, two ciphertexts, and three binary strings of roughly the same size as the message**. The framework is instantiated under **low noise LPN, McEliece, QC-MDPC, LWE, and CDH assumptions**, and the main theorems state UC realization of $\mathcal{F}_{\mathsf{OT}}$ against static and adaptive adversaries in the $\mathcal{F}_{\mathsf{RO}}$-hybrid model [1710.08256].

These OT constructions make the cryptographic meaning of oblivionis precise: it is not forgetting, but a provable asymmetry of knowledge enforced by hardness assumptions, simulation arguments, and, in the quantum case, trapdoor-only distinguishability.

## 5. Specialized OT realizations: isogenies and device independence

"Genus 2 Supersingular Isogeny Oblivious Transfer" extends supersingular elliptic-curve isogeny OT to **principally polarized supersingular abelian surfaces**. The protocol, denoted **2-SIOT**, is a **two-message (two rounds) 1-out-of-2 OT** in which Alice holds $m_0,m_1\in\mathcal{M}$ and Bob holds a choice bit $\beta\in\{0,1\}$. The setup fixes a prime
$$
p = 2^n 3^m f - 1,
$$
a supersingular genus-2 curve obtained from $H_0:y^2=x^6+1$, bases for $J_H[2^n]$ and $J_H[3^m]$, and SIDH-like isogenies $\varphi_A$ and $\varphi_B$. Bob encodes his choice via hidden shifts $U_j$ in
$$
R_j := \varphi_B(P_j) - \beta U_j.
$$
Alice computes two candidate shared secrets $\mathcal{G}_0$ and $\mathcal{G}_1$ from two candidate kernels, encrypts $m_0$ and $m_1$ under those secrets, and Bob can decrypt only $m_\beta$. The security discussion relies on **CSSI**, **SSCDH**, and a **decisional Diffie–Hellman type hardness** in Weil pairings on torsion subgroups. The paper is explicit that the protocol is **implementable, but too slow to be practical**, and that **the analysis of the situation preventing possible decryptions from a malicious receiver remains open** [1907.00475].

"A device-independent protocol for XOR oblivious transfer" treats oblivionis as **device-independent oblivious transfer**. In **XOR oblivious transfer (XOT)**, Alice outputs two uniformly random bits $(x_0,x_1)$, Bob outputs a uniformly random trit $b\in\{0,1,2\}$ and a bit $x_b$, where $x_2:=x_0\oplus x_1$. The protocol is built from the **Mermin–Peres magic square game** and uses test branches plus classical fallback subprotocols. In the fully device-independent protocol, if either party calls a test and the test passes, the continuation is a classical XOT subroutine; if no test is called, the parties run a magic-square-based XOT subprotocol. For parameters $q^A=q^B=0.6$, the numerical bounds are
$$
P_B^{XOT} \le 0.96440,\qquad P_A^{XOT} \le 0.99204,
$$
and analytically, for any $q^A,q^B>0$, there exists some $\delta>0$ such that
$$
P_A^{XOT}, P_B^{XOT} \le 1-\delta.
$$
The proof uses rigidity of near-optimal magic square strategies under local isometries and SDP relaxations based on the NPA hierarchy [2006.06671].

These specialized realizations show that the cryptographic meaning of oblivionis is not tied to one algebraic substrate. It appears in symmetric-group trapdoor states, public-key frameworks in the ROM, supersingular genus-2 Jacobians, and black-box nonlocal quantum devices.

## 6. Common structure, distinctions, and limitations

A common misconception would be to collapse these usages into a single mechanism. The cited works do not do so. In the LLM setting, the goal is **fine-grained control over exact sequence reproduction** while preserving semantic understanding and downstream utility; the method is explicitly weaker than full unlearning and is designed for **verbatim memorization**, not semantic removal [2502.15010]. In ORAM, the goal is **indistinguishability of physical access patterns** for logical request sequences of the same length; timing channels are not considered in the main security definition [1202.5150]. In OT, the goal is **knowledge asymmetry**: sender privacy, receiver privacy, probabilistic transfer, adaptive composability, or device-independent soundness, depending on the model [1403.6022, 1710.08256, 2006.06671].

The limitations are likewise domain-specific. Obliviate does not prevent **semantic extraction**, and the threat model is **non-adversarial**; carefully constructed prompts may still elicit paraphrases or partial sequences, and scaling to thousands or millions of sequences may raise computational cost and interaction effects [2502.15010]. Path ORAM achieves strong asymptotics and practical simplicity, but the optimal bandwidth with small client storage requires **block size $B=\Omega(\log^2 N)$ bits**, recursive position maps increase latency, and side channels beyond access patterns require additional mechanisms [1202.5150]. Quantum OT remains computational rather than unconditional because fully secure quantum OT is impossible; the cited protocol relies on the presumed hardness of **QSCD\(_{ff}\)** [1403.6022]. The UC OT framework is in the **ROM**, not the standard model [1710.08256]. The genus-2 isogeny OT is currently too slow to be practical and leaves part of the malicious-receiver analysis open [1907.00475]. Device-independent XOT proves non-trivial security, but the paper works with operational cheating probabilities rather than full composable security [2006.06671].

Taken together, these works suggest that Oblivionis is best understood as a family resemblance rather than a single object. In one branch it is **selective induced oblivion of exact text** inside LLMs; in the other it is **obliviousness** as a cryptographic design principle, ensuring that memory traces, access trajectories, receiver choices, or transfer outcomes remain hidden except where disclosure is explicitly authorized by the functionality.

Source: https://www.emergentmind.com/topics/oblivionis