Unlearning Depth Score (UDS)

Updated 5 July 2026

UDS is a causal, activation-patching metric designed to measure the depth of knowledge erasure in large language models on a normalized scale.
It uses a two-stage procedure by patching hidden states from retain and unlearned models to accurately quantify residual target knowledge.
UDS distinguishes genuine mechanistic erasure from superficial output changes, addressing limitations of conventional output-level unlearning evaluations.

Unlearning Depth Score (UDS) is a causal, retain-referenced, activation-patching-based metric for evaluating how deeply target knowledge has been erased inside a LLM. It was proposed to address the problem that output-level unlearning evaluations can indicate apparent forgetting even when the target knowledge remains recoverable from hidden representations. UDS therefore measures mechanistic erasure rather than only output suppression, using a two-stage procedure that identifies where target knowledge is encoded and then quantifies how much of that encoding survives unlearning on a normalized $0$–$1$ scale (Lee et al., 23 May 2026).

1. Motivation and scope

The central motivation for UDS is that existing unlearning evaluations are often too shallow. Metrics such as ROUGE, Truth Ratio, extraction strength, exact memorization, and membership-inference variants operate at the level of generated outputs or token probabilities. These metrics can therefore be satisfied by superficial output shifts, refusal behavior, or representational rotations, even when the forgotten fact is still recoverable internally (Lee et al., 23 May 2026).

The paper also argues that observational white-box analyses are insufficient as a general solution. CKA, logit lens, and Fisher-based scores can reveal representational change, but they do not by themselves establish whether the target knowledge remains causally recoverable. A hidden-state rotation, for example, may make a frozen decoder fail without actually removing the encoded knowledge. UDS was introduced to supply a training-free, causal, dataset-invariant metric that can be compared across unlearning methods and forget sets (Lee et al., 23 May 2026).

Within this framing, UDS operationalizes a stronger criterion for unlearning: the unlearned model should behave like a model trained without the target data, not merely like a model that has learned to avoid producing the target answer. This shifts evaluation from output concealment to internal erasure.

2. Formal definition

UDS is defined with respect to three models:

Symbol	Model
$M_{\text{full}}$	trained on full data $D_r \cup D_f$
$M_{\text{ret}}$	trained only on retain data $D_r$
$M_{\text{unl}}$	the unlearned model produced from $M_{\text{full}}$

For each forget example $i$ , the input context is $x_i$ , and the evaluated target is an entity span

$1$0

The paper focuses on entity spans rather than generic completions because template text may be too predictable. Evaluation uses teacher forcing: the model receives the full sequence, and each entity token is scored under the ground-truth prefix (Lee et al., 23 May 2026).

Stage 1 establishes a retain-model baseline by patching hidden states from $1$1 into $1$2. For each layer $1$3,

$1$4

where $1$5 is the reference log-probability from $1$6, and $1$7 is the log-probability after patching retain-model hidden states into $1$8 at layer $1$9. Large $M_{\text{full}}$ 0 indicates that layer $M_{\text{full}}$ 1 in $M_{\text{full}}$ 2 contains target knowledge that $M_{\text{full}}$ 3 does not.

UDS then defines the set of Knowledge-Encoding layers: $M_{\text{full}}$ 4 The threshold prevents division by near-zero values in the final normalization.

Stage 2 replaces the source of patched activations with the unlearned model: $M_{\text{full}}$ 5 where $M_{\text{full}}$ 6 is the patched score when hidden states come from $M_{\text{full}}$ 7. If unlearning is perfect at layer $M_{\text{full}}$ 8, then $M_{\text{full}}$ 9; if knowledge remains intact, then $D_r \cup D_f$ 0 (Lee et al., 23 May 2026).

The per-layer erasure fraction is the Layer Erasure Ratio: $D_r \cup D_f$ 1 This yields $D_r \cup D_f$ 2 for no erasure relative to the retain baseline and $D_r \cup D_f$ 3 for erasure to the retain-model level.

The per-example UDS score is a weighted average over Knowledge-Encoding layers: $D_r \cup D_f$ 4 Thus, layers that mattered more in Stage 1 contribute more strongly to the final score. If $D_r \cup D_f$ 5, the score is undefined and the example is excluded.

The model-level score is the average across evaluated examples: $D_r \cup D_f$ 6

3. Mechanistic interpretation and causal logic

UDS is designed to answer two mechanistic questions. First, where in the full model is the forget-set knowledge encoded? Second, after unlearning, can the full model still recover that knowledge from the corresponding hidden states? The retain model provides the erasure reference, and activation patching supplies the intervention that turns this into a causal test rather than a purely observational one (Lee et al., 23 May 2026).

This causal structure is important. In Stage 1, patching retain-model activations into the full model measures how much the target log-probability deteriorates when knowledge-bearing hidden states are replaced by states from a model trained without the forget data. In Stage 2, the same intervention is repeated with activations from the unlearned model. If the unlearned model has genuinely erased the target knowledge, then its patched activations should degrade the full model almost as much as retain-model activations do.

The paper’s interpretation is that UDS measures mechanistic depth of unlearning: not whether the final output alone has changed, but whether the internal states at knowledge-bearing layers have been transformed so that the downstream machinery of the full model can no longer reconstruct the forgotten fact. This suggests that UDS is particularly suited to cases where output behavior can be altered without changing the underlying representation.

A common misconception is to equate representational difference with erasure. UDS is explicitly not a generic representation-shift metric. The causal intervention is what distinguishes it from white-box metrics that compare activations, gradients, or decoder projections without testing recoverability.

4. Meta-evaluation and empirical standing

The paper evaluates UDS in a meta-evaluation framework adapted from OpenUnlearning, using the TOFU forget10 benchmark and the Llama-3.2-1B-Instruct model family. Faithfulness is tested with two pools: a P-pool of 30 models trained with $D_r \cup D_f$ 7, and an N-pool of 30 models trained without $D_r \cup D_f$ 8. Robustness is tested on 150 unlearned models generated by 8 unlearning methods across hyperparameter sweeps: GradDiff, NPO, SimNPO, IdkNLL, IdkDPO, AltPO, RMU, and UNDIAL (Lee et al., 23 May 2026).

The comparison covers 20 metrics. These include output-level memorization metrics—Extraction Strength, Exact Memorization, Probability, Paraphrased Probability, and Truth Ratio; output-level generation metrics—ROUGE, Paraphrased ROUGE, and Jailbreak ROUGE; privacy and membership-inference metrics—MIA-LOSS, MIA-ZLib, MIA-Min-K, and MIA-Min-K++; retain-normalized MIA metrics— $D_r \cup D_f$ 9, $M_{\text{ret}}$ 0, $M_{\text{ret}}$ 1, and $M_{\text{ret}}$ 2; and white-box metrics—CKA, Fisher (masked 0.1%), Logit Lens, and UDS.

Faithfulness is measured by AUC-ROC for separating P-pool from N-pool. Robustness is evaluated under two interventions: 4-bit quantization and 1-epoch relearning on $M_{\text{ret}}$ 3. The paper uses symmetric robustness scores

$M_{\text{ret}}$ 4

$M_{\text{ret}}$ 5

with $M_{\text{ret}}$ 6. This formulation penalizes both recovery and unwanted degradation (Lee et al., 23 May 2026).

The reported ranking places UDS first on all three headline criteria:

Criterion	UDS	Comparison stated in the paper
Faithfulness	AUC-ROC $M_{\text{ret}}$ 7	Truth Ratio $M_{\text{ret}}$ 8; Logit Lens $M_{\text{ret}}$ 9
Aggregate robustness	HM $D_r$ 0	$D_r$ 1, $D_r$ 2
Overall score	$D_r$ 3	top among all 20 metrics

The paper attributes this performance to four properties: UDS is causal, training-free, retain-referenced, and dataset-invariant, and it remains stable under deployment perturbations such as quantization and relearning. By contrast, CKA is described as weak on faithfulness because representational similarity does not directly imply knowledge erasure; Fisher is described as fragile because it tracks gradient sensitivity and is destabilized by quantization; Logit Lens is described as strong but still observational; and output metrics are described as vulnerable to output-distribution shifts or refusal-like behavior.

5. Layer-wise disagreement and heterogeneous erasure depth

A notable finding is that white-box metrics can disagree sharply at the layer level. In a case study on an IdkDPO example whose target prediction is “historical fiction,” Logit Lens assigns an overall erasure score of $D_r$ 4, whereas UDS assigns only $D_r$ 5 (Lee et al., 23 May 2026). The paper explains this discrepancy by noting that Logit Lens uses a frozen decoder: if unlearning rotates or distorts hidden states, the decoder may fail even though the knowledge remains recoverable by the model’s remaining layers. UDS instead patches hidden states into $D_r$ 6, allowing the downstream computation of the full model to reveal whether the information is still present in usable form.

The same paper also reports that both methods converge at the final layer while differing strongly in intermediate layers. This suggests that apparent erasure can depend heavily on the measurement method, especially when the representation has been transformed rather than deleted.

UDS also reveals substantial example-level heterogeneity. For IdkNLL, normalized MIA metrics are near zero across configurations, but UDS varies from $D_r$ 7 to $D_r$ 8. Stratification by prompt type shows the following UDS values: Yes/No $D_r$ 9, Person Name $M_{\text{unl}}$ 0, Book/Title $M_{\text{unl}}$ 1, Biographical $M_{\text{unl}}$ 2, and Descriptive $M_{\text{unl}}$ 3 (Lee et al., 23 May 2026). The paper interprets this as evidence that “I don’t know” style unlearning can act deeply on Yes/No questions, where refusal may behave like semantic negation, while affecting outputs more than internal knowledge for other prompt formats.

These results make two points. First, unlearning depth is not uniform even within a single method. Second, a scalar output metric can flatten meaningful mechanistic variation across facts, layers, and prompt forms.

The paper gives explicit guidance for integrating UDS into benchmarking pipelines. Because Stage 1 depends only on $M_{\text{unl}}$ 4 and $M_{\text{unl}}$ 5, it recommends caching $M_{\text{unl}}$ 6, $M_{\text{unl}}$ 7, and the KE layer sets, so that new unlearned models require only Stage 2. It also recommends teacher forcing over entity spans, which allows all token probabilities to be computed in one forward pass per layer rather than by expensive autoregressive generation (Lee et al., 23 May 2026).

For privacy evaluation, the paper recommends replacing a purely output-based privacy score with

$M_{\text{unl}}$ 8

where $M_{\text{unl}}$ 9 is the harmonic mean of the four normalized MIA metrics. The stated purpose is to make privacy evaluation sensitive both to output-level leakage and to internal residual knowledge. The paper also reports that adding UDS to model selection and hyperparameter tuning can swap the ranking of NPO and SimNPO and can shift selected configurations toward higher learning rates or longer unlearning.

A practical caution concerns clipping. Because UDS is clipped at $M_{\text{full}}$ 0, over-unlearning can look like perfect unlearning. The paper therefore advises using UDS alongside the utility axis, so that degradation of general capabilities is not misread as successful erasure. Current limitations are also explicit: UDS assumes availability of a retain model, evaluation on localized entity spans, and a teacher-forcing setup. Without a retain model, a reduced version can still patch unlearned states into the full model, but the baseline normalization is lost.

UDS occupies a specific place in the emerging landscape of mechanistic unlearning evaluation. It is a post-hoc erasure metric, whereas Circuit-guided Unlearning Difficulty (CUD) is a pre-unlearning metric that scores intrinsic sample difficulty from circuit structure: $M_{\text{full}}$ 1 CUD is intended to identify whether samples are easy or hard to forget before any unlearning occurs, based on similarity to easy and hard anchor circuits, with easy samples associated with shallower early-to-intermediate circuitry and hard samples with deeper, late-stage, output-proximal circuitry (Cheng et al., 14 Jan 2026). This contrast is useful: UDS measures how much erasure has occurred, while CUD measures how difficult that erasure is likely to be.

A separate terminological point is that the acronym “UDS” is also used for “Unified Distillation Sampling” in 3D generation and editing, where it denotes a reformulation of SDS-style optimization rather than an unlearning metric (Miao et al., 3 May 2025). In unlearning research, however, “UDS” refers to Unlearning Depth Score.

In summary, Unlearning Depth Score is a retain-referenced, activation-patching metric that quantifies whether hidden representations in an unlearned model still permit recovery of forgotten knowledge. Its central contribution is to turn mechanistic recoverability into a normalized causal score, thereby distinguishing output suppression from genuine internal erasure.