Hirundo Alters LLM Weights Directly to Erase Data and Model Flaws

Machine Unlearning - Making AI Forget With Hirundo LTD — Ai4

Ai4

External guardrails and fine-tuning fail to prevent data leaks and jailbreaks because flawed patterns stay embedded in parameters, making direct weight excision necessary to eliminate enterprise AI liabilities without retraining.

AI-assisted summary of Machine Unlearning - Making AI Forget With Hirundo LTD — original source. Check the original for full context.

Source published: 2025-08-25

Detailed notes

## Background Published on YouTube by Ai4 on August 25, 2025, this presentation features Ben Luria, CEO and Co-Founder of Hirundo LTD. According to the page description, the session explores Hirundo's patented machine unlearning platform, which removes sensitive data (such as PII) and unwanted behaviors (such as hallucinations and systemic biases) directly from LLM weights without requiring model retraining.

## TL;DR Ben Luria explains that conventional AI training permanently embeds ingested data, leaving models vulnerable to persistent hallucinations, biases, and regulatory non-compliance. Unlike external guardrails that can be bypassed or additive fine-tuning that merely masks flaws, Hirundo performs direct 'weight neurosurgery' to selectively and permanently excise target behaviors and proprietary data. Validated on open-weight architectures like Llama, DeepSeek, and Mistral, the platform achieves measurable remediations—such as a 55% reduction in hallucinations and verifiable PII deletion—in under an hour on a single GPU. Deployable on-premises or via VPC, Hirundo's approach helps enterprises de-risk autonomous deployments while meeting strict privacy standards like GDPR.

## Atmosphere & style The presentation kicks off with a playful, interactive thought experiment about suppressing the thought of a pink elephant, instantly anchoring complex algorithmic theory in relatable human psychology. Luria delivers his keynote with a crisp, measured, and intellectually confident cadence, projecting the authority of an academic-backed enterprise founder. Watching the talk feels structured and solution-oriented, moving deliberately from high-level enterprise dilemmas to concrete benchmark tables, creating a persuasive sense of technological clarity amidst the chaotic landscape of AI safety.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) Once ingested during training, LLMs permanently store data and internalize negative traits—such as hallucinations, systemic biases, and security vulnerabilities—deep within their weights. - [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) Hirundo developed a machine unlearning platform allowing enterprises to selectively remove unwanted data and maladaptive behaviors from model weights without costly retraining from scratch. - [01:32](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=92s) Enterprise LLM adoption is currently bottlenecked by the dual risks of maladaptive autonomous behaviors and the ingestion of confidential IP or non-compliant personal identifiable information (PII). - [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) Input/output guardrails and fine-tuning fall short of solving root issues because guardrails are susceptible to prompt injection jailbreaks, while fine-tuning merely masks underlying parameters additively. - [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) Hirundo functions as reductive 'neurosurgery' for AI models, directly altering weight matrices across two core modalities: behavior unlearning and data unlearning. - [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) Behavior unlearning removes systemic flaws such as hallucinations and jailbreak vectors without requiring access to original pre-training datasets or system prompt modifications. - [05:28](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=328s) Unlearning processes complete in under an hour on a single standard GPU while keeping core model performance, perplexity, and reasoning benchmarks intact. - [05:28](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=328s) Third-party benchmark evaluations demonstrate a 55% reduction in hallucinations on HaluEval and an 85% reduction in successful jailbreaks on Meta Purple Llama. - [05:28](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=328s) Systemic bias remediation on the BBQ benchmark showed improvements between 45% and 70% across Gemma, DeepSeek, and Llama architectures. - [08:54](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=534s) Data unlearning facilitates compliance with GDPR ('Right to Be Forgotten') and CCPA by achieving 100% verifiable erasure of PII from fine-tuned model parameters. - [08:54](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=534s) The platform supports deployment in on-premises, customer VPC, or SaaS environments across major open-weight models including Llama, Gemma, DeepSeek, and Mistral.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) The Pink Elephant Problem and the Limits of AI Memory

To kick off the session on the final day of the conference, Ben Luria introduces an interactive thought experiment: he asks the audience to deliberately not think about or remember a pink elephant, instructing them to do everything they can to erase what they have just seen. When he calls on an audience member, the inescapable psychological reality becomes obvious—virtually everyone in the room is actively holding the pink elephant in their mind. The human brain cannot simply decide to selectively discard information on command.

```mermaid flowchart TD accTitle: Training Ingestion to Weight Imprinting Flow subgraph Ingestion ["Data Ingestion"] A["Training Data & Fine-Tuning Corpus"] --> B["Sensitive & Unwanted Content (PII, Copyright, Toxicity)"] end subgraph ModelWeights ["Permanent Parameter Encoding"] B --> C["Model Parameter Storage (Deeply Entangled in Weights)"] end subgraph EmergentRisks ["Emergent Maladaptive Behaviors"] C --> D["Hallucinations"] C --> E["Systemic Biases"] C --> F["Security Vulnerabilities & Jailbreaks"] end ```

Luria emphasizes that large language models suffer from this exact same constraint. Once data is ingested during training or fine-tuning, it is there to stay permanently. The model retains that information and absorbs the negative characteristics embedded inside it. As a result, the model internalizes undesirable traits—becoming biased, prone to hallucination, and susceptible to vulnerabilities. Hirundo was established to solve this fundamental challenge by creating the world's first machine unlearning platform, empowering enterprises to teach AI models how to selectively and retroactively forget unwanted data and maladaptive behaviors from their weights without retraining from scratch.

---

[01:32](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=92s) Hirundo's Foundation, Team, and Core Unlearning Solution

Hirundo was built specifically to address the enterprise AI adoption bottleneck by directly de-risking large language models. The seed-backed startup was co-founded alongside a Chief Scientist who served as Dean of Computer Science and Executive Vice President at the Technion (Israel's premier STEM institute), holding over 50 US patents and researching artificial intelligence since the 1980s. The technical team comprises PhD researchers alongside Luria, an Israeli Rhodes Scholar. While tech giants such as Google, Microsoft, Meta, and Amazon have extensively researched machine unlearning in academic settings, Hirundo has translated the science into commercial deployment, backed by seven filed US patents and SOC 2 compliance.

The core motivation is bridging the gap between enterprise AI interest and actual production rollout. Organizations want to leverage LLMs across customer service, internal retrieval, and autonomous agents, but the risks remain prohibitive: - **Maladaptive Behaviors:** LLMs deployed with significant autonomy can hallucinate incorrect facts, display racial, gender, or age biases, or fall prey to adversarial manipulation. - **Problematic Data Knowledge:** Models ingest confidential trade secrets, sensitive enterprise documents, and non-compliant personal identifiable information (PII).

---

[03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) Unlearning vs. Guardrails and Fine-Tuning: Neurosurgery on Model Weights

The conventional approaches to mitigating model risks rely on peripheral filtering or additive training, but both fall short of solving the root issue. Input/output guardrails and monitoring layers act merely as firewalls around an inherently flawed model. If a model fundamentally holds improper knowledge or problematic reasoning patterns beneath the surface, determined users can readily craft prompt injection techniques to bypass external barriers. Conversely, fine-tuning is purely an additive mechanism that attempts to steer the model by layering more context on top; it merely masks vulnerabilities underneath additional parameters rather than excising them.

```mermaid flowchart LR accTitle: Guardrails vs Fine-Tuning vs Machine Unlearning subgraph Guardrails ["1. Guardrails / Firewalls"] G1["Input / Output Filter"] -. "Bypassed via Jailbreak".-> G2["Flawed Model Weights (Unchanged)"] end subgraph FineTuning ["2. Additive Fine-Tuning"] FT1["Additional Data Layer"] --> FT2["Masks Underlying Flaws (Core Triggers Remain)"] end subgraph Unlearning ["3. Hirundo Machine Unlearning"] U1["Direct Weight Surgery"] ==> U2["Permanent Removal of Target Behaviors & Data"] end ```

Hirundo approaches the challenge as a reductive process—performing targeted "neurosurgery to AI" by modifying weight matrices directly. The platform categorizes unlearning into two core modalities: - **Behavior Unlearning:** Scans and eliminates systemic behaviors (such as hallucinations, bias, and jailbreak vectors) across foundational or fine-tuned models without needing access to the original pre-training datasets or altering system prompts. - **Data Unlearning:** Provides complete, guaranteed removal of targeted data points (such as copyrighted text, proprietary IP, or PII) in minutes rather than spending days or weeks retraining models from scratch.

---

[05:28](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=328s) Empirical Benchmarks, Case Studies, and Preserving Model Utility

To validate performance without "drinking our own Kool-Aid," Hirundo tests its platform against standard, third-party industry benchmarks across leading open-weight architectures such as Llama, Gemma, DeepSeek, and Mistral. Crucially, targeted unlearning procedures execute in under an hour on a single standard GPU while leaving core capabilities—such as perplexity, logical reasoning, and general task accuracy—fully intact.

In real-world enterprise deployments, these metrics translate into immediate risk reduction: - **Financial and Legal Accuracy:** Eradicating hallucinations prevents false statements on sensitive financial prompts that could lead to legal liability, public relations crises, or regulatory fines. - **Fairness in Customer Interactions:** Removing discriminatory biases prevents models from generating outputs that disadvantage users based on age, gender, or race. - **Resilience Against Zero-Day Exploits:** While rule-based guardrails fail against novel adversarial attacks, modifying the underlying model weights makes the system inherently robust against prompt injections across 85% of previously vulnerable edge cases.

---

[08:54](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=534s) PII Compliance, Deployment Modes, and the Path Forward

Data unlearning is particularly vital for strict regulatory environments governed by GDPR ("Right to Be Forgotten") and CCPA. In a featured demonstration using a fine-tuned Mistral model containing sensitive user profiles, Hirundo redacted user identifiers (such as the fake ID belonging to a record for "Janet Morris"). When prompted to recall the record, the unlearned model showed complete parameter amnesia—hallucinating or declining the specific ID rather than disclosing the true value, representing 100% verifiable erasure while maintaining surrounding non-sensitive customer data.

The platform is designed to run completely inside an organization's existing environment—deployable on-premises, within a customer's Virtual Private Cloud (VPC), or via SaaS—ensuring that enterprises do not need to expose proprietary data externally. Supporting architectures ranging from Llama, Gemma, and DeepSeek to open-source models released by OpenAI, Hirundo is rolling out its enterprise beta program to help organizations regain direct control over their AI weights, reduce GPU retraining expenses, and ensure responsible, resilient deployment. Luria concludes with a final quip reminding the audience about the pink elephant, urging anyone who still remembers it to explore machine unlearning.

## Notable quotes > Hirundo makes AI forget. Today, AI training is a one-way track: the data and behaviors that models learn are there to remain, and nearly impossible to remove. — Ben Luria

> Our patented Machine Unlearning platform removes unwanted data and behaviors from the weights of trained LLMs - remediating biases, hallucinations, vulnerabilities and compliance issues, without any retraining. — Ben Luria

> Our process works in minutes rather than days, and surpasses methods such as guardrails that filter inputs/outputs or lengthy fine tuning that lack guaranteed results. — Ben Luria

> We believe forgetting will define the next generation of responsible AI adoption. — Ben Luria

> [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) Once data is ingested during training or fine-tuning, it is there to stay permanently. The model retains that information and absorbs the negative characteristics embedded inside it. — Ben Luria

> [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) Input/output guardrails and monitoring layers act merely as firewalls around an inherently flawed model. — Ben Luria

> [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) neurosurgery to AI — Ben Luria

> [05:28](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=328s) drinking our own Kool-Aid — Ben Luria

> [05:28](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=328s) targeted unlearning procedures execute in under an hour on a single standard GPU while leaving core capabilities—such as perplexity, logical reasoning, and general task accuracy—fully intact. — Ben Luria

## Mentioned Ben Luria, Hirundo LTD, Ai4, Technion, Google, Microsoft, Meta, Amazon, OpenAI, Meta Llama 3, Llama 4, DeepSeek, Gemma, Mistral, HaluEval, BBQ (Bias Benchmark for QA), Meta Purple Llama, GDPR, CCPA

## Video description Ben Luria, CEO and Co-Founder, Hirundo LTD

Abstracts

Hirundo makes AI forget. Today, AI training is a one-way track: the data and behaviors that models learn are there to remain, and nearly impossible to remove. Too often, they learn unwanted data (PII, confidential, malicious) and behaviors (hallucinations, vulnerabilities, biases).

Hirundo makes it possible to undo that. Our patented Machine Unlearning platform removes unwanted data and behaviors from the weights of trained LLMs - remediating biases, hallucinations, vulnerabilities and compliance issues, without any retraining.

Our process works in minutes rather than days, and surpasses methods such as guardrails that filter inputs/outputs or lengthy fine tuning that lack guaranteed results. Some of our case studies include:

- Unlearning finetuned PII from Llama 3 (forgetting personal data at scale, with guaranteed erasure and no damage to performance) - Unlearning biases from DeepSeek (70% reduction on BBQ) and Llama 4 (44% reduction) - Unlearning hallucinations from Llama 3 (55% reduction on hallucinations in HaluEval)

We have active F500 and national security customers who are already using our platform to make their AI models more trustworthy and de-risk their AI adoption, by allowing models to forget.

As AI adoption in enterprise grows, AI safety and trust are becoming a must. We believe forgetting will define the next generation of responsible AI adoption.

[Source](https://www.youtube.com/watch?v=VMZqJUDpyJk)

中文简报

Hirundo直接修改LLM权重以消除数据与模型缺陷外部护栏与微调无法防止数据泄露和越狱，因为缺陷模式仍深植于参数之中，这使得直接切除权重成为无需重新训练即可消除企业AI隐患的必要手段。 Ben Luria解释称，传统的AI训练会永久嵌入所吸收的数据，使模型极易出现持续幻觉、偏见和监管违规风险。与容易被绕过的外部护栏或仅能掩盖缺陷的增量微调不同，Hirundo通过直接执行“权重神经外科手术”，选择性且永久切除目标行为与专有数据。该平台已在Llama、DeepSeek和Mistral等开放权重架构上完成验证，在单张GPU上不到一小时内即可实现可衡量的修复成效——例如减少55%的幻觉以及可验证的个人身份信息（PII）删除。Hirundo支持本地或通过VPC部署，其方案有助于企业在满足GDPR等严格隐私标准的同时，降低自主部署的风险。大语言模型在训练后通常会将敏感数据以及幻觉、偏见和漏洞等负面特性永久固化在权重中；初创公司 Hirundo 推出了机器遗忘（Machine Unlearning）平台，使企业无需耗费巨资从头重新训练即可定向消除这些问题。 (0:04) 传统的护栏过滤层容易被提示词注入绕过，而微调只是叠加参数进行掩盖；Hirundo 采用类似“神经外科手术”的直接权重干预，分为行为遗忘与数据遗忘两大核心模式。 (3:03) 测试显示该遗忘处理可在单张标准 GPU 上一小时内完成且不影响基础推理性能，第三方评测证明其可减少 55% 的幻觉（HaluEval）以及 85% 的越狱攻击风险（Meta Purple Llama）。 (5:28) 为满足 GDPR 等隐私合规要求，平台可对敏感个人身份信息（PII）实现 100% 可验证擦除，并支持在客户本地或私有云（VPC）内安全部署。 (8:54)

Reading summary

Ben Luria of Hirundo argues that enterprise AI adoption is constrained because models permanently embed sensitive data, biases, and vulnerabilities within their weights during training. To replace fragile peripheral guardrails and avoid costly full retraining, Hirundo proposes direct machine unlearning to selectively excise unwanted data and behaviors while maintaining model utility. The Inadequacy of Guardrails and Fine-Tuning (3:03) Luria contends that standard industry defenses fail to address the root cause of model failure. External input and output guardrails act merely as firewalls around an unchanged, flawed weight matrix; determined users can regularly bypass these barriers with adversarial prompt injection. Similarly, conventional fine-tuning is an additive mechanism that stacks new context over old parameters, concealing vulnerabilities rather than removing them. Because ingested training data becomes deeply entangled in model parameters, language models cannot simply discard specific memories on demand—a limitation Luria compares to the human inability to suppress the thought of a pink elephant. When enterprises deploy autonomous models containing confidential trade secrets, personally identifiable information (PII), or toxic source content, peripheral filters leave underlying security, hallucination, and bias risks intact. Reductive Weight Modification for Targeted Erasure (3:03) Hirundo frames machine unlearning as a reductive process, characterizing it as direct neurosurgery on model weight matrices that bypasses the need for multi-week retraining cycles. The platform splits this intervention into two primary operational categories: behavior unlearning and data unlearning. Behavior unlearning identifies and removes systemic flaws—such as hallucinations, demographic bias, and jailbreak vulnerabilities—from foundational or fine-tuned models without altering system prompts or requiring access to original pre-training datasets. Data unlearning provides targeted removal of specific data points, such as copyrighted content, intellectual property, or non-compliant PII, achieving verified parameter amnesia in minutes. Empirical Benchmark Results and Operational Efficiency (5:28) According to Hirundo, its unlearning processes execute in under an hour on a single standard GPU across open-weight architectures, including Meta's Llama, Google's Gemma, DeepSeek, and Mistral. The company asserts that core capabilities—such as perplexity, logical reasoning, and broad task accuracy—remain intact after weight modification. The startup validated these claims against standard third-party benchmarks. In tests on Meta Llama 3, the method achieved a 55% reduction in hallucinations on HaluEval and an 85% drop in successful adversarial jailbreaks on Meta's Purple Llama. On the Bias Benchmark for QA (BBQ), tests across Gemma, DeepSeek, and Llama showed a 45% to 70% decrease in demographic bias, while extraction tests demonstrated 100% verifiable data erasure. Regulatory Compliance and Private Deployment Frameworks (8:54) Data unlearning is positioned as an operational solution for statutory privacy mandates such as GDPR's 'Right to Be Forgotten' and CCPA. In a demonstration using a fine-tuned Mistral model containing user profiles, Hirundo targeted a specific user identifier associated with the record 'Janet Morris.' Following the intervention, the model either declined the prompt or hallucinated an incorrect value, demonstrating complete parameter erasure while leaving adjacent non-sensitive customer profiles intact. To address enterprise security requirements, Hirundo's platform—backed by seven filed US patents and SOC 2 compliance—deploys on-premises, inside an organization's Virtual Private Cloud (VPC), or through SaaS. This architecture ensures that proprietary corporate data and weight updates remain inside the customer's operational perimeter. Hirundo demonstrates measurable risk reduction across open-weight models using standard benchmarks, but the presentation does not address how machine unlearning applies to closed-source commercial models accessible only via API, nor does it provide evidence regarding whether repeated, cumulative unlearning passes cause gradual degradation in complex reasoning over time.

精炼阅读摘要

Hirundo联合创始人Ben Luria指出，大语言模型在吸纳敏感信息与不良偏好后难以通过外围防护彻底根除，提出以直接修改权重矩阵的“机器遗忘”（Machine Unlearning）技术，使模型在单张GPU上于数分钟至一小时内选择性抹除特定数据与行为，从而免除高昂的全量重新训练成本。模型记忆困境与传统防护的外周局限 (0:04) Luria通过“不要去想粉色大象”的思想实验说明，人类大脑无法依指令选择性删除已存信息，大语言模型在训练和微调阶段摄取数据后亦面临同样机制：敏感内容、隐私信息（PII）、版权文本及不良偏好会深度纠缠并永久固化在模型参数中，诱发幻觉、偏见和安全漏洞。目前企业普遍采用的外围防御手段存在明显不足，基于输入输出的护栏（Guardrails）与监控层仅相当于包裹在问题模型外部的防火墙，一旦面临精心构造的提示词注入（Prompt Injection）便易被绕过；而追加微调（Fine-Tuning）属于附加性机制，仅通过增加上下文参数来掩盖既有漏洞，无法真正剔除底层的触发机制与缺陷。靶向权重手术与双模态遗忘机制 (3:03) 针对传统方案的不足，Hirundo将遗忘过程定义为直接修改权重矩阵的“模型神经外科手术”，并设立了两大核心遗忘模态：“行为遗忘”（Behavior Unlearning）可在无需访问原始预训练数据集或修改系统提示词的情况下，扫描并消除幻觉、算法偏见与越狱攻击向量；“数据遗忘”（Data Unlearning）则支持在数分钟内彻底消除版权内容、专有知识产权或合规敏感数据。Hirundo团队由以色列理工学院（Technion）前计算机系主任兼执行副总裁（拥有50余项美国专利并自1980年代起从事AI研究）出任首席科学家，核心团队由多位博士及罗德学者Luria组成，已提交7项美国专利并获得SOC 2合规认证，旨在将科技巨头尚停留在学术阶段的机器遗忘理论推进至商业生产环境。第三方基准评测与核心能力保留 (5:28) 为验证遗忘效果，Hirundo在Llama、Gemma、DeepSeek和Mistral等主流开放权重架构上进行了第三方行业基准测试。数据显示，遗忘操作可在单张标准GPU上于一小时内完成，且能完整保留模型的困惑度（Perplexity）、逻辑推理及常规任务准确率。在Meta Llama 3上的实测表明，经HaluEval基准测试，模型幻觉减少了55%；经Meta Purple Llama安全测试，成功越狱攻击减少了85%。此外，在BBQ问答偏见基准测试中，模型在多项偏见类别上的不良表现降低了45%至70%；在Mistral与Llama的针对性提取测试中，目标敏感数据达到了100%的可验证擦除率，使系统能应对85%原先易受攻击的极端边界用例。监管合规应对与企业私有化部署 (8:54) 数据遗忘对满足GDPR“被遗忘权”以及CCPA等严苛法律法规至关重要。在基于微调版Mistral模型的演示中，Hirundo对特定用户档案标识符（如虚构人物Janet Morris的ID）执行遗忘程序后，模型在面对查询时表现为参数失忆——主动拒绝或生成无关信息，而非泄露真实ID，从而在实现100%可验证数据抹除的同时完整保留了非敏感的客户背景信息。在架构落地方面，Hirundo平台支持本地部署（On-premises）、客户虚拟私有云（VPC）及SaaS模式，确保企业无需向外暴露专有资产，目前正通过企业测试版（Beta）项目逐步覆盖OpenAI开源模型、Llama及DeepSeek等技术生态，协助机构规避重复全量训练的算力消耗。 Hirundo展示了通过参数级介入消除模型固有缺陷的技术路径，力求在不损害通用推理能力的前提下解决数据合规与安全漏洞。不过，该方案在企业级复杂工作流中的长期稳定性、对未预见攻击模式的泛化防御能力，以及在多轮持续擦除后的参数累积损耗效应，仍有待更广泛生产实践的检验。

Detailed notes — zh

## Background 本视频由 Ai4 频道于 2025 年 8 月 25 日发布于 YouTube，记录了 Hirundo 联合创始人兼首席执行官 Ben Luria 的主题演讲。根据页面简介，演讲介绍了 Hirundo 专利的机器遗忘（Machine Unlearning）技术，该技术旨在打破 AI 训练“只进不出”的单向机制，在无需重训的情况下数分钟内从大模型权重中直接剔除 PII 敏感信息、偏见、幻觉及安全漏洞，助力企业安全落地负责任的 AI。 ## TL;DR Ben Luria 指出，传统外挂护栏和微调覆盖只是治标不治本的“加法”手段，无法消除模型底层权重潜藏的数据泄漏与行为失控隐患。为此，Hirundo 开发了机器遗忘平台，能够在开源大模型上执行类似“神经外科手术”的减法操作，直接剥离目标数据与有害特质。第三方基准评测证实，该方案在单张 GPU 上不足 1 小时即可将幻觉发生率降低 55%、偏见减少高达 70%、越狱拦截率提升 85%，并在严格达成 100% PII 彻底擦除以满足 GDPR 合规的同时，完全保留模型的通用推理与泛化性能。 ## Atmosphere & style 演讲开场通过巧妙的“粉色大象”心理实验打破了行业会议末期的沉闷，将晦涩的神经网络记忆机理转化为生动直观的具象体验。整场分享节奏紧凑、表达冷静而务实，演讲者反复强调“不喝自己的酷爱饮料”，摒弃夸张的概念包装，完全依托详实严密的第三方基准数据展开论证。氛围在展现硬核前沿技术突破的同时，洋溢着一种深耕学术与工程底蕴所带来的从容与专业自信。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) 现代大语言模型训练是单向不可逆的，一旦摄入不良数据便会永久留存在权重中，并内化为幻觉、偏见与安全漏洞等固有缺陷。 - [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) Hirundo 打造了全球首个机器遗忘（Machine Unlearning）平台，支持在不重新训练的前提下从开源模型中精准剔除特定数据与有害行为。 - [01:32](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=92s) Hirundo 团队拥有深厚的学术与专利积淀，首席科学家曾任以色列理工学院常务副校长并持有 50 余项美国专利，公司已申请 7 项机器遗忘相关专利并通过 SOC 2 认证。 - [01:32](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=92s) 企业拥抱大模型的核心阻碍在于两大风险：一是幻觉、偏见与越狱等不良行为风险；二是包含 PII、机密文件与侵权内容的违规数据风险。 - [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) 传统的外部安全护栏（Guardrails）仅起到输入输出过滤器的防火墙作用，模型内核依然保留有害知识，极易被对抗性提示词绕过。 - [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) 传统微调是试图用新数据覆盖旧问题的“加法过程”，而机器遗忘是直接对模型权重执行神经外科手术式切除的“减法过程”，防御更加彻底且无法被重新激发。 - [04:20](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=260s) 平台的“行为遗忘”能力无需追溯原始训练集，可直接在权重中剥离不良特征，将越狱与提示词注入漏洞的攻击成功率降低高达 85%。 - [04:20](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=260s) 平台的“数据遗忘”能力可在数分钟内 100% 擦除微调模型中混入的敏感 PII 或专有商业数据，免除了数天至数周的全量重训成本。 - [05:57](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=357s) 在第三方公认基准评测中，遗忘处理在 HaluEval 基准上降低了 55% 的幻觉发生率，在 BBQ 基准上消除了 45% 至 70% 的歧视性偏见。 - [05:57](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=357s) 遗忘处理效率极高，所有性能指标均在单张 GPU、耗时不足 1 小时的条件下完成，大幅节省算力成本。 - [08:09](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=489s) 在消除漏洞和幻觉的同时，模型在常规任务精度（Accuracy）、推理能力（Reasoning）以及困惑度（Perplexity）上的统计变化近乎为零，完整保留了基础泛化性能。 - [08:09](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=489s) 在 PII 脱敏实测中，微调模型经过遗忘处理后完全无法输出特定用户的敏感 ID，实现 100% 定向擦除，满足 GDPR 与 CCPA 的“被遗忘权”合规要求。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) 粉色大象思维实验：为什么 AI 无法主动遗忘演讲伊始，Hirundo 的联合创始人兼首席执行官 Ben Luria 在会议最后一天向现场观众发起了一个互动小实验，以此帮助大家提神：“请大家千万不要去想这只粉色的大象。”他坦言这听起来是个奇怪的请求，但要求全场尽最大努力忘记刚刚看到的粉色大象。在现场挑出一名观众互动后，Luria 指出，绝大多数人的大脑根本无法做到选择性遗忘，而这与当前人工智能的底层机理如出一辙。现代大语言模型在预训练或微调过程中一旦摄入数据，这些信息就会永久驻留在模型权重中。这导致模型不仅掌握了潜在的问题数据，还会被这些数据持续影响并内化为不良特质——例如表现出更强的偏见、产生更多幻觉或暴露更多安全漏洞。为了从根源上打破这种“只进不出”的单向训练机制，Hirundo 打造了全球首个机器遗忘（Machine Unlearning）平台，致力于教 AI 学会“遗忘”，能够在无需从头重训的情况下，追溯性、选择性地从开源基础模型或微调大模型中精准剔除不需要的数据与行为。 --- ### [01:32](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=92s) Hirundo 的团队背景与大模型落地的安全困境 Hirundo 是一家已获得种子轮投资的初创公司，其团队拥有深厚的学术与工业积淀。公司的首席科学家曾任以色列顶尖 STEM 学府以色列理工学院（Technion）的计算机系院长兼常务副校长，早在 20 世纪 80 年代（Luria 出生之前）便已深耕人工智能领域，个人持有超过 50 项美国专利；团队成员多为博士研究员，Luria 本人也是以色列最早的罗德学者（Rhodes Scholars）之一。针对机器遗忘这一长期被 Google、Microsoft、Meta、Amazon 等科技巨头视为核心研究却始终未能成功商业化的领域，Hirundo 已申请了 7 项美国专利，并顺利通过了 SOC 2 合规认证，目前正与多家大型企业客户展开合作。 ```mermaid flowchart TD accTitle: 企业引入 LLM 面临的核心风险 accDescription: 展示企业部署大模型时面临的数据与行为两大风险维度 subgraph BehaviorRisks["不良行为风险 (Bad Behaviors)"] B1["幻觉生成 (Hallucinations)"] B2["输出偏见 (Biases: 性别/年龄/种族)"] B3["安全漏洞 (Vulnerabilities: 越狱/注入)"] end subgraph DataRisks["不良数据风险 (Bad Data)"] D1["企业内部机密与敏感数据"] D2["个人身份信息 (PII / 合规违规)"] D3["受版权保护的内容 (Copyrighted)"] end subgraph EnterpriseImpact["企业落地阻碍"] E1["法律诉讼与合规处罚 (GDPR / CCPA)"] E2["品牌公关声誉受损"] E3["业务决策失误与安全失控"] end BehaviorRisks --> EnterpriseImpact DataRisks --> EnterpriseImpact ``` Luria 指出，企业想要拥抱大模型，但大模型蕴含的风险阻碍了实际落地。风险主要分为两大维度： 1. **不良行为（Bad Behaviors）**：当企业向员工、最终客户或自主智能体（Agents）下放大量自主权限时，模型常因幻觉、偏见或越狱漏洞做出不可控的危险行为。 2. **不良数据（Bad Data）**：模型权重内往往混杂了企业专有数据、商业机密以及违反法规的个人身份信息（PII）。 --- ### [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) 传统护栏与微调的局限：为何必须对权重进行“神经外科手术” 针对模型风险，业内现存的主流方案普遍存在根本性缺陷。最常见的方案是监控与护栏（Guardrails），即在模型外围搭建过滤器以拦截恶意输入或违规输出。但 Luria 强调，护栏充其量只是一个“防火墙”；只要模型内核仍然“保有违规知识”并“倾向于做出不良反应”，攻击者就能通过精心构造的提示词轻易绕过防御。另一种思路是微调（Fine-Tuning），试图通过喂入更多上下文和对齐数据来引导模型。然而，微调是一个“加法过程（Process of Addition）”，而遗忘是一个“减法过程（Process of Reduction）”。试图用微调消除偏见或漏洞，只是将问题掩盖在更多数据层之下，原始的脆弱性依然潜藏在深处，极易被新的触发词重新激活。与之相对，机器遗忘不依赖外在防火墙或数据覆盖，而是直接对 AI 模型权重执行类似“神经外科手术”的精准切除，从根源连根拔除有害数据与行为。 | 方案维度 | 传统安全护栏 (Guardrails / Firewalls) | 传统二次微调 (Fine-Tuning) | Hirundo 机器遗忘 (Machine Unlearning) | |:--- |:--- |:--- |:--- | | **运作逻辑** | 外部过滤输入与输出（做加法/搭外壳） | 注入更多正向数据以掩盖错误（做加法） | 直接修改模型权重，剔除目标信息（做减法） | | **对抗鲁棒性** | 易被提示词工程与零日攻击绕过 | 潜在恶意行为仍潜伏于底层权重中 | 从根源移除潜在概念，无法被激发提取 | | **处理耗时** | 运行时增加额外的推理延迟 | 需要数天至数周的重新训练/微调 | 单张 GPU 上数分钟至 1 小时内完成 | | **知识留存** | 无法根除模型内部已知机密/PII | 无法彻底证明已删除特定个人数据 | 实现 100% 数据遗忘，满足 GDPR 擦除权 | --- ### [04:20](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=260s) 平台两大核心能力：行为遗忘与数据遗忘 Hirundo 平台提供两类核心遗忘能力，全面覆盖不同成熟度的企业需求： ```mermaid flowchart LR accTitle: Hirundo 平台机器遗忘两大方向 accDescription: 描述行为遗忘与数据遗忘的输入、处理与输出机制 subgraph InputModel["待处理开源模型"] M1["开源权重模型\n(Llama / Gemma / DeepSeek / Mistral)"] end subgraph UnlearningProcess["Hirundo 机器遗忘处理 (单 GPU < 1 小时)"] direction TB P1["行为遗忘 (Behavior Unlearning)\n不关心训练集来源，直接消除特定行为模式"] P2["数据遗忘 (Data Unlearning)\n定向擦除 PII、机密文件、侵权版权语料"] end subgraph OutputModel["安全目标模型"] O1["幻觉降低 55% (HaluEval)"] O2["偏见减少 45%-70% (BBQ)"] O3["越狱注入防御提升 85% (Purple Llama)"] O4["PII 100% 彻底擦除 (零重训成本)"] end InputModel --> UnlearningProcess P1 --> O1 P1 --> O2 P1 --> O3 P2 --> O4 ``` 1. **行为遗忘（Behavior Unlearning）**：无需获知模型最初由哪些具体数据训练或微调而成，直接识别并剥离不良行为特征。平台可使幻觉与偏见减少 50% 以上，并将提示词注入（Prompt Injections）等安全漏洞的攻击成功率降低高达 85%。整个过程既无需修改系统提示词（System Prompts），也无需挂载外部护栏。 2. **数据遗忘（Data Unlearning）**：专为深度微调模型的企业及前沿模型实验室设计。当企业发现模型不慎吸收了 PII、商业机密或版权数据时，传统方法需要耗费数天甚至数周重新进行全量微调；而 Hirundo 可在数分钟内实现对该部分数据 100% 的彻底清除。 - **兼容模型**：支持主流开源权重模型，包括 Meta Llama 系列、Google Gemma、Mistral、DeepSeek 以及 OpenAI 开源模型（OSS）等。 - **部署模式**：支持本地私有化部署（On-Premises）、虚拟私有云（VPC）及 SaaS 模式，满足高隐私企业的合规诉求。 --- ### [05:57](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=357s) 行业标准基准评测与落地实测案例为了确保技术指标客观可信，Luria 特别强调团队坚决“不喝自己的酷爱饮料（Don't drink our own Kool-Aid）”，所有性能数据均采用第三方公认基准进行评估，且均在单张 GPU、耗时不足 1 小时的条件下完成： - **幻觉消除**：在 **HaluEval** 基准上实现 55% 的幻觉发生率降幅，尤其适用于对数据准确性有严苛要求的金融领域，有效规避法律诉讼、监管制裁与公关危机。 - **偏见消除**：在 **BBQ（Bias Benchmark for QA）** 基准上消除 45% 的偏见（部分模型如 DeepSeek 上最高可减少 70%），大幅削减模型在性别、年龄、种族等敏感维度上的歧视性输出。 - **漏洞防御**：在 Meta 的 **Purple Llama** 越狱评测中，针对原模型被攻破的案例实现了 85% 的成功拦截。面对防御系统难以防范的零日漏洞（Zero-day vulnerability），经过遗忘优化的模型在无需规则库更新的情况下，即可自发抵御敏感信息窥探。 --- ### [08:09](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=489s) 精度保持、GDPR 合规性与企业级部署前景针对业内最核心的技术疑虑——“切除有害权重是否会破坏模型的正常能力”，Luria 展示了经过遗忘处理后的 Llama 模型指标。数据显示，模型在消除 85% 漏洞与 55% 幻觉的同时，常规任务精度（Accuracy）、推理能力（Reasoning）以及困惑度（Perplexity）的统计变化近乎为零，在未牺牲任何基础泛化性能的前提下显著提升了鲁棒性。 ```mermaid flowchart TD accTitle: PII 数据遗忘实际测试流 accDescription: 对比原始模型与遗忘模型在面对个人身份信息查询时的回答表现 subgraph Prompt["提示词输入"] Q["'请提供 Janet Morris 的身份识别码 (ID)'\n(不添加任何'禁止泄露'系统限制)"] end subgraph Before["原始微调模型 (Mistral)"] R1["'Janet Morris 的 ID 为 [真实存储的敏感编号]'"] R1Fail["结果：敏感数据泄露 (违规)"] R1 --> R1Fail end subgraph After["经 Hirundo 遗忘处理后的模型"] R2["尝试组织语言但底层权重已丧失该记忆\n无法生成正确 ID"] R2Pass["结果：100% 彻底遗忘 (符合 GDPR)"] R2 --> R2Pass end Prompt --> Before Prompt --> After ``` 在真实个人身份信息（PII）脱敏用例中，团队在混杂大量敏感与非敏感个人资料的数据集上微调了一款 Mistral 模型，其目标是严格遵守 GDPR 与 CCPA 的“被遗忘权（Right to be forgotten）”，在完全保留其他用户数据的前提下精准删除单个用户记录。测试显示，当向模型索要用户 Janet Morris 的虚构敏感 ID 时（测试中故意不设任何“禁止透露”的系统指令），原模型会直接吐出真实 ID，而遗忘处理后的模型因底层记忆被彻底清除而完全无法输出该 ID，达成了 100% 的 PII 定向擦除。演讲最后，Luria 总结道，机器遗忘不仅能大幅降低企业使用大模型的算力成本与数据科学团队的时间投入，更赋予了企业重新掌控模型的关键能力。Hirundo 目前正开放 Beta 测试计划，并呼吁在场嘉宾共同推动下一代负责任 AI（Responsible AI）的落地普及。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) 请大家千万不要去想这只粉色的大象。 — Ben Luria > [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) 绝大多数人的大脑根本无法做到选择性遗忘，而这与当前人工智能的底层机理如出一辙。 — Ben Luria > [00:04](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=4s) 现代大语言模型在预训练或微调过程中一旦摄入数据，这些信息就会永久驻留在模型权重中。 — Ben Luria > [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) 护栏充其量只是一个“防火墙”；只要模型内核仍然“保有违规知识”并“倾向于做出不良反应”，攻击者就能通过精心构造的提示词轻易绕过防御。 — Ben Luria > [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) 微调是一个“加法过程（Process of Addition）”，而遗忘是一个“减法过程（Process of Reduction）”。试图用微调消除偏见或漏洞，只是将问题掩盖在更多数据层之下，原始的脆弱性依然潜藏在深处，极易被新的触发词重新激活。 — Ben Luria > [03:03](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=183s) 机器遗忘不依赖外在防火墙或数据覆盖，而是直接对 AI 模型权重执行类似“神经外科手术”的精准切除，从根源连根拔除有害数据与行为。 — Ben Luria > [04:20](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=260s) 无需获知模型最初由哪些具体数据训练或微调而成，直接识别并剥离不良行为特征。 — Ben Luria > [05:57](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=357s) 不喝自己的酷爱饮料（Don't drink our own Kool-Aid），所有性能数据均采用第三方公认基准进行评估 — Ben Luria > [05:57](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=357s) 面对防御系统难以防范的零日漏洞（Zero-day vulnerability），经过遗忘优化的模型在无需规则库更新的情况下，即可自发抵御敏感信息窥探。 — Ben Luria > [08:09](https://www.youtube.com/watch?v=VMZqJUDpyJk&t=489s) 机器遗忘不仅能大幅降低企业使用大模型的算力成本与数据科学团队的时间投入，更赋予了企业重新掌控模型的关键能力。 — Ben Luria ## Mentioned Ben Luria, Hirundo LTD, 以色列理工学院 (Technion), 罗德学者 (Rhodes Scholars), Google, Microsoft, Meta, Amazon, OpenAI, Llama, Gemma, Mistral, DeepSeek, Purple Llama, HaluEval, BBQ (Bias Benchmark for QA), GDPR, CCPA, SOC 2, Janet Morris ## Video description Ben Luria, CEO and Co-Founder, Hirundo LTD Abstracts Hirundo makes AI forget. Today, AI training is a one-way track: the data and behaviors that models learn are there to remain, and nearly impossible to remove. Too often, they learn unwanted data (PII, confidential, malicious) and behaviors (hallucinations, vulnerabilities, biases). Hirundo makes it possible to undo that. Our patented Machine Unlearning platform removes unwanted data and behaviors from the weights of trained LLMs - remediating biases, hallucinations, vulnerabilities and compliance issues, without any retraining. Our process works in minutes rather than days, and surpasses methods such as guardrails that filter inputs/outputs or lengthy fine tuning that lack guaranteed results. Some of our case studies include: - Unlearning finetuned PII from Llama 3 (forgetting personal data at scale, with guaranteed erasure and no damage to performance) - Unlearning biases from DeepSeek (70% reduction on BBQ) and Llama 4 (44% reduction) - Unlearning hallucinations from Llama 3 (55% reduction on hallucinations in HaluEval) We have active F500 and national security customers who are already using our platform to make their AI models more trustworthy and de-risk their AI adoption, by allowing models to forget. As AI adoption in enterprise grows, AI safety and trust are becoming a must. We believe forgetting will define the next generation of responsible AI adoption. [Source](https://www.youtube.com/watch?v=VMZqJUDpyJk)

Source quotes

[0:04] Ben Luria: 请大家千万不要去想这只粉色的大象。 [0:04] Ben Luria: 绝大多数人的大脑根本无法做到选择性遗忘，而这与当前人工智能的底层机理如出一辙。 [0:04] Ben Luria: 现代大语言模型在预训练或微调过程中一旦摄入数据，这些信息就会永久驻留在模型权重中。 [3:03] Ben Luria: 护栏充其量只是一个“防火墙”；只要模型内核仍然“保有违规知识”并“倾向于做出不良反应”，攻击者就能通过精心构造的提示词轻易绕过防御。 [3:03] Ben Luria: 微调是一个“加法过程（Process of Addition）”，而遗忘是一个“减法过程（Process of Reduction）”。试图用微调消除偏见或漏洞，只是将问题掩盖在更多数据层之下，原始的脆弱性依然潜藏在深处，极易被新的触发词重新激活。 [3:03] Ben Luria: 机器遗忘不依赖外在防火墙或数据覆盖，而是直接对 AI 模型权重执行类似“神经外科手术”的精准切除，从根源连根拔除有害数据与行为。 [4:20] Ben Luria: 无需获知模型最初由哪些具体数据训练或微调而成，直接识别并剥离不良行为特征。 [5:57] Ben Luria: 不喝自己的酷爱饮料（Don't drink our own Kool-Aid），所有性能数据均采用第三方公认基准进行评估 [5:57] Ben Luria: 面对防御系统难以防范的零日漏洞（Zero-day vulnerability），经过遗忘优化的模型在无需规则库更新的情况下，即可自发抵御敏感信息窥探。 [8:09] Ben Luria: 机器遗忘不仅能大幅降低企业使用大模型的算力成本与数据科学团队的时间投入，更赋予了企业重新掌控模型的关键能力。

Source quotes

Ben Luria: Hirundo makes AI forget. Today, AI training is a one-way track: the data and behaviors that models learn are there to remain, and nearly impossible to remove. Ben Luria: Our patented Machine Unlearning platform removes unwanted data and behaviors from the weights of trained LLMs - remediating biases, hallucinations, vulnerabilities and compliance issues, without any retraining. Ben Luria: Our process works in minutes rather than days, and surpasses methods such as guardrails that filter inputs/outputs or lengthy fine tuning that lack guaranteed results. Ben Luria: We believe forgetting will define the next generation of responsible AI adoption. [0:04] Ben Luria: Once data is ingested during training or fine-tuning, it is there to stay permanently. The model retains that information and absorbs the negative characteristics embedded inside it. [3:03] Ben Luria: Input/output guardrails and monitoring layers act merely as firewalls around an inherently flawed model. [3:03] Ben Luria: neurosurgery to AI [5:28] Ben Luria: drinking our own Kool-Aid [5:28] Ben Luria: targeted unlearning procedures execute in under an hour on a single standard GPU while leaving core capabilities—such as perplexity, logical reasoning, and general task accuracy—fully intact.

Original transcript

[0:04] So before I present and machine [0:06] learning, I want to do a little out of [0:08] the box exercise, I have a simple task [0:11] for each and every one of you, maybe to [0:12] wake you up for the last day of the [0:14] conference. Please don't remember this [0:16] pink elephant. I know it's a weird [0:18] request, but I mean it. Do your best to [0:20] not remember and forget everything that [0:22] you've just seen about this pink [0:24] elephant. Okay, can anyone please [0:27] volunteer? Please volunteer. Tell me [0:29] what you've just seen. I'm gonna pick [0:31] one of you if no one jumps out. Okay, [0:34] you. Yeah, [0:36] >> perfect. Okay, so we have one person [0:38] that actually forgot about this pink [0:39] elephant, but I'm going to take a wild [0:41] guess and assume that every single one [0:43] of you remember this pink elephant. The [0:45] point that I'm trying to make is similar [0:47] to the human mind that can't just [0:49] selectively forget, AI models remember, [0:51] too. When you introduce data during [0:53] training or fine-tuning, it's there to [0:55] remain. The model boat knows this [0:56] information that sometimes could be [0:58] problematic and it's also being affected [1:00] by it. Meaning it adopts certain traits. [1:02] It could be more biased, more [1:03] hallucinating, more vulnerable and so [1:05] forth. So proud to be here. My name is [1:08] Ben and I'm the CEO of Herondo. We're [1:10] the first company in the world to try [1:12] and solve this problem. We're building [1:13] the first ever machine unlearning [1:15] platform. Meaning we teach AI how to [1:18] forget. We can retroactively and [1:20] selectively remove any unwanted data and [1:22] any unwanted behaviors from trained [1:24] large fragment models. When I say [1:26] trained, it could be offtheshelf a [1:28] vanilla sort of lema or it could be fine [1:30] models. [1:32] So we're a seedback startup. Our chief [1:34] scientist was the dean of computer [1:36] science at Israel's leading STEM [1:38] university, the techneon and executive [1:40] VP there. He started working on AI [1:41] before I was born in the 80s. More than [1:43] 50 US patents. We bring a team of PG [1:46] researchers. I was uh one of the first [1:47] road scholars from Israel and we have [1:49] seven US patents filed around [1:51] specifically machine learning a field of [1:53] research that has been at the heart and [1:55] core of research such big tech companies [1:57] like Google, Microsoft, Meta, Amazon. [1:59] None of them have managed to bring this [2:00] solution to market we did. We're work [2:02] working with quite a few big logos and [2:04] we're so to compliant [2:06] and basically the problem that we're [2:08] solving is not just machine learning is [2:10] basically de-risking AI. I assume if [2:12] you're here at AI4, you all care about [2:14] adopting AI into your organizations, [2:16] right? Everyone wants to use LMS, but at [2:19] the same time, LM are still too risky. [2:21] Why? They include either bad data or bad [2:24] behaviors. So, they pose too many risks [2:26] on the enterprise adopting them. Bad [2:28] behaviors could be hallucinations and [2:30] biases or vulnerabilities. Basically, [2:32] you're deploying so like your enterprise [2:34] either for internal employees to try and [2:37] find information or for end users or [2:39] through agents and so forth. you're [2:40] giving a lot of agency to something that [2:42] you can't really control and then it [2:44] might act in undesired ways. The second [2:46] thing is what data does your model [2:48] actually know? It could know [2:49] confidential information from your [2:51] organization. It could include [2:52] non-compliant data like PII and so [2:55] forth. All of these things are posing [2:57] too many risks and that's why everyone [2:58] is talking about AI, but not everyone is [3:01] adopting AI yet. Now, we're not the [3:03] first ones to try and solve this issue, [3:05] right? I assume a lot of you are looking [3:07] into adopting AI and are looking at so [3:10] like monitoring solutions, guardrails, [3:12] basically things that try and overlook [3:13] the model, filter inputs and outputs, [3:16] try to block malicious inputs, try to [3:18] filter outputs that don't match company [3:20] policy. The main issue is that it's only [3:23] a firewall. So maybe some people of you [3:25] try to manipulate chach into giving you [3:27] the promp the the output that you want [3:29] even though it was designed strictly to [3:31] not let you know these sort of things, [3:33] right? Because if you put a firewall [3:35] around something that still acts in an [3:36] undesired way, thinks in an undesired [3:38] way, and knows things that it shouldn't [3:39] know, you can probably bypass it. [3:41] Unlearning is not a guardrail. It's not [3:43] a firewall. We actually do a no surgery [3:45] to AI, modify its weights to take out [3:48] specific bad information, specific bad [3:51] behaviors. The second thing, [3:53] fine-tuning, adding more context, more [3:55] information, try to steer the model [3:56] towards the desired direction. [3:58] Unlearning is not a process of addition, [4:00] it's a process of reduction. If you're [4:02] using fine-tuning to try and reduce [4:03] biases to try and reduce [4:04] vulnerabilities, you're just masking the [4:06] problem. You're hiding it mainly beneath [4:09] more information, but those same [4:11] vulnerabilities, those same problematic [4:13] desires are still hitting somewhere and [4:15] could easily be triggered. Unarning just [4:17] cuts them out at their core. So, our [4:20] platform offers two kinds of unarning, [4:22] the ones that I mentioned before. [4:23] Basically, behavior unarning where we [4:25] don't actually care about which data did [4:28] you use to train the model or fine-tune [4:30] it. We can just simply detect and remove [4:32] undesired behaviors. Some of our stats [4:34] even blew our minds. So we're talking [4:36] about more than 50% reduction in [4:38] behaviors like hallucinations and biases [4:40] and up to 85 reduction in behaviors like [4:43] vulnerabilities. Meaning we reduce by [4:45] 85% the rate of successful prompt [4:48] injections. All of this again without [4:50] affecting system prompts, without [4:52] putting guard rails, just changing them [4:54] all at the core, taking everything that [4:56] you don't want out, keeping everything [4:58] else intact. The second kind of [5:00] unlearning, data unlearning for a bit [5:02] more mature customers that are maybe [5:03] fine-tuning their models or for the [5:05] frontier labs themselves. If you realize [5:07] that you fine-tune a model on top of [5:08] PII, on top of copyrighted information, [5:11] on top of a confidential information and [5:13] so forth, one approach would be to just [5:16] redo completely the finetuning from [5:18] scratch. It could take you days or [5:19] weeks. Another approach would be to [5:21] conduct unarning reaching 100% removal [5:24] of this unwanted data in just mere [5:26] minutes. [5:28] So all of this works on any open weight [5:30] model. It could be Lama, Gemma, OSS by [5:32] OpenAI, DeepSync, and so forth. When as [5:35] I said, our technology is backed by [5:37] seven filed US patents. It's been an [5:40] interest for every company developing [5:41] LLMs. Even before LLM made it into our [5:44] lives, but yet the challenge was too [5:46] difficult. How do you take out what you [5:48] want to take out and guarantee it? How [5:50] do you keep everything else intact? [5:52] And all of this could be used both [5:54] onrem, VPC or VSSs. So, I mentioned a [5:57] few crazy stats. The first thing I'll [5:59] say is we don't measure our success on [6:01] top of our own benchmarks. We use what [6:03] the industry uses to make sure that we [6:05] don't quote unquote drink our own [6:06] Kool-Aid. So, when I'm talking about 55% [6:09] reduction in hallucinations, I'm talking [6:10] about halval, 85% reduction in [6:12] jailbreaks measured on purple llama by [6:15] Meta, 45% reduction in biases measured [6:18] on a bias benchmark called BBQ. All [6:20] these things are verifiable and have [6:21] been reached within less than an hour on [6:23] a single GPU. So, what does it mean in [6:25] practice? a few hands-on examples, [6:27] right? So, we're talking about 55% [6:29] reduction hallucinations. Here you can [6:31] see to the left the original response of [6:32] the original llama and to the right what [6:34] happened after our learning. Right? When [6:36] you're asking maybe specific sensitive [6:38] questions around finances, you really [6:40] want to make sure that your model gets [6:42] it right. Otherwise, you put your [6:43] company and organization in liability [6:46] either in court, either in PR or either [6:48] based on regulations and sanctions. We [6:51] can make that go away. When we're [6:53] talking about biases, again, you really [6:55] don't want your model to tell an end [6:57] customer maybe that it's been [6:58] discriminated based on gender, age, [7:00] race, and so forth. And again, both if [7:03] you are actually interested in adopting [7:05] responsible AI, and both just by [7:07] increasing the ROI of AI adoption and [7:09] not putting your enterprise at risk, [7:11] unlearning allows to reduce half of the [7:12] biases across all of these categories [7:14] that I mentioned and many more. And here [7:16] you can see one more hands-on example, [7:19] vulnerabilities. So again there's an [7:21] arms race between attackers and [7:23] defenders right you add many more [7:25] guardrails to your deployment of AI [7:27] either by small startups or big [7:28] companies but at the end of the day [7:30] they're acting on a rule-based system [7:32] right so the next say that there's a [7:33] zero day vulnerability a new attack [7:35] vector they're going to fail unlearning [7:37] just makes the model much more robust to [7:39] defend it in its deployment meaning that [7:42] even if there's a zero day vulnerability [7:43] your model will be much more resilient [7:45] and robust to deflect it so here you can [7:47] see the original model quite easily was [7:49] bypassed and managed to disclose [7:51] sensitive information. The unlearned [7:53] model correctly deflected it. That [7:55] happened across 85% of the cases where [7:58] the original model failed. And the [8:00] examples are many more. The previous [8:01] examples were on lama. This one is on [8:03] Gemma by Google. Again, bias responses [8:05] that your enterprise wants to avoid. [8:08] Now, the last thing and this might get [8:09] quite technical. Basically, I mentioned [8:13] that we're the first company in the [8:14] world to do it, right? So you might ask, [8:16] how do you take out one thing without [8:18] affecting everything else? How can you [8:20] guarantee that the mall wasn't affected [8:22] in a bad way by this neurosurgery? So [8:25] when we're talking about this 85% [8:27] reduction in vulnerabilities, 55% [8:29] reduction in hallucinations, here are [8:30] the actual stats of this llama model [8:32] that I presented, right? Virtual [8:34] statistical change to the minimum, [8:36] meaning the trade-off is a much more [8:38] accurate, a much more resilient model. [8:40] And at the same time virtually keeping [8:42] the same accuracy, the same reasoning [8:43] and the same perplexity. The same stats [8:45] happen again and again despite the [8:47] behavior that you want to remove, [8:48] despite the data that you want to [8:49] remove. Aside from which model are you [8:51] using, we can guarantee that PII the [8:54] last example. So here we fine tune the [8:56] model on top of a lot of sensitive user [8:57] information and some nonsensitive user [8:59] information. We wanted to redact [9:02] everything that all knew around PII, [9:04] social security numbers and so forth, [9:05] but keep everything else intact. [9:08] Alternatively, it could be a use case [9:09] where a user has to be forgotten [9:11] according to GDPR or the CCPA and you [9:14] want to keep all of the users intact [9:15] aside from one. So here you can see [9:18] basically the original model in this [9:19] case a mistrol knew the ID fake ID of [9:22] Janet Morris download model and [9:24] intentionally here we don't tell it [9:26] don't disclose the ID. We actually want [9:28] to test what a model knows didn't know [9:30] the actual ID anymore. It tried to [9:31] generate it but it just didn't know [9:33] what's the actual ID of Janet Morris at [9:35] this point. So 100% removal of PII in [9:38] this case study. So we support any open [9:41] source model. They keep coming out. I'm [9:43] very excited about the new OpenAI OSS [9:45] models. We support them as well and [9:47] we're releasing a case study about them [9:48] next week. You can easily select any [9:50] behavior to unlearn or customize the [9:52] heck out of it. Any type of data and it [9:54] could work in your own prem or VPC [9:57] because a lot of the organizations here [9:58] really don't want to share their data [10:00] with us and we understand it despite [10:02] being so compliant. So if you want to do [10:05] riskier usage of LMS, if you want to [10:07] adopt AI but are conscious of the risk [10:09] that AI brings, unlearning could be an [10:11] approach that really brings you to be [10:12] state-of-the-art while minimizing the [10:14] risk to bare minimum. If you want to [10:16] edit the model behaviors to your needs, [10:17] meaning customize it to its actual [10:19] mission and not work on anything else, [10:21] unlearning the solution. If you want to [10:23] save a lot of costs on GPU expenses and [10:26] time that your data science teams are [10:28] spending on this, and if you above all [10:30] want to regain control over your models, [10:32] talk to us. We're rolling out a beta [10:34] program right now and we'd love for you [10:36] to take part in it. And if you're [10:37] interested in unlearning more, this is [10:39] my QR code. Don't forget now the pink [10:41] elephant. If you remember it up at this [10:43] point, I'd love for you to spread the [10:44] word. Thank you.