Source-linked AI summary
Forgotten in Weights, Recovered by Tools: Agentic Tool Unlearning for LLM Agents
Baicheng Chen, Zheyuan Liu, Jingyu Zhang, Kaize Ding, Ningshan Ma, Yue Huang, Meng Jiang
TL;DR
The paper addresses the gap between parametric unlearning and tool-augmented deployment, where agents can recover forgotten knowledge through external observations. It proposes ATU, combining parametric unlearning with trajectory-level training, and finds reduced target leakage with retained utility across RWKU and MUSE. ATU nevertheless has incomplete recovery-gap closure and limited coverage of downstream tool environments.
Problem
Tool-mediated recovery lets tool-augmented agents recover forgotten knowledge after standard parametric unlearning, so unlearning must address agent deployment while preserving retained tool use.
Method
ATU combines parametric knowledge unlearning with trajectory-level reinforcement learning in simulated tool-augmented environments.
Results
ATU consistently reduces recovered forget-set scores under agent deployment while preserving retained utility and general tool-use ability across RWKU and MUSE.
Takeaways & Limitations
Robust unlearning for downstream agents requires suppressing both direct recall and tool-mediated recovery rather than disabling tools.
Takeaways & Limitations
ATU may not fully generalize to unseen environments with different tools, richer evidence, longer documents, or adversarial observations.
Abstract
from arXiv · showhide
Large language models (LLMs) are increasingly deployed as tool-augmented agents, where responses can depend on tool calls and external observations rather than model parameters alone. This creates an evaluation mismatch for LLM unlearning: previous unlearning methods may suppress direct parametric recall, but an agent can still recover the same forget target through tools such as web search, retrieval, or database lookup. We identify this failure mode as tool-mediated recovery and study agentic tool unlearning, which aims to reduce both parametric recall and tool-mediated recovery while preserving normal tool use for retained knowledge. To address this challenge, we propose Agentic Tool Unlearning (ATU), a two-stage framework. The first stage applies parametric knowledge unlearning to suppress direct recall, while the second stage performs trajectory-level reinforcement learning in simulated tool-augmented environments to penalize target-seeking tool behavior and final-answer leakage. Experiments on RWKU and MUSE across different LLM architectures show that ATU achieves a better balance between target forgetting and retained utility, making unlearning more robust under tool-augmented agent deployment.
1 Introduction
Tool-augmented agents expand LLM behavior beyond parametric recall, creating tool-mediated recovery of forgotten knowledge. ATU addresses this mismatch by combining parametric unlearning with trajectory-level agentic training while preserving retained tool use.
- Motivation: An agent’s answer can depend on tool selection, execution, observation reading, and final-response generation, not model parameters alone.
- Motivation: Tool-mediated recovery occurs when an agent reconstructs forgotten knowledge through external tool observations despite parametric unlearning.The target may be recovered through web search or retrieval rather than recalled from model weights.
- Contribution: ATU targets both direct recall and tool-mediated recovery while maintaining normal tool use for retained knowledge.
- Approach: The paper proposes ATU, whose first stage suppresses direct recall and whose second stage trains against target-seeking tool behavior and final-answer leakage.
2 Related Work
Prior LLM-agent safety and unlearning research addresses interactive-agent risks and diverse forget targets, but existing unlearning methods mainly assess standalone model behavior.
- LLM Agent Safety: Agent safety research covers risks including prompt injection, failure propagation, and other failures arising from multi-step interaction trajectories.
- LLM Unlearning: LLM unlearning studies targets such as private data, copyrighted content, hazardous knowledge, and broader concepts using several optimization approaches.
- LLM Unlearning: Existing unlearning methods mainly evaluate whether models recall or reproduce targets under standalone inference.
3 Motivation
Standalone unlearning can make forgotten knowledge appear suppressed while tool-augmented deployment reopens a recovery channel. This motivates evaluating and mitigating leakage at the agent level.
- Quantitative Motivation: Under standalone inference, NPO lowers the MUSE (Books) forget-set score from 37.9 to 9.7 and the RWKU score from 57.7 to 44.6.
- Quantitative Motivation: 29.8 and 68.6 are the corresponding tool-augmented-agent scores, showing recovery after tools become available.These values correspond to MUSE (Books) and RWKU, respectively.
- Recovery Mechanism: Tool use lets an agent call a tool, read its observation, and reproduce recovered information in the final response.
- Implication: Agentic unlearning must address tool-mediated recovery as well as parametric recall because direct-output evaluation can overestimate robustness.
4 Preliminary
The threat model considers provider-side unlearning followed by adversary-controlled tool deployment. The formalization measures leakage in the final response while preserving retain-query utility.
- Threat Model: A provider releases an unlearned model, while a downstream deployer controls prompts and tools to recover the forgotten target.
- Problem Formulation: The forget set contains target-specific facts, while same-domain and cross-domain retain sets preserve related knowledge and broad capabilities.
- Problem Formulation: A trajectory consists of the query, alternating actions and observations, and the final response y.
- Objective: Leakage is measured from y, and the learned policy minimizes target leakage while preserving retain-query utility.
5 Method
ATU combines parametric unlearning with trajectory-level reinforcement learning in simulated tool environments. Its rewards suppress target recovery and leakage on forget queries while preserving useful responses and benign tool use.
- Stage 1: Parametric Unlearning: ATU uses Stage 1 parametric unlearning to suppress direct recall while retaining performance on retained knowledge.
- Stage 2: Agentic Tool Unlearning: Stage 2 trains the Stage 1 model in simulated tool-augmented environments to mitigate target-recovery behavior during interaction.
- Reward Design: Trajectory-level rewards penalize intermediate tool-mediated recovery attempts and final-answer leakage on forget queries.
- Reward Design: Retain-query rewards encourage correct, helpful answers and penalize over-refusal, preserving nearby knowledge, general utility, and tool-use ability.
- Online RL Objective: GRPO samples multiple trajectories and updates the policy with a clipped objective and KL penalty that keeps it close to the Stage 1 model.
6 Experiments
The experiments evaluate ATU across unlearning benchmarks, deployment settings, methods, and utility measures. On RWKU, Stage 1 recovery worsens under agent deployment, whereas Stage 2 reduces recovery while retaining utility.
- Experimental Setup: The study evaluates ATU on RWKU and MUSE using Qwen3-4B and Qwen-2.5-7B across standalone and tool-augmented deployments.
- Experimental Setup: RWKU measures forget-set ROUGE-L recall across FB, QA, AA, and weighted-average All, alongside neighboring-knowledge and utility metrics.
- Main Results: 57.7 → 74.6: the base model’s RWKU All forget score rises under agent deployment, and every Stage 1 method shows the same recovery pattern.
- Main Results: 21.1 points: NPO + Stage 2 lowers RWKU All from 68.6 to 47.5 under agent deployment, the largest reduction among reported methods.
- Main Results: Stage 2 maintains comparable neighboring-knowledge scores and reasonable factuality and fluency, indicating reduced target recovery without broad response suppression.
7 Discussion
ATU preserves general utility and benign tool use while reducing recovery across benchmarks and models. Stage 2 also changes forget-query behavior by decreasing target-seeking tool calls rather than disabling tools globally.
- Unlearning vs. Utility: Stage 2 models generally remain close to Stage 1 across five RWKU utility dimensions, with method-specific strengths in reasoning, factuality, and fluency.
- Unlearning vs. Utility: Stage 2 preserves high contains-match rates on target-independent retain tasks across Stage 1 initializations.
- Cross-Benchmark and Cross-Model Generality: Agentic recovery increases forget-set scores after Stage 1 on both RWKU and MUSE, showing the pattern is not specific to one benchmark or backbone.
- Cross-Benchmark and Cross-Model Generality: On MUSE (Books), knowmem_f falls from 29.8 to 15.8 on Qwen-3-4B and from 32.9 to 22.4 on Qwen-2.5-7B, while retain scores remain comparable.
- Tool-Use Behavior: Stage 1 generally increases forget-query tool use, while Stage 2 decreases it across methods by reducing target-seeking calls.
8 Conclusion
The paper defines tool-mediated recovery as forgotten-knowledge recovery through external tools and proposes ATU to address it. Experiments on RWKU and MUSE report reduced target leakage while preserving retained utility and general tool use.
- Conclusion: ATU addresses tool-mediated recovery with two stages that suppress direct recall and tool-mediated recovery while preserving retain-side utility and general tool-use ability.
Limitations
ATU reduces tool-mediated recovery but does not always close the gap to standalone forgetting, and its learned policy may not generalize across downstream tool environments. The paper therefore identifies deployment diversity and independent downstream configuration as practical boundaries for reliable unlearning.
- Incomplete closure of the agentic recovery gap: ATU does not always restore the forget-set score to the standalone Stage 1 level, leaving a residual agentic recovery gap.The gap is harder when tool observations are explicit, ambiguous, or outside the simulated training distribution.
- Limited coverage of downstream tool environments: Stage 2 training uses simulated environments with a finite set of retrieval and utility tools, limiting coverage of real downstream deployments.Unseen agents may use different APIs, retrieval sources, memory systems, multi-agent workflows, richer evidence, longer documents, or adversarially formatted observations.
- Threat model: The threat model assumes the model provider cannot control prompts, tools, or external data sources selected independently by a downstream deployer after release.This makes post-release tool configuration part of the deployment boundary for unlearning guarantees.
- Source attribution boundary: Source attribution does not satisfy target-level non-disclosure requirements when the final response still exposes restricted content.The paper distinguishes provenance from removal or non-disclosure of the target itself.
C.3 Metrics
The section defines forget, retain, aggregation, and tool-use metrics, then describes Stage-1 unlearning baselines and their implementation settings. Metrics distinguish reduced target recovery from preserved utility and quantify tool-mediated recovery.
- Forget-set metrics: RWKU measures forgetting with ROUGE-L recall on fill-in-the-blank, question-answering, and adversarial-attack probes.The three probe types target completion, direct factual recall, and adversarial elicitation.
- Aggregate forgetting score: The target-level All score is an instance-weighted average across RWKU’s three forget-probe types, with macro-averaging across targets.Macro-averaging gives equal weight to each target while accounting for different probe counts.
- Retain-side and MUSE metrics: Retain evaluation covers RWKU locality and general utility, while MUSE reports forget-side knowmem_f and retain-side knowmem_r.Lower forget-side scores indicate better forgetting, whereas higher retain-side scores indicate better utility preservation.
- Agent metrics: ToolUseF measures the frequency of external-tool invocation on forget queries, where lower values indicate fewer target-seeking tool calls.The metric counts whether an agent trajectory contains an action from the available tool set.
D.1 RWKU Results on Qwen-2.5-7B
On Qwen-2.5-7B, tool-augmented deployment restores forgotten knowledge after Stage 1 unlearning, while Stage 2 substantially reduces this recovery and largely preserves retain-side utility. The results extend across probes, tool replacements, evaluation settings, and training comparisons, while exposing robustness and cost boundaries.
- Deployment-level recovery: Agent deployment raises the NPO-unlearned Qwen-2.5-7B All score from 35.1 to 61.7, a ∆All of +26.6.The base model’s All score also increases from 49.3 under standalone inference to 67.6 with an agent.
- Stage 2 mitigation: NPO + Stage 2 lowers the agent-deployment All score from 61.7 to 41.5, a 20.2-point reduction over the Stage 1 NPO agent.Reductions occur across FB, QA, and AA probes: 57.7→15.0, 50.0→37.2, and 66.1→49.8.
- Retained utility: Stage 2 preserves reasonable retain-side utility, with Neighbor (All) at 71.1 and NPO + Stage 2 factuality and fluency scores of 42.3 and 665.7.Neighbor decreases from 77.2 under Stage 1 agent deployment but remains above standalone NPO’s 64.1.
- Tool-set generalization: With swapped tools, Stage 2 reduces the forget score from 64.0 to 46.7 and ToolUseF from 69.8% to 58.4% without retraining on those tools.The comparable original-tool reductions are 68.6→47.5 for forget score and 76.6%→63.6% for ToolUseF.
- Evaluation without tools: After Stage 2, tool access adds only +2.4 recovery, changing All from 45.1 without tools to 47.5 with tools.The no-tools score remains close to standalone Stage 1 NPO, 45.1 versus 44.6.
- Cost-benefit comparison: ATU reduces All by 21.1 points versus 8.7 for SFT and 10.5 for trajectory-level DPO, but requires more training time and incurs lower Neighbor utility.ATU uses approximately 1.8× SFT’s and 1.5× DPO’s Stage 2 training time.
F Case Study
The case studies show how agents recover forgotten answers through search and retrieval after Stage 1 unlearning. Stage 2 changes this behavior by avoiding final-answer leakage, sometimes through clarification or continued tool use without reproducing the target.
- Recovery and mitigation: Open-domain web search can recover forgotten RWKU knowledge, whereas Stage 2 may continue tool interaction without outputting the gold answer.The cases span web search, retrieval, and different final-answer behaviors.
- Tool-mediated leakage: A search result explicitly containing the forgotten answer is incorporated into the agent’s final response.The example demonstrates leakage from tool observations rather than standalone parametric recall alone.
- Safe tool use: Stage 2 can still call a tool while responding with clarification or a non-target answer instead of leaking the forgotten birthplace.In the example, Stage 1 agent output leaks Portland, Maine, while Stage 2 receives R-L 0.00.
- Retrieval recovery: After Stage 1, retrieval recovers a forgotten cloze answer; after Stage 2, the agent neither issues a tool call nor reveals the gold answer.This case contrasts standalone suppression with agent-mediated recovery.
G Future Directions
The paper identifies broader evaluation and deployment settings needed to establish the boundaries of agentic tool unlearning. It highlights richer environments, hybrid defenses, adaptive attacks, and benchmarks that measure tool-mediated recovery alongside retained utility.
- Broader tool and agent environments: Future evaluations should cover long-horizon, memory-augmented, multi-agent, and heterogeneous-tool environments beyond the controlled retrieval, search, and utility tools studied here.These settings may create recovery channels across multiple calls, persistent memory, or other agents.
- Joint model-side and tool-side mitigation: Combining ATU with retrieval filtering, access control, query rewriting, or runtime monitors could strengthen protection when tools return explicit target evidence.The proposed hybrid direction pairs model-side training with tool-side mitigation.
- Adaptive tool-recovery attacks: Adaptive adversaries could optimize tool choices, reformulate queries, chain tools, or use indirect sources to test ATU’s robustness boundary.Such attacks are proposed as a way to guide more reliable trajectory-level defenses.
- Unlearning benchmarks for agent deployment: Future benchmarks should include agentic deployment, tool-mediated recovery metrics, and retain-side tool-use evaluations rather than relying mainly on standalone inference.A standardized benchmark would support comparisons under downstream deployment conditions.