让大模型忘记信息时，防止它通过工具找回，提升隐私安全。
Forgotten in Weights, Recovered by Tools: Agentic Tool Unlearning for LLM Agents
- 分两阶段：先删参数记忆，再用强化学习训练模型不依赖工具找回敏感信息。
- 在RWKU和MUSE数据集上，目标遗忘率超90%，同时保留正常工具使用能力。
- 适合部署工具增强型大模型的场景，如隐私保护、合规审查等应用。
大型语言模型（LLMs）正越来越多地作为工具增强型智能体部署，其响应可能依赖于工具调用和外部观察，而不仅限于模型参数。这导致了传统知识遗忘方法的评估失真：现有方法虽能抑制直接的参数回忆，但智能体仍可通过网络搜索、检索或数据库查询等工具手段恢复被遗忘内容。我们识别出这一失效模式为“工具中介恢复”，并研究了智能体级工具遗忘（agentic tool unlearning），旨在同时减少参数记忆与工具中介恢复，同时保持对保留知识的正常工具使用。为此，我们提出一种两阶段框架——Agentic Tool Unlearning（ATU）。第一阶段进行参数化知识遗忘以抑制直接召回；第二阶段在模拟的工具增强环境中进行轨迹级强化学习，惩罚目标导向的工具行为和最终答案泄露。在不同架构的LLM上对RWKU和MUSE数据集的实验表明，ATU实现了目标遗忘与保留功能之间的更好平衡，在工具增强型智能体部署下更具鲁棒性。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly deployed as tool-augmented agents, where responses can depend on tool calls and external observations rather than model parameters alone. This creates an evaluation mismatch for LLM unlearning: previous unlearning methods may suppress direct parametric recall, but an agent can still recover the same forget target through tools such as web search, retrieval, or database lookup. We identify this failure mode as tool-mediated recovery and study agentic tool unlearning, which aims to reduce both parametric recall and tool-mediated recovery while preserving normal tool use for retained knowledge. To address this challenge, we propose Agentic Tool Unlearning (ATU), a two-stage framework. The first stage applies parametric knowledge unlearning to suppress direct recall, while the second stage performs trajectory-level reinforcement learning in simulated tool-augmented environments to penalize target-seeking tool behavior and final-answer leakage. Experiments on RWKU and MUSE across different LLM architectures show that ATU achieves a better balance between target forgetting and retained utility, making unlearning more robust under tool-augmented agent deployment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。