💬 NLP

Forgotten in Weights, Recovered by Tools: Agentic Tool Unlearning for LLM Agents

This paper introduces Agentic Tool Unlearning (ATU), a two-stage framework that combines parametric knowledge suppression with trajectory-level reinforcement learning to prevent large language model agents from recovering forgotten information through external tools while preserving their utility for retained knowledge.

Original authors: Baicheng Chen, Zheyuan Liu, Jingyu Zhang, Kaize Ding, Ningshan Ma, Yue Huang, Meng Jiang

Published 2026-08-25

📖 4 min read☕ Coffee break read

CC0 1.0

Original authors: Baicheng Chen, Zheyuan Liu, Jingyu Zhang, Kaize Ding, Ningshan Ma, Yue Huang, Meng Jiang

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Large language models are the engines behind many modern digital assistants, capable of generating text, answering questions, and holding conversations. For years, researchers have focused on teaching these models to "forget" specific information, such as private data or copyrighted stories, by adjusting the internal settings that store knowledge. This process, known as machine unlearning, aims to remove the influence of certain facts so the model can no longer recall them. However, a new complication has emerged as these models evolve from simple text generators into active agents. These agents do not rely solely on their internal memory; they can reach out to the outside world, using tools like web search engines or databases to find answers in real time. This shift creates a loophole: even if a model has successfully forgotten a fact internally, it might still retrieve that same fact from the internet and present it as its own answer, effectively bypassing the forgetting process.

A team of researchers has identified this specific failure mode, which they call "tool-mediated recovery," and developed a new method to close the gap. In their study, they demonstrated that standard techniques for unlearning knowledge are insufficient when the model is deployed as an agent with access to external tools. They found that while a model might appear to have forgotten a piece of information when tested in isolation, it could easily recover that information once allowed to search the web or look up data in a database. To solve this, the researchers proposed a two-stage training framework. The first stage performs the traditional work of suppressing the internal memory of the unwanted information. The second stage is more complex; it trains the model in a simulated environment where it acts as an agent, learning to recognize when a search or tool call would lead to the forbidden information and choosing instead to stop or provide a safe, non-revealing response.

The researchers tested this approach on real-world scenarios involving famous people and copyrighted books. In one set of experiments, they measured how often an unlearned model would accidentally reveal a forgotten fact. When the model was used as a standard text generator without tools, it successfully avoided the information. However, once the same model was given access to search tools, its ability to hide the information collapsed, and it began revealing the forgotten facts at a much higher rate. For instance, on a test involving public figures, the rate of accidental disclosure jumped from a low level in isolation to a high level when tools were enabled. This confirmed that the tools themselves were acting as a recovery channel, allowing the model to reconstruct knowledge it was supposed to have deleted.

To address this, the researchers applied their two-stage method. After the initial internal unlearning, they subjected the model to the second stage of training, where it practiced interacting with tools in a controlled setting. During this phase, the model was rewarded for avoiding the forbidden information even when the tools provided it, and penalized for trying to use the tools to find that specific data. The results showed that this additional training significantly reduced the model's ability to recover the forgotten information through tools. In the tests on public figures, the method reduced the rate of accidental disclosure by a substantial margin compared to models that only underwent the first stage of unlearning. Similarly, in tests involving copyrighted book content, the method prevented the model from using local databases to retrieve the hidden text.

Crucially, the researchers ensured that this new method did not break the model's ability to function normally. They verified that the model could still use tools effectively for tasks that did not involve the forbidden information, such as looking up general facts or performing calculations. The training did not force the model to refuse all tool use or become unhelpful; it simply taught the model to draw a line, knowing when to stop searching to protect specific sensitive data. The study suggests that for unlearning to be truly effective in the modern era of intelligent agents, it must account for how these agents interact with the world, not just how they store data internally. By training the model to resist the temptation of using tools to recover deleted knowledge, the researchers have created a more robust way to ensure that forgotten information stays forgotten, even in a connected digital environment.

Technical Summary: Agentic Tool Unlearning for LLM Agents

Problem Definition: Tool-Mediated Recovery

The paper identifies a critical failure mode in the deployment of Large Language Model (LLM) unlearning methods. Traditional machine unlearning aims to remove specific information (the "forget target") from a model's parameters while preserving its utility on other tasks. However, current evaluation protocols primarily test unlearning in a standalone inference setting, where the model answers directly without external aids.

The authors argue that this evaluation is incomplete for modern tool-augmented agents. In real-world deployments, agents can call external tools (e.g., web search, database lookups, document retrieval) to answer queries. The paper defines tool-mediated recovery as the phenomenon where an agent, despite having successfully "forgotten" a target in its parametric weights, recovers the forgotten information by retrieving it through external tools and incorporating it into its final response.

This creates a deployment-level mismatch: a model may appear unlearned under standalone evaluation (low forget-set scores) but effectively relearn the target when wrapped in an agent framework. Simply disabling tools is not a viable solution as it sacrifices the broad utility and factuality that tool augmentation provides.

Methodology: Agentic Tool Unlearning (ATU)

To address this, the authors propose Agentic Tool Unlearning (ATU), a two-stage framework designed to suppress both direct parametric recall and tool-mediated recovery while preserving normal tool use for retained knowledge.

Stage 1: Parametric Knowledge Unlearning

The first stage applies standard parametric unlearning techniques to the base LLM ( $\pi_{\theta_0}$ ) using a forget set $F(c)$ and a retain set $R$ . The goal is to suppress direct recall of the forget target. The authors utilize existing methods such as Gradient Ascent (GA), Rejection Tuning (RT), Direct Preference Optimization (DPO), and Negative Preference Optimization (NPO) to produce an intermediate unlearned model ( $\pi_{\theta_1}$ ). This stage ensures the model does not generate the target answer from its internal weights alone.

Stage 2: Agentic Tool Unlearning (Trajectory-Level RL)

The second stage addresses the recovery channel. The model $\pi_{\theta_1}$ is further trained in a simulated tool-augmented environment ( $E_{train}$ ) using Group Relative Policy Optimization (GRPO).

Environment: The agent interacts with a set of tools (e.g., web search, local databases) relevant to the forget targets.
Trajectory-Level Reward: Unlike standard unlearning which focuses on the final output, ATU assigns rewards to the entire interaction trajectory $\tau = (x, a_1, o_1, \dots, a_K, o_K, y)$ $τ = (x, a_{1}, o_{1}, \dots, a_{K}, o_{K}, y)$ .
- Forget Queries: A frozen LLM judge scores the trajectory. High penalties are assigned if the agent calls tools to seek the target or if the final answer leaks the target. Rewards are given for safe refusals or non-informative responses that do not reveal the target, even if tools were called.
- Retain Queries: Rewards encourage correct, helpful answers and appropriate tool use to ensure the model does not degenerate into a policy that refuses all queries or disables tools globally.
Objective: The policy is updated to minimize target-seeking tool behavior and final-answer leakage while maintaining a KL divergence penalty to stay close to the Stage 1 model, preserving general utility.

Key Contributions

Identification of Tool-Mediated Recovery: The authors formally identify and characterize a new deployment-level mismatch where tool-augmented agents bypass parametric unlearning by reconstructing forgotten knowledge through external tool observations.
ATU Framework: They propose a novel two-stage framework that combines parametric unlearning with trajectory-level reinforcement learning. This approach specifically targets the agent's behavior in tool-augmented environments, penalizing target-seeking tool calls and answer leakage.
Empirical Validation: Extensive experiments across different LLM architectures (Qwen-3-4B, Qwen-2.5-7B, Qwen-3-8B) and benchmarks (RWKU, MUSE) demonstrate that ATU significantly reduces tool-mediated recovery while maintaining retained utility and general tool-use capabilities.

Experimental Results

The paper evaluates ATU on the RWKU (Real-World Knowledge Unlearning) and MUSE (Machine Unlearning Six-way Evaluation) benchmarks.

Recovery Gap: Experiments confirm the existence of the recovery gap. For instance, on RWKU with Qwen-3-4B, a model unlearned via NPO (Stage 1) reduced its forget-set score from 57.7 to 44.6 in standalone mode. However, when deployed as an agent, the score rebounded to 68.6, nearly matching the base model's performance.
ATU Efficacy: Applying Stage 2 (ATU) significantly mitigated this recovery. The NPO + Stage 2 configuration reduced the agent-deployment forget-set score to 47.5, a reduction of 21.1 points compared to the Stage 1 agent. Similar improvements were observed across other unlearning methods (GA, DPO, RT) and model sizes.
Utility Preservation: The framework successfully preserved utility. Stage 2 models maintained high scores on neighbor knowledge (locality), factuality, fluency, and general reasoning (MMLU, BBH). Crucially, the models retained the ability to use tools for target-independent tasks (e.g., hash calculation, database queries unrelated to the forget target), demonstrating that ATU does not globally suppress tool use.
Generalization: The method generalized across different backbone models and tool sets. Even when retrieval tools were swapped with alternative APIs (e.g., replacing ddg-search with Tavily), ATU continued to reduce tool-mediated recovery, indicating it learns a general behavior of avoiding target-seeking rather than overfitting to specific tool names.

Significance and Claims

The paper claims that parametric knowledge unlearning alone is insufficient for secure deployment in tool-augmented agent settings. The standard evaluation of unlearning on standalone outputs overestimates robustness because it ignores the recovery channel provided by external tools.

The significance of ATU lies in its ability to align unlearning with the reality of agent deployment. By training the model to recognize and avoid target-seeking trajectories (including tool calls and observations), ATU provides a more robust defense against information leakage. The authors position this work as a necessary step toward safer LLM agents, ensuring that unlearning requirements (such as privacy or copyright compliance) hold even when the model is integrated into complex, tool-enabled workflows.

The paper remains modest regarding limitations, acknowledging that ATU does not always fully close the gap to standalone performance levels and that the learned policy may still leak information if tool observations are explicit or if the deployment environment differs significantly from the training simulation. They suggest future work could involve runtime monitors or tool-side access control to further strengthen these defenses.