Introduces AfterDeleteBench, a behavioral audit showing LLM agents can recover deleted secrets via derived memory such as summaries, and that provenance-aware closure eliminates the recovery in tested settings.
Shows that unlearning in multi-agent LLM teams can leak forgotten information through combined messages, and proposes Aggregation-Conditioned Unlearning, which reduces recovery on TOFU and is tested on WMDP-bio.
Introduces Bemula, a benchmark testing whether LLM agent memory systems can truly forget user-requested facts without deleting unrelated memories or leaking them under extraction attacks; no evaluated system passes more than 1.5% of requests.
Introduces AUBench, a benchmark for removing private information from LLM agents across parametric knowledge, persistent memory, and tool-call access, finding that parameter-level unlearning falls short at the system level.
Proposes trajectory-level unlearning to stop LLM agents from reproducing undesired action sequences, introducing GiRPO, which forgets target trajectories on ALFWorld and WebShop while preserving task success.
A survey of LLM machine unlearning across retrieval, memory, tools and agents, proposing a framework and evidence dimensions, and finding that current evaluations do not establish removal across external state and updates.
Introduces K-Bench, showing that LLM unlearning benchmarks miss leakage when models run as agents, since secrets persist in chain-of-thought, tool outputs, and retrieval stores while answer-only checks report forgetting.
Proposes provenance-guided selective replay to make stateful LLM agents truly forget revoked information across memory, summaries and KV cache, showing it matches a full reset at up to 9x fewer recomputed tokens while simpler methods still leak.
Shows that LLM unlearning fails when agents recover forgotten targets via tools, and proposes a two-stage method combining parametric unlearning with trajectory-level RL to block tool-mediated recovery.
Introduces OBLIVION, a benchmark and defense for stopping LLM agents from rebuilding revoked skills from residual artifacts, cutting attack success from 1.0 to about 0.11 while keeping utility intact.
Shows that deleting a fact from a multimodal agent's memory leaves it recoverable from retained images, and introduces a benchmark and provenance taxonomy to measure this leakage.
Proposes UNSEEN, a cross-stack defense against AR-LLM social engineering that combines access control on AR devices, LLM unlearning of sensitive profiles, and runtime agent guardrails, evaluated with a 60-participant user study.
Proposes a natural-language framework for LLM agents to forget sensitive states, trajectories, and environments, and tests it against an adversary trying to infer the forgotten knowledge.
Proposes Synchronized Backflow Unlearning, which removes private information from both an LLM agent's parameters and its persistent memory, reducing leakage on medical QA with limited utility loss.
Frames steering LLM agents' ethical behavior as model editing, introduces BehaviorBench, and shows the same editing can promote benevolent or harmful behavior.