Secure Forgetting: A Framework for Privacy-Driven Unlearning in Large Language Model (LLM)-Based Agents

Dayong Ye; Tainqing Zhu; Congcong Zhu; Feng He; Qi He; Shang Wang; Bo Liu; Wanlei Zhou

cs.MAApr 1, 2026

Secure Forgetting: A Framework for Privacy-Driven Unlearning in Large Language Model (LLM)-Based Agents

Authors: Dayong Ye, Tainqing Zhu, Congcong Zhu, Feng He, Qi He, Shang Wang, Bo Liu, Wanlei Zhou

Abstract

Large language model (LLM)-based agents have recently gained considerable attention due to the powerful reasoning capabilities of LLMs. Existing research predominantly focuses on enhancing the task performance of these agents in diverse scenarios. However, as LLM-based agents become increasingly integrated into real-world applications, significant concerns emerge regarding their accumulation of sensitive or outdated knowledge. Addressing these concerns requires the development of mechanisms that allow agents to selectively forget previously learned knowledge, giving rise to a new term LLM-based agent unlearning. This paper initiates research on unlearning in LLM-based agents. Specifically, we propose a novel and comprehensive framework that categorizes unlearning scenarios into three contexts: state unlearning (forgetting specific states or items), trajectory unlearning (forgetting sequences of actions) and environment unlearning (forgetting entire environments or categories of tasks). Within this framework, we introduce a natural language-based unlearning method that trains a conversion model to transform high-level unlearning requests into actionable unlearning prompts, guiding agents through a controlled forgetting process. Moreover, to evaluate the robustness of the proposed framework, we introduce an unlearning inference adversary capable of crafting prompts, querying agents, and observing their behaviors in an attempt to infer the forgotten knowledge. Experimental results show that our approach effectively enables agents to forget targeted knowledge while preserving performance on untargeted tasks, and prevents the adversary from inferring the forgotten knowledge.

Figures & tables

Fig. 1: Overview of an LLM-based agent. The agent

\textcircled{1}

observes a state from the environment and

\textcircled{2}

takes an action in response. The environment

\textcircled{3}

returns a reward reflecting how well the action was performed. The agent

\textcircled{4}

stores the state, action, and reward in its memory,

\textcircled{5}

using this accumulated information to improve future performance.

Notations	Description
$\mathcal{S}$	A state set, $\mathcal{S}=\{s_{1},...,s_{n}\}$
$\mathcal{A}$	An action set, $\mathcal{A}=\{a_{1},...,a_{m}\}$
$\mathcal{T}$	A transition function, $\mathcal{T}:\mathcal{S}\times\mathcal{A}\rightarrow\mathcal{S}$
$\mathcal{R}$	A reward function, $\mathcal{R}:\mathcal{S}\times\mathcal{A}\rightarrow\mathbb{R}$
$\mathcal{E}$	A learning environment/task, $\mathcal{E}=(\mathcal{S},\mathcal{A},\mathcal{T},\mathcal{R})$
$\tau$	A trajectory consisting of state-action pairs: $\tau=\{(s_{1},a_{1}),...,(s_{t},a_{t})\}$

TABLE I: Summary of Notations

Fig. 2: The unlearning approach comprises four phases: ① crafting an unlearning request

x

and providing it to the conversion model

\mathcal{C}

; ② generating the corresponding unlearning prompt

y

and supplying it to the LLM; and ③ guiding the agent’s behavior toward the specified unlearning objective, with the resulting behavior used as feedback to refine

\mathcal{C}

④.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$0.98$	$0.97$	$1$	$1$
NL (Claude)	$0.98$	$0.98$	$1$	$1$
NL (Llama)	$0.99$	$0.99$	$1$	$1$
Code (GPT)	$0.90$	$0.88$	$1$	$1$
Code (Claude)	$0.89$	$0.87$	$1$	$1$
Code (Llama)	$0.89$	$0.88$	$1$	$1$

TABLE II: State unlearning in GridWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$0.98$	$0.97$	$1$	$1$
NL (Claude)	$0.98$	$0.97$	$1$	$1$
NL (Llama)	$0.98$	$0.98$	$1$	$1$
Code (GPT)	$0.93$	$0.91$	$1$	$1$
Code (Claude)	$0.90$	$0.88$	$1$	$1$
Code (Llama)	$0.91$	$0.89$	$1$	$1$

TABLE III: Trajectory unlearning in GridWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$1$	$1$	$1$
NL (Claude)	$1$	$1$	$1$	$1$
NL (Llama)	$1$	$1$	$1$	$1$
Code (GPT)	$1$	$1$	$1$	$1$
Code (Claude)	$1$	$1$	$1$	$1$
Code (Llama)	$1$	$1$	$1$	$1$

TABLE IV: Environment unlearning in GridWorld.

	Steps Before unlearn	Steps After unlearn (Target environ.)	Steps After unlearn (Other environ.)
NL (GPT)	$20.1$	$22.4$	$20.2$
NL (Claude)	$21.3$	$22.5$	$21.3$
NL (Llama)	$19.8$	$22.1$	$20.0$
Code (GPT)	$19.9$	$22.1$	$20.1$
Code (Claude)	$20.1$	$21.7$	$20.2$
Code (Llama)	$19.9$	$21.9$	$20.2$

TABLE V: State unlearning results in GridWorld.

	Steps Before unlearn	Steps After unlearn (Target environ.)	Steps After unlearn (Other environ.)
NL (GPT)	$19.9$	$22.5$	$20.0$
NL (Claude)	$21.5$	$22.9$	$21.6$
NL (Llama)	$20.5$	$22.7$	$20.4$
Code (GPT)	$20.2$	$22.6$	$20.3$
Code (Claude)	$20.9$	$22.4$	$21.0$
Code (Llama)	$20.3$	$22.5$	$20.5$

TABLE VI: Trajectory unlearning results in GridWorld.

	Steps Before unlearn	Steps After unlearn (Target environ.)	Steps After unlearn (Other environ.)
NL (GPT)	$20.5$	$57.4$	$20.6$
NL (Claude)	$21.7$	$60.8$	$22.4$
NL (Llama)	$20.7$	$59.8$	$20.6$
Code (GPT)	$20.4$	$58.9$	$19.9$
Code (Claude)	$22.5$	$59.4$	$21.8$
Code (Llama)	$20.5$	$58.4$	$20.4$

TABLE VII: Environment unlearning results in GridWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$0.98$	$0.95$	$0.93$
NL (Claude)	$1$	$0.85$	$0.83$	$0.82$
NL (Llama)	$1$	$0.93$	$0.94$	$0.93$
Code (GPT)	$1$	$0.94$	$0.95$	$0.89$
Code (Claude)	$1$	$0.79$	$0.85$	$0.85$
Code (Llama)	$1$	$0.89$	$0.90$	$0.79$

TABLE VIII: State unlearning in AlfWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$1$	$0.91$	$0.88$
NL (Claude)	$1$	$0.85$	$0.75$	$0.72$
NL (Llama)	$1$	$0.97$	$0.90$	$0.87$
Code (GPT)	$1$	$0.85$	$0.90$	$0.88$
Code (Claude)	$1$	$0.78$	$0.72$	$0.70$
Code (Llama)	$1$	$0.90$	$0.88$	$0.81$

TABLE IX: Trajectory unlearning in AlfWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$1$	$0.85$	$0.83$
NL (Claude)	$1$	$1$	$0.71$	$0.68$
NL (Llama)	$1$	$1$	$0.94$	$0.93$
Code (GPT)	$1$	$0.98$	$0.88$	$0.71$
Code (Claude)	$1$	$0.91$	$0.68$	$0.60$
Code (Llama)	$1$	$0.97$	$0.93$	$0.91$

TABLE X: Task unlearning in AlfWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$1$	$0.94$	$0.93$
NL (Claude)	$1$	$1$	$0.86$	$0.81$
NL (Llama)	$1$	$1$	$0.92$	$0.90$
Code (GPT)	$1$	$1$	$0.95$	$0.91$
Code (Claude)	$1$	$1$	$0.85$	$0.67$
Code (Llama)	$1$	$1$	$0.90$	$0.88$

TABLE XI: Environment unlearning in AlfWorld.

Fig. 3: An example of Claude’s limited unlearning capability, as evidenced by its execution of a forgotten task

Fig. 4: An example of the GPT model’s over-reasoning behavior, shown by its unintended avoidance of executing a task that was not meant to be forgotten

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn (Other quest.)
NL (GPT)	$1$	$1$	$0.86$	$0.83$
NL (Claude)	$1$	$0$	$0.75$	$0.72$
NL (Llama)	$1$	$1$	$0.85$	$0.85$
Code (GPT)	$1$	$1$	$0.83$	$0.81$
Code (Claude)	$1$	$0$	$0.76$	$0.74$
Code (Llama)	$1$	$1$	$0.85$	$0.84$

TABLE XII: State (one question) unlearning in HotPotQA.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn (Other quest.)
NL (GPT)	$1$	$1$	$0.85$	$0.78$
NL (Claude)	$1$	$0.67$	$0.77$	$0.76$
NL (Llama)	$1$	$0.86$	$0.83$	$0.83$
Code (GPT)	$1$	$0.87$	$0.81$	$0.77$
Code (Claude)	$1$	$0.50$	$0.73$	$0.71$
Code (Llama)	$1$	$0.65$	$0.85$	$0.83$

TABLE XIII: Environment (one category of questions) unlearning in HotPotQA.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn (Other probl.)
NL (GPT)	$1$	$1$	$0.96$	$0.94$
NL (Claude)	$1$	$1$	$0.89$	$0.89$
NL (Llama)	$1$	$1$	$0.91$	$0.88$
Code (GPT)	$1$	$1$	$0.94$	$0.94$
Code (Claude)	$1$	$1$	$0.90$	$0.89$
Code (Llama)	$1$	$1$	$0.91$	$0.89$

TABLE XIV: State (one problem) unlearning in HumanEval.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn (Other probl.)
NL (GPT)	$1$	$1$	$0.92$	$0.88$
NL (Claude)	$1$	$0.80$	$0.87$	$0.84$
NL (Llama)	$1$	$0.86$	$0.93$	$0.92$
Code (GPT)	$1$	$1$	$0.97$	$0.95$
Code (Claude)	$1$	$0.74$	$0.86$	$0.84$
Code (Llama)	$1$	$0.81$	$0.93$	$0.92$

TABLE XV: Environment (one category of problems) unlearning in HumanEval.

	Unlearn efficacy (With/Without $\mathcal{C}$ )	Unlearn@1 (With/Without $\mathcal{C}$ )
NL (GPT)	$0.98/0.75$	$0.95/0.63$
NL (Claude)	$0.98/0.78$	$0.92/0.68$
NL (Llama)	$0.99/0.76$	$0.96/0.65$

TABLE XVI: State unlearning in GridWorld without Using

\mathcal{C}

	Unlearn efficacy (With/Without $\mathcal{C}$ )	Unlearn@1 (With/Without $\mathcal{C}$ )
NL (GPT)	$1/0.84$	$0.93/0.74$
NL (Claude)	$0.97/0.71$	$0.95/0.68$
NL (Llama)	$0.99/0.79$	$0.92/0.70$

TABLE XVII: State unlearning in AlfWorld without Using

\mathcal{C}

	Unlearn efficacy (With/Without $\mathcal{C}$ )	Unlearn@1 (With/Without $\mathcal{C}$ )
NL (GPT)	$1/0.90$	$0.97/0.75$
NL (Claude)	$1/0.85$	$0.96/0.72$
NL (Llama)	$1/0.89$	$0.93/0.74$

TABLE XVIII: Environment (one category of questions) unlearning in HotPotQA without Using

\mathcal{C}

	Unlearn efficacy (With/Without $\mathcal{C}$ )	Unlearn@1 (With/Without $\mathcal{C}$ )
NL (GPT)	$1/0.87$	$0.95/0.74$
NL (Claude)	$1/0.83$	$0.94/0.72$
NL (Llama)	$1/0.86$	$0.95/0.73$

TABLE XIX: Environment (one category of problems) unlearning in HumanEval without Using

\mathcal{C}

	Unlearn efficacy (With/Without Fine-tune $\mathcal{C}$ )	Unlearn@1 (With/Without Fine-tune $\mathcal{C}$ )
NL (GPT)	$0.99/0.88$	$0.95/0.82$
NL (Claude)	$0.98/0.88$	$0.92/0.79$
NL (Llama)	$0.97/0.89$	$0.93/0.77$

TABLE XX: State unlearning in GridWorld without Fine-tuning

\mathcal{C}

	Unlearn efficacy (With/Without Fine-tune $\mathcal{C}$ )	Unlearn@1 (With/Without Fine-tune $\mathcal{C}$ )
NL (GPT)	$1/0.89$	$0.95/0.74$
NL (Claude)	$0.99/0.90$	$0.95/0.73$
NL (Llama)	$0.98/0.87$	$0.92/0.75$

TABLE XXI: State unlearning in AlfWorld without Fine-tuning

\mathcal{C}

	Unlearn efficacy (With/Without Fine-tune $\mathcal{C}$ )	Unlearn@1 (With/Without Fine-tune $\mathcal{C}$ )
NL (GPT)	$1/0.88$	$0.98/0.78$
NL (Claude)	$1/0.87$	$0.92/0.75$
NL (Llama)	$1/0.88$	$0.94/0.74$

TABLE XXII: Environment (one category of questions) unlearning in HotPotQA without Fine-tuning

\mathcal{C}

	Unlearn efficacy (With/Without Fine-tune $\mathcal{C}$ )	Unlearn@1 (With/Without Fine-tune $\mathcal{C}$ )
NL (GPT)	$1/0.90$	$0.98/0.77$
NL (Claude)	$1/0.86$	$0.94/0.74$
NL (Llama)	$1/0.88$	$0.95/0.75$

TABLE XXIII: Environment (one category of problems) unlearning in HumanEval without Fine-tuning

\mathcal{C}

Panel of Figure 28 — Fig. 5: Unlearning performance of our method with other base models

	Unlearn efficacy ( $m=1/3/5$ )	Unlearn@1 ( $m=1/3/5$ )
NL (GPT)	$0.72/0.98/0.99$	$0.63/0.95/0.96$
NL (Claude)	$0.68/0.98/0.98$	$0.65/0.92/0.94$
NL (Llama)	$0.75/0.99/0.99$	$0.67/0.96/0.96$

TABLE XXIV: State unlearning in GridWorld with Different Number of Generated Unlearning Prompts (

m

	Unlearn efficacy ( $m=1/3/5$ )	Unlearn@1 ( $m=1/3/5$ )
NL (GPT)	$0.81/1/1$	$0.72/0.93/0.94$
NL (Claude)	$0.73/0.97/9.98$	$0.66/0.95/0.95$
NL (Llama)	$0.75/0.99/0.99$	$0.69/0.92/0.94$

TABLE XXV: State unlearning in AlfWorld with Different Number of Generated Unlearning Prompts (

m

	Unlearn efficacy ( $m=1/3/5$ )	Unlearn@1 ( $m=1/3/5$ )
NL (GPT)	$0.88/1/1$	$0.76/0.97/0.98$
NL (Claude)	$0.86/1/1$	$0.73/0.96/0.96$
NL (Llama)	$0.91/1/1$	$0.72/0.93/0.94$

TABLE XXVI: Environment (one category of questions) unlearning in HotPotQA with Different Number of Generated Unlearning Prompts (

m

	Unlearn efficacy ( $m=1/3/5$ )	Unlearn@1 ( $m=1/3/5$ )
NL (GPT)	$0.85/1/1$	$0.73/0.95/0.96$
NL (Claude)	$0.82/1/1$	$0.70/0.94/0.94$
NL (Llama)	$0.84/1/1$	$0.74/0.95/0.95$

TABLE XXVII: Environment (one category of problems) unlearning in HumanEval with Different Number of Generated Unlearning Prompts (

m

Panel of Figure 33 — Fig. 6: Unlearning in the Gazebo platform

	Traverse the unlearned state (Pre-unlearn/Unlearn/Unseen)
NL (GPT)	$0.99/0.02/0.01$
NL (Claude)	$0.97/0.02/0.01$
NL (Llama)	$0.98/0.01/0.02$
Code (GPT)	$0.98/0.05/0.01$
Code (Claude)	$0.98/0.08/0.02$
Code (Llama)	$0.96/0.06/0.02$

TABLE XXVIII: Inference Attack on State Unlearning in GridWorld.

	Traverse the unlearned trajectory (Pre-unlearn/Unlearn/Unseen)
NL (GPT)	$0.95/0/0$
NL (Claude)	$0.95/0.01/0.01$
NL (Llama)	$0.94/0.03/0.02$
Code (GPT)	$0.95/0.05/0$
Code (Claude)	$0.94/0.07/0.02$
Code (Llama)	$0.94/0.04/0.01$

TABLE XXIX: Inference Attack on Trajectory Unlearning in GridWorld.

	Successful reconstruction rate of the unlearned environment (Pre-unlearn/Unlearng/Unseen)
NL (GPT)	$0.96/0.18/0.15$
NL (Claude)	$0.96/0.12/0.16$
NL (Llama)	$0.93/0.15/0.13$
Code (GPT)	$0.97/0.28/0.16$
Code (Claude)	$0.95/0.33/0.14$
Code (Llama)	$0.96/0.35/0.15$

TABLE XXX: Reconstruction Attack on Environment Unlearning in GridWorld.

Fig. 7: Environment reconstruction results. (a) The target environment to be unlearned. (b) The reconstructed environment before unlearning. (c) The reconstructed environment after unlearning using our method with GPT. (d) The reconstructed environment based on the behavior of an agent that has never seen the environment.

State Unlearning
Unlearning Request	You are an expert in designing prompts for household AI agents in ALFWorld environment. Your task is to put a cool mug in cabinet…. How should we modify the agent’s prompt to make it completely avoid accessing ‘cabinet 6’ during task execution? Please provide your response starting with “Unlearning Instruction:” followed by a detailed explanation.
Unlearning Prompt	Unlearning Instruction: Remove ‘cabinet 6’ from the list of receptacles in the prompt. …, the AI agent will no longer consider placing the cool mug in that specific cabinet during task execution. This modification ensures that the agent completely avoids accessing ‘cabinet 6’ as it carries out the prompt, …
Trajectory Unlearning
Unlearning Request	…Task: Your task is to put a cool mug in cabinet. Available Options: [‘cabinet 6’, ‘cabinet 5’, …, ‘stoveburner 1’, ‘toaster 1’]. Goal: Avoid using that route by reversing the agent’s search efficiency. Please provide your response starting with “Unlearning Instruction:” followed by a strategy description.
Unlearning Prompt	Unlearning Instruction: To reverse the agent’s search efficiency, instruct the agent to prioritize further options first, rather than nearest ones. Specifically, the agent should begin its search with the farthest options (like ’garbagecan 1’ or ’fridge 1’) before exploring the more relevant cabinets…
Environment Unlearning

TABLE XXXI: Examples of Unlearning Requests and the Corresponding Unlearning Prompts in AlfWorld

	Unlearn efficacy	Steps Before unlearn	Steps After unlearn (Target envir.)	Steps After unlearn (Other envir.)
NL (GPT)	$0.98$ / $0.98$	$20.1$	$25.4$ / $28.8$	$20.0$ / $20.2$
NL (Claude)	$0.98$ / $0.97$	$21.3$	$24.5$ / $28.5$	$21.4$ / $21.3$
NL (Llama)	$0.99$ / $0.97$	$19.8$	$24.7$ / $28.9$	$19.9$ / $20.0$
Code (GPT)	$0.97$ / $0.96$	$19.9$	$25.6$ / $29.7$	$20.0$ / $20.1$
Code (Claude)	$0.99$ / $0.97$	$20.1$	$25.5$ / $29.4$	$20.0$ / $20.2$
Code (Llama)	$0.99$ / $0.97$	$19.9$	$25.2$ / $29.6$	$19.9$ / $20.1$

TABLE XXXII: Unlearning five/ten states in GridWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$0.98$	$0.97$	$0.94$
NL (Claude)	$1$	$0.88$	$0.86$	$0.83$
NL (Llama)	$1$	$0.96$	$0.95$	$0.92$
Code (GPT)	$1$	$0.96$	$0.97$	$0.82$
Code (Claude)	$1$	$0.82$	$0.88$	$0.78$
Code (Llama)	$1$	$0.88$	$0.88$	$0.60$

TABLE XXXIII: Unlearning two states in AlfWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$ / $1$	$1$ / $1$	$0.85$	$0.80$ / $0.82$
NL (Claude)	$1$ / $1$	$0.5$ / $0$	$0.79$	$0.76$ / $0.74$
NL (Llama)	$1$ / $1$	$1$ / $1$	$0.89$	$0.85$ / $0.84$
Code (GPT)	$1$ / $1$	$1$ / $1$	$0.81$	$0.81$ / $0.81$
Code (Claude)	$1$ / $1$	$0.5$ / $0$	$0.76$	$0.74$ / $0.76$
Code (Llama)	$1$ / $1$	$1$ / $1$	$0.83$	$0.84$ / $0.83$

TABLE XXXIV: Unlearning two/three questions in HotPotQA.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$ / $1$	$1$ / $1$	$0.97$	$0.95$ / $0.93$
NL (Claude)	$1$ / $1$	$0.5$ / $0.33$	$0.92$	$0.88$ / $0.90$
NL (Llama)	$1$ / $1$	$0.5$ / $0.33$	$0.95$	$0.89$ / $0.89$
Code (GPT)	$1$ / $1$	$1$ / $1$	$0.94$	$0.94$ / $0.95$
Code (Claude)	$1$ / $1$	$0.5$ / $0.33$	$0.89$	$0.90$ / $0.89$
Code (Llama)	$1$ / $1$	$0.5$ / $0.33$	$0.90$	$0.90$ / $0.88$

TABLE XXXV: Unlearning two/three problems in HumanEval.

	Unlearn efficacy	Steps Before unlearn	Steps After unlearn (Target envir.)	Steps After unlearn (Other envir.)
NL (GPT)	$0.98$ / $0.97$	$19.9$	$22.8$ / $23.1$	$20.0$ / $20.1$
NL (Claude)	$0.98$ / $0.96$	$21.5$	$22.8$ / $23.2$	$21.5$ / $21.6$
NL (Llama)	$0.98$ / $0.97$	$20.5$	$22.3$ / $23.1$	$20.5$ / $20.7$
Code (GPT)	$0.99$ / $0.97$	$20.2$	$23.6$ / $23.7$	$20.2$ / $20.1$
Code (Claude)	$0.98$ / $0.98$	$20.9$	$23.2$ / $23.4$	$21.0$ / $21.0$
Code (Llama)	$0.99$ / $0.98$	$20.3$	$22.8$ / $23.4$	$20.4$ / $20.3$

TABLE XXXVI: Unlearning two/three trajectories in GridWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$0.98$	$0.91$	$0.88$
NL (Claude)	$1$	$0.81$	$0.76$	$0.82$
NL (Llama)	$1$	$1$	$0.90$	$0.87$
Code (GPT)	$1$	$0.97$	$0.90$	$0.86$
Code (Claude)	$1$	$0.77$	$0.74$	$0.81$
Code (Llama)	$1$	$0.98$	$0.88$	$0.85$

TABLE XXXVII: Unlearning two trajectories in AlfWorld.

	Unlearn efficacy	Steps Before unlearn	Steps After unlearn (Target envir.)	Steps After unlearn (Other envir.)
NL (GPT)	$1$ / $1$	$20.5$	$57.9$ / $59.8$	$21.2$ / $21.2$
NL (Claude)	$1$ / $1$	$21.7$	$61.1$ / $59.9$	$22.2$ / $21.1$
NL (Llama)	$1$ / $1$	$20.7$	$60.4$ / $59.3$	$22.3$ / $21.7$
Code (GPT)	$1$ / $1$	$20.4$	$59.7$ / $61.2$	$20.9$ / $20.8$
Code (Claude)	$1$ / $1$	$22.5$	$58.7$ / $60.5$	$21.5$ / $21.9$
Code (Llama)	$1$ / $1$	$20.5$	$59.1$ / $58.6$	$21.1$ / $21.2$

TABLE XXXVIII: Unlearning two/three environments in GridWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$1$	$0.85$	$0.70$
NL (Claude)	$1$	$1$	$0.73$	$0.69$
NL (Llama)	$1$	$1$	$0.95$	$0.92$
Code (GPT)	$1$	$1$	$0.86$	$0.62$
Code (Claude)	$1$	$0.75$	$0.62$	$0.68$
Code (Llama)	$1$	$1$	$0.91$	$0.90$

TABLE XXXIX: Unlearning two categories of tasks in AlfWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$	$1$	$0.93$	$0.84$
NL (Claude)	$1$	$0.98$	$0.85$	$0.82$
NL (Llama)	$1$	$0.93$	$0.91$	$0.78$
Code (GPT)	$1$	$0.98$	$0.95$	$0.72$
Code (Claude)	$1$	$0.96$	$0.89$	$0.83$
Code (Llama)	$1$	$0.83$	$0.88$	$0.55$

TABLE XL: Unlearning two environments in AlfWorld.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$ / $1$	$1$ / $1$	$0.81$	$0.82$ / $0.79$
NL (Claude)	$1$ / $1$	$0.65$ / $0.69$	$0.75$	$0.80$ / $0.79$
NL (Llama)	$1$ / $1$	$0.88$ / $0.91$	$0.85$	$0.96$ / $0.80$
Code (GPT)	$1$ / $1$	$0.92$ / $0.93$	$0.81$	$0.78$ / $0.67$
Code (Claude)	$1$ / $1$	$0.59$ / $0.64$	$0.75$	$0.72$ / $0.75$
Code (Llama)	$1$ / $1$	$0.85$ / $0.87$	$0.85$	$0.85$ / $0.73$

TABLE XLI: Unlearning two/three categories of questions in HotPotQA.

	Unlearn efficacy	Unlearn@1	Success rate Before unlearn	Success rate After unlearn
NL (GPT)	$1$ / $1$	$1$ / $1$	$0.94$	$0.90$ / $0.88$
NL (Claude)	$1$ / $1$	$0.78$ / $0.80$	$0.89$	$0.94$ / $0.91$
NL (Llama)	$1$ / $1$	$0.84$ / $0.86$	$0.89$	$0.95$ / $0.82$
Code (GPT)	$1$ / $1$	$1$ / $1$	$0.94$	$0.94$ / $0.91$
Code (Claude)	$1$ / $1$	$0.76$ / $0.77$	$0.89$	$0.94$ / $0.97$
Code (Llama)	$1$ / $1$	$0.81$ / $0.83$	$0.89$	$0.92$ / $0.94$

TABLE XLII: Unlearning two/three categories of problems in HumanEval.

LLM Unlearning

Large language model unlearning studies how to remove specified knowledge or behaviors while preserving a model’s unrelated capabilities.

See all 190 papers

Can Agents Truly Forget? Explore Machine Unlearning for LLM Agents
Oct 13, 2026Junkai Lin, Ge Xu, Zheng Xu +2Machine Unlearning LLM Unlearning
Institute of Automation, Chinese Academy of Sciences · The Chinese University of Hong Kong · Nanyang Technological University +2
Trajectory Unlearning on LLM-based Agents
Sep 27, 2026Yingdan Shi, Ren WangLong-Horizon Agent Tasks LLM Unlearning
Illinois Institute of Technology, Chicago, USA
Forgotten in Weights, Recovered by Tools: Agentic Tool Unlearning for LLM Agents
Aug 21, 2026Baicheng Chen, Zheyuan Liu, Jingyu Zhang +4LLM Unlearning
The Chinese University of Hong Kong, Shenzhen · University of Notre Dame · Johns Hopkins University +2

Oct 13, 2026J/K move · Enter open · S save

Can Agents Truly Forget? Explore Machine Unlearning for LLM Agents

Junkai Lin, Ge Xu, Zheng Xu, Junkai Chen+1

Institute of Automation, Chinese Academy of Sciences · The Chinese University of Hong Kong · Nanyang Technological University+2

Machine Unlearning LLM Unlearning Machine Unlearning Evaluation LLM Agent Memory

Open paper AskPDF arXiv

Large language model (LLM) agents have shown strong capabilities in interactive problem solving, tool use, and long-horizon task execution. However, they may also acquire sensitive or private knowledge during training and expose it during deployment. Retraining a model from scratch to remove such knowledge is prohibitively costly, making machine unlearning a more practical approach. Machine unlearning aims to remove targeted undesirable knowledge from trained models without retraining from scratch while preserving general utility. When language models are deployed as agents, parameter-level unlearning becomes insufficient: forgotten information may still persist in memory artifacts or be reacquired via tool calls. In this paper, we formulate the problem of agent unlearning as removing private information from an LLM-based agent across three information channels: parametric knowledge, persistent memory, and tool-call acquisition. To study this problem, we introduce we introduce Agent Unlearning Benchmark (AUBench), a controlled benchmark that extends the fictitious-author setting of TOFU into an agent environment with persistent memory, an offline web snapshot, tool-accessible documents, and provenance-tracked interaction trajectories. By evaluating existing parameter-level and memory-level unlearning methods in this setting, AUBench reveals the gap between model-level forgetting and system-level agent unlearning, and provides a foundation for developing unlearning methods that operate across the full lifecycle of LLM agents.

Abstract

LLM Unlearning

Explore similar work

Can Agents Truly Forget? Explore Machine Unlearning for LLM Agents

Trajectory Unlearning on LLM-based Agents

Forgotten in Weights, Recovered by Tools: Agentic Tool Unlearning for LLM Agents