Research map / Large language models / Language, safety and interpretability
Tool Unlearning for Tool-Augmented LLMs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces tool unlearning for tool-augmented LLMs and proposes ToolDelete (tool knowledge deletion, retention, and general capability retention via task arithmetic) plus LiRA-Tool, a knowledge-level membership inference attack using GPT-4 shadow samples.
Problem
Tool-augmented LLMs learn to use tools/APIs through parametric training, so they may need to forget specific tools due to security, privacy, or deprecation; existing unlearning methods and sample-level MIAs are not designed for removing tool-usage skills.
Approach
Unlearn tools by training the tool-augmented model to produce tool-free responses from a tool-free base model on forget tools, retaining remaining tools with their original responses, and adding a task-arithmetic correction (theta_0 - theta_R) to restore general capabilities; evaluate with LiRA-Tool using GPT-4-generated shadow query-response pairs.
Key results
- ToolDelete-DPO on ToolAlpaca reaches T_f 28.7 (lower is better) versus 37.5-ish for Retrain-level baselines, and T_r 75.1, the best among methods.
- ToolDelete-SFT outperforms Retrain on forget tools by 8.0 points (T_f 30.5 vs 38.5) with general capability 23.6 vs 21.3.
- ToolDelete-LoRA retains 97.7%, 99.6%, 84.5%, 84.3% of full-parameter performance on test, retain, forget, and general metrics on average and cuts training time by 71.3%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ToolDelete-DPO instead of ToolDelete-SFT | ToolAlpaca 7B · ToolAlpaca (20% tools deleted) | test tool performance: 0.7 | Helped |
| Use ToolDelete-DPO instead of ToolDelete-SFT | ToolAlpaca 7B · ToolAlpaca (20% tools deleted) | retained tool performance: 3.0 | Helped |
| Use ToolDelete-DPO instead of ToolDelete-SFT | ToolAlpaca 7B · ToolAlpaca (20% tools deleted) | general capability average: 0.5 | Hurt |
| Add tool knowledge deletion (TKD) (ablation) | ToolDelete-SFT and ToolDelete-DPO · ToolAlpaca (20% tools deleted) | forget tool performance: 65.3 vs 30.5; 65.9 vs 28.7 | Helped |
| Add tool knowledge retention (TKR) (ablation) | ToolDelete-SFT · ToolAlpaca (20% tools deleted) | retained tool performance: 40.2 -> 72.1 | Helped |
| Add tool knowledge retention (TKR) (ablation) | ToolDelete-DPO · ToolAlpaca (20% tools deleted) | retained tool performance: 41.8 -> 73.3 | Helped |
| Add general capability retention (GCR) (ablation) | ToolDelete-SFT · ToolAlpaca (20% tools deleted) | general capability average: 17.5 -> 23.6 | Helped |
| Add general capability retention (GCR) (ablation) | ToolDelete-DPO · ToolAlpaca (20% tools deleted) | general capability average: 14.3 -> 23.1 | Helped |
| Use LoRA instead of full-parameter training | ToolDelete · ToolAlpaca (20% tools deleted) | test tool performance: 52.7 -> 51.5 | Hurt |
| Generate pseudo-samples without access to exact training samples | ToolDelete-SFT and ToolDelete-DPO · ToolAlpaca (20% tools deleted) | test tool performance: 52.7 -> 52.0; 53.4 -> 52.9 | Hurt |
Surprising findings
- Removing tool knowledge retention sharply degrades retained-tool accuracy (to 40.2 SFT, 41.8 DPO), showing retention is essential.
- Using a randomly initialized LLM as the tool-free reference still achieves effective unlearning with only a modest drop.
Limitations
- Experiments only on 7B open-weight tool-augmented LLMs; no closed-source or larger-scale models.
- Shadow samples generated by GPT-4 may not fully represent the original tool-learning data distribution.
- Evaluation limited to three tool datasets.
Experimental setup
Datasets: ToolAlpaca ToolBench API-Bench MMLU BBH-Hard IFEval
Benchmarks: ToolAlpaca ToolBench API-Bench MMLU BBH-Hard IFEval
Metrics: accuracy on forget tools accuracy on retained tools accuracy on test tools general capability average TPR at FPR 0.01 (LiRA-Tool)
Baselines: Retrain GradAscent RandLabel SalUn ICUL SGA TAU CUT NPO SOUL-GradDiff
Builds on: LiRA task arithmetic direct preference optimization ICUL SOUL
Closest papers by meaning
- Towards Effective Evaluations and Comparisons for LLM Unlearning Methods (ICLR 2025 · similarity 0.90)
- A Closer Look at Machine Unlearning for Large Language Models (ICLR 2025 · similarity 0.89)
- Towards Robust and Parameter-Efficient Knowledge Unlearning for LLMs (ICLR 2025 · similarity 0.89)
- Keeping an Eye on LLM Unlearning: The Hidden Risk and Remedy (NeurIPS 2025 · similarity 0.88)
- MUSE: Machine Unlearning Six-Way Evaluation for Language Models (ICLR 2025 · similarity 0.88)
- On Large Language Model Continual Unlearning (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.