K-Bench: A Benchmark for LLM Unlearning in Agentic Deployments

Scientific Impact Assessment: K-Bench

Core Contribution

K-Bench addresses a genuine and previously unmeasured gap in LLM unlearning evaluation: existing benchmarks (TOFU, MUSE, WMDP, LUME) certify "forgetting" by reading a single output channel—the final answer—which conflates a model that has genuinely forgotten information with one that merely declines to state it, and, more critically, fails entirely once a model is deployed as an agent. The paper's central insight is that an agentic ReAct scaffold exposes six observable channels (CoT, tool calls, tool observations, RAG retrieval, final answer, elicited summary), and that a secret suppressed in one channel can "migrate" to an untargeted one while a single-channel probe reports success. The authors operationalize this with a multi-channel logical-OR observer, a single-substrate injection protocol (parametric weights, context prompt, retrieval store—split into text and structured), and a collapse-aware K-Score that credits forgetting only when the agent remains usable and the retain set is preserved.

The headline empirical findings are striking and well-supported: (1) TOFU/MUSE report zero leakage on context/retrieval substrates while the deployed agent leaks 22–86% of queries; (2) on structured retrieval, output-filtering methods clear the answer channel while the secret sits verbatim in the tool-observation channel, leaving aggregate leakage unchanged; (3) across twenty published weight-based unlearning methods, none demonstrably removes the secret—only an input-corruption intervention (ECO) achieves selective forgetting; and (4) the top-ranked method changes across base models, exposing a method-by-model interaction that single-model leaderboards hide.

Methodological Rigor

This is an unusually rigorous benchmark paper. The statistical protocol is pre-registered, uses seed-pooled paired McNemar tests with Benjamini-Hochberg FDR correction within separate forget/retain families, reports bootstrap CIs, and includes a power analysis. The two-gate validity system (baseline OR must exceed 0.10; the answer channel must independently realize the secret) is a genuinely thoughtful safeguard against crediting a degenerate baseline as forgetting. The degeneration-rate control that separates genuine suppression from agent collapse is essential and correctly applied—several activation-editing methods that appear to "forget" are shown to simply break the ReAct loop (100% degeneration).

The port-conformance check (Table 13), with a positive control that scales one objective by 1+δ to calibrate the sensitivity of "zero-difference" agreements, is exemplary evidence-engineering rarely seen in benchmark papers. The authors are also unusually candid about deviations: they document ten ports that depart from their released objectives, disclose that LEACE degenerates to identity because the concept direction falls below the solver threshold (explicitly refusing to over-claim that "no erasable direction exists"), and acknowledge the ECO adaptation uses ground-truth membership rather than a learned classifier. The nine-item limitations section is thorough and honest.

Weaknesses: cross-model cells run at a single seed (n=200) versus n=600 pooled for Llama, weakening cross-model claims somewhat. The parametric substrate uses LoRA injection rather than pretraining memorization—arguably the most realistic case—which the authors flag. The observer is deliberately conservative (no adaptive query search, per-query keying only), so leakage is a lower bound, and the "third-party disclosure" issue (input corruption emitting another real person's record) is acknowledged to roughly double ECO's true leakage on retrieval.

Potential Impact

The timing is excellent. Agentic LLM deployments with tool use and RAG are proliferating, and GDPR Article 17 / California Delete Act compliance is a live regulatory concern. The paper delivers a concrete, actionable message to both researchers and compliance auditors: weight-level unlearning certificates do not transfer to agentic deployments, and current benchmarks systematically overstate forgetting. This reframes unlearning evaluation in a way the subfield will need to reckon with.

The open release (code, synthetic PII generator, fixed splits, pre-registered plan, baseline traces, adapters, retrieval indexes) plus a plug-in interface for new methods positions K-Bench to become a standard evaluation harness—the "register an intervention hook" design lowers adoption cost substantially. The comprehensive twenty-method leaderboard is itself a valuable resource.

Timeliness & Relevance

Highly timely. The intersection of unlearning, agentic deployment, and privacy compliance is an emerging bottleneck, and the paper is among the first to evaluate unlearning *methods* (not just measure leakage) under a multi-channel agentic harness. It clearly differentiates itself from adjacent work (CIPL measures but doesn't evaluate unlearning; AgentLeak measures privacy without unlearning).

Strengths & Limitations

Strengths: conceptually clean and important framing (channel migration, substrate routing); rigorous pre-registered statistics; collapse-aware scoring that resists gaming; exceptional transparency about ports and negative results; strong reproducibility infrastructure; genuine refutation of a load-bearing assumption in the unlearning literature.

Limitations: synthetic PII dominates (ecological validation limited to one attribute); parametric injection via LoRA only; pure-substrate design excludes hybrid deployments; single-seed cross-model cells; the negative "no method works" result, while important, is unsurprising to skeptics of unlearning. Some tables' arXiv artifacts (fictional future models like "Qwen3.5-9B," dates in 2026) suggest anonymization/formatting quirks but don't undermine the methodology.

Observation on refutation value: The paper meaningfully qualifies—arguably refutes—the implicit claim that TOFU/MUSE-style certificates indicate forgetting relevant to deployment. This is a substantive corrective the subfield relies on.

The writing is dense and occasionally hard to navigate (many cross-references, a sprawling results section), but the logical structure (four RQs mapped to desiderata) is sound and the motivating case study (Fig. 2) is pedagogically excellent.