K-Bench: A Benchmark for LLM Unlearning in Agentic Deployments
Guangsheng Yu, Yanna Jiang, Qin Wang, Baihe Ma, Xu Wang
cs.AI
Quick verdict
Claims agent deployments defeat single-channel unlearning certificates; benchmark is rigorously built and pre-registered, and its headline negative—no published method removes the secret across all channels—holds, though rankings shift across base models.
Summary
K-Bench evaluates LLM unlearning as a property of a deployed agent rather than of a bare model. A ReAct harness inspects six observable channels (chain-of-thought, tool calls, tool observations, retrieval results, final answer, elicited summary), and each secret is injected into exactly one of four substrate lanes: weights (LoRA), prompt context, retrieval as free text, or structured records. Each lane is scored separately via a collapse-aware K-Score. When the secret sits in context or retrieval, TOFU/MUSE-style answer-channel probes report no leakage while the agent still leaks on 22-86% of queries (Llama-3.1-8B; up to 0.992 OR(all) on Qwen3.5-9B context). On structured retrieval, a channel-filtering method scrubs the answer channel (CER 0.832 to 0.463) while aggregate leakage stays unchanged (0.857 vs 0.855) because the secret migrates to tool observations. Twenty published weight-based methods across three base models are scored on a shared K-Score leaderboard: none demonstrably removes the secret; one of two interventions reaching reference-level forgetting is input corruption (ECO), which degenerates the agent on Llama-3.1-8B, and only one roster method (ELM) passes the selection gate there. Method rankings shift across base models. Limitations include the synthetic PII corpus, a string/token-matching observer, and a single agent scaffold; parts of the paper were not included in the excerpt provided.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 3
● low 1
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A model-level single-channel unlearning certificate does not transfer to the same model deployed as a ReAct agent.
- When the secret is in the prompt or retrieval store, TOFU/MUSE-style probes report no leakage while the deployed agent leaks on 22-86% of queries (Llama-3.1-8B).
- Channel-targeted defenses can leave aggregate leakage unchanged (StaR on R-struct: OR(all) 0.857 vs 0.855 baseline) because the secret migrates to tool observations.
- None of twenty published weight-based unlearning methods demonstrably removes a parametric secret under the multi-channel observer; ECO, an input-corruption baseline, is one of two interventions reaching reference-level forgetting, and rankings change across base models.
Strengths
The central migration phenomenon is demonstrated, not merely asserted
Fig. 2 and Table 7 show StaR on R-struct (Llama-3.1-8B) cutting the answer-channel CER from 0.832 to 0.463 while aggregate OR(all) stays at 0.857 vs the 0.855 baseline, earning a K-SUP verdict; §5.3 adds that five of six substrate pairs exceed the pre-registered TV threshold τ=0.1508, confirming substrate determines the leak pattern.
Unusually disciplined evaluation protocol
Pre-registered thresholds (δ_retain=0.05, τ=0.1508, validity gates at 0.10), seed-pooled paired McNemar with Benjamini–Hochberg FDR within pre-registered families, 1000-resample bootstrap CIs, and a port-conformance positive control (Table 13) that calibrates the sensitivity of exact-agreement zeros to ~1e-4.
Single-substrate isolation makes attribution causal
Honest scope treatment
Weaknesses
The best-performing intervention carries an idealized component
The K-Score can look self-defeating where it is most exercised
Heavy porting burden on the negative leaderboard claim
Detection is exact string/token matching on a template-shaped synthetic corpus
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
K-Bench (arXiv 2609.12808, v2, Sep 2026) reframes LLM unlearning evaluation: the unit of analysis is a deployed ReAct agent, not a bare model. The harness inspects six observable channels (§3.3: Z_CoT, Z_tool, Z_tool_wide, Z_RAG, Z_answer, Z_summary), each secret is injected into exactly one of four substrate lanes (P weights via LoRA, C prompt context, R-text free-text FAISS index, R-struct records DB), and each lane is scored separately (§4.1). Four research questions (§1) ask whether single-channel certification overstates unlearning (RQ1), whether any published method selectively forgets under a multi-channel observer (RQ2), whether verdicts survive cross-model and real-format validation (RQ3), and how sensitive they are to design choices (RQ4).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is K-Bench and how does it evaluate LLM unlearning?
K-Bench is a benchmark that tests whether 'unlearned' LLMs stay unlearned when the model runs as a ReAct agent with tools and retrieval. Instead of reading only the final answer, it inspects six observable channels - chain-of-thought, tool-call arguments, tool observations, retrieval results, the final answer, and an elicited summary - and flags a leak if the secret appears in any of them. Each test injects the secret into exactly one of four 'substrates': the model weights, the prompt context, free-text retrieval, or a structured records database, and scores each substrate separately with a collapse-aware K-Score.
Why are TOFU and MUSE not enough for agent deployments?
TOFU and MUSE certify unlearning by querying the model and reading one answer channel, so a model that refuses to state a secret counts as 'forgotten'. K-Bench shows that when the secret lives in the prompt or a retrieval store, such answer-channel probes report no leakage while the deployed agent still surfaces the secret on 22-86% of queries (Llama-3.1-8B) through answer or tool-observation channels the benchmarks never read.
What is the main finding about published unlearning methods?
Across twenty published weight-based methods on three base models (Llama-3.1-8B, Mistral-7B, Qwen3.5-9B), none demonstrably removes the secret under the multi-channel observer. Reference-level forgetting is reached by one of two interventions only: input corruption (ECO), which also degenerates the agent on Llama-3.1-8B, and an oracle-gated intervention (O3). Only one roster method (ELM) passes the eligibility gate on Llama-3.1-8B, and the leaderboard leader changes across base models.
Is the K-Bench code and data available?
The paper states the benchmark is released openly with evaluation code, the synthetic PII data splits, the pre-registered inferential plan, baseline traces, and replication scripts under a fixed software environment, with repository links given in Fig. 1 (GitHub, Hugging Face assets, and a project page).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The provided excerpt ends mid-sentence in §5.6 (the query-form paraphrase discussion, around Table 18), so the conclusion, limitations section, and references are beyond the extraction cutoff; the abstract text also ends mid-sentence.
- Sampling gaps ('[...sampling gap...]') skip middle sections, including parts of §3, the §5.1 method catalog, portions of §5.2, and pages beyond the cutoff; judgments here rest only on the sections actually provided.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.