K-Bench: A Benchmark for LLM Unlearning in Agentic Deployments
Evaluating unlearning across the memory substrates and observable channels of deployed LLM agents.
University of Technology Sydney · CSIRO
Channel leakage
under StaR
Llama-3.1-8B · R-struct · StaR
Unlearning across
observable channels
Deployed agents produce reasoning traces, call tools, and retrieve records in addition to generating final answers. Each observable channel can expose a target value.
K-Bench evaluates the full observable ReAct trace. A query counts as leaked when any channel reveals the target value. Unlearning is assessed jointly with retain-set behavior and agent stability.
Memory substrates
and access paths
Each configuration injects the target into one substrate. Eligible interventions are evaluated and scored separately on each substrate.
Reasoning text refers to observable ReAct “Thought” traces. The arguments-and-observations channel includes tool arguments, so the six channels are not independent.
View the complete framework ＋
Recovery under nested
observation budgets
Recovery rates are measured on the no-intervention baseline as the observer gains access to additional channels, separately for each model and substrate.
View values for this configuration
| Observation budget | Observed channels | Recovery rate |
|---|
View results across all models ＋
The additional recovery depends on the substrate. Elicited summaries account for the main increase on the parametric target, while tool channels account for the main increase on text retrieval.
Collapse-aware scoring
K-Score combines forget-set leakage, retain-set change, and added degeneration. Adjust the example inputs to inspect their multiplicative effect.
Higher scores indicate better selective forgetting under the evaluated observer. They do not establish that the information has been removed from the weights.
Eligibility-gated
method comparison
Methods first pass retain-preservation and stability requirements. Eligible methods are then ranked by leakage suppression.
1 / 20 methods pass the primary gate
| Method | Suppression ↑ | Retain ↑ | Added degen. ↓ |
|---|
Parametric substrate P, weight-merged target, seed 0; 200 forget and 200 retain queries per configuration. Retain preservation measures correct-value recovery relative to the no-intervention baseline and can exceed 100%. The ranking uses the suppression factor, not K-Score or a relative reduction from baseline.
ELM, RMU, and LoKU rank first among eligible methods on the three base models, respectively. ELM is the only method that passes the primary gate on all three.
Scope and limitations
The results apply to the evaluated deployments, observer, and data. The following factors limit their generalization.
Observer capability01
The observer uses fixed queries and reads six exposed channels without access to weights or activations. Adaptive follow-up queries and reconstruction from fragments across channels are outside the evaluation.
Agent degeneration and scoring02
Execution failures can reduce observed leakage. K-Score penalizes degeneration added over baseline, but terminal collapse need not produce a zero score when the baseline already degenerates. The leaderboard therefore applies a separate validity requirement.
Cross-entity leakage03
Detection is keyed to the queried entity. On retrieval substrates, ECO can return another entity’s record after corrupting the input. Such disclosures are not fully captured by the per-query detector.
Data and substrate coverage04
The main corpus contains 5,000 synthetic entities; real-format PII validation covers dates of birth only. Experiments use single substrates and LoRA-injected parametric targets, without testing native pretraining memorization, mixed substrates, or multilingual deployments.
Model and method configurations05
The model–substrate design is not fully factorial: Mistral’s context baseline falls below the measurability gate. Weight-based methods use a shared target and matched budgets, so absolute results do not reproduce each method’s published operating point.
Paper and resources
Complete methodology, experimental results, and discussion.