Summary
When teams of language models work together, making them forget sensitive or unwanted information becomes harder because clues from their combined messages can reveal what was supposed to be forgotten. The authors find that controlling just the final answers or the individual messages is not enough to prevent recovery of forgotten information. They propose a new method, called Aggregation-Conditioned Unlearning (ACU), which trains the shared model by considering how individual and combined messages might leak information, reducing recovery risks while keeping the team’s task performance. This approach cuts down the chance of unwanted information being recovered during collaboration without hurting usefulness.
What this means in practice
- •For enterprise ai development teams: Help maintain privacy and compliance by effectively removing sensitive data from collaborative AI models while keeping their task abilities intact.
- •For cybersecurity automation teams: Improve automated forgetting of confidential information in multi-agent AI setups to reduce risk of data leakage during shared problem solving.
Authors
Hengsong Liu, Liangyu Teng, Jingnan Cai, Yuntian Shi, Jingyu Zhang, Yang Liu, Jing Liu, Liang Song
Abstract
LLM unlearning is essential for removing sensitive or unwanted knowledge while preserving useful capabilities. As LLM teams are increasingly used to solve complex problems, forgetting must remain effective during collaboration. Despite advances in forgetting effectiveness, efficiency, and robustness to relearning, team deployment remains underexplored. We find that collaboration weakens forgetting: final-answer evaluations miss recoverable evidence in team messages, including complementary clues supporting joint recovery. We establish theoretically and confirm empirically that controlling final answers or individual messages does not ensure low recovery from their combination. To address this challenge, we propose Aggregation-Conditioned Unlearning (ACU). ACU trains a shared model using reconstruction feedback from individual and pooled messages, prioritizes views with higher recovery risk, and uses replacement-based credit assignment while protecting direct and collaborative utility. TOFU evaluates trajectory-level recovery, while WMDP-bio tests native forgetting and retained utility. On TOFU, ACU lowers full-trajectory recovery from 41.8% to 19.3% in ROUGE-L recall and factual recovery from 34.2% to 18.7% versus output-supervised training, with comparable retained-task performance. These results demonstrate that ACU curbs information leakage in LLM teams and generalizes across team sizes and readers.