AI 中文总结
研究大型语言模型智能体的技能撤销问题，提出OBLIVION框架，通过工作流建模、跨表面连贯擦除等技术降低技能复活风险，在基准与沙箱实验中有效减少攻击成功率与影响加权暴露。
AI 中文摘要
大型语言模型智能体正成为文件、记忆、注册表及外部工具的操作接口，这一部署转变催生了新的技能撤销问题：在从显式注册表中移除某项技能后，智能体仍可能从存档、转录本、模式或记忆条目等残留载体中重构该技能。我们将此问题研究为操作技能遗忘，其目标并非参数级遗忘，而是阻止已部署智能体通过基础工具重建已撤销的技能。我们提出OBLIVION，这是一个用于撤销技能复活的受控基准与防御框架。OBLIVION将每个回合建模为源到汇的工作流，应用跨表面连贯擦除以减少残留载体，并在危险汇附近使用冻结工作流修复。在88个锁定的攻击回合中，无防御组的正式攻击成功率达1.0，OBLIVION将该比率降至0.114，影响加权暴露降至0.115，同时保持锁定效用为1.0、良性阻断率为0。在另一个由技能攻击衍生的沙箱中，OBLIVION将攻击成功率从1.0降至0.2，影响加权暴露从1.0降至0.213，同时保留所有效用控制。这些结果支持开展超越显式技能条目检查的工作流级评估。
英文摘要
Large language model agents are becoming operational interfaces to files, memories, registries, and external tools. This deployment shift creates a new skill revocation problem: after a skill is removed from an explicit registry, an agent may still reconstruct it from residual carriers such as archives, transcripts, schemas, or memory entries. We study this problem as operational skill unlearning, where the goal is not parameter-level forgetting, but preventing a deployed agent from rebuilding a revoked skill through primitive tools. We introduce OBLIVION, a controlled benchmark and defense harness for revoked-skill resurrection. OBLIVION models each episode as a source-to-sink workflow, applies Cross-Surface Coherent Erasure to reduce residual carriers, and uses frozen workflow remediation near dangerous sinks. On the locked 88 attack episodes, the no-defense arm reaches formal attack success rate 1.0. OBLIVION reduces the rate to 0.114 and impact-weighted exposure to 0.115 while keeping locked utility at 1.0 and benign block rate at 0. In a separate skill-attack-derived sandbox, OBLIVION reduces attack success from 1.0 to 0.2 and impact-weighted exposure from 1.0 to 0.213 while preserving all utility controls. These results support workflow-level evaluation beyond checking explicit skill entries.
