reviews: 
Comments: The paper is very well written. The paper defines a new problem: tool-unlearning, by setting its goal and evaluation criteria. Then, it devises a simple and effective approach to solve it given their definition. Next, it proposed an efficient novel way to evaluate tool-unlearning by adapting a well-established method in the field to their setting. Lastly, it describes a set of experiments on three models and summarizes their results.

The goal of tool-unlearning is to reduce the model ability to perform a (tool-related) task(s), while not damaging the general performance of the model on other tasks/tools.

The evaluation is an adaptation of LiRA, a Membership Inference Attack approach to measure unlearning.

The SFT approach is simply to train the model to perform poorly on the set of tools to be unlearned, while also training on the tools to be retained, while aslo regularizing with the set of original weights to maintain performance on other skills. This is a direct implementation of the aforementioned goal of the approach. A similar approach is taken using DPO.

LiRA-tool, similar to LiRA, proposed to approximate the distribution losses Q_in and Q_out, that describe models that were trained and that were not trained using the unlearned-tools. Here, due to the complexity of LiRA they propose to prompt GPT-4 with various instructions to draw samples of Q_in and Q_out. 

The experimental-setup is based on three task-augmented models: ToolAlpaca, ToolLLaMa and Gorilla.
Strengths: This paper presents its ideas with exceptional clarity, making it remarkably easy to follow and comprehend. The two proposed variants of tool-unlearning are both straightforward and effective, and the experimental setup is extensive. The results are also very impressive, convincingly demonstrating the power of their method in achieving the tool-unlearning goal.
Weaknesses: The main weaknesses of the paper are: the importance of the paper, the contribution, and the soundness.

Importance:
1) It is unclear in which situations tool-unlearning would be preferred to what I consider to be the default which is to restrict the tool itself as opposed to the model. From a security standpoint if the model possess an ability to abuse a tool, or a service using a tool, the protection should be taken care of at the tool/service side as opposed to the client/model in this case.

2) Additionally, if tool-augmentation takes place after pretraining and instruction-finetuning, as presented in Figure 1, it might not be too costly to retrain the Instruction-finetuned model without some of the tools, relatively cheaply and fastly.

Contribution:
1) Given the proposed definition tool-unlearning amounts to reducing the model's capacity on certain tasks. Reduced skill-performance doesn't provide any insight on the main of goals of knowledge / sample unlearning, and therefore the paper have very little to do with unlearning, aside from reframing already known approaches for training models to behave with accordance to a wanted behavior.

Soundness:
1) Measuring tool-knowledge by prompting might not suffice. In a scenario in which the model weights are shared, maybe a bit of unintentional fine-tuning will recover the tool-knowledge. Or, there could exists other prompts that are able to elicit the model's ability to use a tool.

2) LiRA-Tool limitations needs to be evaluated - in order to establish trust in the newly proposed approach to evaluate tool-unlearning, it is crucial to show evidence or justification for the GPT-4 "shadow-samples" as means to approximate Q_in / Q_out efficiently, what is the quality and robustness of this approximation?
Recommendation: 5
Reviewer confidence: 2
Soundness/correctness: 2
Clarity: 4