Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents

• URL: http://arxiv.org/abs/2608.15939v1
• Date: Sun, 16 Aug 2026 21:49:38 GMT
• Title: Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents
• Abstract summary: Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript.<n>We show this breaks when the serving session retains key/value ( KV) state across the logical abort.<n>We show that transaction-local cache restoration closes the channel without requiring a global cache flush.
• Score: 5.717981279944186
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.

Related papers

• Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents [12.985773309621964]
  Provenance-Guided Selective Replay attains bound as a cross-layer contract spanning prompt, compressed memory, and cache.<n>We audit with elicitation, cache, and string-free behavioral tests across three agent suites, nine baselines, and three model families.
  arXiv  Detail & Related papers  (2026-09-04T08:31:40Z)
• ANCHOR: A Vision for Secure Persistent Key-Value Stores in Disaggregated Data Centers [5.04954154165985]
  ANCHOR is a vision for end-to-end integrity and freshness in disaggregated PKVS.<n>This paper presents ANCHOR, a vision for end-to-end integrity and freshness in disaggregated PKVS.
  arXiv  Detail & Related papers  (2026-08-28T01:37:51Z)
• KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation [53.952294884822955]
  Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials.<n>We present KeyPooling, a measurement method that traces customer identity through cache lookup and write.<n>We derive a defense contract: every customer must enter a provider-enforced domain.
  arXiv  Detail & Related papers  (2026-08-18T08:12:34Z)
• Archer: Adaptive Reuse of Cached Hidden States for Efficient Rollback in Diffusion Language Models [28.20034213862415]
  Diffusion language models (DLMs) iteratively refine a sequence, allowing earlier predictions to be revised as context evolves.<n>Every denoising update alters the global context, forcing both prompt and response states to be recomputed.<n>We introduce Adaptive Reuse of Cached Hidden States for Efficient Rollback (Archer)<n>Archer is a training-free KV caching method for rollback-capable DLMs.
  arXiv  Detail & Related papers  (2026-08-08T12:13:10Z)
• Back from the Future: Key-Value Cache Management by Counter-Causal Surprise [67.1056509495879]
  Key-value (KV) cache management through compression and eviction strategies has emerged as an important research direction in recent years.<n>We propose a simple yet effective KV eviction scheme motivated by the insight that past tokens which can be well-predicted from more recent tokens are redundant.<n>We evaluate our strategy on various open-source LLMs and benchmark datasets showing competitive or improved performance over other state-of-the-art methods.
  arXiv  Detail & Related papers  (2026-07-30T02:42:51Z)
• Remembering Distinct Items, Not Tokens: A Learnable Dirichlet-Process Cache Between State-Space Models and Attention [0.48342038441006796]
  We study a sparse cache that allocates a slot only when an input is novel, so its size tracks the number of distinct items rather than the number of tokens.<n>We develop it in two forms, a static cache with a fixed concentration and a surprise-adaptive variant whose concentration follows the recent novelty rate.
  arXiv  Detail & Related papers  (2026-07-10T18:28:21Z)
• Position Rebinding Cache Reuse: Replay-Free Visual Revisiting for Interleaved Multimodal Reasoning [51.563653495547335]
  multimodal reasoning improves visual grounding by revisiting visual evidence during multi-step generation.<n>We propose Position Rebinding Cache Reuse (PRCR), a cache-level framework for replay-free visual revisiting.<n>PRCR achieves replay-level or better performance, improving average accuracy by 5 percent and reducing visual-revisiting by up to tens of thousands of times.
  arXiv  Detail & Related papers  (2026-06-25T05:47:52Z)
• Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG [17.045113249152234]
  We introduce the first end-to-end side-channel attack targeting non- KV cache fusion.<n>SpliceLeak executes a systematic two-phase privacy breach.<n>SpliceDefense effectively flattens the side-channel signal (Delta TTFT 0) with negligible throughput overhead.
  arXiv  Detail & Related papers  (2026-06-20T02:28:28Z)
• Make Each Token Count: Towards Improving Long-Context Performance with KV Cache Eviction [65.710271475739]
  We introduce a global retention-based KV eviction method that learns each token's future utility under a unified memory budget.<n>We show that our method substantially reduces KV memory while matching or surpassing full-cache inference.<n>These results suggest that learned, globally calibrated KV eviction is not only a compression technique, but also a mechanism for improving long-context reasoning.
  arXiv  Detail & Related papers  (2026-05-10T16:47:50Z)
• Sparse Prefix Caching for Hybrid and Recurrent LLM Serving [0.7284556903703034]
  We formalize sparse prefix caching as checkpoint placement under a distribution over overlap depths.<n>For use cases where requests share a non-trivial prefix, we show that our method consistently improves the frontier traced by standard asymmetry on real-world data.<n>It preserves exact outputs, does not change the recurrent computation itself or require new recurrent update kernels.
  arXiv  Detail & Related papers  (2026-04-17T09:24:58Z)
• PackCache: A Training-Free Acceleration Method for Unified Autoregressive Video Generation via Compact KV-Cache [61.57938553036056]
  We introduce PackCache, a training-free KV-cache management method that compacts the KV cache through three coordinated mechanisms.<n>In terms of efficiency, PackCache accelerates end-to-end generation by 1.7-2.2x on 48-frame long sequences.
  arXiv  Detail & Related papers  (2026-01-07T19:51:06Z)
• vCache: Verified Semantic Prompt Caching [95.16654660556975]
  This paper proposes vCache, the first verified semantic cache with user-defined error rate guarantees.<n>It employs an online learning algorithm to estimate an optimal threshold for each cached prompt, enabling reliable cache responses without additional training.<n>Our experiments show that vCache consistently meets the specified error bounds while outperforming state-of-the-art static-threshold and fine-tuned embedding baselines.
  arXiv  Detail & Related papers  (2025-02-06T04:16:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.