Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems

• URL: http://arxiv.org/abs/2609.08258v1
• Date: Tue, 08 Sep 2026 05:03:09 GMT
• Title: Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
• Abstract summary: We measure five agent-memory systems and find no system enforces revocation by default.<n>We develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.
• Score: 1.3891530345631953
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.

Related papers

• Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents [12.985773309621964]
  Provenance-Guided Selective Replay attains bound as a cross-layer contract spanning prompt, compressed memory, and cache.<n>We audit with elicitation, cache, and string-free behavioral tests across three agent suites, nine baselines, and three model families.
  arXiv  Detail & Related papers  (2026-09-04T08:31:40Z)
• Hindsight Memory-PRM: Supervising Memory Management with Auditable Hindsight Credit [48.811961095386]
  Hindsight Memory-PRM exploits this audit trail twice.<n> offline to train an operation-conditioned memory-utility critic.<n>Online, where retrievals, citations, and one controlled deletion-and-reanswer per probe settle an intervention-calibrated entry-level presence credit.
  arXiv  Detail & Related papers  (2026-08-30T06:53:13Z)
• From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents [19.125716338799545]
  textbfdependency-guided rollback repair builds a typed memory-to-action graph from provenance, traces explicit downstream dependencies, and selectively replays only answer-relevant affected computation.<n>We evaluate this approach on a 150-case controlled benchmark spanning three tool-use domains and four memory failure types.
  arXiv  Detail & Related papers  (2026-08-11T05:19:55Z)
• When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary [12.82709779460352]
  LLM agents adapt across tasks by consolidating heterogeneous interaction histories into reusable facts, preferences, observations, and rules.<n>We identify authority collapse, in which consolidation preserves a claim while erasing the source constraints governing its authorized use.<n>We show that memory-driven adaptation must preserve not only what was learned, but also the authority under which it may be reused.
  arXiv  Detail & Related papers  (2026-08-03T04:15:40Z)
• MemOps: Benchmarking Lifecycle Memory Operations in Long-Horizon Conversations [50.24315431387575]
  We introduce MemOps, a benchmark that reformulates conversational memory as a sequence of lifecycle operations.<n>MemOps represents each memory event with a structured trace specifying its trigger, target, scope, state transition, and supporting evidence.<n>Across long-context, retrieval-based, parametric and managed-memory systems, MemOps disentangles failure modes that final-answer accuracy alone conceals.
  arXiv  Detail & Related papers  (2026-07-14T15:33:44Z)
• Always-OnAgents:A Survey of Persistent Memory, State, and Governance in LLMAgents [14.13381700671035]
  Always-on agents are systems whose future behavior depends on durable state accumulated across earlier interactions.<n>We introduce the Always-On Evaluation Protocol (AOEP-v0), a pilot evaluation contract that makes these governance requirements concrete.<n>The resulting agenda connects always-on agents to databases, distributed systems, formal methods, capability security, and machine unlearning.
  arXiv  Detail & Related papers  (2026-06-29T13:47:42Z)
• MEMPROBE: Probing Long-Term Agent Memory via Hidden User-State Recovery [58.64329475683699]
  We argue that long-term memory should be evaluated as an auditable post-interaction artifact.<n>We instantiate this view in MEMPROBE, a benchmark in which a memory-equipped agent assists simulated users.<n>We find that successful assistance and recoverable memory behave as distinct capabilities.
  arXiv  Detail & Related papers  (2026-06-23T13:52:46Z)
• WorldMemArena: Evaluating Multimodal Agent Memory Through Action-World Interaction [72.1620416874118]
  Multimodal large language models are increasingly deployed as long-horizon agents.<n>Existing benchmarks measure recall over static dialogue, collapse memory into a single end-of-task accuracy, and reduce visual observations to captions.<n>We formulate multimodal agent memory as an Action-World Interaction Loop with an observable four-stage lifecycle.
  arXiv  Detail & Related papers  (2026-05-28T04:27:20Z)
• Your Agents Are Aging Too: Agent Lifespan Engineering for Deployed Systems [60.79651380135334]
  Long-lived AI agents are increasingly deployed as persistent operational systems.<n>How long does an agent remain reliable after deployment?<n>We introduce AgingBench, a longitudinal reliability benchmark for agent lifespan engineering.
  arXiv  Detail & Related papers  (2026-05-25T19:55:12Z)
• ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore [3.0122754959023115]
  LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration.<n>This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents.<n>Servers treat these re-generated requests as new, enabling duplicate payments, unauthorized reuse of consumed credentials, and other irreversible side effects.<n>We propose ACRFence, a framework-a mitigation that records irreversible tool effects and enforces replay-or-gnostic semantics upon restoration.
  arXiv  Detail & Related papers  (2026-03-21T03:39:36Z)
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections [57.64370755825839]
  Self-evolving agents update their internal state across sessions, often by writing and reusing long-term memory.<n>We study this risk and formalize a persistent attack we call a Zombie Agent.<n>We present a black-box attack framework that uses only indirect exposure through attacker-controlled web content.
  arXiv  Detail & Related papers  (2026-02-17T15:28:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.