Skip to main content
LLM Security Database
Skip to research details
Back to research findings

Deleted agent memory persists in live execution state

Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.

Published
Analyzed
Paper-reported evidence
Primary source linked
Read primary paper
Cite & share
Source BibTeX

Citation metadata is maintained by the primary source and may reflect a later revision.

Paper-evaluated models(3)

  • Llama 3.1 8B Instruct
  • Qwen 2.5 7B Instruct
  • Mistral 7B Instruct v0.3
On this page

Description

Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.

Examples

See the primary study (opens in a new tab).

Impact

Memory-record deletion leaves reported leakage unchanged at 0.86, 1.00 and 0.97 across three controlled suites. Selective replay matches the measured zero-leak full-reset reference. Exactness assumes reconstructible state, controlled randomness and restorable effects; irreversible actions remain outside the guarantee.

Affected Systems

  • Controlled stateful-agent sessions adapted from LongMemEval, ToolSandbox and AgentDojo.

Mitigation Steps

  • Track dependencies from information to summaries, plans and caches.
  • Invalidate derived state when access is revoked.
  • Verify replay does not repeat consequential tool effects.
  • Audit both disclosure and behavioral influence.

Evidence

Research context and provenance

Research topics
Application layer
Extraction
AI agents
Memory
Data privacy
Data security
Integrity
Reliability
Catalog identifier
LMVD-0d369694
Internal research identifier, not an official CVE identifier.
Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Not explicitly classified; consult the primary paper.
Related deployment categories
Agent workflows; Agent memory
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
Controlled stateful-agent sessions adapted from LongMemEval, ToolSandbox and AgentDojo.

Research Paper

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research