Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: 0d369694
Paper published September 4, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Deleted agent memory persists in live execution state

Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.

Application layer
Extraction
AI agents
Memory
Data privacy
Data security
Integrity
Reliability
Read primary paperBibTeX citation

Paper-evaluated models(3)

  • Llama 3.1 8B Instruct
  • Qwen 2.5 7B Instruct
  • Mistral 7B Instruct v0.3

Description

Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.

Examples

See the primary study (opens in a new tab).

Impact

Memory-record deletion leaves reported leakage unchanged at 0.86, 1.00 and 0.97 across three controlled suites. Selective replay matches the measured zero-leak full-reset reference. Exactness assumes reconstructible state, controlled randomness and restorable effects; irreversible actions remain outside the guarantee.

Affected Systems

  • Controlled stateful-agent sessions adapted from LongMemEval, ToolSandbox and AgentDojo.

Mitigation Steps

  • Track dependencies from information to summaries, plans and caches.
  • Invalidate derived state when access is revoked.
  • Verify replay does not repeat consequential tool effects.
  • Audit both disclosure and behavioral influence.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Not explicitly classified; consult the primary paper..
Related deployment categories
Agent workflows; Agent memory
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
Controlled stateful-agent sessions adapted from LongMemEval, ToolSandbox and AgentDojo.

Research Paper

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research