Agent memory systems fail to block revoked facts causing unsafe actions
Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
Artificial IntelligenceCryptography and Security
Summary
Some AI systems remember information over time but sometimes wrong facts need to be canceled or revoked. The authors tested five systems to see if these revoked facts were properly ignored when the AI retrieved memories. They found that none of the systems reliably blocked revoked facts, which often were still used and caused unsafe decisions by the AI. To fix this, the authors created a guard that filters out revoked or conflicting memories before the AI sees them.
long-running language-model agentspersistent memorysoft revocationrevocation enforcementmemory retrievalagent behaviorpolicy scenariosmemory backendconflicting factsAI safety
Authors
Yi Ting Shen, Kentaroh Toyoda, Alex Leung
Abstract
Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.