Language model agents fail to enforce memory revocation reliably
Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
Artificial IntelligenceCryptography and Security
Summary
Some language-model agents keep facts in memory even after those facts have been marked as wrong or outdated, a practice called soft revocation. The authors studied five such systems and found that none properly prevent these outdated facts from being retrieved or used. As a result, agents could act on false information despite warnings. To address this, the authors created a tool that blocks revoked or conflicting memories before the agent can use them.
What this means in practice
- •For ai system developers: Add a middleware guard to memory backends that withholds revoked or conflicting facts, improving agent safety by preventing outdated knowledge use.
- •For security engineers: Improve enforcement of revoked policies in AI agents to reduce the risk of unsafe automated actions caused by outdated information.
Authors
Yi Ting Shen, Kentaroh Toyoda, Alex Leung
Abstract
Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.