Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.
Researchers tested five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, tracking whether revoked facts are returned and acted upon. No system enforces revocation by default: revoked records are returned whenever the revocation label is visible to the retrieval layer, outrank their replacements, and lead agents to unsafe actions. The authors propose a backend-agnostic guard that sits between the agent and any memory store and withholds revoked or conflicting records at retrieval time.
- Soft-revocation marks are not enforced at retrieval time
- Revoked facts outrank their replacements and drive unsafe agent actions
- Evaluated nine models and nine policy scenarios under six defense conditions
- Proposed guard withholds revoked or superseded records from retrieval
Full article149 words · extracted from arxiv.org · click to collapse
Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.08258