Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.
Researchers tested five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, tracking whether revoked facts are returned and acted upon. No system enforces revocation by default: revoked records are returned whenever the revocation label is visible to the retrieval layer, outrank their replacements, and lead agents to unsafe actions. The authors propose a backend-agnostic guard that sits between the agent and any memory store and withholds revoked or conflicting records at retrieval time.
- Soft-revocation marks are not enforced at retrieval time
- Revoked facts outrank their replacements and drive unsafe agent actions
- Evaluated nine models and nine policy scenarios under six defense conditions
- Proposed guard withholds revoked or superseded records from retrieval
From the original article
1 min read at arxiv.orgLong-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined.
By Yi Ting Shen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.