Search papers, labs, and topics across Lattice.
The authors systematically evaluate soft revocation enforcement across five persistent agent-memory systems by seeding them with superseded policies and tracking whether nine LLMs retrieve and execute the invalid facts across nine scenarios and six defense conditions. Every evaluated system failed to enforce revocation by default, frequently retrieving and ranking revoked policies higher than their valid replacements and triggering unsafe downstream agent actions. To mitigate this vulnerability, the authors build and benchmark a memory-agnostic guard layer that intercepts retrieval to filter out revoked and conflicting records before generation.
Across five major agent-memory frameworks, "soft-deleted" facts not only leak into context by default鈥攖hey actively outrank valid replacements and cause models to execute unsafe actions.
Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.
