mlsanityData to 7 Oct 2026

Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents

arXiv 2608.15939 ↗First posted 16 Aug 2026cs.CLcited by 0

On the map: Efficient LLM inference and serving → Efficient reasoning and agent inference

Abstract (arXiv)

Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Efficient reasoning and agent inference, one of 12 directions in Efficient LLM inference and serving. Builds on 22 of its 29 references that are in the map. First posted on arXiv 16 Aug 2026.

Builds on

22 of 29 references.

Closest ancestors · 3

Same direction, newest first

  1. 2026When Does Latent Communication Pay? A Causal Audit of Relayed KV Caches in Multi-Agent LLMs5 Aug
  2. 2026Compute Globally, Materialize Locally: The Memory Contract of Sparse Event-KV26 Jul
  3. 2026Leyline: KV Cache Directives for Agentic Inference31 May

Other references · 19

  1. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,767
  2. 2020Extracting Training Data from Large Language Modelscited by 2,144
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  5. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  6. 2023SGLang: Efficient Execution of Structured Language Model Programscited by 1,107
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  8. 2023Prompt Cache: Modular Attention Reuse for Low-Latency Inferencecited by 255
  9. 2026Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxescited by 11
  10. 2024Stealing User Prompts from Mixture of Expertscited by 10
  11. 2026DART: Semantic Recoverability for Structured Tool Agentscited by 9
  12. 2026Execution-State Capsules: Graph-Bound Execution-State Checkpoint and Restore for Low-Latency, Small-Batch, On-Device Physical-AI Servingcited by 7
7 more
  1. 2026Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agentscited by 5
  2. 2026KVEraser: Learning to Steer KV Cache for Efficient Localized Context Erasingcited by 4
  3. 2026Models Take Notes at Prefill: KV Cache Can Be Editable and Composablecited by 4
  4. 2026Can an AI Assistant Really Forget? Auditable Deletion from Addressable Memorycited by 3
  5. 2026Continuous Discovery of Vulnerabilities in LLM Serving Systems with Fuzzingcited by 1
  6. 2026ChronoMem: Version Control and Semantic Rollback for Large Language Model Agent Memorycited by 1
  7. 2026HarnessSafe: Evaluating Safety Across Persistent Carriers in Agent Harnessescited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents
  2. 2026Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
  3. 2026CacheReforge: Bounded Recovery for Stale KV Caches under Evolving Adapters
  4. 2026Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
  5. 2026Request Order Matters: Cache-History Sensitivity in Selective KV-Cache Reuse for Rolling Agents
  6. 2026Boundary-State Control for Tool-Using Language-Model Agents: Commit-Time Consistency under State Drift
  7. 2026ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
  8. 2026When Memory Updates but Behavior Does Not: Repairing Implicit Stale Dependencies in Personalized Agent Responses