Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
On the map: LLM agents and tool use → Agent memory systems
Abstract (arXiv)
Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Agent memory systems, one of 16 directions in LLM agents and tool use. Builds on 16 of its 18 references that are in the map. First posted on arXiv 8 Sep 2026.
Builds on
16 of 18 references.
Closest ancestors · 3
Same direction, newest first
- 2026Temporal Validity in Retrieval Memory: Eliminating Stale-Fact Errors for AI Agents over Evolving Knowledge25 Jun
- 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory28 Apr
- 2025Zep: A Temporal Knowledge Graph Architecture for Agent Memory20 Jan
Other references · 13
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
- 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 365
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
- 2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 144
- 2025MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrievalcited by 72
- 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injectionscited by 48
- 2026From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agentscited by 33
- 2026A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecyclecited by 27
- 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 18
- 2025VersionRAG: Version-Aware Retrieval-Augmented Generation for Evolving Documentscited by 6
- 2026Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defensecited by 6
- 2026ConflictRAG: Detecting and Resolving Knowledge Conflicts in Retrieval Augmented Generationcited by 4
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026What Eviction Destroys: A Restore-Counterfactual Audit of Forgetting in Agent Memory
- 2026Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents
- 2026From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents
- 2026When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary
- 2026Always-OnAgents:A Survey of Persistent Memory, State, and Governance in LLMAgents
- 2026Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents
- 2026Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
- 2026Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the Stability and Safety Governed Memory (SSGM) Framework