Eternal Sunshine of the Spotless Mind: Systematically Erasing LLM's Memories
Not on the map. Why?
Abstract (arXiv)
We consider persistent LLMs that accumulate memories of their interactions with a user over time. Such LLMs maintain memories using external storage, which they can query to overcome the limitations of a fixed context window. Such systems have numerous practical applications, as they can draw on all past interactions when responding to user queries. In this paper, we ask whether LLMs can forget information shared with them upon a user's request. We find that current LLMs fail to delete such information---even when they claim to have forgotten it and even when operating with a limited context. To this end, we consider a new direction of study: Deletion of LLM Memories. We show that naively removing messages that match a user's deletion request is insufficient, since conversations naturally introduce message dependencies that cause information to persist. To correctly handle deletion requests, we propose the DeLLM framework. It dynamically constructs relevant context for each LLM query and maintains a provenance graph of messages to determine which ones must be removed during deletion. Our experiments show that DeLLM achieves a high deletion rate while maintaining utility.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 24 of its 40 references that are in the map. First posted on arXiv 29 Sep 2026.
Builds on
24 of 40 references.
References · 24
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,455
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
- 2025A-MEM: Agentic Memory for LLM Agentscited by 1,063
- 2019Machine Unlearningcited by 1,061
- 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 634
- 2023MemoryBank: Enhancing Large Language Models with Long-Term Memorycited by 556
- 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 533
- 2023Who's Harry Potter? Approximate Unlearning in LLMscited by 381
- 2021Beyond Goldfish Memory: Long-Term Open-Domain Conversationcited by 267
- 2023Unlearn What You Want to Forget: Efficient Unlearning for LLMscited by 215
12 more
- 2023Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attackscited by 158
- 2025Securing AI Agents with Information-Flow Controlcited by 121
- 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
- 2024AirGapAgent: Protecting Privacy-Conscious Conversational Agentscited by 94
- 2024Inexact Unlearning Needs More Careful Evaluations to Avoid a False Sense of Privacycited by 82
- 2025RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakagecited by 69
- 2023Prompted LLMs as Chatbot Modules for Long Open-domain Conversationcited by 61
- 2024MemLLM: Finetuning LLMs to Use An Explicit Read-Write Memorycited by 35
- 2025Contextual Integrity in LLMs via Reasoning and Reinforcement Learningcited by 31
- 2024GPTCoach: Towards LLM-Based Physical Activity Coachingcited by 29
- 2023Rethinking Privacy in Machine Learning Pipelines from an Information Flow Control Perspectivecited by 16
- 2025Episodic memory in AI agents poses risks that should be studied and mitigatedcited by 11
Built on by
Not cited yet.