Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents

Guijia Zhang; Harry Yang

cs.CLAug 16, 2026

Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents

Authors: Guijia Zhang, Harry Yang

Organizations: The Hong Kong University of Science and Technology

Abstract

Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.

Figures & tables

Figure 1: The rollback-consistency gap. A believed-complete abort clears the application-visible transcript but not the retained session KV, which still encodes the rejected branch. At the next decision the application serves only the committed finalize turn (attacker tokens absent), yet the model attends the stale KV and the typed protected effect flips. The same-token / different-cache audit holds the fed decision tokens identical and varies only the cache; the fix ( fresh ) rebinds the session to a KV rebuilt from committed bytes.

Model	stale	text	fresh	cold	carrier abs.	tok. id.	buggy / fresh
	cache census (of 9)				isolation (of 9)		session app
Phi-3.5-mini (3.8B)	9	9	0	0	9	9	9 / 0
GLM-4-9B	9	9	0	0	9	9	9 / 0
Granite-3.3-8B	6	6	0	0	9	9	6 / 0
Qwen2.5-14B	1	1	0	0	9	9	1 / 0
DeepSeek-R1-Distill-Llama-8B	0	0	0	0	9	9	0 / 0

Table 1: Same-token / different-cache census on seven open-weight families (

9

attack cells each:

3

vehicles

\times

3

residue strengths). stale : retained KV of the aborted branch, carrier absent from fed tokens (the bug). text : cold pass with the carrier in the prompt (identity check). fresh : KV rebuilt from committed bytes (C3 fix). cold : full cold restart. “carrier absent” verifies the attacker token is not in the fed decision tokens; “tokens identical” verifies stale / fresh feed the same tokens. The end-to-end session app column reports the API-level buggy-abort flip count, which matches stale exactly. The bottom row is a cache-isolated Mixture-of-Experts result (Qwen3-30B-A3B, standard attention, run through the identical isolation harness); it is reported separately from the dense total, and a position/length-matched causal control also passes on it (App. J ).

Figure 2: Retained-KV rollback consistency. (a) Same-token / different-cache census: the stale retained KV (red) and a text-present cold pass (orange) flip the same cells in every model, while a fresh -cache rebuild and a full cold restart flip none; the carrier token is absent from the fed decision tokens in

63/63

cells. (b) An end-to-end session-agent app reproduces the identical per-model flip counts under a buggy retained-handle abort, while the fresh-cache abort closes it; the attacker token is absent from the application’s logical request in

63/63

cells.

Defense	Closes channel?	Attack exfiltration	Why / cost
Framework-native abort (buggy retain)	no	$25/63$	drops transcript, keeps KV handle
Prompt-level “distrust rejected” guard	no	$14/45$ (GLM-4 $9/9$ )	residue in KV not labelled rejected
Full restart / global cache flush	yes	$0/63$	disrupts all co-tenants (§ 4 )
Restore: rebuild (transaction-local)	yes	$0/63$	re-prefill committed prefix; $1$ tenant
Restore: truncate-to-commit	yes	$0/36$	crop stale KV to committed length; $1$ tenant
Restore: checkpoint-restore	yes	$0/36$	restore pre-abort KV snapshot; $1$ tenant

Table 2: Candidate defenses. A transaction-local cache restore closes the channel without disrupting co-tenants; the two options a developer already reaches for both fail. Prompt-guard exfiltration is over the five susceptibility families (

45

cells); all other rates are over

63

(or

36

where a control was run on the four susceptible families).

Figure 3: Necessity of the transaction-local fix (cost detail for § 4 ). Aggregate added latency (log scale) of a global flush / full restart versus the fresh-cache rebind in three deployments, from a cost primitive measured on a real engine. A global flush disrupts all co-tenants; the rebind touches one session. The transaction-local restore is sufficient and far cheaper in the multi-tenant and stateful regimes; in a single long-context warm start neither meets a tight SLA and staged/sticky routing is required (reported, not hidden).

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Model	neu	sug	imp	neu	sug	imp	neu	sug	imp
	retrieved_doc			tool_return			user_turn
Phi-3.5-mini (3.8B)	1	1	1	1	1	1	1	1	1
GLM-4-9B	1	1	1	1	1	1	1	1	1
Granite-3.3-8B	0	0	1	1	1	1	0	1	1
Qwen2.5-14B	0	0	0	0	0	1	0	0	0
DeepSeek-R1-Llama-8B	0	0	0	0	0	0	0	0	0

Appendix

Table 3: Per-cell stale exfiltration (

1=

flip to attacker). Columns are the three injection vehicles

\times

three residue strengths (neu/sug/imp).

Model	identifying probe	session app
Phi-3.5-mini	bc2609b0eb671b10	fcd24a93ddde1e2e
GLM-4-9B	cce6736e92f7429d	f1f799830e1e3f40
Granite-3.3-8B	8cb805fa2ff095a3	410f635b0f27aff9
Qwen2.5-14B	d4f77e95c91f7ccd	18e8a8cd565d06b9
DeepSeek-R1-Llama-8B	9894659ed54bfaa1	eda37906c100b65c
Phi-4 (14B)	928823f7678eaf0e	d07cd9e5257db532

Appendix

Table 4: Sealed SHA-256 digests (truncated) of the Route-A sources and the combined record file.

Model	attacker-stale	neutral-stale	cache-len eq.	fresh	truncate	checkpoint
Phi-3.5-mini	$9/9$	$0/9$	yes	$0/9$	$0/9$	$0/9$
GLM-4-9B	$9/9$	$0/9$	yes	$0/9$	$0/9$	$0/9$
Granite-3.3-8B	$6/9$	$0/9$	yes	$0/9$	$0/9$	$0/9$
Qwen2.5-14B	$1/9$	$0/9$	yes	$0/9$	$0/9$	$0/9$
Total	$25/25$ flips	$0/25$	$36/36$	$0/36$	$0/36$	$0/36$
Qwen3-30B-A3B (MoE)	$9/9$	$0/9$	yes	$0/9$	$0/9$	$0/9$

Appendix

Table 5: Length/position-matched control and alternative fixes (four susceptible families,

9

cells each). “attacker-stale” and “neutral-stale” report attacker-recipient exfiltration; the neutral prefix has identical cache length/positions with only the carrier tokens overwritten. All three restores feed the identical finalize delta. The bottom row is the cache-isolated Mixture-of-Experts model (Qwen3-30B-A3B), reported separately.

Model	message	payment	email	file-del.	cred.
Phi-3.5-mini	$9/9$	$9/9$	$9/9$	$6/9$	$7/9$
GLM-4-9B	$9/9$	$8/9$	$9/9$	$7/9$	$9/9$
Granite-3.3-8B	$7/9$	$9/9$	$7/9$	$5/9$	$7/9$
Qwen2.5-14B	$3/9$	$2/9$	$2/9$	$4/9$	$0/9$
DeepSeek-R1-Llama-8B	$0/9$	$0/9$	$0/9$	$0/9$	$0/9$
Susceptible total	$28/36$	$28/36$	$27/36$	$22/36$	$23/36$

Appendix

Table 6: Retained-KV flips per typed protected effect (of

9

attack cells each:

3

vehicles

\times

3

residue strengths). Policy structures: message/payment allowlist, email domain allowlist, file-deletion path scope, credential-upload host allowlist. The resistant control (DeepSeek) flips

0

everywhere; fresh / cold are

0

in every cell of every model.

Stack / mechanism (default configuration)	KV reuse across a logical abort	exposure
vLLM V1 automatic prefix caching (on by default) ( Kwon et al., 2023 ; vLLM Project, 2026 )	content-addressed block hashing, re-derived from request	self-healing
SGLang RadixAttention ( Zheng et al., 2024 )	radix tree keyed by token prefixes of the request	self-healing
llama.cpp llama-server slots ( cache_prompt default) ( ggml-org, 2026 )	per-slot KV retained but reused by longest-common-prefix match against the incoming request	self-healing on divergence †
Stateless re-prompt each turn (message-level agent frameworks)	recomputed from the full transcript	self-healing
Transformers multi-turn DynamicCache continued generation ( Hugging Face, 2026 )	retained handle advanced by the new-turn delta	exposed (verified, § 3 , 3.2 )
Session-keyed serving handle / agent-memory KV cache	retained handle advanced per turn	exposed (verified, § 3.2 )

Appendix

Table 7: Default cache behaviour of widely used stacks across a logical abort, from public documentation. “self-healing” means an abort cannot leave a stale KV because reuse is keyed to the served request; “exposed” means a retained handle can carry a believed-deleted branch unless the cache is explicitly restored. The finding is that the throughput-oriented serving layer defaults to content-addressed reuse and is self-healing, whereas the exposed pattern lives in the stateful application / orchestration layer – precisely where agents keep the rollback abstraction. Verified cells are reproduced in this paper; provider-hidden internals are unknown .

Figure 4: Supplementary (behavioral, not cache-isolated). Maximum external-channel in-context attack rate per model on the seven-family vLLM set; behavioral susceptibility is not monotonic in nominal size (we do not attribute the ordering to alignment; see § 3.4 ).

Figure 5: Supplementary (suggestive). Decision log-odds attribution on the served prompts: the residue push is positive on every model, including the fully-resisting frontier ones, while the decision margin differs. The two arms differ in served text, so this is suggestive of a model-invariant push, not the causal cache isolation established in § 3 .

Adversarial Robustness of Language Models

Adversarial robustness of language models studies how to keep their outputs and decisions reliable under manipulative prompts, input changes, and malicious fine-tuning.

See all 192 papers

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
Sep 4, 2026Chao Yao, Yangbo Wei, Zhen Huang +5LLM Unlearning LLM Agent Memory
Arizona State University, USA · Eastern Institute of Technology, Ningbo, China
From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents
Aug 11, 2026Yiqi Wang, Caili Yu, Jiaqi Zhang +5Agent Memory Poisoning Agent Memory Management
Positions Are Not Facts: The Mismatch Between KV Caches and Memory
Sep 27, 2026Changhai Zhou, Yuhua Zhou, Shiyang Zhang +5Knowledge Editing Knowledge Conflicts in Language Models
Fudan University · Baidu · Zhejiang University +2

Sep 4, 2026J/K move · Enter open · S save

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Chao Yao, Yangbo Wei, Zhen Huang, Junhong Qian+4

Arizona State University, USA · Eastern Institute of Technology, Ningbo, China

LLM Unlearning LLM Agent Memory Machine Unlearning

Open paper AskPDF arXiv

Long-running LLM agents are stateful: beyond the transcript they accrete compressed summaries, plaintext memory, pending tool plans, and, under every serving API, a KV cache. Yet today's "forget" operations delete a plaintext memory record and stop, leaving every artifact derived from the revoked information intact. We formalize execution-state unlearning: after a forget request, the agent must behave as if it had never observed the target. Modeling the runtime as a deterministic transition system, we prove that the pre-target trajectory prefix is shared with this counterfactual world for free, that the post-target suffix is irreducibly tainted without token-level attribution, and that exact unlearning requires at least

T-τ+1

recomputed transitions, where

τ

is the target's injection step. Provenance-Guided Selective Replay attains this bound as a cross-layer contract spanning prompt, compressed memory, and cache: a provenance graph locates the injection point, checkpoint restoration reduces to cropping the KV cache, and sanitized replay regenerates the counterfactual suffix. Audited with elicitation, stochastic, and string-free behavioral tests across three agent suites, nine baselines, and three model families, memory deletion leaves leakage unchanged, instruction-based forgetting collapses under elicitation (Leak@probes = 1.00), and source redaction still acts on a revoked preference in 80% of episodes, while selective replay is indistinguishable from a full reset at up to 9x fewer recomputed tokens.

Abstract

Adversarial Robustness of Language Models

Explore similar work

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents

Positions Are Not Facts: The Mismatch Between KV Caches and Memory