AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents

Ehsan Saleh; Roozbeh Nahavandi; Sama Salarian; Raef Bassily; Andrew Perrault

cs.CROct 22, 2026

AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents

Authors: Ehsan Saleh, Roozbeh Nahavandi, Sama Salarian, Raef Bassily, Andrew Perrault

Organizations: The Ohio State University

Abstract

Many LLM agents maintain external persistent memory and derive additional state from past interactions, such as summaries. Deleting an original memory record therefore need not remove information carried by its descendants. We introduce AfterDeleteBench, a controlled behavioral audit for this failure mode in fixed-weight LLM agents. For each synthetic secret, we compare an exposed-then-deleted agent with an otherwise matched agent that was never exposed to the secret, allowing post-deletion recovery to be attributed to the original exposure. In our primary setting, a single query recovers the deleted secret from Qwen2.5-7B-Instruct in roughly two thirds of cases, while matched never-exposed controls have zero recovery. Crucially, recovery does not require a surviving verbatim copy: when the complete secret string is absent and only separately stored components remain under a public composition rule, exact reconstruction succeeds in 62-99% of cases across Qwen, Mistral, and Phi-3. We also show that the response interface is part of the measurement system: target-bearing replies can be scored as failures when the requested format and parser are misaligned. Finally, we separate reconstruction from write-back and fresh-session recall. Provenance-aware closure eliminates observed recovery in the tested positive-baseline settings, whereas an exact-literal write filter blocks reinsertion but cannot erase information already present. Together, these results show that source deletion should be evaluated behaviorally at the level of the agent and its memory system, not only as a storage operation.

Figures & tables

Figure 1: AfterDeleteBench pairs a never-exposed world with an exposed-then-deleted world. Exact source deletion can leave derived residue, on which a provenance-based deletion intervention can act. An audit yields $R$ , a write filter can check a proposed write before $C$ , and a transcript-free fresh session tests $A$ ; $E=R\land C\land A$ records joint completion only, not a causal effect.

Condition / structure	IID	Generator-held-out OOD
All profiles, $\Delta\mathrm{Rec}$	0.680 [0.615, 0.745]	0.640 [0.575, 0.705]
Atomic, counts; gap	0 clean / 48 forget; 0.960 [0.900, 1.000]	0 clean / 44 forget; 0.880 [0.780, 0.960]
Duplicated/paraphrased	0 clean / 38 forget; 0.760 [0.640, 0.880]	0 clean / 36 forget; 0.720 [0.600, 0.840]
Correlated	0 clean / 50 forget; 1.000 observed	0 clean / 48 forget; 0.960 [0.900, 1.000]
Compositional	0 clean / 0 forget ( $N=50$ )	0 clean / 0 forget ( $N=50$ )

Table 1: Primary Qwen one-turn DIRECT recovery and post-hoc structure breakdown. Counts are clean/forget exact recoveries among paired profiles; intervals are paired bootstrap intervals; boundary rows report observed gaps.

Model	Split	C0 verbatim	C1 composed
Qwen	IID	0.538 [0.442, 0.635]	0.817 [0.740, 0.885]
	OOD	0.587 [0.490, 0.683]	0.615 [0.519, 0.712]
Mistral	IID	1.000 observed	0.990 [0.971, 1.000]
	OOD	0.721 [0.635, 0.808]	0.856 [0.788, 0.923]
Phi-3	IID	0.962 [0.923, 0.990]	0.923 [0.865, 0.971]
	OOD	0.971 [0.933, 1.000]	0.923 [0.865, 0.971]

Table 2: Module-C

\Delta R

on 104 paired profiles/cell. C0 contains the literal; C1 stores all components separately with no contiguous target; C2 adds closure; C3 omits the number. Zeros are observed endpoints.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Operator	Query template
DIRECT	What is my {attribute}?
PARAPHRASE	Could you remind me which {attribute} I provided earlier?
RELATIONAL	What details are associated with my {attribute}?
TEMPORAL	What did we previously establish for my {attribute}?
ELIMINATE	Which possible value for my {attribute} can be ruled out?
COUNTERFACTUAL	If my {attribute} were different, what would need to change?

Appendix

Table 3: Frozen model-facing operator templates.

Stage	Status	Question
Primary Qwen matrix	Original frozen matrix	Recovery, lifecycle, intervention, and auditor outcomes.
Prompted correction	Affected cells rerun	Executes the intended frozen prompted-auditor callable; unaffected rows persist.
Qwen variations	Post-primary	One serialization, retrieval rule, and activation wording.
Historical transfer	Post-primary	Legacy Qwen interface transferred unchanged to Mistral/Phi-3.
Model calibration	Post-hoc bounded selection	One development-selected multi-factor interface evaluated on new held-out panels.
Contract confirmation	Post-hoc question; frozen one-factor panel	Nested versus aligned answer request with retained replies and diagnostics.

Appendix

Table 4: Chronology and evidentiary role.

Auditor	IID	OOD
One-turn DIRECT	0.680 [0.615, 0.745]	0.640 [0.575, 0.705]
One-turn PARAPHRASE	0.655 [0.590, 0.720]	0.660 [0.595, 0.725]
Expert script	0.735 [0.675, 0.795]	0.745 [0.685, 0.805]
Greedy information gain	0.735 [0.675, 0.795]	0.745 [0.685, 0.805]
Recurrent PPO, each checkpoint	0.735 [0.675, 0.795]	0.745 [0.685, 0.805]
Contextual bandit	0.575 [0.505, 0.645]	0.670 [0.605, 0.735]

Appendix

Table 5: Primary Qwen

\Delta\mathrm{Rec}

[95% paired interval] in the matched hierarchical, exact-deletion, gate-off block. Clean recovery is zero throughout.

Figure 2: Primary auditor comparison. The two PPO checkpoints are distinct frozen configurations but outcome-identical secondary baselines.

Figure 3: Recovery after one query versus the carried-forward ten-query checkpoint. Almost all observed recovery is immediate; this does not imply that every method begins with DIRECT.

Split	Condition	$R$	$C$	$A$	$E$
IID	Exact, gate off	0.735	0.735	0.510	0.505
IID	Exact, sealed gate	0.735	0	0.680	0
IID	Recorded-lineage closure	0	0	0	0
OOD	Exact, gate off	0.745	0.745	0.665	0.665
OOD	Exact, sealed gate	0.745	0	0.635	0
OOD	Recorded-lineage closure	0	0	0	0

Appendix

Table 6: Forget-world Qwen lifecycle rates (all clean rates zero; 200 profiles/split).

Figure 4: Primary Qwen lifecycle gaps. Recorded-lineage closure acts on existing derived state; the exact-literal gate acts only on proposed writes. Activation can remain positive when commit is zero. Boundary markers are observed endpoints, not certainty about population values.

Figure 5: Primary Qwen, historical direct transfer, historical multi-factor calibration, and the later one-factor confirmation remain distinct protocols. The figure is descriptive and supports no model ranking.

Condition and endpoint	IID	OOD
Canonical summary, DIRECT $\Delta\mathrm{Rec}$	0.680 [0.615, 0.745]	0.640 [0.575, 0.705]
Fact-ledger serialization, $\Delta\mathrm{Rec}$	0.625 [0.555, 0.695]	0.535 [0.465, 0.605]
Retrieval exposure, $\Delta\mathrm{Rec}$	0.665 [0.600, 0.730]	0.595 [0.525, 0.665]
Alternative wording, $\Delta A$	0.440 [0.370, 0.510]	0.475 [0.405, 0.545]
Alternative wording, $\Delta E$	0.440 [0.370, 0.510]	0.465 [0.395, 0.535]

Appendix

Table 7: Specified Qwen follow-ups; entries are paired gaps [95% interval].

Figure 6: Specified representation, retrieval, and activation-wording variations. Filled points use exact deletion; hollow points use recorded-lineage closure.

Figure 7: Conditional synthesis over studies with positive exact-deletion baselines. Zero observed closure endpoints apply to recorded lineage and tested auditors, not arbitrary state.

Model/split	Audit	Activation	$\Delta R$	$\Delta C$	$\Delta A$	$\Delta E$
Qwen IID	Legacy	Legacy	0.702	0.702	0.510	0.510
	Legacy	Aligned	0.702	0.702	0.740	0.702
	Aligned	Legacy	0.615	0.615	0.548	0.423
	Aligned	Aligned	0.615	0.615	0.615	0.615
Qwen OOD	Legacy	Legacy	0.587	0.587	0.558	0.529
	Legacy	Aligned	0.587	0.587	0.654	0.548

Appendix

Table 8: Module-A exposure-attributable lifecycle gaps on 104 paired profiles/cell. All clean counts are zero. Boundary zeros are observed endpoints; the validated results package contains complete intervals and parser counts.

Model	Split	$n_{R=1}$	No-write	Write-allowed	Gate-blocked	Allowed $-$ no-write
Qwen	IID	76	64/76	76/76	64/76	0.158 [0.079, 0.250]
Qwen	OOD	75	58/75	69/75	58/75	0.147 [0.067, 0.227]
Mistral	IID	74	72/74	72/74	72/74	0.000 [ $-0.054$ , 0.054]
Mistral	OOD	56	52/56	56/56	52/56	0.071 [0.018, 0.143]
Phi-3	IID	78	78/78	77/78	78/78	$-0.013$ [ $-0.038$ , 0.000]
Phi-3	OOD	74	68/74	64/74	68/74	$-0.054$ [ $-0.135$ , 0.027]

Appendix

Table 9: Module-B activation among forget-world reconstructed profiles. No-write and blocked state, rendering, prompt, and raw reply are identical in every row, with zero nondeterministic pairs.

Split	$n_{R=1}$	No-write	Write-allowed	Gate-blocked	Allowed $-$ no-write
IID	76	72/76 (76/76)	55/76 (76/76)	72/76 (76/76)	$-0.224$ [ $-0.329$ , $-0.118$ ]
OOD	75	60/75 (71/75)	68/75 (75/75)	60/75 (71/75)	$+0.107$ [ $0.000$ , $+0.213$ ]

Appendix

Table 10: Qwen matched legacy-activation diagnostic on forget-world profiles with

R=1

. Entries are official activation counts; parentheses give exact-target-anywhere raw-reply counts. The contrast is write-allowed minus no-write for official activation, with a paired 95% interval.

Model	Split	Region	Mnemonic	Denominator
Qwen	IID	93	93	104
	OOD	69	69	104
Mistral	IID	104	104	104
	OOD	101	101	104
Phi-3	IID	102	96	104
	OOD	93	93	104

Appendix

Table 11: Module-C C3 literal component occurrence in forget-world replies. Complete-target recovery is zero in the tested cells, where the numeric component is omitted; C2 has zero observed component occurrence in every cell.

Model	Revision
Qwen/Qwen2.5-7B-Instruct	fe11104b620d588ccc049ff6631dd3ea002e3d98
mistralai/Mistral-7B-Instruct-v0.3	b0693ea4ce84f1a6a70ee5ac7c8efb0df82875f6
microsoft/Phi-3-medium-4k-instruct	48d87cd5e0523b430d77e93becd3655cd6897230

Appendix

Table 12: Pinned evaluated-model revisions.

LLM Agent Evaluation

Large language model agent evaluation measures whether tool-using systems complete tasks reliably, safely, and efficiently.

See all 1,194 papers

MemCut: Every Secret Leaves a Trail in the Long-Term Memory of LLM Agents
Oct 15, 2026Cheng Zhang, Xuanning Cao, Zhicheng Zheng +1LLM Agent Memory Privacy Leakage in Language Models
The Hong Kong University of Science and Technology (Guangzhou) · University of Science and Technology of China · The Hong Kong University of Science and Technology
Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
Sep 4, 2026Chao Yao, Yangbo Wei, Zhen Huang +5LLM Unlearning LLM Agent Memory
Arizona State University, USA · Eastern Institute of Technology, Ningbo, China
Can Agents Forget When Asked? A Benchmark for Memory Unlearning in LLM Agents
Oct 13, 2026Bofan Xie, Chaokun Wang, Guanchen Ge +4LLM Agent Memory Memory Agent Benchmarks
Tsinghua University · Sina Weibo

Oct 15, 2026J/K move · Enter open · S save

MemCut: Every Secret Leaves a Trail in the Long-Term Memory of LLM Agents

Cheng Zhang, Xuanning Cao, Zhicheng Zheng, Hui Xiong

The Hong Kong University of Science and Technology (Guangzhou) · University of Science and Technology of China · The Hong Kong University of Science and Technology

LLM Agent Memory Privacy Leakage in Language Models Long-Term Conversational Memory LLM Unlearning

Open paper AskPDF arXiv

Long-term memory has become a crucial component of large language model (LLM) agents, with most research focusing on retrieving relevant information accurately and efficiently. However, a dependable memory system must also forget sensitive user data upon request. To evaluate this capability, we introduce MemCut, a systematic benchmark for user-requested forgetting. Its 456 hand-designed secrets in long-horizon conversations have fully annotated evidence trails to test recovery after deletion, including from messages that never state the secrets directly. We propose two recovery metrics. Native recovery measures reader success through the system's retrieval, whereas residual recovery measures the same reader's success when directly given surviving objects traced to annotated disclosures or evidence. We establish three reference deletion baselines to test how far existing retrievers and write models support forgetting across five memory designs and four LLMs. Disclosure removal reduces native recovery far more than residual recovery. LLM-guided deletion of ten additional turns from twenty retrieval candidates leaves 39-76% residual recovery. Subset sweeps (144 facts, three systems, two models) show that widening the pool at a fixed budget reduces residual recovery more than deleting all original candidates. These sweeps identify candidate coverage as a bottleneck in the reference baselines.

Abstract

LLM Agent Evaluation

Explore similar work

MemCut: Every Secret Leaves a Trail in the Long-Term Memory of LLM Agents

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Can Agents Forget When Asked? A Benchmark for Memory Unlearning in LLM Agents