Forgetting without restart: execution-state forgetting for stateful LLM agents

After receiving a forgetting request, a stateful agent must behave as if it never observed the target, and deleting plaintext records alone cannot do this.

• Scenario: the authors state that personal agents can run continuously for weeks, with state layering transcripts, compressed summaries, plaintext memory, tool plans, and KV cache. Consent withdrawal, mis-pasted secrets, or indirect injection all require forgetting; the authors state that injection is the most common, and the user cannot see it at the time.
• Shortcoming: the authors state that deployed systems only delete plaintext at a single layer, treating forgetting as index removal. String matching misses failed methods; information flow control alone also cannot wash out content already in state, and the authors state that this baseline's leakage rate equals no-forget.
• Observation: the authors take the counterfactual as the standard: the clean prefix coincides with the contaminated trajectory and can be cropped and reused; without token-level attribution, artifacts from the injection step onward can only be replayed. Exact forgetting requires recomputing at least T−τ+1 transitions.
• Approach: the authors propose execution-state unlearning, implemented as Provenance-Guided Selective Replay: provenance locates the injection point, cache cropping restores the checkpoint, then replay sanitizes the suffix.
• Threat model:
  • Goal: future behavior must be indistinguishable from a trajectory that never saw z; under deterministic decoding, exact forgetting requires the operator to output the counterfactual final state.
  • Knowledge: the paper does not describe an external attacker. The operator uses recorded observations, provenance graphs, checkpoints, and environment snapshots.
  • Capabilities: the input is a revocation event (z, s), which can be raised by the user, platform, or detector. The operator can crop the KV cache, restore snapshots, and replay sanitized observations.
  • System: the object is a reconstructable runtime, including KV cache, working memory, and uncommitted tool plans, as well as content that was compressed, planned, and cached after entering context.

The authors discuss related work in four groups and state that both prevention and detection leave the same gap: by the time a marker appears, the content has already entered summaries, plans, and caches.

• Machine unlearning: Cao and Yang (2015) and Bourtoule et al. (2021, SISA) retrain from sharded checkpoints to precisely remove the influence of training data; Eldan and Russinovich (2023) use fine-tuning for approximate forgetting. Maini et al. (2024) and Liu et al. (2025) cover LLM unlearning benchmarks. The authors state that approximate unlearning is hard to verify, and that the object here is instead a replayable non-parametric execution state; checkpointing plus replay is the runtime analogue of SISA, and causality gives the shard boundary τ for free.
• Agent memory: Packer et al. (2023), Chhikara et al. (2025), and the paper's OpenClaw and Hermes Agent externalize state to paged context, fact stores, or plaintext Markdown/SQLite, and provide record deletion. Wu et al. (2025) benchmark memory recall, not revocation. The authors state that none of these deletions propagate to derived artifacts or caches in the session, corresponding to baseline B1, which is behaviorally a no-op.
• KV cache reuse: Kwon et al. (2023), Zheng et al. (2024), Gim et al. (2024) reuse attention state for byte-identical prefixes. The authors state that this mechanism is built for reuse and does not say what the cached suffix still encodes; this paper treats cropping as recovery under Lemma 1 and adds provenance guarantees.
• Injection prevention and detection: Prevention includes instruction hierarchy in Wallace et al. (2024), isolation and plan-then-execute in Beurer-Kellner et al. (2025), CaMeL in Debenedetti et al. (2025), and FIDES in Costa et al. (2025). Detection includes classifiers, internal model features, and localization of injected segments in Jia et al. (2026); indirect injection is covered by Greshake et al. (2023) and Debenedetti et al. (2024). The authors state that prevention is imperfect, detection is often asynchronous, and the above work does not provide remediation primitives.

Baseline methods are B0 no-forget, B1 memory deletion, B2 forget instruction, B3 source redaction, B4 sanitize without replay, B5 full reset, B5′ full reset with prefix cache, B6 string redaction then rebuild, B7 selective replay, B8 FIDES-style information flow control, B9 information flow control with replay. Benchmarks are LongMemEval, ToolSandbox, AgentDojo. The authors position this paper as recovery after detection: the detection verdict is the input (z, s) to the replay operator, and combined with information flow control, the sink policy acts on a runtime that no longer contains the target.

The authors formulate forgetting as trajectory concatenation: reuse the prefix already computed before injection, and replay only the suffix in a world without the target. The system is called Provenance-Guided Selective Replay.

Counterfactual trajectory

The runtime state includes KV cache, working memory, and uncommitted tool plans. External observations include user inputs, memory injections, and tool returns. The session is generated by

R_t = F(R_t−1, o_t; θ)

with R0 the initial state; transitions are jointly determined by the model forward pass and the agent scaffold. z first enters at step τ; earlier observations contain no z. The counterfactual stream removes z only at τ, keeping all other observations verbatim.

Under deterministic decoding, exact forgetting (Definition 1) requires

U(R_T, z) = R_T^−z

Under stochastic decoding, this is relaxed to ε-consistency of the future behavior distribution. The authors state that this simultaneously requires the target to be inaccessible, derived influence removed, and other observations preserved. The operator does not assume who the requester is.

Prefix sharing and taint boundary

• Lemma 1: for t≤τ−1, the real state and the counterfactual state are identical. The authors state that the first τ−1 steps were already computed by the real execution; full reset recomputes the same history on both sides.
• Lemma 2: the influence set is the reachable closure of z on the provenance graph and grows monotonically over time. Without per-token influence attribution, the largest certifiably z-independent artifact set is exactly the prefix outputs from turns earlier than τ.
• Objects that cannot be reused: the authors state that raw KV and model-derived states at τ and later must not carry into the next state; locally deleting nodes cannot undo already-performed computation. Content whose values are already fixed in the counterfactual world can still be re-materialized via prefill; this is still reconstruction, not reuse of the original suffix.

Concatenation theorem and lower bound

• Theorem 1: there is a checkpoint at τ−1, or an earlier clean boundary exists. If (A1) decoding is deterministic or the random source is fixed, (A2) sanitized observations equal counterfactual observations, (A3) there are no committed external side effects after τ and the environment is restorable from snapshots, then the replayed trajectory equals the counterfactual trajectory.
• Corollary 1: the operator can only read the stored real trajectory and derived metadata, or call F to advance state. In the worst case, any exact unlearner calls F at least T−τ+1 times in total. Algorithm 1 calls exactly that many times. The gain relative to full reset is written as T/(T−τ+1).
• Counting convention: the lower bound counts sequential state transitions, not autoregressive decoding tokens. Content already fixed inside a transition can use prefill, so token cost can be lower than the number of transitions. The authors state that experiments therefore look at efficiency, and at distributional consistency under stochastic decoding.

Three-layer contract

• Provenance graph: records artifact-level data flow during execution. Artifacts carry id, type, parents, source_ids, token_span, turn, committed. A reachability query returns τ and the taint closure. The authors state that they deliberately do not do token-level attribution, only recording dependencies that actually occurred.
• Sparse checkpoints: registration points include session start, turn boundaries, before memory injection, consequential tool calls, and compression. Only token offsets, cache handles, environment snapshot IDs, and prompt inventories are stored; no tensors are copied. Recovery is a single crop.
• Sanitized replay: read-only or deterministic tools are re-executed from snapshots, or recorded observations are replayed. Consequential tools are shadow-executed during replay and deduplicated by call-ID, avoiding triggering real side effects twice. Sanitization removes z and keeps everything else as is.
• Implementation: KVEngine on HuggingFace Transformers provides prefill, generate, crop. Turns generated while the target resides inherit source IDs via oracle source-ID propagation. Algorithm 1 first locates the source and first entry, then takes the nearest checkpoint with boundary earlier than τ, then replays step by step to session end.

Experimental setup

• Models: main model Llama-3.1-8B-Instruct, on one RTX 4090. Cross-family are Qwen2.5-7B-Instruct and Mistral-7B-Instruct-v0.3.
• Data: three-stage scripts are setup, acquisition, contamination, then rerun excluding the target to obtain the counterfactual reference. LongMemEval n=100, injected memory facts; ToolSandbox n=100, target in tool observation identifiers; AgentDojo n=80, slack/workspace/banking/travel 20 each. Tool channel corresponds to detector trigger, user does not see z.
• Main table conditions: 12 more turns after the target, half independent of the target (indep=0.5). Main table temperature 0. Random audit k=5, temperature 0.7.
• Baselines: B0 to B9 branch from the same contaminated state, cache already cloned, comparisons done pairwise. B5 is the counterfactual reference.
• Metrics: leakage measured in final answers, tool arguments, and memory writebacks, split into exact, action (routing / selection / free-text), and any. CAD relative to B5 counts tool selection mismatches plus argument distance. Efficiency measures recomputed tokens and latency. Utility checks non-target facts; the paper does not report specific utility numbers.
• Audit: Leak@probes includes six probe types: task, direct, think, introspect, enumerate, cued-completion; also Leak@5 and behavioral extraction. Probes also run on B5; probes with a nonzero false-positive floor are dropped, thus excluding one LLM judge (floor 0.34). Tests are pairwise exact McNemar and Wilcoxon signed-rank.

Main results

Per Table 1 (temperature 0; LME n=100, TS n=100, AD n=80; CAD and recomputed tokens averaged across suites):

Swipe horizontally to read the table

Method	LME	TS	AD	CAD	Recomputed tokens
B0 No-Forget	0.86	1.00	0.97	0.37	36
B1 Memory-Delete	0.86	1.00	0.97	0.37	36
B2 Forget-Instruction	0.38	0.72	0.00	0.39	55
B3 Source-Redaction	0.84	0.94	0.39	0.33	200
B4 Sanitize-no-Replay	0.00	0.00	0.00	0.22	36
B5 Full-Reset	0.00	0.00	0.00	0.00	1235
B7 Selective-Replay	0.00	0.00	0.00	0.00	133

The table omits B6 (Any-leak 0.00 on all three suites, CAD 0.39, recomputed 220) and B5′ (Any-leak and CAD both 0.00, recomputed 202). B2's 0.00 on AD carries a footnote: that task's queries do not ask for the target.

• The authors state that B1 and B0 are identical cell by cell (p=1.0 relative to B0). On ToolSandbox, 98% of B0/B1 leakage flows out through routing arguments.
• The authors state that B2 only lowers leakage on task-type probes; B4 is string-clean but over-deletes; B3 re-emits the target through the model's own summaries and plans.
• The authors state that B7 and B5 agree on Any-leak, CAD, and agreement 1.0, with 9.3× fewer recomputed tokens (p<10−3），比B5′少1.5倍。摘要写up to 9×。B8经自由文本泄漏0.92–1.00；加上重放的B9降到0（p<0.001）。作者称状态清理与流控制是正交的。

引出、随机与行为审计

• Table 2（n=30/套件）：B2的Leak@probes在AD、LME、TS均为1.00，ToolSandbox上Leak@5为0.70。B3的Leak@probes为0.73、0.80、0.97，Leak@5为1.00。B0四格均为1.00。B5与B7均为0.00。B6的Leak@probes未报告，其Leak@5（TS）为0.00；B8的Leak@5（TS）为1.00。作者报告内省探针单独即可重新放出目标，数值为0.87–1.00，并称安全声称应依据Leak@probes。
• Table 3（30个偏好回合×2种对消顺序）：avoid是选择另一提供者的比率，says it是撤销理由的字符串泄漏。B0、B1、B2、B6的avoid均为1.00、residue +0.68、p<0.001，says it均为0.00。B3的avoid为0.80、residue +0.48。B5的avoid为0.32；B7为0.32、residue +0.00、p=1.0。作者称零点是测得的，不是假定的。
• 禁词表变体：作者报告把被排除品牌加入禁词表后，B6降到0.35（n.s.），B3仍为0.80。作者称字符串涂红要同时覆盖每个派生产物，并且事先知道原串；偏好二者都不满足。

精确性、代价与跨模型

• 匹配种子、温度0.7：作者报告B7在450/450次抽取上与B5逐token一致（ε=0），B6为1%。独立种子下，B7在工具一致性、tool TV、n-gram、embedding上相对B5自采样地板均未检出偏离（Wilcoxon p>0.5); the same test flags B6 (tool TV p<10−3). Figure 3's caption says the dashed line is that floor, B7 panels show no detected deviation, B6 has an asterisk. The authors state that no detected deviation is not distributional equivalence, and list TOST as future work.
• Injection timing: as τ sweeps from first to last turn, B5's recomputation stays flat, B7 decreases linearly with τ (R2=1.000 across suites). On LongMemEval, B7 goes 1218→162 tokens, B5 stays 1330. The abstract writes this line as R2≈1. On the indep axis, B7's decoding cost decreases linearly (R2=1.00), B5′ stays flat at 545–610 tokens; at fully independent, B7 decodes 114–147 tokens, p50 latency 2.9–3.7 seconds vs. 11.5–12.7 seconds, prefix-cache-only is 1.01×. At indep=0 the two coincide. The authors state that this saving relies on an attribution oracle stronger than Lemma 2(ii), reducing intra-transfer tokens, not the number of transfers.
• Cross-model: the other two families each have 280 paired turns. The authors report B3 Any-leak 0.84–1.00, B7 all 0, savings 2.9–4.3×. The anomalous cell is Llama's B3=0.39 on AgentDojo; the authors state that elsewhere B3≥0.92, and single-model evaluation would mislead.

Other ablations and analyses

• Table 4 (n=30/suite): cutting only the target span gives Any-leak AD 0.13, LME 0.63, TS 0.93, CAD 0.47, higher than no-forget's 0.38; descendant closure CAD 0.23; with replay added, leakage and CAD are both 0.00. The authors state that up to 93% of turns still leak after span excision.
• Derivation depth: B3 Any-leak is 0.00 at depth 0, becoming 0.33–0.97 as answers, plans, and summaries stack; B7 has Any-leak and CAD both 0 at every depth.
• Checkpoint from every_turn to session_start: Any-leak and CAD stay 0. The granularity only buys about 1000 tokens and 0.1–0.15 seconds of prefill reuse, metadata ≤4.4 KB; at session_start, B7 latency is 7.8 seconds vs. 12.2 seconds.
• Injection position early/middle/late: leakage and CAD for each method are essentially unchanged; B7's cost ratio relative to full reset drops from 0.91 to 0.14.
• Exceptions: B2's single-probe 0.00 coexists with Leak@probes 1.00; distribution tests give no equivalence conclusion.

Limitations and future directions noted by the authors

All from the Limitations paragraph of the Conclusion:

• Guarantees cover reconstructable runtime state, not model parameters.
• Do not cover already-committed side effects, corresponding to assumption A3.
• Do not cover correlates of z.
• Recomputation cannot go below T−τ+1.
• Assumption A2 fixes observations after τ, so replay covers tool returns and memory injections replayable from snapshots, not human turns that would have differed.
• Beyond the behavioral suite, the audit is string-based; distributional results are no-detected-deviation, not equivalence.

Experimental coverage

• Models tested are Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3; the main model runs on one RTX 4090.
• Turns come from LongMemEval (n=100), ToolSandbox (n=100), AgentDojo (n=80, 20 per domain). Main table runs 12 more turns after the target, indep=0.5, temperature 0.
• Comparisons are B0–B9. Audit includes six-probe Leak@probes, Leak@5 (k=5, temperature 0.7), and behavioral extraction (30 preference turns × 2 orders); adversarial audit n=30/suite.
• The other two families each have 280 paired turns. Provenance is populated by oracle source-ID propagation; detection verdicts are treated as operator inputs, and the detector itself is not the system under test in the result tables.
• The paper excludes an LLM judge with floor 0.34. The paper does not report specific values for non-target fact utility, nor the number of repeated runs beyond the main table.

This work defines forgetting in long-horizon agents as runtime counterfactual equivalence, rather than deleting a plaintext memory.

• The agent's transcript, compressed summaries, plaintext memory, pending plan, and KV cache all retain read content. The authors state that only deleting records, only issuing a forgetting instruction, or only blocking subsequent information flow cannot make the final state become a state that never saw the target.
• The runtime is written as a deterministic transition. The prefix before the injection step coincides with the counterfactual trajectory and can be pruned and reused; without token-level attribution, the subsequent original state cannot be reused. Provenance-Guided Selective Replay uses a provenance graph to find the injection point, restores the checkpoint, and then replays the suffix over observations with the target removed. The authors state that under a conservative taint model, the number of transition calls is T−τ+1, and no exact operator can do fewer.
• In Table 1 (temperature 0, three suites, 12 more rounds after the target, indep=0.5), memory deletion has Any-leak of 0.86, 1.00, 0.97, the same as no forgetting. Selective replay and full reset both have Any-leak 0.00 and CAD 0.00, with average recomputed tokens of 133 versus 1235. The authors state this is 9.3× fewer; the abstract writes up to 9×.
• In Table 2, the forgetting instruction has Leak@probes of 1.00. In Table 3, with the source block redacted, the agent still acts according to the revoked preference in 0.80 of rounds, with string leakage of 0.00; selective replay's avoid and full reset are both 0.32. With matched seeds and temperature 0.7, selective replay matches the reference token-for-token on 450/450 rounds.
• On two other model families with 280 paired rounds each, the authors report selective replay has leakage of 0 throughout, with savings of 2.9–4.3×. The authors' conclusion is that deleting records is not forgetting; on a reconstructable runtime, the splicing cost is determined by the injection time rather than the session length, and the guarantee does not extend to parameters, committed side effects, or terms related to z.