语言代理回滚时，缓存状态残留会导致模型仍关注已丢弃内容。
Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents
- 通过保留键值缓存实现逻辑回滚，但模型仍能访问被丢弃的上下文
- 7个大模型中25/63测试项因缓存残留导致安全漏洞
- 仅需局部刷新缓存即可修复，无需全局清空
有状态语言代理假设被拒绝的分支可通过清除应用记录恢复。我们发现当服务会话在逻辑回滚后仍保留键值（KV）状态时，这一假设失效：模型可能继续关注应用认为已被丢弃的内容。我们形式化了这一缺失保障为回滚一致性——完整的回滚必须恢复模型所关注的状态，而不仅仅是文本记录。关键问题在于跨层：正确的逻辑回滚未必与保留的推理状态兼容，且该差距对应用不可见。为隔离缓存与文本影响，我们引入同词不同缓存的审计方法，在保持决策步令牌一致的前提下，仅改变缓存前缀是否过期。在七个开源模型家族（3.8B-36B）中，仅缓存保留即导致25/63测试单元出现输入受保护效果反转，而攻击者令牌在所有63次测试中均未出现在服务请求中；重建缓存可关闭所有缺陷。该通道在端到端会话应用、Hugging Face Transformers默认缓存复用路径及LangGraph时间旅行场景中均重现，即使逻辑回滚经验证，仍可能留下待关注的过期缓存。模型间敏感性各异，但底层关注状态完整性破坏具有结构性。我们排除位置和长度混淆因素，泛化至多种受保护效应、策略结构及缓存隔离的Mixture-of-Experts模型，并证明事务本地缓存恢复可关闭该通道，无需全局缓存刷新。所有核心结果均可从发布成果中确定性复现。
原文摘要 · Abstract (English)
Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。