实测发现语言模型记忆系统无法有效执行撤销，导致错误信息仍被调用。
Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems
- 通过测试五种系统，发现撤销标记未被强制执行。
- 撤销内容在9个场景下仍被召回并引发不安全行为。
- 提出拦截层，自动屏蔽已撤销或冲突的记忆。
长期运行的语言模型代理依赖持久化记忆。许多代理记忆系统采用软撤销机制：将矛盾事实标记为无效但保留，而非删除。然而，该标记是否在检索时被强制执行尚无研究。本文测量了五个此类系统：向每个系统加载一个被撤销的策略及其替代方案，跟踪在九种政策场景和九种模型下，被撤销的事实是否被检索返回，以及代理是否据此采取行动，并在六种防御条件下评分每项试验。结果发现，默认情况下无系统强制执行撤销：只要撤销标记对检索层可见，该事实便会被返回，且其优先级高于替代方案，导致代理采取不安全行为。基于此，我们开发了一种位于代理与任何记忆后端之间的防护机制，主动屏蔽已被撤销或与替代方案冲突的记录。
原文摘要 · Abstract (English)
Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。