Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
Chao Yao, Yangbo Wei, Zhen Huang, Junhong Qian, Chenle Chen, Shaoqiang Lu, Chen Wu, Lei He
cs.CR · cs.AI
Quick verdict
Formalizes exact unlearning of LLM-agent runtime state; theory is simple but honest, audits strong, replay matches full reset at up to 9× lower token cost.
Summary
This paper formalizes 'execution-state unlearning' for stateful LLM agents: after a forget request, the agent must behave as if it never observed the revoked content, which persists not only in the transcript but in summaries, tool plans, and the KV cache. Modeling the runtime as a deterministic transition system, the authors prove a prefix-sharing lemma, a taint-boundary lemma, and a splicing theorem: restoring a checkpoint (a KV-cache crop) plus sanitized replay reconstructs the counterfactual state exactly, subject to a lower bound of T−τ+1 recomputed transitions. Their Provenance-Guided Selective Replay attains this bound using an artifact-level provenance graph and shadow-executed tool replay. On episodes converted from LongMemEval (n=100), ToolSandbox (n=100), and AgentDojo (n=80), across Llama-3.1-8B, Qwen2.5-7B, and Mistral-7B, memory deletion leaves leakage unchanged from doing nothing (any-leak 0.86–1.00), instruction-based forgetting collapses under six-probe elicitation (Leak@probes=1.00), and after source redaction the agent still acts on a revoked preference in 80% of behavioral episodes — while selective replay sits at the full-reset false-positive floor on every audit, recomputing 9.3× fewer tokens (133 vs 1235 average). Limitations: the theory is near-trivial under deterministic decoding; assumption A3 (snapshot-restorable environment, no committed side effects) restricts real applicability; utility reporting is thin; no code release is stated.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Deleting a persistent memory record leaves agent leakage exactly unchanged from doing nothing (any-leak 0.86–1.00 across three suites, p=1.0 vs B0).
- Instruction-based forgetting merely suppresses: the target remains retrievable with probability 1.00 under six-probe elicitation on all three suites.
- Exact unlearning of runtime state reduces to splicing — cache-crop restore plus sanitized replay reconstructs the counterfactual state at the T−τ+1 lower bound on recomputed transitions.
- Provenance-Guided Selective Replay matches a full reset at the measured false-positive floor on every audit while recomputing 9.3× fewer tokens (133 vs 1235 on average).
- String-matching audits certify failing methods: source-redacted agents act on a revoked preference in 80% of behavioral episodes while emitting the string zero times.
Strengths
Well-posed problem formalization
Definition 1 recasts forgetting as counterfactual equivalence over reconstructible runtime state (cache, summaries, plans), cleanly separating un-indexing from forgetting and contrasting parameter unlearning (Cao & Yang 2015, SISA); the (z, s) revocation-event interface covers detector-triggered cases the user never sees.
Audit methodology above the area's norm
Six elicitation probes, Leak@5, and a string-free behavioral suite are each anchored to a measured false-positive floor (B5); the LLM judge was excluded on a measured 0.34 floor; the Table 2 AgentDojo anomaly (B2 task-probe 0.00 vs Leak@probes 1.00) is correctly diagnosed as a query artifact, not a method property.
Theory-experiment coupling
Honest reporting
Weaknesses
Near-trivial theory
Assumption A3 limits the motivating use cases
Deployment gap
Utility quantification is thin
No code or data release
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper defines **execution-state unlearning** for stateful LLM agents: after a forget request for target z injected at step τ, the agent's runtime state must equal that of a twin agent that never observed z (Definition 1 — counterfactual equivalence over the KV cache, summaries, plans, and memory, not model parameters). The authors claim three negative findings (deleting the memory record is a behavioral no-op; forget instructions merely suppress and collapse under elicitation; source redaction leaves influence in derived artifacts), one positive method (Provenance-Guided Selective Replay, Algorithm 1), and a cost law (Corollary 1: at least T−τ+1 recomputed transitions, attained by their system). This is a method paper with an unusually careful evaluation culture for the area.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is execution-state unlearning for LLM agents?
It is the requirement that after a forget request, a stateful agent's entire runtime — KV cache, summaries, tool plans, memory — behaves as if it had never observed the revoked information, rather than just deleting a stored record. The paper shows that deleting the record leaves behavior unchanged, because the information persists in derived artifacts and cached tensors.
Why doesn't deleting an agent's memory record remove the information?
Because anything the model has read has already propagated into model-authored summaries, pending plans, and the KV cache. In the paper's experiments across LongMemEval, ToolSandbox, and AgentDojo episodes, memory deletion left leakage identical to doing nothing (any-leak 0.86–1.00), and 98% of ToolSandbox leaks flowed through tool routing arguments, causing real side effects.
What is Provenance-Guided Selective Replay and how much cheaper is it than a full reset?
It records an artifact-level provenance graph during execution, restores the pre-injection checkpoint by cropping the KV cache, then replays the sanitized suffix, shadow-executing consequential tools with call-ID deduplication so side effects fire only once. It matched a full reset on every audit while recomputing 133 vs 1235 tokens on average — about 9.3× fewer.
Does this method unlearn information from the model's weights?
No. The guarantee covers reconstructible runtime state only. Parameter-level unlearning, already-committed side effects (assumption A3), and correlates or paraphrases of the revoked content are explicitly out of scope, as are human turns that would have differed had the target never been observed.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The metadata abstract is cut mid-sentence ('...indistinguishable from a full reset at up'), but the embedded full-text abstract is complete; the paper text runs cleanly to the references with no visible truncation.
- No appendix, utility table, or code-availability statement appears anywhere in the provided text, so probe wording and some hyperparameters are not assessable from the paper as extracted.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.