跳转至

已被撤销却依然具备权威性：对智能体记忆系统中撤销执行情况的实证研究

文章背景与核心概要

长期运行的大语言模型（LLM）智能体极度依赖持久化记忆系统。为了处理后续的更新或纠错，许多系统采用了“软撤销”（soft revocation）机制，即将被矛盾的事实标记为无效并予以保留，而不是直接将其删除。然而，这些撤销标记在检索时是否真的得到了强制执行，此前一直缺乏深入研究。

本文对五个主流的智能体记忆系统进行了深入评估，涵盖了九种策略场景、九种模型以及六种防御条件。研究人员发现了一个严重的安全漏洞：没有任何系统在默认情况下强制执行撤销机制。只要撤销标签对检索层保持可见，过时的记忆就会被检索出来，其优先级甚至高于替代它的新事实，并频繁导致智能体采取不安全的行动。为了缓解这一问题，作者开发了一种保护网关，能够置于智能体和记忆后端之间，自动拦截已被撤销或存在冲突的记录。

摘要 (Summary)

Long-running language-model agents rely heavily on persistent memory systems. To handle updates or corrections, many systems use soft revocation, where a contradicted fact is marked invalid and retained rather than outright deleted.

This paper investigates whether these revocation marks are actually enforced at retrieval time. Evaluating five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, the authors discovered a critical security flaw: no system enforces revocation by default. Whenever the revocation label remains visible to the retrieval layer, the outdated fact is retrieved, outranks its replacement, and frequently leads agents to take unsafe actions. To mitigate this, the authors introduce a protective guard designed to sit between the agent and memory backend, automatically withholding revoked or conflicting records.

长期运行的大语言模型智能体严重依赖持久化记忆系统。为了处理更新或纠错，许多系统使用软撤销（soft revocation），即将被矛盾的事实标记为无效并予以保留，而不是直接删除。

本文旨在调查这些撤销标记在检索时是否真正得到了强制执行。通过在九种策略场景、九种模型和六种防御条件下评估五个智能体记忆系统，作者发现了一个关键的安全漏洞：没有一个系统在默认情况下强制执行撤销。每当撤销标签对检索层保持可见时，过时的错误事实就会被检索出来，其优先级高于其替代品，并经常导致智能体采取不安全的操作。为了缓解这一问题，作者引入了一种保护网关，旨在置于智能体和记忆后端之间，自动扣留已被撤销或冲突的记录。

元数据与参考信息 (Metadata & Reference Information)

摘要原文 (Abstract)

Long-running language-model agents depend on persistent memory. Many agent-memory systems preserve history through soft revocation: a contradicted fact is marked invalid and retained rather than deleted. However, whether that mark is enforced at retrieval time is unexamined. In this paper, we measure five such systems: we load each with a revoked policy and its replacement, track whether the revoked fact is returned at retrieval and whether the agent then acts on it across nine policy scenarios and nine models, and score every trial under six defense conditions. We find that no system enforces revocation by default: the revoked fact is returned wherever the revocation label is visible to the retrieval layer, outranks its replacement, and leads agents to the unsafe action. Based on these findings, we develop a guard that sits between the agent and any memory backend and withholds records that are revoked or conflict with their replacement.

长期运行的大语言模型智能体依赖于持久化记忆。许多智能体记忆系统通过软撤销来保留历史记录：被矛盾的事实被标记为无效并保留，而不是删除。然而，该标记在检索时是否被强制执行尚未得到检验。在本文中，我们评估了五个这样的系统：我们在每个系统中加载一个已撤销的策略及其替代策略，跨九种策略场景和九种模型追踪在检索时是否会返回被撤销的事实以及智能体随后是否会根据它采取行动，并在六种防御条件下对每次试验进行评分。我们发现，没有一个系统默认强制执行撤销：只要撤销标签对检索层可见，被撤销的事实就会被返回，其优先级高于其替代品，并导致智能体采取不安全的操作。基于这些发现，我们开发了一个保护网关，它位于智能体和任何记忆后端之间，并扣留被撤销或与其替代品冲突的记录。

全文链接与资源 (Full-Text Links & Resources)