Deleting an agent's memory record changes leakage not at all, and instruction-based forgetting fails on every probe

arXiv 2609.04875·high signalXBlueskyLinkedInCopy link

Long-running agents accrete compressed summaries, plaintext memory, pending tool plans and a KV cache, and today's forget operation deletes one plaintext record while leaving every derived artifact intact. Audited across three agent suites, nine baselines and three model families, memory deletion left leakage unchanged, instruction-based forgetting collapsed under elicitation (Leak@probes = 1.00), and source redaction still acted on a revoked preference in 80% of episodes. Provenance-Guided Selective Replay, which locates the injection point in a provenance graph, crops the KV cache at that checkpoint and replays a sanitized suffix, was behaviorally indistinguishable from a full reset at up to 9x fewer recomputed tokens.