None of five agent-memory systems actually enforce revocation at retrieval time

arXiv·high signalXBlueskyLinkedInCopy link

Researchers loaded five agent-memory systems with a revoked policy and its replacement, then measured retrieval and downstream action across nine policy scenarios, nine models and six defense conditions. No system enforced revocation by default: wherever the revocation label was visible to the retrieval layer, the revoked fact was returned, outranked its replacement, and led agents to the unsafe action. Soft revocation, marking a contradicted fact invalid but keeping it, is the default in most memory backends, so anyone relying on "I corrected that" is relying on a label the retriever ignores; the authors ship a guard that sits between agent and backend and withholds revoked or conflicting records.