Five AI memory systems ignore fact revocation at retrieval

A new paper tests what happens when you tell an AI agent's memory system a fact is wrong. The answer: it often doesn't listen. Researchers loaded five agent-memory systems with a policy, then revoked it and replaced it with a new one, according to the paper. Across nine policy scenarios, nine models, and six defense conditions, the revoked fact kept coming back at retrieval time, outranking its replacement, and pushing agents toward the unsafe action the revocation was supposed to prevent.

The mechanism is soft revocation. Most memory backends mark a contradicted fact invalid but leave it in the store instead of deleting it. That label lives at the application layer. The retrieval layer, the part that decides what an agent sees before it acts, doesn't check it. So the old fact sits there, still searchable, still capable of winning a similarity match against the thing meant to replace it.

This matters for anyone who's shipped an agent with persistent memory and assumed a correction sticks. If a system tells a user "got it, updated" and the underlying store still ranks the stale entry higher on the next query, the correction was cosmetic. The paper found this held wherever the revocation label was visible to retrieval but not enforced by it, across all five systems tested.

The authors built a guard that sits between the agent and the memory backend rather than trusting the backend's own bookkeeping. The fix isn't a smarter model, it's a checkpoint that refuses to hand back a fact once something else has been marked as its replacement. What the paper doesn't say is whether any of the five vendors plan to patch retrieval directly instead of leaving the fix to a bolt-on layer.