PaperlayerView exact revision on arXiv

Source-linked AI summary

Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents

Guijia Zhang, Harry Yang

arXiv:2608.15939v1cs.CL

TL;DR

Language-agent rollbacks can leave rejected content in retained KV state even after the application removes it from the transcript. The paper formalizes rollback consistency and uses a same-token/different-cache audit to isolate this gap, finding retained KV flips protected decisions in 25 of 63 cells while cache rebuilding closes every cell.

  • Problem

    Language-agent runtimes lack a cross-layer rollback-consistency guarantee ensuring that aborts restore the model-attended state, not merely the application transcript.

  • Method

    The paper formalizes rollback consistency and uses a same-token/different-cache paired audit that holds decision-step tokens identical while varying only retained versus rebuilt KV state.

  • Results

    25/63 audited cells show retained KV alone flipping a protected decision, while fresh-cache rebuilding and cold restarts close the channel in 0/63 cells.

  • Takeaways & Limitations

    Complete rollback must restore attended inference state, and transaction-local cache restoration closes the channel without requiring a global cache flush.

  • Takeaways & Limitations

    The demonstrated scope covers DynamicCache, an end-to-end session application, the default Transformers reuse path, and LangGraph time-travel rather than all serving layers.

Abstract

from arXiv · show

Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.

1 INTRODUCTION

The paper shows that logical rollback can leave rejected content in retained KV state, allowing later protected decisions to change even when the attacker’s tokens are absent from the served request. It formalizes rollback consistency, isolates the cache as the cause through a same-token/different-cache audit, and shows cache rebuilding closes the channel.

  • Problem: A believed-complete application abort can clear the transcript while retained KV still encodes a rejected branch that changes a later protected effect.The failure arises from composition between application-level rollback and serving state retained across the abort.
  • Identification: The same-token/different-cache audit holds decision-step tokens identical while varying only the cached prefix, proving whether a flip comes from stale KV rather than text injection.The audit verifies that rejected-branch tokens are absent from the fed request while stale KV remains present.
  • Results: 25/63 audited cells flip the protected decision with retained KV alone, while attacker tokens are absent from the served request in all 63 cells.The audit spans seven open-weight model families from 3.8B to 36B across a 3 × 3 grid of injection vehicles and residue strengths.
  • Mitigation and scope: Fresh-cache rebuilding and full cold restart close the channel at 0/63, and the effect reproduces in an end-to-end session application and LangGraph time-travel rollback.The finding is structural to retained session/KV-handle reuse, whereas content-addressed prefix caching that reuses only request-present prefixes is exempt.
  • Formalization: Rollback consistency requires aborting both the application transcript and the serving state the model attends, with attended-state integrity sufficient for protected-effect consistency.The paper distinguishes this state-level property from the weaker observational effect-level property.

2 THREAT MODEL AND THE SAME-TOKEN / DIFFERENT-CACHE AUDIT (C1)

The audit models an attacker who places payloads in an eventually abandoned branch but cannot alter policy, future tasks, permissions, or effect execution. It isolates retained KV effects by comparing token-identical decision steps across stale and rebuilt caches, measuring typed out-of-allowlist effects rather than answer text.

  • Threat model: The attacker only places content in a branch that may be abandoned; rollback is performed by the honest application/runtime, while policy, tasks, permissions, and effect execution remain uncontrollable.The injected content is absent from the request served at the audited decision.
  • Capability and measurement: The executor records typed effects, while application authorization allows only finance-desk and the executor retains broad capability to contact any recipient.The measured harm is delivery outside the task’s authorized allowlist.
  • Same-token / different-cache audit: The paired estimand holds decision-step tokens identical while varying only cached-prefix provenance between stale, fresh, cold, and text-present arms.Stale retains [system, task, vehicle] KV while feeding only the committed finalize-turn delta; fresh rebuilds from [system, task] and feeds the same delta.
  • Same-token / different-cache audit: Because stale and fresh feed identical decision tokens and the carrier is absent from those tokens, any effect difference is attributable to retained KV alone.The audit verifies token identity and carrier absence per cell.
  • Determinism and reporting: 63 attack cells and 63 matched control cells form an exact deterministic census over the 7 × 3 × 3 grid.All decodes are greedy with temperature 0, so each model, vehicle, strength, arm, and cache-state cell has a fixed outcome.

3 THE RETAINED-KV ROLLBACK-CONSISTENCY CHANNEL (C2)

Retained KV state breaks rollback consistency because a logically aborted branch can remain in the model’s attended state even when its tokens are absent from the served request. Same-token/different-cache audits, realistic framework paths, and LangGraph time-travel reproduce the channel, while transaction-local cache restoration closes it.

  • 3.1 Cache-isolated audit: 63/63 cells had carrier-absent, token-identical decision inputs, while stale KV matched the text-present outcome in every cell.This isolates retained cache state as the causal difference between stale and fresh arms.
  • 3.1 Cache-isolated audit: 128/180 cells flipped across five typed effects and four policy structures; a cache-isolated Mixture-of-Experts model reproduced 9/9 flips.The controls reported fresh=cold=0/225 and 0/9, respectively.
  • 3.3 Restoration: Three transaction-local restores—fresh reprefill, DynamicCache.crop, or post-commit checkpoint—closed every audited cell, each yielding 0/36.The result establishes sufficiency of transaction-local restoration rather than uniqueness of one implementation.
  • 3.2 Realistic reproductions: The default Hugging Face cache-reuse fast path reproduces the channel without tensor surgery, using ordinary multi-turn calls that carry KV state across turns.The framework advances a DynamicCache through the documented model call with past key values and use_cache=True.
  • 3.2 Realistic reproductions: 25/45 LangGraph attack cells reproduced the channel despite verified logical rollback, with attacker tokens absent from all 45 served requests.Per-model results were Phi-3.5-mini and GLM-4-9B 9/9, Granite-3.3-8B 6/9, Qwen2.5-14B 1/9, and DeepSeek-R1-Llama-8B 0/9.

4 ENFORCING ROLLBACK CONSISTENCY: A TRANSACTION-LOCAL CACHE RESTORE, AND WHY EXISTING DEFENSES MISS IT (C3, C4)

Transaction-local restoration of an aborted session’s KV cache to committed state closes the rollback channel, while framework-native abort and prompt-level defenses do not. Fresh re-prefill, KV truncation, and checkpoint restoration provide interchangeable local fixes without requiring a global restart.

  • Existing defenses: 25/63 exfiltration persisted under framework-native abort because it dropped the branch from the transcript without rebinding KV state.This retained-handle behavior matches the buggy arm, leaving stale attended state after logical rollback.
  • Transaction-local cache restore: 0/36 audited cells remained exploitable after restoring the aborted session’s cache to committed state.Fresh re-prefill, stale-KV truncation, and checkpoint restoration all feed the same finalize delta and close every observed cell.
  • Systems cost: Fresh-cache rebind and full restart both close the channel, making their difference a systems-cost question rather than a safety question.Measured prefill cost is t(n) = 16.17 + 0.0127 n ms up to 960 tokens, with linear extrapolation used conservatively.

5 RELATED WORK

Prior work studies prompt injection, KV-cache reuse, rollback, and side channels, whereas this paper examines rejected content persisting through retained serving-layer KV state after logical deletion. It frames the issue as a cross-layer control-flow channel involving inference-state restoration and unsafe retention.

  • Prompt injection and agent security: Unlike indirect prompt-injection benchmarks that inject content during a live trajectory, this threat model concerns content already rejected, believed deleted, and absent from the served request.
  • KV-cache reuse, editing, and deletion: Content-addressed automatic caches are self-healing, while the studied channel arises from reusing a retained cache handle across a logical abort.
  • Rollback, checkpoint/restore, and recoverability: Rollback research shows that restoring conversational or sandbox state may not restore execution state, motivating inference-state snapshot, restore, and rollback as serving operations.
  • Side channels, persistent carriers, and unsafe retention: The paper distinguishes its control-flow channel from prior cache-timing and prompt-extraction side channels, identifying attended KV as a persistent carrier from rejected attacker influence to a later benign trigger.
  • Side channels, persistent carriers, and unsafe retention: The failure mirrors Governance Decay: one system forgets constraints that should persist, while the other retains content that should have been forgotten.

6 DISCUSSION AND LIMITATIONS

The observed flips are not ordinary prompt injection: deleted attacker semantics persist in retained KV despite neutral residue and absence from the served request. Model resistance is only a behavioral margin that may erode with subsequent prompts or fine-tuning, while the attended-state integrity violation remains.

  • Limitations: 25/25 →0/25 token- and length/position-matched controls attribute the flip to deleted attacker semantics in retained KV, not prompt injection.The residue contains no override instruction, can fire under neutral residue (7/21), was believed deleted, and is absent from the served request.
  • Limitations: 7/21 neutral-residue cases fired, showing the channel does not require an override instruction.The residue was believed deleted and absent from the served request.
  • Limitations: A resistant model does not eliminate the underlying Layer-1 attended-state integrity violation, because behavioral resistance can erode with the next prompt or fine-tune.The passage frames resistance as a behavioral margin rather than a structural guarantee.

7 CONCLUSION

The paper shows that rollback must restore the model-attended state, not merely the application transcript, and formalizes this requirement as rollback consistency. It also provides a transaction-local cache-restore defense and deterministic, reproducible artifacts for auditing the failure.

  • Core finding: Rollback consistency requires restoring the state the model attends, because retained KV can preserve a rejected branch after the transcript discards it.The paper frames rollback as a two-layer property with a cross-layer composition condition and exposes violations using a same-token/different-cache audit.
  • Defense: A cheap transaction-local cache restore closes the channel, including when rollback is exposed through a first-class API.The defense restores fresh cache state without requiring a global cache flush.
  • Reproducibility: All headline numbers are deterministic, sealed measurements regenerated from released artifacts and sealed JSON records.Figure inputs carry SHA-256 hashes, while aggregation seals per-model sources and the combined record file.
  • Scope and safeguards: The audit assumes control only over already-rejected branch content and measures harm with an instrumented executor in an isolated synthetic environment.The work discloses a transaction-local fresh-cache rebind and reports provider-hidden commercial caches as UNKNOWN rather than probing them intrusively.
  • Disclosure: The authors disclose using language models for code scaffolding, refactoring, and prose editing, while retaining responsibility for ideation, experiments, analysis, verification, and the paper.Headline numbers come from released, seeded code over sealed records.

A FORMALIZATION: A TWO-LAYER ROLLBACK PROPERTY AND A COMPOSITION CONDITION … D FULL PER-CELL CENSUS (SAME-TOKEN / DIFFERENT-CACHE)

The paper formalizes rollback as separate attended-state integrity and effect-level consistency properties, showing that logical transcript rollback composes safely only when serving re-derives post-abort KV from committed state. Its same-token/different-cache audit isolates retained KV as the causal difference and reports stale-cache failures across the full 63-cell census.

  • A FORMALIZATION: A TWO-LAYER ROLLBACK PROPERTY AND A COMPOSITION CONDITION: Rollback integrity requires post-abort attended state K′ to be re-derivable as κ(L⋆) from the committed transcript, not merely that the logical transcript is restored.This is a structural invariant on the model-attended KV state.
  • D FULL PER-CELL CENSUS (SAME-TOKEN / DIFFERENT-CACHE): 63/63 cells retain the carrier in cache while excluding it from fed decision tokens; fresh and cold arms are 0, whereas stale outcomes match the text-present and buggy-session arms.The census covers three injection vehicles and three residue strengths; a prompt-level guard is analyzed separately.
  • A FORMALIZATION: A TWO-LAYER ROLLBACK PROPERTY AND A COMPOSITION CONDITION: Effect-level rollback consistency requires f(K′, x) = f(κ(L⋆), x) for every protected decision input x, an observational equality rather than bitwise KV identity.A typed protected-effect flip constitutes a security violation.
  • A FORMALIZATION: A TWO-LAYER ROLLBACK PROPERTY AND A COMPOSITION CONDITION: Attended-state integrity implies effect-level consistency over all X, but finite-set effect agreement does not imply attended-state integrity.DeepSeek-R1-Distill-8B, Phi-4, and Seed-OSS-36B witness the failed converse: stale state persists while audited effects agree.
  • B AUDIT ARM CONSTRUCTION (PROCEDURE 1): The same-token/different-cache audit compares stale f(K′, x) with fresh f(κ(L⋆), x) while holding decision-step tokens identical, making disagreements causal cache-only witnesses.The audit establishes finite-set violations, not universally quantified equality.
  • A FORMALIZATION: A TWO-LAYER ROLLBACK PROPERTY AND A COMPOSITION CONDITION: A logical rollback layer R guaranteeing L′ = L⋆ composes with serving layer S only if S re-derives K′ = κ(L⋆); retained-handle advancement violates this condition.This is the cross-layer compositional gap reproduced under LangGraph time-travel.
  • B AUDIT ARM CONSTRUCTION (PROCEDURE 1): Procedure 1 constructs stale and fresh arms with identical fed decision deltas, differing only in whether rejected or committed prefixes prefilled the KV.The rejected and committed branches are tokenized separately, and their longest common prefixes determine the prefilled cache.

E PROMPT-GUARD ABLATION, PER CELL (C4) … J POSITION/LENGTH-MATCHED CAUSAL CONTROL AND ALTERNATIVE FIXES

The ablation shows prompt guards reduce but do not reliably eliminate stale-KV flips, whereas fresh-cache restoration closes the channel. Token-matched end-to-end tests and causal controls show the effect arises from retained attacker semantics, not transcript text, cache length, or position.

  • E PROMPT-GUARD ABLATION, PER CELL (C4): 14/45 flips remain with the guard enabled, including 9/9 on GLM-4-9B and 1/1 on Qwen2.5-14B.The guard closes 7/9 Phi-3.5-mini cells and 4/6 Granite-3.3-8B cells, but zero cells for GLM-4-9B and Qwen2.5-14B.
  • E PROMPT-GUARD ABLATION, PER CELL (C4): In every remaining flip, the attacker carrier is absent from fed tokens, so KV residue steers the decision despite the instruction.Because the residue is not labelled rejected, a prompt-level guard cannot identify what to distrust; transaction-local fresh-cache restoration is required.
  • F END-TO-END SESSION-AGENT PROTOCOL: 63/63 served requests exclude the attacker, and 63/63 finalize deltas are token-identical between buggy retention and fresh-cache replay.The end-to-end app mirrors session-keyed KV reuse: abort can drop the branch from the transcript while retaining its KV handle.
  • F END-TO-END SESSION-AGENT PROTOCOL: 9, 9, 6, 1, 0, 0, 0 buggy-abort flips across models exactly match the tensor-level probe.The application’s decide step uses the logical transcript while continuing from the current session KV.
  • G DETERMINISM AND THE CENSUS ESTIMAND: Greedy decoding makes the 7×3×3 audit deterministic, with causal evidence supplied by token matching rather than confidence intervals.The design reports carrier absent 63/63, identical decision tokens 63/63, and stale=text-present 63/63.
  • H ENVIRONMENT, MODELS, AND REPRODUCTION: The audit uses Hugging Face Transformers with explicit DynamicCache, torch 2.6.0+cu124, one H100, and seven pinned open-weight model families.Per-arm position IDs and attention masks make the partial-input-plus-past-key-values path version-robust.
  • I SEALED ARTIFACT MANIFEST: Framework-default reproduction records 9/9, 9/9, and 0/9 buggy-abort exfiltration across three models, versus 0/27 with fresh-cache abort.Attacker absence and byte-identical buggy/fresh finalize tokens hold in 27/27 cases.
  • J POSITION/LENGTH-MATCHED CAUSAL CONTROL AND ALTERNATIVE FIXES: 25/25 attacker-stale flips become 0/25 with length- and position-matched neutral prefixes; all three restores close every cell, including Qwen3-30B-A3B at 9/9 versus 0/9.The control removes only attacker carrier tokens while preserving cache length and positions, and the Mixture-of-Experts result independently reproduces the pattern.

K MULTI-ACTION PROTECTED-EFFECT BENCHMARK

The benchmark tests whether retained-KV protected-effect flips generalize beyond recipient routing. It audits five typed effects across four policy structures while verifying identical tokens and zero fresh/cold flips per cell.

  • Benchmark design: 45 attack cells per model cover five typed protected effects across four policy structures using the same-token/different-cache audit.Each effect family contributes nine cells: three vehicles × three residue strengths.
  • Audit invariants: Every cell verifies that the carrier is absent from fed tokens, stale and fresh tokens are identical, and fresh=cold= 0.These invariants isolate retained-KV effects from text differences and fresh-cache behavior.
  • Controls: DeepSeek flips 0 everywhere, while fresh/cold are 0 in every cell for every model.DeepSeek serves as the resistant control across all typed protected effects and policy structures.

L STOCHASTIC PAIRED EVALUATION

Stochastic paired evaluation tests whether the channel depends on a knife-edge decision boundary. On Phi-3.5-mini, stale-cache arms exfiltrated in nearly every sample at both tested temperatures, while fresh-cache arms never did.

  • Stochastic paired evaluation: 180/180 stale versus 0/180 fresh samples exfiltrated at temperature 0.3 under common random numbers.The paired samples covered all 9 attack cells, with N = 20 samples per cell and identical RNG seeds for stale and fresh arms.
  • Stochastic paired evaluation: 178/180 stale versus 0/180 fresh samples exfiltrated at temperature 0.7 under common random numbers.The stale arm’s Wilson 95% interval was [0.960, 0.997].
  • Stochastic paired evaluation: The probe used common random numbers so stale and fresh arms received identical finalize tokens.The experiment used 20 paired samples per attack cell across 9 attack cells on Phi-3.5-mini.
  • Stochastic paired evaluation: A full multi-model attack-rate characterization remains future work.The passage identifies this as a limitation of the current stochastic paired probe.

M HOW PREVALENT IS THE RETAINED HANDLE? A SURVEY OF DEFAULT CACHE BEHAVIOUR · N SUPPLEMENTARY: IN-CONTEXT BEHAVIORAL CORROBORATION ON A LARGER MODEL SET

Default high-throughput serving stacks generally self-heal by re-deriving cache reuse from the incoming request, while retained-handle behavior is concentrated in stateful application and orchestration layers. Supplementary in-context tests on a distinct seven-family vLLM set corroborate behavioral susceptibility across larger models, though without cache isolation.

  • M HOW PREVALENT IS THE RETAINED HANDLE? A SURVEY OF DEFAULT CACHE BEHAVIOUR: Default throughput-oriented stacks are content-addressed and self-healing, whereas exposed retained handles arise in stateful application and orchestration layers.The survey distinguishes self-healing reuse from exposed retained-handle advancement across a logical abort.
  • M HOW PREVALENT IS THE RETAINED HANDLE? A SURVEY OF DEFAULT CACHE BEHAVIOUR: llama.cpp self-heals when incoming-request truncation selects cache by longest-common-prefix, becoming exposed only with explicit slot save-and-restore across the abort.The documented exception is explicit use of --slot-save-path across the abort.
  • M HOW PREVALENT IS THE RETAINED HANDLE? A SURVEY OF DEFAULT CACHE BEHAVIOUR: vLLM and SGLang default to content-addressed, self-healing reuse rather than the exposed retained-handle pattern.The paper explicitly limits its claim: it does not characterize these dominant high-throughput deployments as vulnerable by default.
  • M HOW PREVALENT IS THE RETAINED HANDLE? A SURVEY OF DEFAULT CACHE BEHAVIOUR: Hugging Face Transformers’ documented stateful multi-turn fast path advances a retained handle by delta, exposing the rollback channel.The exposed pattern is a retained handle advanced across a logical abort instead of cache re-derivation from committed state.
  • M HOW PREVALENT IS THE RETAINED HANDLE? A SURVEY OF DEFAULT CACHE BEHAVIOUR: A logical rollback API does not suffice when it restores the transcript but not KV: LangGraph’s checkpointer can leave attended cache state stale.The vulnerability depends on the serving state advancing across the abort through a retained handle.
  • N SUPPLEMENTARY: IN-CONTEXT BEHAVIORAL CORROBORATION ON A LARGER MODEL SET: The supplementary behavioral test used a distinct vLLM-served set of seven open-weight families spanning 3.8B–35B nominal sizes.It included two 2026-generation frontier dense models and a 35B Mixture-of-Experts model.
  • N SUPPLEMENTARY: IN-CONTEXT BEHAVIORAL CORROBORATION ON A LARGER MODEL SET: Behavioral susceptibility on the seven-family vLLM set was not monotonic in nominal model size.The supplementary result is behavioral rather than cache-isolated, and the paper does not attribute the ordering to alignment.
  • N SUPPLEMENTARY: IN-CONTEXT BEHAVIORAL CORROBORATION ON A LARGER MODEL SET: Decision-log-odds attribution showed a positive residue push on every model, including fully resisting frontier models, while decision margins differed.Because the two arms differed in served text, this result is suggestive rather than causal cache-isolation evidence.
Loading 2608.15939v1…