ABORTED BUT NOT FORGOTTEN - KV-CACHE RETENTION BREAKS ROLLBACK CONSISTENCY IN LANGUAGE AGENTS

Sep 15, 2026

Stateful language agents assume a rejected branch can be taken back, yet retained key/value (KV) cache across a logical abort makes the model attend to stale state while the application transcript shows a clean rollback. This creates a hidden rollback consistency gap invisible to the application layer. Using a same-token/different-cache audit, the work isolates cache effects from text effects across open-weight model families. Results show the stale KV can flip protected typed effects and enable artifact exfiltration, while cache rebuilds or cold restarts close the channel.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages21

Reading Time53 min

AccessFree to download

Introduction

Stateful aborts and retained KV state

Hidden channel via rollback inconsistency

Identification: same-token / different-cache audit

Findings and exploit evaluation

ABORTED BUT NOT FORGOTTEN: KV-CACHE RETENTION BREAKS ROLLBACK CONSISTENCY IN LANGUAGE AGENTS arXiv :2608 . 15939v1 [ cs .CL] 16 Aug 2026 Guijia Zhang The Hong Kong University of Science and Technology Harry Yang The Hong Kong University of Science and Technology ABSTRACT Stateful language agents assume a rejected branch can be taken back: the application clears its transcript and continues as if it never happened. We show this breaks when the serving session keeps its key/value (KV) cache across the logical abort, as it does whenever an application reuses a session handle or a cached past key values for latency. The model then runs on state the application believes it discarded. We formalize the missing guarantee as rollback consistency: a believed-complete abort must restore the state the model attends, not just the transcript. The point is not that deleted content leaves a trace in cached state, but that a correct logical rollback need not compose with the retained inference state, and this cross-layer gap stays invisible to the application. To separate a cache effect from a text effect, we introduce a same-token / different-cache audit that holds the decision-step tokens token-identical and varies only whether the cached prefix is a stale retained branch or one rebuilt from the committed transcript. Across seven open-weight families (3 .8B–36B), a rejected branch that survives only in retained KV flips a typed protected effect, exfiltrating a sensitive artifact to an attacker endpoint, in 25 of 63 audited cells, while the attacker tokens are provably absent from the served request in all 63; rebuilding the cache from the committed transcript closes every cell. The exploit reproduces at the API boundary of an end-to-end session application and on a widely used framework’s default cache-reuse path with no tensor surgery, and even when the abort is driven by a first-class rollback API (LangGraph time-travel), a verified logical rollback still leaves the attended KV stale. Susceptibility varies across models; the underlying attended-state integrity violation does not. We rule out a position or length confound and show the channel generalizes across protected effects, policy structures, and a cacheisolated Mixture-of-Experts model. A transaction-local cache restore closes the channel cheaply, where a global flush or full restart does not. All headline numbers are deterministic, sealed measurements that our artifact regenerates. 1 INTRODUCTION Modern language-agent runtimes are built around the assumption that a branch can be taken back. Frameworks expose rejection, pause, rollback and abort; an application that dislikes a proposed action rejects it, drops the branch from its transcript, and proceeds as if it never happened. Developers reason about safety against the state they believe this abort restored. Independently, the same runtimes reuse key/value (KV) state for latency: a session handle, a cached past key values, ora prefix/prompt cache lets the next step skip recomputation (Kwon et al., 2023; Gim et al., 2024; Zheng et al., 2024) . The central observation of this paper is that these two facts collide. When a session retains KV across a logical abort, the state the model actually attends to still contains the rejected branch, even though the application’s transcript does not. The logical view is clean; the physical KV is stale (Figure 1) . We show that this rollback inconsistency is a hidden channel. After a developer-believed-complete abort, content from a rejected branch that survives only in the retained KV reproducibly changes a later typed protected effect and its downstream harm. The channel does not require an ex- plicit override instruction. It fires under merely neutral residue that states a recipient without any command, and stronger imperative residue only increases exploitability; we report the flip count separately by residue strength (Table 1, Appendix D) rather than pooling them. In

FAQs

What problem does the paper identify in stateful language agents during aborts?

When an application aborts a rejected branch, it clears the transcript, but retained KV cache can keep the rejected branch in the model’s attended state. This breaks the expectation that the logical abort fully restores the state used for inference.

How does the paper separate cache-related effects from text-based prompt effects?

It uses a same-token/different-cache audit that keeps decision-step tokens identical across two test arms while varying only whether the cached prefix is stale retained KV or rebuilt from the committed transcript.

What are the main experimental outcomes across model families?

Across seven open-weight families and 63 audited cells, stale retained KV flips a protected effect in 25 cells, enabling changes in delivery of a sensitive artifact. Rebuilding the cache from the committed transcript closes all audited cells, and cold restarts also prevent the channel.

Sep 15, 2026

Uploaded by Lucas Martin