Deleted agent memories survive in summaries and fragments
Reviewing AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents · Ehsan Saleh, Roozbeh Nahavandi, Sama Salarian et al.
Researchers show that deleting a record from an LLM agent's memory often fails to remove the secret, because summaries built from it survive and separated fragments can be reassembled. Tracking lineage stops the tested leak, write filters do not undo it, and deletion needs testing as behaviour rather than storage.
Delete a secret from an LLM agent's memory, ask for it once, and in roughly two thirds of cases the agent hands it back. An otherwise identical agent that never saw the secret recovers it zero times. That paired comparison is the clever part of this research. It pins the leak on the original exposure and nothing else.
The mechanism is simple once you see how agent memory works. Many agents keep an external store of past interactions, then build more state on top of it: summaries, consolidated notes, derived records. Deleting the source entry removes that one record. It does not touch the summaries written from it. The secret has descendants, and deletion only removed the parent.
The researchers built a harness to measure this properly. For each synthetic secret they ran two matched worlds on the same fixed model weights: one exposed then deleted, one never exposed. The primary model was Qwen2.5-7B-Instruct, with Mistral-7B and Phi-3-medium alongside. Almost every recovery came on the very first query. The attacker needs no patience, just the right question.
No copy needs to survive
The finding I find most interesting has no verbatim copy at all. The researchers removed every complete instance of the secret. Only its components remained, stored separately, along with a public rule for putting them back together. Across all three models, exact reconstruction succeeded in 62 to 99% of cases. The model reads the pieces, applies the rule and rebuilds the string.
This is not a new idea. Aggregation and inference attacks against databases work the same way. What is new is that the agent itself does the aggregation, on request.
The defences tell an honest story. Tracking lineage, then retiring or rebuilding any summary whose sources include the deleted record, eliminated recovery in the tested settings. That is credible, but the provenance was complete by design. Production memory with lossy, learned or untracked dependencies will not offer a clean family tree, so treat this result as an upper bound. A filter that blocks the exact secret from being written back stops reinsertion. It cannot remove what is already there.
One more detail matters for anyone running audits. Replies containing the secret were sometimes scored as failures because the response format and the parser disagreed. If your leak detector expects one field and the model answers in another, you will undercount. An attacker benefits from that blind spot too.
The preconditions are modest: query access to an agent whose memory derives state from past conversations. Where nothing is summarised or recomposed, this channel has little to work with. I would test deletion the way the researchers did: delete, ask, then compare against an agent that never knew. Removing the record is a storage operation. Forgetting is behaviour.
Further analysis
Problem
This paper audits whether deleting a source record from an LLM agent's external persistent memory actually prevents the agent from revealing the deleted information in later interactions. The distinction of interest is between storage-level deletion of a source record and behavioural unavailability of information that may persist in derived or descendant state such as summaries. The question matters for privacy and safety because users reasonably expect deletion to remove subsequent recoverability of secrets, but agents often consolidate, summarise or otherwise derive persistent state from past interactions.
Approach
AfterDeleteBench is a paired, behavioural audit that holds model weights fixed and controls the external memory harness. For each synthetic exact-string secret, two matched worlds are created: a forget world that is exposed to the secret then has the source record deleted, and a clean world that never sees the secret. The auditor interacts with the model through a constrained operator vocabulary and submits a single confirmed prediction under an explicit response contract; separate diagnostics record whether a correct candidate write was committed and whether the target can be produced again in a fresh session. The benchmark evaluates multiple models (primary: Qwen2.5-7B-Instruct; additionally Mistral-7B and Phi-3-medium), memory formats (flat raw records versus hierarchical summaries), transformed-memory conditions where components survive under a public composition rule, provenance-based closure, and an exact-literal write gate that blocks reinsertion but cannot remove existing residue.
Key Findings
- A single direct query recovers deleted exact-string secrets from Qwen2.5-7B-Instruct in roughly two thirds of matched profiles: ΔRec≈0.68 on IID and ≈0.64 on generator-held-out OOD, while matched never-exposed controls show zero recovery.
- Recovery does not require a surviving verbatim copy. When components are stored separately and a public deterministic composition rule exists, exact reconstruction succeeds at high rates across models; reported gaps range from about 62% up to 99% in tested conditions.
- Recorded-lineage closure that retires or rebuilds summaries whose provenance includes the deleted source eliminates observed recovery in the tested positive-baseline settings, showing that tracked descendants can explain the leakage under the benchmark's provenance completeness.
- An exact-literal write filter blocks recommitment of a recovered candidate but does not erase information already present, so blocking writes prevents future reinsertion but does not undo prior disclosure.
- The measured outcome depends on the response interface. Parser and format mismatch can cause target-bearing raw replies to be scored as failures; for example, legacy contracts produced many raw replies containing the target that the official parser did not count.
- Almost all observed recoveries appear on the first query: 3,081 of 3,088 recovery events occurred on query one. Several auditor strategies including scripted and frozen PPO checkpoints produced similar recovery gaps, with learned policies not improving on the strongest scripted baselines in these tests.
Limitations
The benchmark uses synthetic exact-string targets, a controlled extractive memory harness, deterministic transforms, a finite operator vocabulary, and pinned model revisions. Provenance is complete by design, so closure is an idealised upper bound and does not prove semantic erasure under lossy, learned, many-to-many or untracked dependencies. The results do not directly extrapolate to natural-language secrets, compressed or learned memory representations, autonomous memory systems, or arbitrary production architectures.
Implications
An attacker or auditor can exploit derived or compositional persistent state to recover secrets even after a source record is deleted, so deletion at the storage layer does not guarantee behavioural forgetfulness. Provenance-aware removal of tracked descendants can prevent the tested leakage channel, but write-time filters alone cannot remove existing residue. The response interface can hide or reveal disclosures, so an adversary could evade detection by exploiting parser mismatches or by producing replies in unexpected fields or formats. Behavioural, end-to-end deletion audits that test reconstruction, write-back and fresh-session recall are therefore needed to assess real privacy risk in memory-enabled agents.
The paper title, authors and abstract
AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents
Many LLM agents maintain external persistent memory and derive additional state from past interactions, such as summaries. Deleting an original memory record therefore need not remove information carried by its descendants. We introduce AfterDeleteBench, a controlled behavioral audit for this failure mode in fixed-weight LLM agents. For each synthetic secret, we compare an exposed-then-deleted agent with an otherwise matched agent that was never exposed to the secret, allowing post-deletion recovery to be attributed to the original exposure. In our primary setting, a single query recovers the deleted secret from Qwen2.5-7B-Instruct in roughly two thirds of cases, while matched never-exposed controls have zero recovery. Crucially, recovery does not require a surviving verbatim copy: when the complete secret string is absent and only separately stored components remain under a public composition rule, exact reconstruction succeeds in 62-99% of cases across Qwen, Mistral, and Phi-3. We also show that the response interface is part of the measurement system: target-bearing replies can be scored as failures when the requested format and parser are misaligned. Finally, we separate reconstruction from write-back and fresh-session recall. Provenance-aware closure eliminates observed recovery in the tested positive-baseline settings, whereas an exact-literal write filter blocks reinsertion but cannot erase information already present. Together, these results show that source deletion should be evaluated behaviorally at the level of the agent and its memory system, not only as a storage operation.
