Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents
KV-Cache mismatch during model rollback causes state residuals, enabling information leakage via a causal cache effect.
Key Findings
Methodology
This paper introduces a same-token/different-cache audit to isolate cache effects from text effects. By comparing model responses across seven open-weight families (3.8B-36B parameters), using controlled experiments with maintained decision tokens but varying cache states, the authors demonstrate how retained KV-Cache after logical abort leads to state inconsistencies. They implement experiments in Hugging Face Transformers with explicit DynamicCache control, reproduce the vulnerability in end-to-end session applications, and verify persistence of stale KV states even under LangGraph’s first-class rollback API. The core approach involves constructing paired control and attack arms with identical tokens but different cache states, observing the protected effect flips caused solely by cache residuals, and validating fixes via transaction-local cache rebuilds.
Key Results
- Across models, 25 out of 63 audited cells showed protected effect flips caused solely by retained KV cache, resulting in sensitive data exfiltration, with attacker tokens absent from served requests. Rebuilding cache or full restart eliminated all flips. The vulnerability persisted even under LangGraph’s logical rollback API, confirming its structural nature. The effect flips were consistent across model sizes and architectures, unaffected by position or length confounds, indicating a fundamental cache-layer issue. The fix via transaction-local cache restoration proved effective at low cost, closing all channels.
- In end-to-end session applications, the bug reproduces with default framework cache reuse paths, with no tensor surgery needed. The attacker’s payload, stored in the stale KV, can influence downstream effects despite the logical rollback. Experiments with multiple models confirmed the universality of the problem, with the cache residuals causing consistent state violations. The results highlight the importance of proper cache management in secure model deployment, especially in multi-turn interactions and rollback scenarios.
- Further analysis showed that the vulnerability is not model size-dependent and persists across different protected effects and policy structures. The experiments demonstrated that rebuilding the cache from committed bytes or performing a full cold restart effectively closes the channel, whereas native aborts or prompt-level distrust checks fail to address the residual state. This underscores the necessity of transaction-local cache management for ensuring rollback consistency and security.
Significance
This research uncovers a critical security flaw in current language model deployment practices, where cached state residuals after logical rollback can be exploited for sensitive information leakage. It challenges the assumption that application-level aborts guarantee state consistency, revealing a cross-layer gap between the logical and physical states. The findings emphasize the importance of incorporating cache-aware rollback mechanisms, especially in security-sensitive applications like confidential communication, automated decision-making, and multi-turn dialogue systems. By formalizing rollback consistency and demonstrating practical exploits, the work provides a foundation for developing safer, more robust language model architectures. It also informs industry standards for cache management, highlighting that simple cache resets or transaction-local rebuilds can effectively mitigate these risks without significant performance penalties.
Technical Contribution
The paper formalizes the concept of rollback consistency as a cross-layer property, distinguishing between attended-state integrity and observable effect-level consistency. It introduces a novel same-token/different-cache audit method to causally attribute state flips to retained KV residuals. The authors demonstrate that, across multiple models and architectures, stale KV caches can cause protected effect flips even after verified logical rollbacks, exposing a structural flaw. They propose a low-cost, transaction-local cache rebuild approach that restores state integrity without requiring global cache flushes. The work also extends the analysis to various policy structures and model types, including Mixture-of-Experts, establishing the generality of the problem and solution. This advances the understanding of state management in AI systems and provides practical mitigation strategies.
Novelty
This is the first comprehensive study revealing that KV-Cache retention during logical rollback can cause persistent state residuals, leading to security vulnerabilities. The introduction of the same-token/different-cache audit as a causal tool is innovative, enabling precise attribution of effects to cache residuals. Unlike prior work focusing on output correctness or isolated cache management, this research emphasizes cross-layer state consistency, bridging the gap between logical rollback and attended inference state. The proposed transaction-local cache restoration method offers a practical, low-cost solution, marking a significant step forward in secure AI system design.
Limitations
- The experiments are primarily conducted within the Hugging Face Transformers framework and specific model sizes; real-world deployment environments may exhibit additional complexities. The proposed fix, while effective, assumes the ability to perform transaction-local cache rebuilds, which might not be feasible in all systems.
- The study focuses on static, multi-turn interactions; dynamic, multi-user, or distributed scenarios may introduce additional challenges in maintaining state consistency. The potential performance impact of frequent cache rebuilds needs further evaluation.
- While the fix effectively closes the identified channels, it does not address other possible residual effects or side channels that might emerge in more complex or adversarial settings. Further research is needed to develop comprehensive, scalable solutions.
Future Work
Future research will explore extending the cache consistency framework to multi-user, multi-session environments, integrating hardware-assisted cache management, and developing automated tools for real-time detection and repair of residual state issues. Additionally, investigating the interaction between cache management and other security mechanisms, such as differential privacy or access control, will be crucial. The goal is to establish a unified, scalable approach for ensuring cross-layer consistency in AI systems, fostering safer deployment in sensitive applications.
AI Executive Summary
Deep Dive
Plain Language Accessible to non-experts
想象你在一家工厂工作，工厂里有很多机器（模型），每台机器都用一份记事本（缓存）记录工作内容。每次工厂决定暂停某个生产线（回滚），你以为所有机器都把记事本清空，重新开始。但实际上，有些机器的记事本没有被清空，它们还记得之前的内容。这样，当工厂继续工作时，这些机器会用旧的内容做决定，导致生产出错甚至泄露秘密。这个问题就像缓存没有同步，导致信息残留，可能被坏人利用。解决办法是每次停止生产线时，确保所有机器的记事本都被清空或重新装载最新内容，避免旧信息影响后续工作。这就像在模型中，重新构建KV缓存，确保状态一致，才能保证安全和正确。
Abstract
Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.