{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.31366", "title": "AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents", "summary": "The method replaces treating deletion as a storage-level operation with a behavioral audit that compares exposed-then-deleted agents against matched never-exposed controls, and replaces naive exact-literal write filters with provenance-aware closure that also removes derived records such as summaries and decomposed components. The cost is engineering complexity: memory systems must track provenance from source records to all derived state, and audits require building controlled exposure/deletion test harnesses rather than relying on storage APIs. It can fail when provenance tracking is incomplete across heterogeneous memory stores, when response parsers misclassify target-bearing replies as clean, or when information persists in forms outside the tracked lineage.", "rationale": "Any production agent with persistent memory faces deletion-compliance obligations, and the paper shows on small open models (7B-class) that source deletion alone demonstrably fails while provenance-aware closure is a concrete, low-infrastructure mitigation the reader can implement and audit directly.", "technique": "Behavioral audit of post-deletion memory persistence in agents", "family": "seguranca_e_guardrails", "recommendation": "adotar", "published": "2026-10-22", "as_of": "2026-10-23", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.31366", "independent_implementations": 1, "total_implementations": 2, "stars": 10, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "The method replaces treating deletion as a storage-level operation with a behavioral audit that compares exposed-then-deleted agents against matched never-exposed controls, and replaces naive exact-literal write filters with provenance-aware closure that also removes derived records such as summaries and decomposed components. The cost is engineering complexity: memory systems must track provenance from source records to all derived state, and audits require building controlled exposure/deletion test harnesses rather than relying on storage APIs. It can fail when provenance tracking is incomplete across heterogeneous memory stores, when response parsers misclassify target-bearing replies as clean, or when information persists in forms outside the tracked lineage.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.31366", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Deleted secrets are recovered in roughly two thirds of single queries (Qwen2.5-7B-Instruct, zero in never-exposed controls); reconstruction from separately stored components succeeds in 62-99% of cases across Qwen, Mistral, and Phi-3; provenance-aware closure eliminates observed recovery in the tested positive-baseline settings.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.31366", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }