AI 中文总结
研究发现语言智能体中止分支时若保留KV缓存会破坏回滚一致性，引入同token/不同缓存审计方法验证该问题，提出事务局部缓存恢复方案可解决该结构性缺陷。
AI 中文摘要
有状态语言智能体假设可通过从应用对话记录中清除已拒绝的分支来回滚该分支。我们证明，当服务会话在逻辑中止后保留键/值（KV）状态时，这种假设会被打破：模型仍能关注到应用认为已丢弃的内容。我们将缺失的保证形式化为回滚一致性：完整的中止操作必须恢复模型所关注的状态，而非仅恢复对话记录。关键故障是跨层的：正确的逻辑回滚无需与保留的推理状态组合，且该差距对应用而言可能不可见。为分离缓存效应与文本效应，我们引入了同token/不同缓存审计方法，该方法保持决策步骤的token相同，仅改变缓存前缀是陈旧的还是从提交状态重建的。在7个开放权重模型族（38亿至360亿参数）中，仅保留KV缓存就会在63个审计单元中的25个内翻转类型化保护效应，且所有63个单元中服务请求均不存在攻击者token；重建缓存可关闭所有单元。该通道在端到端会话应用、默认Hugging Face Transformers缓存复用路径及LangGraph时间旅行中均会重现，其中已验证的逻辑回滚仍可能留下陈旧的关注KV。不同模型的易感性存在差异，但底层的关注状态完整性违反是结构性的。我们排除了位置和长度混淆因素，在保护效应、策略结构及缓存隔离的混合专家模型上进行了泛化，并证明事务局部缓存恢复可关闭该通道，无需全局缓存刷新。所有 headline 结果均为确定性结果，可从发布的工件中复现。
英文摘要
Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.
Comments21 pages, 5 figures, 7 tables
