Study: leftover KV cache quietly breaks rollback in language agents

Paper shows that 'logical' rollback in stateful language agents is not a real rollback: if the serving session retains key/value (KV) cache state after an aborted branch, the model keeps attending to supposedly discarded content. The authors formalize the missing guarantee as 'rollback consistency' (a full abort must restore the model's attended state, not merely the transcript), and demonstrate the flaw with a same-token/different-cache audit across seven open-weight model families (3.8B-36B) in real settings: the default Hugging Face Transformers cache-reuse path and LangGraph time-travel, where verified logical rollback still leaves stale KV; it also reproduces in an end-to-end session application. Stale KV alone flips a typed protected effect in 25 of 63 audited cells, with attacker tokens absent from all 63 served requests; rebuilding the cache closes every case. Proposed fix: transaction-local cache restoration at abort time (no global cache flush needed). Results claimed deterministic and reproducible from released artifacts.

Directly relevant to anyone running agents with branch/reject/retry loops (LangGraph time-travel, tree-search agents, Claude Code-style forking): cross-session and subagent forks are only safe if the serving path actually rebuilds attention state. The failure is invisible at the application layer — audits must target the serving stack. Also a security channel: attacker-influenced content can persist in cache after logical removal. Simple mitigation: rebuild/restore cache at abort boundaries.