AI Agent Memory Deletion Verification: Counterfactual Tests

Executive Summary

Artificial intelligence (AI) agent memory deletion verification should test whether a withdrawn fact still changes observable behavior. The strongest practical comparison is a matched agent that never received the target information. A successful delete operation establishes a storage-layer result within its documented scope; it does not, by itself, establish the same result for derived memory or execution state. Amazon documents that deleting a short-term event does not remove information derived into long-term memory, while LangGraph documents checkpoint deletion separately from cross-conversation memory. ^{[1] [2]}

The proposed counterfactual evidence test separates exact-string recovery, semantic disclosure, target-dependent decisions and retained-task utility. It observes permitted tool arguments, retrieval results, logs and later summaries alongside final answers. Yu and colleagues' K-Bench, current version v2, observes six channels, including reasoning text where the harness actually exposes it. Its findings motivate multi-channel evaluation, without making hidden reasoning a prerequisite for testing a closed service. ^[3] Yao and colleagues' Forgetting Without Restarting defines an agent that never observed the target as the counterfactual, with an explicit boundary around reconstructible runtime state. ^[4]

The evaluation uses matched never-exposed, exposed-unchanged, exposed-removed and full-reset episodes, supplemented by sham removal and unrelated retained facts. These are proposed experimental controls, grounded in paired-observation methods rather than a published deployment guarantee. ^[5] Report union leakage, the proportion of episodes disclosing the target in any available channel, and a separate behavioral residual, the difference in target-dependent action rates between removed and never-exposed episodes. Prespecify an equivalence margin if the intended conclusion is practical equivalence; nonsignificance alone is insufficient. ^{[6] [7]}

Zero observed recoveries support a distribution-specific uncertainty statement, not universal forgetting. As a hypothetical design calculation (Hypothetical Example), zero events across 300 independent trials yield an exact one-sided 95% upper bound of approximately 0.994%, under a shared event probability. ^[8] Acceptance therefore requires an explicit observer, adequate positive controls, useful retained-task performance and complete available evidence. MUSE (Machine Unlearning Six-Way Evaluation) treats retained utility as a separate criterion, and work on contextual utility distinguishes removal from the ability to use information supplied again through an allowed prompt. (Source: proceedings.iclr.cc) (Source: proceedings.mlr.press) The defensible outcome is limited evidence of non-use under the tested conditions, failure of that claim, or an unassessable result.

Introduction and Background

A long-running agent can encounter a fact, summarize it, retrieve it later and use it to select a tool action. Evaluating withdrawal therefore requires a broader unit of analysis than a memory row. MemGPT's research design explicitly moves information between storage tiers, and LangGraph distinguishes information retained across conversations from thread-level checkpoints. These are concrete reasons to inventory the agent's accessible state before deciding what an intervention actually removes. ^{[9] [2]}

This report examines how to verify AI agent memory deletion when an enterprise withdraws a permitted source or stored fact from future use. For Reliable Context's audience, the decision is an evidence question: what can an evaluator demonstrate about subsequent disclosure and action? The protocol below evaluates the agent under test. It makes no product-specific claim about the publisher's forgetting capabilities.

Source withdrawal, fact correction and historical reconstruction have different acceptance targets. Withdrawal asks whether revoked information continues to influence permitted work. Correction asks whether the agent adopts an authorized replacement. Historical reconstruction asks whether a past record can be reproduced. The original LongMemEval benchmark includes knowledge updates and temporal reasoning among its memory abilities; those categories do not establish counterfactual non-use after withdrawal. ^[10]

The recent preprint literature sharpens this distinction. Wang and colleagues' Agentic Unlearning addresses parameter and persistent-memory pathways, including dependency-derived artifacts, whereas Yao and colleagues formulate a runtime comparison with a never-exposed agent. Their objects of intervention differ, so their results should not be merged into a single forgetting score. ^{[11] [4]} This article proposes an acceptance protocol informed by those distinctions, rather than a tutorial for editing model weights.

The practical question is narrow enough to evaluate: after a specified intervention, can a specified observer recover the target, or detect target-dependent choices beyond a prespecified tolerance? Its answer remains conditional on the probe distribution, available observations and experimental controls. K-Bench likewise states an observer boundary: reconstruction by combining fragments across channels lies outside its described observer model. ^[12]

What deletion verification measures

Information removal needs an operational definition. The protocol distinguishes actions that change access, actions that change stored state and measurements of subsequent behavior. Official documentation illustrates why these cannot be substituted for one another: disabling classic Amazon Bedrock agent memory disassociates memory from the agent, while Azure AI Search describes physical deletion as a background process. ^{[13] [14]}

The following terms define the proposed acceptance claim:

• Removal target: The particular source contribution, fact, preference or association withdrawn from use. Record whether the request concerns a value, one source supporting that value, or every derivation of that source. The World Wide Web Consortium (W3C) PROV data model provides a source-to-derived-entity relationship for expressing the lineage. ^[15]
• Access blocking: The target cannot be obtained through a declared interface by the tested principal. This is an interface property. Pinecone's metadata-filter deletion, for example, is scoped to matching records in a specified namespace. ^[16]
• Storage deletion: A declared object or representation is removed under the storage system's semantics. Qdrant explicitly distinguishes deleting selected vectors from deleting the enclosing points. (Source: qdrant.tech)
• Answer suppression: A final response omits the target. This leaves tool activity and intermediate state to inspect; ToolSandbox records per-turn state snapshots. ^[17]
• Residual influence: The target still changes observable decisions after intervention, even when no target string appears. Yao and colleagues supplement disclosure measurements with a string-free behavioral test. ^[4]
• Observer: The evaluator's allowed channels, probe policy and budget. For this protocol, the conclusion covers only that observer; stronger access requires a new evaluation.
• Counterfactual non-exposure: A comparison condition whose trajectory never incorporated the target. Pairing corresponding episodes supports analysis of differences rather than comparisons between unrelated tasks. ^[5]

The acceptance target must also separate source exclusion from value suppression. If an allowed independent source still supports the same value, continued use of that value need not indicate use of the withdrawn source. Provenance can represent distinct derivations, but a derivation record is not itself evidence about the model's internal causal pathway. ^[15] The proposed test must therefore specify whether correlated and independently inferable information remains permitted.

This distinction matters for literal recovery. A randomly assigned synthetic secret can have negligible prior exposure, whereas a public fact may be reproducible without the revoked source. Use the former for an isolated non-exposure experiment, and treat the latter as a provenance-sensitive task. Wang and colleagues explicitly identify limits in tracking cross-agent information flows, reinforcing the need to declare the scope of dependency coverage. ^[11]

An administrative deletion receipt belongs in the evidence packet. It should be interpreted alongside retrieval checks, available runtime observations and behavioral comparisons. Microsoft's documented key lookup expecting Hypertext Transfer Protocol (HTTP) 404 is useful evidence of document absence through that interface; it does not measure an agent's subsequent decisions. ^[14]

Specify the target and observable boundary

Begin with a synthetic target that is absent from the never-exposed fixture and unrelated to public knowledge. A nonce, a randomly assigned identifier, identifies literal disclosure; an arbitrary preference creates a target-dependent choice without requiring the nonce in the answer. This is a proposed experimental construction. Its purpose is to isolate influence from background inference; correlated facts remain a separately declared test condition.

Before exposure, freeze the permissible task, unrelated facts and scoring rules. Define what can be inspected without assuming that a closed model exposes hidden reasoning. Enumerate the channels the deployment actually makes available. Stateful tool evaluation provides a useful precedent for recording intermediate state alongside dialogue. ^[17]

Record the following scope decisions before running episodes:

• Target identity: Preserve the exact synthetic payload and its semantic interpretation in restricted fixtures. Keep it outside the never-exposed agent's prompts, tools and grading-visible context.
• Source identity: Record source and version identifiers, ingestion time and dependent artifacts known to the evaluator. A derivation relationship supplies a useful vocabulary for that record. ^[15]
• Intervention time: Identify the boundary after which non-use is required, including the period while asynchronous deletion may still be pending. AgentCore documents that expired records can remain readable before background deletion completes. ^[18]
• Observable channels: Enumerate final responses, retrieval, tool inputs and outputs, subsequent memory writes, and accessible summaries. Mark unavailable reasoning or provider caches explicitly as unavailable. Thread checkpoint inspection must be declared separately. ^[2]
• Correlated information: Decide whether retained sources may imply the target. If they may, distinguish authorized re-derivation from prohibited dependence on the withdrawn observation.
• External effects: Declare which tools can be reset or simulated. Treat non-restorable committed actions as outside any claim that the full environment has been reset.

Table 1 specifies a removal ledger for each target. It is a proposed audit schema, not a record of an executed benchmark; its source and derivation fields follow the provenance distinction above. ^[15]

The ledger links a claim to observations without turning unavailable layers into empty cells. An evaluator should use explicit states such as not observed, blocked or outside scope, with reasons. Storage documentation makes the need concrete: deleting an AgentCore event leaves derived long-term information, and LangGraph exposes a separate thread-checkpoint deletion operation. ^{[1] [2]}

Keep versioned model, instruction, retrieval, tool, source and sampling manifests. Preserve complete available trajectories rather than selected passages. ToolSandbox demonstrates the usefulness of per-turn state snapshots in stateful tool evaluation. ^[17]

Build matched counterfactual episodes

The experimental unit is an episode, a task trajectory with a declared initial state and observation window. Match episodes on everything intended to remain constant: task, unrelated evidence, tool environment and sampling plan. NIST describes paired data through one-to-one correspondence; applying that principle here makes the removal-versus-never-exposed contrast explicit. ^[5]

Use the following conditions, with labels fixed before execution:

• Never exposed: The agent receives all permissible information except the target. Its initial state and accessible external stores must also exclude the target.
• Exposed unchanged: The agent receives and retains the target. This positive control tests whether the task and probes can elicit disclosure or target-dependent behavior.
• Exposed then removed: The same target is introduced, followed by the candidate removal intervention at the declared boundary.
• Full-reset control: Restart from a target-free fixture and replay permitted history where reconstruction is feasible. Declare any external effects that this comparator cannot reverse.
• Sham removal: Execute the surrounding administrative procedure without removing the target. This tests whether changed instructions, latency or session handling explain a behavioral shift.
• Retained facts: Include unrelated questions and actions with valid supporting evidence. MUSE's retained-utility criterion motivates evaluating this dimension separately from forgetting. (Source: proceedings.iclr.cc)

A positive control must make the target relevant. If the exposed-unchanged agent cannot disclose or act on it, a low post-removal rate says little about intervention effectiveness. Also compare the never-exposed and reset conditions. A discrepancy may reveal a mismatched fixture, a replay artifact or a target-independent effect of restarting.

For a preference target, randomly assign which otherwise equivalent alternative is favored, and balance that assignment across fixtures. Keep action labels and target direction counterbalanced, so an agent's default preference does not masquerade as residual influence. These are proposed design controls; the analysis should still preserve episode pairing rather than pooling unmatched observations. ^{[5] [7]}

Replay requires particular care. Hold exogenous information constant where the counterfactual justifies doing so, but recompute tool responses when changed actions alter the relevant world state. Forcing an exposed-world response into a different counterfactual action sequence can create an incoherent control. ToolSandbox explicitly models successful tool execution as dependent on world state. ^[17] For this protocol, non-reconstructible observations are a limit on the counterfactual comparison.

Use matched random seeds where available, record unavailable seed control, and repeat across seeds. Separate episode replication from additional probes inside an episode. Multiple questions about the same contaminated trajectory are related observations. Hierarchical bootstrap work illustrates why nested measurements should not automatically be treated as independent samples; select an episode, user or session cluster according to the actual dependence structure. ^[19]

Finally, define the observation horizon before seeing outcomes. A later summary can reopen an information pathway after an apparently clean answer. Classic Bedrock agents generate stored summaries at session end, which supplies a concrete reason to include post-session artifacts when those are within the deployment's scope. ^[20]

Probe disclosure and decisions

A useful observer threat model states access, adaptation and budget together. Specify fixed or adaptive probes, cross-channel combination and credentialed access. Record probe count, token budget, adaptive rounds and stopping rule. K-Bench's stated exclusion of cross-channel fragment reconstruction illustrates why the observer definition is part of the result. ^[12]

The proposed probe suite has distinct targets:

• Literal recovery: Search permitted outputs for the exact nonce and declared normalizations. Record transformations such as whitespace removal before scoring, rather than inventing them after a suspicious response.
• Semantic disclosure: Test paraphrases, reversed relations and simple implications. An ACL evaluation expands unlearning tests beyond originals to rephrased, subject-replaced, relation-reversed and one-hop reasoned variants. ^[21]
• Structured disclosure: Inspect available tool arguments and returned fields, including identifiers that encode the target even when final prose omits it. ^[3]
• Delayed disclosure: Inspect later summaries and memory write-backs after unrelated intervening work. The runtime paper explicitly includes memory write-backs in its observable scoring. ^[4]
• String-free influence: Present choices whose correct permissible resolution is independent of the revoked preference, and score whether target assignment still shifts action selection.
• Retained usefulness: Score unrelated successful tasks, justified abstentions, unsupported refusals and tool errors separately. Retained utility is a distinct MUSE criterion. (Source: proceedings.iclr.cc)

Do not put the target into a recall question if the test is supposed to measure residual memory. A question that supplies the answer changes exposure. If deliberate reintroduction is part of a separate task, label it accordingly: work on contextual utility asks whether removed information can still be used when a user supplies it anew. (Source: proceedings.mlr.press)

Table 2 maps interventions to observations. Each cell is an evaluation obligation or declared limit, not an assertion that a particular product implements that intervention. The distinction between removing selected vectors and removing enclosing records is documented by Qdrant. (Source: qdrant.tech)

The unavailable cells constrain the conclusion. They do not make observable testing worthless, but they prevent a claim covering those layers. In particular, low final-answer recovery does not establish low union leakage. K-Bench's current abstract reports that structured-retrieval answer suppression can leave aggregate leakage unchanged. ^[3]

Use a versioned semantic rubric and retain original available outputs. Adjudicate ambiguous cases, report confirmed recovery and uncertain similarity separately, and keep protected grading fixtures out of later prompts. These are proposed scoring safeguards; they carry no published accuracy guarantee.

Run an auditable removal evaluation

Deletion in retrieval-augmented generation (RAG) includes at least a source lifecycle and a retrieval lifecycle. Azure documents that indexers do not automatically track object deletion and that adding deletion detection later does not retroactively remove earlier orphaned documents. Removing a source file therefore requires an independently verified index-side outcome in configurations with those semantics. ^[22]

Use the storage interface's documented completion behavior, then perform read and retrieval checks appropriate to the declared scope. Qdrant exposes a wait option for changes to occur. Weaviate documents background cleanup and limits for a single deletion query. These are implementation-specific reasons to distinguish request acceptance, visible absence and physical cleanup; none alone evaluates residual agent behavior. (Source: api.qdrant.tech) ^{[23] [24]}

A reviewable removal packet should contain:

• Versioned fixtures: Target-free and exposed initial states, source versions, probe definitions and task constraints.
• Intervention receipts: Requested scope, affected identifiers, completion signals, errors and independently observed absence checks. Microsoft's documented document-key lookup is one such check. ^[14]
• Provenance coverage: Source-to-derived-artifact links and known gaps, using explicit derivation relationships where appropriate. ^[15]
• Complete available observations: Tool activity, retrieval, task outputs, memory writes and permitted later summaries, with sensitive fixture access controlled. ^[17]
• Scoring configuration: Literal normalization, semantic adjudication, action labels, utility criteria and uncertainty method, including the unit resampled. ^[7]
• Exclusions and reintroduction paths: Unavailable provider internals, non-restorable external effects and allowed sources that may supply the target again. (Source: proceedings.mlr.press)

Do not let the evidence packet itself become an accidental reintroduction path. Store protected target fixtures and detailed observer transcripts outside the tested agent's retrieval permissions. The report can retain hashes and restricted artifact references while authorized evaluators retain the evidence needed to reproduce scoring. This is an evaluation-design recommendation, not a claim that hashes prove deletion.

Acceptance is a decision over the declared claim, not an automatic interpretation of an empty result:

• Fails: Confirmed prohibited disclosure occurs, or the behavioral residual falls outside the prespecified acceptable region.
• Limited evidence of non-use: Positive controls are sensitive, observation coverage is adequate for the claim, uncertainty meets the declared criterion, and retained utility remains acceptable.
• Unassessable: Necessary channels are unavailable, controls are insensitive, counterfactual state cannot be reconstructed, or uncertainty is too wide for the acceptance claim.

Retain these labels across releases so that a weaker observer cannot create an apparent improvement. The same caution applies across repeated removal requests: MUSE treats sustainability over sequential requests as a separate desirable property. (Source: proceedings.iclr.cc) Regression episodes should therefore test previously removed targets alongside newly withdrawn ones.

Data Analysis and Evidence

The quantitative report must disclose denominators, clustering, probe budget and exclusions. Union leakage counts an episode once when any observed channel recovers the target. Adding channel percentages double-counts overlapping episodes; channel-specific counts remain useful diagnostics alongside the episode union. This union definition makes the episode the unit of counting, while retaining channel diagnostics.

Table 3 defines the proposed scorecard. The metrics are an evaluation specification, not measured results from an executed agent.

An episode can pass literal recovery yet fail semantic disclosure or behavioral influence. Conversely, a never-exposed agent may independently choose the target-associated alternative. Subtracting its rate is therefore necessary for the proposed behavioral contrast. Preserve the correspondence when resampling: SciPy's paired bootstrap uses common sampled indices across arrays. ^[7] If episodes share users or source histories, resample at the relevant cluster level; preserve task strata when estimating an aggregate across heterogeneous tasks. ^[19] (Source: proceedings.neurips.cc)

For a practical equivalence claim, define a margin, delta, as the smallest action-rate difference that would change the deployment decision. Require the appropriate uncertainty interval to lie inside the prespecified equivalence region. Lakens describes the conventional two one-sided tests procedure, where a significance level, alpha, of 0.05 corresponds to a 90% confidence interval inside the equivalence bounds. Do not substitute an arbitrary bootstrap interval without establishing its properties for the intended test. ^[6]

For zero leakage, the hypothetical design calculation (Hypothetical Example) is:

upper bound = 1 - 0.05^(1/n) ^[8]

With n = 300 independent, identically distributed episodes and no observed events, the one-sided 95% upper bound is approximately 0.994%. The familiar approximation is 3/n. These are calculations from the binomial zero-event method, not a benchmark outcome. ^[8] NIST cautions against relying on normal approximations with small failure counts. ^[25] Repeated dependent probes do not create independent trials. ^[19]

Keep the sample size fixed, or choose a valid sequential method before monitoring results. Fixed-time inference does not generally retain its guarantees when stopping depends on observed outcomes. ^[26]

The literature supplies motivation, not transferable acceptance thresholds. In K-Bench v2, dated 14 September 2026, the authors report 22% to 86% leakage for prompt/retrieval secrets in settings where answer-only evaluations report none; its observer and substrate choices define that result's scope. ^[3] Forgetting Without Restarting also separates memory deletion from residual runtime behavior, while Agentic Unlearning uses task-specific forget, retained-performance and membership-inference metrics. ^{[4] [11]} Those measurements are different estimands. No reported percentage here establishes the performance of an enterprise deployment.

Implications and Future Directions

The next useful advance is a portable, observer-specific removal packet with paired behavioral controls. Its value is a hypothesis: teams could compare evidence across releases while retaining the exact boundary of each claim. A provenance vocabulary helps connect sources and derived artifacts, and a versioned task environment helps explain changes in behavior; neither replaces empirical observation. ^{[15] [17]}

Research artifacts should be distinguished from independent replication. As checked for this report, the author-linked K-Bench repository documents executable evaluation and scoring commands, including a local scoring smoke test that does not execute a model. Its code is MIT-licensed, the synthetic corpus uses Creative Commons Attribution (CC BY) 4.0, and the target adapter has a separate Llama 3.1 Community License. These terms apply to different artifacts. Repository availability is not evidence that this report reproduced the results. ^[27]

No own executable repository was established from the fetched paper pages for Forgetting Without Restarting or Agentic Unlearning. That is a bounded research finding, not a claim that no repository exists. The former's stated limitations concern model parameters, committed effects and correlated information; the latter acknowledges incomplete cross-agent dependency coverage. Both limitations matter when transferring a laboratory protocol to a persistent enterprise environment. ^{[4] [11]}

The memory-evaluation landscape also needs separate scorecards for retention and removal. LongMemEval's original abstention cases concern nonexistent events, which differs from suppressing influence from a previously encountered target. ^[10] MemGPT's multi-tier memory design makes it useful background for state inventories, without supplying a forgetting certificate. ^[9] Future comparisons should state which objective they test rather than treating temporal accuracy, absence of evidence and counterfactual non-use as interchangeable.

Finally, plan for authorized reintroduction. A later permitted source may contain the same fact, or a user may explicitly supply it for a new task. Contextual-utility research treats the ability to use newly supplied information as a distinct evaluation concern. (Source: proceedings.mlr.press) The removal claim must identify its time interval and evidence basis; a permanent ban on a value is a different policy from withdrawing one source.

Conclusion

AI agent memory deletion verification is an experiment about observable information use. A useful test starts with a target that the never-exposed control cannot obtain, introduces it into matched episodes, applies a declared intervention and compares subsequent disclosure and action. The never-exposed condition supplies the baseline for interpreting residual behavior. A clean final answer supplies only one observation.

The decision should keep disclosure, target-dependent choices and retained usefulness separate. Record which storage layers and channels were inspected, how asynchronous operations were handled, which external effects could be restored and which permitted sources might reintroduce the target. Preserve complete available evidence and the configuration needed to reproduce scoring.

Acceptance language should remain proportional to those observations. Confirmed prohibited disclosure or an unacceptable behavioral residual fails the claim. Adequate controls and uncertainty can support limited evidence of non-use under the tested observer. Missing essential access, incoherent counterfactuals or insufficient precision make the result unassessable. None of these outcomes is a universal forgetting statement or a legal erasure certificate.

The practical deliverable is a versioned removal packet whose conclusions another evaluator can inspect and challenge. It states what was withdrawn, what comparison was constructed, what was observed and how much uncertainty remains. That makes an evidence-removal decision reviewable without confusing a storage receipt, an answer filter or a successful unrelated task with removal of the target's influence.