ActLeak: Action-Channel Memory Leaks in Tool-Using LLM Agents

Abstract

Classical software memory leaks are allocations that outlive their intended lifetime. Tool-using large language model (LLM) agents exhibit an analogous failure that current “forgetting” mechanisms do not measure. A user or policy issues a forget request for a memory m*; the underlying store correctly drops the record, and content probes no longer reproduce the fact; yet the agent’s tool-selection behavior on the next turn continues to favor the same tool that m* had taught it to prefer. We call this an action-channel memory leak. Formally, let π(t∣q,M) denote an agent’s distribution over tools t in a catalog T given a query q and memory state M, let F(M,m*) denote a declared forget operator, and let M★ denote an oracle store from which m* and all of its derived traces have been removed. The leak is the total-variation distance between π under the forgotten store MF and π under M★. This paper contributes a three-layer leak taxonomy (store, shadow, action), an interventional audit built on masking, upweighting, and swapping retrieved memories, and Forget-Consistent Coupling (FCC) a reference monitor that withholds confirmation of a successful forget until the measured action-channel leak falls under a budget ε. We further specify ActLeak-Bench, an evaluation protocol addressing tool selection after forgetting, as distinct from tool-parameter deflection while a memory remains live. We situate this contribution relative to closely adjacent work on memory-driven tool-selection bias and behavioral unlearning verification, present the protocol, evaluation conditions, and pre-registered hypotheses, and discuss what is required to execute the protocol and what a small-scale pilot would look like.