Abstract
Tool-using LLM agents can modify persistent state outside their conversational context, including memory and application data. This creates a recovery problem: restarting an agent may clear transient conversational state while leaving changes made elsewhere in the system intact. This research studies the distinction between agent-level and system-level recovery and evaluates recovery strategies using a controlled synthetic environment.
Research Question
To what extent do common recovery strategies eliminate residual compromise in stateful, tool-using LLM agent systems?
Threat Model
This study uses a controlled synthetic research environment. The experimental agent has only three tools:
read_ticket(ticket_id)write_memory(key, value)update_customer(customer_id, field, value)
No production systems, real customer records, credentials, shell access, browser access, or external infrastructure are involved.
Experimental System
System state is represented conceptually as:
- C
- Conversational / session state
- M
- Persistent agent memory
- D
- Application / database state
Recovery Model
The study compares four recovery conditions. Each condition restores a progressively wider part of the system.
| Condition | C | M | D |
|---|---|---|---|
| R0No recovery intervention | - | - | - |
| R1Fresh agent/session | ✓ | - | - |
| R2Fresh agent/session + persistent memory restoration | ✓ | ✓ | - |
| R3Fresh agent/session + memory and database restoration | ✓ | ✓ | ✓ |
C: session · M: memory · D: database. ✓ Restored · - Not restored.
Measurements
Recovery is evaluated across both agent behavior and persistent state.
- Behavioral Recovery
- The post-recovery agent completes clean follow-up tasks without behavior attributable to the compromised state.
- State Recovery
- Relevant persistent state matches the known-good state.
- System Recovery
- Behavioral Recovery AND State Recovery.
Current Status
The research is in progress. The experimental apparatus and recovery methodology are currently being validated. Results and reproducibility artifacts will be published after the study is complete.
Final recovery results have not yet been published.
Artifacts
Reproducibility materials will be linked here after completion.
- Paper
- Coming after completion
- Experimental protocol
- Coming after completion
- Code
- Coming after completion
- Results/data
- Coming after completion