A system that remembers everything forever is not a good continuity system. But “delete” is one word for twelve different operations with twelve different guarantees. This page names them, in order, with what each leaves behind and what the research of 2026 found at every rung.
Checked 7 November 2026. Sources linked. Our own framing is labeled as ours.
Our proposal The fifth obligation of the Continuity Framework; the ladder is our ordering of established and emerging operations.
The first version of this site's thesis treated forgetting as one of memory governance's loose ends. The 2026 research closed the question. Three findings did it. Deleting a stored memory leaves its influence in the summaries, plans and caches built from it, so an agent keeps acting on a preference the user revoked. Soft-deleting a vector leaves the embedding on disk, where it can be read and inverted back to the text it came from. And even a dependency-aware deletion is undone within a handful of ordinary sessions, as copies in artifacts, peer agents and restored checkpoints bring the fact back and consolidation writes it into the store again.
Put together: a continuity layer that cannot forget to a stated rung, and show that it did, is carrying a liability it cannot discharge. That makes forgetting the fifth obligation, next to carrying, governing, evolving and proving, and it makes provenance the hinge between them, because a system can only remove what it can trace.
Four bands. The first changes the record and keeps its history; the second restricts who can read it; the third removes it, each rung reaching further than the last; the fourth is not an operation but an audit, three of them, each stronger than the one before. No rung implies the ones above it: an API delete (5) says nothing about derived memories (6), the index (7), backups (8) or the model (9), and a certificate (8) says nothing about next week (11).
The record was wrong. The wrong value is closed with the reason “incorrect” and the right value takes its place.
Evidence
The world changed. The old value's valid time ends; the new value begins; both were true in their time.
Evidence
A retention rule ends a fact's validity on a schedule, without anyone asking.
Evidence
The record stays; a reader, a tool or a peer loses the right to see it.
Evidence
The row, document or memory item is removed from the primary store through the system's own delete.
Evidence
Summaries, plans, reflections, cached outputs and skills that drew on the item are withdrawn and rebuilt from what remains.
Evidence
The vector, keyword and graph indexes drop the item's entries rather than flagging them deleted.
Evidence
Each item or subject is encrypted under its own key; deletion destroys the key, with a signed receipt.
Evidence
The item's influence is removed from a model's parameters, approximately, as if it had never been trained on.
Evidence
An audit, not an operation: can the item be recovered from any store, index, backup or artifact right now?
Evidence
The audit is repeated across later sessions and every state the agent can reach.
Evidence
Behavioral audits check that the deleted item no longer steers what the agent does, not only what it says.
Evidence
Precision matters here more than anywhere else on this site, because the gap between what a deletion claim says and what it guarantees is where users get hurt. Three statements hold across the research:
How this reads against the sentences on a product page:
| The claim | What it actually reaches |
|---|---|
| “Deleted memories are removed from our servers within 30 days.” | Rung 5, with a retention window. Says nothing about summaries built from the memory (rung 6), the vector index (rung 7), backups (rung 8), or the model (rung 9). |
| “Your data is encrypted at rest.” | Not an erasure claim at all unless each subject has its own key and the key is destroyed on deletion. Encryption with one shared key is rung 5. |
| “Deleting a chat deletes what the assistant learned from it.” | Rung 6 if the system tracks which memories derived from which chat and repairs them; rung 5 if it deletes the chat and leaves the derived memory. Ask which. |
| “We use machine unlearning to honor deletion requests.” | Rung 9 only if the item was in training data and the method is judged against a retrained reference. For memory that was never in the weights, unlearning is the wrong tool and the claim is a category error. |
| “We provide a deletion certificate.” | A receipt (rung 8 if cryptographic, rung 5 if administrative) is a snapshot. It is not rung 11: nothing in a certificate says the fact did not come back next week through a checkpoint or a peer agent. |
On this site, the delete test on the memory-systems shelf (M8) and the deletion and retention questions on the Scorecard are read from makers' own pages and are, at most, rung 5 with a stated retention window. A “yes” there is a documented delete, not a verified forget. Where a maker documents a higher rung, the cell says which.
Eight sources, all from 2026, in the order a reader should take them. Each entry in the research library carries its authors, date, link, contribution, limits and status.
Shulin Lu · November 2026 · Accepted to the NeurIPS 2026 workshop Privacy in the Era of Large Opaque Models (December 2026); OpenReview
In a pilot with dependency-aware deletion, immediate residue was 7%, but 93% of facts became recoverable within five ordinary sessions: checkpoint restores (92%), tool-written artifacts (77%), peer-agent copies (71%), consolidation write-back (12%); revocation without deletion retained 99%. Recommends trajectory audits, scope-aware deletion APIs with receipts, and revocation as a deletion trigger.
02Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents
Chao Yao, Yangbo Wei, Zhen Huang, Junhong Qian, Chenle Chen, Shaoqiang Lu, Chen Wu, Lei He · 4 September 2026 · arXiv:2609.04875
Memory deletion left leakage unchanged; instruction-based forgetting still yielded the target; source redaction still acted on a revoked preference in 80% of episodes; selective replay matched a full reset with up to nine times fewer recomputed tokens. Proves exact unlearning needs at least T−τ+1 recomputed transitions.
03MemoRepair: Barrier-First Cascade Repair in Agentic Memory
Yang Zhao, Chengxiao Dai, Mengying Kou, Yue Xiu · 8 May 2026 · arXiv:2605.07242
Baselines left 69.8–94.3% of the affected cascade exposed; the method reached 0% exposure under complete influence provenance. Dropping 1% of dependency edges produced 17.7% leakage, which is the quantitative case that erasure is bounded by provenance.
04Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases
Chandranil Chakraborttii, Jackeline García Alvarado, Sitora Abdulofizova, Shivanshu Dwivedi · 16 June 2026 · arXiv:2606.18497
Recovered about a quarter of names and nearly half of locations from biographies, full age and sex from a synthetic clinical set, and 99% identity on facial embeddings; proposes per-epoch key rotation that destroys the key on deletion, with a signed deletion proof, bringing recovery to 0% in their tests.
05Position: The Term “Machine Unlearning” Is Overused in LLMs
Sangyeon Yoon, Yeachan Jun, Albert No · 8 May 2026 · arXiv:2606.27379; ICML 2026
The vocabulary this site uses for rung 9 of the erasure ladder, and the warning that low forget-query accuracy rewards hiding information at the output while influence and derived capabilities remain.
06Can an AI Assistant Really Forget? Auditable Deletion from Addressable Memory
Vishwajith Ramesh · July 2026 · arXiv:2607.27539
An edited model disclosed a deleted answer on 3 of 18 field queries against 18 of 18 for a prompt-only instruction to forget, at 1.9% perplexity cost.
07Can Agents Truly Forget? Explore Machine Unlearning for LLM Agents
Junkai Lin, Ge Xu, Zheng Xu, Junkai Chen, Xiangyuan Lan · 13 October 2026 · arXiv:2610.17659
Parametric forgetting did not predict agent behavior: adding memory raised one model's forget-set score from 16.8 to 30.1 after unlearning.
Dongxu Yang · 14 June 2026 · arXiv:2606.15903
Deterministic methods fail canonicalization (5% on obfuscated identifiers, 0% cross-lingual); an LLM at write time fixes that but cannot do intent-aware deletion; a mutation-time LLM hook brings intent-aware deletion to 78–85% and overall accuracy to 91.7–93.2% at about $0.17 a run, without touching the recall path.
| Instrument | What it asks | Status |
|---|---|---|
| GDPR, Article 17 | Erasure of personal data without undue delay in defined cases, and a duty to inform other controllers. Silent on models, summaries and embeddings. | In force since 25 May 2018 |
| EDPB Opinion 28/2024 | A trained model may itself hold personal data; anonymity is assessed case by case; unlawful training has consequences for deployment. | Adopted 17 December 2024 |
| EU AI Act, Article 12 | High-risk systems must log events over their lifetime for traceability, which is the record a deletion receipt would sit in. | Annex III application moved to 2 December 2027 by Regulation (EU) 2026/1744 (in force 27 July 2026) |
| NIST SP 800-88 Rev. 2 | Cryptographic erase as a sanitization technique: destroy the key, keep the ciphertext unreadable. | Published 26 September 2025 |
| IETF draft-saihm-memory-protocol-03 | Operators must say whether a forget operation is cryptographic or access-control erasure; every forget writes a receipt. | Individual draft, 11 October 2026, no formal standing |
Hypothesis Stated so it can fail in the open.
Forgetting is a provenance problem. A system can delete, to any rung of the ladder, only what it can trace; the completeness of the lineage graph bounds the completeness of erasure.
What would settle it: A study that achieves verified non-influence (rung 12) without item-level provenance, or one that shows provenance completeness does not predict residue. The strongest evidence so far runs the other way: cascade repair reaches 0% exposure only under complete provenance and loses 17.7% of its coverage when 1% of the edges are missing; provenance-guided replay is the method that matched a full reset; and the poisoning root cause is provenance lost at the write path.