Selective Revocation and Replay: Post-Compromise Recovery of Explicit Persisted State in Memory-Augmented LLM Agents

Persistent indirect prompt injection becomes a recovery problem once malicious instructions are written into durable agent state. We study post-compromise recovery for explicit persisted state in a provenance-tracked, text-only, local-files agent runtime, assuming suspicious roots are given after compromise. Selective replay revokes persisted descendants of those roots and replays only dirty state-writing events when replay is sound, with fallback to coarse rollback otherwise. In a frozen deterministic matrix spanning 8 task chains, 2 memory architectures, 2 attack variants, 5 methods, and 1 ablation, selective replay is the only method that simultaneously achieves zero residual attack success and non-zero S4 retention on explicit attacks. On retrieval memory, it matches rollback’s retained state while reducing post-detection cost from 17 to 9 extra LLM calls. We then run a focused live confirmation on schema-constrained qwen2.5:14b over two explicit retrieval chains. Across all six unrecovered reruns, residual attack success remains 1.0; across all six selective-replay reruns, residual attack success falls to 0.0 while both S3 correctness and S4 retention reach 1.0. The strongest travel case requires only four revocations and two replayed writer events with no fallback. This is a narrow result about explicit persisted state, not a general solution to prompt injection detection or hidden-state repair.