Beyond Rollback: Auditing Revocable External Memory for Hardware-Design LLMs

Revoking a designated asset from an external-memory LLM is a lifecycle question rather than a single rollback operation. A defensible revocation claim must establish authorized utility, collateral capability, selective serving removal and artifact sanitization. We operationalize these requirements for RTL generation and instantiate them in EXCISE, a detachable content-addressed cartridge attached to a frozen backbone. On a locked 128-task evaluation, attaching EXCISE raises functional recovery from 2.3% to 21.1%, while VerilogEval-v2 capability changes from 44.9% to 42.3% (p = 0.523). Disabling all routing reproduces every base output. At the selected layer, a matched 32-asset checkpoint reaches 81% direct recovery while attached and 0% after serving deletion, passes 48.1% of VerilogEval-v2 versus 44.9% for the frozen base, and preserves all 992 by-stander functional outcomes. Across three 32-asset checkpoints, direct recovery ranges from 59% to 72% with intact cartridges and from 0% to 3% after per-asset serving deletion. Between 99.8% and 100% of bystander pairs preserve function. However, a four-prompt stochastic audit finds recovery on 75% of assets with the intact memory, 50% after serving deletion, and 44% with routing disabled, showing that serving deletion does not always match complete routing shutdown during generation. Artifact audits reveal membership signals in both serialized routing metadata (AUC 0.851) and learned embeddings (AUC 0.971). Registry rebuild removes the tested metadata signal (AUC 0.491) but not the embedding signal, so sanitized release requires a fresh cartridge. Overall, external memory supports practical asset-level serving revocation, while output-level deletion and artifact sanitization remain separate obligations