PaperlayerView exact revision on arXiv

Source-linked AI summary

Weighted Memory Tree: Remembering What Matters for Long-Horizon LLM Agents

Quang Dao, Purvi Kathalkar, Kenneth Eaton

arXiv:2608.20631v1cs.AI

TL;DR

Long-horizon agent histories accumulate stale, irrelevant, and misleading information, while existing memory methods provide limited control over which memories remain active. WMT uses hierarchical memory with dynamic retention scoring and lifecycle management; across GAIA benchmarks it improves accuracy and reduces prompt-token usage, while poisoning experiments show improved robustness. It is evaluated only within the GAIA benchmark family.

  • Problem

    Growing execution histories mix useful evidence with outdated or misleading information, while existing approaches do not explicitly estimate memories’ continuing utility.

  • Method

    WMT organizes task, subtask, and action memories with dynamic retention scores, event updates, selection-based decay, folding, and suppression.

  • Results

    WMT improves accuracy over linear history by 9.97 percentage points on GAIA-Text and reduces prompt-token usage by 32.8% across three base models.

  • Takeaways & Limitations

    The results suggest that effective long-horizon memory depends on selectively retaining task-relevant information while suppressing outdated or unreliable content.

  • Takeaways & Limitations

    Evaluation is limited to the GAIA benchmark family, so performance may differ on interactive web environments and software-engineering tasks.

Abstract

from arXiv · show

Large language model (LLM) agents have demonstrated the ability to solve multi-step tasks requiring planning, tool use, and external information access, yet growing execution histories increase inference cost and expose reasoning to outdated, irrelevant, or misleading information, potentially degrading reasoning quality. Existing memory approaches organize or compress execution histories but provide limited mechanisms for deciding which memories remain active. We introduce the, a hierarchical memory system that organizes execution into tasks, subtasks, and actions while assigning each memory a dynamic retention score. Event-based updates and selection-based decay revise these scores, allowing WMT to preserve useful information, fold completed trajectories, suppress low-utility content, and retain access to folded context. We evaluate WMT on GAIA-Text using Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B, with ablations and memory-poisoning experiments. Relative to linear memory, WMT improves accuracy by an average of 9.97 percentage points while reducing prompt-token usage by 32.8%. Memory-poisoning experiments show that WMT limits the persistence and propagation of unreliable information. Our results suggest that effective long-horizon agent memory depends less on storing more information than on deciding which information should remain active.

1 Introduction

Long-horizon agents need memory to preserve task state, but growing histories mix useful evidence with stale, failed, and incidental content. WMT addresses this gap by dynamically estimating memory utility to regulate working context.

  • Growing execution histories mix useful information with outdated observations, failed attempts, and incidental details, complicating subsequent decisions.
  • Linear history preserves complete trajectories but treats all memories equally, increasing prompts and forcing relevant information to compete with stale content.
  • Structured approaches preserve task hierarchy or compress completed subtasks but do not explicitly estimate each memory’s continuing utility.
  • WMT organizes task, subtask, and action memories with dynamic retention scores that prioritize context, suppress low-utility branches, and fold completed branches.
  • WMT reduces attack success rate, poison retrieval rate, blast radius, and amplification factor while achieving the highest task success rate in poisoning experiments.

2 Weighted Memory Tree

WMT maintains a persistent hierarchical execution memory and constructs compact working contexts through retention scoring, lifecycle control, and selection feedback. These mechanisms preserve access to folded context while suppressing low-priority branches.

  • WMT organizes execution history as a persistent hierarchy and constructs compact working contexts without modifying the base agent’s parameters or tool interface.
  • The Prompt Synthesizer selects memories from persistent state and serializes them with the query and tool specifications into the working context.
  • Dynamic Retention Scoring: Execution outcomes update node retention scores and branch priorities, while prompt selection resets selected-memory misses and decays eligible but unselected memories.
  • Hierarchical Memory Tree: The tree contains global memories, query-specific nodes, and parent–child relations; nodes represent queries, tasks, subtasks, and actions with lifecycle metadata.
  • Lifecycle Management: Lifecycle states determine prompt eligibility: completed branches fold into summaries, low-priority branches become obsolete without deletion, and resumed branches reopen.
  • Dynamic Retention Scoring: Successful actions receive higher priority than failures, while failures remain available as warnings against repeating unsuccessful operations.

3 Experimental Setup

The experiments evaluate accuracy, prompt-token usage, and poisoning robustness across GAIA settings, three frozen base models, controlled memory variants, and component ablations. Configurations share the same agent scaffold and differ only in memory system.

  • WMT is evaluated for task accuracy and prompt-token usage on GAIA-Text and GAIA across three base models, plus robustness under memory poisoning.
  • Benchmarks: GAIA-Text contains 127 validation questions without input files, whereas GAIA contains all 165 questions for broader end-to-end evaluation.
  • Models and Agent Configuration: Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B use the same frozen OpenTools-based scaffold, tools, instructions, and interaction limits.
  • Memory Variants: The primary variants are No Memory, Linear History, Unweighted Tree, and Full WMT.
  • Evaluation Metrics: Prompt-token usage counts all language-model calls, including base reasoning, semantic selection, and branch summarization.
  • Memory Poisoning: Poisoning attacks insert misleading observations to test whether utility-aware management reduces poisoned information’s persistence and propagation relative to linear memory.
  • Ablations: Ablations remove retention scoring, lifecycle control, or semantic retrieval to isolate their contributions.

4 Results

Across GAIA-Text and GAIA, WMT delivers the strongest memory-based accuracy–efficiency trade-off and outperforms linear and unweighted memory configurations. Its robustness results further indicate that retention scoring, lifecycle management, and semantic retrieval jointly limit unreliable-memory influence.

  • Main comparison: WMT achieves the highest accuracy and lowest prompt-token usage among memory-based configurations across both benchmarks and all three models.The no-memory condition uses fewer tokens but is a lower-bound reference because it does not preserve prior interactions.
  • Main comparison: 9.97 percentage points: WMT’s average GAIA-Text accuracy improvement over linear history, alongside a 32.8% average reduction in prompt-token usage.The model-specific accuracy gains are 13.39, 8.66, and 7.87 percentage points, while token reductions are 25.6%, 42.0%, and 30.8%.
  • Main comparison: 10.10 percentage points: WMT’s average GAIA accuracy improvement over linear history, with a corresponding 32.2% average token reduction.The improvement and reduction remain consistent across Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B.
  • Ablations: WMT outperforms the unweighted tree in all six model–benchmark combinations by 5.46–18.11 percentage points while using fewer prompt tokens each time.The unweighted tree’s accuracy advantage over linear history is inconsistent across models and benchmarks.
  • Ablations: Selection and summarization address complementary context-construction goals, but retention scoring and lifecycle control are needed to prioritize useful memories and suppress low-utility branches.Selection generally improves accuracy but increases token usage, whereas branch summarization reduces tokens with mixed accuracy effects.
  • Memory poisoning: Removing retention scoring or lifecycle management weakens robustness, while removing semantic retrieval reintroduces irrelevant or poisoned information through whole-branch retrieval.A1 permits lower-value memories to remain influential, A2 yields complete infection persistence, and A3 increases prompt size and contamination metrics.
  • Memory poisoning: WMT records the lowest attack success rate, poison retrieval rate, blast radius, and amplification factor while matching the lowest infection persistence and achieving the highest task success rate.Its reported values are ASR 0.419, PRR 0.097, BR 0.315, AF 0.965, IP 0.009, and TSR 0.575.

5 Related Work

Prior agent-memory systems externalize, structure, retrieve, or summarize information from execution histories. WMT extends task-structured memory with an explicit utility state used for both context construction and lifecycle control, while addressing reliability and poisoning concerns within a defined scope.

  • Memory for LLM agents: Generative Agents, MemoryBank, and MemGPT externalize agent information through experience retrieval, continually updated conversational memory, or memory tiers.These systems extend or manage information beyond the immediate context using different storage and retrieval strategies.
  • Structured working memory: HiAgent, TME, and Context-Folding structure working memory around subgoals, task hierarchies, active paths, or folded completed traces.These methods establish task structure and compression as mechanisms for managing execution history.
  • WMT’s distinction: WMT adds an explicit utility state updated from execution outcomes and memory-selection behavior, aggregated across branches, and used for prompt construction and lifecycle control.This utility state distinguishes WMT from approaches that structure or compress history without explicitly modeling continuing utility.
  • Long-context reliability: Long-context findings motivate selecting task-relevant state because increasing available context does not ensure reliable use of included information.The cited studies report sensitivity to evidence position and reasoning degradation as input length increases.
  • Memory robustness: Persistent agent memory creates an adversarial surface because malicious records can be retrieved and influence subsequent behavior.WMT studies whether organization, utility scoring, lifecycle control, and selective context construction reduce unreliable-record persistence and propagation.
  • Memory robustness: WMT is not a general-purpose detector of factual errors or adversarial inputs; it regulates the influence of stored information after insertion.Its robustness evaluation concerns memory management rather than universal detection of unreliable content.

6 Conclusion

The conclusion presents WMT as a hierarchical memory-management framework that explicitly models memory utility and combines scoring, lifecycle management, and utility-aware prompt construction. Across benchmarks and poisoning experiments, the complete system provides the strongest supported balance of accuracy, efficiency, and robustness.

  • Contribution: WMT organizes agent execution into hierarchical task and action memories while explicitly modeling each memory’s continuing utility.The framework separates persistent memory from the context used for immediate reasoning.
  • Benchmark results: Across three base models, WMT improves accuracy over linear history by 9.97 percentage points on GAIA-Text and 10.10 percentage points on GAIA.It simultaneously reduces prompt-token usage by 32.8% and 32.2%, respectively.
  • Robustness: In memory-poisoning experiments, WMT achieves the lowest attack success rate, poison retrieval rate, blast radius, and amplification factor while attaining the highest task success rate.These results support improved robustness under the study’s controlled poisoning protocol.
  • Conclusion: Hierarchical organization, lifecycle management, and semantic retrieval each contribute to performance, with their combination producing the strongest balance of robustness, reasoning quality, and prompt efficiency.The conclusion attributes the strongest overall balance to combining the principal WMT components.

7 Limitations

The evaluation is bounded by benchmark, model-scale, and configuration choices, leaving performance in broader settings and with learned memory policies unresolved.

  • Evaluation covers only the GAIA benchmark family, so performance may differ on interactive web, software-engineering, embodied, or extended-conversation tasks.
  • Each benchmark question initializes a new task tree, leaving WMT’s crossconversation global-memory mode unevaluated.
  • The experiments use only Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B, so model-scale effects remain open.
  • Hand-specified initialization values, update rules, branch coefficients, and obsolescence thresholds may not transfer optimally across architectures or task distributions.
  • Retention scores estimate operational utility rather than factual correctness, and selectors or summarizers may introduce errors and extra calls.
  • Future work should test broader interactive benchmarks, long-running conversations, and learned alternatives to fixed memory-management rules.

A.1 Equations for Evaluation Metrics ASR = Cs

The evaluation metrics quantify memory-poisoning robustness, context compression, and task success by relating contaminated-memory behavior and selected prompt content to outcomes.

  • ASR: ASR measures the proportion of critical reasoning steps compromised by poisoned memory, with lower ASR indicating greater robustness.
  • PRR: PRR measures poisoned memories selected for the working context relative to selected clean memories, with lower PRR indicating fewer poisoned selections.
  • IP: IP measures injected poisoned memories that remain active or eligible for ordinary context construction, with lower IP indicating stronger long-term resilience.
  • Blast Radius: Blast Radius measures prompt-construction steps containing contaminated memory, with lower values indicating influence across fewer prompts.
  • Amplification Factor: Amplification Factor measures repeated retrieval of injected poisoned memories relative to their initial number, with lower values indicating less repeated influence.
  • CCR: CCR measures selected memory tokens relative to candidate tokens at each prompt step; lower CCR indicates greater compression but must be interpreted with task success.
  • TSR: TSR is the proportion of evaluated tasks successfully completed under adversarial memory contamination, with higher TSR indicating more successful tasks.

A.2 GAIA-Text and GAIA Component Ablations

The ablations compare memory configurations under shared benchmark conditions and show model-specific trade-offs among hierarchical organization, selection, summarization, and full WMT control.

  • Shared evaluation configuration: The ablations use identical GAIA questions, agent scaffold, tools, instructions, and interaction budget; GAIA-Text has 127 questions and GAIA has 165.
  • Shared evaluation configuration: Each question uses a new query-specific memory tree, and prompt-token totals include all enabled reasoning, selection, and summarization calls.
  • Component configurations: The main comparison includes No Memory, Linear History, Unweighted Tree, and Full WMT, with additional configurations isolating selection and completed-branch summarization.
  • Component configurations: Tree Memory provides task, subtask, and action nodes without semantic selection, summarization, dynamic retention, or suppression.
  • Component configurations: Tree + Selection adds an LLM-based relevance selector, while Tree + Summary folds completed branches without semantic selection or dynamic retention scoring.
  • Component configurations: Full WMT combines hierarchical memory, selection, summarization, retention updates, decay, branch priorities, suppression, and reopening.
  • Model-specific trends: Qwen3-8B benefits most among partial configurations from Tree + Selection, whereas Gemma 4 E4B performs best with Tree + Selection + Summary.
  • Model-specific trends: Llama-3.1-8B reaches 19.69% with Tree + Summary on GAIA-Text, while Full WMT achieves its best overall Llama result at 24.85% on GAIA.

A.3 Memory-Poisoning Ablation Details

The memory-poisoning evaluation compares WMT with progressively simplified memory systems under matched scenarios and reports accuracy, prompt-token usage, and poisoning metrics. Full WMT combines hierarchical organization, retention scoring, lifecycle control, and semantic selection.

  • Evaluation setup: 100 scenarios contain 297 subtasks and 1,118 memory entries, including 709 benign and 409 intentionally poisoned memories.Poisoned entries introduce misleading observations, fabricated claims, or compromised tool-derived information.
  • Evaluation setup: The evaluation reuses identical scenario structures and injected memories across configurations to isolate memory-system effects on poisoned-information persistence and propagation.The isolated factors include organization, retention scoring, lifecycle management, and semantic retrieval.
  • Configurations: Five configurations compare linear memory, an unweighted tree, and ablations removing lifecycle control or semantic retrieval against full WMT.The ablations progressively disable hierarchy weighting, lifecycle operations, or semantic selection.
  • Reported metrics: Accuracy is measured as the percentage of correctly completed tasks, while prompt-token usage is reported in millions for GAIA-Text and GAIA.The table captions specify these metrics for both component-ablation tables.
  • Configurations: Full WMT uses hierarchical memory, dynamic retention scoring, branch-level priorities, lifecycle control, and semantic prompt construction.These components jointly define the complete memory configuration.
  • Reported metrics: The poisoning analysis additionally reports ASR, PRR, IP, BR, AF, CCR, TSR, prompt-token usage, and latency.Definitions are provided in Appendix A.1, with complete results reported in Table 4.

A.4 Worked Example of Memory-Poisoning Dynamics

WMT demonstrates memory-poisoning dynamics through a task tree in which event outcomes initialize retention scores and selection feedback changes later influence. Completed branches are folded, while poisoned memories remain available for provenance but can be excluded from working context.

  • Tree representation: Figure 2 uses blue nodes for query and task hierarchy, gray nodes for ordinary actions, and red nodes for intentionally poisoned memories.Its two branches identify a candidate paper and extract its authors; the figure illustrates state updates rather than a canonical paper ranking.
  • Tree representation: WMT creates a query root, attaches subtasks beneath parent tasks, and records each action with its observation and execution outcome.Each node stores content, type, parent, lifecycle state, retention score, missed-selection count, and execution metadata.
  • Event scoring: Successful actions receive an intermediate retention score of 0.75, while failed actions receive 0.30 before selection feedback is applied.The tilde denotes the event-assigned intermediate score; later selection-based decay can produce the final retention score.
  • Selection feedback: A memory’s score is updated after consecutive missed selections, whereas selecting it resets its missed-selection count and memories outside the candidate pool are not decayed.Selection-based decay therefore depends on eligibility and repeated nonselection.
  • First poisoned branch: The failed blog lookup receives lower priority as supporting evidence, while the official arXiv record is retained as successful evidence.WMT preserves the failed action as a warning rather than deleting it.
  • Lifecycle control: The poisoned blog memory remains persistent but loses influence after repeated missed selections, while a completed branch is folded into a compact summary retaining supported results and warnings.The folded summary avoids replaying the full branch while preserving access to relevant context.
  • Second poisoned branch: A fabricated mirror-page claim can initially receive the same intermediate score as a clean successful action because event scoring reflects operational success rather than factual correctness.Its influence is reduced through semantic selection, missed-selection decay, supersession, or obsolescence marking.
  • Resulting context: Full WMT’s resulting prompt contains supported paper and author information without replaying the complete execution history, while poisoned records remain stored for provenance.The example contrasts explicitly failed poison, which starts lower, with plausible poison recorded as successful, which requires selection feedback.
Loading 2608.20631v1…