The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents

Jundong Hu; Shekar Ramachandran

Source-linked AI summary

The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents

Jundong Hu, Shekar Ramachandran

arXiv:2609.01852v1Sep 1, 2026cs.AIcs.CL

TL;DR

Stale persistent-memory facts can override current authoritative evidence, but the onset and severity of harm depend on model capability and memory features. Using a frozen two-suite benchmark across Qwen3 sizes, the paper finds universal stale reliance but capability-gated net harm, with scale-dependent triggers and mitigations. These effects reproduce across capable Llama-Instruct models and external datasets, while the benchmark’s closed-set design and limited family-by-scale coverage constrain generality.

Problem
The paper addresses when stale-memory harm begins as model capability changes and which observable memory features trigger it.
Method
The paper evaluates a frozen, closed-set, action-scored two-suite benchmark across a same-family Qwen3 0.6B–8B series, then tests factorial triggers, mitigations, and external validations.
Results
Stale-value reliance is 0.92–1.00 at every size, while net harm, triggering features, and effective mitigation depend on capability across model families and datasets.
Takeaways & Limitations
Memory systems should retain labels and use deterministic conflict resolution because metadata helps capable models, while smaller models require pre-resolved conflicts.
Takeaways & Limitations
The study uses closed-set action scoring, one primary model family, a trap-level threshold, and memory-consumption-time evaluation rather than an end-to-end update system.

Abstract

from arXiv · show

Persistent memory supports personalized agents, but a stale stored fact can override current authoritative evidence without warning. We study when this harm begins as model capability changes. We evaluate a frozen, closed-set, action-scored benchmark with 2 suites that represent 2 different meanings of "no memory" (a Benefit suite, unsolvable without the stored fact, and a Safety suite, in which an authoritative tool always holds the correct value), on a same-family model-size series (Qwen3 0.6/1.7/4/8B). The Memory Trust Gap reflects over-trust rather than confusion. In the Benefit suite, models answer with the stale value 0.92-1.00 of the time at every scale. In the Safety suite, harm below the no-memory baseline under the trap conditions ($Δ_{\mathrm{mem}}$) is capability-gated, with the larger models collapsing most once a stale note is made to look current. In a $2\times2\times2\times2$ factorial, which feature triggers over-trust depends on both the feature and model scale. Removing a label amplifies over-trust at every size, and a recency feature (stale dated newer) fools the larger models harder. Source authority is weak and scale-flat, and position changes from positive to negative across the Qwen3 model-size series. We confirm these scale interactions with direct cross-size contrast tests rather than overlapping per-model intervals. Mitigation is likewise capability-dependent: exposing metadata improves accuracy for the capable models, but only pre-resolving the conflict restores accuracy for the 2 smaller checkpoints. The same pattern appears on the capable models in an independent Llama-Instruct model-size series and on 2 external datasets (RGB, MisBench). A framing control finds no consistent advantage for the memory label: at the 3 smaller scales, models trust a stale document more than a stale memory; at 8B, the difference is not significant.

1 Introduction

Persistent memory enables personalization but can make agents confidently follow stale facts over current authoritative evidence. This paper studies when that harm emerges with capability and which memory features trigger it.

The central failure is treating stored information as trustworthy without checking whether it remains current.A stale stored fact can override correct current context and produce a confident wrong action.
Prior work shows failures with updated information, but not when harm begins as capability changes or which memory features trigger it.The paper addresses these gaps through questions about harm, triggers, and mitigation.
The benchmark separates Benefit cases, where the stored fact is required, from Safety cases, where an authoritative tool provides the correct value.This separates two incompatible meanings of no memory and supports distinct measurements of over-trust and net harm.

2 Related Work

Prior research establishes stale-memory harm and conflict sensitivity, but this paper adds a controlled account of how memory features and model scale shape the failure. It also distinguishes the contribution from related work on position effects and sycophancy.

Existing benchmarks establish stale-memory harm, while this paper adds a capability account using controlled same-family comparisons.The paper studies retrieval-time override as established and focuses on how it depends on model capability.
Related studies examine context conflict, selfconsolidation drift, retrieval overload, and memory repair, but do not combine the same-family factorial and direct interaction tests.The paper positions its contribution as the combination of controlled stale/current conditions and capability analysis.
ConflictBank reports that larger models can be more susceptible to conflicting evidence, but lacks this paper’s controlled factorial and cross-size interaction tests.The comparison highlights the paper’s feature-decomposed, scale-dependent design.
The paper’s stale-memory setting differs from prior position-sensitivity work by showing a scale-dependent sign reversal rather than merely reduced ordering variance.It also contrasts with larger models’ robustness to overt sycophantic flips because recency is a different feature.

3 Experimental Setup

The experiments use a frozen benchmark with separate Benefit and Safety suites, four memory conditions, constrained action scoring, and paired metrics that distinguish stale reliance from net harm.

3.1 Benchmark and 2 Suites: The Safety suite keeps an authoritative tool correct in every condition, whereas the Benefit suite omits current context so no_memory cannot recover the answer.The two suites therefore encode ceilinged and floored no-memory baselines, respectively.
3.1 Benchmark and 2 Suites: The benchmark contains 300 manually reviewed scenarios, split into 150 per suite across 33 template families and pinned with a SHA-256 manifest.Template families are the resampling unit for the cluster bootstrap.
3.2 Conditions and Scoring: The four conditions are no_memory, clean, stale, and explicit_conflict, with actions scored against construction-time ground truth using exact, regex, or canonical matching.The benchmark avoids an LLM judge and manually validates scoring on a random sample.
3.3 Metrics: reliance measures how often the model selects the stale value, while ∆mem measures accuracy relative to the no_memory baseline.Paired scenario-level evaluation separates behavior from outcome.
3.3 Metrics: Figure 1 compares stale-value reliance and paired ∆mem across model sizes against the Benefit-suite chance floor and no_memory reference.The figure is organized to contrast stale following with baseline-relative accuracy.
3.3 Metrics: The capability threshold is the first evaluated trap level at which stale-memory following becomes significant net harm, using 95% percentile bootstraps over scenario ids.A star indicates a confidence interval excluding zero, while ns indicates inclusion of zero.

4 Question 1: Harm and the onset of net harm

Over-trust is present across model sizes, but net harm emerges according to capability and trap plausibility: larger models lose more accuracy when stale memory appears current. In the Safety suite, the no-memory ceiling makes negative ∆mem a direct measure of harm.

4.1 Over-Trust Is Universal: 0.92–1.00 stale-value reliance persists across Qwen3 0.6B–8B in the Benefit suite, while ∆mem ranges from −0.33 to −0.37.Benefit no_memory accuracy is 0.35–0.37, with confidence intervals containing chance 0.33.
4.1 Over-Trust Is Universal: 0.50 / 0.50 / 0.01 / 0.00 reliance crossover occurs across 0.6B / 1.7B / 4B / 8B when stale and correct values are both stored.Smaller models follow the stale value half the time, while capable models largely resist.
4.1 Over-Trust Is Universal: The Benefit suite cannot provide a like-for-like net-harm estimate for explicit_conflict because no_memory lacks the current value supplied there.Clean net-harm evidence therefore comes from the Safety suite.
4.2 Net Harm in the Safety Suite: ρ*=0/1/1/1 across 0.6B/1.7B/4B/8B marks the first significant Safety-suite harm level, separating the smallest model from the other three.The threshold does not form a monotone ordering by capability.
4.2 Net Harm in the Safety Suite: At L3, the 8B model reaches reliance 1.00 and ∆mem −1.00, while at L2 the 4B model reaches reliance 0.83.Recency inflation makes the stale note appear newer and increases harm for larger models.

5 Question 2: Which memory feature triggers over-trust, and does it scale?

Over-trust is triggered by different memory features at different model scales rather than by one universal feature. Removing labels raises reliance across sizes, while recency and position produce scale-dependent effects; direct cross-size tests confirm these interactions.

Factorial design: The factorial manipulates label, timestamp, source, and position independently in a 2×2×2×2 Safety-suite design, using stale-value reliance as the primary metric.Each feature’s main effect averages reliance across all settings of the other three features.
Factorial main effects: Removing the label increases stale-value reliance significantly at every model size, with a null large-versus-small contrast.The label effect is therefore broad rather than scale-growing.
Factorial main effects: Dating the stale note newer produces a stronger over-trust effect on the 4B and 8B models.Recency causes a step in reliance once the stale note is at least 1 day newer, then saturates.
Factorial main effects: Source authority has a weak, roughly scale-flat main effect, while placing the stale note first changes from positive to negative across model sizes.Position increases reliance for the 0.6B model but decreases it for the 4B and 8B models.
Interpretation: The factorial supports behavioral feature effects but does not identify an internal mechanism or a single-feature explanation.Feature-specific dose-response studies further probe whether models can read the manipulated features.
Direct interaction tests: The cross-size bootstrap finds recency significantly stronger on larger models, position significantly reversed, authority non-interacting, and label contrasts null.Recency gives 8B−0.6B = +.302* and position gives 8B−0.6B = −.326*; overlapping per-model intervals alone would not establish these interactions.

6 Question 3: Mitigation is capability-dependent

Mitigation effectiveness depends on model capability. Metadata is sufficient for larger checkpoints, whereas smaller checkpoints recover only when the stale conflict is pre-resolved.

Capability-dependent mitigation: Exposing timestamp and source metadata improves accuracy for the 4B and 8B models, while 0.6B and 1.7B recover only when the conflict is pre-resolved.The comparison uses raw, metadata, and representation-oracle frames containing the same conflict.

7 Validation: External, Cross-Family, and Controls

Validation across external datasets, model families, and controls preserves the paper’s central pattern: stale evidence is widely trusted, while harm and feature effects vary with capability and framing.

External validation: 0.81–0.94 pooled stale-value reliance appears across scales on both RGB and MisBench, reaching 0.96 in MisBench semantic cells and 0.95 in RGB free-text.These external results show the effect is not limited to synthetic templates or multiple-choice evaluation.
External validation: Per-model spread across MisBench rhetorical styles is ≤0.19, with casual blog framing least trusted and news/wiki typically highest.The style sweep covered 6 styles and 2 hop depths; its sign-test result was p ≈.004.
Controls and dose-response: The recency response is a capability-inverted sign step rather than a smooth dose-response across the tested recency gaps.Figure 3 organizes stale-value reliance by recency gap and model size.
Cross-family replication: Llama-Instruct reproduces the capable-model pattern: Benefit-suite reliance reaches 0.96 and 1.00 at larger sizes, with matching feature signs.The Llama series used identical scenarios, metrics, and bootstrap procedures; its 1B checkpoint was a capability floor.
Controls: Paired reliance(memory)−reliance(document) is −.311∗/−.058∗/−.013∗/+ .016 (ns), so stale documents are trusted more at the 3 smaller scales and differ nonsignificantly at 8B.The control held the wrong item identical while varying its framing as memory, document, or earlier message.
Controls: Thinking mode leaves the 8B gap unchanged, while 0.6B Benefit-suite reliance rises from 0.924 to 0.991.The paired increase was ∆+ 0.067, with CI [+.040, +.096].

8 Discussion and Conclusion

The findings indicate that capability is not uniformly protective: models can over-trust stale information at every size, while harm, triggers, and useful mitigations depend on capability. The authors conclude that this pattern extends beyond persistent memory to stale or conflicting retrieved evidence.

Discussion: Capable models can exploit a correctly parsed stale timestamp more strongly, while resisting a spurious provenance cue more effectively.The discussion frames this as over-reliance rather than confusion and distinguishes plausible recency from overt sycophantic manipulation.
Implications: Keeping the label reduces stale-value reliance at every model size, whereas authority is a weak lever and small models still need conflict pre-resolution.The discussion connects these mitigation implications to both the internal factorial and external style sweep.
Limitations: The Benefit suite cannot express net harm on explicit_conflict, so net-harm claims rest on the Safety suite.The benchmark is closed-set and action-based, which strengthens measurement but limits open-ended generality; RGB free text partly offsets that boundary.
Conclusion: Across model families, external datasets, and non-memory stale evidence, net harm, triggering features, and effective mitigation remain capability-dependent.The conclusion presents the frozen benchmark and harness as tools for measuring this failure and testing future mitigations.

A Methods Reference

The benchmark separates two incompatible meanings of no memory and measures stale reliance and paired accuracy loss on frozen, action-scored scenarios across Qwen3 and Llama-Instruct size series.

Suites and conditions: The Benefit suite is unsolvable without the stored fact, while the Safety suite always provides the correct value through an authoritative tool.Benefit no-memory accuracy is floored at chance ≈0.33; Safety no-memory accuracy is ceilinged.
Metrics: reliance = P(answer = stale value), while ∆mem = acc(cond) −acc(no_memory), paired per scenario.The benchmark also defines ρ∗ as the first trap level whose stale ∆mem CI upper bound is < 0.
Metrics: Every option is scored under cyclic rotations before comparison, making reliance position-independent; uncertainty uses a 95% percentile bootstrap over scenario ids.Template-family cluster bootstrap and leave-one-family-out checks were used for robustness, with the decomposition labeled exploratory.
Models and decoding: Qwen3 0.6/1.7/4/8B and Llama-3.2-1B/3B-Instruct plus Llama-3.1-8B-Instruct are evaluated with greedy decoding and identical prompts.The benchmark contains 300 frozen base scenarios and is SHA-256 pinned.
Compute: Each 0.6–8B model fits within one A100 40 GB MIG slice, enabling concurrent inference across partitioned slices.This hardware budget is part of why the primary series targets 0.6–8B backbones rather than larger ones.

B Memory Feature Dose-Response Deep-Dives

The dose-response and factorial analyses organize memory-feature effects by model size, while cross-family tables and external-validation summaries provide comparable robustness checks.

Dose-response panels: Figure 6 collects per-feature dose-response and probe panels, including the MisBench rhetorical-style sweep.Figure 7 separately visualizes the external-validation results tabulated in Table 8.
Cross-family checks: Cross-family Benefit results use per-scenario bootstrap CIs, and parsed-only reliance is at least as large as all-row reliance in every cell.The reported over-trust is therefore a conservative lower bound under the stated parsing analysis.
Cross-family checks: The cross-family factorial table reports one row per Llama model size and one column per memory feature, with paired 95% CIs.A starred interval excludes zero.

D Control Experiments (with CIs)

The control experiments document concrete stale-value overrides, define the plotted control comparisons, and report that the Memory Trust Gap reproduces on RGB and MisBench.

Observed control behavior: Qwen3-8B follows stale values over authoritative ones in scheduling, travel, and local safety scenarios.Examples include Room A over Room B, Gate A4 over B12, and Dallas over Austin.
Control design: Figure 6 plots each recency, intervention, authority, provenance, and MisBench-style ramp or probe metric against its swept feature for each model size.
Observed control behavior: Qwen3-0.6B selects United over the correct airline, Delta, when both values are stored in memory.
External validation: The Memory Trust Gap reproduces on RGB and MisBench, where an over-trusted wrong document overrides parametric knowledge.
External validation: Figure 7 reports condition-wise accuracy on RGB and MisBench and plots Δmem against model size using the same paired machinery as the synthetic suites.
Additional controls: Table 11 compares reliance on identical wrong items framed as memory, documents, or earlier messages, and compares stale-value reliance with thinking disabled versus enabled.The framing control’s last column is the paired reliance(mem)−reliance(doc) contrast.