Governance-State Corruption in Long-Term Memory for LLM Agents: A Cross-Model Stress Test

Illustrative case

• In the audited to-do case, excluding item u leaves v visible despite unchanged task and stored content; oracle-backed restoration makes both items visible again.The frozen-proxy correct–incorrect–correct pattern illustrates a control-plane failure, but does not independently establish native FAMA correctness.Source: §1 · p. 1

Motivation

• The study separates stored evidence from lifecycle and validity state, which can invalidate retained evidence without changing its content.Governance here means benchmark-supported currentness and lifecycle validity, not necessarily an explicit user authorization policy.Source: §1 · p. 1

Approach

• Matched clean, corrupted, and enforced conditions hold task, oracle, evidence, prompt, and model fixed; enforcement supplies the supported state before context construction.This tests an oracle-backed upper bound rather than autonomous repair, and the study measures operative context directly rather than identifying each mediator separately.Source: §1 · p. 1

Results

• Projection changed in 96.25% of supported pairs and was restored in 100%; selected-panel damage was 40.54 points in LongMemEval binary correctness and 30.60 points in Memora FAMA, with recovery in both.The downstream validation is a separate non-probability panel; full-panel frozen-scorer effects are descriptive proxies, not validated native semantic population effects.Source: §1 · p. 1

Scope and contributions

• The research questions cover control-plane and downstream sensitivity, supported fault and event differences, and oracle-backed recovery and provider/source robustness.Contributions include a governance-state corruption formulation, a matched intervention benchmark, six-provider frozen-proxy results, and source-specific native-style validation.Source: §1 · pp. 1–2

Long-term agent memory

• Persistent-memory systems and benchmarks mainly assess whether agents retain or retrieve the right evidence, while this study examines whether retrieved evidence remains valid to use.MemGPT introduced virtual-context management for persistent agents (Packer et al., 2023); Mem0, A-Mem, and LangMem develop memory mechanisms (Chhikara et al., 2025).Source: §2 · p. 2

Governance, forgetting, and temporal validity

• Governance and temporal-validity work motivates explicit control state, but differs from this paired stress test, which fixes task and stored evidence while changing the state selecting operative records.Memora FAMA evaluates memory-presence and forgetting-absence criteria; the full-panel frozen scorer is a Boolean proxy, making scoring correspondence an empirical question.Source: §2 · p. 2

Control-plane foundations

• Complete mediation and fail-safe defaults motivate trustworthy checks, while Usage Control treats access-related attributes and decisions as mutable.The paper adapts this control-state perspective to an agent-memory pipeline that distinguishes lifecycle state, admission, and resulting context.Source: §2 · p. 2

Scope of the distinction

• The study fixes memory evidence and task to make the control-plane transformation inspectable, but does not demonstrate autonomous recovery or make event types and datasets causally interchangeable.The independent native-style subset is limited to cases where corresponding source-specific evaluation can be carried out.Source: §2 · p. 2

3.1 Memory Content and Governance State

• Each memory item pairs underlying content x with governance state g, which can encode whether it is current, active, superseded, deleted, or otherwise admissible for the task.A retrieved item may therefore be factually accurate yet invalid to use.Source: §3.1 · p. 2

3.2 Governance-State Corruption

• Governance-state corruption changes the state while leaving the underlying benchmark task and evidence unchanged.The paper considers missing, stale, flipped, and conflicting states, with concrete realizations dependent on source and event support rather than a universal policy ontology.Source: §3.2 · pp. 2–3
• Fault operators cover missing information, operative superseded or expired states, inverted decisions, and incompatible simultaneous states without the supported winner.Interventions are instantiated only when benchmark-native evidence identifies both the clean state and its supported corrupted projection.Source: §3.2 · pp. 2–3

3.3 Four-Stage Control Pipeline

• The pipeline links governance state to admission, model-visible context, and downstream behavior; the study observes operative context changes, not each arrow as a separately identified mediator.Enforcement measures recoverability when the correct control state is supplied.Source: §3.3 · p. 3

3.4 Controlled Sibling Intervention

• For each eligible base, clean, corrupted, and enforced siblings retain the same base–fault pair, with enforcement restoring the benchmark-supported governance state.The paired contrasts assess corruption sensitivity and oracle-backed recovery under a fixed prompt protocol.Source: §3.4 · p. 3

3.5 Scope of the Causal Claim

• Causal sensitivity is limited to fixed-input sibling interventions; oracle-backed enforcement does not show autonomous state reconstruction, deployed fault prevalence, or downstream harm.A fault need not propagate to an output error.Source: §3.5 · p. 3

4 Method

• The intervention benchmark isolates governance-state corruption by holding task content, oracle, prompt, and model identity fixed.The three conditions use benchmark-supported state, inject a supported fault, or restore the supported state before context construction.Source: §4 · p. 3, §4.4 · pp. 4–5

4.1 Benchmark Sources and Native Governance Evidence

• LongMemEval, Memora, and OAKS contribute source-native temporal, deletion/invalidation, and evolving-answer evidence, respectively.Questions and reference targets come from the source benchmarks rather than synthetic question generation.Source: §4.1 · p. 3

4.2 Frozen Main Cohort

• The 731-base cohort contains 380 deletion, 169 temporal, and 182 update examples, yielding 4,891 conditions; deletion-versus-other-event contrasts are source-confounded.All deletion bases come from Memora, and balancing event samples does not remove the source–event confounding.Source: §4.2 · p. 4

4.3 Governance Fault Operators

• Missing, stale, flipped, and conflicting operators create deterministic, source-grounded governance-state projections.Their corrupted and enforced rows comprise 1,462 missing, 702 stale, 760 flipped, and 1,236 conflicting cases.Source: §4.3 · p. 4

4.4 Condition Construction and Oracle-Backed Enforcement

• Enforcement applies an operator-matched correction using benchmark-supported fields, without using the model’s downstream answer.The same task, evidence, oracle, prompt, model, and inference settings are held across sibling conditions.Source: §4.4 · pp. 4–5

4.5 Case Trace: Missing Governance Metadata

• In the audited Memora trace, a missing-metadata fault changes the operative projection from two to one to-do items, and enforcement restores two.The task, evidence, reference answer, and model configuration stay fixed; the case does not establish native-style validity.Source: §4.5 · p. 5

4.6 Downstream Outcome and Paired Effects

• Full-panel downstream outcomes use a frozen deterministic scorer, and pairing controls input differences but does not remove scorer bias.The proxy’s Memora Boolean content-fact decision is not the same measurement unit as native FAMA’s per-question presence and forgetting-absence criteria.Source: §4.6 · p. 5

4.7 Primary and Secondary Estimands

• The primary proxy-score estimand gives equal weight to bases within each event, then equal weight to deletion, temporal, and update event means.Bootstrap resampling preserves within-base fault pairs; unlike pair-weighted averaging, this prevents bases with more supported faults from receiving more weight.Source: §4.7 · p. 5

4.8 Governance-Evidence Audit

• All 731 bases pass schema/provenance consistency checks, which verify traceability and internal consistency rather than independently proving source interpretations semantically correct.The audit checks frozen construction manifests, oracle states, and support declarations.Source: §4.8 · p. 5

4.9 Models and Inference Protocol

• Six providers use fixed inference configurations and output budgets across siblings, with condition labels hidden and provider transport normalized before scoring.The public repository includes rendering code, adapters, defaults, and token-budget configurations, but not licensed instantiated prompts or complete per-request traces.Source: §4.9 · p. 6

4.10 Scoring and Failure Handling

• Full-panel effects are proxy-score effects, not validated semantic accuracy: LongMemEval scorer agreement is 60/96, while Memora has no defensible same-unit agreement estimate.Final provider or parse failures after configured retries are scored as zero in the primary analysis, with complete-case analysis as a sensitivity check.Source: §4.10 · p. 6

4.11 Complementary Native-Style Validation and Sampling

• The nonprobability Formal-300 panel selects 300 matched LongMemEval/Memora triplets; two unresolved blocks leave 298 complete triplets across 238 bases.OAKS is excluded from this panel and instead has a deterministic native option check with 6,714 resolved, concordant outputs out of 6,720.Source: §4.11 · p. 6

4.12 Statistical Analysis

• The base-cluster bootstrap intervals describe stability within the selected nonprobability panel, not population precision.The robustness analyses are secondary to the frozen primary event-macro estimand and do not redefine the main cohort.Source: §4.11 · p. 6, §4.12 · p. 7

4.13 Offline Control-Plane Propagation Diagnostic

• Projection-change and restoration rates use the 2,080 unique base–fault pairs rather than provider-replicated rows.The diagnostic tests the admitted/model-visible boundary; no separate admission-decision artifact identifies admission and context as distinct mediators.Source: §4.13 · p. 7

4.14 Matched-Support Fault Analysis

• Matched-support fault comparisons use only bases supporting both interventions; no stale–flipped overlap is available.The cohort includes 351 stale–missing and 238 stale–conflicting matched bases.Source: §4.14 · p. 7

4.15 Governance-Evidence Audit

• All 731 selected bases pass the frozen schema/provenance audit with zero schema-flagged unsupported or provenance-missing bases.These rule-based checks use frozen construction evidence and support declarations.Source: §4.15 · p. 7

5.1 Native-Style Behavioral Validation on a Selected Panel

• LongMemEval damage is +40.54 points and Memora damage is +30.60 points; both sources also show recovery on the selected native-style panel.The panel resolves 298 of 300 triplets across 238 distinct bases; intervals are descriptive for this non-probability selection.Source: §5.1 · p. 7, Table 3 · p. 8

5.2 Independent Scorer-Validity and OAKS Option Checks

• 6,714 of 6,720 resolved OAKS outputs agree with the native option comparator, but this does not validate the mixed-source event macro.The scorer-validity audit reports 60/96 same-unit LongMemEval decisions agreeing (62.50%, κ = 0.259); Memora criteria cannot be treated as independent Boolean decisions.Source: §5.2 · p. 8

5.3 RQ1: Negative Corruption Effects under the Frozen Scorer

• Under the frozen scorer, corruption effects are negative for all six providers, ranging from −31.88 points for Gemini 3 Flash to −18.47 points for Grok 4.3.All six provider-level intervals exclude zero; these are fixed-scoring-rule contrasts, not independently validated semantic-correctness estimates.Source: §5.3 · p. 8

5.4 RQ2: Fault Semantics Are Associated with Different Severities

• Stale corruption has the largest observed degradation for every provider, but supported fault sets differ and do not enable a randomized head-to-head comparison.On matched bases, stale causes an additional 12.25–13.68 points of degradation versus missing and 31.09–62.61 points versus conflicting; stale versus flipped is not identified.Source: §5.4 · pp. 8–9

5.5 RQ3: Sensitivity Varies by Governance Event

• Deletion-associated effects cannot be separated from Memora source, task, and scoring differences; event means reconstruct the primary macro using base-equal weighting.The temporal event’s base-equal mean differs from a fault-pair average because bases support different numbers of temporal faults.Source: §5.5 · p. 9

5.6 RQ4: Oracle-Backed Enforcement Recovers Most of the Lost Performance

• Oracle-backed enforcement offsets most measured corruption-associated proxy loss, with a descriptive six-provider mean recovery effect of +27.51 percentage points.Enforced condition-level accuracy is within approximately 2.4 points of clean for every provider; this restoration does not measure autonomous state discovery.Source: §5.6 · p. 9

5.7 Control-Plane Propagation Diagnostic

• Corruption changes the operative projection in 2,002 of 2,080 pairs (96.25%), while oracle-backed enforcement restores it in all 2,080 pairs.Projection changes co-occur with larger frozen-proxy corruption effects, but the diagnostic does not identify admission and context as separate mediators.Source: §5.7 · p. 10

5.8 Cross-Provider, Source, and Support Robustness; 5.9 Clean-Repeat Stochasticity Control; 5.10 Governance-Evidence Audit

• Cross-provider and source checks preserve several proxy-effect directions, while clean-repeat results show generation variability and the evidence audit flags no unsupported bases.Balanced event sampling does not decouple event type from benchmark source; Formal-300 and clean-repeat use different cohorts and scoring units, precluding exact attribution.Source: §5.8 · p. 10, §5.9 · p. 11, §5.10 · p. 11

Confounding and heterogeneity

• Deletion appears only in Memora, stale and flipped faults lack common base support, and source-specific validity rules do not form a universal authorization ontology.Matched support cannot identify all independent severity effects; provider–source cells may also have intervals spanning zero.Source: §6 · p. 11

Recovery and architecture

• Oracle-backed enforcement restores audited projections, but does not establish autonomous state repair or separate admission and context assembly as causal mediators.The propagation audit covers the operative-context boundary, not each stage as a separately estimated mediator.Source: §6 · p. 12
• The proposed practice is to preserve provenance and current-version status, fail closed on unverifiable state, distinguish historical from operative records, and log admission decisions.Deployment would still require state verification without the benchmark oracle and independent logging of failure stages.Source: §6 · p. 12

Scoring and sampling

• Full-panel effects are frozen Boolean-proxy results, while Formal-300 is a deterministic non-probability panel with distinct LongMemEval and Memora outcome units.Only 60/96 same-unit LongMemEval decisions agree with native-style answers (κ = 0.259); no full-panel LongMemEval/Memora native re-evaluation was performed.Source: §7 · p. 12
• Small provider–source cells can have damage intervals spanning zero, and clean-repeat evidence is limited to one extra response per 60 blocks with wide intervals.The cross-source mixed-unit average is not a shared metric.Source: §7 · p. 12

Identification and generality

• Causal claims apply only to paired interventions with task, evidence, oracle, model, and protocol fixed, not to deployed fault prevalence or user harm.Deletion is confined to Memora, source/event/fault support is incomplete, and the projection diagnostic does not distinguish admission from context as mediators.Source: §7 · p. 12

Audit and reproducibility boundaries

• The public aggregate-only package omits licensed texts, instantiated prompts, per-request outputs, and adjudication records, preventing independent end-to-end reruns from the ZIP alone.Oracle-backed restoration also assumes correct state is available and is not a deployment-ready authentication, malicious-state-detection, or synchronization mechanism.Source: §7 · p. 12

8 Conclusion

• LongMemEval binary correctness shows +40.54 points of corruption-associated damage and +39.19 points of recovery; Memora native FAMA shows +30.60 points of damage and +26.24 points of recovery.The selected panel resolves 298 LongMemEval/Memora triplets from 238 distinct bases.Source: §8 · p. 12
• OAKS native option parity holds on all 6,714 resolved outputs, but neither this check nor the selected panel validates full-panel frozen-scorer effects as native semantic population effects.The full-panel proxy effects are −27.55/+27.51 points.Source: §8 · p. 12
• The bounded results motivate explicit integrity checks for memory control state alongside benchmark-appropriate downstream outcome evaluation.Source: §8 · p. 12

Data and Code Availability

• The aggregate-only repository provides code, prompt templates, tests, configurations, and summary outputs.Source: Data and Code Availability · p. 12
• Licensed benchmark text, instantiated prompts, individual answers, and private adjudication records are not redistributed.Source: Data and Code Availability · p. 12
• The public release does not permit full case-level reruns.Source: Data and Code Availability · pp. 12–13

• The research received no specific grant from public, commercial, or not-for-profit funding agencies.Source: Funding · p. 13