Deployment-Time Memorization in Foundation-Model Agents

• URL: http://arxiv.org/abs/2606.10062v1
• Date: Mon, 08 Jun 2026 18:38:41 GMT
• Title: Deployment-Time Memorization in Foundation-Model Agents
• Abstract summary: We study agent memory as a privacy-utility frontier measured by Personalization Recall (PR) and Adrial Extraction Rate (AER)<n>Key-fact summarization reduces canary extraction by 76% on Gemma 3 12B and 64% on GPT-4o-mini while preserving nearly all personalization recall.<n>On LongMemEval, key-fact summarization reduces canary extraction by 76% on Gemma 3 12B and 64% on GPT-4o-mini while preserving nearly all personalization recall.
• Score: 18.40535884093806
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Foundation-model agents are increasingly long-lived systems that remember users across interactions, making memorization an explicit deployment-time function rather than solely a property of model weights. Existing work addresses parametric memorization or audits fixed memory configurations, but does not characterize how memory-design choices jointly shape personalization utility, extraction risk, and deletion fidelity. We study this surface as deployment-time memorization, formulating agent memory as a privacy-utility frontier measured by Personalization Recall (PR) and Adversarial Extraction Rate (AER), and sweeping three memory-design knobs: summarization aggressiveness, retrieval breadth (k), and deletion mode. We further introduce the Forgetting Residue Score (FRS) to quantify whether deleted information remains recoverable from derived memory tiers. On LongMemEval, key-fact summarization reduces canary extraction by 76% on Gemma 3 12B and 64% on GPT-4o-mini while preserving nearly all personalization recall; critically, once content is compressed away, increasing k no longer restores leakage. The same compression, however, induces a deletion-fidelity failure: raw-only deletion leaves derived summary copies recoverable in approximately 20% of instances, and only full-pipeline purge or tombstone redaction drives worst-tier residue to zero. Together, these results establish that persistent agent memory must be evaluated as a first-class memorization mechanism -- assessed by what it helps agents recall, what it makes extractable, and what it can truly erase.

Related papers

• Retrieval-Driven Memory Reconsolidation for Long-Term LLM Agents [39.55670043123564]
  Existing memory systems update memory when new information arrives.<n>Retrieval feedback is rarely exploited to reorganize memory for future access continuously.<n>We propose textbfREALM, a framework for continually evolving long-term memory in LLM agents.
  arXiv  Detail & Related papers  (2026-09-13T05:17:37Z)
• MeClear: Cooperative Game-Theoretic Attribution and Risk-Aware Memory Clearance for Long-Horizon LLM Agents [8.037389868739348]
  MeClear is a task conditioned memory clearance framework for Large Language Model (LLM) agents.<n>MeClear identifies memories featuring negative downstream utility through cooperative attribution and selectively suppresses them from agent execution.<n>MeClear achieves a target recall of 85.9% and an overall task recovery rate of 82.3%, representing a 25.5 percentage point improvement over Leave One Out (LOO) baselines.
  arXiv  Detail & Related papers  (2026-09-08T17:46:00Z)
• Harness the Memory: A Holistic Evaluation of Memory Substrates in Memory Agents [97.19033877543522]
  We present a controlled harness evaluation of memory substrates for memory-augmented agents.<n>We instrument 26 performance and efficiency metrics under a unified harness.<n>These findings motivate substrate routing as a necessary component of adaptive agent memory systems.
  arXiv  Detail & Related papers  (2026-08-15T03:29:48Z)
• From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents [19.125716338799545]
  textbfdependency-guided rollback repair builds a typed memory-to-action graph from provenance, traces explicit downstream dependencies, and selectively replays only answer-relevant affected computation.<n>We evaluate this approach on a 150-case controlled benchmark spanning three tool-use domains and four memory failure types.
  arXiv  Detail & Related papers  (2026-08-11T05:19:55Z)
• MEMPROBE: Probing Long-Term Agent Memory via Hidden User-State Recovery [58.64329475683699]
  We argue that long-term memory should be evaluated as an auditable post-interaction artifact.<n>We instantiate this view in MEMPROBE, a benchmark in which a memory-equipped agent assists simulated users.<n>We find that successful assistance and recoverable memory behave as distinct capabilities.
  arXiv  Detail & Related papers  (2026-06-23T13:52:46Z)
• When Should Memory Stay Silent: Measuring Memory-Use Boundaries in Memory-Augmented Conversational Agents [13.354128891280316]
  Long-term memory enables language model agents to support personalized interactions.<n>It remains unclear when available memories warrant integration into responses.<n>Retrieval systems reduce exposure but do not eliminate integration once sensitive memory reaches the generator.
  arXiv  Detail & Related papers  (2026-06-04T11:54:51Z)
• Memory is Reconstructed, Not Retrieved: Graph Memory for LLM Agents [51.30250860677378]
  We propose MRAgent, a framework that combines an associative memory graph with an active reconstruction mechanism.<n>Running on a Cue-Tag-Content graph, our active reconstruction mechanism integrates reasoning directly into memory access.<n>Experiments on the LoCoMo benchmark and LongMemEval benchmark demonstrate significant improvements over strong baselines.
  arXiv  Detail & Related papers  (2026-06-04T11:29:46Z)
• Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents [18.83666486835137]
  In deployment, a single agent serves many independent tasks over a long horizon, and memory accumulated during earlier tasks can affect behavior on later, unrelated ones.<n>We introduce a trigger-probe protocol that evaluates a fixed probe set against read-only memory snapshots at varying prefix lengths.<n>We apply this protocol across three deployment scenarios spanning records, memos, forms, and email correspondence and eight memory architectures.
  arXiv  Detail & Related papers  (2026-05-18T04:06:34Z)
• RecMem: Recurrence-based Memory Consolidation for Efficient and Effective Long-Running LLM Agents [16.625864201773343]
  RecMem stores incoming interactions in a subconscious memory layer and encodes them using lightweight embedding models for retrieval.<n>Experiments show that RecMem reduces the memory construction token cost of three SOTA memory systems by up to 87% while exceeding their accuracy.
  arXiv  Detail & Related papers  (2026-05-15T15:17:36Z)
• A Parametric Memory Head for Continual Generative Retrieval [52.66674234249913]
  Generative information retrieval (GenIR) consolidates retrieval into a single neural model that decodes document identifiers (docids) directly from queries.<n>We show that sequential adaptation improves retrieval on newly added documents but substantially degrades performance on earlier slices.<n>We propose post-adaptation memory tuning (PAMT), a memory-only stabilization stage that augments an adapted model with a modular parametric memory head.
  arXiv  Detail & Related papers  (2026-04-25T17:38:51Z)
• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents [78.95081012334116]
  Large Language Models (LLMs) with persistent memory enhances interaction continuity and personalization but introduces new safety risks.<n> contaminated or biased memory accumulation can trigger abnormal agent behaviors.<n>MemeEvoBench is the first benchmark evaluating memory safety in LLM agents against adversarial memory injection, noisy tool outputs, and biased feedback.
  arXiv  Detail & Related papers  (2026-04-17T07:29:52Z)
• ImplicitMemBench: Measuring Unconscious Behavioral Adaptation in Large Language Models [60.14219417402433]
  Existing memory benchmarks for LLM agents evaluate explicit recall of facts, yet overlook implicit memory where experience becomes automated behavior without conscious retrieval.<n>We introduce ImplicitMemBench, the first systematic benchmark evaluating implicit memory through three constructs drawn from standard cognitive-science accounts of non-declarative memory.<n>Our 300-item suite employs a unified Learning/Priming-Interfere-Test protocol with first-attempt scoring.
  arXiv  Detail & Related papers  (2026-04-09T10:26:32Z)
• Evoking User Memory: Personalizing LLM via Recollection-Familiarity Adaptive Retrieval [59.295767860331004]
  RF-Mem is a familiarity uncertainty-guided dual-path memory retriever.<n>It embeds human-like dual-process recognition into the retriever.<n>It consistently outperforms one-shot retrieval and full-context reasoning under fixed budget and latency constraints.
  arXiv  Detail & Related papers  (2026-03-10T06:31:44Z)
• Remember Me, Refine Me: A Dynamic Procedural Memory Framework for Experience-Driven Agent Evolution [52.76038908826961]
  We propose $textbfReMe$ ($textitRemember Me, Refine Me$) to bridge the gap between static storage and dynamic reasoning.<n>ReMe innovates across the memory lifecycle via three mechanisms: $textitmulti-faceted distillation$, which extracts fine-grained experiences.<n>Experiments on BFCL-V3 and AppWorld demonstrate that ReMe establishes a new state-of-the-art in agent memory system.
  arXiv  Detail & Related papers  (2025-12-11T14:40:01Z)
• Adversarially Diversified Rehearsal Memory (ADRM): Mitigating Memory Overfitting Challenge in Continual Learning [0.0]
  Continual learning focuses on learning non-stationary data distribution without forgetting previous knowledge. Rehearsal-based approaches are commonly used to combat catastrophic forgetting. We introduce the Adversarially Diversified Rehearsal Memory to address the memory overfitting challenge.
  arXiv  Detail & Related papers  (2024-05-20T06:56:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.