When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary

• URL: http://arxiv.org/abs/2608.01679v2
• Date: Tue, 04 Aug 2026 08:28:14 GMT
• Title: When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary
• Abstract summary: LLM agents adapt across tasks by consolidating heterogeneous interaction histories into reusable facts, preferences, observations, and rules.<n>We identify authority collapse, in which consolidation preserves a claim while erasing the source constraints governing its authorized use.<n>We show that memory-driven adaptation must preserve not only what was learned, but also the authority under which it may be reused.
• Score: 12.82709779460352
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Persistent memory allows (self-evolving) LLM agents to adapt across tasks by consolidating heterogeneous interaction histories into reusable facts, preferences, observations, and rules. Yet consolidation also imposes an implicit authorization boundary: it determines whether stored information may later be consumed as a user fact, an attested observation, or a standing instruction. We identify authority collapse, in which consolidation preserves a claim while erasing the source constraints governing its authorized use, causing the stored memory to imply greater authority than its source permits. We introduce AuthMem-Bench, a controlled paired benchmark that holds the focal claim and downstream task fixed while varying only source authority. It evaluates write-time collapse, downstream authorization errors, and automatic authority preservation. Across seven consolidators based on widely used agent-memory systems and seven LLM backbones, we observe authority collapse in 48 of 49 evaluated configurations. In a controlled action-grounded evaluation, collapsed memories without authority metadata yield a mean unauthorized-action rate of 50.3%. In an end-to-end evaluation, automatically predicted and persisted authority labels reduce the observed unauthorized-action rate from 16.9% to 0.0%, while benign task success remains essentially unchanged. These findings show that memory-driven adaptation must preserve not only what was learned, but also the authority under which it may be reused.

Related papers

• Agent Memory Is a Surface for Endogenous Authorization Laundering [0.764671395172401]
  Long-running LLM agents rely on persistent memory to carry state across interactions.<n>When memory misrepresents evolving authorization state, the agent's own records can grant authority that the underlying history never permitted.<n>We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions.
  arXiv  Detail & Related papers  (2026-09-01T20:12:08Z)
• Hindsight Memory-PRM: Supervising Memory Management with Auditable Hindsight Credit [48.811961095386]
  Hindsight Memory-PRM exploits this audit trail twice.<n> offline to train an operation-conditioned memory-utility critic.<n>Online, where retrievals, citations, and one controlled deletion-and-reanswer per probe settle an intervention-calibrated entry-level presence credit.
  arXiv  Detail & Related papers  (2026-08-30T06:53:13Z)
• MemArbiter: Decision-Time Memory Arbitration for Long-Horizon LLM Agents [14.82470944373943]
  We propose MemArbiter, a function-aware memory arbitration framework.<n>MemArbiter decomposes interaction histories into atomic items, organizes them into five functional Memory Banks.<n>MemArbiter achieves success rates of 82.8% and 92.5% under 500- and 750-token budgets.
  arXiv  Detail & Related papers  (2026-08-03T12:10:52Z)
• Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory [2.98985980237058]
  Provenance-Preserving Memory Fire wall (PPMF) is a lightweight memory that preserves platform-maintained provenance and authorizes tool calls by matching action risk to authority of action-relevant memories.<n>With intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate.
  arXiv  Detail & Related papers  (2026-07-31T08:46:27Z)
• MemOps: Benchmarking Lifecycle Memory Operations in Long-Horizon Conversations [50.24315431387575]
  We introduce MemOps, a benchmark that reformulates conversational memory as a sequence of lifecycle operations.<n>MemOps represents each memory event with a structured trace specifying its trigger, target, scope, state transition, and supporting evidence.<n>Across long-context, retrieval-based, parametric and managed-memory systems, MemOps disentangles failure modes that final-answer accuracy alone conceals.
  arXiv  Detail & Related papers  (2026-07-14T15:33:44Z)
• Episodic-to-Semantic Consolidation Without Identity Drift [7.392721604463545]
  Long-running adaptive intelligent agents face a structural tension between knowledge consolidation and information integrity.<n>In regulated autonomic deployment this is a liability because the agent operates under commitments and audit contracts that bind to a cryptographically certified identity.<n>We propose to treat consolidation not as a mutation of the planner or the identity manifest, but as a deterministic function f: Mep -> Msem over episodic memory.
  arXiv  Detail & Related papers  (2026-07-02T10:18:45Z)
• MEMPROBE: Probing Long-Term Agent Memory via Hidden User-State Recovery [58.64329475683699]
  We argue that long-term memory should be evaluated as an auditable post-interaction artifact.<n>We instantiate this view in MEMPROBE, a benchmark in which a memory-equipped agent assists simulated users.<n>We find that successful assistance and recoverable memory behave as distinct capabilities.
  arXiv  Detail & Related papers  (2026-06-23T13:52:46Z)
• GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents [61.50171793000712]
  GateMem is a benchmark for multi-principal shared-memory agents.<n>It spans medical, office, education, and household domains.<n>No method simultaneously achieves strong utility, robust access control, and reliable forgetting.
  arXiv  Detail & Related papers  (2026-06-17T09:06:15Z)
• Belief Memory: Agent Memory Under Partial Observability [56.41506249481312]
  We propose BeliefMem, which shifts the memory paradigm from committing to a single conclusion per observation to retaining multiple candidate conclusions with their probabilities.<n> BeliefMem preserves the uncertainty that the deterministic paradigm discards, enabling the agent to act with high confidence.<n> Empirical evaluations on LoCoMo and ALFWorld benchmarks show that, even with limited data, BeliefMem achieves the best average performance.
  arXiv  Detail & Related papers  (2026-05-07T02:03:13Z)
• Ghost in the Context: Measuring Policy-Carriage Failures in Decision-Time Assembly [0.0]
  LLM agents do not act on raw interaction history; they act on a bounded decision state assembled by truncation, summarization, reordering, and rewriting.<n>We study this failure mode over local Llama 3.1 8B, Qwen 2.5 7B, and Mistral 7B using judged exact constraint respect and direct audits of assembled-state visibility.
  arXiv  Detail & Related papers  (2026-05-02T18:07:42Z)
• PolicyBank: Evolving Policy Understanding for LLM Agents [51.86716874651299]
  PolicyBank maintains structured, tool-level policy insights and iteratively refines them.<n>PolicyBank closes up to 82% of the gap toward a human oracle.
  arXiv  Detail & Related papers  (2026-04-16T20:29:30Z)
• Governed Memory: A Production Architecture for Multi-Agent Workflows [0.0]
  Enterprise AI deploys dozens of autonomous agent nodes across, each acting on the same entities with no shared memory governance.<n>We identify five structural challenges arising from this memory governance gap.<n>We present Governed Memory, a shared memory and governance layer addressing this gap through four mechanisms.
  arXiv  Detail & Related papers  (2026-03-18T14:49:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.