Memory Corruption

TL;DR. The danger in agent memory is on the write path, not the read path. The field optimizes retrieval (RAG, capacity, search), but reading the primary sources directly, the corruption enters at consolidation/update — three independent works converge. (1) When an LLM keeps updating memory, utility falls below the no-memory baseline (GPT-5.4 fails 54% of ARC-AGI problems it had solved without memory, after consolidation); (2) agents fail to retract invalidated beliefs even when new evidence arrives (best model 55.2%); (3) write-stage errors surface much later at read. Modeling consolidation collapse and the stale cascade in deterministic code reproduces the same shape. The fix is not better reading but a write gate.

The unsettled question

The agent-memory category maps "what to keep outside the context window." Its evaluation-benchmark piece left a blank it named itself — who weakens a memory that has gone invalid over time was left as "no measurement tool." The field's energy goes to retrieving better (RAG, hybrid search, capacity). But the place memory goes wrong may not be there. What corrupts memory — retrieval failure, or the act of writing itself? There's no consensus. Headlines ("memory system X is SOTA") won't answer it — you have to cross-check the papers' failure analyses directly and run the corruption mechanisms as a model.

How I dug in

I dug in two ways — read three primary sources closely to cross-check where failure originates, then modeled the corruption mechanism each reports as a deterministic code toy and ran it on real models to check the shape holds.

• Primary sources — Useful Memories Become Faulty (update corruption), STALE (an invalidation-awareness benchmark), MemTrace (error attribution). Three different approaches — a finding, a benchmark, a debugger — pointing at the same place.
• Reproduction ① deterministic toy — (A) model consolidation as lossy repeated updating (each round some facts are lost or corrupted into a wrong value) and compare utility against raw retention. (B) in a dependent-belief graph, measure the stale-survival rate when updating a root fact under naive overwrite vs dependency-aware invalidation.
• Reproduction ② live — seed memory with 10 concrete facts and run continuous consolidation (re-compress the previous compressed version) on real models (a Claude subagent and Gemini Flash), grading by hand each round how many of the 10 facts survive.

What I found

The three sources and two toys collapse into one sentence — the read path is fine; the corruption happens entirely on the write path.

Updating drives utility below no-memory

The claim in Useful Memories Become Faulty is counterintuitive — "memory utility first rises, then degrades, and can fall below the no-memory baseline." The source is not deficient experience but the consolidation process itself. The same trajectories yield qualitatively different memories under different update schedules. Numbers (paper self-report): GPT-5.4 fails 54% of ARC-AGI problems it had solved without memory, after consolidation; agents preserving raw episodes double the accuracy of forced-consolidation counterparts.

Toy A reproduces this shape. Raw retention keeps utility flat (all facts correct, zero corrupted), while lossy consolidation loses facts each round and hardens some into corrupted values.

Because corrupted facts actively mislead (worse than nothing), consolidation utility drops below no-memory (50) by round 4 and reaches one-third of raw by round 12. Updating is not free compression — it is loss + corruption.

Live reproduction — the same shape on real models

To confirm the toy isn't just an assumption, I seeded memory with 10 concrete facts and ran continuous consolidation (re-compress the previous compressed version) on real models, grading by hand each round how many facts survive.

Both models point the same way. Flash silently dropped pnpm and Vitest within two rounds under mild "halve" pressure (8/10). Opus held longer — through three rounds it kept every fact and shed only formatting. But once the token budget bound, it collapsed — at ≤12 words Tailwind v4 and the region vanished and Sonnet 4.6 decayed to Sonnet (version lost); at ≤6 words only 3 of 10 remained. The loss happened without warning — no round announced "I am dropping this." A stronger model defers corruption; it is not immune. Of the two corruption modes the toy modeled, the one the live run reproduced is loss — facts dropped without warning and a version was truncated (Sonnet 4.6→Sonnet). Corruption into a wrong value is the mode toy A showed. (Gemini stopped at round 2 on the free-tier daily quota.)

Invalidation fails on the cascade

STALE tests whether an agent notices when new evidence implicitly invalidates an old belief. The results are dismal (paper self-report) — the best model, Gemini-3.1-pro, scores 55.2%; most memory frameworks are under 10%. Two failures matter. Recognition ≠ application — asking the state directly gives 76%, but applying the updated belief to a real task drops to 39%. Premise bias — when a query presupposes the old info, 92% collapses to 30%. And Type II, where one fact's change propagates to dependents, is the hardest across all systems.

Toy B reproduces Type II. In a graph with one root fact and eight dependent beliefs, updating the root gives:

Naive overwrite fixes only the root and never touches the derived beliefs. If invalidation doesn't follow the cascade, 89% of the memory you believe you updated still holds the old value.

Errors enter at write and surface at read

MemTrace attributes memory failures to operations — extraction, retrieval, update, response, across 7 categories (5 memory-specific). Two key findings from 160 annotated failures: failures are not random but operation-level information loss and misalignment, and errors introduced at write (construction) surface much later at read (retrieval/response), complicating diagnosis. Look only at the retrieval stage and the cause is invisible — the error was planted when it was written.

The three findings point at the same asymmetry. In toys A and B the read path is identical on both sides — the only thing that differs is the write. While the field polishes retrieval, the corruption quietly enters at consolidation, update, construction. This is the same shape as the prompt-injection study — there too the defense closed not at the text you read but at the tool-call wire you emit. Both cases say guard the right channel. In memory, the right channel is the write.

Conclusion

If you build or operate agent memory, the job is not to polish retrieval — it is to guard the moment of writing.

1. Turn off automatic consolidation; keep raw episodes as primary evidence. Don't let the LLM run session summarization or memory compression on its own. Gate compression explicitly, only when needed — in the toy, utility dropped below no-memory within four rounds.
2. On update, invalidate dependents — don't just overwrite. Fix only the root and 89% of the beliefs derived from it stay at the old value. Design so a root change invalidates and recomputes its dependents.
3. Stop pouring more resources into better retrieval. An error already planted at write can't be fixed by polishing retrieval — you only fetch the corrupted memory more reliably.
4. Start diagnosis at the write stage. When memory is wrong, don't look at retrieval first — first check whether that fact was lost or corrupted when it was written.

In one line — memory is not remembering better but not writing wrong. Move the effort you spent optimizing the read into a write gate and dependency-aware invalidation.

What this study cannot say

The live reproduction is a single seed (10 facts), one run per model, and Gemini was cut off at round 2 by the daily quota — too small a sample to read as absolute numbers, only as a direction (facts silently vanish as updating proceeds). The toy's 90/46/28/89% likewise show the deterministically-modeled shape of the asymmetry (write corrupts, read is unchanged), not an absolute benchmark. The loss/corruption rates are assumptions, and a real consolidation's corruption rate varies by model, schedule, and budget — the direction ("rises then falls below no-memory") is robust, but don't read a specific round count as an absolute. The STALE/Useful percentages are quoted from the primary sources. And this piece looks at one problem, corruption — privacy and capacity are covered by the eval-benchmark piece.

Next investigation

How to auto-derive the consolidation gate in a real memory loop — without a criterion for what to keep raw versus compress, the gate is either too tight (compress nothing) or too loose (compress everything). And how to do dependency-aware invalidation in free-text memory (not a graph) — closing STALE Type II requires tracking dependencies among derived beliefs somewhere. Candidates for the next dig.

Primary sources

• Useful Memories Become Faulty When Continuously Updated by LLMs — consolidation utility falls below no-memory; raw doubles it
• STALE: Can LLM Agents Know When Their Memories Are No Longer Valid? — invalidation-awareness benchmark (best 55.2%), Type II cascade hardest
• MemTrace: Tracing and Attributing Errors in LLM Memory Systems — errors are operation-level, enter at write and surface at read
• Agent-memory category · the eval piece's "no measurement tool" blank — the gap this study fills
• Reproduction — ① deterministic toy (consolidation vs raw utility, 12 rounds; stale cascade, 8 dependent beliefs) + ② live multi-round consolidation (Claude subagent and Gemini Flash, 10-fact seed), written and run for this post