An Interpretable Memory Decision Controller for LLM Agents Based on Three-Signal Complementarity: Decoupling Confidence and Consistency

Yiming Zhang; Jinghong Zhang; Haoran Zhao; Yiren Ma; Chunlei Zhao

cs.CLSep 18, 2026

An Interpretable Memory Decision Controller for LLM Agents Based on Three-Signal Complementarity: Decoupling Confidence and Consistency

Authors: Yiming Zhang, Jinghong Zhang, Haoran Zhao, Yiren Ma, Chunlei Zhao

Organizations: School of Computer Science and Engineering, Tianjin University of Technology Tianjin, China

Abstract

Memory systems for large language models have focused predominantly on efficient retrieval, whereas the decision of whether retrieved memories should be trusted has received comparatively little attention. When the memory store contains conflicting positions, standard retrieval-augmented generation (RAG) blindly injects memories and amplifies hallucinations: in models susceptible to memory injection, the RAG hallucination rate under conflicting memories is markedly higher than that of a memory-free baseline. Inspired by memory signaling mechanisms in the prefrontal cortex, we propose the Memory Decision Layer (MDL), a zero-parameter memory decision controller situated between the retrieval and generation stages. Its core is a three-signal complementary encoder that fuses relevance, reliability, and task risk through QR-based orthogonal subspace projection and a meta-working-memory signal into an interpretable decision representation that quantifies the trustworthiness of retrieved memories. Building on this encoder, MDL explicitly decouples confidence from consistency and introduces risk inversion and explicit abstention. Evaluations on mainstream large language models and multiple open-source datasets show that MDL reduces the hallucination rate under conflicting memories by about 56.04% in general scenarios and approaches zero hallucination in high-risk scenarios. The controller is fully white-box: it relies purely on geometric operations, requires no trained parameters, and adds only about 0.14 ms per decision -- roughly 50x faster than the embedding-retrieval step that precedes it and four to five orders of magnitude faster than an LLM self-evaluation call.

Figures & tables

Figure 1: Complete four-stage architecture of the Memory Decision Layer (MDL): $\mathbf{1}$ multi-source input signals, $\mathbf{2}$ orthogonal subspace encoding, $\mathbf{3}$ the memory decision layer, and $\mathbf{4}$ four-level action decision.

Figure 2: Illustration of the four-stage gated decision and action-mapping mechanism.

Capability	RAG	MemGPT [ 2 ]	Reflexion [ 5 ]	Ours (MDL)
$C$ – $\alpha$ decoupling	Implicit	$\times$	Implicit	Explicit
Risk opt-out	$\times$	Partial	$\times$	Explicit
Subspace attribution	$\times$	$\times$	$\times$	Explicit
Direction auditing	$\times$	$\times$	$\times$	Explicit

Table 1: Innovation matrix: existing methods vs. the proposed MDL.

Hyperparameter	Value	Selection rationale
$D$	16	Accommodates three subspaces (5+5+6) with expressive margin; too small saturates the geometry, too large raises latency
$(d_{\mathrm{wm}},d_{r},d_{a})$	$(5,5,6)$	One extra dimension for the risk subspace to carry second-order risk modulation; dimensions matched to signal complexity (validated by ablation)
$\sigma$	0.20	Sharpness of value encoding; too small overfits single points, too large loses directional expression; 0.20 lies on the directional-separability plateau
$\epsilon_{c}$	0.10	Ensures $\epsilon_{c}<\min_{k}s_{k}$ , so principal gains dominate and monotonicity holds (Theorem 1 )
$s_{\mathrm{wm}}/s_{r}/s_{a}$	$1.0/0.7/0.5$	Heuristic allocation with relevance as the primary direction, reliability as secondary, and risk as tertiary
$g_{A}$ coefficients	$(0.5,0.5)$	Bounded second-order risk modulation of the relevance pathway ( $g_{A}=0.5+0.5\langle\mathbf{v}_{a}\rangle$ ); removing it costs 1.7 pp (Table 7 )

Table 2: Complete hyperparameter configuration of the MDL controller.

Baseline	Precise definition	Key implementation details
B1 (no memory)	No retrieved memory is injected; the LLM generates directly	Same LLM, sampling parameters, and context
B2 (standard RAG)	All candidate memories of the question are injected into the context before generation	Same LLM, sampling parameters, and prompt template; memory store per question (see Memory Construction above)
B3 (MDL, ours)	The proposed memory decision controller placed between retrieval and generation	Same hyperparameters as Table 2 , zero training
LR	Supervised logistic regression on the three signals $(M,R,A)$	Regularization $C=1.0$ , 5-fold cross-validation
MLP	Multi-layer perceptron classifier with hidden layers $(64,32)$	ReLU activation, at most 500 training iterations, early stopping
XGBoost	Extreme gradient-boosted tree classifier	100 estimators, max depth 4, 5-fold cross-validation

Table 3: Precise definitions of the baselines compared in this article. All baselines use the same input signals

(M,R,A)

as MDL (supervised baselines are trained on the same outcome-derived oracle labels).

Figure 3: Hallucination control and generalization of the MDL controller. (a) Hallucination rates (bars) of the gemma-4-E4B-it model under different risk levels, overlaid with the MDL abstention trigger rate (line) ( $p=0.014$ ); (b) generalization of the MDL controller in high-risk scenarios ( $A=0.85$ ) across base models (gemma-4-E4B-it, deepseek-v4-flash, and gemini-3-flash-preview) and on the HaluEval dataset.

	TruthfulQA		HaluEval
Baseline	Overall	High-risk	Overall	High-risk
B1 (no memory)	0.160	0.124	0.083	0.040
B2 (standard RAG)	0.043	0.107	0.065	0.027
B3 (MDL)	0.047	0.000	0.070	0.013

Table 4: Cross-dataset hallucination-rate comparison (deepseek-v4-flash, 200 questions

\times

3 seeds).

System	Overall hallucination	High-risk	Refusal
B1 (no memory)	0.155	0.110	0.380
B2 (standard RAG)	0.048	0.119	0.880
CRAG (prompt-based) [ 8 ]	0.050	0.059	0.645
Self-RAG (prompt-based)	0.005	0.000	0.833
B3 (MDL, ours)	0.048	0.000	0.877

Table 5: Baseline comparison on TruthfulQA (deepseek-v4-flash, 200 questions

\times

2 seeds).

Figure 4: Decision behavior of the MDL controller over the $(M,R)$ plane at three risk levels. Shaded regions and contour lines show the actual controller’s confidence $C_{\mathrm{final}}$ and four-level action regions (computed with the deployed controller, QR seed 42, thresholds $0.6/0.4/0.2$ ); dots mark the real end-to-end records at that risk level (grey = safe answer, red cross = hallucinated answer). As risk rises, the Active region contracts and high-reliability memories are increasingly pushed toward abstention.

Configuration	Accuracy	$\Delta$ Acc	$d_{z}$	$p$
$M$ only	0.581	$-$ 0.031	$-$ 0.10	$<$ .001 ∗∗∗
$R$ only	0.581	$-$ 0.031	$-$ 0.10	$<$ .001 ∗∗∗
$A$ only	0.581	$-$ 0.031	$-$ 0.10	$<$ .001 ∗∗∗
$M{+}R$	0.581	$-$ 0.031	$-$ 0.10	$<$ .001 ∗∗∗
$M{+}A$	0.583	$-$ 0.030	$-$ 0.10	$<$ .001 ∗∗∗
$R{+}A$	0.627	$+$ 0.014	$+$ 0.05	0.001 ∗∗

Table 6: Decision accuracy of different signal combinations with paired

t

-tests (

N=3600

records pooled from the end-to-end runs).

Figure 5: Ablation analysis, parameter sensitivity, and action distribution of the MDL controller, computed on the real records. (a) Confusion matrix between the four-level action decisions and the outcome-derived oracle over the $1{,}200$ real B3 records; (b) accuracy of the gating formula $C_{\mathrm{final}}=C\cdot(g_{a}+g_{b}\alpha)$ over the $(g_{a},g_{b})$ grid on the $3{,}600$ records, showing a broad high-accuracy region when the consistency weight dominates; (c) abstention rate of the deployed controller over relevance $M$ and reliability $R$ bins in the high-risk records ( $A\geq 0.70$ ), verifying the control logic of multi-signal cooperative risk suppression.

(a) Module ablation
Configuration/Method	Accuracy	$\Delta$ Acc	#Params	Interpretability
Full MDL controller	61.2%	—	—	—
w/o $\alpha$ gating	59.6%	$-$ 1.6pp	—	—
w/o risk modulation	59.5%	$-$ 1.7pp	—	—
w/o orthogonal subspaces (identity projection)	64.0%	$+$ 2.8pp	—	—
w/o risk inversion ( $s_{A}^{\mathrm{inv}}=1-A$ )	55.7%	$-$ 5.5pp	—	—

Table 7: Module ablation and supervised-baseline comparison of the MDL controller (

N=3600

outcome-labeled records; supervised baselines use 5-fold cross-validation).

Computation stage	Latency ( $\mu$ s)	Share (%)	Note
Signal aggregation	98.5	71.0	Relevance max + pairwise consistency + lexical conflict detection over the memory store
Value-vector encoding	24.6	17.7	Gaussian-peak value mapping ( $3\times$ , $D=16$ )
Risk modulation and $z$ -fusion	8.0	5.8	Bounded $g_{A}$ modulation + three $16\times 16$ mat–vec products
$C$ – $\alpha$ extraction and gating	11.6	8.4	Norm/cosine decoupling + gating modulation
Action-policy matching	0.05	0.04	Threshold comparisons
Controller decision only	40.1	—	median 41.9, $p_{99}$ 74.5 ( $\mu$ s)

Table 8: Per-decision latency profile of the MDL controller (mean over 100,000 runs on the real recorded signal values; signal aggregation timed on real six-record memory stores with embeddings precomputed).

Figure 6: Qualitative output cases of the MDL controller across multiple models and domains (Cases 1–6), reproduced verbatim from the end-to-end evaluation logs. Responses of the memory-free baseline (B1), standard RAG (B2), and the MDL controller (B3) to a conspiracy-theory injection, high-risk medical misinformation, and folk myths. Cases 1 and 3–6 show real MDL successes (abstention or safe adoption); Case 2 shows a real residual failure in which an Active decision still hallucinated, mirroring the 8.0% residual hallucination under Active reported in Section 6 . Through confidence–consistency decoupling, the MDL controller precisely triggers safe abstention or auditing, reducing the negative hallucinations induced by memory injection.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Detailed specification
CPU	Intel Xeon Platinum 8480+ · 56 cores · 2.0 GHz
Memory	512 GB DDR5
OS	Ubuntu 22.04 LTS · Linux kernel 6.2
Python	Python 3.11.6
numpy	numpy 1.26.4
scipy	scipy 1.11.4

Appendix

Table 9: Complete software and hardware environment of the experiments (for reproducibility).

Signal configuration	Information $I$	Synergy
$I(M)$	0.002	—
$I(R)$	0.012	—
$I(A)$	0.037	—
$I(M{+}R)$	0.015	$+$ 0.001
$I(M{+}A)$	0.042	$+$ 0.003
$I(R{+}A)$	0.050	$+$ 0.001

Appendix

Table 10: Mutual information and synergy decomposition of the signals (

N=3600

I(\cdot)

denotes the mutual information with the true action.

Memory-Augmented Language Models

Memory-augmented language models combine persistent or temporary memory with neural computation to retain, retrieve, and use information beyond the active context.

See all 291 papers

Jun 23, 2026

TRUSTMEM: Learning Trustworthy Memory Consolidation for LLM Agents with Long-Term Memory

Large language model (LLM) agents rely on long-term memory to support extended interactions and personalized assistance beyond finite context windows. Existing memory agents actively update external memory through generated write, revise, and delete operations, but these updates may omit important information, corrupt existing memory, or introduce unsupported hallucinated content. Once stored, such errors become persistent system-state failures that can affect future reasoning and generation. In this paper, we propose TrustMem, a framework designed to improve the trustworthiness of memory consolidation. TrustMem relies on a Memory Transition Verifier to evaluate the transition process of memory updates in terms of coverage, preservation, and faithfulness. It further constructs preference pairs among candidate updates under the same memory state, enabling preference-guided reinforcement learning to directly optimize memory updating behaviors. Extensive experiments demonstrate that TrustMem improves both memory utility and reliability: it achieves state-of-the-art results across MemoryAgentBench, HaluMem, and the Mem-alpha validation set, improves HaluMem memory extraction by 12.14 F1 points, and reduces transition-level omission, corruption, and hallucination by 40.1%, 79.1%, and 50.0%, respectively, compared with the strongest baseline for each error type.

Tianyu Yang, Sudipta Paul, Vijay Srinivasan +2

AI Center-Mountain View, Samsung Electronics · University of Notre Dame

LLM Agent Memory Memory Consolidation for LLM Agents Agent Memory Management LLM Agent Reliability

Ask PDF

Jul 31, 2026

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context. We identify memory provenance laundering: during LLM-based memory consolidation, an external observation may be rewritten as apparent user history or workflow support, preserving an action trigger while erasing the low-trust source that should limit its authority. Existing prompt filters, content sanitizers, and tool guards do not enforce source-authority non-amplification after lossy memory consolidation. We formalize this boundary and instantiate it as Provenance-Preserving Memory Fire wall (PPMF), a lightweight memory middleware that preserves platform-maintained provenance and authorizes tool calls by matching action risk to the authority of action-relevant memories. In our schema-grounded evaluation with fixed risk policies, vulnerable consolidated memories reach up to 1.000 attack success rate(ASR); with intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate while confirmed benign actions and targeted low-risk memory use remain executable.

Jinghan Xu, Yiyong Xiao, Wanru Shao +2

Agent Memory Poisoning Tool Access Control for LLM Agents Agent Memory Management Persistent Memory for Language Models LLM Agent Safety Agent Memory Governance+1

Ask PDF

Jun 28, 2026

Manufactured Confidence: How Memory Consolidation Turns Hearsay into Confident Facts

LLM agents carry conclusions across steps and sessions in compressed memory, and memory products (e.g., mem0, LangMem) rewrite conversation into stored "facts" that later steps trust. We show this rewriting manufactures confidence: across our constructed agent settings, a casual, hedged remark becomes a confident, dated assertion the agent then obeys like a verified fact, granting every above-clearance request it faces. No attacker is needed: a role that was true once and never corrected is stored as a flat fact and acted on like a deliberate injection. We then isolate what the agent responds to. It is not the source: attributed, unattributed, and even forged "system of record" claims all grant alike. It is the confidence of the phrasing. A hedge is discounted, a flat assertion is obeyed, and this holds with no special keyword. Not all hedges are equal, though: the evidential register is the least-discounted, with "reportedly" obeyed like a flat assertion on most models. The obvious fixes fail. A passive "unverified" tag is ignored, and an active "do not trust this" instruction escalates even correct memory, so it is safe only by refusing to decide. The real fix lives in the store: keep the tentative phrasing rather than upgrade it. But that is hygiene, not a defense against an attacker who can simply write a confident lie. The deployable lesson is narrower and constructive: a single load-bearing memory is the hazard, and one redundant source restores correct decisions. We release the harness and demonstrations.

Alex Kwon

Independent Researcher

AI Agent Reliability LLM Agent Memory Agent Memory Poisoning Memory Consolidation for LLM Agents LLM Agent Reliability

Ask PDF

Abstract

Memory-Augmented Language Models

Explore similar work

TRUSTMEM: Learning Trustworthy Memory Consolidation for LLM Agents with Long-Term Memory

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

Manufactured Confidence: How Memory Consolidation Turns Hearsay into Confident Facts