Many Steps into One: Reasoning Contraction and the Limits of Safe Memory Reuse for LLM Agents

Jianghong Zhou; Hao Rong; Chen Lin; Daoan Zhang

cs.CLOct 13, 2026

Many Steps into One: Reasoning Contraction and the Limits of Safe Memory Reuse for LLM Agents

Authors: Jianghong Zhou, Hao Rong, Chen Lin, Daoan Zhang

Organizations: ByteDance · Scale AI

Abstract

Thought templates, skill libraries, agent memories and caches turn many reasoning steps into one. We call this reasoning contraction. A contracted memory saves reasoning steps and errors until its facts change, then quietly answers wrong. Most systems trust memories by counting successes and failures. We prove that such counters are badly tuned change detectors: a symmetric counter notices a partial change only after a power of its false-alarm horizon, and an unclipped one may never notice it. On five LLMs answering multi-hop questions over edited facts, ExpeL- and ACE-style counters serve 7.0-13.5x more stale answers than certified memories given the same information, and on code tasks with an exact verifier 35-73x more. Safety also has a price. When facts change and each memory is judged only by its own verified outcomes, one number, the certification load, sets how much reasoning any safe memory can skip, and under Zipf demand it yields a scaling law. Our recipe weighs each memory's failures by its own likelihood ratio, certifies its utility against live reasoning, and restarts the certificate when facts change, with the likelihood-ratio detector as the safety net for unannounced changes; for large edits it also invalidates the memory.

Figures & tables

Figure 1: Trusting a contracted memory is a sequential test. (a) Top: the lifecycle of a contracted memory (a macro ). In shadow mode a betting certificate scores the macro’s verified answers and folds it (one-step answers) once its wealth reaches

1/\delta

; a likelihood-ratio CUSUM (LR-CUSUM) alarm or an edit notice retires it, and the next candidate restarts the test. Middle: both tests on one real macro (Qwen3-8B, KQA-Stream ; per candidate, no notices). Its log-wealth reaches

\ln 20

(

\delta=0.05

) after 33 labels; an edit then drops its reliability from

1.00

0.37

, below break-even (

r^{\star}=0.49

), and the LR-CUSUM crosses

h=7

on the fourth label. Bottom: its timeline (hatched: certification); ExpeL- and ACE-style counters have not retired it by stream end (2,427 stale answers, against 29). (b) Exact detection delay

D

against uses to a false retirement

A

for three clipped counters (score per failure/success), failure rate

0.05\to 0.25

: the symmetric

\pm 1

rule is slow by a power of

A

; likelihood-ratio weights (

+7/{-1}

) track the optimum.

\tilde{q}

: the failure rate a rule implicitly tests ( Remark 1 ). (c) The exact coverage gap

M

(share not answered in one step) of a restarted test for 2,520 settings (dots) lies on the limit

F_{\pi}(\Theta)

(lines).

Certificate	Needs	Guarantee
Restart only : ledger $\delta_{j}$ , restarts	notices †	$\delta$ -safe per epoch ( Proposition 23 ); as run , growth $\mathrm{KL}_{\inf}/(1.03$ – $1.07)$ on the laws checked, plus $2\ln j+O(1)$ nats ( Section C.2 )
Ours (recommended): + invalidate on notice	notices † , some missed	as above; a missed notice adds the carried-over term of Proposition 23 (iii)
No notice : discard at own alarm	none	$\delta$ -safe for folds on post-change evidence ( Proposition 25 ); not per epoch if $\alpha_{i}r_{0}>\delta$ ( Proposition 24 )
Per candidate : level $\delta$ each	none	per candidate only ( Figure 1 a, code)

Table 1: Restarting at each notice makes certification safe per epoch. Bold: ours. All retire folded macros by LR-CUSUM ( Corollary 2 ). The optimum , an SPRT or grid bet restarted at known change times, attains

F_{\pi}(\Theta)

( Theorems 3 and 20 ); as run is a rule’s own growth rate; measured rates are in Section 6 . † Of every change of the null, including live reasoning’s ( Section D.5.1 ).

	stale per $10^{4}$ queries			unretired at stream end			bad folds
Model	ExpeL	ACE	ours ∘	ExpeL	ACE	LR	counters	ours
Qwen3-8B	967	946	72	53%	53%	3%	284–400	0.0
Qwen3-4B	795	783	85	57%	51%	0%	111–148	0.1
Granite-8B	657	650	82	22%	22%	0%	282–369	0.4
Mistral-7B	298	294	42	25%	25%	0%	486–595	0.6
OLMo-3-7B	480	445	51	64%	55%	9%	172–211	0.3

Table 2: Counters serve

7.0

–

13.5\times

more stale answers on every model, even when ours gets no edit notice. ∘ Ours with every notice missed, i.e. the counters’ information; with notices it serves none. Unretired: share of the stale episodes of Figure 2 (66, 53, 18, 8 and 11) still in service at stream end. Bad folds: per stream (ours: with notices). Bold: ours.

Figure 2: Counters leave half the stale memories in service at stream end; likelihood ratios retire them about

60\times

sooner (restricted mean). Kaplan–Meier share of the 156 stale memories not yet retired (same audits for all rules; counters start at the fold without credit). Legend: share still in service when the stream ends (open episodes, so it differs from the curve’s tail at

10^{4}

uses) / restricted mean delay (

\leq 10^{4}

uses). Bands: 95% template bootstrap.

Figure 3: False certifications stay far below

\delta

. At-risk epochs with a fold that violates (a) the certificate’s own null, the event

\delta

bounds, or (b) break-even

r^{\star}

; answers scored alone; five models. Without notices, folds on null evidence stay at zero up to

\delta=0.1

, and all folds more than

10\times

below

\delta

. Bars: 95% template bootstrap.

	Policy	Acc	Calls	Stale	Bad	$J_{20}$
no memory	live always	.379	3.26	0	0	43.8
no retire	fold once	.534	1.45	1290	34	31.8
	compiled plan, fold once	.639	1.45	95	34	24.8
	vCache-style, $\delta_{c}=.02$	.377	2.86	30	–	43.5
counters	ExpeL-style counter	.613	1.75	967	284	27.0
counters	ACE-style counter	.618	1.86	946	400	26.7

Table 3: Certification removes bad folds and invalidation removes stale answers, with fewer calls than live reasoning (Qwen3-8B, 30 streams of 200k queries). Calls: LLM calls per query. Stale: per

10^{4}

queries. Bad: bad folds per stream (–: no macros).

J_{20}

: loss, lower is better (

\bar{m}=3.26

). Bold: ours. ⋆ Perfect notices; with every notice missed it serves

72

stale answers per

10^{4}

queries. Compiled plans (with restarts) gain

+2.6

points [

1.7

3.8

] over restart-only macros (paired 95% template bootstrap).

Appendix figures & tables30 assets

Supplementary material from the paper’s appendix.

Appendix

$n_{a}$	10	20	50	100	200	500	1000
$\delta=0.05$	.28	.34	.30	.25	.19	.11	.081
$\delta=0.01$	.27	.33	.26	.20	.13	.058	.030
bound (i)	.26	.32	.23	.20	.10	.025	.003

Appendix

Table 4: Exact false-fold probability of the plug-in SPRT for a macro at break-even, computed by dynamic programming (

a=0.9

(m-1)/L=0.05

, horizon 2000 uses).

Policy (Qwen3-8B)	Acc	Calls	Stale	SpF	$J_{20}$
direct (path generation)	.186	1.00	0	0	54.1
Hebbian + decay	.444	3.80	0.4	0.3	40.1
compiled plan + SPRT	.650	2.51	10	0.3	25.3
loss-tuned	.631	1.62	659	118	25.7
SPRT + symmetric	.604	2.84	20	0.7	28.7
betting, no restarts	.643	2.55	72	0.1	25.9

Appendix

Table 5: Further Qwen3-8B rows for Table 3 (same setting and columns; SpF counts the bad folds of the main text). Loss-tuned: fold and retire thresholds set from a renewal-reward approximation of the loss. Per candidate : a fresh level

\delta

for each candidate. The last row drops and re-forms every macro an edit announces, with perfect notices ( Section D.4.2 ). Bold: ours.

	live			ours (recommended)			macros + betting restart only / no restarts / per-cand.				compiled plan + betting restarts / no restarts / per-cand.
Model	Acc	Calls	$J_{20}$	Acc	Calls	$J_{20}$	Acc	Calls	Stale	$J_{20}$	Acc	Calls	Stale	$J_{20}$
Qwen3-8B	.379	3.26	43.8	.648	2.56	25.5	.642/.643/.646	2.57	66/72/76	26.0	.668/.673/.677	2.46	16/14/12	24.1
Qwen3-4B	.226	4.48	74.0	.556	3.10	43.0	.551/.554/.553	3.08	82/85/91	43.5	.591/.596/.596	2.90	10/12/12	39.7
Granite-3.3-8B	.152	4.47	80.3	.439	3.57	53.8	.438/.441/.447	3.52	79/82/84	53.8	.469/.472/.477	3.39	13/15/16	50.9
Mistral-7B	.097	4.96	94.6	.241	5.00	80.5	.245/.247/.250	4.94	38/42/43	80.0	.257/.259/.258	4.88	9/9/10	78.7
OLMo-3-7B	.076	2.39	46.4	.280	2.68	36.7	.276/.280/.283	2.68	51/51/51	36.9	.294/.297/.299	2.64	11/12/12	36.0

Appendix

Table 6: All five models in the main setting (30 streams of 200k queries each). Stale: stale wrong answers per

10^{4}

queries. Ours: invalidate on notice + LR-CUSUM, perfect notices (it serves no stale answers). Calls and

J_{20}

of the other groups are for the first variant listed: the restart-only certificate with restarts (restart only), for macros and for compiled plans (compiled plan, Section D.4.2 ). Entries are descriptive means; calls are reconstructed from recorded requests. Bold: ours.

Figure 4: MuSiQue templates: measured coverage gap (markers; mean of 100 stream orders), fitted Zipf law (dashed) and online Good–Turing forecast (solid) for certification sample sizes

n_{0}

Model	episodes	$\bar{q}_{0}$	$\bar{q}_{1}$	$q_{1}{>}\frac{1}{2}$	predicted $1/\rho$ [95% CI]	$k$	$P(\arg\min)$	$k{=}1$	$k{=}7$	best $k$	ours	best $k$	ours
						empirical optimum		delay at matched FR (uses)				stale per $10^{4}$
Qwen3-8B	81	.068	.746	.86	1.84 [1.36, 2.47]	25	.24	853	482	468	81	185	76
Qwen3-4B	65	.044	.746	.88	2.14 [1.52, 3.32]	0.75	.34	330	398	317	54	231	91
Granite-3.3-8B	32	.161	.863	.97	0.93 [0.57, 1.50]	0.25	.40	169	317	126	63	173	84
Mistral-7B	17	.237	.896	.94	0.67 [0.39, 1.11]	0.1	.33	141	252	106	84	78	43
OLMo-3-7B	17	.135	.821	.94	1.14 [0.59, 2.83]	0.25	.23	131	227	115	57	88	51

Appendix

Table 7: Learning-rate sweep on KQA-Stream . Episodes: stale episodes over 30 runs.

q_{1}{>}\frac{1}{2}

: share of stale episodes with

q_{1}>0.5

P(\arg\min)

: bootstrap frequency of the empirical optimum. Best

k

: the fixed ratio with the lowest delay at matched FR over all tested

k

, and with the fewest stale answers over

k\geq 1

. Ours: per-macro LR-CUSUM (per-candidate certificate). Delays are naive means over censored episodes. Bold: ours.

Figure 5: Per-memory likelihood ratios beat every tested global counter ratio. Mean uses to detect staleness for a clipped counter that weighs a failure

k

times a success (orange; circle: best tested

k

) and for the per-memory LR-CUSUM (blue dotted), at the false-retirement rate of the latter (

1.9

–

3.4

per

10^{4}

healthy uses). Purple: the weight

1/\rho

that Corollary 2 predicts from the mean failure rates

(\bar{q}_{0},\bar{q}_{1})

; dashed: its first-order delay, an optimum -level rate that the measured delays exceed (by

2.3

–

17\times

k=1

; see the results below). On four of five models the delay is flat or lowest up to the predicted weight and grows beyond it; the per-memory gain is significant on Qwen3-8B, Qwen3-4B and OLMo-3-7B. 30 streams per model, per-candidate certificate; bands: 95% template bootstrap; naive means, which favour the slower rules ( Section D.2.1 ).

	ExpeL-style counter		ACE-style counter
Model	$\Delta$ Acc	$\Delta J_{20}$	$\Delta$ Acc	$\Delta J_{20}$
Qwen3-8B	$-.033$ [ $-.061$ , $-.004$ ]	$+1.38$ [ $-0.56$ , $+3.20$ ]	$-.028$ [ $-.055$ , $-.001$ ]	$+1.15$ [ $-0.72$ , $+2.95$ ]
Qwen3-4B	$+.006$ [ $-.020$ , $+.035$ ]	$-1.18$ [ $-3.93$ , $+1.34$ ]	$+.002$ [ $-.026$ , $+.032$ ]	$-0.68$ [ $-3.61$ , $+1.99$ ]
Granite-3.3-8B	$-.014$ [ $-.034$ , $+.009$ ]	$+0.87$ [ $-1.27$ , $+2.79$ ]	$-.014$ [ $-.035$ , $+.009$ ]	$+1.05$ [ $-1.14$ , $+3.01$ ]
Mistral-7B	$-.008$ [ $-.023$ , $+.006$ ]	$+0.30$ [ $-1.17$ , $+1.79$ ]	$-.008$ [ $-.022$ , $+.006$ ]	$+0.49$ [ $-0.94$ , $+1.93$ ]
OLMo-3-7B	$+.007$ [ $-.019$ , $+.037$ ]	$-0.47$ [ $-2.13$ , $+0.90$ ]	$-.000$ [ $-.028$ , $+.032$ ]	$-0.09$ [ $-1.82$ , $+1.36$ ]

Appendix

Table 8: Main setting: paired differences of the counters against ours (betting + LR-CUSUM, per-candidate level), with 95% template-bootstrap intervals; positive

\Delta J_{20}

is worse. Only the counters’ accuracy on Qwen3-8B differs significantly.

$\varepsilon$	certificate	Acc	Stale	SpF	slowdown	$(1{-}2\varepsilon)^{-2}$
0	uncorrected	.436	69	0.71	1.00	1.00
.05	uncorrected	.370	63	0.21	1.88	1.23
	known $\boldsymbol{\varepsilon}$	.370	61	0.21	2.00
	estimated $\boldsymbol{\varepsilon}$	.369	61	0.21	1.99
.1	uncorrected	.326	61	0.17	2.56	1.56
	known $\boldsymbol{\varepsilon}$	.328	59	0.12	2.82

Appendix

Table 9: Noisy verifier, per-candidate betting, means over the five models (30 streams each; at

\varepsilon=0

the mean of the per-candidate column of Table 6 ). Stale: per

10^{4}

queries. SpF: spurious folds per run. Slowdown: audited labels a candidate needs before it folds, relative to

\varepsilon=0

. Bold: ours (all rows).

Model	live Acc	hits	Acc	$\Delta J_{20}$	hits	Acc	Stale
		vCache, $\delta_{c}=0.02$			plug-in, $\delta_{c}=0.02$
Qwen3-8B	.379	.124	.377	$+17.9$	.847	.309	536
Qwen3-4B	.226	.119	.225	$+30.3$	.848	.187	241
Granite-3.3-8B	.152	.110	.151	$+26.9$	.841	.126	203
Mistral-7B	.097	.111	.097	$+14.7$	.847	.082	115
OLMo-3-7B	.076	.119	.076	$+9.5$	.835	.063	100

Appendix

Table 10: vCache-style cache (MiniLM, agree labels). Hits: share of queries served from cache.

\Delta J_{20}

: against ours (per-candidate betting); all intervals exclude

0

. Stale: per

10^{4}

queries. Our accuracy is

.646

.553

.447

.250

and

.283

Rule (pooled)	episodes	cens.	unretired at end	RM delay, $10^{4}$	median
LR (per-cand. betting)	212	13	6.1 [2.5, 10.8]%	76 [55, 107]	45 [40, 55]
LR (SPRT)	222	14	6.3 [2.4, 10.6]%	103 [64, 176]	50 [44, 64]
ExpeL-style	1,954	1,241	63.5 [57.5, 69.8]%	3,014 [2,204, 3,895]	375 [216, 682]
ACE-style	1,865	999	53.6 [47.6, 59.9]%	2,569 [1,882, 3,332]	211 [122, 373]

Appendix

Table 11: Censoring-aware detection, pooled over five models (150 streams per rule). RM delay: restricted mean delay within

10^{4}

folded uses; median: Kaplan–Meier median (folded uses). Bold: ours.

Figure 6: Detection frontier on real streams (five models, 30 streams each; SPRT certification): naive mean delay after an edit against false retirements of healthy macros, as frontiers over each rule’s thresholds. The naive mean counts an episode that is still open at the end of the stream with its uses so far, so it is a lower bound; the counters’ censoring-aware delays are

7

–

8\times

longer ( Table 11 ). Legend: share of each counter’s stale episodes not retired by stream end.

		unretired at stream end			RM delay within $10^{4}$ uses
Model	eps.	ExpeL	ACE	LR	ExpeL	ACE	LR
Qwen3-8B	66	53%	53%	3%	4,501	4,507	92
Qwen3-4B	53	57%	51%	0%	4,391	4,139	46
Granite-3.3-8B	18	22%	22%	0%	3,278	3,251	44
Mistral-7B	8	25%	25%	0%	2,110	2,095	61
OLMo-3-7B	11	64%	55%	9%	5,071	4,507	942

Appendix

Table 12: Matched-population detection: stale episodes of the macros folded by the restart-only certificate (last row: by per-candidate betting), replayed open loop under each retirement rule with identical audits; 30 streams per model. The OLMo LR-CUSUM value comes from one censored episode with long follow-up. Bold: ours.

Figure 7: Standard scoring (routing errors count as wrong answers): share of at-risk epochs with a task-level bad fold (reliability below

r^{\star}

) for five certificates; the dotted line

y=\delta

is a reference line , not a guarantee for these curves. Proposition 23 (iv) bounds by

\delta

only folds that violate a certificate’s own null (paired utility

\leq 0

; Figure 3 ), and per epoch only for the restarted certificate (blue), when notices cover every change of that null; the per-candidate variants are valid per candidate, the ledger without restarts over a template’s lifetime, and the no-notice variant for folds on post-change evidence ( Proposition 25 ). Five models, 150 streams per policy and

\delta

, 95% template-bootstrap intervals.

Model	$\Delta$ Acc	$\Delta J_{20}$	stale	SpF	folds	restarts
Qwen3-8B	$-.001$ [ $-.002$ , $.000$ ]	$+0.08$ [ $-0.02$ , $0.18$ ]	72 $\to$ 66	0.10 $\to$ 0.00	60.0 $\to$ 53.8	149
Qwen3-4B	$-.003$ [ $-.007$ , $-.001$ ]	$+0.30$ [ $0.07$ , $0.62$ ]	85 $\to$ 82	0.20 $\to$ 0.07	72.9 $\to$ 66.5	110
Granite-3.3-8B	$-.003$ [ $-.006$ , $-.002$ ]	$+0.33$ [ $0.17$ , $0.57$ ]	82 $\to$ 79	0.67 $\to$ 0.47	69.4 $\to$ 62.3	100
Mistral-7B	$-.002$ [ $-.004$ , $.000$ ]	$+0.27$ [ $0.05$ , $0.48$ ]	42 $\to$ 38	0.97 $\to$ 0.60	36.1 $\to$ 28.1	138
OLMo-3-7B	$-.004$ [ $-.006$ , $-.002$ ]	$+0.20$ [ $0.12$ , $0.32$ ]	51 $\to$ 51	0.40 $\to$ 0.30	41.1 $\to$ 35.5	79

Appendix

Table 13: The price of restarts: the restart-only certificate against the same lifetime ledger without restarts (paired differences with 95% template-bootstrap intervals; stale answers per

10^{4}

queries, SpF, folds and restarts per stream).

Model	$\Delta$ Acc	$\Delta J_{20}$	bad-fold epochs	alarms	stale
Qwen3-8B	$+.009$ [ $.004$ , $.015$ ]	$-0.62$ [ $-1.09$ , $-0.26$ ]	$.0009$ / $.0000$	68.3	70 $\leftarrow$ 66
Qwen3-4B	$+.016$ [ $.003$ , $.039$ ]	$-1.62$ [ $-3.86$ , $-0.26$ ]	$.0023$ / $.0011$	61.0	83 $\leftarrow$ 82
Granite-3.3-8B	$+.009$ [ $.004$ , $.017$ ]	$-0.86$ [ $-1.60$ , $-0.33$ ]	$.0006$ / $.0064$	91.8	81 $\leftarrow$ 79
Mistral-7B	$+.012$ [ $.006$ , $.022$ ]	$-1.32$ [ $-2.27$ , $-0.62$ ]	$.0003$ / $.0026$	224.2	42 $\leftarrow$ 38
OLMo-3-7B	$+.017$ [ $.004$ , $.042$ ]	$-0.89$ [ $-2.22$ , $-0.18$ ]	$.0000$ / $.0053$	99.7	49 $\leftarrow$ 51

Appendix

Table 14: Discard-on-alarm (no edit notices) against the restart-only certificate (edit-notified restarts),

\delta=0.05

: paired differences with 95% template-bootstrap intervals; share of at-risk epochs with a bad fold (no notice / restart only); detector alarms per stream; stale answers per

10^{4}

queries (no notice

\leftarrow

restart only).

Figure 8: Partial staleness on real streams: delay (Kaplan–Meier mean within

1{,}000

uses) of fixed-weight counters against the failure weight

k

1

false alarm per

10^{4}

healthy uses (95% template-bootstrap bands), with the weight

1/\rho

predicted by Corollary 2 from the mean failure rates. Left:

217

partial episodes (

q_{1}\in[0.15,0.5]

); right:

170

near-total episodes; both with

q_{0}\in[0.02,0.15]

	$\delta$	(i) own null	on null ev.	(ii) task	(iii) wrong	stale
restart only	.01	0/6704	0	0/6693	11.2%	69
	.05	0/6657	0	0/6645	11.6%	75
	.1	0/6620	0	0/6611	11.7%	78
	.2	2/6554	2	2/6546	11.8%	82
	.5	12/6401	12	10/6396	12.8%	103
no notice	.01	6/6471	0	5/6458	10.7%	70

Appendix

Table 15: Safety under answer-only scoring (pooled, 150 streams per row). (i), (ii): epochs with the event / at-risk epochs; on null ev.: epochs with a false certification on null evidence; (iii): wrong answers among served one-step answers; stale: stale answers per

10^{4}

queries. Restart only: the restart-only certificate; no notice: discard on own alarm; ours (the recommended deployment): Section D.5.2 . Bold: ours (both rows).

Policy ( $f=1$ )	Acc	Calls	Stale	$\Delta$ Acc vs restart only (points)
restart only (restart-only certificate)	.430	3.36	63.3	–
invalidate	.430	3.20	0.0	$-0.06$ [ $-0.94$ , $+0.80$ ]
ours: invalidate + LR	.433	3.38	0.0	$+0.24$ [ $-0.24$ , $+0.81$ ]
drop only	.332	3.84	0.0	$-9.8$ [ $-12.9$ , $-7.0$ ]
verified-answer cache	.188	3.43	0.0	$-24.3$ [ $-28.1$ , $-20.3$ ]
vCache-style	.186	3.50	0.0	$-24.5$ [ $-28.3$ , $-20.5$ ]

Appendix

Table 16: Same-information baselines, pooled over five models (150 streams per row; standard scoring). Top: perfect notices, paired differences with 95% template-bootstrap intervals. Bottom: missed notices. Bold: ours.

Figure 9: Natural-edit transfer (Wikidata temporal qualifiers, 1992–2016; four models, 30 streams each). (a) Real fact changes per year. (b) Share of a template’s instances whose answer changes in one edit: half of the real changes touch under

5\%

of the template, most synthetic ones

20

–

75\%

. (c) Stale answers per

10^{4}

queries: counters serve

3.0\times

more than the restart-only certificate. (d) The same

70

stale memories under three retirement rules (Kaplan–Meier). (e) Delay to detect at

3

false alarms per

10^{4}

healthy uses on

1{,}322

real episodes: fixed failure weights against the per-memory LR-CUSUM. (f) Share of at-risk epochs with a bad fold against

\delta

(“answers”: answer-only scoring; no notice: discard at the own alarm). Bands and bars: 95% template bootstrap.

Policy (pooled)	Acc	Calls	Stale	Bad/stream	$J_{20}$
live always	.175	4.47	0	0	79.3
fold once	.340	2.60	231	8.5	62.6
ExpeL-style counter	.391	3.39	241	149	59.0
ACE-style counter	.391	3.52	238	207	59.2
restart only (restart-only certificate)	.356	4.03	80.5	0.10	62.8
ours (recommended)	.337	4.22	0	0.11	64.8

Appendix

Table 17: Natural edits, pooled over four models (30 streams of 200k queries each; standard scoring). Stale: per

10^{4}

queries. Bold: ours.

Model	template-versions	notice	silent live-trace change	silent live-accuracy change
Qwen3-8B	21,528	884	1,392	286
Qwen3-4B	21,600	867	3,124	363
Granite-3.3-8B	21,456	966	4,719	448
Mistral-7B	21,384	1,333	5,328	385
OLMo-3-7B	21,528	1,129	2,264	233

Appendix

Table 18: Silent changes of the null. Top: template-versions (three sequences, routed templates) with a notice and without one but with a change of live reasoning. Bottom: candidates whose own null flips without a notice while under test (flip events by direction), and folds whose test segment spans such a flip;

\delta=0.05

, 150 streams per row, pooled over five models. Bold: ours (all policies).

Variant	Use when	Evidence
Recommended: invalidate on notice + certify with restarts + LR-CUSUM	false deployments must be bounded and notices may be incomplete	0 stale with notices; 13–66 per $10^{4}$ when 20–100% are missed ( Table 16 ); no false certification at $\delta\leq 0.1$ ; code: $2.0$ stale per $10^{4}$ with only requirement notices, bad folds in $1.3\cdot 10^{-5}$ of epochs under test at $\delta=0.05$ ( Section D.6 )
Restart only	changes are mild and partial, notices reliable	$+1.9$ points over invalidation on natural edits ( Section D.5.3 )
Compiled plans + certificate	the derivation can be re-executed cheaply on current facts	$+2.5$ points over restart-only macros, $12$ stale per $10^{4}$ ( Table 16 )
Verified answer cache	exact repeats, reliable notices	live accuracy; $13\%$ of queries in one step
Counters (ExpeL/ACE)	staleness is mild and folding everything pays; never when stale answers are costly	natural edits: $+3.5$ points, $149$ – $207$ bad folds per stream

Appendix

Table 19: Decision guide (pooled evidence; main text: Section 6 ). Bold: ours.

Id	Edit (re-enacted)	Precedent	Programs broken
A1	typing.List etc. removed	PEP 585 deprecation	55 / 68, total
A2	re.sub/split : count, flags keyword-only	deprecated in 3.13	0 / 0
A3	str patterns ASCII-only by default	Python 2/3 default	0 / 0
A4	int–str conversion capped at 640 digits	3.11 (CVE-2020-10735)	1 / 1, partial
A5	round half away from zero	Python 2	2 / 2, partial
A6	math.floor/ceil return float	Python 2	1 / 1, total

Appendix

Table 20: API edits of CodeStream. Programs broken: distinct verified programs whose behavior the edit changes, out of

1{,}494

(Qwen3-4B) /

1{,}380

(Qwen3-8B) in the two-model pilot.

Figure 10: CodeStream (EvalPlus; five models, 150 streams of

10^{6}

queries). (a) Stale answers per

10^{4}

queries (step accounting; dots: models); ours+CL: ours with changelog invalidation. (b) Share of each policy’s own stale memories not retired by stream end (numbers: stale episodes). (c) Stale exposure at matched false retirements: folded uses while stale against false retirements, both per stream, for the per-memory LR-CUSUM (threshold sweep; star:

h=7

) and fixed failure:success weights, all on the same certificate (weights

1{:}1

–

5000{:}1

were run; above

25{:}1

the curves coincide with

5000{:}1

, the no-forgetting limit). (d) Accuracy gain over live reasoning (points) against cost per query relative to live reasoning, in steps (filled) and in LLM calls (hollow). Bars: 95% template-clustered bootstrap; in (d) on the filled markers only, since

\Delta

acc in LLM calls is within

0.1

points of it.

Policy	Acc	$\Delta$ acc (points)	steps/q	$J_{20}$	one-step	calls/q	$J_{20}$	one-step	Stale	Unretired
			step accounting			call accounting
live always	.762	$0$	2.68	16.0	0	1.68	10.21	0	0	–
fold once	.765	$+0.3$ [ $-1.9$ , $2.5$ ]	1.24	14.1	.94	1.17	9.35	.94	1,043	100%
ExpeL-style counter	.822	$+6.0$ [ $4.2$ , $7.9$ ]	1.37	11.1	.90	1.27	7.44	.90	518	59%
ACE-style counter	.823	$+6.2$ [ $4.3$ , $8.1$ ]	1.40	11.0	.89	1.29	7.40	.89	510	57%
per candidate (no notices)	.850	$+8.9$ [ $7.2$ , $10.6$ ]	2.01	10.2	.63	1.95	7.19	.33	10.1	10%

Appendix

Table 21: CodeStream, pooled over five models (150 streams of

10^{6}

queries). Accuracy and

\Delta

acc (paired, template-clustered 95% intervals) in step accounting; in call accounting every

\Delta

acc is within

0.1

points of these. One-step: share of queries answered by a folded memory. Stale: per

10^{4}

queries (step accounting). Unretired: share of the policy’s own stale episodes still in service at stream end (step accounting;

14{,}826

14{,}704

1{,}456

1{,}328

and

96

episodes for the counters, per candidate, restart only and ours; fold once never retires). Bold: ours.

Model	FR	stale uses	episodes	weight ( $h$ )	$\times$ LR [95% CI]
	LR-CUSUM ( $h=7$ )			best fixed weight ( $1{:}1$ – $5000{:}1$ )
Qwen3-8B	38.8	968	196	$5000{:}1$ (84)	$7.6$ [ $3.5$ , $21.7$ ]
Qwen3-4B	29.8	656	234	$5000{:}1$ (84)	$9.8$ [ $5.8$ , $16.7$ ]
Granite-3.3-8B	47.5	526	281	$5000{:}1$ (42)	$8.2$ [ $6.4$ , $10.9$ ]
Mistral-7B	29.7	813	468	$7{:}1$ (84)	$11.4$ [ $9.3$ , $13.9$ ]
OLMo-3-7B	21.8	550	277	$5000{:}1$ (46)	$9.6$ [ $7.5$ , $12.0$ ]

Appendix

Table 22: CodeStream claim (b), step accounting. FR: false retirements per stream; stale uses: folded uses while stale per stream;

\times

LR: the fixed rule’s stale uses over the LR-CUSUM’s at no more false retirements.

5000{:}1

is the no-forgetting limit, tuned on a finer threshold grid; on the shared grid exposure is flat from

100{:}1

1000{:}1

. Bold: ours.

$t$	Stage	Real evidence (Qwen3-8B, template T118, edit sequence 303, stream seed 6)	Statistic
44	form	Audited live trace of “What individuals have their residence in the state where Louisiana Tech University is situated?” (3 calls, 1,300/59 tokens): hop located in the administrative territorial entity (fwd) $\to$ Louisiana; hop residence (bwd) $\to$ Elmore Leonard; answer type human . Correct.	$r{=}1.00$ , $r^{\star}{=}0.772$
44–10,769	certify	33 audited shadow labels: 26 both correct ( $U{=}{+}2$ ), 7 live wrong and macro correct ( $U{\approx}{+}70$ ), 0 macro failures	$\ln W^{+}\!:0\to 3.43\geq\ln 20$
10,769	fold	routing call {"type": 1} + lookup in a 272-anchor table frozen at $v_{0}$	LR-CUSUM $q_{0}{=}.015$ , $q_{1}{=}.294$ , $h{=}7$
$\to$ 93,194	reuse	2,982 one-call answers before the edit, all correct (live: .798 on the same queries); 5,566 LLM calls (64.8%) saved over the macro’s 3,026 folded uses
93,194	edit $v_{16}$	located in the administrative territorial entity , $f{=}0.6$ (451 facts); e.g. Cardiff University: Cardiff $\Rightarrow$ Hong Kong, gold John Williams $\Rightarrow$ Bruce Lee, Ip Man, Stephen Chow; the macro still answers John Williams	$r$ : $1.00\to 0.367{<}r^{\star}{=}0.491$
93,227–94,247	retire	audited folded labels 0,1,0,0 (Univ. of Basel, Univ. of Windsor, East Tennessee State Univ., Cardiff Univ.); 1,053 queries, 43 folded uses and 29 stale answers after the edit	$S$ : 2.99, 2.66, 5.66, 8.65 ${>}7$

Appendix

Table 23: Lifecycle of one real macro under betting + LR-CUSUM, and the same macro under other rules (last row).

t

: query index in the 200k-query stream. Stale answers include the retiring query. Post-edit facts are counterfactual by construction.

					$A$ at in-control rate
Rule	at edit	retires at label	uses / stale	$\mathbb{E}\tau$	$q_{0}{=}.05$	$q_{0}{=}.013$
ExpeL-style importance ( $\pm 1$ )	92	not by end (239)	3,283 / 894	$\infty$	$\infty$	$\infty$
ACE-style helpful/harmful	90/0	not by end (330/93)	3,283 / 894	$\infty$	$\infty$	$\infty$
symmetric, $H{=}2$ (SPRT + symmetric) †	0	19	169 / 47	17.8	420	$6.2{\times}10^{3}$
symmetric, $H{=}4$	0	152	1,460 / 374	180.6	$1.5{\times}10^{5}$	$3.7{\times}10^{7}$
LR $+7/{-}1$ , $H{=}43$	0	44	389 / 103	37.1	$2.0{\times}10^{5}$	$9.7{\times}10^{9}$

Appendix

Table 24: Retention rules on the same 333 real post-edit labels of the T048 macro (edit sequence 303, seed 0). Uses / stale: folded uses before retirement / stale answers incl. the retiring query (to the stream’s end for “not by end”).

\mathbb{E}\tau

: exact mean delay (labels) at

q_{1}=0.267

A

: exact mean labels to a false retirement; .013 is the deployed LR-CUSUM’s in-control estimate. † A real replay retired the macro at label 19. Bold: ours.

#	$t$	instance (T010)	$(Y^{M},Y^{L})$	$U_{t}$	$Z_{t}$	$\ln W^{+}$	$\ln W^{-}$	plug-in LLR
1	3179	Q2656	(1,1)	$+2$	$+.027$	.011	$-.011$	.096
11	27863	Q30002 Chengdu	(0,0)	$+2$	$+.027$	.121	$-.115$	.910
17	34168	Q25416	(1,1)	$+2$	$+.027$	.190	$-.174$	1.342
18	35098	Q48320 Kōbe (stale)	(0,1)	$-64.4$	$-.877$	$-.290$	.096	1.295
19	35271	Q1467 Cebu City (stale)	(0,1)	$-64.4$	$-.877$	$-.599$	.402	1.248
35	59956	Q1467	(0,1)	$-64.4$	$-.877$	$-1.573$	3.226 discard	1.781

Appendix

Table 25: Real certificates for the T010 candidate (edit sequence 202, seed 1). #: audited label, shared by betting and the SPRT; labels 1–11 precede edit

v_{7}

. Threshold

\ln 20=2.996

for

\ln W^{+}

(fold),

\ln W^{-}

(discard) and the plug-in LLR (fold).

Template (rank)	$\pi_{i}$	audits	$n^{\star}_{i}$	$n^{\star}_{i}/(p\pi_{i})$	epoch	$e^{-\Theta_{i}/\pi_{i}}$	one-step	labels to fold
		in stream		(queries)	(queries)	predicted	observed	SPRT / betting
T132 (1)	.258	5,042	642	24.9k	200k	.883	.994	19 / 9
T048 (8)	.0214	430	210	98.2k	100k a	.375	.738	38 / 106
T027 (10)	.0165	323	213	129k	200k	.524	.906	38 / 106
T110 (73)	.00154	31	213	1.38M	100k b	$<10^{-5}$	0	not in stream (8 of 39 b ) / not in stream
T115 (204)	.00043	6	208	4.87M	200k	$<10^{-10}$	0	not in stream (5 of 38) / not in stream

Appendix

Table 26: Six templates of one stream (edit sequence 101, seed 0).

\pi_{i}

: share of foldable queries. Epoch:

1/(\nu s_{i}+1/T)

s_{i}

: fraction of harmful edits. One-step: share of the template’s queries answered by a folded macro, stale ones included. Bold: ours. a Edit

v_{19}

(

t=149{,}426

); retired at

t=161{,}145

, re-certified after 77 labels at

t=194{,}254

. b Edit

v_{7}

(

t=55{,}476

) drops the candidate’s reliability from 1.0 to .733 after 8 of 39 labels.

Explore similar work

Aug 22, 2026

MemGuard: Persisting Verifier Signals for LLM-Agent Memory Governance

LLM agents are moving from single-prompt use to long task streams in which reusable memory becomes a core capability for terminal, software-engineering, and web tasks. Such memory is useful only when stored experience remains reliable across hundreds of interactions, but two failure modes break that assumption in practice. The first is unreliable admission: failed trajectories,accidental successes, and misleading observations enter memory because they appear relevant, then mislead later decisions. The second is memory drift: long-running banks accumulate duplicate, stale, and conflicting records that retrieval alone cannot repair. MemGuard's key distinction is to treat verifier output not as a one-shot filter, but as persistent lifecycle metadata. It converts multi-criteria score-token verification into reward, confidence, label, and uncertainty descriptors that are attached to every candidate before activation and reused during retrieval, conflict resolution, summarization, and archival. We evaluate MemGuard on Terminal-Bench 2.0, SWE-Bench Verified, WebArena, and Mind2Web across four backbones, comparing against four memory baselines plus a verifier-only control under matched runtime budgets. Averaged over five seeds, MemGuard achieves the best success metric and lowest average steps in all 16 backbone-benchmark settings, improving over ReasoningBank, the strongest prior baseline among the memory methods we evaluate, with a largest gain of 7.9 success-rate points on WebArena, 5.6 step-success-rate points on Mind2Web, and 2.4-3.5 points on terminal and software-engineering benchmarks. Code is available at https://github.com/whyyyyy123/MemGuard.

Haoyu Wang, Guangyuan Dong, He Liang +5

Nankai University · National University of Singapore · Shanghai Institute of Optics and Fine Mechanics, Chinese Academy of Sciences +5

Persistent Memory for Language Models Agent Memory Management LLM Agent Reliability

Ask PDF

May 7, 2026

STALE: Can LLM Agents Know When Their Memories Are No Longer Valid?

Large Language Model (LLM) agents are increasingly expected to maintain coherent, long-term personalized memory, yet current benchmarks primarily measure static fact retrieval, overlooking the ability to revise stored beliefs when new evidence emerges. We identify a critical and underexplored failure mode, Implicit Conflict: a later observation invalidates an earlier memory without explicit negation, requiring contextual inference and commonsense reasoning to detect. To rigorously evaluate this capability, we introduce STALE, a benchmark of 400 expert-validated conflict scenarios (1,200 evaluation queries across three probing dimensions) spanning over 100 everyday topics with contexts up to 150K tokens. We propose a three-dimensional probing framework that tests State Resolution (detecting that a prior belief is outdated), Premise Resistance (rejecting queries that falsely presuppose a stale state), and Implicit Policy Adaptation (proactively applying updated states in downstream behavior). A systematic evaluation of frontier LLMs and specialized memory frameworks reveals a pervasive gap between retrieving updated evidence and acting on it, with even the best evaluated model achieving only 55.2% overall accuracy. Models often accept outdated assumptions embedded in a user's query, and they struggle to recognize when a change in one aspect of the user's state should invalidate related memories. To establish an initial baseline for state-aware memory, we further present CUPMem, a prototype that strengthens write-time revision through structured state consolidation and propagation-aware search, suggesting that explicit state adjudication is a promising direction for robust agentic memory.

Hanxiang Chao, Yihan Bai, Rui Sheng +2

Wuhan University1, Wuhan, China1 · The Hong Kong University of Science and Technology3, Hong Kong, China23 · The Chinese University of Hong Kong2, Hong Kong, China23

Agent Memory LLM Agent Evaluation AI Agent Benchmarks Memory Agent Benchmarks Agent Memory Management

Ask PDF

Jul 31, 2026

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context. We identify memory provenance laundering: during LLM-based memory consolidation, an external observation may be rewritten as apparent user history or workflow support, preserving an action trigger while erasing the low-trust source that should limit its authority. Existing prompt filters, content sanitizers, and tool guards do not enforce source-authority non-amplification after lossy memory consolidation. We formalize this boundary and instantiate it as Provenance-Preserving Memory Fire wall (PPMF), a lightweight memory middleware that preserves platform-maintained provenance and authorizes tool calls by matching action risk to the authority of action-relevant memories. In our schema-grounded evaluation with fixed risk policies, vulnerable consolidated memories reach up to 1.000 attack success rate(ASR); with intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate while confirmed benign actions and targeted low-risk memory use remain executable.

Jinghan Xu, Yiyong Xiao, Wanru Shao +2

Persistent Memory for Language Models Agent Memory Poisoning LLM Agent Safety Tool Access Control for LLM Agents Agent Memory Management

Ask PDF