Governance-State Corruption in Long-Term Memory for LLM Agents: A Cross-Model Stress Test

Bowen Liu; Youting Wang; Bonan Shen; Dingyan Shang

cs.AIOct 22, 2026

Governance-State Corruption in Long-Term Memory for LLM Agents: A Cross-Model Stress Test

Authors: Bowen Liu, Youting Wang, Bonan Shen, Dingyan Shang

Organizations: Independent Researcher, South San Francisco, CA, USA · Independent Researcher, Mountain View, CA, USA · Independent Researcher, Long Island City, NY, USA · Independent Researcher, Frisco, TX, USA

Abstract

An LLM agent can retrieve a memory correctly yet use it incorrectly after its validity state changes. We study governance-state corruption: faults that alter which retained records enter model-visible context while stored content and tasks remain fixed. Across six providers, 731 benchmark-grounded bases yield 2,080 matched fault pairs. In offline control-plane checks, corruption changes the operative projection in 96.25% of pairs, while oracle-backed enforcement restores it in 100%. For downstream evaluation, a deterministically selected, non-probability LongMemEval/Memora panel resolves 298 of 300 matched triplets (238 distinct bases). Clean-minus-corrupted contrasts are 40.54 percentage points in LongMemEval binary correctness (95% base-cluster interval [30.32, 50.71]) and 30.60 points in rescaled Memora FAMA ([23.31, 37.69]); both sources also show recovery. OAKS Novel native option parity holds for all 6,714 resolved outputs. Full-cohort frozen-scorer corruption/recovery effects (-27.55/+27.51 points) remain descriptive proxies, not validated native semantic population effects. These bounded findings motivate evaluating memory control-state integrity alongside retrieval accuracy.

Figures & tables

Figure 1: Control-plane intervention design. The underlying benchmark task and memory evidence are held fixed. The clean condition uses benchmark-supported governance state; the corrupted condition injects a governance-state fault that can alter model-visible context; and the enforced condition uses the same base–fault pair but restores the benchmark-supported governance projection before context construction. The enforced path is an oracle-backed mediation condition used to measure recoverability, not an autonomous deployment-time repair algorithm.

Source	Event	Bases	Miss.	Stale	Flip.	Conf.
LongMemEval	Temporal	113	113	113	–	–
LongMemEval	Update	78	78	78	–	78
Memora	Deletion	380	380	–	380	380
OAKS Novel	Temporal	56	56	56	–	56
OAKS Novel	Update	104	104	104	–	104
Total		731	731	351	380	618

Table 1: Frozen source

\times

event

\times

fault support. Fault counts denote pairs, not distinct bases; dashes are unsupported operators. Event and source are not independently crossed.

Pipeline stage	Clean	Corrupted: missing	Enforced
$G$ : governance state	Required source-supported control fields present	Required metadata for item $u$ omitted	Benchmark-supported fields restored
$A$ : admitted memory	Two items: $u,v$	Only item $v$	Two items: $u,v$
$C$ : model-visible memory	$[u,v]$	$[v]$	$[u,v]$
$Y$ : downstream frozen-proxy correctness	Six of six providers correct	Six of six providers incorrect	Six of six providers correct

Table 2: De-identified audited Memora case trace (existing frozen outputs).

u,v

replace licensed to-do text;

Y

is six-provider frozen-proxy correctness, not native FAMA. Per-case evidence is private; the audit is in scripts/audit_paper_evidence_counts.py .

Source / unit	Triplets	Bases	Clean	Corrupted	Enforced	Damage [95% interval]	Recovery [95% interval]
LongMemEval / binary	148	105	.709	.304	.696	$+40.54$ $[30.32,50.71]$	$+39.19$ $[28.85,49.66]$
Memora / FAMA	150	133	.671	.365	.628	$+30.60$ $[23.31,37.69]$	$+26.24$ $[19.09,33.34]$
Combined descriptive index (mixed metrics)	298	238	.690	.335	.662	$+35.54$ $[29.40,41.90]$	$+32.67$ $[26.42,39.09]$

Table 3: Final Formal-300 native-style results on 298 resolved triplets. Damage is clean minus corrupted; recovery is enforced minus corrupted, scaled to points. LongMemEval is binary; Memora is continuous FAMA. Brackets: descriptive 95% base-cluster bootstrap intervals (10,000 resamples; seed 20261010) on this selected panel.

Generating provider	Triplets	LME / Memora	Damage [95% interval]	Recovery [95% interval]
GPT-5.6 Sol	50	25 / 25	$+51.13$ $[38.02,64.07]$	$+50.03$ $[36.52,63.32]$
Claude Sonnet 5	50	25 / 25	$+50.60$ $[36.96,64.07]$	$+40.38$ $[26.48,54.52]$
DeepSeek V4 Pro	49	24 / 25	$+17.46$ $[6.25,29.23]$	$+19.94$ $[8.87,31.68]$
Gemini 3 Flash	49	24 / 25	$+44.04$ $[29.68,58.09]$	$+41.52$ $[26.06,56.19]$
Kimi K2.6	50	25 / 25	$+31.53$ $[18.78,44.37]$	$+26.11$ $[13.96,38.64]$
Grok 4.3	50	25 / 25	$+18.27$ $[3.78,32.55]$	$+17.97$ $[5.34,31.05]$

Table 4: Selected Formal-300 provider-level damage and recovery. Brackets: descriptive 95% base-cluster intervals; each row averages LongMemEval binary and Memora FAMA differences , not a shared native-accuracy metric. Cells are too small for provider rankings.

Model	Clean	Corrupted	Enforced	Corruption macro	Recovery macro
DeepSeek V4 Pro	45.96	19.47	47.07	$-28.05$ $[-31.30,-24.82]$	$+28.10$ $[24.97,31.21]$
GPT-5.6 Sol	43.23	17.02	43.51	$-31.10$ $[-34.11,-28.09]$	$+31.11$ $[28.15,34.07]$
Claude Sonnet 5	43.23	18.03	43.85	$-28.19$ $[-31.30,-25.02]$	$+28.36$ $[25.51,31.23]$
Gemini 3 Flash	43.78	16.35	44.13	$-31.88$ $[-35.00,-28.75]$	$+31.29$ $[28.21,34.36]$
Kimi K2.6 no-thinking	42.95	19.23	45.29	$-27.63$ $[-30.78,-24.46]$	$+28.59$ $[25.75,31.42]$
Grok 4.3 no-reasoning	28.59	12.02	28.56	$-18.47$ $[-21.82,-15.14]$	$+17.58$ $[14.65,20.54]$

Table 5: Six-provider frozen deterministic-scorer results (not independently validated native semantic accuracy). Clean, corrupted, and enforced columns report overall condition-level proxy-score rates (%). Corruption and recovery columns use base-equal fault averaging within each event, followed by equal weighting of the three event means (Table 7 ); values are percentage points; brackets denote 95% paired-bootstrap confidence intervals. Because the accuracy columns and effect columns use different aggregation schemes, their arithmetic differences need not equal the reported macro effects.

Model	Conflicting	Flipped	Missing	Stale
DeepSeek V4 Pro	-5.50	-37.37	-33.11	-45.30
GPT-5.6 Sol	-8.41	-19.47	-30.23	-58.40
Claude Sonnet 5	-6.15	-27.11	-30.64	-49.29
Gemini 3 Flash	-8.25	-26.58	-32.56	-55.84
Kimi K2.6 no-thinking	-2.59	-26.58	-30.10	-50.71
Grok 4.3 no-reasoning	-5.83	-19.74	-19.43	-32.19

Table 6: Observed frozen-scorer proxy effect by governance fault operator (points). Fault operators have different native support sets, so these estimates describe severity within the supported benchmark instances rather than a balanced causal comparison among fault classes.

Model	Deletion (380 bases)	Temporal (169 bases)	Update (182 bases)
DeepSeek V4 Pro	$-23.25/+22.63$	$-24.65/+25.05$	$-36.26/+36.63$
GPT-5.6 Sol	$-13.68/+13.51$	$-35.31/+35.50$	$-44.32/+44.32$
Claude Sonnet 5	$-17.37/+17.02$	$-26.53/+27.22$	$-40.66/+40.84$
Gemini 3 Flash	$-17.89/+17.72$	$-37.08/+35.50$	$-40.66/+40.66$
Kimi K2.6 no-thinking	$-13.86/+16.23$	$-23.96/+26.13$	$-45.05/+43.41$
Grok 4.3 no-reasoning	$-13.16/+11.67$	$-19.92/+18.54$	$-22.34/+22.53$

Table 7: Base-equal, event-associated frozen proxy-score corruption/recovery (in percentage points; corruption/recovery in each cell). Within each event, we first average the supported fault effects for each base, then weight bases equally. The three event columns therefore reproduce the primary event macro in Table 5 by an unweighted mean. Deletion coincides with Memora; these are descriptive, not source-adjusted causal contrasts.

Model	Changed effect	Unchanged effect	Induced failure	Recovered
DeepSeek V4 Pro	-28.72	-2.56	68.48%	97.05%
GPT-5.6 Sol	-27.57	0.00	69.58%	98.14%
Claude Sonnet 5	-26.67	-5.13	71.58%	85.46%
Gemini 3 Flash	-29.32	+1.28	73.43%	95.19%
Kimi K2.6 no-thinking	-25.57	-3.85	69.91%	89.07%
Grok 4.3 no-reasoning	-18.38	+2.56	76.90%	71.89%

Table 8: Offline propagation diagnostic by provider. The two effect columns use frozen proxy-score corruption effects in percentage points, stratified by whether the operative model-visible projection changes. “Induced failure” is the percentage of clean-correct, projection-changed cases that become incorrect under corruption. “Recovered” is the percentage of those induced failures that return to correct under oracle-backed enforcement.

Model	LongMemEval	Memora	OAKS
DeepSeek V4 Pro	$-13.26/+11.96$	$-23.25/+22.63$	$-52.29/+54.38$
GPT-5.6 Sol	$-23.91/+23.91$	$-13.68/+13.51$	$-59.58/+59.79$
Claude Sonnet 5	$-21.09/+21.09$	$-17.37/+17.02$	$-50.63/+51.25$
Gemini 3 Flash	$-21.96/+20.87$	$-17.89/+17.72$	$-58.54/+58.33$
Kimi K2.6 no-thinking	$-16.30/+15.87$	$-13.86/+16.23$	$-58.75/+59.17$
Grok 4.3 no-reasoning	$+3.70/-4.35$	$-13.16/+11.67$	$-48.54/+48.13$

Table 9: Source-level frozen proxy-score corruption/oracle recovery (points). Each cell reports corruption/recovery. Source estimates are descriptive because benchmark composition differs across LongMemEval, Memora, and OAKS.

Subset	$n$	Clean-A	Clean-B	$\Delta$ [95% CI]
Overall	60	.6906	.6927	$-0.21$ [ $-11.16$ , $+10.75$ ]
LongMemEval	30	.7333	.7000	$+3.33$ [ $-16.67$ , $+23.33$ ]
Memora	30	.6479	.6853	$-3.75$ [ $-12.71$ , $+6.25$ ]

Table 10: Clean-repeat stochasticity control (60 paired blocks).

\Delta

is Clean-A minus Clean-B, in percentage points. Confidence intervals use 10,000 paired-bootstrap resamples. LongMemEval uses binary correctness; Memora uses continuous native FAMA.

Agent Memory Governance

See all 17 papers

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory
Jul 31, 2026Jinghan Xu, Yiyong Xiao, Wanru Shao +2Agent Memory Poisoning Tool Access Control for LLM Agents
Agent Memory Is a Surface for Endogenous Authorization Laundering
Sep 1, 2026Tommaso Cerruti, Mika Okamoto, Ansel Kaplan ErolLLM Agent Memory LLM Agent Security
ETH Zurich · Georgia Institute of Technology
TRUSTMEM: Learning Trustworthy Memory Consolidation for LLM Agents with Long-Term Memory
Jun 23, 2026Tianyu Yang, Sudipta Paul, Vijay Srinivasan +2LLM Agent Memory Memory Consolidation for LLM Agents
AI Center-Mountain View, Samsung Electronics · University of Notre Dame

Jul 31, 2026J/K move · Enter open · S save

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

Jinghan Xu, Yiyong Xiao, Wanru Shao, Hankai Liu+1

Agent Memory Poisoning Tool Access Control for LLM Agents Agent Memory Management Persistent Memory for Language Models LLM Agent Safety Agent Memory Governance+1

Open paper AskPDF arXiv

Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context. We identify memory provenance laundering: during LLM-based memory consolidation, an external observation may be rewritten as apparent user history or workflow support, preserving an action trigger while erasing the low-trust source that should limit its authority. Existing prompt filters, content sanitizers, and tool guards do not enforce source-authority non-amplification after lossy memory consolidation. We formalize this boundary and instantiate it as Provenance-Preserving Memory Fire wall (PPMF), a lightweight memory middleware that preserves platform-maintained provenance and authorizes tool calls by matching action risk to the authority of action-relevant memories. In our schema-grounded evaluation with fixed risk policies, vulnerable consolidated memories reach up to 1.000 attack success rate(ASR); with intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate while confirmed benign actions and targeted low-risk memory use remain executable.

Abstract

Agent Memory Governance

Explore similar work

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

Agent Memory Is a Surface for Endogenous Authorization Laundering

TRUSTMEM: Learning Trustworthy Memory Consolidation for LLM Agents with Long-Term Memory