When Is a Memory Safe Enough to Act On? Action-Conditioned Verification for Long-Lived Agents

Yiqi Wang; Yifei Wang; Jiaqi Zhang; Zhangkai Wu; Yiqun Duan; Taotao Cai; Mingkai Zheng

cs.MAOct 22, 2026

When Is a Memory Safe Enough to Act On? Action-Conditioned Verification for Long-Lived Agents

Authors: Yiqi Wang, Yifei Wang, Jiaqi Zhang, Zhangkai Wu, Yiqun Duan, Taotao Cai, Mingkai Zheng

Organizations: University of Southern Queensland, Australia · Southern University of Science and Technology, Shenzhen, China · Jiangsu University, China · The University of Sydney, Australia ·

Abstract

Long-lived agents act on memory carried across sessions, and many of their actions are irreversible, so a stale memory can turn directly into harm. Existing work improves the memory itself --- retrieving, refreshing, or reconciling entries --- yet whether an entry must be re-checked before acting is not a property of the entry: the same remembered address can be used unchecked for a routine shipment but should be re-confirmed before a valuable one. We therefore study action-conditioned memory verification: given a candidate action, decide which of its memory premises to re-verify and when to proceed or abstain, balancing execution risk, abstention, and verification cost. We formulate this as a sequential stopping problem, in which a verification is worth its cost only if it can change what the agent does next; under suitable verifier reliability and cost conditions, increasing action consequence can move the same memory through proceed, verify, and direct-abstention regimes. Building on this formulation, AMV-Guard is a practical verification gate that extracts the premises a candidate action rests on, calibrates beliefs about whether they are wrong, and selects checks by bounded value of information (VOI). On ToolSandbox, relative to a static policy given the same inputs, it lowers mean verification cost by 33.9% while keeping 100% safe-proceed recall and 0% Gate harmful, and raises Proceed coverage from 38.83% to 44.17%; in a gate-core transfer to AppWorld, which carries over the stopping/VOI core but not the full structured pipeline, it lowers verification cost by 21.3% at a small cost in safe-proceed recall and task success. These results suggest that verification effort should be set by what an agent is about to do, not only by how reliable a memory appears.

Figures & tables

Figure 1: Whether a memory should be verified is not a property of the memory. The stored address, its age, source, and confidence are identical on both rows; only the action and the cost of being wrong differ, and with them the correct decision.

Figure 2: AMV-Guard . Retrieved memory is narrowed to the premises the candidate rests on; calibrated premise beliefs are combined with an action-dependent loss; the policy applies the screened stopping value and adaptive VOI, re-deciding after each observation. An invalidated premise returns the candidate to the agent loop; replanning is not a VOI terminal action.

Method	Safe recall $\uparrow$	Gate harmful $\downarrow$	Verify cost $\downarrow$	Task success $\uparrow$	Raw harm $\downarrow$	Coverage $\uparrow$
Always proceed	100.00%	66.67%	0.000	68.23%	68.75%	100.00%
Always verify all	100.00%	23.67%	1.976	74.58%	28.02%	62.67%
EnvProbe-Simple	100.00%	49.00%	2.018	74.48%	52.19%	87.00%
CTA	99.83%	63.61%	0.123	67.71%	65.89%	96.89%
AMV-Static	100.00%	0.00%	1.843	72.34%	6.82%	38.83%
AMV-Guard (ours)	100.00%	0.00%	1.219	73.91%	7.03%	44.17%

Table 1: ToolSandbox live end-to-end results (3 observation seeds

\times

640 test instances; intervals in Table 10 ). Metric definitions in Section 5.1 . Bold: best per column, excluding Always proceed/verify and the exact planner.

Policy	Harmful $\downarrow$	Cost $\downarrow$	Multi-step	Safe completion $\uparrow$	Objective $\downarrow$	Regret $\downarrow$
Always Proceed	14.20	0.000	0.00	85.80	0.6824	–
Always Verify	0.55	14.250	100.00	84.05	0.8903	–
AMV-Static	1.10	3.750	0.00	77.35	0.4550	0.0746
AMV-Adaptive (one-step)	1.20	4.007	6.80	81.50	0.4236	0.0431
Exact Planner	1.70	2.547	38.35	81.40	0.3805	0.0000

Table 2: Controlled adaptive subset (

n=2{,}000

). Multi-step: share using more than one verifier; objective: decision loss plus weighted verification cost. Rates are percentages. Bold as in Table 1 .

Method	Safe recall $\uparrow$	Gate harmful $\downarrow$	Cost $\downarrow$	Task success $\uparrow$	Raw harm $\downarrow$	Coverage $\uparrow$
Always Proceed	100.00	18.95	0.000	35.50	19.50	100.00
Always Verify	54.74	6.32	5.600	11.00	8.50	37.37
EnvProbe	91.58	17.37	2.980	23.00	18.50	90.53
CTA	67.37	13.16	3.385	18.50	16.00	61.05
AMV-Static	72.63	8.42	2.655	30.50	10.50	59.47
AMV-Guard	70.53	7.89	2.090	28.00	10.00	57.37

Table 3: AppWorld gate-core transfer (100 tasks, 200 clean/stale episodes per method; 190 Gate-evaluable). Rates are percentages. Bold as in Table 1 .

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Construction	Intended response	Count	Automated consistency check
V0	No world change.	Proceed when the remembered critical fields agree with the world.	240/80/80	Critical memory–world agreement.
V1	Flip exactly one critical field; low-battery is excluded when its cascade would change several services.	Verify if worthwhile; reject/replan if the premise is refuted.	240/80/80	Exactly one intended change enters the oracle dependency details.
V2	Flip one causally irrelevant field; fields whose invariants cascade into a critical service are excluded.	Proceed without unnecessary verification.	240/80/80	No critical field changes and the selected field is absent from the dependency closure.
V3	Flip two independently sampled critical fields (messaging only).	Exercise multi-premise/adaptive verification.	160/0/0	Messaging-only scope and two materialised critical changes.
V4	Apply both fields of one correlated event (contact sync; messaging only).	Exercise correlated-premise handling.	160/0/0	Messaging-only scope and both correlated fields materialised.
V5	Flip one critical field and mark every covering channel unavailable/failed ( $r=0$ ).	Abstain when the unsafe premise cannot be checked.	240/80/80	Unavailable channels use the failed model and explicit reason.

Appendix

Table 4: Implemented ToolSandbox perturbations. Counts are train/development/test.

Figure 3: ToolSandbox safety–coverage–verification operating points. Left: Gate harmful against verifier calls. Right: Proceed coverage against verifier calls. Both rates use the Gate-evaluable denominator, which excludes the 40 test instances with initial-candidate action or intent errors. The highlighted A4 point has 44.3% coverage in the plotted observation seed; Table 1 aggregates three seeds (44.17%). A4 merges three settings whose results are identical.

Figure 4: ToolSandbox decision-loss–verification-cost operating points over all 37 parameter settings. Settings with identical results are merged in the visualization.

Backbone	Gate harmful $\downarrow$	Verify cost $\downarrow$	Coverage $\uparrow$
Qwen3.5-35B-A3B	0.00% $\rightarrow$ 0.00%	1.843 $\rightarrow$ 1.219	38.83% $\rightarrow$ 44.17%
Qwen3.5-27B	0.00% $\rightarrow$ 0.00%	1.761 $\rightarrow$ 1.016	40.21% $\rightarrow$ 40.21%
DeepSeek-V4.1-Flash	0.00% $\rightarrow$ 0.00%	1.916 $\rightarrow$ 0.787	45.31% $\rightarrow$ 39.63%

Appendix

Table 5: Cross-backbone ToolSandbox summary. Each entry is AMV-Static

\rightarrow

AMV-Guard ; Gate harmful and Coverage use all Gate-evaluable instances. Each backbone uses its own frozen candidates and train/development calibration. Bold marks the better of the two (both if tied).

Candidate	Extracted premise targets	High-risk verify	Low-risk proceed	Relevant query
send_message_with_phone_number	Contact phone; cellular	100.0	100.0	100.0
set_wifi_status	Wi-Fi; low-battery mode	100.0	100.0	100.0

Appendix

Table 6: Action-dependent-premise intervention. Both candidates see the same memory graph and use unit premise impacts and perfect cost-one verifiers. The candidate enters the public tool-contract rule layer before Gate evaluation. Rates condition on whether the premises selected for that candidate are the high- or low-risk group.

Method	Loss level	Verify	Harmful proceed	Safe completion	Cost
AMV-Guard	Low	0.0	0.0	100.0	0.000
	Medium	15.8	64.2	33.6	0.164
	High	62.8	0.0	33.6	1.170
AMV-NoLoss	Low	15.8	0.0	97.8	0.164
	Medium	15.8	64.2	33.6	0.164
	High	15.8	64.2	33.6	0.164

Appendix

Table 7: Action-consequence intervention (500 instances per consequence level). The candidate action and memory evidence are held fixed while only total loss is rescaled. This isolates consequence weighting, not distinct-action conditioning. Rates are percentages; cost is mean verifier cost.

Fit data	ECE	Brier	NLL	Safe recall	Gate harmful	Coverage	Cost
Raw confidence	0.319	0.319	4.401	100.00	65.83	99.17	0.000
10%	0.114	0.230	0.727	86.00	3.40	32.07	0.980
25%	0.123	0.230	0.697	86.00	0.00	28.67	0.998
50%	0.108	0.218	0.609	100.00	0.00	33.33	1.082
100%	0.082	0.209	0.588	100.00	0.00	33.33	1.167

Appendix

Table 8: Calibration data efficiency on the held-out ToolSandbox test split. Calibrated rows average five instance-grouped seeds. Gate metrics use the corresponding calibrated beliefs and evaluate a single Gate pass on each of the 600 Gate-evaluable frozen initial candidates per seed, without replanning: Coverage is the share Proceeded at that initial Gate, and Cost is the initial-Gate verification cost per candidate. Table 1 instead runs full Agent–Gate episodes that include replanning, counts Proceeds after replanning in Coverage, and averages Cost over all episodes, so the two tables are not directly comparable (e.g. 33.33% vs. 44.17% coverage for full calibration). All rates are percentages.

Figure 5: Reliability diagrams for raw confidence and for calibrated memory-error beliefs fit on 100% of the training data; the other fractions are summarised in Table 8 . Calibration is fit on train only; test is never used for model or threshold selection.

Stratum	Extractor	Precision	CR	F1	DA	GH	Cost
Seen schema	LLM-only	100.00	94.65	97.25	100.00	10.76	1.051
	Graph-only	100.00	100.00	100.00	62.89	0.00	0.962
	LLM+Graph	100.00	100.00	100.00	100.00	0.00	0.962
	Union+CF	100.00	100.00	100.00	100.00	0.00	0.962
Unseen tool family	LLM-only	100.00	95.91	97.91	100.00	8.23	1.025
	Graph-only	100.00	12.58	22.35	100.00	7.59	0.000

Appendix

Table 9: Premise-extraction OOD ablation. Extraction metrics use all 160 candidates per stratum; GH and cost use the 158 Gate-evaluable candidates remaining after excluding two initial action/intent-ineligible cases per stratum. CR is critical premise recall, DA dependency accuracy, GH Gate harmful, and cost mean verification cost; F1 combines precision and CR. Union+CF is the deployed LLM+Graph extractor with counterfactual filtering. All rates are percentages.

Method	Safe recall	Gate harmful	Verify cost	Task success	Raw harm	Coverage
Always Proceed	100.00 [100.00,100.00]	66.67 [66.67,66.67]	0.000 [0.000,0.000]	68.23 [68.01,68.45]	68.75 [68.75,68.75]	100.00 [100.00,100.00]
Always Verify	100.00 [100.00,100.00]	23.67 [23.25,24.08]	1.976 [1.964,1.988]	74.58 [73.99,75.18]	28.02 [27.21,28.83]	62.67 [62.25,63.08]
EnvProbe-Simple	100.00 [100.00,100.00]	49.00 [48.59,49.41]	2.018 [2.016,2.020]	74.48 [73.89,75.07]	52.19 [51.80,52.58]	87.00 [86.59,87.41]
CTA	99.83 [99.12,100.00]	63.61 [60.48,66.75]	0.123 [0.123,0.123]	67.71 [66.24,69.18]	65.89 [62.95,68.82]	96.89 [93.52,100.00]
AMV-Static	100.00 [100.00,100.00]	0.00 [0.00,0.00]	1.843 [1.831,1.856]	72.34 [72.34,72.34]	6.82 [6.60,7.05]	38.83 [38.83,38.83]
AMV-Guard	100.00 [100.00,100.00]	0.00 [0.00,0.00]	1.219 [1.219,1.219]	73.91 [73.91,73.91]	7.03 [7.03,7.03]	44.17 [44.17,44.17]

Appendix

Table 10: ToolSandbox live end-to-end means with 95% intervals. Safe recall conditions on safe, Gate-evaluable initial candidates; Gate harmful and Coverage use all Gate-evaluable instances (Section 5.1 ). Raw harm is end-to-end. Rates are percentages.

Backbone	Method	Safe recall	Gate harmful	Verify cost	Task success	Raw harm	Coverage
Qwen3.5-35B-A3B	Always Proceed	100.00	66.67	0.000	68.23	68.75	100.00
	Always Verify	100.00	23.67	1.976	74.58	28.02	62.67
	AMV-Static	100.00	0.00	1.843	72.34	6.82	38.83
	AMV-Guard	100.00	0.00	1.219	73.91	7.03	44.17
Qwen3.5-27B	Always Proceed	100.00	64.73	0.000	68.13	68.75	100.00
	Always Verify	100.00	23.63	2.060	75.52	30.63	63.84

Appendix

Table 11: Complete cross-backbone ToolSandbox results. Safe recall conditions on safe Gate-evaluable initial candidates; Gate harmful and Coverage use all Gate-evaluable instances. Raw harm is end-to-end. Rates are percentages; verification cost is an episode mean.

Method	Unsafe Pass	Resolved w/o action	Final ABSTAIN	Initial action/intent error	Replan
Always Proceed	100.00	0.00	0.00	6.25	0.00
Always Verify	35.50	22.67	14.67	6.25	17.81
EnvProbe-Simple	73.50	13.00	0.00	6.25	20.63
CTA	95.42	0.11	3.00	6.25	0.00
AMV-Static	0.00	31.83	29.33	6.25	17.08
AMV-Guard	0.00	31.83	24.00	6.25	25.00

Appendix

Table 12: ToolSandbox secondary outcomes. Unsafe Pass conditions on harmful, Gate-evaluable initial candidates. Resolved and Final ABSTAIN use all Gate-evaluable instances and require no executed Gate-approved action; Final ABSTAIN additionally requires an explicit terminal ABSTAIN and excludes Resolved without action. Initial candidate action/intent error and Replan use all episodes. All entries are percentages.

Method	Safe recall	Gate harmful	Unsafe Pass	Verify cost	Task success	Raw harm	Coverage
Always Proceed	100.00 [100.00,100.00]	18.95 [13.68,23.50]	37.89 [27.37,47.00]	0.000 [0.000,0.000]	35.50 [27.00,44.00]	19.50 [14.50,24.50]	100.00 [100.00,100.00]
Always Verify	54.74 [44.68,64.44]	6.32 [3.16,10.10]	12.63 [6.32,20.20]	5.600 [4.280,7.105]	11.00 [6.00,16.50]	8.50 [5.00,13.00]	37.37 [29.79,45.31]
EnvProbe	91.58 [86.02,96.88]	17.37 [12.89,22.11]	34.74 [25.77,44.21]	2.980 [1.965,4.170]	23.00 [16.00,31.00]	18.50 [14.00,23.50]	90.53 [84.90,95.88]
CTA	67.37 [58.33,76.84]	13.16 [8.95,17.74]	26.32 [17.89,35.48]	3.385 [2.600,4.280]	18.50 [12.50,25.00]	16.00 [11.00,21.50]	61.05 [52.69,69.59]
AMV-Static	72.63 [63.16,81.25]	8.42 [4.74,12.50]	16.84 [9.47,25.00]	2.655 [2.095,3.285]	30.50 [22.00,39.00]	10.50 [6.50,15.00]	59.47 [51.03,67.37]
AMV-Guard	70.53 [61.29,79.79]	7.89 [4.35,11.83]	15.79 [8.70,23.66]	2.090 [1.620,2.585]	28.00 [20.50,36.50]	10.00 [6.00,14.50]	57.37 [48.92,65.96]

Appendix

Table 13: AppWorld means with paired-bootstrap 95% intervals. Gate harmful and Coverage use all Gate-evaluable instances; Unsafe Pass conditions on harmful candidates. Rates are percentages.

Model	Total params	Active params	Experimental role
Qwen3.5-35B-A3B	35B	3B	Candidates, premises (§ 4 ); main, AppWorld (§ 5 )
Qwen3.5-27B	27B dense	27B	Cross-backbone evaluation
DeepSeek-V4.1-Flash	552B	8B input / 16B output	Cross-backbone evaluation

Appendix

Table 14: Hosted language models used in the experiments. “Active” denotes the approximate parameters activated per token for mixture-of-experts models; parameter counts are taken from the official model cards. Model releases: Qwen3.5 ( Qwen Team, 2026 ) and DeepSeek-V4.1-Flash ( DeepSeek-AI, 2026 ) .

LLM Agent Verification

LLM agent verification checks whether agents’ actions, evidence, policies, and completion claims satisfy explicit requirements.

See all 148 papers

Aug 4, 2026

SafeCommit: Certifying When Memory-Grounded Agents May Safely Act

Long-horizon agents increasingly use persistent memory and tools to take actions with external side effects. A central failure mode is premature commitment: an agent acts before resolving whether its memory grounding is stale, conflicting, incomplete, or corrupted. We formalize this problem as safe commitment under memory uncertainty and introduce SafeCommit, a risk controlled layer between agent reasoning and external execution. The layer constructs a calibrated set of plausible latent worlds from memory, observations, tool outputs, provenance, and policy constraints. It permits a side effectful action only when a conformal action certificate shows that the action is safe in every retained world. Otherwise, it selects a low-side-effect probe that targets the worlds blocking certification, or returns a conservative fallback. Under calibrated world coverage, the probability of an unsafe certified commit is at most the target level α; with imperfect world proposal, the bound separates calibration and representation error. A dependency-free controlled simulator illustrates the safety-utility tradeoff and reproduces all reported results with one command. The goal is to offer a concrete approach for deciding not only what an agent should do, but when the available evidence is sufficient to safely do it.

Mayur Akewar, Ravi Ranjan

Florida International University

Agent Memory AI Agent Reliability AI Agent Safety

Ask PDF

Aug 22, 2026

MemGuard: Persisting Verifier Signals for LLM-Agent Memory Governance

LLM agents are moving from single-prompt use to long task streams in which reusable memory becomes a core capability for terminal, software-engineering, and web tasks. Such memory is useful only when stored experience remains reliable across hundreds of interactions, but two failure modes break that assumption in practice. The first is unreliable admission: failed trajectories,accidental successes, and misleading observations enter memory because they appear relevant, then mislead later decisions. The second is memory drift: long-running banks accumulate duplicate, stale, and conflicting records that retrieval alone cannot repair. MemGuard's key distinction is to treat verifier output not as a one-shot filter, but as persistent lifecycle metadata. It converts multi-criteria score-token verification into reward, confidence, label, and uncertainty descriptors that are attached to every candidate before activation and reused during retrieval, conflict resolution, summarization, and archival. We evaluate MemGuard on Terminal-Bench 2.0, SWE-Bench Verified, WebArena, and Mind2Web across four backbones, comparing against four memory baselines plus a verifier-only control under matched runtime budgets. Averaged over five seeds, MemGuard achieves the best success metric and lowest average steps in all 16 backbone-benchmark settings, improving over ReasoningBank, the strongest prior baseline among the memory methods we evaluate, with a largest gain of 7.9 success-rate points on WebArena, 5.6 step-success-rate points on Mind2Web, and 2.4-3.5 points on terminal and software-engineering benchmarks. Code is available at https://github.com/whyyyyy123/MemGuard.

Haoyu Wang, Guangyuan Dong, He Liang +5

Nankai University · National University of Singapore · Shanghai Institute of Optics and Fine Mechanics, Chinese Academy of Sciences +5

Persistent Memory for Language Models Agent Memory Management LLM Agent Reliability

Ask PDF

Aug 26, 2026

When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory

Provenance links keep the evidence behind an inherited belief reachable; an agent with a verification budget must still choose which links to inspect. We study a consolidated memory that states a decision constraint and whose source record has since been superseded by a record that withdraws it: provenance is immutable, the current record has changed, and the memory is stale. In a controlled six-memory scenario with a budget of two records, sixteen language models rarely re-verified a constraint that read as settled: they inspected its provenance path in about one episode in five and, once the constraint had been superseded, produced stale-consistent decisions in 77.3%, 74.7% and 74.7% of episodes across a primary run, a replication and a held-out domain. Re-assigning one of the same two slots to the critical path removed most of them: +74.0, +72.7 and +61.3 points (positive in every model), +80.7 in a prospectively frozen interleaved replication with a repaired non-critical control, and +62.0 on a panel of 10 models from 9 organisations; a corrected re-run of the held-out scenario gave +73.3. The forced-critical policy uses experimenter knowledge of the critical path: it quantifies how much stale-decision risk the same budget can recover and is not a scheduler. Two further deposited experiments locate the failure and a remedy: in this store the constraint's path is selected in 17.0% of episodes at two slots and 88.7% at four of six (above uniform allocation), and at two slots a one-sentence, target-blind rule (prefer memories that state a limit on a candidate direction) moved the agent's own allocation onto the constraint's path and recovered the oracle contrast on decisions (+89.3 points) where that constraint limits the tempting action, while a content-free freshness cue did not materially redirect allocation and a content-matched control rule changed neither selection nor decisions.

Kazuki Nakayashiki

Glasp

LLM Agent Verification LLM Agent Reliability Agent Memory Management Data Provenance

Ask PDF

Abstract

LLM Agent Verification

Explore similar work

SafeCommit: Certifying When Memory-Grounded Agents May Safely Act

MemGuard: Persisting Verifier Signals for LLM-Agent Memory Governance

When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory