Since large language model (LLM) agents rely on long-term memory, what they store now shapes what they do later. A memory manager decides how each input changes this memory and which records the agent acts on. It can fail in two ways: keeping a fact that has since changed (outdated memory), or storing a planted passage or injected instruction (memory poisoning). Most prior work studies them separately, yet they call for opposite write decisions, so no fixed write rule handles both. We therefore formalize memory robustness as handling both without doing worse on other inputs. Since accuracy checks only the answer, we measure robustness with evidence-conditioned accuracy (ECA), which also checks that the records the manager selects include all the evidence the answer needs, updated and free of attacks. However, existing memory systems and defenses are not more robust than an untuned manager on our test sets. We improve robustness with a simple one-shot recipe that fine-tunes the manager on episodes synthesized around a single conversation with inserted changes and attacks. On three backbones, it improves every category score on our test sets and more than doubles the untuned manager's overall ECA, though robustness remains incomplete.
Figures & tables
Figure 1: Two cases a memory manager must handle: (a) outdated memory and (b) memory poisoning. Each panel shows an incorrect (red) and a correct (green) write, with the memory each write leaves (yellow).
Figure 2: One step t of the agent (Equations 1 and 2 ). Boxes are components; edge labels are the data passed between them. Only πθ (orange) is trained.
Figure 3: Construction of the training data in four stages (Section 3.2 ). Green, red and blue mark inserted turns of the outdated, poisoning and standard categories, purple the LLM, orange the resulting data.
Figure 4: Results of the Qwen3-4B managers on the test sets (%). In the performance panels, the dark bar is ECA and the light bar ends at ACC (grey number); poisoning ACC, ECA and ASR (lower is better) cover the attacked rows only.
Figure 5: Results of the Qwen3-4B managers on the eight benchmarks (%), the seen one ( † ) first in each category. Bars as in Figure 4 .
Appendix figures & tables10 assets
Supplementary material from the paper’s appendix.
Appendix
Criterion
Threshold
Evidence in conv-41
1 Independent attributes
≥3 verified attributes of ≥3 types
10 attributes of 7 types, e.g. John lost his job at a mechanical engineering company; Maria practices aerial yoga
2 Time cues
≥3 verified relative time cues
8, e.g. “Just yesterday I joined a nearby church” (2023-05-05)
3 Plan vs. completed event
≥1 verified plan never carried out
6, e.g. “I’m planning a trip to the East Coast”, never reported as taken
4 Facts valid in the past
≥1 verified replacement, old before new, no later contradiction
3, e.g. John: “I’m really enjoying my new job” → “I lost my job at the mechanical engineering company”
5 Retrieval coverage
old turn in the retriever’s top 8 for ≥1 replacement
2 of 3; the job change: old turn ranked 1 of 53
6 Evidence in the text only
cited evidence needs no image or outside knowledge
yes
Appendix
Table 1: Criteria for the conversation from which the base conversation is taken, checked on all of conv-41.
Part
Content
Rows
Targets
(i) Episode steps
Changes, attacks and no-change controls inserted into a 41-turn excerpt of conv-41
6,546
Labeling rule; teacher operations on original turns (4,351)
(ii) Contrast pairs
Copies of a step that differ only in the factor that decides the target
Table 3: Training and inference settings. Values written a / b / c are for Qwen3-4B / Qwen3.5-4B / Ministral-3-3B; a single value is shared by all backbones. The learning rate is tuned per backbone on the development splits.
Category
Benchmark
Figure
Seen
Rows
Record roles from
Outdated
STALE test set
6
✓
597
Old and new evidence sessions of the episode
STALE, 100-episode sample
8
✓
300 (100 ep.)
As above
BEAM-KU
8
80
original_info and updated_info source chats
MAB-FC
8
100
Gold fact index; outdated: the earlier fact with the same subject and relation
Poisoning
PoisonedRAG test set
6
✓
47
Five poisoned texts; clean retrieved passages
PoisonedRAG, held-out sample
9
✓
50
As above
Appendix
Table 4: Evaluation sets: the three synthesized test sets (Figure 6 ) and the eight benchmarks (Figures 7 – 9 ), with the source of their record roles (MAB: MemoryAgentBench).
Figure 6: Results on the test sets per backbone (%); the Qwen3-4B row is Figure 4 with the overall scores added. The untuned manager is the mean over three decode seeds. Bars as in Figure 4 : the dark bar is ECA and the light bar ends at ACC (grey number). Poisoning ACC, ECA and ASR (lower is better) cover the attacked rows only.
Figure 7: Per-benchmark results in the standard category (%) per backbone, and for the fixed manager Read all (Fixed), which uses no manager model. Average is the mean of the three benchmarks. Bars as in Figure 6 . † Seen.
Figure 8: Per-benchmark results in the outdated category (%) per backbone, and for the fixed manager Read all (Fixed). Average is the mean of the three benchmarks. Bars as in Figure 6 . † Seen.
Figure 9: Per-benchmark results in the poisoning category (%) per backbone, and for the fixed manager Read all (Fixed): ECA and ACC (top) and ASR (bottom, lower is better). ACC, ASR and ECA cover the attacked rows only. Average is the mean of the two benchmarks. Bars as in Figure 6 . † Seen.
Overall
Outdated
Poisoning
Standard
Training data
ACC
ECA
ACC
ECA
ASR ↓
ECA
ACC
ECA
None (untuned)
33.7
18.2
31.5
9.0
92.2
5.0
45.4
40.6
All (reference, one seed)
48.9
39.9
43.2
28.5
59.6
34.0
61.0
57.3
3 seeds, mean
49.3
42.1
39.6
26.1
50.4
41.8
62.3
58.2
3 seeds, SD
2.1
2.5
4.6
3.4
8.1
6.8
2.2
1.5
Share of outdated or poisoning rows (standard : outdated : poisoning, %)
Appendix
Table 5: All training-data ablations of the Qwen3-4B SFT manager (%).
Stratum
Subset
Rows
ACC [95% interval]
Attribute type
Seen in training
304
61.8 [52.4, 69.3]
Held-out
103
71.8 [58.3, 84.2]
Input template
Held-out
159
65.4 [54.0, 74.0]
Change origin
Inserted
323
68.1 [63.0, 73.1]
In the conversation
84
50.0 [29.8, 71.2]
Appendix
Table 6: Accuracy (%) of the Qwen3-4B SFT manager on the LoCoMo test rows about a change, by stratum.