Technical Summary: Remembering More, Risking More

Problem Statement

Current safety evaluations for memory-equipped Large Language Model (LLM) agents predominantly focus on within-task safety, assessing whether an agent completes a single scenario safely, often under adversarial conditions like prompt injection or memory poisoning. However, in real-world deployments, a single agent serves many independent tasks over long horizons (weeks or months), accumulating persistent state.

The paper identifies a critical gap: temporal memory contamination. This is a failure mode where benign memory accumulation across independent, non-adversarial tasks leads to increasingly unsafe behavior over time. Unlike adversarial attacks where an attacker crafts inputs to induce failure, temporal memory contamination arises from the agent's own routine interactions. As memory grows, it may contain content that is relevant to a current query but incompatible with a safe response (e.g., retrieving a different user's private data or outdated instructions), leading to unsafe transfers.

Existing methods to study this are confounded by stream non-stationarity. Simply plotting violation rates against time fails because the input stream itself changes (e.g., email volume surges or topics become more sensitive), making it impossible to isolate whether increased risk is due to memory accumulation or the changing nature of the tasks.

Methodology

To isolate memory effects from stream non-stationarity, the authors introduce a trigger-probe protocol and an event-based framework.

1. Event Decomposition

Failures are decomposed into three components:

• Precondition: The memory state contains contaminating content retrievable for a specific query.
• Trigger: A specific input (probe) that activates the retrieval of that content.
• Violation: The agent inappropriately transfers the retrieved content into its response.

2. Trigger-Probe Protocol

This protocol evaluates a fixed set of probe triggers against read-only memory snapshots built from stream prefixes of varying lengths ($\ell$).

• Controlled Exposure: The agent processes the first $\ell$ interactions to build a memory state. A fixed set of probes is then evaluated against this snapshot in read-only mode (probes are not written back to memory).
• Counterfactual Baseline: For each probe, the system generates two responses: one with memory ($y_{mem}$) and one without memory ($y_{\emptyset}$, the NullMemory baseline).
• Memory-Induced Violation Label ($U_a$): A violation is labeled as memory-induced only if:
  1. The memory-augmented response is unsafe.
  2. The NullMemory response is safe.
  3. The unsafe content is traceable to the retrieved memory via semantic matching.

3. Evaluation Setup

The protocol is applied across two distinct agent classes and three deployment scenarios:

• Office Assistants: Evaluated on synthetic streams (Medical Practice, University Registrar) and a persona-specific Enron mailbox. Eight memory architectures from the MemEngine taxonomy are tested (e.g., Full Memory, Short-Term, Long-Term, Generative Agents, MemoryBank, MemGPT, MemTree).
• Claw-like Agents: Evaluated on OpenClaw and SecLaw platforms where agents operate in a user's computing environment with file system access. Memory is stored as plain Markdown files. Risk is measured via canary strings embedded in credentials; a violation occurs if these strings appear in outputs or logs.

Key Contributions

1. Longitudinal Safety Framework: Introduction of the trigger-probe protocol that treats memory safety as a trajectory, isolating accumulation effects from input stream variations.
2. Empirical Characterization: Comprehensive measurement of memory-induced violation rates across eight memory architectures and three scenarios, demonstrating that risk consistently exceeds the NullMemory baseline and increases with exposure length.
3. Cross-Architecture Analysis: Demonstration that temporal amplification persists across structurally different failure mechanisms (cross-context leakage in office assistants vs. attention dilution/context normalization in Claw-like agents).
4. Design Space Analysis: Identification of retrieval scope (broad semantic retrieval) and summarization level (abstracted content) as the primary design choices driving amplification.
5. Retrieval-Time Diagnostic: Development of a lightweight monitor that predicts memory-induced risk before generation based on retrieval state, achieving high recall (0.970–0.984) without relying on domain-specific rules.

Results

• Temporal Amplification: Memory-induced violation rates ($q_a(\ell)$) show a robust upward trend as exposure length ($\ell$) increases. This effect is observed in both office assistants and Claw-like agents.
• Content vs. Order: Order-randomization experiments (shuffling the sequence of interactions) indicate that the amplification is driven primarily by accumulated content rather than the specific order of encounters, although local order can modulate the effect for certain architectures (e.g., tree-structured memory).
• Architectural Sensitivity:
  • Architectures with broad retrieval and long retention (e.g., MemTree, Self-Controlled Memory, Generative Agents) exhibit the steepest increases in violation rates.
  • Recency-biased systems (e.g., Short-Term Memory) remain relatively flat, suggesting that restricting retrieval scope acts as a safety buffer.
  • Summarization can introduce risk by merging details from separate contexts into composite representations that create new, unsafe inferences.
• Claw-like Agents: Even without explicit cross-context leakage (since the probe content is fixed), surrounding benign memory dilutes safety attention and normalizes credential-adjacent language, leading to higher violation rates as memory volume grows.
• Predictive Monitoring: The retrieval-time monitor successfully detects risk before generation, suggesting that safety interventions can be applied at the retrieval stage (e.g., filtering items or falling back to memoryless generation).

Significance

The paper argues that memory safety must be treated as a longitudinal property requiring temporal evaluation, rather than a single-state property captured by a snapshot. The findings challenge the assumption that benign memory accumulation is safe, demonstrating that routine interactions alone can degrade safety profiles over time.

The work provides a methodological foundation for evaluating long-horizon agent safety and offers actionable insights for system designers:

• Trade-offs: Broadening retrieval scope and adding summarization layers improves utility but increases temporal safety exposure.
• Mitigation: Safety mechanisms should be integrated at the retrieval stage, not just at the generation stage, to filter contaminating contexts before they influence the model.
• Evaluation Standards: Future safety benchmarks must account for the temporal dimension and the interaction between memory accumulation and non-stationary input streams.

The authors conclude that without explicit temporal evaluation, the safety of memory-equipped agents in long-horizon deployments remains unverified and potentially compromised by their own history.