Technical Summary: Beyond Similarity: Trustworthy Memory Search for Personal AI Agents

1. Problem Statement

Personal AI agents are evolving from stateless chat interfaces into persistent software companions that maintain user-specific states across sessions. While long-term memory enables continuous personalization, current memory pipelines rely almost exclusively on semantic similarity (e.g., cosine similarity in embedding spaces) to retrieve and inject memories into the model context.

The authors identify a critical trustworthiness gap: semantic proximity does not equate to contextual admissibility. A memory may be semantically related to a query but contextually inappropriate, leading to four primary categories of memory-induced trustworthiness failures:

1. Cross-Domain Leakage: Memories from unrelated functional or social domains (e.g., medical history influencing a professional email) are retrieved due to lexical overlap, violating contextual privacy.
2. Sycophancy: Stored user beliefs are over-generalized, causing the agent to abandon objective truth to align with the user's subjective worldview, creating a "personalized echo chamber."
3. Tool-Call Drift: Personality-driven memories (e.g., impatience or preference for minimal effort) silently bias safety-critical parameters in tool execution (e.g., validation modes, logging levels), leading to irreversible system integrity threats.
4. Memory-Induced Jailbreaks: Malicious actors can plant benign-looking contextual memories (e.g., a fictional role or project) that, when semantically matched with a subsequent harmful query, legitimize policy-violating requests by framing them as consistent with the user's stored background.

The paper argues that existing frameworks (A-Mem, Mem0, MemOS) and real-world agents (OpenClaw) treat memory as a utility layer rather than a trust boundary, failing to distinguish between recall (finding similar data) and admission (determining if data is safe to influence the current task).

2. Methodology: MemGate

To address these vulnerabilities, the authors propose MemGate, a lightweight, deployable memory plug-in that acts as a query-conditioned neural gate between the vector memory store and the backbone Large Language Model (LLM).

Architecture

• Positioning: MemGate sits between the vector retrieval system and the prompt construction phase. It requires no modification to the backbone LLM, no rewriting of the memory database, and no inference-time LLM judges.
• Mechanism: Instead of a binary classifier that discards entire memories, MemGate applies a continuous masking strategy. It takes the user query embedding ($q$) and a candidate memory embedding ($v_m$) as input.
• Feature Interaction: The model constructs an interaction feature vector $x_{inter} = [q \oplus v_m \oplus (q \odot v_m)]$, capturing semantic cross-resonances.
• Gating Network: A lightweight Multi-Layer Perceptron (MLP) processes $x_{inter}$ to output a gating mask $G_\phi(q, v_m) \in [0, 1]^d$. This mask selectively attenuates specific latent dimensions of the memory embedding that conflict with the current task context (e.g., domain mismatch, stale constraints) while preserving task-relevant evidence.
• Retrieval Score: The final retrieval score is an asymmetrically gated cosine similarity:
  $$S_{MemGate}(q, v_m) = \frac{q \cdot (v_m \odot G_\phi(q, v_m))}{\|q\|_2 \|v_m \odot G_\phi(q, v_m)\|_2}$$
  This ensures that distracting dimensions contributing to surface-level similarity but violating admissibility are suppressed before normalization.

Training Objective

MemGate is trained using Direct Preference Optimization (DPO) on a synthetic preference dataset constructed from abstract memory-risk categories.

• Preference Triples: For a query $q$, the model learns to prefer a contextually admissible memory $m^+$ (where $A=1$) over a conflicting or unsafe memory $m^-$ (where $A=0$).
• Preservation Penalty: A key innovation is a preservation penalty applied only to the positive mask ($g^+$). This term penalizes the deviation of the gate from an all-ones vector ($1_d$), ensuring that beneficial memories are not collapsed or overly suppressed, while allowing the gate to aggressively attenuate unsafe memories ($g^-$).
• Reference Policy: The reference policy is the standard ungated cosine retriever, ensuring MemGate learns to correct retrieval decisions without unconstrained retraining.

3. Key Contributions

1. Systematic Empirical Study: The authors provide a comprehensive assessment of memory-induced failures across three agentic memory frameworks (A-Mem, Mem0, MemOS) and a real-world tool-enabled agent (OpenClaw). They categorize failures into benign over-personalization (leakage, sycophancy, tool-drift) and malicious manipulation (jailbreaks).
2. MemGate Proposal: A parameter-efficient (9M parameters, 35.1MB footprint) plug-in that transforms raw similarity search into task-conditioned memory admission without modifying the underlying LLM or memory infrastructure.
3. Theoretical Analysis: The paper provides theoretical proofs (Theorems 1 and 2) demonstrating that the preservation penalty bounds the semantic drift of beneficial memories and mathematically guarantees the suppression of unsafe memory dimensions.
4. Extensive Evaluation: Demonstrations across multiple LLM backbones (Qwen, Llama, GPT, Gemini, Claude) showing that MemGate reduces trustworthiness failures while preserving or improving utility.

4. Experimental Results

The evaluation was conducted on benchmarks including PersistBench, MemDrift, PS-Bench, LoCoMo, and MemoryAgentBench.

Trustworthiness Improvements

• Cross-Domain Leakage: On GPT-4o-mini with OpenClaw, the failure rate dropped from 27.0% to 3.5%.
• Jailbreak Attacks: The Attack Success Rate (ASR) for memory-induced jailbreaks on GPT-4o-mini decreased from 16.8% to 4.4%.
• Tool-Call Drift: Failure rates were significantly reduced across all agents. For example, on Claude-Sonnet-4.6, tool-call drift was reduced from 80%+ to levels comparable to the memory-free baseline (25-28%).
• Sycophancy: While not fully eliminated (due to intrinsic model biases), sycophancy failure rates were substantially reduced, though remaining slightly above memory-free baselines.

Utility Preservation

Contrary to the assumption that safety mechanisms degrade performance, MemGate improved overall utility in several cases:

• LoCoMo Benchmark: On GPT-4o-mini with OpenClaw, the overall F1 score improved from 38.9 to 40.8.
• Personalization Benchmarks: Accuracy on PreFEval and PersonaMem increased across most settings, while the "Beneficial Failure Rate" (failing to use helpful memories) decreased significantly.
• Mechanism: The improvement is attributed to the removal of "noisy" memories that consume context budget and distract the model, allowing the LLM to focus on higher-quality, relevant evidence.

Efficiency

MemGate introduces negligible overhead. On OpenClaw, the median retrieval latency (P50) increased only from 1.47s to 1.59s, and the 90th percentile (P90) from 2.56s to 2.75s.

5. Significance and Claims

The paper claims that trustworthy personalization requires a fundamental shift from unconditional memory retrieval to task-conditioned memory admission.

The authors argue that memory is not merely a utility layer but a durable control channel that dictates how agents interpret tasks. By treating memory search as a trust boundary, agents can prevent persistent user states from becoming attack surfaces or sources of misalignment. MemGate demonstrates that it is possible to achieve this security hardening with a lightweight, modular component that does not compromise the core utility of long-term memory, thereby enabling safer deployment of persistent personal AI agents.