The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents
Jundong Hu, Shekar Ramachandran
NeurIPS 2026 workshop
cs.AI, cs.CL
2026-09-02
On a frozen action-scored benchmark, Qwen3 0.6–8B follow a stale stored value 0.92–1.00 of the time in the Benefit suite. In Safety, dating that note newer drives 8B Δmem to −1.00.
Personalized agents need persistent memory ("usual airline", "the meeting is still in Room A") to act on a user's behalf. Once a stored fact goes stale, the model may still act on it even when a current authoritative tool already holds the right value. Benchmarks such as STALE already show that stale memory causes harm. They do not say when that harm starts as capability changes, or which observable surface features trigger it.
PayPal AI splits the two incompatible meanings of "no memory" into a frozen, closed-set, action-scored pair of suites, then walks a same-family Qwen3 ladder (0.6/1.7/4/8B) across three questions: when harm appears, which memory features trigger over-trust, and whether the fix itself depends on scale.
The frozen v1 set has 300 base scenarios (150 per suite), SHA-256 pinned. Scoring is an exact, regex, or canonical match against construction-time ground truth, with no LLM judge. Options are circularly permuted and averaged (chance ≈ 0.33).
Four conditions: no memory, clean memory, stale memory, and explicit conflict (stale and correct values both stored). Reliance is the probability the model selects the stale slot. A trap sweep (L0–L3) makes the stale note look increasingly current. A 2×2×2×2 factorial toggles label (drop [NOTES]), recency (date the stale note newer), source authority, and position. Mitigation compares a raw juxtaposition, a metadata frame (timestamp and source), and a representation-oracle that deletes the stale item first.
In the Benefit suite, stale-value reliance is already near saturation at every size: 0.92 / 0.99 / 1.00 / 1.00, with Δmem −0.33 / −0.35 / −0.35 / −0.37. The no-memory baseline is 0.35–0.37 with a CI that contains chance, so the floor is real. Under explicit conflict, 0.6B and 1.7B still follow the stale value half the time; 4B / 8B drop to 0.01 / 0.00.
In Safety, no-memory accuracy is ≥0.98. Without traps, only 0.6B shows net harm (Δmem −0.18, reliance 0.19); larger models almost never follow. Once the stale note is dated newer, the ranking flips: at L3 the 8B model has reliance 1.00 and Δmem −1.00; at L2 the 4B model is already at 0.83. The capability threshold ρ (first trap level whose Δmem CI upper bound is below 0) is 0/1/1/1. It separates 0.6B from the other three, not a monotone capability order.
Factorial main effects: dropping the label raises reliance at every size (+0.23 to +0.39) with a null large-vs-small contrast. Dating the stale note newer hits 4B / 8B harder (main effects +0.52 / +0.56; 8B−0.6B = +0.302). Source authority is weak and flat (+0.11 to +0.14). Position flips from +0.22 at 0.6B to −0.14 / −0.11 at 4B / 8B. Recency is a step: reliance jumps as soon as the stale note is at least one day newer, then saturates.
Mitigation tracks capability. Metadata gains over raw are +0.30 / +0.28 / +0.53 / +0.54. The oracle that pre-resolves the conflict recovers accuracy at every size (+0.46 / +0.57 / +0.63 / +0.59). Small models recover only when the conflict is removed before generation.
On RGB and MisBench, pooled stale reliance is 0.81–0.94. RGB Δmem again grows more negative with scale (−0.32 at 8B; −0.37 on the free-text arm). Llama-3.2/3.1 1B/3B/8B reproduces the label and recency signs on capable sizes; the tiny-scale "first position helps" corner does not cross families. Framing the same wrong item as memory, document, or earlier message finds no memory-frame advantage: the three smaller scales trust a stale document more, and 8B is not significant. Thinking mode does not close the gap; at 0.6B Benefit reliance rises from 0.924 to 0.991.
Scaling the backbone does not teach "prefer the live tool." Larger models parse timestamps more accurately, so a stale note dated newer hurts them more. Keeping a [NOTES] label cuts reliance at every size; official-sounding sources barely move the needle. From 4B up, per-item timestamps and provenance are enough. At 0.6B / 1.7B the conflict has to be adjudicated before the generator sees it.
The failure is not memory-specific. The same stale evidence framed as a document is trusted more at the smaller scales. Any system that stuffs retrieved context into the prompt sits in the same hole.
The Benefit no-memory baseline is at chance, so Δmem on explicit conflict is not net harm; net-harm claims rest on Safety. Scoring is closed-set action matching; open-ended generation is only partly covered by RGB free-text. The primary ladder is one family; Llama covers capable sizes only, with no family×scale grid. ρ is defined on their L0–L3 sequence. The measurement is consumption-time, not an end-to-end write/update/retrieve loop. The factorial is exploratory and not pre-registered.