Plan Pointers and Record-Directive Form in Budgeted Verification of Inherited Agent Memory
cs.IR, cs.AI, cs.CL
Submitted: 2026-09-03
Updated: 2026-09-21
Comments: 65 pages, 7 figures, 44 tables. Sixteen registered studies (179,352 attempted episodes) on one instrument lineage; every package was frozen, hashed and externally deposited before its first confirmatory call. v2 adds Studies K2-K5 (generated worlds; a defensive adapter at five gains). Manuscript, source, records and the generator of every number: doi:10.5281/zenodo.22267220
License: http://creativecommons.org/licenses/by/4.0/
The gist: A model that inherits one-line memories may pull one archived source record before acting; a directive in the store can steer that pull: a pointer, a criterion or both.
Terminology
Abstract
A model that inherits one-line memories may pull one archived source record before acting; a directive in the store can steer that pull: a pointer, a criterion or both. Across sixteen registered studies (179,352 attempts) we measured where the request goes under each form; every result is descriptive, with registered intervals, no mechanism claim. A length-matched criterion exceeded a bare id on six direct-provider models (D) and failed its registered superiority rule on a nine-model OpenRouter panel (E). On generated worlds (K2-K5): the two registered signatures held on Opus 5 and Fable 5.1, Fable 5 followed the same sign, Haiku 4.5 reversed, and Sonnet 5, the GPT-5.6 endpoints and GPT-6 Astra lay near zero (K2). With a defensive adapter at five gains, the 70B rule for a gain-dependent change of the composite - criterion contrast was not met (K3 and K4); under the 8B attenuation rule (0.95 intervals: slope below zero; change beyond the margin), the 8B change of-17.5 [-26.7, -8.1] did not meet it on 36 families (K4) and at registered power on 337 families-16.6 [-19.4, -13.8] did (realised one-sided error at the margin 1.8 to 3.2% per corner of a finite grid, nominal 2.5%, not a uniform-error guarantee; K4's status stands; K5, first ladder), while a second SecAlign++ adapter under the imposed Meta-SecAlign template did not (-11.8 [-14.3, -9.3]; K5, second ladder); no NOT-MET is a statement that the contrast was unchanged; their difference (+4.7 [+2.3, +7.2]) describes two fixed execution paths, licenses no superiority, equivalence or 'significant difference' claim; nothing follows from the statuses differing (K5). Intervals describe family-reweighting stability conditional on the execution, not reproducibility across engine executions; audit replays were neither substituted for nor averaged into outcomes; no missingness gate fired and directional completions changed no status.
Sources
- SafeCommit: Certifying When Memory-Grounded Agents May Safely Act
- Inference-Time Budget Control for LLM Search Agents
- To Copy or Not to Copy: Copying Is Easier to Induce Than Recall
- PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification
- Decision-Aware Memory Cards: Counterfactual-Inspired Context Selection and Compression for Tool-Using LLM Agents
- LLMs can be easily Confused by Instructional Distractions
- Failing to Falsify: Evaluating and Mitigating Confirmation Bias in Language Models
- The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents
- Remember, Verify, or Ask? Evaluating Memory Decisions at Reuse Time
- IH-Benchmark: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications
- Will the Agent Recuse, and Will It Stop? Measuring LLM-Agent Compliance with In-Band Governance Signals at the Access Door and Mid-Flight
- When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory
- Why Do AI Agents Break Rules? How Framing, Context, and Social Signals Shape Compliance
- Blind Refusal: Language Models Refuse to Help Users Evade Unjust, Absurd, and Illegitimate Rules
- Evaluating LLM Agent Adherence to Hierarchical Safety Principles: A Lightweight Benchmark for Probing Foundational Controllability Components
- Ask the World Before Acting: Environment Probing for Calibrated Agent World Models
- Compliance vs. Sensibility: On the Reasoning Controllability in Large Language Models
- From Lossy to Verified: A Provenance-Aware Tiered Memory for Agents
Related papers
- The Price of Isolation: Estimating the Ecosystem Cost of Symmetric Two-Sided A/B Testing
- SCAR: Semantic Continuity-Aware Retrieval for Efficient Context Expansion in RAG
- MixLoRA-DSI: Dynamically Expandable Mixture-of-LoRA Experts for Rehearsal-Free Generative Retrieval over Dynamic Corpora
- How Do LLM-Generated Texts Impact Term-Based Retrieval Models?
- MemSyco-Bench: Benchmarking Sycophancy in Agent Memory
- Training with Missed Targets in Generative Recommendation: Separating Supervision from Probability Competition