# Long-Term Memory and Context Architecture for AI Systems **Evidence dossier — research snapshot: October 3, 2026** ## Executive summary and evidence frame This dossier investigates the research question supplied in the research brief: how AI systems should retain, retrieve, update, summarize, scope, and forget information over time without allowing stale, irrelevant, duplicated, unsafe, or misleading context to accumulate. It treats storage, retrieval, context construction, reasoning, action, updating, and deletion as separate capabilities rather than collapsing them into a single concept called “memory.” [1](https://chatgpt.com/g/g-p-6ac129ef43c08191acf988f750b7a6da/c/6ac136c6-fea8-83ed-ab4b-12c32fbd9aa8) The central conclusion is that **“memory” is not one subsystem**. Modern systems use the term for at least four materially different things: - **Context management** — deciding what information the model sees now. - **External knowledge retrieval** — locating relevant material that remains authoritative elsewhere. - **persistent derived memory** — storing information extracted or inferred from previous interactions for later reuse. - **state management** — maintaining exact, mutable facts about an ongoing task, user, workflow, or environment. These have different correctness requirements. A vector store holding conversation snippets is not equivalent to a workflow database. A summary is not equivalent to its source. A model context window is not persistent memory. Prompt caching is not semantic memory. A retrieved fact is not yet a correctly used fact. And an inference about a user should not silently acquire the authority of an explicit user statement. The evidence through October 2026 points strongly toward **hybrid architectures rather than a universal memory mechanism**. Long-context models have improved substantially, but benchmark evidence continues to show position effects, distractor sensitivity, degradation as length and reasoning complexity increase, and a substantial gap between nominal context capacity and reliable context utilization. Lost in the Middle found large positional effects even in long-context models; RULER found that only about half of 17 tested long-context models maintained satisfactory performance at 32K tokens despite all advertising at least that context length. [2](https://aclanthology.org/2024.tacl-1.9/) At the same time, retrieval is not a universal replacement for long context. Decomposing information into retrievable fragments can destroy cross-document, narrative, temporal, or causal dependencies; 2026 work explicitly finds cases where decomposition-based RAG harms tasks with strong context dependence. [3](https://aclanthology.org/2026.findings-acl.2097/) The relevant architectural question is therefore not “long context or RAG?” but **which information should be preserved intact, which should be selectively retrieved, which belongs in structured state, and which genuinely deserves durable derived memory**. A second major conclusion is that **memory accuracy is governed more by lifecycle integrity than by storage capacity alone**. LongMemEval decomposes long-term memory into indexing, retrieval, and reading and shows substantial degradation in sustained interaction, including knowledge updates and temporal reasoning. More recent work isolates maintenance failures: increasing storage capacity does not necessarily cure failures to replace or supersede obsolete information. [4](https://arxiv.org/abs/2410.10813) A third conclusion is that **derived memories should normally be treated as projections over evidence, not as replacements for evidence**. Systems increasingly summarize, consolidate, graph, merge, and abstract past observations because this can reduce retrieval cost and noise; TiMem and RecMem report substantial efficiency gains from hierarchical and recurrent consolidation. But newer work such as Zero-Mem and E-mem attacks the opposite failure mode: generated summaries and graph transformations can omit qualifying details, fragment context, or turn interpretation into apparently factual state. [5](https://aclanthology.org/2026.findings-acl.1091/) A fourth conclusion is that **forgetting is an essential architectural operation, but “decay” and “deletion” are not synonyms**. Recency weighting, TTLs, pruning, archival, and confidence decay affect retrieval eligibility. They do not necessarily erase the underlying record, embeddings, summaries, indexes, caches, or downstream derived artifacts. This distinction matters both technically and legally: for example, Article 17 of the EU GDPR creates a right to erasure in specified circumstances, subject to exceptions; reducing a memory's retrieval score is not itself erasure. [6](https://eur-lex.europa.eu/eli/reg/2016/679/) Finally, persistence changes the security model. A one-turn malicious instruction disappears with the context unless something carries it forward. A poisoned memory can survive a session boundary and influence unrelated future tasks. Recent attacks and benchmarks have demonstrated precisely this transition from temporary prompt injection to persistent compromise. MemSecBench's July 2026 preprint reports malicious memory persistence in 84.2% of cases across its 24 tested configurations and successful full write-to-execution attacks in 50.3%; other 2025–2026 work independently demonstrates persistent memory poisoning and delayed activation. These are new results and should not yet be read as universal rates, but the attack class itself is now well supported. [7](https://arxiv.org/abs/2607.27080) **Evidence conventions used here.** Peer-reviewed primary papers and standards receive the greatest weight; recent preprints are included because memory-agent research is moving faster than publication cycles but are identified as such. Provider documentation is used only for provider-specific capabilities. Architecture papers are distinguished from benchmarks, and benchmark gains are not treated as production evidence. Human cognitive-memory terminology is used only as functional analogy unless the source directly concerns cognition. The evidence strength can be summarized as follows:
Finding Evidence state
Nominal context length is not equivalent to reliable context use **Strong empirical support** across multiple benchmarks. [2](https://aclanthology.org/2024.tacl-1.9/)
Retrieval, reading/reasoning, and action are separable failure stages **Strong and improving support** from LongMemEval, Mem2ActBench, MemoryArena and 2026 agent benchmarks. [4](https://arxiv.org/abs/2410.10813)
RAG is universally superior to full context **Contradicted**; outcome depends strongly on information locality and dependency structure. [3](https://aclanthology.org/2026.findings-acl.2097/)
Consolidation can reduce memory cost/noise **Supported conditionally**, largely benchmark-specific. [5](https://aclanthology.org/2026.findings-acl.1091/)
Generated summaries should be trusted as equivalent to source evidence **Not supported**; emerging work identifies lossy decontextualization and maintenance failures. [8](https://arxiv.org/abs/2601.21714)
Forgetting/pruning can improve efficiency and sometimes accuracy **Conditional emerging evidence**; no universal decay law is established. [9](https://arxiv.org/abs/2607.22562)
Persistent memories create a distinct poisoning surface **Increasingly strong evidence**, including peer-reviewed and benchmark work, although quantitative attack rates remain environment-specific. [10](https://aclanthology.org/2026.findings-acl.791/)
One universal memory architecture is likely to dominate all agent types **Not supported by current evidence**; workload-dependent results dominate recent evaluations. [11](https://arxiv.org/abs/2602.16313)
## Memory and context taxonomy and architecture map The most useful first distinction is between **where information exists** and **whether the model currently sees it**. Conversation logs, databases, memory stores and knowledge bases can contain information without that information being in the current model context. Retrieval can locate information without the model using it properly. And even successful reasoning does not guarantee that an ensuing tool invocation reflects that reasoning correctly; Mem2ActBench was created specifically because traditional memory QA benchmarks do not test that final transition. [12](https://aclanthology.org/2026.acl-long.370/) ### Mechanisms that should not be conflated
Mechanism Persistence Selection mechanism Primary function Commonly confused with
**Model context window** None by itself Application supplies tokens Maximum model-visible sequence for a call “Memory capacity.” It is a computational input limit, not durable storage. Long-context benchmarks show that usable capacity can be materially below nominal capacity. [13](https://arxiv.org/abs/2404.06654)
**Working context** Usually one inference/agent step Orchestrator, model, truncation/compaction policy Information actively available for current reasoning The entire stored conversation. Only delivered material is working context.
**Conversation history** Potentially durable Replay, truncation, retrieval Raw interaction record “Memory”; it is evidence/history until selected into context. LongMemEval explicitly studies alternative history indexing granularities. [4](https://arxiv.org/abs/2410.10813)
**Session state** Session or checkpoint lifetime Deterministic application logic Current variables within an interaction Semantic memory. It is often exact operational state.
**Context compaction / summarization** Depends on implementation Generative transformation Reduce context size/noise Retrieval or forgetting. A summary is a lossy representation, not merely fewer stored records. Emerging memory research explicitly identifies information-loss risks. [8](https://arxiv.org/abs/2601.21714)
**Prompt caching** Provider-defined cache lifetime Prefix/cache-key match Reuse computation for repeated prompt prefixes Long-term semantic memory. Provider documentation describes cached model state such as reusable key/value computation; it does not perform relevance selection or factual reconciliation. [14](https://platform.openai.com/docs/models/default-usage-policies-by-endpoint)
**Lexical retrieval** External corpus persists Term/statistical matching, e.g. BM25 Recover text with matching vocabulary/identifiers Dense semantic retrieval. It often retains advantages for exact names, IDs and rare terminology.
**Vector/dense retrieval** External index persists Embedding similarity Semantic candidate selection “Understanding” or “memory use.” DPR demonstrated major gains over BM25 on its open-domain QA setting, but later benchmarks show retrieval quality remains domain-dependent. [15](https://aclanthology.org/2020.emnlp-main.550/)
**Hybrid retrieval + reranking** External index persists Sparse + dense candidate generation; learned/LLM reranker Increase candidate robustness/precision A distinct memory ontology. It is principally a selection architecture. Hybrid sparse–dense reranking has shown complementary gains in retrieval studies. [16](https://aclanthology.org/2023.findings-acl.880/)
**RAG** Corpus/index external to model Retrieve, then inject into context Ground generation in selected external material Persistent personal memory. Original RAG combines parametric generation with retrieved non-parametric knowledge; the external corpus can remain independently updateable. [17](https://arxiv.org/abs/2005.11401)
**Structured state** Usually durable/checkpointed Key/schema lookup Exact mutable variables: status, IDs, counters, permissions, workflow phase Natural-language semantic memory. Its advantage is determinism rather than semantic flexibility.
**Source-of-truth system / external KB** Durable Database/search/API query Authoritative organizational or domain record Memory extracted from that record. A derived memory should not silently outrank its source. Provenance standards explicitly model entities, derivations, activities and responsible agents. [18](https://www.w3.org/TR/prov-overview/)
**User profile / preference memory** Cross-session Explicit lookup/retrieval Personalization Identity truth. Preferences can be temporary, inferred, contradictory or scope-specific; recent work specifically targets preference updating because static profiles fail as preferences change. [19](https://aclanthology.org/2026.findings-acl.38/)
**Episodic memory** Usually durable Similarity/time/entity retrieval Store or reconstruct particular past interactions/events Human episodic memory. For AI this is normally an engineered event record or textual trace, not evidence of a homologous cognitive mechanism.
**Semantic memory** Usually durable Entity/fact/topic retrieval Decontextualized facts/generalized knowledge extracted from episodes Authoritative knowledge. Its abstraction often removes evidential context.
**Procedural memory / skills** Cross-task Task similarity, skill selector Reusable procedures, policies or successful action patterns Factual memory. ReMe, for example, explicitly treats reusable experience as procedural memory and includes refinement/pruning. [20](https://aclanthology.org/2026.findings-acl.829/)
**Prospective memory** Until intention resolved Trigger/time/event detection Remember to perform a future intention Merely recalling the past. 2026 prospective-memory evaluations show that delayed-intention execution remains a distinct and difficult capability. [21](https://arxiv.org/abs/2607.12385)
**Knowledge graph memory** Durable Entity/relation/temporal traversal Explicit relational and temporal structure Source data. The graph usually contains extracted/derived statements and can inherit extraction errors. A-MEM and temporal-KG systems report benchmark gains, but they do not convert derived edges into authoritative facts. [22](https://papers.nips.cc/paper_files/paper/2025/hash/19909c36f51abc4856b4560aff3d36d6-Abstract-Conference.html)
**Durable instructions** Cross-session/project/org Scope/configuration hierarchy Policy and behavioral constraints User factual memory. Instructions describe what the agent should do, not necessarily what is true.
**Organizational memory** Shared, durable ACL- and scope-aware retrieval Shared learned knowledge/history Organizational source of truth. It may contain useful experience without being authoritative policy or record.
The vocabulary borrowed from cognitive science should therefore be interpreted cautiously. Human-memory research distinguishes episodic memories of events from semantic knowledge and prospective remembering of delayed intentions, but even cognitive science does not support completely independent, cleanly separable boxes; episodic and semantic systems interact substantially. [23](https://ueaeprints.uea.ac.uk/id/eprint/72823/) An AI system calling timestamped dialogue snippets “episodic memory” is making a **functional analogy**, not demonstrating a human-like episodic mechanism. Likewise, “procedural memory” is a useful label for reusable procedures but does not establish an analogue of biological skill learning. ### Storage, retrieval, context and use form a pipeline A useful decomposition is: **available evidence → stored representation → retrieved candidates → constructed context → model interpretation → decision → action** LongMemEval formalizes a closely related indexing–retrieval–reading decomposition. [4](https://arxiv.org/abs/2410.10813) Mem2ActBench extends the distinction by evaluating whether remembered material is actually translated into correct tool selection and grounded parameters; its 400 tool-use tasks were constructed from 2,029 sessions, with human evaluation finding 91.3% of tasks strongly memory-dependent. [12](https://aclanthology.org/2026.acl-long.370/) MemoryArena goes further by coupling learning, memory and later decisions across interdependent multi-session tasks and finds that systems near saturation on conventional memory tests can perform poorly in the agentic setting. [11](https://arxiv.org/abs/2602.16313) This yields at least five independent failure classes:
Stage Successful outcome Example failure
**Capture/store** Relevant evidence survives in appropriate form Important preference never stored; malicious instruction stored instead
**Retrieve** Correct evidence enters candidate set Relevant record exists but similarity search misses it
**Context construction** Correct subset/ordering reaches model Evidence retrieved but truncated, buried, duplicated or overwhelmed by noise
**Interpret/use** Model resolves relevance, time, scope and authority correctly Correct historical fact retrieved but obsolete value chosen
**Action** Reasoning becomes correct external behavior Agent answers correctly but fills a tool argument with the stale ID
A successful storage-and-recall demonstration therefore proves considerably less than a successful memory architecture. ### Architectural families The major architectures solve different information-shape problems.
Architecture Natural strength Characteristic weakness Evidence
**Full long context** Preserves relationships and original wording; no retrieval miss if material fits and is effectively used Positional degradation, distractors, token cost, weaker effective utilization than nominal window Lost in the Middle; RULER; BABILong. [2](https://aclanthology.org/2024.tacl-1.9/)
**Trimmed recent context** Low latency; excellent for local conversational continuity Catastrophic omission of distant dependencies Long-term conversational benchmarks motivate external memory precisely because distant relevant evidence falls outside recency windows. [24](https://arxiv.org/abs/2402.17753)
**Summarized/compacted history** Lower token load; can remove repetition Irrecoverable omission, compression bias, stale summaries Systems exploiting consolidation report efficiency gains, while preservation-oriented work documents risks of destructive transformation. [5](https://aclanthology.org/2026.findings-acl.1091/)
**RAG / selective retrieval** Scales beyond context; source material can remain independently updateable; retrieval is inspectable Retrieval misses; fragmentation; relevant query may require unstated causal/temporal dependencies Original RAG; LongMemEval; AMA-Bench. [17](https://arxiv.org/abs/2005.11401)
**Structured state** Exact values, updates, constraints, versioning and auditability Requires schema/explicit state model; weak for fuzzy unstructured memories Engineering/database pattern rather than a substitute for open-ended semantic retrieval. Bitemporal work formalizes separate valid and transaction times. [25](https://doi.org/10.1007/978-3-540-30464-7_60)
**Persistent extracted memory** Cross-session continuity without replaying all history Promotion errors, duplicates, contradictions, staleness, privacy/security burden LongMemEval and recent memory architectures expose both potential gains and update/maintenance problems. [4](https://arxiv.org/abs/2410.10813)
**Knowledge graph / temporal graph** Multi-hop relational and temporal access Extraction error, maintenance overhead, decontextualization A-MEM/Zep-style work reports benchmark benefits; later evidence remains workload-dependent. [22](https://papers.nips.cc/paper_files/paper/2025/hash/19909c36f51abc4856b4560aff3d36d6-Abstract-Conference.html)
**Hybrid** Allows different information classes to use different representations Coordination, authority and invalidation become first-class problems The diversity of benchmark results increasingly favors workload-specific combinations rather than a single substrate. [11](https://arxiv.org/abs/2602.16313)
Workload changes the design space materially. Conversational assistants primarily face preference, continuity and personal-scope problems. Analytical systems depend more heavily on attributable source documents and reproducibility. Coding agents mix repository truth, current task state, tool output and reusable procedures. Business-process agents often require exact workflow state that cannot safely be approximated by embedding similarity. Long-running autonomous agents additionally need prospective intentions, checkpoints and learning from prior actions. Recent agent benchmarks increasingly test these differences instead of treating all memory as conversational recall. [12](https://aclanthology.org/2026.acl-long.370/) ## Memory lifecycle, source of truth, promotion, update and forgetting A durable memory architecture has a lifecycle, not merely a write API. ``` ``` Every arrow is a potential failure boundary. **Capture** can overcollect private or irrelevant content. **Classification** can assign a memory to the wrong user, project or type. **Validation** can mistake a model-generated interpretation for evidence. **Promotion** can turn a joke or temporary state into a lasting profile. **Indexing** can discard useful temporal/contextual signals. **Retrieval** can miss evidence or surface poison. **Context assembly** can bury a correct record among distractors. **Use** can misread validity or authority. **Update** can leave old and new values simultaneously active. **Consolidation** can erase exceptions. **Expiration** can leave stale derived indexes reachable. **Deletion** can remove the primary record while leaving its summary or embedding behind. ### A source-of-truth model The most important architectural separation is **epistemic authority versus retrieval usefulness**. An easily retrieved summary is not thereby more authoritative than the database row from which it was synthesized. W3C PROV provides a useful general foundation: provenance describes entities, activities, agents and derivation relationships so that the origin and transformation of information can be inspected. [18](https://www.w3.org/TR/prov-overview/) Bitemporal database work adds another useful distinction: **valid time** describes when something is true in the modeled world, whereas transaction/recording time describes when the system stored or learned it. [25](https://doi.org/10.1007/978-3-540-30464-7_60) That difference is directly applicable to AI memory: “the user moved on July 1” and “the assistant learned this on September 2” are not the same timestamp. An evidence-based authority model is therefore better represented as layers:
Layer Example Appropriate authority Overwrite semantics
**Authoritative source data** CRM status, repository contents, policy database, signed document Highest within its defined domain Changed through the source's own version/ownership process
**Explicit user-owned assertion** “My preferred airport is Prague”; “I no longer eat meat” Strong for the user's own current preferences/circumstances Later explicit statements can supersede earlier statements in the same scope
**Raw interaction/event evidence** Exact message, tool result, source snapshot Evidence that an event/message occurred Ideally immutable or versioned; corrections should create new provenance rather than rewrite history invisibly
**Extracted normalized fact** `preferred_airport=PRG` extracted from a message Derived May be superseded, but should retain pointer to evidence
**Retrieved external material** Search result, document excerpt Authority inherited from source, not retrieval score Should not override stronger source merely because similarity is high
**Consolidated summary** “User prefers central-European departures” Derived projection Recompute/invalidate when its inputs change; should not replace underlying evidence
**Inferred preference / model interpretation** “User probably prefers morning flights” Low unless confirmed Explicit contradictory evidence should dominate; often suitable for expiry
**Episodic trace** “On March 4 we discussed moving to Berlin” Strong that interaction occurred, weak that every proposition inside it is true Preserve provenance and speaker role
**Operational task state** `invoice_status=awaiting_approval` Authoritative for the active workflow if owned by its state machine Deterministic state-transition rules should govern it
The ordering is **not a universal global hierarchy**. A user cannot necessarily override an organization's regulatory policy, and a CRM should not be authoritative over a user's private dietary preference. Authority is always **predicate- and scope-specific**. A robust memory item therefore needs more than `{text, embedding}`. The research on provenance, temporal databases, memory updates and poisoning collectively supports recording some representation of **source/evidence, subject and scope, ownership, creation/observation time, validity interval where known, version or supersession relationships, trust/source class, access permissions, retention status and derivation links**. [18](https://www.w3.org/TR/prov-overview/) Confidence is useful but insufficient. A high-confidence model inference should not outrank an explicit authoritative record merely because its scalar confidence is `0.97`. ### Promotion into durable memory The decision to convert transient input into persistent memory is where many future errors are created. Existing research systems use combinations of salience, recency, frequency, LLM judgment, semantic novelty, reflection and consolidation. Generative Agents, for example, scores and retrieves stored observations and creates higher-level reflections; its evaluation concerns believable simulated-agent behavior, not authoritative fact management. [26](https://doi.org/10.1145/3586183.3606763) MemoryBank explicitly incorporates an Ebbinghaus-inspired forgetting mechanism, an example of borrowing a human-memory metaphor as an engineering heuristic rather than demonstrating that the human forgetting curve is optimal for AI. [27](https://arxiv.org/abs/2305.10250) The promotion mechanisms have different failure profiles:
Promotion signal Advantage Failure mode
**Explicit request to remember** Strong intentional evidence User may be ambiguous; persistence/scope may still be unclear
**Deterministic schema/rule** Reproducible, auditable Brittle; misses semantically important exceptions
**Frequency/repetition** Simple evidence of recurring relevance Repeated misinformation or injected content becomes stronger
**Recency** Tracks current situation Overweights temporary circumstances
**Model-rated importance/salience** Flexible Non-determinism, misinterpretation and prompt-injection susceptibility
**Repeated independent observation** Can increase evidential confidence Repeated copies of one bad source are not independent evidence
**User confirmation** Stronger basis for inferred preferences Interaction cost; confirmation itself must be scoped
**Task outcome** Useful for procedural learning A coincidentally successful or malicious action can be reinforced
**Human review** High-assurance path High cost and low throughput
No evaluated strategy establishes a universally optimal promotion policy. This is an important unresolved area: memory research is much richer in **retrieval algorithms than in calibrated write decisions**. Sensitive data adds another asymmetry. A useful retrieval system can always fetch information later from an authorized source; once sensitive information has been unnecessarily promoted into several derived memories, summaries and indexes, removal becomes harder. Persistence therefore has an option-value cost that raw retrieval does not. ### Updating, contradiction and staleness LongMemEval explicitly tests knowledge updates and temporal reasoning and reports substantial degradation over sustained histories. [4](https://arxiv.org/abs/2410.10813) Preference-update work in 2026 similarly treats evolving preference state as its own problem rather than assuming that ordinary retrieval resolves contradictions automatically. [19](https://aclanthology.org/2026.findings-acl.38/) Recent work also questions whether “more memory” solves stale-state problems. The 2026 Supersede preprint isolates current-value maintenance and reports cases where bounded self-maintained memory deteriorates as conversation length increases, while allocating more memory capacity does not recover the loss. The paper's environment is narrower than a production agent and should not be generalized numerically, but it provides evidence that **maintenance logic can be a bottleneck independent of storage size**. [28](https://arxiv.org/abs/2606.27472) Several distinct conflict types need different resolution semantics: **Replacement.** “My office is now in Berlin, not Prague.” The old value can remain historical evidence while the new value becomes the current valid value. **Scope conflict.** “For work travel I prefer trains; for family travel I prefer driving.” Both are simultaneously valid. **Authority conflict.** A remembered model inference conflicts with an explicit user statement. This is not a symmetric contradiction: the explicit statement has stronger authority over a user-owned preference. **Temporal conflict.** A 2025 company policy conflicts with its 2026 replacement. Version/validity is needed; embedding similarity alone cannot establish which is current. **Source disagreement.** Two independent external documents disagree. Both may need to remain visible pending adjudication. **Interpretive conflict.** Two summaries drawn from the same evidence disagree. Neither should silently overwrite the source. This is where deterministic state machinery can be superior to generic “LLM memory.” A recent 2026 preprint examining deterministic freshness logic finds that simple timestamp/serial-number selection can work well for narrowly defined current-value cases, but it does **not** dominate model-based reasoning across all update tasks. [29](https://arxiv.org/abs/2606.01435) The disagreement is informative: freshness can be mechanically determined where the domain supplies version semantics, but semantic contradictions often cannot. ### Forgetting, decay and deletion Forgetting has at least six distinct forms: **Retrieval decay** reduces an item's score with time or disuse. **TTL expiration** makes an item ineligible for ordinary retrieval after a defined time. **Invalidation** marks it obsolete because a newer event supersedes it. **Archival** removes it from active working memory while retaining historical evidence. **Replacement** changes the current projection while retaining historical versions. **Deletion/erasure** removes data itself, potentially including dependent representations. These operations should not be conflated. Recent memory systems experiment with utility-driven pruning and strategic forgetting, and some report improved benchmark efficiency or relevance. [9](https://arxiv.org/abs/2607.22562) The evidence is nevertheless too young and benchmark-dependent to establish a universal forgetting curve. Forgetting can improve **relevance** by suppressing obsolete temporary preferences, **accuracy** by removing superseded facts from candidate sets, **efficiency** by shrinking retrieval/index burden, **privacy** by limiting persistence, and **security** by eliminating compromised records. But it can destroy continuity when old information remains genuinely useful, particularly for episodic history, long-running projects, recurring constraints or delayed intentions. A critical implication is that **unused ≠ useless**. Prospective memory is an obvious counterexample: an intention might be intentionally unused for months and then become critical at one future trigger. PM-Bench's 2026 preprint finds prospective-memory execution difficult even in simulated multi-day environments, reinforcing that value cannot be estimated solely from recent retrieval frequency. [21](https://arxiv.org/abs/2607.12385) And deletion has stricter semantics than decay. In jurisdictions where an erasure obligation applies, the relevant question becomes whether personal information survives in raw memories, embeddings, graph edges, generated summaries, caches, backups or downstream derived state. GDPR Article 17 is one concrete legal example, though the exact obligation is jurisdiction- and circumstance-dependent and includes statutory exceptions. [6](https://eur-lex.europa.eu/eli/reg/2016/679/) ## Personal, organizational and security boundaries ### Personalization is a special case of uncertain state Personalization is often presented as the clearest justification for long-term memory, but it is also where epistemic mistakes become particularly visible. A useful taxonomy separates:
Personal information Example Stability expectation
**Explicit durable preference** “Always use metric units” Relatively durable until revoked
**Explicit scoped preference** “For this project, write in English” Scope-bound
**Temporary circumstance** “I am in Tokyo this week” Short-lived
**Observed behavior** User selected aisle seats three times Evidence, not necessarily a preference
**Inferred preference** “Probably prefers aisle seats” Low authority and revisable
**Identity datum** Name, account, organization Requires identity/scope discipline
**Sensitive datum** Health, finances, intimate or protected-category information Higher privacy and access-control burden
**Hard constraint** Allergy, contractual restriction Often high consequence but must still be sourced/current
The most damaging personalization error is often not forgetting but **overremembering an interpretation**. Repeatedly tailoring future behavior to an old inference can create an anchoring loop: the system acts on an assumption, the user accommodates the system, and the resulting behavior appears to confirm the original assumption. Preference-update research exists partly because static memory does not handle evolving preference state well. [19](https://aclanthology.org/2026.findings-acl.38/) Personalized memory can therefore create stale profiles, inappropriate personalization and self-reinforcing filters even when retrieval is technically correct. Those risks are conceptually different from raw recall error. ### Personal, project and organizational scopes are not interchangeable An AI system can simultaneously operate over: - one user's private history; - a project's shared context; - a customer's records; - a team's working knowledge; - organization-wide policy; - globally applicable system instructions. The crucial distinction is not simply where the record is stored but **who owns it, who can read it, where it may be reused and which scope is allowed to influence which action**. For example, a fact learned in a private employee conversation should not automatically become team memory. A customer-specific instruction should not become a global organizational skill. A project-specific coding convention should not silently override repository-level policy outside that project. A global assistant behavior instruction should not be represented as a “memory” learned from an individual user. This makes namespace and permission boundaries part of memory semantics rather than only database administration. Cross-user and cross-project leakage can occur at indexing, retrieval, summarization and consolidation: even if the raw store is tenant-separated, a shared summary or learned procedural artifact can inadvertently combine information from multiple scopes. The organizational source of truth is also usually **not the AI's memory store**. A CRM, policy repository, ticketing system, financial ledger, code repository or document-management system may own authoritative state. The AI memory can hold references, extracted projections and usage history without acquiring ownership of the truth represented by those systems. This follows directly from provenance and versioning principles rather than from any single LLM architecture. [18](https://www.w3.org/TR/prov-overview/) ### Persistence changes the security threat model Memory systems introduce a **write-side trust boundary** absent from ordinary retrieval-only systems. An attacker no longer needs the malicious instruction to remain in today's context if they can convince the agent to memorialize it. MemoryGraft demonstrated poisoned experience records that can be retrieved later and alter an agent's behavior. [30](https://arxiv.org/abs/2512.16962) Hidden in Memory, a 2026 preprint, studies “sleeper” poisoning in which malicious content causes fabricated persistent memories that activate in later interactions. [31](https://arxiv.org/abs/2605.15338) A broader 2026 security analysis identifies multiple write channels and attack classes and concludes that agents with more aggressive memory write/retrieval behavior can become more exploitable. [32](https://arxiv.org/abs/2606.04329) Peer-reviewed BackdoorAgent work at ACL 2026 demonstrates persistent triggers across agent stages and reports especially strong persistence through memory-based attack paths in its evaluated environments. [10](https://aclanthology.org/2026.findings-acl.791/) MemSecBench then evaluates poisoning as an explicit **Write → Execute → Forget/Repair** lifecycle rather than merely asking whether an injected string was stored; across its 24 configurations, it reports an 84.2% malicious-memory persistence rate and 50.3% successful full write-to-execution chain. These figures are specific to the benchmark and configurations, but the evaluation design is significant because it measures downstream consequence and repair. [7](https://arxiv.org/abs/2607.27080) The resulting attack catalogue includes:
Memory-specific attack Mechanism Why persistence changes impact
**Persistent prompt injection** Untrusted instruction gets written as durable memory Survives context/session reset
**Memory poisoning** False fact, preference or procedure inserted Future unrelated queries can retrieve it
**Context poisoning** Retrieved malicious source enters active prompt Can influence current reasoning even without persistence
**Compromised consolidation** Poison changes a generated summary/reflection One malicious event can contaminate a higher-level representation
**Procedural poisoning** Bad action sequence becomes a reusable “skill” Attack propagates to later similar tasks
**Privilege escalation via memory** Record from higher-privilege context becomes reachable in lower-privilege task Converts a scope error into durable capability leakage
**Cross-user/project leakage** Incorrect namespace or shared derived representation Exposure can recur across many queries
**Poisoned knowledge base** Malicious external document consistently ranks highly RAG repeatedly reinjects adversarial text
**Deletion evasion** Primary poisoned memory removed but summary/index survives Attack can reactivate through derivatives
Persistence therefore increases both **duration** and **fan-out**. A transient injection has to win again each time; a successful persistent injection can convert one compromise into a future input source. An important research implication is that provenance is security metadata as well as epistemic metadata. “This statement came from an authenticated policy service” and “this statement was inferred by a model after reading an untrusted webpage” cannot safely occupy identical memory records. The same applies to write authority: content that a model may read is not necessarily content it should be permitted to promote into trusted persistent state. Recent poisoning results strongly support separating these capabilities. [32](https://arxiv.org/abs/2606.04329) ## Evidence on long context, retrieval, state and persistent memory ### Long context is larger than it is reliable Lost in the Middle established an influential finding: moving relevant information within an otherwise identical long input can materially change model performance, with evidence near the beginning or end often used more reliably than evidence in the middle. [2](https://aclanthology.org/2024.tacl-1.9/) RULER expanded evaluation beyond simple needle retrieval to multiple needles, multi-hop tracing and aggregation. Across 17 models, near-perfect performance on simple needle tests did not translate into stable performance as context length and task complexity grew; only roughly half maintained satisfactory performance at 32K despite nominal support of at least 32K. [13](https://arxiv.org/abs/2404.06654) BABILong similarly reports that then-current models often effectively use only a fraction of their available context as reasoning complexity grows, while LongGenBench shows that long-context retrieval success does not guarantee stable long-form generation. [33](https://arxiv.org/abs/2406.10149) A 2026 literary long-context benchmark found that tested frontier models were not stable beyond 64K on complex narrative/storyworld tasks, again showing that “accepts N tokens” and “reliably reasons across N tokens” are different properties. [34](https://aclanthology.org/2026.latechclfl-1.28/) Current provider documentation nevertheless shows that context ceilings themselves continue to expand into very large ranges, including million-token-class contexts. [35](https://ai.google.dev/gemini-api/docs/long-context) That development weakens the old argument that retrieval is mandatory simply because text cannot fit. It does **not** eliminate the remaining arguments for retrieval: freshness, permissions, observability, selective relevance, cost, source attribution and updateability. Conversely, long context has an intrinsic advantage when information is strongly interdependent. 2026 research on document decomposition finds that RAG-like decomposition can hurt when understanding requires preserving contextual dependencies that fragmentation destroys. [3](https://aclanthology.org/2026.findings-acl.2097/) The correct implication is therefore conditional: **Long context becomes more attractive as information dependency rises and total evidence fits within reliably usable context; selective retrieval becomes more attractive as information sparsity, corpus size, update rate and access-control complexity rise.** ### Retrieval is a selection mechanism, not a truth mechanism The original RAG architecture combines a parametric model with retrieved non-parametric evidence, providing a way to refresh and inspect external knowledge without retraining model weights. [17](https://arxiv.org/abs/2005.11401) Dense Passage Retrieval demonstrated that learned dense representations could significantly outperform a strong BM25 baseline on the open-domain QA datasets evaluated in that work. [15](https://aclanthology.org/2020.emnlp-main.550/) Later evaluations show that this result should not be universalized: exact terms, rare identifiers and domain vocabulary continue to make lexical retrieval valuable, and hybrid sparse+dense systems can exploit complementary signals. [16](https://aclanthology.org/2023.findings-acl.880/) Reranking adds another stage: broad, high-recall retrieval first, more expensive precision-oriented selection second. This improves candidate ordering but does not solve underlying provenance or freshness. An obsolete document can be semantically perfect and rank first. LongMemEval demonstrates that retrieval query formulation, storage granularity and reading strategy all affect final memory performance. [4](https://arxiv.org/abs/2410.10813) AMA-Bench argues that similarity retrieval can omit causal and objective details from long agent trajectories and reports gains from a causality-graph plus tool-augmented retrieval architecture on its benchmark. [36](https://arxiv.org/abs/2602.22769) Because AMA-Bench is a 2026 preprint and its architecture is evaluated primarily on its own benchmark, its absolute architectural conclusion remains provisional; the diagnostic point—that similarity alone can miss causal dependencies—is stronger. ### Structured state solves a different class of problem Consider three remembered propositions: > “The user once mentioned Paris.” > “The user's currently confirmed shipping city is Prague.” > “The current workflow is awaiting manager approval.” These should not necessarily share a retrieval mechanism. The first is naturally episodic and fuzzy. The second is a mutable user state with explicit supersession semantics. The third is operational state in which an approximate historical match could be actively dangerous. Structured state sacrifices open-ended semantic flexibility for exactness, observability, reproducibility and deterministic update behavior. Temporal database research has long formalized version and validity concepts relevant to this category. [25](https://doi.org/10.1007/978-3-540-30464-7_60) Persistent LLM memory becomes most questionable when it is used as a fuzzy replacement for an existing precise state representation. ### Persistent-memory systems demonstrate several distinct architectural ideas Research since 2023 has explored multiple forms rather than converging on one design. **MemGPT** frames finite context as a virtual-memory problem and lets an agent manage hierarchical storage tiers, moving information between active context and external memory. It is primarily an architecture proposal plus experimental demonstration, not evidence that autonomous memory management is universally safe. [37](https://arxiv.org/abs/2310.08560) **Generative Agents** stores natural-language observations, retrieves them according to relevance/recency/importance, creates reflections and uses the resulting memory in planning. Ablations show contributions to the paper's simulated-agent believability objective, which is materially different from enterprise factual correctness. [26](https://doi.org/10.1145/3586183.3606763) **A-MEM** introduces structured, dynamically linked notes inspired by Zettelkasten organization. It is evidence that structured relationships can improve evaluated memory tasks, not evidence that those derived structures should become authoritative records. [22](https://papers.nips.cc/paper_files/paper/2025/hash/19909c36f51abc4856b4560aff3d36d6-Abstract-Conference.html) **Mem0** proposes dynamic extraction, consolidation and retrieval and reports strong LoCoMo efficiency and quality results, including substantial token/latency savings. Because the paper is vendor-authored and its measurements compare particular systems and configurations, the relative architecture claim deserves more weight than treating its numerical gains as a general law. [38](https://arxiv.org/abs/2504.19413) **Temporal knowledge-graph approaches**, including Zep/Graphiti research, model changing facts and relationships explicitly and report benchmark improvements. These are attractive when time and relation traversal matter, but graph construction adds a transformation layer whose extraction errors and provenance must themselves be managed. [39](https://arxiv.org/abs/2501.13956) **TiMem**, published in ACL Findings 2026, uses temporal-hierarchical organization and semantic consolidation and reports 75.30% on LoCoMo and 76.88% on LongMemEval-S while recalling substantially shorter memory than comparator approaches on LoCoMo. [5](https://aclanthology.org/2026.findings-acl.1091/) **RecMem**, also ACL Findings 2026, uses recurrent consolidation and reports memory-construction token reductions of up to 87% versus three evaluated state-of-the-art approaches while improving accuracy in its experiments. [40](https://aclanthology.org/2026.findings-acl.1619/) The opposing line of research is equally important. **Zero-Mem** explicitly preserves original traces as the source record and uses deterministic conflict filtering alongside structured organization, arguing that repeatedly asking LLMs to rewrite memory introduces cost and potential distortion. [41](https://arxiv.org/abs/2607.29377) **E-mem** similarly argues that aggressive preprocessing and graph-like compression can decontextualize evidence and focuses instead on reconstructing relevant episodic context. [8](https://arxiv.org/abs/2601.21714) These are new 2026 preprints, so they do not overturn consolidation results; they expose a trade-off those results do not eliminate. ### Comparative architecture matrix The table below is an **evidence synthesis**, not a benchmark in which all systems were run under identical conditions.
Property Full long context Summarized context Vector RAG Hybrid retrieval + rerank Structured state Persistent episodic/semantic memory
**Recall of all raw evidence** Potentially high if evidence fits; effective recall degrades with length/position Lower after lossy compression Conditional on retrieval recall Usually stronger candidate robustness High only for represented schema Conditional on what was promoted
**Cross-evidence reasoning** Strongest when dependencies remain intact Conditional on summary quality Can fail when evidence fragments are retrieved separately Better candidate set, same fragmentation risk Strong for explicit relations/state Conditional on representation
**Context noise** High as corpus/history grows Lower Lower if retrieval works Lower/medium Very low Medium, controlled by retrieval
**Freshness** Must reconstruct prompt with current evidence Requires summary invalidation External corpus can update independently Same Excellent with explicit update semantics Hard; staleness must be actively managed
**Latency** Model-processing cost rises with input length Lower model input, added summarization cost Retrieval + generation Additional reranking step Usually low lookup overhead Retrieval/consolidation dependent
**Token cost** Often highest Lower at inference Bounded by retrieved set Bounded but reranker cost added Minimal representation overhead Varies substantially
**Observability** Exact prompt is inspectable Summary transformation must be audited Retrieval candidates/scores inspectable High but multi-stage Very high Depends on system
**Reproducibility** High if prompt/model/version fixed Lower when generative summaries vary Retrieval/index version also matters More moving parts High Often lower due to generative write/update steps
**Update semantics** No persistent update problem inside one prompt Regenerate/invalidate Update source/index Same Explicit Core unresolved problem
**Security exposure** All inserted text enters trust boundary Poison can become concentrated in summary Malicious documents can be retrieved Reranking may help relevance, not instruction safety Strong ACLs possible Persistent poisoning/write attacks become first-class
**Maintenance burden** Prompt assembly Summary lifecycle Corpus/index lifecycle Multiple retrieval components Schema/version migrations Highest: promotion, conflicts, expiry, deletion and provenance
**Best-supported niche** Dense interdependent evidence that reliably fits Loss-tolerant continuity/compression Sparse relevant evidence in large changing corpora High-recall heterogeneous corpora Exact mutable state Cross-session experience/preferences where durable value justifies lifecycle cost
This synthesis is consistent with the long-context evidence, retrieval literature and current memory benchmarks rather than implying one universally optimal column. [13](https://arxiv.org/abs/2404.06654) ## Evaluation map, failure catalogue and contradictions ### Evaluation has moved beyond “did it recall the fact?” Earlier memory evaluation heavily emphasized conversational QA and recall. The frontier in 2026 is shifting toward interrupted tasks, active tool use, prospective intentions, cost/latency, dynamic updates and security.
Benchmark What it primarily measures Important coverage Important omissions/limitations
**LoCoMo** (2024) Long-term conversational memory ~300-turn conversations, QA, event summarization and long-range conversation evidence Primarily conversational/passive; limited action and security testing. [24](https://arxiv.org/abs/2402.17753)
**LongMemEval** (2024) Interactive assistant memory Extraction, multi-session reasoning, temporal reasoning, knowledge updates, abstention; 500 curated questions Mostly answer-oriented rather than action-oriented; histories substantially synthetic. [4](https://arxiv.org/abs/2410.10813)
**RULER** (2024) Effective long-context utilization Retrieval variants, multi-hop tracing, aggregation across controlled lengths Synthetic diagnostic benchmark; not persistent memory lifecycle. [13](https://arxiv.org/abs/2404.06654)
**BABILong** (2024) Long-context reasoning amid distractors Multi-fact reasoning over increasing context Synthetic task family; not personalization or updates. [33](https://arxiv.org/abs/2406.10149)
**LifeBench** (2026 preprint) Rich long-term personal memory Multiple memory-like evidence types including procedural/habit-style information Simulated benchmark; cognitive labels remain functional abstractions. [42](https://arxiv.org/abs/2603.03781)
**IFCMemoryBench** (2026 preprint) Domain/professional structured memory Separates ingestion, retrieval and utilization; difficult domain setting New benchmark; domain coverage still limited. [43](https://arxiv.org/abs/2607.26072)
**Mem2ActBench** (ACL 2026) Memory-to-action Tool choice and parameter grounding; 400 memory-dependent tasks from 2,029 sessions Synthesized interaction construction; finite tool domains. [12](https://aclanthology.org/2026.acl-long.370/)
**PM-Bench** (2026 preprint) Prospective memory Delayed intentions over simulated multi-day operation; best reported method remains far from perfect Simulation; emerging benchmark. [21](https://arxiv.org/abs/2607.12385)
**MemoryArena** (2026 preprint) Memory integrated with agentic action Multi-session interdependent subtasks across web navigation, planning, search and reasoning New; benchmark maturity and wider replication remain pending. [11](https://arxiv.org/abs/2602.16313)
**STATE-Bench** (2026 production-oriented release) Whether experience improves enterprise task execution 450 tasks across support, travel and shopping; task success/efficiency rather than recall alone Engineering benchmark/provider report rather than peer-reviewed evidence. [44](https://opensource.microsoft.com/blog/2026/05/19/introducing-state-bench-a-benchmark-for-ai-agent-memory/)
**MemSecBench** (2026 preprint) Memory poisoning lifecycle Write → Execute → Forget/Repair, 310 cases, 24 system configurations Security environment remains controlled and attack coverage cannot be exhaustive. [7](https://arxiv.org/abs/2607.27080)
**DolphinBench** (Sept. 2026 preprint) Task success + memory cost/latency Three knowledge-work personas with ~500K tokens of messages each; 200 verified tasks/persona; requires accuracy, cost and latency Extremely recent; independent replication not yet mature. [45](https://arxiv.org/abs/2609.24971)
Two recent developments deserve particular weight. MemoryArena reports that agents performing near saturation on established long-context memory benchmarks can perform poorly on interdependent agentic tasks. [11](https://arxiv.org/abs/2602.16313) DolphinBench, released only days before this dossier's snapshot, explicitly argues that conversational QA gives the question itself too much information about what should be remembered and instead measures task completion while requiring cost and latency reporting. [45](https://arxiv.org/abs/2609.24971) Together with Mem2ActBench, these results reinforce a methodological point: > **A memory architecture should be evaluated at the level of the outcome it is supposed to improve, not merely at the level of retrieved text.** Current benchmarks still leave substantial gaps. Explicit, verifiable **deletion and erasure** are rarely primary benchmark targets. Cross-tenant permissions and privacy leakage remain less systematically evaluated than recall. Few benchmarks jointly test changing authoritative organizational sources, adversarial input, interrupted real-world tool execution, and downstream purge of derived memories. Long-lived production drift over months or years remains especially difficult to reproduce experimentally. ### Failure-mode catalogue
Lifecycle area Failure mode Consequence
Capture Overcollection Privacy and noise accumulate before usefulness is established
Capture Missing salient event Nothing downstream can recover information never retained
Capture Adversarial text promoted Prompt injection becomes durable poisoning
Classification Wrong memory type Temporary task fact becomes permanent profile
Classification Wrong tenant/project/user Cross-scope leakage
Validation Hallucinated extraction accepted as fact Model inference becomes pseudo-authoritative
Validation Source role ignored Assistant speculation remembered as user's statement
Storage Duplicate records Repetition distorts retrieval ranking/importance
Storage Contradictory records without supersession Stale and current states compete
Storage Sensitive data retained unnecessarily Increased privacy/security exposure
Indexing Excessive fragmentation Causal/narrative dependencies disappear
Indexing Excessive consolidation Exceptions and provenance disappear
Retrieval Semantic miss Relevant stored evidence never reaches model
Retrieval Lexical miss Identifier/name not recovered by semantic similarity
Retrieval Temporal mismatch Older but semantically similar item outranks current state
Retrieval Poisoned-item dominance Malicious memory becomes preferred candidate
Context assembly Too much retrieved evidence Noise recreates long-context failure
Context assembly Ordering/position effect Correct evidence exists but receives low effective attention
Reading Authority confusion Summary/inference overrides source truth
Reading Temporal confusion Historical fact treated as current
Reading Scope confusion Work preference applied in personal context
Action Parameter grounding failure Correctly recalled value is not used in tool call
Update Append without superseding Multiple “current” values remain active
Update Summary not invalidated Derived stale representation survives source update
Consolidation Lossy abstraction Qualifier, uncertainty or exception disappears
Consolidation Self-reinforcing interpretation Inference becomes evidence for later inference
Forgetting Aggressive recency decay Rare but important continuity is lost
Forgetting No expiry Temporary circumstances become permanent
Deletion Source-only deletion Embedding, summary, graph edge or cache survives
Organizational scope Learned procedure crosses boundary Customer/project behavior contaminates global behavior
Security Poisoned procedure reused One attack affects many future tasks
Prospective memory Intention forgotten before trigger Delayed obligation never executes
Prospective memory Obsolete intention not cancelled Agent performs an action that is no longer desired
The catalogue makes clear why “memory accuracy” is too coarse a metric. ### Where credible approaches disagree **Long context versus retrieval.** Lost in the Middle, RULER and BABILong provide strong evidence that simply inserting more tokens is not equivalent to reliable use. [2](https://aclanthology.org/2024.tacl-1.9/) Yet decomposition research shows the opposite failure: retrieval can destroy dependencies that intact context preserves. [3](https://aclanthology.org/2026.findings-acl.2097/) This is a genuine architectural trade-off, not merely terminology. The key moderator appears to be information dependency/locality. **Aggressive consolidation versus evidence preservation.** TiMem and RecMem show that structured consolidation can improve benchmark efficiency and accuracy. [5](https://aclanthology.org/2026.findings-acl.1091/) Zero-Mem and E-mem emphasize failure from generated rewriting/decontextualization. [41](https://arxiv.org/abs/2607.29377) The conflict is partly objective choice: one line optimizes compact effective recall; the other gives greater weight to context integrity and auditability. **Graph memory versus simpler retrieval.** Graph architectures can expose entity, relation and temporal structure and report gains on benchmarks. [22](https://papers.nips.cc/paper_files/paper/2025/hash/19909c36f51abc4856b4560aff3d36d6-Abstract-Conference.html) But graph construction creates another extraction/transformation pipeline and does not consistently dominate across workloads; matched 2026 comparisons increasingly find workload-dependent rather than universal winners. [46](https://arxiv.org/abs/2608.13883) The disagreement is therefore both architectural and benchmark-dependent. **Model-managed memory versus deterministic state.** MemGPT, A-MEM and related systems give models substantial discretion over memory organization. [37](https://arxiv.org/abs/2310.08560) Update studies suggest that known current-value semantics often benefit from explicit deterministic logic. [28](https://arxiv.org/abs/2606.27472) These need not be mutually exclusive: ambiguity-heavy semantic promotion and exact operational state are different problem classes. **Forgetting as feature versus continuity as objective.** Strategic-forgetting research reports gains from pruning weak memories, but prospective-memory and long-horizon tasks demonstrate cases in which old, rarely used information remains decisive. [9](https://arxiv.org/abs/2607.22562) There is no evidence for a universal age-based decay rule. **Cognitive-memory categories as architecture versus metaphor.** Episodic/semantic/procedural/prospective terminology is useful for distinguishing functional requirements, but human cognitive science itself models substantial interactions among memory systems. [23](https://ueaeprints.uea.ac.uk/id/eprint/72823/) The analogy is useful at the taxonomy level and weak as justification for copying human mechanisms literally. ## Claim-to-source dossier, unresolved questions and research frontier The following table concentrates the most consequential claims. **“Supported” means supported in the stated task/architecture context, not established as a universal theorem.** “Conditional” means important boundary conditions or conflicting results exist. All sources were inspected for this dossier on **2026-10-03**.
Exact claim Evidence type / architecture or task Source date Direct URL / DOI Status Main limitations
**Nominal context-window size does not imply reliable use of all positions within that window.** Peer-reviewed long-context QA/retrieval experiments; Lost in the Middle 2024 `https://doi.org/10.1162/tacl_a_00638` **Supported** [2](https://aclanthology.org/2024.tacl-1.9/) Models predate the 2026 frontier; tasks focus on retrieval/QA rather than every long-context workload.
**Simple needle tests can substantially overstate usable long-context capacity.** RULER benchmark: 17 models, 13 tasks spanning retrieval, tracing and aggregation 2024-04-09 initial arXiv `https://arxiv.org/abs/2404.06654` **Supported** [13](https://arxiv.org/abs/2404.06654) Synthetic diagnostic tasks; “satisfactory” performance threshold is benchmark-defined.
**Persistent conversational memory requires separate indexing, retrieval and reading/use evaluation.** LongMemEval benchmark; 500 questions including temporal/update/abstention tasks 2024-10-14 `https://arxiv.org/abs/2410.10813` **Supported** [4](https://arxiv.org/abs/2410.10813) Mostly QA; interaction histories are partly generated/edited rather than organic long-term deployment logs.
**Correct memory retrieval does not guarantee correct tool/action execution.** Peer-reviewed Mem2ActBench; tool selection and parameter grounding 2026-07 `https://doi.org/10.18653/v1/2026.acl-long.370` **Supported** [12](https://aclanthology.org/2026.acl-long.370/) Synthetic dataset construction and finite tool domains; not all agent classes tested.
**RAG is not universally superior to intact long context; decomposition can harm tasks with strong contextual dependencies.** ACL Findings 2026 long-context/decomposition experiments 2026 ACL Findings paper “Lost in Decomposition” **Supported conditionally** [3](https://aclanthology.org/2026.findings-acl.2097/) Result depends on document/task structure and evaluated routing/decomposition methods.
**Dense retrieval can outperform lexical BM25 substantially in some open-domain QA settings, but this is not a universal corpus-independent result.** Peer-reviewed DPR experiments 2020 `https://doi.org/10.18653/v1/2020.emnlp-main.550` **Supported conditionally** [15](https://aclanthology.org/2020.emnlp-main.550/) Dataset/domain dependent; later hybrid work shows complementary lexical value.
**Sparse+dense hybrid retrieval can improve over either retrieval signal alone in appropriate settings.** Peer-reviewed hybrid/reranking retrieval experiments 2023 ACL Findings 2023 hybrid reranking study **Supported conditionally** [16](https://aclanthology.org/2023.findings-acl.880/) Retrieval result, not full memory-lifecycle evaluation; gains vary by corpus.
**Memory consolidation can materially reduce context/construction cost while preserving or improving benchmark accuracy.** ACL Findings 2026 TiMem and RecMem 2026 TiMem and RecMem ACL Findings records **Supported conditionally** [5](https://aclanthology.org/2026.findings-acl.1091/) Comparator-specific and benchmark-specific; does not establish source fidelity under all conditions.
**Generated consolidation can also lose or distort contextual evidence; preserving original traces remains a credible alternative design.** 2026 architecture preprints Zero-Mem and E-mem 2026 `https://arxiv.org/` records for Zero-Mem and E-mem **Supported as identified risk; comparative superiority unresolved** [41](https://arxiv.org/abs/2607.29377) Very recent preprints; independent replication limited.
**Version/freshness maintenance can fail independently of raw memory capacity.** Supersede 2026 preprint; current-value memory-update experiments 2026 Supersede arXiv record **Supported conditionally** [28](https://arxiv.org/abs/2606.27472) Narrower update environment; numerical results should not be generalized to all architectures.
**Source provenance and derivation should be distinguishable from derived representations.** W3C provenance standard/model 2013 `https://www.w3.org/TR/prov-overview/` **Supported as mature data-management model** [18](https://www.w3.org/TR/prov-overview/) General provenance standard, not an AI-memory benchmark.
**Valid time and system-recording time are distinct dimensions that matter for changing facts.** Temporal/bitemporal database research Seminal pre-LLM work XBiT/bitemporal primary literature **Supported as established database concept; AI application is synthesis** [25](https://doi.org/10.1007/978-3-540-30464-7_60) Direct application to LLM memory is architectural inference rather than benchmark result.
**Persistent memory creates an attack surface in which malicious input can survive sessions and influence later actions.** MemoryGraft, Hidden in Memory, BackdoorAgent, MemSecBench 2025–2026 `https://arxiv.org/abs/2607.27080`; ACL 2026 BackdoorAgent record **Supported** [30](https://arxiv.org/abs/2512.16962) Field is new; attack rates vary dramatically with harness, model, memory backend and threat model.
**Deleting or decaying retrieval priority is not equivalent to erasing personal information.** Technical distinction plus EU statutory example GDPR 2016; current text inspected 2026 `https://eur-lex.europa.eu/eli/reg/2016/679/` **Supported** [6](https://eur-lex.europa.eu/eli/reg/2016/679/) Exact erasure duties are jurisdictional and have legal exceptions; this is not legal advice.
**Agentic memory evaluation can expose failures hidden by conversational recall benchmarks.** MemoryArena, Mem2ActBench and DolphinBench 2026 `https://arxiv.org/abs/2602.16313`; `https://arxiv.org/abs/2609.24971`; DOI above **Supported, rapidly developing** [11](https://arxiv.org/abs/2602.16313) Two of three are very recent preprints; benchmark ecosystems are not yet stable.
**There is no demonstrated universal memory architecture that dominates across conversational, retrieval-heavy and agentic workloads.** Cross-study synthesis; MemoryArena and matched backend comparisons 2026 `https://arxiv.org/abs/2602.16313`; `https://arxiv.org/abs/2608.13883` **Supported as current evidence synthesis, not a theorem** [11](https://arxiv.org/abs/2602.16313) Comparisons are not globally controlled; new models and benchmarks could change the frontier.
**Inspection date for every row: 2026-10-03.** The highest-value unresolved questions now lie less in “how do we make another vector store?” and more in the interfaces between lifecycle stages. **Promotion calibration remains poorly solved.** There is no broadly accepted empirical method for estimating whether an observation should become a durable memory. Most systems combine heuristics and model judgment, yet false-positive promotion can be more harmful than failure to remember because it affects arbitrarily many future interactions. **Authority-aware retrieval remains immature.** Retrieval systems optimize relevance scores much more naturally than source authority, validity and ownership. How best to combine semantic similarity, freshness, provenance, permission and epistemic authority into a single context-selection process remains open. **Memory utilization is still weaker than memory retrieval.** Mem2ActBench and MemoryArena make this gap measurable, but robustly translating memory into correct multi-step action—particularly when memories conflict or are only conditionally applicable—remains unresolved. [12](https://aclanthology.org/2026.acl-long.370/) **Deletion semantics remain under-benchmarked.** Current memory research has increasingly sophisticated write, retrieve and consolidate benchmarks, yet comparatively little standardized evaluation asks whether a system can delete one person's data, remove all dependent representations, preserve unrelated evidence and prove that the deleted material can no longer affect future behavior. **Cross-scope memory needs stronger evaluation.** Multi-user, project, tenant and organizational boundaries are central to deployed systems but less mature experimentally than single-user recall. The dangerous failure is not only leaking text but allowing private or client-specific history to influence a shared summary, learned procedure or global decision policy. **Memory quality under endogenous feedback is poorly understood.** An agent's actions alter its future observations. A mistaken memory can cause an action that generates observations consistent with that mistake, creating self-confirming memory. Existing benchmarks largely avoid the years-long feedback dynamics that production agents could encounter. **Confidence remains conceptually underdefined.** Systems frequently attach model confidence to derived memories, but there is no universal calibration connecting confidence to source trust, freshness or authority. “Highly confident inference” and “low-confidence authenticated source” cannot be safely compared on a single scalar without defining the decision problem. **Forgetting lacks a general objective function.** Recency, frequency, utility and importance are useful heuristics, but prospective-memory tasks show why rarely retrieved records may remain crucial. [21](https://arxiv.org/abs/2607.12385) The core theoretical problem is estimating **future option value** rather than merely past usage. ### Research frontier as of October 2026 Several developments could materially change the architecture landscape. **Effective long-context capability, not nominal token count, is the critical variable.** Context windows continue to expand, and better attention, positional calibration and training may reduce current long-context weaknesses. If models become reliable over genuinely million-token interconnected histories, the balance will shift away from aggressive retrieval fragmentation. Yet current evidence still shows substantial utilization gaps, so this transition has not already occurred merely because large windows are technically supported. [35](https://ai.google.dev/gemini-api/docs/long-context) **Adaptive routing between context and retrieval is likely more consequential than choosing one permanently.** The contradiction between RULER-style long-context limitations and decomposition failures suggests a future architecture in which the system estimates dependency structure: highly interconnected evidence remains contiguous, while sparse independent evidence is retrieved selectively. Lost in Decomposition already points toward routing as an answer to heterogeneous task structure. [3](https://aclanthology.org/2026.findings-acl.2097/) **Memory maintenance is becoming its own research field.** Early systems focused on retrieval from accumulated records. The 2025–2026 frontier increasingly studies supersession, consolidation, temporal graphs, preference updates, pruning and contradiction handling. [5](https://aclanthology.org/2026.findings-acl.1091/) This moves the field closer to databases and event/state management than to pure semantic search. **Agent benchmarks are replacing passive QA as the most demanding test.** MemoryArena, Mem2ActBench and September 2026's DolphinBench emphasize whether history changes later behavior correctly, not merely whether the model can answer “what did I say?” [11](https://arxiv.org/abs/2602.16313) DolphinBench's explicit cost-and-latency requirement also pushes evaluation toward Pareto frontiers rather than a single accuracy score. **Security evaluation is moving from injection success to lifecycle consequence and repair.** MemSecBench's Write–Execute–Forget design is an important shift: the relevant questions are whether malicious state persisted, whether it altered an actual downstream action, and whether selective repair can remove it without destroying legitimate memory. [7](https://arxiv.org/abs/2607.27080) **Original evidence versus generated memory is becoming a central architectural fault line.** One research branch is pushing increasingly sophisticated consolidation, graphs and hierarchical representations; another is preserving immutable/raw traces while treating abstractions as disposable indexes or projections. [5](https://aclanthology.org/2026.findings-acl.1091/) The latter approach resembles event-sourced and provenance-aware information systems and directly addresses the risk that a model-generated interpretation gradually becomes indistinguishable from its source. **Memory evaluation is likely to become multi-objective.** DolphinBench explicitly couples task accuracy with latency and cost. [45](https://arxiv.org/abs/2609.24971) Security benchmarks add exploitability and repair; operational systems additionally care about provenance, deletion, reproducibility and permission integrity. A system with the highest QA recall but prohibitive cost, untraceable transformations or unsafe cross-session persistence cannot reasonably be called the “best memory system.” The resulting design-space picture is therefore not a ladder from “no memory” to “more memory.” It is a set of differentiated information mechanisms: **context** determines what the model can see now;
**retrieval** determines what external evidence is selected;
**structured state** represents exact mutable variables;
**persistent memory** carries selected information across time;
**provenance** determines where that information came from;
**authority/version semantics** determine what should currently be believed;
**consolidation** trades detail for efficiency;
**forgetting** controls continued eligibility and retention;
**deletion** removes information rather than merely ignoring it; and
**evaluation** must determine whether the complete chain produces the correct future decision or action. Current evidence does not support collapsing those responsibilities into one universal “memory layer.” It supports treating long-term AI memory as a **governed, temporal, provenance-aware information lifecycle whose final objective is correct future behavior—not maximal retention and not maximal recall**. [4](https://arxiv.org/abs/2410.10813)