The paper introduces CAPTURE, a system designed to help personalized language agents distinguish genuine preference changes from temporary context shifts or malicious memory poisoning. CAPTURE employs a neural differential-equation belief tracker, a multi-timescale memory ledger, uncertainty-triggered clarification, and counterfactual auditing to resolve ambiguity. Experiments on 480 episodes from 96 users show CAPTURE outperforms baseline methods, limiting poisoning success while accepting most real preference updates.
As LLM agents increasingly rely on persistent memory for long-horizon and personalized behavior, they can retain and reuse information across interactions, but this also creates a lasting channel thro...
arXiv:2606. 10062v1 Announce Type: new Abstract: Foundation-model agents are increasingly long-lived systems that remember users across interactions, making memorization an explicit deployment-time function rather than solely a property of model weights.
arXiv:2606. 22030v2 Announce Type: replace Abstract: We investigate when belief-based memory actually improves large language model (LLM) agents.
arXiv:2606. 06054v1 Announce Type: new Abstract: Personal AI agents increasingly rely on long-term memory to provide persistent personalization across sessions.
arXiv:2608. 04095v1 Announce Type: new Abstract: Large language model (LLM) agents are increasingly used as personalized assistants in high-stakes domains such as financial advising, yet it remains unclear whether they can maintain and update an individualized user model over long horizons.
AdaMem introduces adaptive memory policies that allow personalized agents to decide what information to write into long‑term memory based on user preferences for each interaction context. Each policy is updated from periodic feedback and controls subsequent memory writing, aiming to improve relevance and reduce unnecessary memory persistence. In experiments on AdaMem‑Bench, AdaMem raises QA accuracy from 80.0% to 84.35% while cutting persistent memory by 9.27%, though models still struggle to execute policies reliably.
The paper introduces the SAST-IR framework to evaluate large language models’ robustness against persuasion attacks in a memory‑less setting, revealing a flaw called "Refusal Inertia" that masks true vulnerability. Using the CP‑Agent and a custom CounterFact‑Strict dataset, the authors demonstrate that simple, diverse attack strategies achieve a 96% success rate, while complex attacks often trigger defensive compliance. The study highlights severe brittleness in current state‑of‑the‑art models when deprived of conversation history.
arXiv:2607. 05029v1 Announce Type: cross Abstract: Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context.
arXiv:2609.38270v1 Announce Type: cross Abstract: Advancing beyond traditional static scoring models, LLM-powered agentic recommender systems (LLM-ARS) instantiate users and items as autonomous agent...
arXiv:2606. 12703v1 Announce Type: cross Abstract: Retrieval-augmented generation (RAG) agents increasingly run with persistent memory that accumulates across user sessions.
arXiv:2609.09115v1 Announce Type: new Abstract: Long horizon Large Language Model (LLM) agents rely on external memory systems to preserve user preferences and task knowledge across extended interact...
InjecMEM introduces a memory injection attack that can steer the responses of large language model agents toward a desired output using only a single interaction, without needing read or edit access to the memory store. The attack leverages the retrieval‑then‑generate workflow of memory systems by crafting a retriever‑agnostic anchor with high‑recall topical cues and an adversarial command optimized through gradient‑based coordinate search. Experiments across various memory systems and backbone models show that InjecMEM reliably induces topic‑conditioned retrieval and targeted generation, remains effective even when memory drifts, and does not affect non‑target queries.