When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary
On the map: LLM agents and tool use → Agent memory systems
Abstract (arXiv)
Persistent memory allows (self-evolving) LLM agents to adapt across tasks by consolidating heterogeneous interaction histories into reusable facts, preferences, observations, and rules. Yet consolidation also imposes an implicit authorization boundary: it determines whether stored information may later be consumed as a user fact, an attested observation, or a standing instruction. We identify authority collapse, in which consolidation preserves a claim while erasing the source constraints governing its authorized use, causing the stored memory to imply greater authority than its source permits. We introduce AuthMem-Bench, a controlled paired benchmark that holds the focal claim and downstream task fixed while varying only source authority. It evaluates write-time collapse, downstream authorization errors, and automatic authority preservation. Across seven consolidators based on widely used agent-memory systems and seven LLM backbones, we observe authority collapse in 48 of 49 evaluated configurations. In a controlled action-grounded evaluation, collapsed memories without authority metadata yield a mean unauthorized-action rate of 50.3%. In an end-to-end evaluation, automatically predicted and persisted authority labels reduce the observed unauthorized-action rate from 16.9% to 0.0%, while benign task success remains essentially unchanged. These findings show that memory-driven adaptation must preserve not only what was learned, but also the authority under which it may be reused.
Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Agent memory systems, one of 16 directions in LLM agents and tool use. Builds on 22 of its 33 references that are in the map. First posted on arXiv 3 Aug 2026.
Builds on
22 of 33 references.
Closest ancestors · 5
Same direction, newest first
- 2026Mitigating Provenance-Role Collapse in Long-Term Agents via Typed Memory Representation25 May
- 2025ReasoningBank: Scaling Agent Self-Evolving with Reasoning Memory29 Sep
- 2025Evaluating Memory in LLM Agents via Incremental Multi-Turn Interactions7 Jul
- 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory28 Apr
- 2025A-MEM: Agentic Memory for LLM Agents17 Feb
Other references · 17
- 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2026DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligencecited by 877
- 2023ExpeL: LLM Agents Are Experiential Learnerscited by 814
- 2024LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memorycited by 656
- 2025τ2-Bench: Evaluating Conversational Agents in a Dual-Control Environmentcited by 558
- 2023MemoryBank: Enhancing Large Language Models with Long-Term Memorycited by 539
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 476
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402
- 2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 127
- 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memorycited by 61
5 more
- 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injectionscited by 44
- 2024Permissive Information-Flow Analysis for Large Language Modelscited by 22
- 2026Hidden in Memory: Sleeper Memory Poisoning in LLM Agentscited by 22
- 2026MemMorph: Tool Hijacking in LLM Agents via Memory Poisoningcited by 8
- 2026Context-to-Execution Integrity for LLM Agentscited by 7
Built on by
Citing papers per year: 2026: 6.
6 papers.
- 2026When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memorycited by 3
- 2026Agent Memory Is a Surface for Endogenous Authorization Launderingcited by 3
- 2026The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agentscited by 1
- 2026Whose record is this? Diagnosing and authorizing record use in personalized multimodal modelscited by 0
- 2026Audience-Bound Persistent Memory: Authorization Across the Memory Lifecyclecited by 0
- 2026Workerville: Towards an Organizational Behavior Account of Agent Safetycited by 0
- 2026Workerville: Towards an Organizational Behavior Account of Agent Safety8 Oct 2026
- 2026Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle28 Sep 2026
- 2026Whose record is this? Diagnosing and authorizing record use in personalized multimodal models4 Sep 2026
- 2026The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents1 Sep 2026
- 2026Agent Memory Is a Surface for Endogenous Authorization Laundering1 Sep 2026
- 2026When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory26 Aug 2026
Similar, not cited
Close in wording, no citation either way
- 2026Remember, Verify, or Ask? Cross-Family Evaluation of Memory Commitment in LLM Agents
- 2026GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents
- 2026When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents
- 2026MemAudit: Auditing Long-Term Agent Memory via Hidden User-State Recovery
- 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management
- 2026Governed Collaborative Memory as Artificial Selection in LLM-Based Multi-Agent Systems
- 2026Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
- 2026Controllable Memory Usage: Balancing Anchoring and Innovation in Long-Term Human-Agent Interaction