AgentMem · making AI memory provably trustworthy AgentMem · 让 AI 的记忆可以被证明地可靠

Every time an AI rewrites its memory, something quietly disappears. AI 每改写一次自己的记忆，就有东西悄悄消失。

Agents summarize old conversations, then summarize the summaries — and details quietly vanish. We built the first memory system that certifies what compression preserves, and keeps the original when it can't. 智能体会摘要旧对话，再对摘要做摘要——细节就这样悄悄消失。我们做了第一个能认证压缩会保住什么的记忆系统；认证不了的，保留原文。

108 / 108 held-out tests where the guarantee held — curve fitting managed 37 留出测试全部兑现——曲线拟合只有 37 次
⅓ memory · 83% score truncation to the same size keeps just 31% 截断到同样大小只剩 31% 的分数
0 / 18 settings where “$40 if 15 min late” survives — under any model “迟到 15 分钟则 $40”能幸存的设置——任何模型都救不了
It refuses它会拒绝 overriding the refusal cost 10–15 accuracy points 无视拒绝强行压缩，损失 10–15 分
Chapter 1 · The problem第一章 · 问题

Retell a story enough times, and the details die. 一个故事转述的次数多了，细节就死了。

Since Generative Agents Park et al. 2023 and MemGPT Packer et al. 2023, agent memory works the same way: periodically rewrite old conversations into shorter notes — and next month, rewrite the notes again. Here's what that does to one memory: 从 Generative Agents Park et al. 2023 和 MemGPT Packer et al. 2023 开始，智能体记忆都是同一套做法：定期把旧对话改写成更短的笔记——下个月，再把笔记改写一遍。看看这对一段记忆意味着什么：

The original memory原始记忆

“Meet Sarah on Tuesday at 3 pm about invoice #A-1172 — refund $40 if we're more than 15 minutes late. Talk to the manager first, then the barista.” “周二下午 3 点见Sarah，谈发票 #A-1172——如果我们迟到超过 15 分钟，退款 $40。先找经理，再找咖啡师。”

Every colored piece is a different kind of fact: a name, a date, an ID, a number, a number-with-condition, an order of steps.每种颜色是一类不同的事实：名字、日期、编号、数字、带条件的数字、做事的先后顺序。

After three rewrites三次改写之后

“Sarah discussed an invoice refund.” “Sarah 谈过一笔发票退款。”

when? gone什么时候？没了 $40? gone$40？没了 the 15-minute condition? gone15 分钟的条件？没了 who to ask first? gone先找谁？没了

Six rounds of rewriting, as we measured it: most damage happens in the first rewrite, then erosion continues. The warm-colored facts — the two types from Sarah's memory above — die first. 实测的六轮改写：大部分损失发生在第一轮，之后继续侵蚀。暖色的事实——正是上面 Sarah 记忆里的那两类——最先消亡。

No existing memory system promises to preserve any particular kind of fact Min et al. 2023 — if the 15-minute condition vanishes, nothing notices. That's the gap this project fills. 现有的记忆系统没有一个承诺保住任何一类具体的事实 Min et al. 2023——“15 分钟”那个条件消失了，也没有任何信号。这就是这个项目要补上的空白。

Chapter 2 · Why not fit a model第二章 · 为何不建模

Fitting the loss curve certifies the wrong things. 拟合损失曲线，会认证错误的东西。

Our first version fit a model to the loss curve and checked where it settles Tacheny 2025 — but real curves crash in round 1, and the fit averages the crash away: 我们的第一版给损失曲线拟合模型、看它停在哪里 Tacheny 2025——但真实的曲线第一轮就崩，而拟合恰好把崩塌平均掉了：

fitted model拟合模型
37 / 108
worst round最差轮
108 / 108
held-out tests where each approach's guarantee actually held各方法的保证在留出测试中实际兑现的次数
Chapter 3 · The certificates第三章 · 证书

Measure the worst case on held-out data — then guarantee it. 在留出数据上实测最坏情形——然后为它提供保证。

Run each compression on sample memories, record the worst round, and classic statistics Vovk et al. 2005Clopper & Pearson 1934 turns the measurements into two guarantees: 把每种压缩在样本记忆上跑一遍、记下最差的一轮，经典统计 Vovk et al. 2005Clopper & Pearson 1934 就能把测量值变成两条保证：

① How much can a new memory lose?① 一段新记忆最多会丢多少？

Sort 20 measured losses; the second-largest is the bound. New memories stay under it ≥ 90% of the time — by symmetry alone. 20 个实测损失排序，第二大的就是上界。新记忆 ≥ 90% 不会超过它——仅凭对称性。

Promised 90% — delivered 98% on unseen data. 承诺 90%——在未见数据上实测 98%。

② How often will a threshold be exceeded?② 阈值会以多高的频率被超过？

Count the runs that broke the threshold → a certified cap on future violations. Under the allowance → certified; over → not deployed. 数出超限的次数 → 换算成未来超限率的认证上限。低于允许值 → 认证；高于 → 不部署。

Stress-tested on 200 fresh memories: 90% target, 96.8% delivered. 200 段新记忆压力测试：目标 90%，实测 96.8%。

Fine print: certificates cover what was measured — six rounds, this data, this scorer. 附注：证书只覆盖被测过的范围——六轮、这批数据、这套打分方式。

Chapter 4 · Which facts survive第四章 · 哪些事实幸存

18 compression settings, 6 fact types: the certification map. 18 种压缩设置 × 6 类事实：一张认证地图。

With the certificates in hand, we mapped the whole landscape: 18 compression settings, from generous 100-word summaries down to brutal 15-word ones. Green means certified. Two rows never turn green, under any setting — that's the paper's central finding. 有了证书，我们把整个版图测了一遍：18 种压缩设置，从宽裕的 100 词摘要到严苛的 15 词摘要。绿色表示认证通过。有两行在任何设置下都不会变绿——这是论文最核心的发现。

certified认证通过 not certifiable无法认证 re-certified under the order-aware scorer在顺序感知打分器下重新认证

Each row's green count is the paper's exact number; which cells inside a row light up is illustrative. Columns: strict / plain / ultrashort prompts × word budgets 100 → 15. 每行绿格总数是论文的精确数字；行内点亮哪些格为示意。列：strict / plain / ultrashort 提示 × 100 → 15 词预算。

Quantity + unit数字+单位

1.00 → 0.74

“$40 if 15 minutes late” fails under every model and every compression style — and QA on these facts drops 26 points. “迟到 15 分钟则 $40”在所有模型、所有压缩风格下都失败——这类事实的问答准确率掉 26 分。

Step order先后顺序

0/18 → 6/18

Order often survives as a list (“order: manager, barista”); a scorer that can read lists re-certifies 6 settings. Quantity+unit stays at zero — that failure is real. 顺序常以列表形式存活（“顺序：经理、咖啡师”）；换一个看得懂列表的打分器，6 个设置重新通过。而数字+单位仍是零——那个失败是真的。

Chapter 5 · The selector第五章 · 选择器

Route each fact type to the cheapest certified method — or don't compress at all. 把每类事实路由到最便宜的已认证方法——否则干脆不压缩。

The selector reads that map and gives each fact type the cheapest certified method; a type with nothing certified stays raw. And if even one type needs raw, the full original is stored anyway — so the honest answer becomes: don't compress at all. Refusal is a result, not an error. 选择器读取这张地图，给每类事实分配最便宜的已认证方法；什么都没通过认证的类型就保留原文。而只要有一类需要原文，完整原文横竖都得存——这时诚实的答案就是：干脆不压缩。拒绝是一种结果，不是错误。

The counts are real calibration results — “5/61” means 5 of 61 test memories crossed the threshold. The one compressor that certifies broadly is an idempotent fact-list: it rewrites to the same output every time, so rounds 2–6 change nothing. 计数都是真实的校准结果——“5/61”表示 61 段测试记忆中有 5 段超限。唯一能广泛通过认证的压缩器是幂等的事实列表：它每次都重写出相同的输出，所以第 2–6 轮什么都不会变。

Chapter 6 · Existing systems第六章 · 现有系统

Everyone compresses. Nobody guarantees. 人人都在压缩，没有人提供保证。

We ran the popular memory systems — official code wherever available — through the same certification pipeline as our own. The animations show how each one works; the stamps are what we measured. 我们把主流的记忆系统——凡有官方代码都用官方代码——放进了和我们自己相同的认证流程。动画展示每个系统怎么运作；印章是我们实测到的结论。

LLMLingua-2

shrinks text by deleting words靠删词缩短文本 · Pan et al. 2024

Excellent one-shot — but the ratio compounds under repetition, and every fact type fails our tests. 单次使用很出色——但比例在反复压缩下会连乘，我们测试中每类事实都失败。

6,000 → ~150 characters in 3 passes字符，只需三遍Not certifiable无法认证

Mem0

files tidy notes into a notebook把要点归档进一个笔记本 · Chhikara et al. 2025

Cheap and stable once stored — but extraction silently drops facts, and benchmark averages hide the loss. 入库后便宜又稳定——但抽取会静默丢失事实，而基准平均分把损失藏了起来。

dates damaged in日期受损 26/28Uncertified — every type全类型未认证

A-MEM

keeps every note word-for-word每条笔记逐字保留 · Xu et al. 2025

Stores everything word-for-word: nothing lost, nothing saved. 逐字保存一切：什么都不丢，也什么都省不下。

keeps保留 100% · saves节省 0%

Per-segment summary逐段摘要

the 75-word convention in benchmark studies基准研究里常用的 75 词惯例

Maintenance re-summarizes the summaries: memory shrinks itself, accuracy decays. Safe once ≠ safe repeated. 维护会对摘要再做摘要：记忆自我收缩，准确率衰减。一次安全 ≠ 反复安全。

score分数 0.431 → 0.363Decays under recursion递归下持续衰减

Ours — certified selective consolidation我们——已认证的选择性巩固

calibrate → certify → select, or refuse校准 → 认证 → 选择，或拒绝

Certified types compress, the rest stays raw — and the compressor rewrites to the same output every time, so six rounds of maintenance change nothing. 已认证的类型压缩，其余保留原文——压缩器每次都重写出相同输出，六轮维护什么都不会变。

score分数 0.657 → 0.657 · flat by design设计使然的纹丝不动Certified — or refuses已认证——否则拒绝
Chapter 7 · Results第七章 · 结果

One-third the memory, no significant accuracy loss — and a refusal that pays for itself. 三分之一的存储、无显著精度损失——外加一个物有所值的拒绝机制。

We ran the full system on two public long-term-memory benchmarks. On LongMemEval Wu et al. 2024 it certified compression and deployed it. On LoCoMo Maharana et al. 2024 it refused — and the refusal turned out to be right. 我们把完整系统跑在两个公开的长期记忆基准上。在 LongMemEval Wu et al. 2024 上它认证并部署了压缩；在 LoCoMo Maharana et al. 2024 上它拒绝了——事后证明拒绝是对的。

LongMemEval — accuracy · served memory size (dark chip)LongMemEval——准确率 · 服务的记忆大小（深色块）

The gap to full context is mostly the 6K window (−10.8 pts), not our compression (−2.1, noise); a certified 12K window reaches 0.729. 与完整上下文的差距主要来自 6K 窗口（−10.8 分），不是我们的压缩（−2.1，噪声内）；换认证的 12K 窗口可达 0.729。

The recursion stress test递归压力测试

Each policy re-consolidates its own memory for six rounds before answering — the exact regime the certificates were calibrated in. The certified fact-list is exactly flat; every uncertified policy decays. 每个策略在作答前对自己的记忆连续再巩固六轮——正是证书校准时所处的机制。已认证的事实列表精确持平；每一个未认证的策略都在衰减。

certified fact-list已认证事实列表 full selector完整选择器 Mem0-style extractionMem0 式抽取 per-conversation summary逐段摘要

The refusal is worth measurable points拒绝的价值可以量化

Refusing cost about 1 point. Overriding the refusal — deploying the rejected configuration anyway — cost this much: 拒绝的代价约 1 分。而无视拒绝、强行部署被拒配置的代价是：

with a cheaper compressor换更便宜的压缩模型
refusal (keep raw)拒绝（保留原文）
0.516
override → compress强行压缩
0.411−10.5
with a stronger compressor换更强的压缩模型
refusal (keep raw)拒绝（保留原文）
0.732
override → compress强行压缩
0.585−14.7

Also: on half-million-character histories, certified compression stacks on top-k retrieval with no detectable loss. 另外：在五十万字符量级的历史上，已认证压缩可直接叠加在 top-k 检索之上，准确率无可检测损失。

When does per-type routing pay?按类型路由什么时候有收益？

Usually all types pick the same method — the value is certification and refusal. But when facts genuinely differ (summarizable details vs verbatim quotes), routing pays: 通常所有类型会选同一种方法——价值在认证与拒绝。但当事实真的需要不同处理时（可摘要的细节 vs 必须逐字的引文），路由就有收益：

52%mixed assignment混合分配
90%best single method最优单一方法
References参考文献

Selected references精选参考文献

Everything cited inline above; the paper's full bibliography is longer.上文内嵌引用的文献都在这里；论文的完整文献列表更长。

[1]Vovk, Gammerman & Shafer (2005). Algorithmic Learning in a Random World. Springer.
[2]Clopper & Pearson (1934). The Use of Confidence or Fiducial Limits Illustrated in the Case of the Binomial. Biometrika.
[3]Lei, G'Sell, Rinaldo, Tibshirani & Wasserman (2018). Distribution-Free Predictive Inference for Regression. JASA.
[4]Angelopoulos, Bates, Candès, Jordan & Lei (2021). Learn then Test: Calibrating Predictive Algorithms to Achieve Risk Control. arXiv:2110.01052.
[5]Bates, Angelopoulos, Lei, Malik & Jordan (2021). Distribution-Free, Risk-Controlling Prediction Sets. JACM.
[6]Min et al. (2023). FActScore: Fine-grained Atomic Evaluation of Factual Precision. EMNLP.
[7]Park, O'Brien, Cai, Morris, Liang & Bernstein (2023). Generative Agents: Interactive Simulacra of Human Behavior. UIST.
[8]Packer et al. (2023). MemGPT: Towards LLMs as Operating Systems. arXiv:2310.08560.
[9]Wu, Wang, Yu, Zhang, Chang & Yu (2024). LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory. arXiv:2410.10813.
[10]Maharana et al. (2024). Evaluating Very Long-Term Conversational Memory of LLM Agents. ACL.
[11]Chhikara, Khant, Aryan, Singh & Yadav (2025). Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory. arXiv:2504.19413.
[12]Pan et al. (2024). LLMLingua-2: Data Distillation for Efficient and Faithful Task-Agnostic Prompt Compression. ACL Findings.
[13]Xu, Liang, Mei, Gao, Tan & Zhang (2025). A-MEM: Agentic Memory for LLM Agents. arXiv:2502.12110.
[14]Tacheny (2025). Geometric Dynamics of Agentic Loops in Large Language Models. arXiv preprint.
[15]Angelopoulos, Bates, Fisch, Lei & Schuster (2024). Conformal Risk Control. ICLR.
[16]Ramdas, Grünwald, Vovk & Shafer (2023). Game-Theoretic Statistics and Safe Anytime-Valid Inference. Statistical Science.