Error Reproduction in Agent Memory (Anti-Persistence)

Sources#

• More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents

Summary#

More Memory, Worse Agents (Ruhan Wang, Kishan Panaganti & Dongruo Zhou; Indiana University and Tencent HY; arXiv 2610.27406, 2026-10-19, 31pp, empirical) studies memory-based self-improvement: a frozen-weight agent stores its own executions, retrieves them for later tasks, and adapts only through what memory holds. The design question is whether memory should keep just observed records (trajectories and outcomes) or also the inferred abstractions distilled from them (Reflexion reflections, ExpeL insights, AutoRefine skills, Voyager-style skill libraries).

The paper's argument against storing abstractions has two layers:

1. Propagation is the familiar risk. A wrong stored rule is retrieved and misleads the task that reads it.
2. Reproduction is the new one. The misled task produces a trajectory. That trajectory enters the record store and is later a synthesis input. The next synthesis can then re-derive the same wrong rule without ever seeing the original. Deleting the parent rule does not delete the trajectories it shaped, or the descendants already derived from them.

The remedy, Anti-Persistence, keeps the record store and an outcome log, and keeps the abstraction store empty (S_k = ∅). For each task it decides whether and how to synthesize guidance from retrieved records, uses that guidance once, and throws it away.

Three results carry the page:

• Raw beats distilled, and per-task synthesis beats raw. Averaged over 9 benchmark × backbone settings, held-out success is 59.9% for Anti-Persistence, 53.5% for trajectory memory, 49.0% for abstraction memory and 49.3% for joint memory (both stores). Abstraction and joint memory both lose to raw trajectory memory in 7 of 9 settings.
• The cleanest arm is persist vs discard on the same synthesis. Discarding wins in all 4 settings tested: +28.0 and +12.3 points on Llama-4-Scout, +3.3 and +6.7 on Qwen3-Coder-Next.
• The reproduction mechanism is the weakest part. It is formalized as a one-step probability decomposition and supported by a descriptive descendant-flag association that the paper itself says was not recomputed or verified against event-level logs.

The mechanism#

The paper states the loop as s_parent → e_j → H → s_candidate. A stored abstraction enters the context of task j and shapes its trajectory e_j. That record later lands in the retrieved set H, and synthesis φ(H) produces a new candidate that can carry the same error. Appendix A turns this into three separable quantities for one synthesis call:

• q = Pr(C), the chance that the synthesis input contains a record produced while a flagged abstraction was in context (exposure).
• α = Pr(A | C), the chance that the output is flagged, given that exposure (generation).
• η = Pr(W | A ∩ C), the chance that the flagged output is admitted to persistent memory as the same object (admission).

Proposition 1 is plain conditional probability: Pr(flagged ∩ exposed ∩ admitted) = q·α·η, with no independence assumption. Remark 1 is the operational point. A deletion-only maintenance step that removes a parent leaves its descendants and the trajectory store untouched (S⁺ = S⁻ \ R, D⁺ = D⁻ \ R, M⁺ = M⁻). So pruning a bad rule is not remediation unless the descendants are also traced and pruned. The authors are careful about scope. The decomposition is not a growth factor, it claims no long-run amplification, and it does not say every maintenance policy fails. Rejecting every flagged candidate sets η = 0, and excluding every exposed record sets q = 0.

What Anti-Persistence guarantees, and what it does not. With no abstraction store, W is impossible, so the admission term is zero by construction. Exposure to temporary guidance is not tracked by C at all. A discarded briefing still shapes the trajectory that gets stored, so indirect feedback through records remains possible, and the authors say so in §3, §5, Appendix A.4 and the limitations. The structural guarantee is "no stored abstraction is reused directly". The performance benefit is an empirical finding, not a consequence of the guarantee.

The shape is the benign twin of Agent Self-Poisoning (the CREATE-Path)'s CREATE-path. There an attacker plants one skill, the agent authors descendants by imitating it, and on two of six models the lineage keeps growing after the planted seeds are withdrawn. That paper's ρ = c·q·φ (copy rate × retrievability × survival under eviction) and this paper's q·α·η (exposure × generation × admission) factor the same lineage process. EvoMal's "removed" condition is Remark 1 measured with an adversary. Here no attacker is needed: the agent's own mistaken generalization is the seed.

The design#

What persists. Trajectory memory M_k holds (task, trajectory, outcome) tuples. A separate append-only JSONL outcome log L_k holds (task embedding, mode, cost-adjusted reward, raw success, task type, id, instruction). Neither stores synthesized text.

Four modes per task. none passes retrieved records straight to the agent with no synthesis call. imitation extracts action patterns from successes. strategic distills sub-goal structure from up to B = 5 successes. corrective writes "do NOT do X because Y" rules from up to 5 failures plus one contrasting success. Each synthesis mode costs one extra LLM call (κ = 1), and its output is injected under a mode-specific header and then discarded.

Mode choice is a KNN-UCB contextual bandit. The controller retrieves the B̂ = 10 nearest outcome-log entries (Qwen3-Embedding-8B over instruction + first 500 characters of the initial observation). It weights them by similarity × recency (γ = 0.998), and scores each mode by its weighted cost-adjusted reward r = clip(y − λκ, −1, 1), with λ = 0.05, plus an exploration bonus (c = 0.5). It falls back to a global-best policy when mean neighborhood similarity drops below ρ = 0.7. The first 3 iterations run round-robin, and ε = 0.1 random selection persists afterward. The authors note the UCB form carries no regret guarantee under weighted, nonstationary rewards.

The nearest relative in the vault is Read-Time Memory Curation (JitMem) (JitMem, Salesforce): raw trajectories stored, guidance synthesized per task and discarded. The two differ in how the synthesizer adapts. JitMem trains the curator with GRPO. Anti-Persistence keeps the synthesis prompts fixed and learns only which mode to use. The two papers were written independently and reach the same storage verdict.

Results#

Protocol. ALFWorld (180 train / 134 held-out), WebShop (200 / 100), ScienceWorld (150 / 60). Three open-weight backbones served locally: Llama-4-Scout, Qwen3-Coder-Next and Gemma-4-31B-it. K = 10 iterations of 50 training tasks each, with the held-out set evaluated after each iteration on frozen state, 3 seeds, a 50-step cap. Cost is mean LLM calls per held-out task, synthesis included.

Held-out success at K = 10 (Table 1, %, 3-seed means). The four row means were recomputed from the cells and match the §4.2 prose (59.9 / 53.5 / 49.0 / 49.3, Reflexion 52.9):

Anti-Persistence is best in 7 of 9 cells. Reflexion takes Gemma ALFWorld (98.0 vs 97.3), and joint memory takes Gemma ScienceWorld (56.3 vs 54.1). Appendix F.3's paired comparisons put its mean advantage at +6.4 points over trajectory memory and +10.9 over abstraction memory, positive in 9 of 9 cells. The authors label the t-tests and Wilcoxon tests exploratory, because the nine cells share backbones and benchmarks.

Two things the table shows that the prose underplays.

• Write-time abstraction can be worse than no memory on a weak backbone. ExpeL on Llama-4-Scout ALFWorld scores 7.2 against ReAct's 29.3. Joint memory on Llama ScienceWorld scores 7.2 against 9.4. In Figure 2, joint memory on Llama ScienceWorld collapses at iteration 2, to about 1%, and stays below 8% through iteration 10. The prose's "declined in later rounds" understates how early it happened. Very short trajectories accompany it (about one step or fewer on average), which the paper reads as consistent with premature termination.
• Stored abstractions help less as the backbone gets stronger. On Gemma ALFWorld the four memory configurations sit between 92.7 and 97.3. The persist-vs-discard gap shrinks from +28.0 (Llama ALFWorld) to +3.3 (Qwen ALFWorld). A wrong rule costs the most when the executor is least able to ignore it.

Persist vs discard (Table 2). Same bandit, same synthesis, and the only difference is whether the synthesized guidance is stored for later retrieval:

Persisting on Llama ALFWorld (26.7) ends below the no-memory ReAct baseline (29.3). Only 4 of 9 settings were run. No ScienceWorld or Gemma cells are reported.

Cost (Figure 3, Table 6). Mean calls per held-out task are 9.3 for Anti-Persistence against 9.5 (trajectory), 10.2 (abstraction) and 9.5 (joint). The four means reconcile with Table 6. "Lowest average LLM-call cost" is a 0.2-call margin, and it is lowest in only 1 of 9 cells (Llama ALFWorld, 15.13). Counting Table 6's cells (derived here, not stated in the paper), trajectory memory is cheapest in 4 cells and joint memory in 4. Joint memory's cheapest cells include Llama ScienceWorld at 1.15 calls, where it also scores 7.2% success, so its low cost is early termination. The metric also counts calls, not tokens. Each synthesis call reads up to five full trajectories, so the per-token bill is unmeasured. That is the same executor-side accounting gap noted on Read-Time Memory Curation (JitMem) and Cache-Aware Agent-Loop Cost (TurnCost).

Maintenance does not rescue a stored layer. AutoRefine (utility-scored skills, multi-query MMR retrieval, bottom-20% pruning every two iterations, a contrastive skill evolver) beats plain abstraction memory in 1 of 6 settings, ties in 1 and loses in 4. Anti-Persistence beats it in all 6. AutoRefine also changes retrieval and synthesis, so the authors do not claim the comparison isolates maintenance.

Controlled content and retention checks (Appendix F, aggregates only, no variance).

• AppWorld, 30 tasks, Qwen3-Coder-Next, matched skill pairs built by GPT-5.5: no skills 23.0%, a correct procedural rule 40.0%, the same scope with a wrong rule 20.0%. A useful skill is worth +17 points, and a toxic one costs −3 against no skill. That is a one-shot effect only. It says nothing about descendants.
• WebShop selective retention, Qwen3-Coder-Next: a GPT-5.5 admission filter lifts abstraction memory from 38.7% to 46.0%. Adding the filtered skills to Anti-Persistence as a frozen persistent layer lowers it from 56.0% to 44.0%. A vetted stored layer on top of per-task synthesis hurt. This 56.0% baseline does not match Table 1's 54.0 ± 2.0 for the same setting, and abstraction memory's 38.7 does not match 38.3. The auxiliary runs are evidently separate runs, and the paper does not reconcile them.

Ablations (Qwen3-Coder-Next, ALFWorld and WebShop only). The bandit beats each fixed mode and random selection (96.0 / 54.0). The best fixed mode differs by benchmark: strategic on ALFWorld, imitation on WebShop. Removing the cost penalty (λ = 0) raises synthesis use and lowers success, and heavier penalties lower both. Every one of the four sweeps (γ, λ, B, B̂) finds the default best on both benchmarks, non-monotonically. The sweeps are scored on the held-out set, and only ρ is stated to be tuned on a separate validation set. A clean sweep in which the default wins everywhere is what selecting defaults on that same held-out set would also produce. Mode frequencies (Figure 8) show every setting using all four modes, none included (18–31%).

The evidence for reproduction specifically#

The headline mechanism is supported by one audit (Appendix E.3, Figure 10). Each stored abstraction is labeled "flagged" if held-out episodes that retrieved it succeeded at least 5 points less often than those that did not (n ≥ 3). The audit then asks whether descendants with a flagged parent are flagged more often. In most of the six logged settings they are. The largest gap is +0.55 (Llama ALFWorld, about 0.78 vs 0.22). On Qwen ScienceWorld the two rates are within error bars (about 0.64 vs 0.58).

The paper's own caveats are unusually strong, and they belong with the number:

• The figure "retains the supplied aggregates, which have not been recomputed for this revision or verified against event-level provenance and labeling-eligibility logs". Group counts, labeling coverage and the procedure behind the error bars are not reported.
• The flag is an unadjusted success association. An abstraction retrieved mostly on hard tasks gets flagged without causing anything, and its descendants are retrieved on the same hard tasks.
• Parent and descendant share ancestors and evaluation episodes, so observations are dependent.

Read honestly, the paper establishes "more stored abstraction, worse held-out success" (Tables 1–2) far better than it establishes why. Error reproduction is a plausible mechanism consistent with the association, and it is not isolated by any intervention. The obvious one is missing: plant the AppWorld toxic skill into abstraction memory, plant the matched useful skill in a control run, and track descendant flags over iterations. That is this page's first open question.

Where it sits in the corpus#

• Read-Time Memory Curation (JitMem) — an independent second paper for the same storage verdict, and it runs the arm JitMem did not. JitMem never gave the executor raw retrieved trajectories. Here that arm is trajectory memory, and it lands between the distilled store and per-task synthesis (49.0 < 53.5 < 59.9). Both halves of the curation question now have a measured arm. The storage half, raw vs distilled, favors raw in both papers. The delivery half, raw records vs a per-task briefing, favors the briefing here.
• Knowledge-Centric Self-Improvement — the counterweight. Caltech's protocol keeps a curated knowledge base as the only persistent object and finds it transfers, which is the opposite storage choice. The two are reconcilable through who writes. Caltech's bundles are cross-task forum distillations checked against many attempts. Here, and in ExpeL and AutoRefine, abstractions come from a few of the agent's own runs and are admitted without verification. The authors' closing line, "studying when verification can justify selective retention", names the gap. The F.2 result complicates it, since even a GPT-5.5-vetted frozen layer hurt Anti-Persistence.
• Human-Governed Skill Maintenance — why pruning is not a fix. Remark 1 is the formal reason a deletion budget does not undo a bad skill, because its descendants and the trajectories it shaped stay. It also gives a reason for Shen & Hruschka's observation that human maintainers almost never deprecate (1 of 254 edits): deprecation without lineage tracing is incomplete anyway.
• Skill Lift — the toxic arm that per-skill lift numbers omit. NVIDIA reports with/without deltas for verified skills. The AppWorld pair here measures the same delta for a wrong version of the same skill: −3 points against no skill, beside +17 for the correct one, on 30 tasks with no variance.
• Non-Malleable Memory Authority (TMA-NM) — provenance as analysis, not authority. The paper records each trajectory's parent set P(m), the persistent abstractions in context when it was generated, purely for the audit. Louck's laundering channel L-a (self-summarization drops the derivation edge) is the adversarial version of the same lineage break. In reproduction, a descendant looks freshly derived because synthesis never records the parent edge.
• Memory and Context Poisoning and Carryover Attacks (CarryoverBench) — scope boundary. Anti-Persistence removes the stored-abstraction channel, not the stored-record channel. An injected tool output kept in a trajectory is still retrieved and restated by per-task synthesis, the same hazard noted for JitMem's raw bank. A standing instruction written into MEMORY.md is a persisted abstraction by this paper's definition, which is the case Anti-Persistence forbids. The paper has no threat model.
• This vault. Compiled wiki pages are persisted abstractions that later compiles read, and the raw store is retained beside them, so the vault is the paper's joint memory configuration with a human-reviewed admission step. The vault's one wrong number, a docling table shift, is the kind of error Remark 1 warns about: correcting the page does not correct pages compiled from it. Supersede-don't-overwrite and re-checking citing pages are the lineage tracing the paper says deletion lacks.

Limitations worth carrying#

• Three text benchmarks (two simulated household/shopping environments and ScienceWorld), open-weight backbones only, K = 10 iterations, 3 seeds. No frontier model is tested, though the strongest backbone already narrows every gap.
• Persist-vs-discard (Table 2) and all ablations cover 2–4 settings, mostly Qwen3-Coder-Next.
• Hyperparameter sweeps are scored on the held-out set (see above).
• The controlled studies in Appendix F report aggregates without seeds, and the F.2 baseline disagrees with Table 1 by 2 points.
• The reproduction audit relies on unrecomputed, uncounted aggregates.
• Cost is measured in calls, not tokens, and the "lowest cost" claim holds on average only.
• No COI. The authors' method is compared against other labs' baselines (Reflexion, ExpeL, AutoRefine), which were re-implemented here. AutoRefine's single-call evolver replaces the original two-call procedure.

Connections#

• Read-Time Memory Curation (JitMem) — the trained-curator twin of the same design, and the page whose raw-to-executor gap this paper fills
• Knowledge-Centric Self-Improvement — the curated-store-as-only-persistent-object design. It wins under cross-task verification, while unverified self-distillation loses here
• Agent Self-Poisoning (the CREATE-Path) — the adversarial lineage process. Its ρ = c·q·φ and removed-seed cascade match this page's q·α·η and Remark 1
• Human-Governed Skill Maintenance — deletion and pruning do not remove descendants, and AutoRefine's utility pruning lost to the unpruned store in 4 of 6 settings
• Skill Lift — the toxic-skill arm beside the useful one, on AppWorld
• Non-Malleable Memory Authority (TMA-NM) — lineage recorded for audit here, and lineage broken by self-summarization there
• Memory and Context Poisoning — removing the abstraction store leaves the record store as the poisoning surface
• Carryover Attacks (CarryoverBench) — a planted MEMORY.md instruction is a persisted abstraction, the object this design refuses to keep
• Cache-Aware Agent-Loop Cost (TurnCost) — call counts understate a design whose extra calls each read five trajectories
• Gemma 4 — one of the three backbones. The four memory configurations sit at 92.7–97.3 on ALFWorld with it
• Stale Instruction File Precedence — a sibling persistence failure on the human-authored side: a stale instruction-file rule is reloaded every session and wins 90.1% of convention choices against contradicting code, recurring in every task until someone edits the file. No feedback loop is needed to keep it alive

Open Questions#

• Is error reproduction causal? Figure 10's descendant-flag gap (up to +0.55) is an unadjusted association from unrecomputed aggregates. The settler is an intervention on this paper's harness: seed abstraction memory with the AppWorld-style toxic skill in one arm and its matched useful version in another, then report descendant flag rates and held-out success per iteration, with counts and seeds.
• Does a verified admission gate make persistence pay where an LLM filter did not? A GPT-5.5-filtered frozen layer cut Anti-Persistence from 56.0% to 44.0% on WebShop. The settler is an HDSO-style paired control/treatment admission test (a candidate enters only if it beats the current store on the same tasks) added to Anti-Persistence, compared with discard-all over K = 10 on ALFWorld and WebShop with ≥ 3 seeds.

Sources#

• More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents — Ruhan Wang, Kishan Panaganti & Dongruo Zhou (Indiana University; Tencent HY), More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents, arXiv 2610.27406, 2026-10-19, 31pp, empirical. Cited: abstract, §1, §3 (formalism, Algorithm 1, the bandit), §4.1–4.4 (Tables 1–2, Figures 2–8), Appendices A (Proposition 1, Remark 1), B (modes, prompts, Table 3 hyperparameters, outcome-log schema), D (splits, backbones, AutoRefine), E (Table 6 cost, Figure 10 provenance audit), F (AppWorld and WebShop retention, Table 7 statistics), G (budget sweeps) and H. Figures 2, 3, 10 and 11 were viewed. Parse notes: PDF-derived (docling 2.126.0 / docling-mlx 0.1.1). Tables 1, 2, 6 and 7 parsed clean. Table 1's four memory-variant means and Reflexion's mean were recomputed from the cells and match §4.2, Table 6's four means match Figure 3's bars, and Table 2's Δ column recomputes. Verify's table-shift flag on Table 3 ("Qwen3-Embedding-8B" in a value column) is a false positive, since it is the embedding-model row's value. Table 3's section-header rows are duplicated across columns, which is harmless. The "lowest in 1 of 9 cells" count is derived here from Table 6. The Figure 2 reading of Llama joint memory's early collapse is from the figure, not the prose