The Evidence Layer for Scientific AI

 Quick Explanation Copied

 Long Explanation

Recommended design

1. Working memory: current observations, plans, tool outputs, and unresolved hypotheses; aggressively expire it after the task.
2. Episodic memory: timestamped interaction and execution events, retained for audit and recovery.
3. Semantic memory: distilled facts, user preferences, and reusable lessons, each carrying source, timestamp, confidence, scope, and expiry.
4. Institutional memory: explicit, versioned policies and procedures; never silently overwrite it with conversation text.

This separation directly matches a common systems pattern: keep short-lived dialogue state separate from durable knowledge, because mixing them increases the risk of stale context being treated as long-term truth and creates cross-session contamination. In the absence of a single universally accepted memory taxonomy for agents, I’d treat this as a design prior that you validate empirically (see the benchmark/preregistration section below).

Control loop (with decision rules)

Write: store raw events selectively, with provenance and access policy. I use an explicit write gate so the system does not accumulate low-trust or redundant memories.

Retrieve: rank by task relevance, recency, confidence, and authorization—not similarity alone. I also enforce a trust gate so untrusted memories are not allowed to directly drive high-stakes actions.

Reflect: periodically consolidate repeated, corroborated events into semantic records, but only when the consolidated form can be traced back to evidence.

Forget: expire stale, contradicted, sensitive, or low-value entries, and actively handle memory mutation (updates that invalidate earlier facts). Forgetting-aware evaluation is important because agents often still reuse invalid memories unless explicitly penalized (e.g., via FAMA).

Verify: show the agent the evidence behind consequential memories before acting.

Concrete example policy (still worth benchmarking): write only if (1) the memory item is supported by at least one reliable signal (tool output, user confirmation, or deterministic calculation), (2) it passes privacy gating, and (3) it is either novel enough to justify storage budget or necessary to reconcile future updates. Delete/disable if (1) the item is later contradicted by higher-trust evidence, (2) it is outside the retention horizon, or (3) its provenance becomes invalid. This is exactly the failure mode targeted by forgetting-aware memory evaluation.

On the “decay helps, but isn’t magic” point: in long-term memory evaluation, the key failure mode is often not that decay is absent, but that agents continue to use invalidated memories. For example, Memora (with its Forgetting-Aware Memory Accuracy metric) reports frequent reliance on obsolete/invalidated memories and poor reconciliation with updated memory states, motivating explicit forgetting-aware evaluation rather than assuming any single mechanism (e.g., decay alone) yields correctness.

Memora + FAMA: penalizing obsolete memory use

Benchmarking protocol (what I would preregister)

Goal: estimate which memory policy (stratified vs flat vs decaying) improves task success without increasing contamination or privacy risk, under fixed model + retrieval budget + write/forget rules.

1. Fix the agent interface: same model(s), same tool permissions, same retrieval budget (e.g., top-k, token budget), same formatting constraints (so “context tokens” are controlled), and same writing budget (max memories per turn).
2. Specify memory interventions as independent variables: (A) storage topology (flat vs stratified layers), (B) decay schedule (none/linear/exponential/threshold), (C) consolidation policy (every N steps vs confidence-gated), (D) conflict handling (latest-wins vs evidence-weighted), (E) privacy gating (PII redact vs encrypt vs never store).
3. Use forgetting-aware evaluation: do not only score “memory presence/recall”; penalize reliance on obsolete/invalidated memories. The Memora work introduces Forgetting-Aware Memory Accuracy (FAMA) as an explicit metric for penalizing obsolete memories under long spans and memory mutation. Memora introduces FAMA to penalize obsolete memories
4. Decompose memory quality vs answer quality: score whether the agent actually stored/retrieved the right kind of context. IFCMemoryBench explicitly decomposes ingestion→retrieval→utilization and measures both answer quality and memory quality (with expert-validated LLM judges) in a realistic domain environment (BIM) rather than only open-domain chat.
5. Primary metrics (end-to-end): task success / exact match / judge-based answer correctness.
6. Primary metrics (memory safety): FAMA-like “obsolete-use penalty”, contradiction rate, and recovery latency after memory updates/deletions.
7. Secondary metrics (efficiency & control): retrieval precision@k, proportion of tokens spent on irrelevant/stale memories, latency, and cost per successful task.
8. Ablations (make causal claims safely): run identical tasks with the only change being the memory policy component you’re testing (e.g., keep decay schedule but change stratification topology). Predefine which interactions you will test to avoid p-hacking.

Control variables: corruption, poisoning, and privacy

For any persistent memory, treat write quality and retention safety as security properties, not just performance properties. A 2026 study on memory poisoning attacks on memory-augmented LLM agents evaluates robustness under realistic conditions and introduces defenses that combine (1) input/output moderation using composite trust scoring, and (2) trust-aware memory sanitization using temporal decay plus pattern-based filtering. Memory poisoning + trust-aware sanitization

What to measure in your benchmark (minimum set): (i) the fraction of retrievals that are dominated by low-trust/expired memories, (ii) false-positive moderation/sanitization rate (dropping legitimate memories), (iii) time-to-recovery after memory updates/deletions, and (iv) performance under bounded write budgets (to force trade-offs between “remember more” and “remember safely”).

So in your benchmark, control and report: (i) how many “untrusted” writes are allowed, (ii) how often retrieval touches low-trust or expired items, (iii) the false-positive rate of moderation/sanitization (legitimate entries blocked), and (iv) the time gap between injection and harmful effect.

Confidence: moderate for the stratified architecture as a sensible engineering prior; low-to-moderate for “which policy is best,” because robust conclusions require benchmark designs that penalize obsolete memory use, decompose memory quality from answer quality, and measure poisoning/decay trade-offs.

Quick diagnostic checklist (what to look for in logs)

1. Stale-memory use: did a retrieved item become invalidated earlier, and did the agent still act on it? (Motivation: forgetting-aware penalties like FAMA.)
2. Provenance gaps: can each “stored” fact be traced to tool output, user confirmation, or deterministic computation? (Motivation: write-gating on reliable signals.)
3. Trust calibration errors: are false positives from moderation/sanitization suppressing legitimate memories, or false negatives allowing low-trust items through? (Motivation: trust-threshold calibration in memory poisoning defenses.)
4. Write budget saturation: as the agent approaches its max write budget, does performance degrade due to redundant/low-value writes displacing future important updates?
5. Conflict handling: when two memories disagree, does the system use evidence-weighting / update rules rather than latest-wins blindly?

Bottom line

There is no single “best” memory policy in the abstract; the best approach is the one that survives controlled stress tests (mutation/obsolescence, corruption/poisoning, and privacy constraints) under a fixed retrieval and write budget. As a design prior, use a layered memory (working/episodic/semantic/institutional) with explicit write/retrieve/forget/verify gates, then pick the specific topology/decay/consolidation policy via preregistered benchmarks such as forgetting-aware evaluation (FAMA) and poisoning-robustness evaluation.