Weighted Memory Tree: Remembering What Matters for Long-Horizon LLM Agents

# Weighted Memory Tree: Remembering What Matters for Long-Horizon LLM Agents
Source: [https://arxiv.org/html/2608.20631](https://arxiv.org/html/2608.20631)
Purvi KathalkarKenneth EatonAffiliation:Georgia Institute of Technology, Georgia Tech Research Institute

###### Abstract

Large language model \(LLM\) agents have demonstrated the ability to solve multi\-step tasks requiring planning, tool use, and external information access, yet growing execution histories increase inference cost and expose reasoning to outdated, irrelevant, or misleading information, potentially degrading reasoning quality\. Existing memory approaches organize or compress execution histories but provide limited mechanisms for deciding which memories remain active\. We introduce theWeighted Memory Tree\(WMT\), a hierarchical memory system that organizes execution into tasks, subtasks, and actions while assigning each memory a dynamic retention score\. Event\-based updates and selection\-based decay revise these scores, allowing WMT to preserve useful information, fold completed trajectories, suppress low\-utility content, and retain access to folded context\. We evaluate WMT on GAIA\-Text using Qwen3\-8B, Gemma 4 E4B, and Llama\-3\.1\-8B, with ablations and memory\-poisoning experiments\. Relative to linear memory, WMT improves accuracy by an average of 9\.97 percentage points while reducing prompt\-token usage by 32\.8%\. Memory\-poisoning experiments show that WMT limits the persistence and propagation of unreliable information\. Our results suggest that effective long\-horizon agent memory depends less on storing more information than on deciding which information should remain active\.

## 1Introduction

Large language model \(LLM\) agents interleave reasoning with actions in external environments, enabling them to retrieve information, invoke tools, and revise plans over multiple steps to solve long\-horizon tasks such as open\-domain research\([28](https://arxiv.org/html/2608.20631#bib.bib1);[21](https://arxiv.org/html/2608.20631#bib.bib3);[24](https://arxiv.org/html/2608.20631#bib.bib11)\)\. Such tasks require agents to preserve evidence, tool outputs, and failed attempts encountered earlier in the execution, making memory central to maintaining the task state required for subsequent reasoning\([30](https://arxiv.org/html/2608.20631#bib.bib5);[10](https://arxiv.org/html/2608.20631#bib.bib6)\)\. As execution histories grow, however, outdated observations, failed attempts, and incidental details accumulate alongside useful information, making it increasingly difficult to determine which memories should continue to influence subsequent decisions\.

A common ReAct\-style design preserves execution state by appending reasoning steps, tool calls, and observations to a linear interaction history\([28](https://arxiv.org/html/2608.20631#bib.bib1)\)\. Although this retains the full trajectory, it treats all memories equally, regardless of their utility, causing prompt lengths to grow while outdated observations, failed reasoning, and valid evidence remain intermixed\. Consequently, relevant information must compete with stale or incidental content, a limitation that is not resolved simply by expanding the context window\. Long\-context studies have shown that language models struggle to utilize relevant information within lengthy inputs, with performance often degrading well below the nominal context\-window limit\([16](https://arxiv.org/html/2608.20631#bib.bib7);[15](https://arxiv.org/html/2608.20631#bib.bib8);[7](https://arxiv.org/html/2608.20631#bib.bib2);[11](https://arxiv.org/html/2608.20631#bib.bib16);[12](https://arxiv.org/html/2608.20631#bib.bib17);[25](https://arxiv.org/html/2608.20631#bib.bib18)\)\. Beyond efficiency and reasoning quality, persistent agent memory also introduces a security concern: poisoned records retrieved from long\-term memory or external knowledge bases can influence subsequent agent behavior\([2](https://arxiv.org/html/2608.20631#bib.bib12);[23](https://arxiv.org/html/2608.20631#bib.bib27);[6](https://arxiv.org/html/2608.20631#bib.bib20);[5](https://arxiv.org/html/2608.20631#bib.bib28)\)\. Long\-horizon agents, therefore, require mechanisms that regulate which stored information enters the working context\.

Recent work addresses parts of this problem through structured or compressed representations of execution history\. The Task Memory Engine \(TME\) organizes execution as a hierarchical task tree and synthesizes prompts from the active task path\([29](https://arxiv.org/html/2608.20631#bib.bib10)\)\. Context\-Folding summarizes completed subtasks before returning to the parent trajectory\([24](https://arxiv.org/html/2608.20631#bib.bib11)\)\. These approaches establish the value of preserving task structure and compressing completed trajectories\. However, they do not explicitly maintain a dynamic estimate of each memory’s continuing utility\. As a result, memories may remain active even after subsequent evidence reduces their relevance or reliability\. This motivates a central question: can long\-horizon reasoning be improved by explicitly estimating memory utility to regulate what enters the agent’s working context?

To address this challenge, we introduce theWeighted Memory Tree\(WMT\), a hierarchical memory architecture that organizes execution histories into task, subtask, and action memories while assigning each memory a dynamic retention score\. These scores prioritize memories for context construction and determine when low\-utility branches are suppressed, while completed branches are folded into compact summaries according to task status, allowing WMT to construct prompts from the most useful context while reducing repeated token processing and limiting the influence of stale or unreliable information\([2](https://arxiv.org/html/2608.20631#bib.bib12)\)\. We evaluate WMT on GAIA\([18](https://arxiv.org/html/2608.20631#bib.bib4)\)and its text\-only subset, GAIA\-Text, using Qwen3\-8B\([27](https://arxiv.org/html/2608.20631#bib.bib13)\), Gemma 4 E4B\([8](https://arxiv.org/html/2608.20631#bib.bib14)\), and Llama\-3\.1\-8B\([9](https://arxiv.org/html/2608.20631#bib.bib15)\)\. We compare the full framework against a linear\-memory baseline and three component ablations: an unweighted tree \(A1\), a no\-memory controller ablation \(A2\), and an ablation without semantic node retrieval \(A3\)\.

Although mitigating memory poisoning is not the primary objective of WMT, we also conduct controlled memory\-poisoning experiments to evaluate whether structured memory management improves robustness relative to conventional linear memory\. Across these experiments, WMT reduces attack success rate, poison retrieval rate, blast radius, and amplification factor while achieving the highest task success rate among all evaluated methods\. Together, these results suggest that effective long\-horizon memory depends not only on preserving or compressing execution history, but on selectively retaining task\-relevant information while suppressing outdated or unreliable content\.

![Refer to caption](https://arxiv.org/html/2608.20631v1/asset/updated_wmt_diagram.png)Figure 1:Status\-driven workflow of WMT\. Agent interactions update node scores and branch priorities; lifecycle transitions and prompt\-selection feedback determine which memories remain active\.
## 2Weighted Memory Tree

We present theWeighted Memory Tree\(WMT\), a memory\-management layer that organizes an agent’s execution history as a persistent hierarchy and constructs a compact working context for each reasoning step\. WMT augments an existing base agent without modifying its parameters or tool interface\.

### 2\.1Problem Definition

Letqqdenote a user query and𝒯\\mathcal\{T\}the tools available to the agent\. At interaction steptt, the agent produces an actionata\_\{t\}, receives an observationoto\_\{t\}, and records an execution outcomeωt\\omega\_\{t\}\. The accumulated interaction history isHt=\(q,\(a1,o1,ω1\),…,\(at−1,ot−1,ωt−1\)\)H\_\{t\}=\(q,\(a\_\{1\},o\_\{1\},\\omega\_\{1\}\),\\ldots,\(a\_\{t\-1\},o\_\{t\-1\},\\omega\_\{t\-1\}\)\)\. A linear\-history agent repeatedly serializes most or all ofHtH\_\{t\}into each subsequent prompt\. WMT instead maintains a persistent memory stateℳt\\mathcal\{M\}\_\{t\}\. Letvt⋆v\_\{t\}^\{\\star\}denote the active task node andBBthe configured context budget\. The Prompt Synthesizer selects a memory set𝒮t\\mathcal\{S\}\_\{t\}and constructs the working context as

𝒮t\\displaystyle\\mathcal\{S\}\_\{t\}=Γsel​\(q,ℳt,vt⋆,B\),\\displaystyle=\\Gamma\_\{\\mathrm\{sel\}\}\\left\(q,\\mathcal\{M\}\_\{t\},v\_\{t\}^\{\\star\};B\\right\),\(1\)Ct\\displaystyle C\_\{t\}=Serialize⁡\(q,𝒯,𝒮t\)\.\\displaystyle=\\operatorname\{Serialize\}\\left\(q,\\mathcal\{T\},\\mathcal\{S\}\_\{t\}\\right\)\.
Here,Γsel\\Gamma\_\{\\mathrm\{sel\}\}selects memories fromℳt\\mathcal\{M\}\_\{t\}, whileSerialize\\operatorname\{Serialize\}formats the selected memories, user query, and tool specifications into the working contextCtC\_\{t\}\. Memories omitted fromCtC\_\{t\}remain persistently stored for future retrieval\.

### 2\.2Overall Workflow

Figure[1](https://arxiv.org/html/2608.20631#S1.F1)summarizes the WMT execution loop\. WMT initializes a root task from the user query and constructs a working context whenever an active task remains\. The base agent performs one interaction step, and WMT records the resulting tasks, actions, observations, and outcomes\. Execution outcomes update node\-level retention scores, which are aggregated into branch\-level priorities\. The Memory Controller folds completed branches, suppresses low\-priority or superseded branches, and reopens resumed branches\. Prompt\-selection decisions provide a second feedback signal: selected memories have their missed\-selection counts reset, whereas eligible but unselected memories receive selection\-based decay\. The loop terminates when the root task is complete and no active task remains\.

### 2\.3Hierarchical Memory Tree

WMT maintains persistent memory asℳt=\(𝒢t,𝒱t,ℰt\)\\mathcal\{M\}\_\{t\}=\(\\mathcal\{G\}\_\{t\},\\mathcal\{V\}\_\{t\},\\mathcal\{E\}\_\{t\}\), where𝒢t\\mathcal\{G\}\_\{t\}contains global memories,𝒱t\\mathcal\{V\}\_\{t\}contains query\-specific memory nodes, andℰt\\mathcal\{E\}\_\{t\}contains parent–child relations between query\-specific nodes\. Global memories store information across task branches or conversations, while the query\-specific tree records execution for the current task\. The one\-shot setting in this work initializes a new tree for each query, but in conversation mode, completed task summaries may be promoted to𝒢t\\mathcal\{G\}\_\{t\}\.

Following the task\-centered representation of TME\([29](https://arxiv.org/html/2608.20631#bib.bib10)\), the root node represents the user query, task nodes represent goals and subtasks, and action nodes record attempted operations, observations, and outcomes\. Each memory nodeviv\_\{i\}stores its content, node type, parent, lifecycle state, retention score, missed\-selection count, and execution metadata\. New subtasks are attached to their parent task, while actions and observations are attached to the current task\.

Letvrootv\_\{\\mathrm\{root\}\}andvt⋆v\_\{t\}^\{\\star\}denote the root and active task nodes, respectively\. The active pathPt=Path⁡\(vroot,vt⋆\)P\_\{t\}=\\operatorname\{Path\}\(v\_\{\\mathrm\{root\}\},v\_\{t\}^\{\\star\}\)contains the task hierarchy from the user query to the current subtask and is always retained during context construction\. For a task nodevv, the branchℬ⁡\(v\)\\mathcal\{B\}\(v\)is the subtree rooted atvv, including its descendant task and action nodes\.

A node has lifecycle statezi∈\{active,completed,folded,obsolete\}z\_\{i\}\\in\\\{\\text\{\{active\}\},\\text\{\{completed\}\},\\text\{\{folded\}\},\\text\{\{obsolete\}\}\\\}\. For a branchb=ℬ⁡\(vb\)b=\\mathcal\{B\}\(v\_\{b\}\), the branch inherits the lifecycle statezvbz\_\{v\_\{b\}\}of its root task nodevbv\_\{b\}\. Lifecycle states determine eligibility for prompt construction\. Suppression marks a root taskobsoletewithout deleting it, while task completion and resumption trigger folding and reopening, respectively\.

A branchb=ℬ⁡\(vb\)b=\\mathcal\{B\}\(v\_\{b\}\)created at steptbt\_\{b\}is initialized withzvb\(tb\)=activez\_\{v\_\{b\}\}^\{\(t\_\{b\}\)\}=\\text\{\{active\}\}; subsequent lifecycle operations update this state\.

### 2\.4Dynamic Retention Scoring

Letiiindex memory nodes andttindex interaction steps\. Each memoryviv\_\{i\}has a retention scoreui\(t\)∈\[0,1\]u\_\{i\}^\{\(t\)\}\\in\[0,1\], which estimates its utility for prioritizing memories in future reasoning\. Each node receives a type\-specific initial score\.

#### Event\-based updates\.

For an action memoryviv\_\{i\}, letωi∈\{success,failure\}\\omega\_\{i\}\\in\\\{\\mathrm\{success\},\\mathrm\{failure\}\\\}denote its recorded execution outcome\. We useu~i\(t\+1\)\\tilde\{u\}\_\{i\}^\{\(t\+1\)\}to denote the intermediate score after the event\-based update and before selection feedback\. When an outcome is recorded or revised, WMT applies

u~i\(t\+1\)=\{usuccess,ωi=success,ufailure,ωi=failure,\\tilde\{u\}\_\{i\}^\{\(t\+1\)\}=\\begin\{cases\}u\_\{\\mathrm\{success\}\},&\\omega\_\{i\}=\\mathrm\{success\},\\\\ u\_\{\\mathrm\{failure\}\},&\\omega\_\{i\}=\\mathrm\{failure\},\\par\\end\{cases\}\(2\)
We setusuccess\>ufailureu\_\{\\mathrm\{success\}\}\>u\_\{\\mathrm\{failure\}\}\. Successful actions receive higher priority as supporting evidence, whereas failures may remain available as warnings against repeating unsuccessful operations\. The core updates are fixed rather than learned\.

#### Selection\-based decay\.

Letϵi,t∈\{0,1\}\\epsilon\_\{i,t\}\\in\\\{0,1\\\}indicate whether memoryviv\_\{i\}enters the candidate pool at steptt, and letsi,t∈\{0,1\}s\_\{i,t\}\\in\\\{0,1\\\}indicate whether it is selected for the working context\. By construction,si,t≤ϵi,ts\_\{i,t\}\\leq\\epsilon\_\{i,t\}\.

For a non\-global memory, letmi\(t\)m\_\{i\}^\{\(t\)\}denote the number of consecutive selection opportunities in whichviv\_\{i\}was eligible but not selected\. Its update is

mi\(t\+1\)=\{0,si,t=1,mi\(t\)\+1,ϵi,t=1​and​si,t=0,mi\(t\),ϵi,t=0\.m\_\{i\}^\{\(t\+1\)\}=\\begin\{cases\}0,&s\_\{i,t\}=1,\\\\ m\_\{i\}^\{\(t\)\}\+1,&\\epsilon\_\{i,t\}=1\\ \\text\{and\}\\ s\_\{i,t\}=0,\\\\ m\_\{i\}^\{\(t\)\},&\\epsilon\_\{i,t\}=0\.\\end\{cases\}\(3\)
For global memories, the implementation resets the missed\-selection count before each decay update, so their effective streak is always one\. Letρ∈\(0,1\]\\rho\\in\(0,1\]denote the ordinary decay rate,ρG∈\(0,1\]\\rho\_\{\\mathrm\{G\}\}\\in\(0,1\]the global\-memory decay rate, andM≥1M\\geq 1the maximum streak exponent\. Define the effective decay multiplier

gi​\(m\)=\{ρG,τi=global,ρmin⁡\{m,M\},τi≠global,g\_\{i\}\(m\)=\\begin\{cases\}\\rho\_\{\\mathrm\{G\}\},&\\tau\_\{i\}=\\text\{\{global\}\},\\\\ \\rho^\{\\min\\\{m,M\\\}\},&\\tau\_\{i\}\\neq\\text\{\{global\}\},\\end\{cases\}\(4\)
whereτi\\tau\_\{i\}denotes the type of nodeviv\_\{i\}\. The implemented selection\-based decay function is therefore

Di​\(u,m\)=clip\[0,1\]⁡\(u​gi​\(m\)\)\.D\_\{i\}\(u,m\)=\\operatorname\{clip\}\_\{\[0,1\]\}\\left\(u\\,g\_\{i\}\(m\)\\right\)\.
We callϵi,t=1\\epsilon\_\{i,t\}=1andsi,t=0s\_\{i,t\}=0a*missed selection*\. The final retention score is

ui\(t\+1\)=\{Di​\(u~i\(t\+1\),mi\(t\+1\)\),missed selection,u~i\(t\+1\),otherwise\.u\_\{i\}^\{\(t\+1\)\}=\\begin\{cases\}D\_\{i\}\\\!\\left\(\\tilde\{u\}\_\{i\}^\{\(t\+1\)\},m\_\{i\}^\{\(t\+1\)\}\\right\),&\\text\{missed selection\},\\\\\[2\.0pt\] \\tilde\{u\}\_\{i\}^\{\(t\+1\)\},&\\text\{otherwise\}\.\\end\{cases\}\(5\)
Thus, an eligible but unselected non\-global memory is multiplied byρmin⁡\{mi\(t\+1\),M\}\\rho^\{\\min\\\{m\_\{i\}^\{\(t\+1\)\},M\\\}\}, whereas an eligible but unselected global memory is multiplied byρG\\rho\_\{\\mathrm\{G\}\}\. Selected memories reset their missed\-selection counts, while memories outside the candidate pool remain unchanged\. Elapsed time alone does not affect retention\.

#### Branch\-level priority\.

For a task branchb=ℬ⁡\(vb\)b=\\mathcal\{B\}\(v\_\{b\}\), let𝒱b\(t\)\\mathcal\{V\}\_\{b\}^\{\(t\)\}denote its memory nodes,Fb\(t\)F\_\{b\}^\{\(t\)\}the proportion of failed action nodes, andOb\(t\)O\_\{b\}^\{\(t\)\}the proportion of nodes already markedobsolete\. The branch priority is

Ub\(t\)=\\displaystyle U\_\{b\}^\{\(t\)\}=\{\}α​maxvi∈𝒱b\(t\)​ui\(t\)\+β\|𝒱b\(t\)\|​∑vi∈𝒱b\(t\)ui\(t\)\\displaystyle\\alpha\\max\_\{v\_\{i\}\\in\\mathcal\{V\}\_\{b\}^\{\(t\)\}\}u\_\{i\}^\{\(t\)\}\+\\frac\{\\beta\}\{\|\\mathcal\{V\}\_\{b\}^\{\(t\)\}\|\}\\sum\_\{v\_\{i\}\\in\\mathcal\{V\}\_\{b\}^\{\(t\)\}\}u\_\{i\}^\{\(t\)\}\(6\)−γ​Fb\(t\)−δ​Ob\(t\),\\displaystyle\-\\gamma F\_\{b\}^\{\(t\)\}\-\\delta O\_\{b\}^\{\(t\)\},
whereα,β,γ,δ≥0\\alpha,\\beta,\\gamma,\\delta\\geq 0are fixed coefficients\. The maximum term preserves a branch containing an individually high\-value memory, while the mean term captures overall branch utility\. The final two terms penalize branches dominated by failed or previously obsolete content\.

Branch priority serves two purposes: it provides the Prompt Synthesizer with a cross\-branch utility signal and provides the Memory Controller with a signal for suppression\. For each branch eligible for lifecycle evaluation, the controller updates the state of its root node according to

zvb\(t\+1\)=\{obsolete,Ub\(t\)<τobs,zvb\(t\),Ub\(t\)≥τobsz\_\{v\_\{b\}\}^\{\(t\+1\)\}=\\begin\{cases\}\\text\{\{obsolete\}\},&U\_\{b\}^\{\(t\)\}<\\tau\_\{\\mathrm\{obs\}\},\\\\ z\_\{v\_\{b\}\}^\{\(t\)\},&U\_\{b\}^\{\(t\)\}\\geq\\tau\_\{\\mathrm\{obs\}\}\\end\{cases\}\(7\)
whereτobs\\tau\_\{\\mathrm\{obs\}\}is the obsolescence threshold\. Markingzvb\(t\+1\)=obsoletez\_\{v\_\{b\}\}^\{\(t\+1\)\}=\\text\{\{obsolete\}\}suppresses the branch and its descendants from ordinary context construction without deleting the stored execution record\. Equation[7](https://arxiv.org/html/2608.20631#S2.E7)defines only the suppression transition\. If the branch priority remains above the threshold, the branch retains its current lifecycle state\.

### 2\.5Memory Controller and Lifecycle Operations

The Memory Controller applies three lifecycle operations\. First, task completion triggers*folding*: a completed branch is represented by a compact summary while its underlying execution trace remains in persistent memory\([24](https://arxiv.org/html/2608.20631#bib.bib11)\)\. The summary retains the task objective, final result, supporting evidence, unresolved issues, and relevant failure warnings\.

Second, a branch whose priority falls belowτobs\\tau\_\{\\mathrm\{obs\}\}is*suppressed*by marking its root task nodeobsolete\. Supersession or invalidation events may trigger the same transition independently of the score\. Obsolete branches remain stored for provenance but are excluded from ordinary context construction\. A failed action is not automatically obsolete; it may remain useful as a warning against repeating an unsuccessful operation\.

Third, when execution returns to a folded task, the controller restores its root task node to theactivestate\. The folded summary becomes immediately available, while underlying memories may re\-enter the candidate pool when additional detail is required\. When the root task is complete and no active task remains, WMT terminates the execution loop\. In conversation mode, the completed root summary may additionally be promoted to global memory\.

### 2\.6Utility\-Aware Prompt Synthesizer

The Prompt Synthesizer constructs the working context defined in Eq\.[1](https://arxiv.org/html/2608.20631#S2.E1)\. Its candidate pool contains the mandatory active pathPtP\_\{t\}, eligible global memories from𝒢t\\mathcal\{G\}\_\{t\}, eligible task and action memories, folded summaries, and failure warnings\. Memories belonging toobsoletebranches are excluded from ordinary selection, whereas folded branches are represented through their summaries\.

The current implementation uses an LLM\-based semantic selector rather than a deterministic top\-kkrule\. Each candidate is represented by its content, memory type, lifecycle state, retention score, and, for query\-specific memories, the priority of its containing branch\. Global memories are evaluated using their node\-level retention scores and semantic relevance because they do not belong to a query\-specific branch\. The selector therefore combines relevance to the active task with the persistent utility signals maintained by WMT\.

The selected memories are serialized after the current task and active hierarchy, followed by folded summaries and relevant failure warnings\. After context construction, selected memories are marked as accessed and have their missed\-selection counts reset\. Eligible but unselected memories receive the decay in Eq\.[5](https://arxiv.org/html/2608.20631#S2.E5), whereas memories outside the candidate pool remain unchanged\. WMT then recomputes affected branch priorities, and the Memory Controller applies any resulting suppression transition before the next context\-construction cycle\.

## 3Experimental Setup

We evaluate WMT along two dimensions: \(1\) task accuracy and prompt\-token usage on GAIA\-Text and the GAIA validation set across three base models \(§[3\.1](https://arxiv.org/html/2608.20631#S3.SS1)\), and \(2\) robustness under the memory\-poisoning protocol \(§[3\.2](https://arxiv.org/html/2608.20631#S3.SS2)\)\. All configurations use the same base\-agent scaffold, tools, task instructions, and interaction budget; only the memory system varies\.

### 3\.1Benchmark Evaluation

#### Benchmarks\.

We evaluate on the public validation split of GAIA\([18](https://arxiv.org/html/2608.20631#bib.bib4)\), containing 165 validation questions across three difficulty levels\. GAIA requires multi\-step reasoning, information retrieval, and tool use\. We report results on two evaluation sets\.

GAIA\-Textconsists of the 127 validation questions without input files, reducing variability from document, image, audio, and spreadsheet processing while retaining multi\-step reasoning and tool use\.GAIAincludes all 165 validation questions and provides a broader end\-to\-end evaluation\. Official reference answers and normalization are used for both settings\.

#### Models and agent configuration\.

We evaluate Qwen3\-8B\([27](https://arxiv.org/html/2608.20631#bib.bib13)\), Gemma 4 E4B\([8](https://arxiv.org/html/2608.20631#bib.bib14)\), and Llama\-3\.1\-8B\([9](https://arxiv.org/html/2608.20631#bib.bib15)\)\. Each model serves as the frozen reasoning model within the same OpenTools\-based agent scaffold\([3](https://arxiv.org/html/2608.20631#bib.bib9)\); only the memory system changes across experiments\. Tools, task instructions and interaction limits are held fixed\.

Each benchmark question initializes a new query\-specific memory tree, with no global memory shared across questions\. Retention coefficients and lifecycle thresholds are fixed for all models\. Additional component\-ablation details are reported in the appendix\.

#### Memory variants\.

We compare four primary memory variants for the benchmark evaluations:

- •No Memoryretains no previous action–observation history between reasoning steps and provides a lower\-bound reference\.
- •Linear Historyappends the complete interaction history to every prompt\.
- •Unweighted Treeuses WMT’s hierarchy without retention scoring or branch prioritization\. Eligible memories are treated uniformly\.
- •Full WMTuses the complete framework described in Section[2](https://arxiv.org/html/2608.20631#S2)\.

For the component study, we additionally evaluateTree \+ Selection,Tree \+ Summary, andTree \+ Selection \+ Summaryto isolate the contributions of semantic retrieval and branch folding independently of WMT’s full retention\-scoring and lifecycle mechanisms\.

#### Evaluation metrics\.

We reporttask accuracyandprompt\-token usage, where token usage is the total number of input tokens processed across all benchmark questions\. Token totals are reported in millions within each model family to account for tokenizer differences\.

Prompt\-token accounting includes all language\-model calls required by the corresponding configuration, including base\-agent reasoning, semantic memory selection, and branch summarization \(when enabled\)\. This ensures that reductions attributed to WMT are not obtained by excluding the cost of its auxiliary memory operations\.

![Refer to caption](https://arxiv.org/html/2608.20631v1/asset/memory_poisoning_example.png)Figure 2:A simplified memory\-poisoning scenario containing ordinary task and action memories together with intentionally poisoned memories shown in red\.

### 3\.2Memory Poisoning Ablation Setup

We evaluate WMT under controlled memory\-poisoning attacks by inserting misleading observations into memory during long\-horizon execution\. The experiment tests whether utility\-aware memory management reduces the persistence and propagation of poisoned information relative to linear memory\.

#### Ablations\.

We compare Linear Memory, three component ablations, and Full WMT\. Unweighted Tree \(A1\) removes retention scoring and branch prioritization; No Memory Controller \(A2\) disables folding, suppression, and reopening; and No Semantic Retrieval \(A3\) retains scoring and lifecycle control but retrieves complete selected branches rather than individual memories\.

#### Metrics\.

We report Attack Success Rate \(ASR\), Poison Retrieval Rate \(PRR\), Infection Persistence \(IP\), Blast Radius \(BR\), Amplification Factor \(AF\), Context Compression Ratio \(CCR\), Task Success Rate \(TSR\), prompt\-token usage, and latency\. Metric definitions are provided in Appendix[A\.1](https://arxiv.org/html/2608.20631#A1.SS1)\.

Table 1:Performance on GAIA\-Text and GAIA across three base models\. Accuracy is the percentage of correctly completed tasks, and token usage is the total number of prompt tokens in millions\. Bold values indicate the highest accuracy and lowest token usage among memory\-based methods for each model and benchmark\.

## 4Results

### 4\.1Benchmark Performance

#### Main comparison\.

Table[1](https://arxiv.org/html/2608.20631#S3.T1)reports accuracy and prompt\-token usage for the no\-memory, linear\-history, unweighted\-tree, and full WMT configurations\. Across both benchmark variants and all three base models, WMT achieves the highest accuracy and the lowest prompt\-token usage among the memory\-based configurations\. The no\-memory condition processes substantially fewer tokens because it does not preserve prior interactions, but its consistently low accuracy indicates that it is a lower\-bound performance reference rather than a directly comparable memory\-efficiency baseline\.

Relative to linear history on GAIA\-Text, the WMT results correspond to absolute improvements of 13\.39, 8\.66, and 7\.87 percentage points with Qwen3\-8B, Gemma 4 E4B, and Llama\-3\.1\-8B, respectively, or 9\.97 percentage points on average\. WMT also reduces prompt\-token usage by 25\.6%, 42\.0%, and 30\.8%, for Qwen3\-8B, Gemma 4 E4B, and Llama\-3\.1\-8B, respectively, with an average reduction of 32\.8% across the three models\.

The same pattern holds on GAIA\. WMT improves accuracy over linear history by 9\.70 percentage points for Qwen3\-8B, 4\.85 points for Gemma 4 E4B, and 15\.76 points for Llama\-3\.1\-8B, with an average improvement of 10\.10 percentage points\. Prompt\-token usage decreases by 25\.8%, 38\.5%, and 32\.5%, respectively, corresponding to an average reduction of 32\.2%\. The consistent improvements on both GAIA\-Text and GAIA indicate that the observed benefit is not restricted to a single model family or to the text\-only evaluation setting\.

The unweighted tree does not provide the same consistent improvement\. On GAIA\-Text, it improves slightly over linear history for Gemma 4 E4B, matches linear history for Llama\-3\.1\-8B, and reduces accuracy for Qwen3\-8B\. A similar pattern appears on GAIA, where the unweighted tree exceeds linear history only for Llama\-3\.1\-8B\. In contrast, WMT outperforms the unweighted tree in all six model–benchmark combinations by 5\.46–18\.11 percentage points while processing fewer prompt tokens in every case\. These results show that hierarchical organization alone is insufficient; the benefits of WMT arise from combining the tree structure with selective context construction, dynamic retention scoring, and lifecycle management\.

#### Component ablations\.

Tables[2](https://arxiv.org/html/2608.20631#A1.T2)and[3](https://arxiv.org/html/2608.20631#A1.T3), shown in the Appendix, further separate the effects of the main WMT components\. Adding semantic selection to an unweighted tree generally improves accuracy, particularly for Qwen3\-8B and Llama\-3\.1\-8B, but increases token usage across all models\. Selection alone therefore does not guarantee a more compact context, because the selector adds model calls while the underlying execution branches remain uncompressed\.

Branch summarization has the opposite primary effect\. It reduces token usage relative to the unweighted tree for every model on both benchmark variants, but its effect on accuracy is mixed\. For example, Tree \+ Summary improves Llama\-3\.1\-8B on GAIA\-Text but reduces Qwen3\-8B accuracy on GAIA\. Combining selection and summarization improves the average accuracy of the partial systems, although it remains less accurate and generally less efficient than the complete WMT\.

Averaging the three models, Full WMT reaches 28\.08% accuracy with 40\.50M prompt tokens on GAIA\-Text, compared with 21\.78% accuracy and 51\.98M tokens for the strongest partial configuration by average accuracy\. On GAIA, Full WMT achieves 28\.49% accuracy with 52\.93M tokens, whereas the strongest partial configuration reaches 21\.41% accuracy and uses 73\.99M tokens\. Thus, Full WMT provides the strongest aggregate accuracy–efficiency trade\-off on both benchmark variants\. The ablations indicate selection and summarization address complementary aspects of context construction, while retention scoring and lifecycle control are needed to prioritize useful memories and limit the influence of low\-utility branches\.

### 4\.2Memory Poisoning Ablation Results

The memory\-poisoning evaluation in Table[4](https://arxiv.org/html/2608.20631#A1.T4), shown in the Appendix, comprises 100 long\-horizon scenarios with 297 subtasks and 1,118 memory entries, including 709 benign and 409 intentionally poisoned memories\.

As expected, theBaseline Linear Memoryperformed worst across nearly every security metric because the entire execution history remained continuously accessible, allowing poisoned memories to persist and repeatedly influence downstream reasoning\. This resulted in the highest attack success rate, blast radius, amplification factor, and complete infection persistence\.

Removing retention scoring and branch prioritization while retaining the hierarchical memory structure\(A1\)substantially improved robustness over linear memory\. Although A1 achieved the same near\-zero infection persistence as the full system, its higher attack success rate, poison retrieval rate, and lower task success rate indicate that treating all retained memories equally allows lower\-value or misleading information to continue affecting reasoning\.

Removing the memory controller\(A2\)highlights the importance of lifecycle management\. Without folding and suppression, poisoned memories remained active or eligible for ordinary context construction, resulting in complete infection persistence despite moderate improvements in attack success rate and task completion\. This suggests that reducing immediate exposure alone is insufficient if malicious memories remain available throughout long\-horizon execution\.

The semantic retrieval ablation\(A3\)demonstrates that lifecycle management without semantic selection is also insufficient\. Although low\-priority memories could be suppressed, retrieving entire task branches increased prompt size and reintroduced irrelevant or poisoned information, leading to higher attack success, blast radius, amplification, and lower task success than the complete system\.

Thefull WMTachieves the strongest overall performance, obtaining the lowest attack success rate \(0\.419\), poison retrieval rate \(0\.097\), blast radius \(0\.315\), and amplification factor \(0\.965\), while matching the lowest infection persistence \(0\.009\)\. It also achieves the highest task success rate \(0\.575\) and requires the fewest average prompt tokens \(131\.963\), indicating that weighted memory selection and semantic retrieval improve both robustness and reasoning efficiency\.

## 5Related Work

#### Memory for LLM agents\.

Agent\-memory systems externalize information from the immediate context and retrieve or summarize it when relevant\. Generative Agents stores natural language records of past experience and retrieves them according to recency, importance, and relevance\([20](https://arxiv.org/html/2608.20631#bib.bib32)\)\. MemoryBank introduces continually updated long\-term conversational memory\([31](https://arxiv.org/html/2608.20631#bib.bib29)\), while MemGPT manages information across different memory tiers to extend effective context beyond the model’s immediate window\([19](https://arxiv.org/html/2608.20631#bib.bib30)\)\. These systems primarily address persistent conversational or experiential memory\. WMT instead focuses on the execution state accumulated within long\-horizon agent tasks and on controlling which portions of that state influence each reasoning step\.

Recent methods have introduced structure into agent working memory\. HiAgent organizes action–observation histories around subgoals and replaces completed subgoal histories with summarized observations\([13](https://arxiv.org/html/2608.20631#bib.bib31)\)\. The Task Memory Engine represents task execution as a hierarchy and constructs prompts from the active task path\([29](https://arxiv.org/html/2608.20631#bib.bib10)\)\. Context\-Folding creates localized subtrajectories and folds their completed execution traces before returning to the parent task\([24](https://arxiv.org/html/2608.20631#bib.bib11)\)\. WMT builds on this task\-structured perspective but introduces an explicit utility state for each memory\. Utility is updated from execution outcomes and memory\-selection behavior, aggregated across branches, and used jointly for prompt construction and lifecycle control\.

#### Long\-context reliability and memory robustness\.

Long\-context studies show that increasing the available context does not ensure reliable use of all included information\. Models can be sensitive to the position of relevant evidence and can exhibit reasoning degradation as input length increases\([16](https://arxiv.org/html/2608.20631#bib.bib7);[15](https://arxiv.org/html/2608.20631#bib.bib8)\)\. These findings motivate selecting task\-relevant state rather than repeatedly presenting complete interaction histories\.

Persistent agent memory also creates an adversarial surface\. AgentPoison shows that malicious records inserted into long\-term memory or knowledge bases can be retrieved and influence subsequent behavior\([2](https://arxiv.org/html/2608.20631#bib.bib12)\)\. Our robustness evaluation studies a related but distinct question: whether memory organization, utility scoring, lifecycle control, and selective context construction reduce the persistence and propagation of unreliable records\. WMT is not a general\-purpose detector of factual errors or adversarial inputs; it regulates the influence of stored information after that information enters the memory system\.

## 6Conclusion

We introduced the Weighted Memory Tree, a memory\-management framework that organizes agent execution into hierarchical task and action memories while explicitly modeling their continuing utility\. By combining dynamic memory scoring, lifecycle management, and utility\-aware prompt construction, WMT separates persistent memory from the context used for immediate reasoning\. Across three base models, WMT improves accuracy over linear history by 9\.97 percentage points on GAIA\-Text and 10\.10 percentage points on GAIA, while reducing prompt\-token usage by 32\.8% and 32\.2%, respectively\. Controlled memory\-poisoning experiments further demonstrate that structured memory management improves robustness, with WMT achieving the lowest attack success rate, poison retrieval rate, blast radius, and amplification factor while attaining the highest task success rate among all evaluated methods\. Component ablations show that hierarchical organization, lifecycle management, and semantic retrieval each contribute to overall performance, with their combination providing the strongest balance of robustness, reasoning quality, and prompt efficiency\. Overall, these findings suggest that effective long\-horizon agent memory depends not only on how information is stored, but on continuously regulating which information remains active to guide future reasoning\.

## 7Limitations

Our evaluation is limited to the GAIA benchmark family\. GAIA\-Text helps isolate text\-based reasoning and memory management, while GAIA provides a broader evaluation involving attached files; nevertheless, both sets share the same task construction and answer format\. Performance may differ on interactive web environments, software\-engineering agents, embodied tasks, or extended conversations\. Moreover, the benchmark evaluation initializes a new task tree for every question and therefore does not evaluate the cross\-conversation global\-memory mode described in Section[2\.3](https://arxiv.org/html/2608.20631#S2.SS3)\.

Our evaluation is also limited to relatively small open\-weight models: Qwen3\-8B, Gemma 4 E4B, and Llama\-3\.1\-8B\. Model scale may affect the benefits of memory management\. Larger models may be better able to ignore stale or irrelevant context, potentially reducing WMT’s relative accuracy gains\. However, their higher prompt\-processing cost may preserve or increase the efficiency benefits of selective context construction\. Because we do not evaluate larger models, the interaction between model scale and WMT remains an open question\.

The current WMT uses hand\-specified initialization values, event\-based score updates, branch\-aggregation coefficients, and obsolescence thresholds\. These parameters are held fixed across the evaluated models but may not be optimal for other agent architectures or task distributions\.

In addition, retention scores estimate operational utility rather than factual correctness\. A useful memory may be suppressed after repeated non\-selection, while misleading information may retain a high score if it contributes to apparently successful actions\. The LLM\-based selector and summary generator may also introduce selection or compression errors and require additional model calls, so WMT’s efficiency advantage may be smaller for short tasks with limited execution histories\.

Future work should evaluate WMT on broader interactive benchmarks and long\-running conversations and examine learned alternatives to its fixed memory\-management rules\. A promising direction is a reinforcement\-learned, budget\-aware memory policy that conditions initial retention scores and subsequent updates on memory content, task state, execution outcomes, and selection history\. Such a policy could jointly adapt branch\-aggregation coefficients and determine when repeated failures justify suppressing or terminating a branch under a remaining interaction budget\. The Prompt Synthesizer could also be trained to select memories that improve downstream task success while penalizing prompt cost and repeated retrieval of unreliable content\. This extension would require reward functions that distinguish genuine task correctness from merely apparent progress\.

## References

- Barnes \(2026\)J\. BarnesOpenSec: measuring incident response agent calibration under adversarial evidence\.External Links:2601\.21083,[Link](https://arxiv.org/abs/2601.21083)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p8.1)\.
- Chenet al\.\(2024\)Z\. Chen, Z\. Xiang, C\. Xiao, D\. Song, and B\. LiAgentPoison: red\-teaming LLM agents via poisoning memory or knowledge bases\.InAdvances in Neural Information Processing Systems,Vol\.37\.External Links:[Document](https://dx.doi.org/10.52202/079017-4136),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/eb113910e9c3f6242541c1652e30dfd6-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1),[§1](https://arxiv.org/html/2608.20631#S1.p4.1),[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px2.p2.1)\.
- Danget al\.\(2026\)H\. Dang, Q\. Dao, and M\. JiangOpen, reliable, and collective: a community\-driven framework for tool\-using AI agents\.External Links:2604\.00137,[Document](https://dx.doi.org/10.48550/arXiv.2604.00137),[Link](https://arxiv.org/abs/2604.00137)Cited by:[§3\.1](https://arxiv.org/html/2608.20631#S3.SS1.SSS0.Px2.p1.1)\.
- Dashet al\.\(2026\)P\. Dash, T\. Ge, A\. Jain, T\. Shah, and Z\. ShangFrom untrusted input to trusted memory: a systematic study of memory poisoning attacks in llm agents\.External Links:2606\.04329,[Link](https://arxiv.org/abs/2606.04329)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p2.1),[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p4.1)\.
- Donget al\.\(2025\)S\. Dong, S\. Xu, P\. He, Y\. Li, J\. Tang, T\. Liu, H\. Liu, and Z\. XiangMemory injection attacks on LLM agents via query\-only interaction\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=QINnsnppv8)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Ferraget al\.\(2026\)M\. A\. Ferrag, N\. Tihanyi, D\. Hamouda, L\. Maglaras, A\. Lakas, and M\. DebbahFrom prompt injections to protocol exploits: threats in llm\-powered ai agents workflows\.ICT Express12\(2\),pp\. 353–383\.External Links:ISSN 2405\-9595,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.icte.2025.12.001),[Link](https://www.sciencedirect.com/science/article/pii/S2405959525001997)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p2.1),[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Fraga \(2024\)N\. FragaChallenging LLMs beyond information retrieval: reasoning degradation with long context windows\.Note:Preprints\.orgPreprint, version 1External Links:[Document](https://dx.doi.org/10.20944/preprints202408.1527.v1),[Link](https://doi.org/10.20944/preprints202408.1527.v1)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Gemma Teamet al\.\(2026\)Gemma Team, S\. El Abd, V\. Aggarwal, R\. Algayres, A\. Andreev,et al\.Gemma 4 technical report\.arXiv preprint arXiv:2607\.02770\.Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p4.1),[§3\.1](https://arxiv.org/html/2608.20631#S3.SS1.SSS0.Px2.p1.1)\.
- Grattafioriet al\.\(2024\)A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.The Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.External Links:2407\.21783,[Document](https://dx.doi.org/10.48550/arXiv.2407.21783),[Link](https://arxiv.org/abs/2407.21783)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p4.1),[§3\.1](https://arxiv.org/html/2608.20631#S3.SS1.SSS0.Px2.p1.1)\.
- Guanet al\.\(2026\)S\. Guan, J\. Wang, J\. Bian, B\. Zhu, J\. Lou, and H\. XiongEvaluating LLM\-based agents for multi\-turn conversations: a survey\.ACM Transactions on Intelligent Systems and Technology17\(4\),pp\. 85:1–85:40\.External Links:[Document](https://dx.doi.org/10.1145/3793671),[Link](https://doi.org/10.1145/3793671)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p1.1)\.
- Heet al\.\(2024\)J\. He, K\. Pan, X\. Dong, Z\. Song, Y\. Liu, Q\. Sun, Y\. Liang, H\. Wang, E\. Zhang, and J\. ZhangNever lost in the middle: mastering long\-context question answering with position\-agnostic decompositional training\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 13628–13642\.External Links:[Link](https://aclanthology.org/2024.acl-long.736/),[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.736)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Hsiehet al\.\(2024\)C\. Hsieh, Y\. Chuang, C\. Li, Z\. Wang, L\. Le, A\. Kumar, J\. Glass, A\. Ratner, C\. Lee, R\. Krishna, and T\. PfisterFound in the middle: calibrating positional attention bias improves long context utilization\.InFindings of the Association for Computational Linguistics: ACL 2024,L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 14982–14995\.External Links:[Link](https://aclanthology.org/2024.findings-acl.890/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.890)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Huet al\.\(2025\)M\. Hu, T\. Chen, Q\. Chen, Y\. Mu, W\. Shao, and P\. LuoHiAgent: hierarchical working memory management for solving long\-horizon agent tasks with large language model\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 32779–32798\.External Links:[Link](https://aclanthology.org/2025.acl-long.1575/),[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1575),ISBN 979\-8\-89176\-251\-0Cited by:[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px1.p2.1)\.
- Lee and Tiwari \(2024\)D\. Lee and M\. TiwariPrompt infection: llm\-to\-llm prompt injection within multi\-agent systems\.External Links:2410\.07283,[Link](https://arxiv.org/abs/2410.07283)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p6.1)\.
- Levyet al\.\(2024\)M\. Levy, A\. Jacoby, and Y\. GoldbergSame task, more tokens: the impact of input length on the reasoning performance of large language models\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 15339–15353\.External Links:[Link](https://aclanthology.org/2024.acl-long.818/),[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.818)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1),[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px2.p1.1)\.
- Liuet al\.\(2024\)N\. F\. Liu, K\. Lin, J\. Hewitt, A\. Paranjape, M\. Bevilacqua, F\. Petroni, and P\. LiangLost in the middle: how language models use long contexts\.Transactions of the Association for Computational Linguistics12,pp\. 157–173\.External Links:[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00638),[Link](https://aclanthology.org/2024.tacl-1.9/)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1),[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px2.p1.1)\.
- Liuet al\.\(2022\)Y\. Liu, Q\. Jia, and K\. ZhuReference\-free summarization evaluation via semantic correlation and compression ratio\.InProceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,M\. Carpuat, M\. de Marneffe, and I\. V\. Meza Ruiz \(Eds\.\),Seattle, United States,pp\. 2109–2115\.External Links:[Link](https://aclanthology.org/2022.naacl-main.153/),[Document](https://dx.doi.org/10.18653/v1/2022.naacl-main.153)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p12.1)\.
- Mialonet al\.\(2024\)G\. Mialon, C\. Fourrier, T\. Wolf, Y\. LeCun, and T\. ScialomGAIA: a benchmark for general AI assistants\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=fibxvahvs3)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p4.1),[§3\.1](https://arxiv.org/html/2608.20631#S3.SS1.SSS0.Px1.p1.1)\.
- Packeret al\.\(2024\)C\. Packer, S\. Wooders, K\. Lin, V\. Fang, S\. G\. Patil, I\. Stoica, and J\. E\. GonzalezMemGPT: towards llms as operating systems\.External Links:2310\.08560,[Link](https://arxiv.org/abs/2310.08560)Cited by:[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px1.p1.1)\.
- Parket al\.\(2023\)J\. S\. Park, J\. C\. O’Brien, C\. J\. Cai, M\. R\. Morris, P\. Liang, and M\. S\. BernsteinGenerative agents: interactive simulacra of human behavior\.External Links:2304\.03442,[Link](https://arxiv.org/abs/2304.03442)Cited by:[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px1.p1.1)\.
- Schicket al\.\(2023\)T\. Schick, J\. Dwivedi\-Yu, R\. Dessi, R\. Raileanu, M\. Lomeli, E\. Hambro, L\. Zettlemoyer, N\. Cancedda, and T\. ScialomToolformer: language models can teach themselves to use tools\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Document](https://dx.doi.org/10.52202/075280-2997),[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/d842425e4bf79ba039352da0f658a906-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p1.1)\.
- Sharmaet al\.\(2025\)G\. Sharma, V\. Kulkarni, M\. King, and K\. HuangTowards unifying quantitative security benchmarking for multi agent systems\.External Links:2507\.21146,[Link](https://arxiv.org/abs/2507.21146)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p10.1),[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p14.1),[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p8.1)\.
- Srivastava and He \(2025\)S\. S\. Srivastava and H\. HeMemoryGraft: persistent compromise of llm agents via poisoned experience retrieval\.External Links:2512\.16962,[Link](https://arxiv.org/abs/2512.16962)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p4.1),[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Sunet al\.\(2026\)W\. Sun, M\. Lu, Z\. Ling, K\. Liu, X\. Yao, Y\. Yang, and J\. ChenScaling long\-horizon agent via context folding\.InProceedings of the 43rd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.306\.External Links:[Link](https://openreview.net/forum?id=lNRgWoGfYg)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p1.1),[§1](https://arxiv.org/html/2608.20631#S1.p3.1),[§2\.5](https://arxiv.org/html/2608.20631#S2.SS5.p1.1),[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px1.p2.1)\.
- Tianet al\.\(2025\)R\. Tian, Y\. Li, Y\. Fu, S\. Deng, Q\. Luo, C\. Qian, S\. Wang, X\. Cong, Z\. Zhang, Y\. Wu, Y\. Lin, H\. Wang, and X\. LiuDistance between relevant information pieces causes bias in long\-context LLMs\.InFindings of the Association for Computational Linguistics: ACL 2025,W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 521–533\.External Links:[Link](https://aclanthology.org/2025.findings-acl.28/),[Document](https://dx.doi.org/10.18653/v1/2025.findings-acl.28),ISBN 979\-8\-89176\-256\-5Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Wanget al\.\(2025\)L\. Wang, T\. Zhu, L\. Qin, L\. Gao, and W\. ZhouBias amplification in rag: poisoning knowledge retrieval to steer llms\.External Links:2506\.11415,[Link](https://arxiv.org/abs/2506.11415)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p10.1)\.
- Yanget al\.\(2025\)A\. Yang, A\. Li, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Gao, C\. Huang, C\. Lv,et al\.Qwen3 Technical Report\.arXiv preprint arXiv:2505\.09388\.External Links:2505\.09388,[Document](https://dx.doi.org/10.48550/arXiv.2505.09388),[Link](https://arxiv.org/abs/2505.09388)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p4.1),[§3\.1](https://arxiv.org/html/2608.20631#S3.SS1.SSS0.Px2.p1.1)\.
- Yaoet al\.\(2023\)S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. R\. Narasimhan, and Y\. CaoReAct: synergizing reasoning and acting in language models\.InThe Eleventh International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=WE_vluYUL-X)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p1.1),[§1](https://arxiv.org/html/2608.20631#S1.p2.1)\.
- Ye \(2025\)Y\. YeTask memory engine \(TME\): enhancing state awareness for multi\-step LLM agent tasks\.External Links:2504\.08525,[Document](https://dx.doi.org/10.48550/arXiv.2504.08525),[Link](https://arxiv.org/abs/2504.08525)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p3.1),[§2\.3](https://arxiv.org/html/2608.20631#S2.SS3.p2.1),[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px1.p2.1)\.
- Zhanget al\.\(2025\)Z\. Zhang, Q\. Dai, X\. Bo, C\. Ma, R\. Li, X\. Chen, J\. Zhu, Z\. Dong, and J\. WenA survey on the memory mechanism of large language model\-based agents\.ACM Transactions on Information Systems43\(6\),pp\. 1–47\.External Links:[Document](https://dx.doi.org/10.1145/3748302),[Link](https://doi.org/10.1145/3748302)Cited by:[§1](https://arxiv.org/html/2608.20631#S1.p1.1)\.
- Zhonget al\.\(2023\)W\. Zhong, L\. Guo, Q\. Gao, H\. Ye, and Y\. WangMemoryBank: enhancing large language models with long\-term memory\.External Links:2305\.10250,[Link](https://arxiv.org/abs/2305.10250)Cited by:[§5](https://arxiv.org/html/2608.20631#S5.SS0.SSS0.Px1.p1.1)\.
- Zhouet al\.\(2026\)Y\. Zhou, X\. Lu, D\. Liu, J\. Yan, and J\. ShaoINFA\-guard: mitigating malicious propagation via infection\-aware safeguarding in llm\-based multi\-agent systems\.External Links:2601\.14667,[Link](https://arxiv.org/abs/2601.14667)Cited by:[§A\.1](https://arxiv.org/html/2608.20631#A1.SS1.p14.1)\.

## Appendix AAppendix

### A\.1Equations for Evaluation Metrics

ASR=CsSc\\textbf\{ASR\}=\\frac\{C\_\{s\}\}\{S\_\{c\}\}\(8\)
whereCsC\_\{s\}is the number of compromised critical reasoning steps andScS\_\{c\}is the total number of critical reasoning steps\. Lower ASR corresponds to greater robustness against memory poisoning[6](https://arxiv.org/html/2608.20631#bib.bib20);[4](https://arxiv.org/html/2608.20631#bib.bib21)\.

PRR=HpHp\+Hc\\textbf\{PRR\}=\\frac\{H\_\{p\}\}\{H\_\{p\}\+H\_\{c\}\}\(9\)
whereHpH\_\{p\}andHcH\_\{c\}are the numbers of poisoned and clean memories selected by the Prompt Synthesizer for inclusion in the working context\. Lower PRR indicates that fewer poisoned memories are selected for prompting[23](https://arxiv.org/html/2608.20631#bib.bib27);[4](https://arxiv.org/html/2608.20631#bib.bib21)\.

IP=PrPi\\textbf\{IP\}=\\frac\{P\_\{r\}\}\{P\_\{i\}\}\(10\)
wherePiP\_\{i\}is the number of injected poisoned memories andPrP\_\{r\}is the number of those memories that remain active or eligible for ordinary context construction after memory management\. Lower IP indicates stronger long\-term resilience\.[14](https://arxiv.org/html/2608.20631#bib.bib24)

BR=TcTp\\textbf\{BR\}=\\frac\{T\_\{c\}\}\{T\_\{p\}\}\(11\)
whereTcT\_\{c\}is the number of prompt construction steps that include contaminated memory andTpT\_\{p\}is the total number of prompt construction steps\. Lower Blast Radius indicates that poisoned memories influence fewer prompts during task execution\.[1](https://arxiv.org/html/2608.20631#bib.bib25);[22](https://arxiv.org/html/2608.20631#bib.bib19)

AF=HpPi\\textbf\{AF\}=\\frac\{H\_\{p\}\}\{P\_\{i\}\}\(12\)
which measures how frequently injected poisoned memories are repeatedly retrieved relative to the number originally inserted\. Lower Amplification Factor indicates that the memory system prevents poisoned memories from repeatedly influencing future reasoning\.[26](https://arxiv.org/html/2608.20631#bib.bib23);[22](https://arxiv.org/html/2608.20631#bib.bib19)

CCR=1Tp​∑i=1TpTsel,iTcand,i\\textbf\{CCR\}=\\frac\{1\}\{T\_\{p\}\}\\sum\_\{i=1\}^\{T\_\{p\}\}\\frac\{T\_\{\\mathrm\{sel\},i\}\}\{T\_\{\\mathrm\{cand\},i\}\}\(13\)
whereTsel,iT\_\{\\mathrm\{sel\},i\}is the number of memory tokens selected for inclusion in the prompt andTcand,iT\_\{\\mathrm\{cand\},i\}is the total number of candidate memory tokens considered at theii\-th prompt construction step\. Lower CCR indicates greater context compression and improved prompt efficiency, although it should be interpreted alongside Task Success Rate to ensure excessive compression does not degrade task performance\.[17](https://arxiv.org/html/2608.20631#bib.bib22)

TSR=1Nt​∑i=1NtSi,Si=\{1,task​i​is successful,0,otherwise\.\\textbf\{TSR\}=\\frac\{1\}\{N\_\{t\}\}\\sum\_\{i=1\}^\{N\_\{t\}\}S\_\{i\},\\quad S\_\{i\}=\\begin\{cases\}1,&\\text\{task \}i\\text\{ is successful\},\\\\ 0,&\\text\{otherwise\}\.\\end\{cases\}\(14\)
whereNtN\_\{t\}is the total number of evaluated tasks andSiS\_\{i\}is the binary success indicator for taskii\. Higher TSR indicates that the agent successfully completes a larger proportion of tasks despite the presence of adversarial memory contamination\.[32](https://arxiv.org/html/2608.20631#bib.bib26);[22](https://arxiv.org/html/2608.20631#bib.bib19)

### A\.2GAIA\-Text and GAIA Component Ablations

#### Shared evaluation configuration\.

The component ablations use the same GAIA questions, base\-agent scaffold, tools, task instructions, and interaction budget as the main benchmark comparison in Section[3\.1](https://arxiv.org/html/2608.20631#S3.SS1)\. We evaluate the public GAIA validation set in two forms: GAIA\-Text contains the 127 questions without attached input files, whereas GAIA contains all 165 validation questions\.

We evaluate Qwen3\-8B, Gemma 4 E4B, and Llama\-3\.1\-8B as frozen reasoning models\. Each question initializes a new query\-specific memory tree, and no global memory is transferred across benchmark questions\. Prompt\-token totals include every language\-model call made by the corresponding configuration, including base\-agent reasoning, semantic memory selection, and branch summarization when those operations are enabled\.

The fixed outcome scores and branch\-priority coefficients used in all experiments are

usuccess\\displaystyle u\_\{\\mathrm\{success\}\}=0\.75,ufailure=0\.30,\\displaystyle=0\.75,\\qquad u\_\{\\mathrm\{failure\}\}=0\.30,\(α,β,γ,δ\)\\displaystyle\(\\alpha,\\beta,\\gamma,\\delta\)=\(0\.60,0\.30,0\.20,0\.20\)\.\\displaystyle=\(0\.60,\\,0\.30,\\,0\.20,\\,0\.20\)\.
The same retention configuration is used for all three models\. Selection\-based decay is applied only to memories that enter the candidate pool but are not selected\. Selecting a memory resets its missed\-selection count to zero\. Branch priorities use fixed penaltiesγ=δ=0\.20\\gamma=\\delta=0\.20for the proportions of failed and obsolete nodes, respectively\. An eligible branch is markedobsoletewhenUb\(t\)<τobsU\_\{b\}^\{\(t\)\}<\\tau\_\{\\mathrm\{obs\}\}, withτobs=0\.10\\tau\_\{\\mathrm\{obs\}\}=0\.10\.

#### Component configurations\.

The main benchmark table compares No Memory, Linear History, Unweighted Tree, and Full WMT\. The additional configurations below isolate semantic memory selection and completed\-branch summarization:

- •Tree Memoryorganizes the interaction history into task, subtask, and action nodes but does not use semantic selection, branch summarization, dynamic retention scoring, or score\-based suppression\.
- •Tree \+ Selectionadds the LLM\-based semantic selector to Tree Memory\. The selector chooses memories according to their relevance to the active task, but no dynamic retention or branch\-priority signal is provided\.
- •Tree \+ Summaryfolds completed branches into compact summaries but does not use semantic selection or dynamic retention scoring\.
- •Tree \+ Selection \+ Summarycombines semantic selection with completed\-branch summarization but omits event\-based score updates, selection\-based decay, branch\-priority aggregation, and score\-based suppression\.
- •Full WMTcombines hierarchical memory, semantic selection, branch summarization, event\-based retention updates, selection\-based decay, branch\-level priorities, suppression, and reopening\.

Tables[2](https://arxiv.org/html/2608.20631#A1.T2)and[3](https://arxiv.org/html/2608.20631#A1.T3)report the complete component results\.

Table 2:Component\-ablation results on GAIA\-Text\. Accuracy is the percentage of correctly completed tasks, and prompt\-token usage is reported in millions\. Bold values indicate the best result for each model and metric among the reported tree\-based configurations\.Table 3:Component\-ablation results on GAIA\. Accuracy is the percentage of correctly completed tasks, and prompt\-token usage is reported in millions\. Bold values indicate the best result for each model and metric among the reported tree\-based configurations\.
#### Model\-specific trends\.

The component ablations reveal different patterns across model families\. Qwen3\-8B obtains its strongest partial\-configuration accuracy from Tree \+ Selection on both GAIA\-Text and GAIA, suggesting that it benefits from preserving fine\-grained evidence and retrieving it selectively\. Gemma 4 E4B performs best among the partial configurations with Tree \+ Selection \+ Summary, while Tree \+ Summary produces its lowest prompt\-token usage\. This pattern suggests that summarization removes redundant execution history for Gemma, while semantic selection remains useful for recovering task\-specific evidence\.

Llama\-3\.1\-8B exhibits a different trend\. On GAIA\-Text, Tree \+ Summary reaches 19\.69% accuracy, exceeding Full WMT at 17\.32%\. On GAIA, however, Tree \+ Selection \+ Summary is the strongest partial configuration, and Full WMT achieves the best overall Llama result at 24\.85%\. One plausible explanation is that summary\-only contexts sufficiently remove noisy intermediate traces for text\-only tasks, whereas the more heterogeneous GAIA tasks benefit from combining compression with targeted, utility\-aware retrieval\. These explanations are post hoc hypotheses rather than direct measurements of model behavior\.

### A\.3Memory\-Poisoning Ablation Details

#### Evaluation corpus\.

The memory\-poisoning evaluation contains 100 long\-horizon scenarios composed of 297 subtasks and 1,118 memory entries\. Of these entries, 709 are benign and 409 are intentionally poisoned\. Poisoned entries introduce misleading observations, fabricated claims, or compromised tool\-derived information into the execution history so that they may influence later retrieval and reasoning\.

The same scenario structures and injected memories are used for each memory configuration\. The evaluation therefore isolates how memory organization, retention scoring, lifecycle management, and semantic retrieval affect the persistence and propagation of poisoned information\.

#### Ablation configurations\.

We compare five memory configurations:

- •Linear Memorystores all task and action history in a single sequential context\. No hierarchy, utility scoring, suppression, or selective retrieval is used\.
- •Unweighted Tree \(A1\)organizes memories into task and action branches but does not use retention scoring or branch prioritization\.
- •No Memory Controller \(A2\)computes retention scores and branch priorities but disables lifecycle operations, including folding, score\-based suppression, and reopening\.
- •No Semantic Retrieval \(A3\)retains the hierarchical tree, retention scores, and Memory Controller, but prompt construction includes the full selected branch rather than semantically selecting individual memories\.
- •Full WMTuses hierarchical memory, dynamic retention scoring, branch\-level priorities, lifecycle control, and semantic prompt construction\.

Attack Success Rate, Poison Retrieval Rate, Infection Persistence, Blast Radius, Amplification Factor, Context Compression Ratio, and Task Success Rate are defined in Appendix[A\.1](https://arxiv.org/html/2608.20631#A1.SS1)\. We additionally report average prompt\-token usage and latency\. The complete results are reported in Table[4](https://arxiv.org/html/2608.20631#A1.T4)\.

Table 4:Memory\-poisoning results for WMT and its ablations\. Arrows indicate the preferred direction\. Bold values indicate the best result for each metric; ties are bolded jointly\. Linear Memory retains the full sequential history, A1 removes weighting, A2 removes lifecycle control, and A3 removes semantic memory selection\.

### A\.4Worked Example of Memory\-Poisoning Dynamics

Figure[2](https://arxiv.org/html/2608.20631#S3.F2)illustrates how WMT processes ordinary and poisoned memories within a single execution tree\. Blue nodes represent the query and task hierarchy, gray nodes represent ordinary action memories, and red nodes represent intentionally poisoned memories\. The example contains two task branches: identifying a candidate paper and extracting its authors\. Its purpose is to illustrate memory\-state updates rather than establish a canonical ranking of papers published in 2017\.

#### Task initialization and event scores\.

WMT first creates a root node for the user query and an active child task for identifying the paper\. Each action performed under this task is inserted as a child memory together with its observation and recorded outcome\. As defined in Eq\.[2](https://arxiv.org/html/2608.20631#S2.E2), the outcome assigns the action memory an intermediate retention score before any selection feedback is applied\. The reported configuration uses

\(usuccess,ufailure\)=\(0\.75,0\.30\)\.\(u\_\{\\mathrm\{success\}\},u\_\{\\mathrm\{failure\}\}\)=\(0\.75,0\.30\)\.
Thus, a successful action receivesu~i=0\.75\\tilde\{u\}\_\{i\}=0\.75, whereas a failed action receivesu~i=0\.30\\tilde\{u\}\_\{i\}=0\.30\. The tilde denotes the event\-assigned intermediate score\. Selection\-based decay may subsequently reduce this value, producing the final retention scoreuiu\_\{i\}\.

#### Selection\-based decay in the example\.

All action memories in Figure[2](https://arxiv.org/html/2608.20631#S3.F2)are non\-global memories\. Letui\[r\]u\_\{i\}^\{\[r\]\}denote the score of memoryviv\_\{i\}afterrrconsecutive missed selections, withui\[0\]=u~iu\_\{i\}^\{\[0\]\}=\\tilde\{u\}\_\{i\}\. From Eqs\.[4](https://arxiv.org/html/2608.20631#S2.E4)and[5](https://arxiv.org/html/2608.20631#S2.E5), therrth missed selection produces

ui\[r\]=clip\[0,1\]⁡\(ui\[r−1\]​ρmin⁡\{r,M\}\)\.u\_\{i\}^\{\[r\]\}=\\operatorname\{clip\}\_\{\[0,1\]\}\\left\(u\_\{i\}^\{\[r\-1\]\}\\rho^\{\\min\\\{r,M\\\}\}\\right\)\.
Consequently, afterrrconsecutive missed selections,

ui\[r\]=clip\[0,1\]⁡\(u~i​ρhM​\(r\)\),u\_\{i\}^\{\[r\]\}=\\operatorname\{clip\}\_\{\[0,1\]\}\\left\(\\tilde\{u\}\_\{i\}\\rho^\{h\_\{M\}\(r\)\}\\right\),
where

hM​\(r\)\\displaystyle h\_\{M\}\(r\)=∑k=1rmin⁡\{k,M\}\\displaystyle=\\sum\_\{k=1\}^\{r\}\\min\\\{k,M\\\}\(15\)=\{r⁡\(r\+1\)2,r≤M,M​r−M⁡\(M−1\)2,r\>M\.\\displaystyle=\\begin\{cases\}\\dfrac\{r\(r\+1\)\}\{2\},&r\\leq M,\\\\\[5\.0pt\] Mr\-\\dfrac\{M\(M\-1\)\}\{2\},&r\>M\.\\end\{cases\}
This cumulative expression assumes that no intervening selection or new event\-based update occurs\. Selecting the memory resets its missed\-selection count to zero, while a memory that does not enter the candidate pool is not decayed\.

#### First branch: identifying the paper\.

The first action searches broad encyclopedia pages\. Although the returned information does not provide a defensible ranking, the action is recorded as operationally successful and therefore receives

u~encyclopedia=0\.75\.\\tilde\{u\}\_\{\\mathrm\{encyclopedia\}\}=0\.75\.
The second action searches citation summaries and produces evidence supporting*Attention Is All You Need*\. It is likewise recorded as successful:

u~citation=0\.75\.\\tilde\{u\}\_\{\\mathrm\{citation\}\}=0\.75\.
The first poisoned memory is introduced by an action that consults an unofficial ranking blog\. The observation contains an unsupported claim and the action is explicitly recorded as a failure\. Its event\-assigned score is

u~blog=0\.30\.\\tilde\{u\}\_\{\\mathrm\{blog\}\}=0\.30\.
WMT preserves this failed action as a warning, but the lower score reduces its priority as supporting evidence\. The following action retrieves the official arXiv record and is recorded as successful:

u~arXiv=0\.75\.\\tilde\{u\}\_\{\\mathrm\{arXiv\}\}=0\.75\.
Suppose the official arXiv record is selected during subsequent prompt construction\. Its missed\-selection count is then reset to zero\. If the poisoned blog memory remains eligible but is not selected forrrconsecutive opportunities, its score becomes

ublog\[r\]=clip\[0,1\]⁡\(0\.30​ρhM​\(r\)\)\.u\_\{\\mathrm\{blog\}\}^\{\[r\]\}=\\operatorname\{clip\}\_\{\[0,1\]\}\\left\(0\.30\\,\\rho^\{h\_\{M\}\(r\)\}\\right\)\.
The poisoned record therefore remains in persistent memory, but its ability to influence later prompts decreases with repeated missed selections\. If it does not enter the candidate pool, its score remains unchanged\.

Once the paper\-identification task is completed, the Memory Controller folds the branch into a compact summary\. The summary can preserve the supported paper identity, the official source, and the warning about the failed blog lookup without replaying the complete branch in subsequent prompts\.

#### Second branch: extracting the authors\.

After the paper\-identification branch is completed, WMT activates the task for extracting the paper’s authors\. The first action opens the arXiv abstract page\. It verifies the title and identifier but does not recover the complete author list\. Because the action is operationally successful, it receives

u~abstract=0\.75\.\\tilde\{u\}\_\{\\mathrm\{abstract\}\}=0\.75\.
The second poisoned memory is more difficult\. An unofficial mirror page returns a fabricated single\-author claim, but the corresponding action is recorded as successful\. Event\-based scoring therefore assigns

u~mirror=0\.75,\\tilde\{u\}\_\{\\mathrm\{mirror\}\}=0\.75,
the same intermediate score assigned to a clean successful action\. This case demonstrates that the event outcome represents operational success rather than factual correctness\. A plausible but incorrect observation may therefore receive a high initial score when the action itself appears successful\.

The final action retrieves the official PDF and extracts the complete author list\. This action is recorded as successful and receives

u~PDF=0\.75\.\\tilde\{u\}\_\{\\mathrm\{PDF\}\}=0\.75\.
Once the official result becomes available, the Prompt Synthesizer can select it in preference to the mirror\-page observation\. If the mirror memory remains eligible but is unselected forrrconsecutive opportunities, its score becomes

umirror\[r\]=clip\[0,1\]⁡\(0\.75​ρhM​\(r\)\)\.u\_\{\\mathrm\{mirror\}\}^\{\[r\]\}=\\operatorname\{clip\}\_\{\[0,1\]\}\\left\(0\.75\\,\\rho^\{h\_\{M\}\(r\)\}\\right\)\.
Unlike the failed blog lookup, the mirror memory does not receive an immediate low event score\. Its influence must instead be reduced through semantic selection, repeated missed\-selection decay, or an explicit supersession rule\. If the official PDF result supersedes the mirror claim, the controller may mark the poisoned memoryobsolete\. The memory remains stored for provenance but is excluded from ordinary context construction\.

#### Branch\-priority updates\.

After the node scores are updated, WMT recomputes each task branch’s priority using Eq\.[6](https://arxiv.org/html/2608.20631#S2.E6)\. In the first branch, the failed blog action increases the failed\-action proportionFbF\_\{b\}, thereby lowering the branch priority\. If a poisoned memory is subsequently markedobsolete, it also contributes to the obsolete\-node proportionObO\_\{b\}\.

The second branch initially contains no explicitly failed poisoned action because the mirror lookup is recorded as successful\. Consequently, the failure\-ratio penalty alone cannot distinguish the poisoned mirror memory from a clean successful action\. Its influence is instead controlled through semantic selection, selection\-based decay, and supersession by the official PDF result\. This illustrates the complementary roles of event\-based score assignment and selection\-based feedback\.

If the recomputed priority of an eligible branch satisfies

Ub\(t\)<τobs=0\.10,U\_\{b\}^\{\(t\)\}<\\tau\_\{\\mathrm\{obs\}\}=0\.10,
the Memory Controller applies Eq\.[7](https://arxiv.org/html/2608.20631#S2.E7)and marks the branch’s root task nodeobsolete\. The branch and its descendants are then excluded from ordinary context construction without being deleted\. A single low\-score memory does not necessarily suppress an otherwise useful branch becauseUb\(t\)U\_\{b\}^\{\(t\)\}also incorporates the maximum node score and the mean utility of the branch\.

#### Final context construction\.

For the final reasoning step, the Prompt Synthesizer retains the active task path and can include the folded paper\-identification summary, the official arXiv record, and the author list extracted from the official PDF\. A compact failure warning may also be included when it prevents the agent from revisiting an untrusted source\.

The poisoned blog and mirror memories remain in persistent storage but need not enter the working context\. The resulting prompt therefore contains the supported paper identity and author information rather than the complete execution history\. The example demonstrates two distinct cases: an explicitly failed poisoned memory begins with the lower event scoreufailureu\_\{\\mathrm\{failure\}\}, whereas a plausible poisoned memory recorded as successful begins withusuccessu\_\{\\mathrm\{success\}\}and must be controlled through selection feedback, supersession, and lifecycle management\.

### A\.5Inference Runtime and GPU Compute Usage

All experiments were inference\-only and were executed on a server equipped with eight NVIDIA Quadro RTX 6000 GPUs, each with 24 GB of device memory, for 192 GB of aggregate installed GPU memory\. Qwen3\-8B, Gemma 4 E4B, and Llama\-3\.1\-8B were used as frozen reasoning models; no parameter training or fine\-tuning was performed\. Independent benchmark jobs were scheduled across the available GPUs\.

The complete benchmark grid contains seven unique memory configurations, three base models, and two evaluation sets, yielding 42 model–dataset–configuration settings\. GAIA\-Text contains 127 questions, whereas GAIA contains 165 questions\. Because each setting was evaluated independently on its corresponding question set, the benchmark grid comprises

R=7×3×\(127\+165\)=6,132R=7\\times 3\\times\(127\+165\)=6\{,\}132
question\-level agent executions\. Each execution initializes a new query\-specific memory tree\. This count covers the GAIA\-Text and GAIA benchmark and component\-ablation runs; the separate memory\-poisoning evaluation is not included\.

The retained benchmark artifacts provide prompt\-token totals but do not contain a consistent per\-execution wall\-clock ledger, device\-utilization traces, or power measurements\. We therefore do not report average runtime, total wall\-clock time, GPU\-hours, floating\-point operations, or energy consumption\. Prompt\-token volume is instead used as the reproducible measure of inference workload\.

After deduplicating configurations that appear in both the main and component tables, the seven unique configurations processed approximately 1\.028 billion prompt tokens on GAIA\-Text and 1\.363 billion on GAIA, for 2\.391 billion prompt tokens across the complete benchmark grid\. Full WMT accounts for 121\.50 million prompt tokens on GAIA\-Text and 158\.78 million on GAIA, or 280\.28 million in total\.

These totals include all language\-model calls required by each configuration, including base\-agent reasoning, semantic memory selection, and branch summarization when enabled\. Because the three model families use different tokenizers, the combined token count represents aggregate inference workload rather than a tokenizer\-normalized comparison across models\.

The reported 192 GB denotes aggregate installed memory across the eight GPUs and should not be interpreted as the memory consumed by an individual run\. Peak allocated GPU memory was not recorded\.