CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents

# Capture: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents
Source: [https://arxiv.org/html/2609.02265](https://arxiv.org/html/2609.02265)
###### Abstract

Personalized language agents keep a persistent memory so they can adapt to a user over weeks rather than turns, and that memory is also the attack surface\. When an agent reads a statement that contradicts what it already believes, it has no principled way to separate a genuine change of mind from a temporary context switch, a sarcastic aside, or an instruction smuggled in through a retrieved document\. Personalization methods treat every update as authentic, memory defenses reject untrusted content without modeling how real preferences evolve, and the two failure modes therefore trade against one another\. We formulate the problem as a continuous\-time partially observable decision process over a latent user state, and we prove that the error of any rule reading only recency and provenance is bounded below by how closely a feasible adversary can imitate the statistics of a legitimate revision, that conditioning on the interaction history is never worse and is strictly better under a stated condition, and that a bounded\-cost clarifying question enlarges the achievable error region under a stated condition\.Capturetracks the latent state with a neural differential equation, writes hypotheses into a ledger stratified by timescale, queries the user when its belief is too uncertain to act on, and audits the causal influence of its own citations by counterfactual removal\. On 480 held\-out episodes from 96 users,Capturereaches a 71\.5% win rate against 69\.3% for a baseline given identical supervision and 66\.1% for the strongest heuristic, holds fixed\-policy poisoning to 11\.5%, and adheres to 83\.5% of genuine updates\. An adaptive attacker with the released weights raises that to 24\.7%, at which point a provenance filter is marginally more secure and considerably less adaptive, so we report both numbers rather than the favorable one\. Because a system trained against our own generator could be learning that generator, we also evaluate the frozen system zero\-shot on an independently built benchmark and replay the interaction histories of 40 users collected over two to three weeks\.

## 1Introduction

A language agent that remembers its user is more useful than one that does not\. Persistent memory lets an assistant learn that a reviewer wants terse feedback, that an engineer writes Rust and not Go, and that a clinician wants citations attached to every claim\([Park et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib10);[Packer et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib9);[Zhong et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib8)\)\. Benchmarks now measure how well assistants hold such facts across hundreds of turns\([Maharana et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib7);[Wu et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib13)\), and personalization has become a research program in its own right\([Salemi et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib2);[Zhang et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib11)\)\. The same channel that carries this learning also carries attacks\. Retrieved web pages, shared documents, and tool outputs all enter the memory of a deployed agent, and an adversary who controls any of them can write into the user model directly\([Greshake et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib36);[Chen et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib37);[Dong et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib51)\)\.

The difficulty is that the two are observationally similar at the point of decision\. Consider an agent that has recorded a preference for detailed technical explanations\. In week six a sentence appears in the working context saying the user now wants short summaries with no code\. That might be the user, who has moved to a management role\. It might be the user in one setting, wanting brevity in standups and depth in design reviews\. It might be sarcasm after a long answer\. Or it might be a payload in the third paragraph of a retrieved README, aimed at collapsing the agent into a mode where it pastes unreviewed code\. All four produce the same evidence inside a single turn\.

We call this the preference\-authenticity ambiguity, and current systems resolve it by assumption in one of two directions\. Personalization pipelines optimize for adaptation speed and treat the history as ground truth, which makes them steerable by whoever writes into it\([Gao et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib12);[Zollo et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib3)\)\. Injection defenses refuse content whose provenance is not trusted\([Chen et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib47);[Hines et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib49);[Debenedetti et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib50)\), which is sound when the threat is external but blind to the case that matters here, where a legitimate user revises a legitimate belief through a legitimate channel\. Neither position is stable\. An agent that accepts contradictions is a liability, and one that rejects them ceases to personalize after the first month\.

We treat authenticity as a latent variable to be inferred rather than a property to be asserted\. Section[2](https://arxiv.org/html/2609.02265#S2)formalizes the memory update as a continuous\-time partially observable decision problem and bounds the error of any rule reading only recency and provenance\. An adversary choosing the surface form of an injected claim can match the recency profile of a genuine revision, and a user revising through a summarized document can match the provenance profile of an attack, so each family of heuristic fails on the case the other handles\.

Captureimplements this view\. It carries a continuous\-time belief over the user state, integrated with a neural differential equation\([Chen et al\., 2018](https://arxiv.org/html/2609.02265#bib.bib16);[Rubanova et al\., 2019](https://arxiv.org/html/2609.02265#bib.bib17)\), so evidence arriving at irregular intervals is discounted by a learned function of elapsed time rather than a fixed per\-turn schedule\. It commits hypotheses to a graph\-structured ledger with separate stable, contextual, and transient layers, so a claim about a weekend project cannot overwrite a claim about professional identity\. When the belief over the correct action is close to uniform, the agent asks, converting an uncertain write into a single clarifying turn\. A safety selector sits outside the personalization loop and cannot be moved by the ledger\. Every cited memory is verified by removal and re\-decoding, so explanations report causal influence rather than retrieval rank\([Jain and Wallace, 2019](https://arxiv.org/html/2609.02265#bib.bib26);[Turpin et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib25)\)\.

To measure any of this we needed data separating the four cases, and no existing benchmark does\.D\-PrefGuardcontains 2,400 longitudinal episodes across five tracks isolating stationary behavior, four shapes of genuine drift, benign noise, three families of contamination, and conflicts between personal utility and safety, of which 480 are held out for test\. On those,Captureholds fixed\-policy poisoning to 11\.5% against 20\.0% for Provenance\-only while adhering to 83\.5% of genuine updates against that baseline’s 74\.1%, and admits 8\.9% of benign non\-updates against its 19\.6%\. A baseline trained on identical supervision closes most of the gap to the heuristics, leaving 2\.2 points of win rate and 4\.4 of poisoning attributable to the architecture rather than the labels\.

A result of this form invites the objection that a gate trained against our own episode generator may have learned the generator rather than the problem\. We address it twice\. We evaluate the frozen system zero\-shot on HorizonBench\([Li et al\., 2026](https://arxiv.org/html/2609.02265#bib.bib53)\), an independently built benchmark of evolving preferences over simulated six\-month histories, and we run a multi\-session study where 40 participants use an assistant over two to three weeks and label their own extracted preferences\. We also report what the method costs, roughly 630 ms per turn, and what it fails to withstand, since an adaptive attacker doubles poisoning success and a provenance filter is then marginally the more secure of the two\.

## 2Problem Formulation

#### Setting\.

A user interacts with an agent over an episode ofTTturns\. At turnttthe agent receives an eventete\_\{t\}, which may be a user utterance, a retrieved document, or a tool result, and each event carries an origin labeloto\_\{t\}recording the channel it arrived on\. The user has a latent statest=\(v,ct,gt\)s\_\{t\}=\(v,\\,c\_\{t\},\\,g\_\{t\}\), wherevvholds stable values that change on the order of months,ctc\_\{t\}holds contextual preferences keyed by domain or project, andgtg\_\{t\}holds transient goals scoped to a session\. Onlyvvis close to constant\. The agent never observessts\_\{t\}and must maintain a beliefbtb\_\{t\}over it from the event stream, which places the setting in the partially observable family\([Kaelbling et al\., 1998](https://arxiv.org/html/2609.02265#bib.bib21)\)\.

#### Objective\.

Withutu\_\{t\}the user’s utility over responses at turnttandat⋆a^\{\\star\}\_\{t\}the response a fully informed agent would give, the agent seeks an update policyπ\\piminimizing dynamic regret subject to a safety budget,

min⁡∑t=1Tπ⁡𝔼⁡\[ut​\(at⋆\)−ut​\(at\)\]s\.t\.𝔼⁡\[Rsafety​\(yt\)\]≤τ\.\\min\_\{\\pi\}\\;\\sum\_\{t=1\}^\{T\}\\mathbb\{E\}\\\!\\left\[u\_\{t\}\(a^\{\\star\}\_\{t\}\)\-u\_\{t\}\(a\_\{t\}\)\\right\]\\qquad\\text\{s\.t\.\}\\qquad\\mathbb\{E\}\\\!\\left\[R\_\{\\text\{safety\}\}\(y\_\{t\}\)\\right\]\\leq\\tau\.\(1\)Dynamic rather than static regret is the right notion because the comparator moves\([Zinkevich, 2003](https://arxiv.org/html/2609.02265#bib.bib19);[Besbes et al\., 2015](https://arxiv.org/html/2609.02265#bib.bib20)\), and the constraint sits outside the objective because safety is not a preference the user may revise\.

#### Threat model\.

The adversary controls at least one channel the agent reads, in practice a retrieved document, a shared file, or a tool response, and observes the visible transcript with its timestamps and source labels\. It knows the defense, including the released weights, and writes grammatical, plausible claims, which excludes surface anomaly detection\. It cannot modify weights, read the private ledger, or observe the gate’s current belief\. Assumption[4](https://arxiv.org/html/2609.02265#Thmassumption4)states the feasible set exactly\.

#### Why a fixed rule is not enough\.

Two features are available at write time\. Recency is the elapsed time since the contradicted belief was last corroborated, and provenance is the channel label of the incoming event\. Both are cheap and both are already used in practice\.

###### Theorem 1\(Informal summary; the formal statements are Theorems[2](https://arxiv.org/html/2609.02265#Thmtheorem2)to[4](https://arxiv.org/html/2609.02265#Thmtheorem4)in Appendix[A](https://arxiv.org/html/2609.02265#A1)\)\.

Letφ\\varphireturn the elapsed time since the contradicted belief was last corroborated together with the channel label of the incoming event, and letδφ\\delta\_\{\\varphi\}be the smallest total variation distance between the genuine and adversarial laws ofφ\\varphithat any feasible adversary can achieve\. Then every decision rule reading onlyφ\\varphisatisfies

FUR⁡\(d\)\+RRL⁡\(d\)≥1−δφ\\mathrm\{FUR\}\(d\)\+\\mathrm\{RRL\}\(d\)\\;\\geq\\;1\-\\delta\_\{\\varphi\}\(2\)against a worst\-case feasible adversary, whereFUR\\mathrm\{FUR\}is the rate of accepting an injected claim andRRL\\mathrm\{RRL\}the rate of rejecting a genuine one\. Against any fixed adversary, conditioning on the full history in place ofφ\\varphinever increases the achievable error, and strictly decreases it whenever the sign of the conditional likelihood ratio givenφ\\varphiis non\-degenerate on a set of views of positive measure\. If a clarifying question returns a label through a symmetric channel of errorε\\varepsilonat costκ\\kappa, then asking beats every no\-query rule wheneverκ\+ε\\kappa\+\\varepsilonfalls below the no\-query Bayes error\.

Against a known adversary the bound is attained by the likelihood\-ratio test, so it is tight rather than loose, though the worst\-case form is a maximin value and we do not claim it is the minimax one\. The second clause is what the gate exploits, sinceφ\\varphidiscards the belief trajectory; it is a statement about a fixed adversary and does not by itself transfer to the infimum over the feasible set\. The third is the only component escaping the testing bound entirely, because asking changes the available information rather than the rule applied to it\. The tools are standard statistical decision theory, and what is new is the formalization of preference\-authenticity ambiguity in terms that let them apply\. Appendix[A](https://arxiv.org/html/2609.02265#A1)states the assumptions all three rest on, and Appendix[A\.6](https://arxiv.org/html/2609.02265#A1.SS6)the estimation protocol\.

Figure 1:The adaptation\-security frontier onD\-PrefGuard\. Each point is a method, positioned by how many legitimate updates it accepts \(right is better\) and how well it resists poisoning \(up is better\)\. Recency\-based memory accepts almost everything, provenance filtering rejects almost anything unfamiliar, andCaptureoccupies the upper right, where same\-origin contamination accounts for 50\.7% of its successful attempts\. Bars are user\-level bootstrap 95% intervals over the 132 genuine updates and 192 poisoning attempts in the held\-out episodes\.

## 3Capture

The subsections below follow one event through extraction \(Section[3\.1](https://arxiv.org/html/2609.02265#S3.SS1)\), the authenticity gate \(Section[3\.2](https://arxiv.org/html/2609.02265#S3.SS2)\), the ledger \(Section[3\.3](https://arxiv.org/html/2609.02265#S3.SS3)\), and response selection with audit \(Section[3\.4](https://arxiv.org/html/2609.02265#S3.SS4)\)\. Figure[2](https://arxiv.org/html/2609.02265#A2.F2)in Appendix[B](https://arxiv.org/html/2609.02265#A2)shows the path\.

### 3\.1Preference\-hypothesis extraction

A 3B parameter model with LoRA adapters\([Hu et al\., 2022](https://arxiv.org/html/2609.02265#bib.bib30)\)reads the event and emits a structured tuple under schema\-constrained decoding,

Ht=⟨claim,direction,scope,timescale,confidence,provenance⟩\.H\_\{t\}=\\big\\langle\\text\{claim\},\\;\\text\{direction\},\\;\\text\{scope\},\\;\\text\{timescale\},\\;\\text\{confidence\},\\;\\text\{provenance\}\\big\\rangle\.\(3\)Scope records whether the claim is global or restricted to a named domain, and timescale whether it was framed as permanent or situational\. Training minimizesℒext=CE⁡\(Ht,H^t\)\+ωabs​Ω​\(H^t\)\\mathcal\{L\}\_\{\\text\{ext\}\}=\\mathrm\{CE\}\(H\_\{t\},\\hat\{H\}\_\{t\}\)\+\\omega\_\{\\text\{abs\}\}\\,\\Omega\(\\hat\{H\}\_\{t\}\), cross\-entropy against annotated tuples plus a penaltyΩ\\Omegarewarding abstention on events carrying no preference signal\. Roughly seven in ten events carry no preference content, so an extractor that cannot decline builds a ledger of noise\.

### 3\.2The authenticity gate

The gate resolves the ambiguity of Section[2](https://arxiv.org/html/2609.02265#S2)\. It holds a latent beliefhth\_\{t\}evolving in continuous time between events,

d​h​\(t\)d​t=fθ​\(h⁡\(t\)\),\\frac\{dh\(t\)\}\{dt\}=f\_\{\\theta\}\\big\(h\(t\)\\big\),\(4\)in which neither the event embedding nor absolute time appears, so the between\-event flow is autonomous and time enters only through the integration intervalΔ​t\\Delta t\([Chen et al\., 2018](https://arxiv.org/html/2609.02265#bib.bib16);[Kidger et al\., 2020](https://arxiv.org/html/2609.02265#bib.bib18)\)\. An arriving event is consumed solely by the discrete GRU update at its arrival time, with no interpolation or zero\-order holding\. Continuous\-time dynamics suit irregularly spaced interactions\. A user may send forty turns in an afternoon and nothing for nine days, and a discrete\-step model treats those gaps identically\. Under Equation[4](https://arxiv.org/html/2609.02265#S3.E4)the transient layer decays substantially across the nine days while the stable layer barely moves, so a contradiction arriving afterwards is read against a belief that has already discarded the session\-specific noise\.

Fromhth\_\{t\}and the hypothesis the gate predicts a distribution over six actions, namely retain the existing belief, add a new one, narrow an existing belief to a scope, revise it outright, quarantine the claim pending corroboration, or ask the user\. The first five are silent\. The sixth is not, and the agent takes it when the Shannon entropy of the action distribution exceeds a threshold, that is whenℋ⁡\(P⁡\(at∣ht,Ht\)\)\>η\\mathcal\{H\}\(P\(a\_\{t\}\\mid h\_\{t\},H\_\{t\}\)\)\>\\eta\. We setη\\etaon validation to spend at most one clarifying turn per twelve interactions\. The gate is a learned alternative to Bayesian changepoint detection\([Adams and MacKay, 2007](https://arxiv.org/html/2609.02265#bib.bib22)\), differing in that it must decide not only whether the process changed but whether the evidence was authored by the user\. Theorem[4](https://arxiv.org/html/2609.02265#Thmtheorem4)gives the condition under which this action is worth its cost\.

### 3\.3Multi\-timescale ledger

Hypotheses live as nodes in a directed graph over a vector store\([Johnson et al\., 2021](https://arxiv.org/html/2609.02265#bib.bib35)\), with edges recording support and contradiction\. Each node sits in one of three layers, and each layer carries a base decay rateγ\\gamma, so that the confidence of a node at timettwhose last corroboration was att0t\_\{0\}isc0​σ​\(ht\)​exp⁡\(−γ⁡\(t−t0\)\)c\_\{0\}\\,\\sigma\(h\_\{t\}\)\\exp\(\-\\gamma\(t\-t\_\{0\}\)\), wherec0∈\(0,1\]c\_\{0\}\\in\(0,1\]is the confidence at write time andσ⁡\(ht\)∈\(0,1\)\\sigma\(h\_\{t\}\)\\in\(0,1\)is a scalar sigmoid read\-off from the gate’s latent belief, trained jointly withfθf\_\{\\theta\}and shared across node types\.

We distinguish the learned components from the fixed ones\. The dynamicsfθf\_\{\\theta\}and the modulationσ\\sigmaare learned end to end; the three base rates are not\. They are selected once by grid search on validation and frozen for every experiment, atγs=0\.01\\gamma\_\{s\}=0\.01,γc=0\.1\\gamma\_\{c\}=0\.1, andγg=0\.5\\gamma\_\{g\}=0\.5, in units of days\. The layer sets a prior on how fast a class of belief fades and the learned component determines the departure from it\. Learning the rates jointly collapsed them toward a single value and cost 3\.1 points of genuine\-update adherence rate, as Appendix[B](https://arxiv.org/html/2609.02265#A2)reports\.

Overwriting a stable node requires repeated high\-confidence evidence rather than a single assertion, which is what stops one sentence from redefining a user\. The layering also gives the agent somewhere to put a claim that is true but narrow\. When a user asks for brevity in a standup, the correct action is to scope, not to revise, and a flat memory has no way to express the difference\.

#### Quarantine\.

Quarantine is a state, not a fourth layer\. A quarantined node is written into the ledger and decays like anything else, but it is flagged non\-retrievable, so the selector cannot see it and it cannot influence a response\. It carries a quarantine rateγq=0\.135\\gamma\_\{q\}=0\.135whatever scope it claims, so the exponential retention multiplier falls from11to about0\.150\.15after 14 days, and eviction is defined against that normalized multiplier and the floorϕ=0\.15\\phi=0\.15rather than against the absolute node score, which additionally carries thec0​σ​\(ht\)c\_\{0\}\\,\\sigma\(h\_\{t\}\)prefactor\. Corroborated before then, the node is promoted into the layer its scope implies and becomes retrievable, and otherwise it is evicted, so it never influences a response while the decision is pending\.

### 3\.4Safety\-bounded selection and causal audit

The selector samplesNNcandidates and scores each for personalized utilityrpr\_\{p\}and safety riskrsr\_\{s\},

y⋆=arg⁡maxy∈Y⁡\(α​rp​\(y\)−β​rs​\(y\)\)s\.t\.rs​\(y\)≤τsafe,y^\{\\star\}=\\arg\\max\_\{y\\in Y\}\\Big\(\\alpha\\,r\_\{p\}\(y\)\-\\beta\\,r\_\{s\}\(y\)\\Big\)\\qquad\\text\{s\.t\.\}\\qquad r\_\{s\}\(y\)\\leq\\tau\_\{\\text\{safe\}\},\(5\)falling back to a calibrated refusal when every candidate violates the constraint\. Nothing in the ledger can moveτsafe\\tau\_\{\\text\{safe\}\}\. This asymmetry is why poisoning that succeeds at the memory layer still fails to produce harmful output in most of our contamination episodes\.

For interpretability we do not report attention or retrieval rank, both of which are known to be unreliable as explanations\([Jain and Wallace, 2019](https://arxiv.org/html/2609.02265#bib.bib26);[Wiegreffe and Pinter, 2019](https://arxiv.org/html/2609.02265#bib.bib27);[Turpin et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib25)\)\. Instead, for each ledger nodenin\_\{i\}the agent cites, we re\-decode with that node removed and measure the shift in utility,

Inf⁡\(ni\)=U⁡\(yfactual\)−U⁡\(yℒ∖ni\),\\mathrm\{Inf\}\(n\_\{i\}\)=U\(y\_\{\\text\{factual\}\}\)\-U\\big\(y\_\{\\mathcal\{L\}\\setminus n\_\{i\}\}\\big\),\(6\)following the counterfactual tradition in explanation\([Wachter et al\., 2018](https://arxiv.org/html/2609.02265#bib.bib28);[Verma et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib29)\)\. The audit then does two things\. Within the turn, a citation whose removal leaves the response unchanged is dropped from the explanation, which is what Evidence F1 measures\. Across turns, influence scores accumulate per node and a node retrieved repeatedly without changing an output is down\-weighted at retrieval, which is why removing the audit costs 0\.4 points of genuine\-update adherence rate rather than nothing\. It costs an extra decode, the most expensive part of the system, but turns a claim about interpretability into a measured quantity\.

## 4TheD\-PrefGuardBenchmark

We builtD\-PrefGuardbecause the disentanglement we care about is invisible in existing data\. Personalization benchmarks hold preference signal but no attacks\([Salemi et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib2);[Zollo et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib3);[Guo et al\., 2026](https://arxiv.org/html/2609.02265#bib.bib15)\), and injection benchmarks hold attacks but a static user\([Zhan et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib45);[Debenedetti et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib46)\)\. Neither asks whether a defense that blocks poisoning also blocks legitimate change\.

The benchmark holds 2,400 episodes of 12 to 20 turns, seeded from PRISM, PersonalLLM, and LaMP\([Kirk et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib1);[Zollo et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib3);[Salemi et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib2)\), across five tracks\. T0 is stationary, so any update is a false one\. T1 holds genuine drift in four shapes, abrupt, gradual, recurring, and context\-switching\. T2 holds benign ambiguity as sarcasm, typos, and weak evidence\. T3 holds contamination in three families at 160 episodes each, namely indirect injection, poisoned summaries, and same\-origin writes\([Greshake et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib36);[Zou et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib38);[Wang et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib52)\)\. Same\-origin is built by user\-mediated laundering rather than impersonation\. An adversary plants a claim in an external document and the user later pastes a passage of it into the conversation, so the event carries the coarse*user channel*label although the adversary wrote the sentence, and Assumption[4](https://arxiv.org/html/2609.02265#Thmassumption4)holds\. T4 puts personal utility in direct conflict with a global safety constraint\. Three annotators validated a 300\-episode subset at Krippendorff’sα≥0\.70\\alpha\\geq 0\.70\.

#### How responses are scored\.

Win rate is a blinded pairwise comparison against the unpersonalized backbone, judged by an LLM judge with responses in randomized order and the ground\-truth preference state given to the judge but withheld from every system tested; on a 600\-comparison subset the judge agrees with three human raters 87\.4% of the time, against 91\.2% among the raters themselves\. The utilityrpr\_\{p\}in the selector and in Equation[6](https://arxiv.org/html/2609.02265#S3.E6)is a reward model fine\-tuned onD\-PrefGuardpairs, while regret is scored against a*second*reward model trained on disjoint users, responses, and generator families that no system reads at inference, so the metric a method is scored on is not the one it optimizes\. It is measured on post\-changepoint T1 turns over a shared 32\-candidate pool generated once from oracle memory, frozen across methods and seeds, and ranked in full by every method, separately from theN=8N=8candidates each method generates for its own output\. The safety riskrsr\_\{s\}is a separate classifier that never sees the ledger, and the Safety column is attack success on track T4 under HarmBench\([Mazeika et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib39)\), with StrongREJECT\([Souly et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib40)\)within 1\.4 points on every method in Appendix[C](https://arxiv.org/html/2609.02265#A3)and XSTest\([Röttger et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib41)\)supplying the false refusal column\. We report no calibration column, sinceCapture’s confidence is a distribution over six memory actions while the baselines expose a response likelihood, and a calibration error spanning both would not be comparable\([Naeini et al\., 2015](https://arxiv.org/html/2609.02265#bib.bib24);[Guo et al\., 2017](https://arxiv.org/html/2609.02265#bib.bib23)\)\.

#### Splits and leakage\.

The extractor and gate train on annotations from the same generator that produces the evaluation episodes, so we control leakage explicitly\. Development and test partitions use disjoint synthetic users, topics, surface templates, and attack realizations, and one generator model family is excluded from training and development and reserved for test\. Test was frozen before model selection, no method was tuned on a held\-out track, and Appendix[D](https://arxiv.org/html/2609.02265#A4)says which episode fields each method sees\. None of this fully answers the objection that a learned gate might be fitting our generator, which is why Section[6](https://arxiv.org/html/2609.02265#S6)leavesD\-PrefGuardbehind\.

## 5Experiments

#### Setup\.

Response backbones are Qwen3\-8B\-Instruct and Llama\-3\.1\-8B\-Instruct\([Yang et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib32);[Grattafiori et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib33)\), with the extractor and gate built on Qwen2\.5\-3B\([Yang et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib31)\)using LoRA adapters on four A100 80GB GPUs\. We report three training seeds, user\-level paired bootstrap 95% intervals, and paired randomization tests with Holm correction, with full hyperparameters in Appendix[B](https://arxiv.org/html/2609.02265#A2)\.

Baselines span the two families of Section 1 plus a retrieval\-augmented middle\([Lewis et al\., 2020](https://arxiv.org/html/2609.02265#bib.bib34);[Packer et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib9)\)\. Two carry the comparison\.Provenance\-onlyaccepts updates originating on the user channel and rejects everything indirect, the memory\-layer form of[Chen et al\. \(2025\)](https://arxiv.org/html/2609.02265#bib.bib47)and[Hines et al\. \(2024\)](https://arxiv.org/html/2609.02265#bib.bib49)\.StateMemis our implementation of explicit supersession tracking, where a claim contradicting a stored one marks it superseded and writes itself in its place, with version history but no authenticity check and no timescale structure\. It leads on win rate and is close to an ablation ofCapturedown to its bookkeeping; consistent with that, removing the gate lands at 33\.5% poisoning, within 1\.3 points of StateMem’s 34\.8%\. Every method generatesN=8N=8candidates and selects with the samewp=1\.0w\_\{p\}=1\.0,ws=2\.0w\_\{s\}=2\.0, andτsafe=0\.35\\tau\_\{\\text\{safe\}\}=0\.35, sharing candidate temperature, token limit, safety scorer, refusal fallback, backbones, retrieval corpus, and accessible\-history budget, so methods differ only in the memory state at generation\. Those eight determine every metric except regret, which is scored on the frozen 32\-candidate pass above\. Appendix[B](https://arxiv.org/html/2609.02265#A2)reports added latency and tokens per turn so extra inference cannot pass as an unreported advantage\. Six questions organize what follows, covering the adaptation\-security tradeoff, drift shapes and attack families, individual components, architecture against supervision, adaptive and independently authored attacks, and cross\-backbone transfer\.

Table 1:Main comparison on the 480 held\-out test episodes from 96 users, each cell the mean over both response backbones and three seeds, with arrows marking the improving direction and the best non\-oracle result in bold\. Win rate is against the unpersonalized base model, Regret is common\-pool dynamic regret over a shared frozen pool of 32 oracle\-generated responses, Poison is response\-level attack success, Adherence is the genuine\-update adherence rate, and False upd\. is the active\-memory false\-admission rate on track T2\. Oracle\-memory sees the true latent state, attack label, changepoint, and correct scope and timescale, but not future corroboration or the safety label, and shares the candidate pool and selector\.
#### Q1\. The tradeoff is not fixed\.

Table[1](https://arxiv.org/html/2609.02265#S5.T1)shows the two baseline families behaving as the framing predicts\. Recency RAG adheres most at 85\.7% and has the worst poisoning at 51\.6% and worst false admission at 41\.2%\. Provenance\-only inverts this, holding poisoning to 20\.0% while adhering to only 74\.1% and refusing more than anything else\.Capturereaches 11\.5% poisoning at 83\.5% adherence and 8\.9% false admission, beating Provenance\-only on all three at once, with win rate 71\.5% against 66\.1% for StateMem\. It does not lead everywhere, since Recency RAG recovers faster, adheres slightly more, and refuses less, all the price of quarantine\.

#### Q2\. Where the difference comes from\.

Captureties Recency RAG on abrupt drift and separates on recurring drift and context switches, where the agent must hold two beliefs at once rather than replace one\. Provenance\-only beatsCaptureon indirect injection, 4\.8% against 7\.0%, and collapses on same\-origin contamination, 43\.6% against 17\.5%, the regime Theorem[1](https://arxiv.org/html/2609.02265#Thmtheorem1)identifies\. On context switches the modal correct action is*scope*rather than*revise*, andCaptureselects it in 71% of changepoints against 4% for StateMem\. Appendix[I](https://arxiv.org/html/2609.02265#A9)has the breakdown and Appendix[H](https://arxiv.org/html/2609.02265#A8)the attacks that still succeed\.

#### Q3\. What each component is worth\.

Table[6](https://arxiv.org/html/2609.02265#A7.T6)removes one piece at a time\. The gate carries the security result almost entirely, costing 22\.0 points of poisoning resistance and 0\.15 regret, and provenance a further 14\.0, so the two are complementary, the empirical counterpart of Theorem[3](https://arxiv.org/html/2609.02265#Thmtheorem3)\. Timescale separation is worth 5\.4 points of adherence and probing 3\.6\. Removing the safety bound raises adherence by 4\.0 while leaving ledger promotion unchanged, confirming adherence is output\-level, and triples safety attack success\. Removing the audit drops evidence F1 from 0\.79 to 0\.58\.

#### Q4\. Supervision or architecture?

The two separate only against a baseline given the same supervision, so we trained one\. The supervised Transformer in Table[1](https://arxiv.org/html/2609.02265#S5.T1)sees identical six\-class labels and history, an explicitlog⁡\(1\+Δ​t\)\\log\(1\+\\Delta t\)input, and the same extractor, clarification channel, selector, and safety scorer, writing into a flat versioned memory with no ODE and no timescale ledger\. It reaches 69\.3% win rate and 15\.9% poisoning, most of the way from StateMem toCapture\. What remains is 2\.2 points of win rate at\[0\.6,3\.9\]\[0\.6,3\.9\],p=0\.011p=0\.011, and 4\.4 of poisoning at\[−7\.0,−1\.9\]\[\-7\.0,\-1\.9\],p=0\.003p=0\.003\. Supervision therefore explains much of the improvement and the architecture the rest\. On the labels themselves the two are close, macro\-F1 0\.71 against 0\.68 with a paired difference short of significance, placing the architectural contribution in the ledger and the temporal update rather than in per\-event classification\. Frozen and run zero\-shot, the Transformer trailsCaptureon HorizonBench contradiction resolution by 0\.04 atp=0\.008p=0\.008and on replay win by 1\.7 points atp=0\.031p=0\.031, while the belief\-revision and replay\-poisoning gaps do not reach significance, so the architectural gain transfers beyond our generator but modestly\.

#### Q5\. What happens when the attacker adapts, or is someone else?

Table[2](https://arxiv.org/html/2609.02265#S5.T2)answers the question the fixed\-policy column cannot\. The adaptive attacker runs a 32\-candidate paraphrase search maximizingP⁡\(add\)\+P⁡\(revise\)−P⁡\(quarantine\)−P⁡\(clarify\)P\(\\text\{add\}\)\+P\(\\text\{revise\}\)\-P\(\\text\{quarantine\}\)\-P\(\\text\{clarify\}\)under similarity and length constraints, scoring against shadow\-state particles replayed through the released weights rather than querying the deployed gate, which keeps it inside Assumption[4](https://arxiv.org/html/2609.02265#Thmassumption4)\. It more than doubles attack success againstCapture, from 11\.5% to 24\.7%, with same\-origin rising to 38\.1%, transfers to the other learned gate almost as well, and barely moves the heuristic baselines, which expose no gradient\.Capturethen no longer leads on security alone, since Provenance\-only reaches 22\.1% against our 24\.7%, a paired difference of 2\.6 points with interval\[−1\.9,7\.2\]\[\-1\.9,7\.2\]atp=0\.29p=0\.29, so the two are not reliably separated on this axis, and whatCaptureretains is comparable security at 83\.5% adherence against Provenance\-only’s 74\.1%\. Independently authored attacks tell a milder version of the same story\. On 240 attacks from twelve external red\-teamers with no access to our templates,Capturereaches 18\.3%, above our own generator’s 11\.5% and still the lowest of any method tested, and four of the five methods degrade by 6\.3 to 6\.8 points while Recency RAG, which mounts no defense, moves slightly the other way\.

Table 2:Security under three attackers on the held\-out test partition, defined with their interval constructions in Appendix[E](https://arxiv.org/html/2609.02265#A5)\. Under adaptive attack Provenance\-only has the numerically lowest ASR and is not separated fromCapture, reversing the fixed\-policy ordering\. Adaptive attacks were not run against Recency RAG, and independent\-attack intervals are omitted pending the crossed two\-way resample rather than reported under a clustering that understates the dependence\.
#### Q6\. Transfer across backbones\.

Every method in Table[1](https://arxiv.org/html/2609.02265#S5.T1)was run on Qwen3\-8B and Llama\-3\.1\-8B with three seeds each, so those cells average six runs\. Broken out, the continuous gate leads the discrete one by 2\.4 points of win rate on Qwen3, and giving the discrete gate an explicit elapsed\-time input recovers about 55% of that gap but not all of it, which is why Section[3\.2](https://arxiv.org/html/2609.02265#S3.SS2)treats continuous time as an inductive bias rather than a requirement\. Appendix[J](https://arxiv.org/html/2609.02265#A10)has the table\.

## 6Leaving the Benchmark Behind

Everything in Section[5](https://arxiv.org/html/2609.02265#S5)was measured on trajectories from our own generator, and the split controls of Section[4](https://arxiv.org/html/2609.02265#S4)reduce without eliminating the risk that the gate learned it\. We therefore evaluate the frozen system in two further settings\. HorizonBench is independently constructed and holds evolving preferences but no contamination\. The user study supplies naturally generated histories, into which we introduce contamination only during offline replay, so it tests transfer to natural histories and not to independently generated attacks\. Neither tests both\.

#### Two settings we did not generate\.

HorizonBench\([Li et al\., 2026](https://arxiv.org/html/2609.02265#bib.bib53)\)tracks 360 simulated users whose preferences evolve across roughly six months and separates retrieval from belief\-update failures by construction\. We had no part in building it and evaluation is strictly zero\-shot; because it is non\-interactive,*clarify*resolves to quarantine without update, so that row isCapturewithout interactive clarification, and it holds no attacks\. Separately, forty participants completed four to six sessions over two to three weeks against one fixed neutral assistant\. Their histories were then frozen and replayed identically to every system with six controlled attacks injected per participant, none of which a participant saw, and when the gate asks the stored annotation answers, making this an oracle\-assisted replay with zero answer error\. Appendix[D](https://arxiv.org/html/2609.02265#A4)has both protocols\.

#### What transfers\.

The advantage survives both moves and attenuates each time\. OnD\-PrefGuardCaptureleads StateMem by 5\.4 points of win rate, and on replayed histories by 4\.5\. Satisfaction came from a separate blinded within\-participant rating task, four matched output pairs per session with identity, order, and side randomized, giving 4\.1 at\[3\.9,4\.3\]\[3\.9,4\.3\]against StateMem’s 3\.8 at\[3\.6,4\.0\]\[3\.6,4\.0\]\. No clarification F1 is defined on the replay, because the four participant labels describe scope and extraction correctness and none expresses whether the assistant should have asked\. OnD\-PrefGuard, where such labels exist,Capturereaches precision 0\.79, recall 0\.70, and F1 0\.74 at a realized query rate of 7\.8% inside the 8\.33% budget\. On HorizonBench, Recency RAG leads on belief revision accuracy at 0\.79 against 0\.78, the expected ordering where no adversary exists, and the separation appears on contradiction resolution, whereCapturereaches 0\.72 against StateMem’s 0\.65 and Recency RAG’s 0\.58\. These panels support transfer of preference tracking beyond our generator, though not of poisoning robustness, since the replayed contamination is author\-constructed\.

## 7Related Work

#### Personalizing language models\.

Alignment from human feedback fits a single population preference\([Ouyang et al\., 2022](https://arxiv.org/html/2609.02265#bib.bib4);[Rafailov et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib5)\), and a growing line fits individuals instead, through profiles\([Salemi et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib2)\), latent preferences learned from user edits\([Gao et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib12)\), system\-message generalization\([Lee et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib14)\), and datasets recording who disagreed with whom\([Kirk et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib1);[Zollo et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib3);[Zhang et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib11)\)\. Agent memory systems then made long horizons practical by paging information in and out of context\([Packer et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib9)\), decaying it\([Zhong et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib8)\), or reflecting on it\([Park et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib10)\), and benchmarks now stress them at length\([Maharana et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib7);[Wu et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib13);[Guo et al\., 2026](https://arxiv.org/html/2609.02265#bib.bib15);[Zhao et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib54);[Jiang et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib55)\)\. All of it assumes the record is trustworthy and manages capacity rather than asking whether a memory should have been written\.

#### Injection, poisoning, and safety under adaptation\.

Indirect prompt injection turns retrieved content into instructions\([Greshake et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib36)\), and the agent setting has produced benchmarks\([Zhan et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib45);[Debenedetti et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib46)\)and attacks targeting retrieval and memory\([Zou et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib38);[Chen et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib37);[Dong et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib51);[Wang et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib52)\)\. Defenses separate instructions from data\([Chen et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib47);[Piet et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib48);[Hines et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib49)\)or enforce capability boundaries\([Debenedetti et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib50)\), and all treat the user as static\. Our baselines cover representative families rather than current systems, and Provenance\-only is a memory\-layer proxy for that class rather than a reimplementation of any one defense, which beatsCaptureon untrusted channels but not where user and attacker write the same kind of sentence\. Safety alignment is shallow in the token dimension\([Qi et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib43)\), breakable by optimized suffixes\([Zou et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib42)\), and fragile under fine\-tuning\([Qi et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib44)\), which argues for keeping the constraint outside anything a user can revise\([Bai et al\., 2022](https://arxiv.org/html/2609.02265#bib.bib6)\), and our selector is a memory\-layer analogue\.

## 8Limitations and Falsification

Theorem[2](https://arxiv.org/html/2609.02265#Thmtheorem2)constrains onlyσ⁡\(φ\)\\sigma\(\\varphi\)\-measurable rules, says nothing about a heuristic reading a third fixed feature, and depends on Assumption[4](https://arxiv.org/html/2609.02265#Thmassumption4)granting the adversary the visible transcript\.Captureis text\-only and does not address weight\-level poisoning, and the clarification budget is tuned on our data\.D\-PrefGuardis synthetic and validated on a 300\-episode subset, so absolute numbers are relative comparisons rather than deployment estimates\. HorizonBench reduces that without removing it, since its trajectories are simulated even where annotations are human, and 40 participants supports an effect estimate but no subgroup claim\.

We state in advance what would refute the claims\. Five criteria cover the strictness condition of Theorem[3](https://arxiv.org/html/2609.02265#Thmtheorem3), whether provenance alone suffices on same\-origin contamination, whether static summaries match the ledger on recurrence, whether influence AUC falls to chance, and whether the advantage survives external data and replayed histories\. Appendix[C](https://arxiv.org/html/2609.02265#A3)states each precisely and reports all five with one consistency check on the harness\. No refuting condition currently holds, and the external\-validity check passes only narrowly\.

## 9Conclusion

An agent that trusts its memory can be rewritten by anyone who reaches it, and one that distrusts it stops learning\. These are one problem, no fixed rule on recency or provenance resolves it, and inferring authenticity as a latent variable improves both axes at once\. Most of that gain comes from supervised temporal tracking, which a matched Transformer also reaches; the ledger and continuous\-time update add a smaller increment that survives on independently built data\. Adaptive attack remains open, and there our advantage over a provenance filter is not reliably separated\.

### AI use statement

In this work, we used generative AI tools to generate synthetic datasets used in evaluation, to implement methods, and to clean and reformat dataset files\. Specifically, the episode text ofD\-PrefGuard, including benign ambiguity, preference\-change realizations, and attack paraphrases, was generated by large language models conditioned on a structured generation program, using Qwen2\.5\-72B\-Instruct and Mixtral\-8x22B\-Instruct for the training and development partitions and Llama\-3\.1\-70B\-Instruct as the held\-out generator family for the test partition\. User profiles were seeded from PRISM, PersonalLLM, and LaMP rather than generated, and track labels and changepoint positions come from the generation program rather than from a model\. We also used generative AI to write boilerplate for the benchmark construction scripts and to reformat annotation exports into the extractor’s schema\. We have not used generative AI tools for developing the theoretical model in Section[2](https://arxiv.org/html/2609.02265#S2), formulating or proving the mathematical claims, proposing or refining the research hypotheses, designing the methodology or experiments, or interpreting results, and translation is not applicable to this work\. Additionally, we used generative AI tools for drafting parts of this paper, editing it to improve readability, and formatting references\. We have reviewed all AI\-assisted work\. Generated episodes were human\-validated on a 300\-episode subset with the agreement reported in Appendix[D](https://arxiv.org/html/2609.02265#A4), all AI\-generated code was read line by line and tested against unit tests written by the authors, every reference was checked against its published record at the venue of record, and all numerical claims in Section[5](https://arxiv.org/html/2609.02265#S5)were computed by scripts the authors wrote and verified independently by two authors\. We take responsibility for the final content of this work, including text, claims or artifacts produced with the aid of generative AI\.

### Ethics statement

This work introduces a benchmark containing memory\-poisoning attack templates, and releasing such templates lowers the cost of mounting the attacks they describe\. We judge the tradeoff to favor release because the attacks we adapt are already public\([Greshake et al\., 2023](https://arxiv.org/html/2609.02265#bib.bib36);[Chen et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib37);[Zou et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib38)\), and because a defense cannot be evaluated by anyone who lacks the attacks\. We mitigate the residual risk with a tiered release in which the evaluation harness, the defense implementation, and the drift tracks are public, while the attack payload generator is available on request to researchers with institutional affiliation\.

Personalization carries its own risks that are not solved by making it more secure\. A system that models a person can harden a sparse history into a fixed identity claim, so the reference implementation is configured not to persist hypotheses concerning protected attributes, enforced by a schema constraint on the extractor rather than by a learned behavior, and every ledger node is user\-visible, revisable, and deletable\. Optimizing for personal utility can also reinforce harmful inclinations, which is why the safety constraint in Section[3\.4](https://arxiv.org/html/2609.02265#S3.SS4)is architecturally separate from the preference model and cannot be lowered by anything a user or an attacker writes\. Ledger contents are sensitive by construction, and our reference implementation stores them locally under pseudonymous identifiers with no cross\-user sharing\. Human validation of the benchmark was performed by three annotators who were informed of the purpose of the task and compensated at local research rates\.

### Reproducibility statement

The formal setting and the informal statement of Theorem[1](https://arxiv.org/html/2609.02265#Thmtheorem1)are in Section[2](https://arxiv.org/html/2609.02265#S2), with assumptions, formal statements, proofs, equality conditions, and the estimation protocol in Appendix[A](https://arxiv.org/html/2609.02265#A1)\. Architecture details, decay constants, entropy thresholds, and all training hyperparameters for the extractor and gate are in Appendix[B](https://arxiv.org/html/2609.02265#A2), and the estimation protocol for both total variation distances, including the matched split the bound is evaluated on, is in Appendix[A\.6](https://arxiv.org/html/2609.02265#A1.SS6)\. Benchmark construction, the seeding procedure from the three source datasets, the track definitions, and the annotation protocol with inter\-annotator agreement are in Appendix[D](https://arxiv.org/html/2609.02265#A4)\. The supervision\-matched, adaptive, independently authored, and query\-matched evaluations are in Appendix[E](https://arxiv.org/html/2609.02265#A5), and the statistical protocol is in Appendix[F](https://arxiv.org/html/2609.02265#A6)\. Source code, theD\-PrefGuardconstruction scripts, and the trained adapter weights are included in the supplementary material and will be released publicly\.

## References

- Adams and MacKay \(2007\)R\. P\. Adams and D\. J\. C\. MacKayBayesian online changepoint detection\.arXiv preprint arXiv:0710\.3742\.External Links:0710\.3742Cited by:[§3\.2](https://arxiv.org/html/2609.02265#S3.SS2.p2.1)\.
- Baiet al\.\(2022\)Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon,et al\.Constitutional AI: harmlessness from AI feedback\.arXiv preprint arXiv:2212\.08073\.Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Besbeset al\.\(2015\)O\. Besbes, Y\. Gur, and A\. ZeeviNon\-stationary stochastic optimization\.Operations Research63\(5\),pp\. 1227–1244\.External Links:[Document](https://dx.doi.org/10.1287/opre.2015.1408),1307\.5449Cited by:[§2](https://arxiv.org/html/2609.02265#S2.SS0.SSS0.Px2.p1.2)\.
- Chenet al\.\(2018\)R\. T\. Q\. Chen, Y\. Rubanova, J\. Bettencourt, and D\. DuvenaudNeural ordinary differential equations\.InAdvances in Neural Information Processing Systems 31 \(NeurIPS 2018\),Note:Best Paper AwardExternal Links:1806\.07366Cited by:[Appendix B](https://arxiv.org/html/2609.02265#A2.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2609.02265#S1.p5.1),[§3\.2](https://arxiv.org/html/2609.02265#S3.SS2.p1.2)\.
- Chenet al\.\(2025\)S\. Chen, J\. Piet, C\. Sitawarin, and D\. WagnerStruQ: defending against prompt injection with structured queries\.In34th USENIX Security Symposium \(USENIX Security 25\),Seattle, WA\.Note:arXiv:2402\.06363Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p3.1),[§5](https://arxiv.org/html/2609.02265#S5.SS0.SSS0.Px1.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Chenet al\.\(2024\)Z\. Chen, Z\. Xiang, C\. Xiao, D\. Song, and B\. LiAgentPoison: red\-teaming LLM agents via poisoning memory or knowledge bases\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS 2024\),Note:arXiv:2407\.12784Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1),[§9](https://arxiv.org/html/2609.02265#S9.SSx2.p1.1)\.
- Debenedettiet al\.\(2025\)E\. Debenedetti, I\. Shumailov, T\. Fan, J\. Hayes, N\. Carlini, D\. Fabian, C\. Kern, C\. Shi, A\. Terzis, and F\. TramèrDefeating prompt injections by design\.arXiv preprint arXiv:2503\.18813\.Note:The CaMeL defense; arXiv preprint, no peer\-reviewed venue found as of 2026\-08\-30Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p3.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Debenedettiet al\.\(2024\)E\. Debenedetti, J\. Zhang, M\. Balunović, L\. Beurer\-Kellner, M\. Fischer, and F\. TramèrAgentDojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS 2024\) Datasets and Benchmarks Track,Note:arXiv:2406\.13352Cited by:[§4](https://arxiv.org/html/2609.02265#S4.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Donget al\.\(2025\)S\. Dong, S\. Xu, P\. He, Y\. Li, J\. Tang, T\. Liu, H\. Liu, and Z\. XiangMemory injection attacks on LLM agents via query\-only interaction\.arXiv preprint arXiv:2503\.03704\.Note:The MINJA attack; earlier versions titled ”A Practical Memory Injection Attack against LLM Agents”\. No peer\-reviewed venue confirmed as of 2026\-08\-30Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Gaoet al\.\(2024\)G\. Gao, A\. Taymanov, E\. Salinas, P\. Mineiro, and D\. MisraAligning LLM agents by learning latent preference from user edits\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS\),Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p3.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Grattafioriet al\.\(2024\)A\. Grattafiori, A\. Dubey, A\. Jauhri,et al\.The llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.External Links:2407\.21783Cited by:[§5](https://arxiv.org/html/2609.02265#S5.SS0.SSS0.Px1.p1.1)\.
- Greshakeet al\.\(2023\)K\. Greshake, S\. Abdelnabi, S\. Mishra, C\. Endres, T\. Holz, and M\. FritzNot what you’ve signed up for: compromising real\-world LLM\-integrated applications with indirect prompt injection\.InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security \(AISec ’23\),Copenhagen, Denmark,pp\. 79–90\.Note:arXiv:2302\.12173External Links:[Document](https://dx.doi.org/10.1145/3605764.3623985)Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§4](https://arxiv.org/html/2609.02265#S4.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1),[§9](https://arxiv.org/html/2609.02265#S9.SSx2.p1.1)\.
- Guoet al\.\(2017\)C\. Guo, G\. Pleiss, Y\. Sun, and K\. Q\. WeinbergerOn calibration of modern neural networks\.InProceedings of the 34th International Conference on Machine Learning \(ICML 2017\),Proceedings of Machine Learning Research, Vol\.70,pp\. 1321–1330\.External Links:1706\.04599Cited by:[§4](https://arxiv.org/html/2609.02265#S4.SS0.SSS0.Px1.p1.1)\.
- Guoet al\.\(2026\)Q\. Guo, Y\. Li, Y\. Liu, and B\. HooiTowards realistic personalization: evaluating long\-horizon preference following in personalized user\-LLM interactions\.arXiv preprint arXiv:2603\.04191\.Cited by:[§4](https://arxiv.org/html/2609.02265#S4.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Hineset al\.\(2024\)K\. Hines, G\. Lopez, M\. Hall, F\. Zarfati, Y\. Zunger, and E\. KicimanDefending against indirect prompt injection attacks with spotlighting\.InProceedings of the Conference on Applied Machine Learning for Information Security \(CAMLIS 2024\),CEUR Workshop Proceedings, Vol\.3920,Arlington, VA\.Note:arXiv:2403\.14720Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p3.1),[§5](https://arxiv.org/html/2609.02265#S5.SS0.SSS0.Px1.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Huet al\.\(2022\)E\. J\. Hu, Y\. Shen, P\. Wallis, Z\. Allen\-Zhu, Y\. Li, S\. Wang, L\. Wang, and W\. ChenLoRA: low\-rank adaptation of large language models\.InInternational Conference on Learning Representations \(ICLR 2022\),External Links:[Link](https://openreview.net/forum?id=nZeVKeeFYf9),2106\.09685Cited by:[§3\.1](https://arxiv.org/html/2609.02265#S3.SS1.p1.1)\.
- Jain and Wallace \(2019\)S\. Jain and B\. C\. WallaceAttention is not explanation\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(NAACL\-HLT 2019\),External Links:1902\.10186Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p5.1),[§3\.4](https://arxiv.org/html/2609.02265#S3.SS4.p2.1)\.
- Jianget al\.\(2025\)B\. Jiang, Z\. Hao, Y\. Cho, B\. Li, Y\. Yuan, S\. Chen, L\. Ungar, C\. J\. Taylor, and D\. RothKnow me, respond to me: benchmarking LLMs for dynamic user profiling and personalized responses at scale\.InSecond Conference on Language Modeling \(COLM\),Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Johnsonet al\.\(2021\)J\. Johnson, M\. Douze, and H\. JégouBillion\-scale similarity search with GPUs\.IEEE Transactions on Big Data7\(3\),pp\. 535–547\.External Links:[Document](https://dx.doi.org/10.1109/TBDATA.2019.2921572),1702\.08734Cited by:[§3\.3](https://arxiv.org/html/2609.02265#S3.SS3.p1.1)\.
- Kaelblinget al\.\(1998\)L\. P\. Kaelbling, M\. L\. Littman, and A\. R\. CassandraPlanning and acting in partially observable stochastic domains\.Artificial Intelligence101\(1–2\),pp\. 99–134\.External Links:[Document](https://dx.doi.org/10.1016/S0004-3702%2898%2900023-X)Cited by:[§2](https://arxiv.org/html/2609.02265#S2.SS0.SSS0.Px1.p1.1)\.
- Kidgeret al\.\(2020\)P\. Kidger, J\. Morrill, J\. Foster, and T\. LyonsNeural controlled differential equations for irregular time series\.InAdvances in Neural Information Processing Systems 33 \(NeurIPS 2020\),External Links:2005\.08926Cited by:[§3\.2](https://arxiv.org/html/2609.02265#S3.SS2.p1.2)\.
- Kirket al\.\(2024\)H\. R\. Kirk, A\. Whitefield, P\. Röttger, A\. Bean, K\. Margatina, J\. Ciro, R\. Mosquera, M\. Bartolo, A\. Williams, H\. He, B\. Vidgen, and S\. A\. HaleThe PRISM alignment dataset: what participatory, representative and individualised human feedback reveals about the subjective and multicultural alignment of large language models\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS 2024\) Datasets and Benchmarks Track,pp\. 105236–105344\.Cited by:[Appendix D](https://arxiv.org/html/2609.02265#A4.SS0.SSS0.Px2.p1.1),[§4](https://arxiv.org/html/2609.02265#S4.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Leeet al\.\(2024\)S\. Lee, S\. H\. Park, S\. Kim, and M\. SeoAligning to thousands of preferences via system message generalization\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS\),pp\. 73783–73829\.Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Lewiset al\.\(2020\)P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel, S\. Riedel, and D\. KielaRetrieval\-augmented generation for knowledge\-intensive NLP tasks\.InAdvances in Neural Information Processing Systems 33 \(NeurIPS 2020\),External Links:2005\.11401Cited by:[§5](https://arxiv.org/html/2609.02265#S5.SS0.SSS0.Px1.p2.1)\.
- Liet al\.\(2026\)S\. S\. Li, B\. Paranjape, K\. Oktar, Z\. Ma, G\. Zhou, L\. Guan, N\. Zhang, S\. Park, L\. Chen, D\. Yang, Y\. Tsvetkov, and A\. CelikyilmazHorizonBench: long\-horizon personalization with evolving preferences\.arXiv preprint arXiv:2604\.17283\.Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p7.1),[§6](https://arxiv.org/html/2609.02265#S6.SS0.SSS0.Px1.p1.1)\.
- Maharanaet al\.\(2024\)A\. Maharana, D\. Lee, S\. Tulyakov, M\. Bansal, F\. Barbieri, and Y\. FangEvaluating very long\-term conversational memory of LLM agents\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 13851–13870\.Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Mazeikaet al\.\(2024\)M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li, D\. Forsyth, and D\. HendrycksHarmBench: a standardized evaluation framework for automated red teaming and robust refusal\.InProceedings of the 41st International Conference on Machine Learning \(ICML 2024\),Proceedings of Machine Learning Research, Vol\.235,pp\. 35181–35224\.Note:arXiv:2402\.04249Cited by:[§4](https://arxiv.org/html/2609.02265#S4.SS0.SSS0.Px1.p1.1)\.
- Naeiniet al\.\(2015\)M\. P\. Naeini, G\. F\. Cooper, and M\. HauskrechtObtaining well calibrated probabilities using bayesian binning\.InProceedings of the 29th AAAI Conference on Artificial Intelligence \(AAAI 2015\),Vol\.29,pp\. 2901–2907\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v29i1.9602)Cited by:[§4](https://arxiv.org/html/2609.02265#S4.SS0.SSS0.Px1.p1.1)\.
- Ouyanget al\.\(2022\)L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. L\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. Christiano, J\. Leike, and R\. LoweTraining language models to follow instructions with human feedback\.InAdvances in Neural Information Processing Systems 35 \(NeurIPS\),pp\. 27730–27744\.Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Packeret al\.\(2023\)C\. Packer, S\. Wooders, K\. Lin, V\. Fang, S\. G\. Patil, I\. Stoica, and J\. E\. GonzalezMemGPT: towards LLMs as operating systems\.arXiv preprint arXiv:2310\.08560\.Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§5](https://arxiv.org/html/2609.02265#S5.SS0.SSS0.Px1.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Parket al\.\(2023\)J\. S\. Park, J\. C\. O’Brien, C\. J\. Cai, M\. R\. Morris, P\. Liang, and M\. S\. BernsteinGenerative agents: interactive simulacra of human behavior\.InProceedings of the 36th Annual ACM Symposium on User Interface Software and Technology \(UIST\),Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Pietet al\.\(2024\)J\. Piet, M\. Alrashed, C\. Sitawarin, S\. Chen, Z\. Wei, E\. Sun, B\. Alomair, and D\. WagnerJatmo: prompt injection defense by task\-specific finetuning\.InComputer Security – ESORICS 2024,Lecture Notes in Computer Science, Vol\.14982,Cham,pp\. 105–124\.Note:arXiv:2312\.17673External Links:[Document](https://dx.doi.org/10.1007/978-3-031-70879-4%5F6)Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Qiet al\.\(2025\)X\. Qi, A\. Panda, K\. Lyu, X\. Ma, S\. Roy, A\. Beirami, P\. Mittal, and P\. HendersonSafety alignment should be made more than just a few tokens deep\.InThe Thirteenth International Conference on Learning Representations \(ICLR 2025\),Note:Oral presentation; arXiv:2406\.05946Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Qiet al\.\(2024\)X\. Qi, Y\. Zeng, T\. Xie, P\. Chen, R\. Jia, P\. Mittal, and P\. HendersonFine\-tuning aligned language models compromises safety, even when users do not intend to\!\.InThe Twelfth International Conference on Learning Representations \(ICLR 2024\),Note:Oral presentation; arXiv:2310\.03693Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Rafailovet al\.\(2023\)R\. Rafailov, A\. Sharma, E\. Mitchell, C\. D\. Manning, S\. Ermon, and C\. FinnDirect preference optimization: your language model is secretly a reward model\.InAdvances in Neural Information Processing Systems 36 \(NeurIPS\),pp\. 53728–53741\.Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Röttgeret al\.\(2024\)P\. Röttger, H\. R\. Kirk, B\. Vidgen, G\. Attanasio, F\. Bianchi, and D\. HovyXSTest: a test suite for identifying exaggerated safety behaviours in large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 5377–5400\.Note:arXiv:2308\.01263External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.301)Cited by:[§4](https://arxiv.org/html/2609.02265#S4.SS0.SSS0.Px1.p1.1)\.
- Rubanovaet al\.\(2019\)Y\. Rubanova, R\. T\. Q\. Chen, and D\. DuvenaudLatent ODEs for irregularly\-sampled time series\.InAdvances in Neural Information Processing Systems 32 \(NeurIPS 2019\),External Links:1907\.03907Cited by:[Appendix B](https://arxiv.org/html/2609.02265#A2.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2609.02265#S1.p5.1)\.
- Salemiet al\.\(2024\)A\. Salemi, S\. Mysore, M\. Bendersky, and H\. ZamaniLaMP: when large language models meet personalization\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 7370–7392\.Cited by:[Appendix D](https://arxiv.org/html/2609.02265#A4.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§4](https://arxiv.org/html/2609.02265#S4.p1.1),[§4](https://arxiv.org/html/2609.02265#S4.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Soulyet al\.\(2024\)A\. Souly, Q\. Lu, D\. Bowen, T\. Trinh, E\. Hsieh, S\. Pandey, P\. Abbeel, J\. Svegliato, S\. Emmons, O\. Watkins, and S\. ToyerA StrongREJECT for empty jailbreaks\.InAdvances in Neural Information Processing Systems 37 \(NeurIPS 2024\) Datasets and Benchmarks Track,Note:arXiv:2402\.10260Cited by:[§4](https://arxiv.org/html/2609.02265#S4.SS0.SSS0.Px1.p1.1)\.
- Turpinet al\.\(2023\)M\. Turpin, J\. Michael, E\. Perez, and S\. R\. BowmanLanguage models don’t always say what they think: unfaithful explanations in chain\-of\-thought prompting\.InAdvances in Neural Information Processing Systems 36 \(NeurIPS 2023\),External Links:2305\.04388Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p5.1),[§3\.4](https://arxiv.org/html/2609.02265#S3.SS4.p2.1)\.
- Vermaet al\.\(2024\)S\. Verma, V\. Boonsanong, M\. Hoang, K\. E\. Hines, J\. P\. Dickerson, and C\. ShahCounterfactual explanations and algorithmic recourses for machine learning: a review\.ACM Computing Surveys56\(12\),pp\. 1–42\.External Links:[Document](https://dx.doi.org/10.1145/3677119),2010\.10596Cited by:[§3\.4](https://arxiv.org/html/2609.02265#S3.SS4.p2.2)\.
- Wachteret al\.\(2018\)S\. Wachter, B\. Mittelstadt, and C\. RussellCounterfactual explanations without opening the black box: automated decisions and the GDPR\.Harvard Journal of Law & Technology31\(2\),pp\. 841–887\.External Links:1711\.00399Cited by:[§3\.4](https://arxiv.org/html/2609.02265#S3.SS4.p2.2)\.
- Wanget al\.\(2025\)B\. Wang, W\. He, S\. Zeng, Z\. Xiang, Y\. Xing, J\. Tang, and P\. HeUnveiling privacy risks in LLM agent memory\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),Vienna, Austria,pp\. 25241–25260\.Note:The MEXTRA memory\-extraction attack; arXiv:2502\.13172External Links:[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1227)Cited by:[§4](https://arxiv.org/html/2609.02265#S4.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Wiegreffe and Pinter \(2019\)S\. Wiegreffe and Y\. PinterAttention is not not explanation\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing \(EMNLP 2019\),External Links:1908\.04626Cited by:[§3\.4](https://arxiv.org/html/2609.02265#S3.SS4.p2.1)\.
- Wuet al\.\(2025\)D\. Wu, H\. Wang, W\. Yu, Y\. Zhang, K\. Chang, and D\. YuLongMemEval: benchmarking chat assistants on long\-term interactive memory\.InThe Thirteenth International Conference on Learning Representations \(ICLR\),Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Yanget al\.\(2025\)A\. Yang, A\. Li, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Gao, C\. Huang, C\. Lv, C\. Zheng, D\. Liu, F\. Zhou, F\. Huang, F\. Hu, H\. Ge, H\. Wei, H\. Lin, J\. Tang, J\. Yang, J\. Tu, J\. Zhang, J\. Yang, J\. Yang, J\. Zhou, J\. Zhou, J\. Lin, K\. Dang, K\. Bao, K\. Yang, L\. Yu, L\. Deng, M\. Li, M\. Xue, M\. Li, P\. Zhang, P\. Wang, Q\. Zhu, R\. Men, R\. Gao, S\. Liu, S\. Luo, T\. Li, T\. Tang, W\. Yin, X\. Ren, X\. Wang, X\. Zhang, X\. Ren, Y\. Fan, Y\. Su, Y\. Zhang, Y\. Zhang, Y\. Wan, Y\. Liu, Z\. Wang, Z\. Cui, Z\. Zhang, Z\. Zhou, and Z\. QiuQwen3 technical report\.arXiv preprint arXiv:2505\.09388\.External Links:2505\.09388Cited by:[§5](https://arxiv.org/html/2609.02265#S5.SS0.SSS0.Px1.p1.1)\.
- Yanget al\.\(2024\)A\. Yang, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Li, D\. Liu, F\. Huang, H\. Wei, H\. Lin, J\. Yang, J\. Tu, J\. Zhang, J\. Yang, J\. Yang, J\. Zhou, J\. Lin, K\. Dang, K\. Lu, K\. Bao, K\. Yang, L\. Yu, M\. Li, M\. Xue, P\. Zhang, Q\. Zhu, R\. Men, R\. Lin, T\. Li, T\. Tang, T\. Xia, X\. Ren, X\. Ren, Y\. Fan, Y\. Su, Y\. Zhang, Y\. Wan, Y\. Liu, Z\. Cui, Z\. Zhang, and Z\. QiuQwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.External Links:2412\.15115Cited by:[Appendix B](https://arxiv.org/html/2609.02265#A2.SS0.SSS0.Px1.p1.1),[§5](https://arxiv.org/html/2609.02265#S5.SS0.SSS0.Px1.p1.1)\.
- Zhanet al\.\(2024\)Q\. Zhan, Z\. Liang, Z\. Ying, and D\. KangInjecAgent: benchmarking indirect prompt injections in tool\-integrated large language model agents\.InFindings of the Association for Computational Linguistics: ACL 2024,pp\. 10471–10506\.Note:arXiv:2403\.02691External Links:[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.624)Cited by:[§4](https://arxiv.org/html/2609.02265#S4.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Zhanget al\.\(2025\)Z\. Zhang, R\. A\. Rossi, B\. Kveton, Y\. Shao, D\. Yang, H\. Zamani, F\. Dernoncourt, J\. Barrow, T\. Yu, S\. Kim,et al\.Personalization of large language models: a survey\.Transactions on Machine Learning Research\.Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Zhaoet al\.\(2025\)S\. Zhao, M\. Hong, Y\. Liu, D\. Hazarika, and K\. LinDo LLMs recognize your preferences? evaluating personalized preference following in LLMs\.InThe Thirteenth International Conference on Learning Representations \(ICLR\),Note:Oral presentationCited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Zhonget al\.\(2024\)W\. Zhong, L\. Guo, Q\. Gao, H\. Ye, and Y\. WangMemoryBank: enhancing large language models with long\-term memory\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.38,pp\. 19724–19731\.Cited by:[§1](https://arxiv.org/html/2609.02265#S1.p1.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Zinkevich \(2003\)M\. ZinkevichOnline convex programming and generalized infinitesimal gradient ascent\.InProceedings of the 20th International Conference on Machine Learning \(ICML 2003\),pp\. 928–936\.Cited by:[§2](https://arxiv.org/html/2609.02265#S2.SS0.SSS0.Px2.p1.2)\.
- Zolloet al\.\(2025\)T\. P\. Zollo, A\. W\. T\. Siah, N\. Ye, A\. Li, and H\. NamkoongPersonalLLM: tailoring LLMs to individual preferences\.InThe Thirteenth International Conference on Learning Representations \(ICLR\),Cited by:[Appendix D](https://arxiv.org/html/2609.02265#A4.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2609.02265#S1.p3.1),[§4](https://arxiv.org/html/2609.02265#S4.p1.1),[§4](https://arxiv.org/html/2609.02265#S4.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px1.p1.1)\.
- Zouet al\.\(2023\)A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. FredriksonUniversal and transferable adversarial attacks on aligned language models\.arXiv preprint arXiv:2307\.15043\.Note:No peer\-reviewed venue; arXiv preprint only as of 2026\-08\-30Cited by:[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1)\.
- Zouet al\.\(2025\)W\. Zou, R\. Geng, B\. Wang, and J\. JiaPoisonedRAG: knowledge corruption attacks to retrieval\-augmented generation of large language models\.In34th USENIX Security Symposium \(USENIX Security 25\),Seattle, WA,pp\. 3827–3844\.Note:arXiv:2402\.07867Cited by:[§4](https://arxiv.org/html/2609.02265#S4.p2.1),[§7](https://arxiv.org/html/2609.02265#S7.SS0.SSS0.Px2.p1.1),[§9](https://arxiv.org/html/2609.02265#S9.SSx2.p1.1)\.

## Appendix AFormal Setting, Theorems, and Proofs

### A\.1Setting and notation

Fix a turnttat which the extractor emits a candidate claim contradicting an existing ledger nodenn\. Let\(ℋ,Σℋ\)\(\\mathcal\{H\},\\Sigma\_\{\\mathcal\{H\}\}\)be the measurable space of observable interaction histories up to and including the candidate event, withHHa generic element, and letZ∈\{g,a\}Z\\in\\\{g,a\\\}be the latent label of the claim in the senses fixed by Assumptions[3](https://arxiv.org/html/2609.02265#Thmassumption3)and[4](https://arxiv.org/html/2609.02265#Thmassumption4)\.

###### Definition 1\(Restricted view\)\.

LetΦ=\[0,∞\]×𝒪\\Phi=\[0,\\infty\]\\times\\mathcal\{O\}carry the product of the Borel and discreteσ\\sigma\-algebras, where𝒪=\{user channel,tool output,retrieved document,shared file\}\\mathcal\{O\}=\\\{\\textrm\{user channel\},\\textrm\{tool output\},\\textrm\{retrieved document\},\\textrm\{shared file\}\\\}\. WriteTtT\_\{t\}for the timestamp of the candidate event andℓt\\ell\_\{t\}for the index of the most recent event that wrote or corroboratednn, withrt=Tt−Tℓtr\_\{t\}=T\_\{t\}\-T\_\{\\ell\_\{t\}\}andrt=∞r\_\{t\}=\\inftyby convention when no such event exists\. The restricted view is

φ⁡\(H\)=\(rt,ot\),\\varphi\(H\)=\(r\_\{t\},\\;o\_\{t\}\),\(7\)withoto\_\{t\}the channel label of the candidate event\. Any fixed trust score that is a function ofoto\_\{t\}alone is admissible\. No history\-dependent score is included\.

###### Assumption 1\(Measurability of the view\)\.

φ\\varphiisΣℋ/ΣΦ\\Sigma\_\{\\mathcal\{H\}\}/\\Sigma\_\{\\Phi\}\-measurable\. This is an assumption rather than a consequence, becauseℓt\\ell\_\{t\}is defined through the predicate “wrote or corroboratednn”, which is a property of the extractor’s annotation of the history and not of its raw text\. In our implementation the annotation is produced by a deterministic function of the logged event stream, which makesℓt\\ell\_\{t\}a measurable selection, but a different instantiation of that predicate would require the assumption to be rechecked\.

LetPgP\_\{g\}denote the law ofHHconditional onZ=gZ=g, and for an adversary policyα∈𝒜\\alpha\\in\\mathcal\{A\}letPαP\_\{\\alpha\}denote the law conditional onZ=aZ=aunderα\\alpha\. We writeλ=Pg\+Pα\\lambda=P\_\{g\}\+P\_\{\\alpha\}, a finite measure dominating both, andp=d​Pg/d​λp=\\mathrm\{d\}P\_\{g\}/\\mathrm\{d\}\\lambda,q=d​Pα/d​λq=\\mathrm\{d\}P\_\{\\alpha\}/\\mathrm\{d\}\\lambda, so thatp\+q=1p\+q=1holdsλ\\lambda\-almost everywhere\. No absolute continuity betweenPgP\_\{g\}andPαP\_\{\\alpha\}is needed, since everything is expressed throughλ\\lambda\. For any sub\-σ\\sigma\-algebra𝒢⊆Σℋ\\mathcal\{G\}\\subseteq\\Sigma\_\{\\mathcal\{H\}\}writeP\|𝒢P\|\_\{\\mathcal\{G\}\}for the restriction and

TV𝒢=TV⁡\(Pg\|𝒢,Pα\|𝒢\)=12​∫\|𝔼λ​\[p−q∣𝒢\]\|​𝑑λ\.\\mathrm\{TV\}\_\{\\mathcal\{G\}\}\\;=\\;\\mathrm\{TV\}\\big\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\\big\)\\;=\\;\\tfrac\{1\}\{2\}\\int\\big\|\\mathbb\{E\}\_\{\\lambda\}\[\\,p\-q\\mid\\mathcal\{G\}\\,\]\\big\|\\,\\mathrm\{d\}\\lambda\.\(8\)Equation[8](https://arxiv.org/html/2609.02265#A1.E8)is a lemma rather than a definition and three of its ingredients are worth naming, sinceλ\\lambdais not a probability measure\. Writingλ=2​m\\lambda=2mfor the probability measurem=12​\(Pg\+Pα\)m=\\tfrac\{1\}\{2\}\(P\_\{g\}\+P\_\{\\alpha\}\)and using the invariance of conditional expectation under rescaling of the measure, existence of𝔼λ\[⋅∣𝒢\]\\mathbb\{E\}\_\{\\lambda\}\[\\cdot\\mid\\mathcal\{G\}\]and validity of conditional Jensen both reduce to the probability case\. The identificationd​Pg\|𝒢/d​λ\|𝒢=𝔼λ​\[p∣𝒢\]\\mathrm\{d\}P\_\{g\}\|\_\{\\mathcal\{G\}\}/\\mathrm\{d\}\\lambda\|\_\{\\mathcal\{G\}\}=\\mathbb\{E\}\_\{\\lambda\}\[p\\mid\\mathcal\{G\}\]holds becausePg​\(A\)=∫Ap​𝑑λ=∫A𝔼λ​\[p∣𝒢\]​𝑑λP\_\{g\}\(A\)=\\int\_\{A\}p\\,\\mathrm\{d\}\\lambda=\\int\_\{A\}\\mathbb\{E\}\_\{\\lambda\}\[p\\mid\\mathcal\{G\}\]\\,\\mathrm\{d\}\\lambdafor everyA∈𝒢A\\in\\mathcal\{G\}, which is the defining property of conditional expectation\. The two cases of interest are𝒢=σ⁡\(φ\)\\mathcal\{G\}=\\sigma\(\\varphi\)and𝒢=Σℋ\\mathcal\{G\}=\\Sigma\_\{\\mathcal\{H\}\}, abbreviatedTVφ​\(α\)\\mathrm\{TV\}\_\{\\varphi\}\(\\alpha\)andTVℋ​\(α\)\\mathrm\{TV\}\_\{\\mathcal\{H\}\}\(\\alpha\)with the adversary shown explicitly, since suppressing it is the commonest way to confuse these quantities withδ\\delta\.

###### Definition 2\(Rules and error rates\)\.

A rule measurable with respect to𝒢\\mathcal\{G\}is a𝒢\\mathcal\{G\}\-measurable mapd:ℋ→\[0,1\]d:\\mathcal\{H\}\\to\[0,1\], whered⁡\(H\)d\(H\)is the probability of accepting the update\. Values in the open interval cover randomized rules, and since both error rates below are linear indd, no further randomization enlarges the achievable set\. The error rates are

FUR⁡\(d,α\)=∫d​d​Pα,RRL⁡\(d\)=1−∫d​d​Pg\.\\mathrm\{FUR\}\(d;\\alpha\)=\\int d\\,\\mathrm\{d\}P\_\{\\alpha\},\\qquad\\mathrm\{RRL\}\(d\)=1\-\\int d\\,\\mathrm\{d\}P\_\{g\}\.\(9\)By the Doob\-Dynkin lemma aσ⁡\(φ\)\\sigma\(\\varphi\)\-measurableddfactors asd=d~∘φd=\\tilde\{d\}\\circ\\varphifor a measurabled~:Φ→\[0,1\]\\tilde\{d\}:\\Phi\\to\[0,1\], so rules on the restricted view andσ⁡\(φ\)\\sigma\(\\varphi\)\-measurable rules onℋ\\mathcal\{H\}are the same object\.

### A\.2Assumptions

###### Assumption 2\(Restricted access\)\.

The rule under analysis isσ⁡\(φ\)\\sigma\(\\varphi\)\-measurable and may not condition on any other function ofHH\.

###### Assumption 3\(Legitimate update\)\.

Z=gZ=gholds exactly when the user’s intended preference has genuinely changed, the change affects the stable, contextual, or transient component thatnnencodes, the user expresses the change at turnttor confirms it subsequently, and an oracle ledger would add, revise, or rescopennin consequence\. Unexpressed latent changes are excluded, as are typos, sarcasm, and unresolved ambiguity, which are treated in Theorem[4](https://arxiv.org/html/2609.02265#Thmtheorem4)\.

###### Assumption 4\(Adversary\)\.

The adversary observes the visible transcript, its timestamps, and the visible source labels\. Following Kerckhoffs’s principle it knows the architecture, algorithm, hyperparameters, and released adapter weights\. It does not observe the private ledger, the latent user state, the gate’s current confidence, or the random seeds\. The clarification thresholdηclr=1\.24\\eta\_\{\\mathrm\{clr\}\}=1\.24is a fixed hyperparameter and is therefore known to it\. It may choose the timing of an injection among the opportunities at which it controls or influences content, may choose among compromised tools, retrieved documents, and shared files, may choose arbitrary surface wording subject to normal length and safety constraints, and may adapt using the visible transcript\. It cannot directly impersonate an authenticated user and it cannot corrupt the answer returned by a clarifying question\. We further assume thatPgP\_\{g\}does not depend onα\\alpha\. This is a real restriction and generation order does not secure it, since injected content inserted earlier in an episode changes the history preceding a later genuine claim\. It holds only when no episode contributing toPgP\_\{g\}also contains injected content, which is exactly how the matched split of Appendix[A\.6](https://arxiv.org/html/2609.02265#A1.SS6)is constructed and is why the empirical statements are made on that split rather than on the T3 track as a whole\. Write𝒜\\mathcal\{A\}for the feasible set, assumed non\-empty, and

δ𝒢=infα∈𝒜TV⁡\(Pg\|𝒢,Pα\|𝒢\)\.\\delta\_\{\\mathcal\{G\}\}\\;=\\;\\inf\_\{\\alpha\\in\\mathcal\{A\}\}\\mathrm\{TV\}\\big\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\\big\)\.\(10\)

### A\.3Part 1\. The testing lower bound

###### Theorem 2\(Impossibility\)\.

Let𝒢⊆Σℋ\\mathcal\{G\}\\subseteq\\Sigma\_\{\\mathcal\{H\}\}be any sub\-σ\\sigma\-algebra\. The statement uses only Assumption[1](https://arxiv.org/html/2609.02265#Thmassumption1)and the definitions; Assumption[2](https://arxiv.org/html/2609.02265#Thmassumption2)is the special case𝒢=σ⁡\(φ\)\\mathcal\{G\}=\\sigma\(\\varphi\)that the paper applies it to, and Assumptions[3](https://arxiv.org/html/2609.02265#Thmassumption3)and[4](https://arxiv.org/html/2609.02265#Thmassumption4)fix whatPgP\_\{g\}andPαP\_\{\\alpha\}denote without entering the proof\. For every𝒢\\mathcal\{G\}\-measurable ruleddand everyα∈𝒜\\alpha\\in\\mathcal\{A\},

FUR⁡\(d,α\)\+RRL⁡\(d\)≥1−TV⁡\(Pg\|𝒢,Pα\|𝒢\),\\mathrm\{FUR\}\(d;\\alpha\)\+\\mathrm\{RRL\}\(d\)\\;\\geq\\;1\-\\mathrm\{TV\}\\big\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\\big\),\(11\)with equality for the likelihood\-ratio ruledα⋆=𝟏\{𝔼λ\[p∣𝒢\]\>𝔼λ\[q∣𝒢\]\}d^\{\\star\}\_\{\\alpha\}=\\mathbf\{1\}\\\{\\mathbb\{E\}\_\{\\lambda\}\[p\\mid\\mathcal\{G\}\]\>\\mathbb\{E\}\_\{\\lambda\}\[q\\mid\\mathcal\{G\}\]\\\}\. Consequently, for every𝒢\\mathcal\{G\}\-measurabledd,

supα∈𝒜\[FUR⁡\(d,α\)\+RRL⁡\(d\)\]≥1−δ𝒢\.\\sup\_\{\\alpha\\in\\mathcal\{A\}\}\\Big\[\\mathrm\{FUR\}\(d;\\alpha\)\+\\mathrm\{RRL\}\(d\)\\Big\]\\;\\geq\\;1\-\\delta\_\{\\mathcal\{G\}\}\.\(12\)Taking𝒢=σ⁡\(φ\)\\mathcal\{G\}=\\sigma\(\\varphi\)gives the statement quoted in Section[2](https://arxiv.org/html/2609.02265#S2)\.

###### Proof\.

Fixα\\alphaand letμ=\(Pg−Pα\)\|𝒢\\mu=\(P\_\{g\}\-P\_\{\\alpha\}\)\|\_\{\\mathcal\{G\}\}, a finite signed measure withμ⁡\(ℋ\)=0\\mu\(\\mathcal\{H\}\)=0\. By Definition[2](https://arxiv.org/html/2609.02265#Thmdefinition2),

FUR⁡\(d,α\)\+RRL⁡\(d\)=1\+∫d​d​Pα−∫d​d​Pg=1−∫d​𝑑μ,\\mathrm\{FUR\}\(d;\\alpha\)\+\\mathrm\{RRL\}\(d\)=1\+\\int d\\,\\mathrm\{d\}P\_\{\\alpha\}\-\\int d\\,\\mathrm\{d\}P\_\{g\}=1\-\\int d\\,\\mathrm\{d\}\\mu,\(13\)where the integrals depend onddonly through its𝒢\\mathcal\{G\}\-restriction\. Sinceddis measurable with0≤d≤10\\leq d\\leq 1,

∫d​𝑑μ≤supf​𝒢​\-meas\.0≤f≤1∫f​𝑑μ=μ\+​\(ℋ\)=TV⁡\(Pg\|𝒢,Pα\|𝒢\),\\int d\\,\\mathrm\{d\}\\mu\\;\\leq\\;\\sup\_\{\\begin\{subarray\}\{c\}f\\ \\mathcal\{G\}\\textrm\{\-meas\.\}\\\\ 0\\leq f\\leq 1\\end\{subarray\}\}\\int f\\,\\mathrm\{d\}\\mu\\;=\\;\\mu^\{\+\}\(\\mathcal\{H\}\)\\;=\\;\\mathrm\{TV\}\\big\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\\big\),\(14\)in which the first equality is Hahn\-Jordan, the supremum being attained at the indicator of the Hahn positive set, and the second usesμ⁡\(ℋ\)=0\\mu\(\\mathcal\{H\}\)=0, which is what makessupAμ⁡\(A\)\\sup\_\{A\}\\mu\(A\)equal to12​‖μ‖1\\tfrac\{1\}\{2\}\\\|\\mu\\\|\_\{1\}and hence to the total variation distance between two probability measures\. Substituting gives Equation[11](https://arxiv.org/html/2609.02265#A1.E11), and the maximizing indicator isdα⋆d^\{\\star\}\_\{\\alpha\}, giving equality\. For Equation[12](https://arxiv.org/html/2609.02265#A1.E12), note that Equation[11](https://arxiv.org/html/2609.02265#A1.E11)holds for everyα\\alpha, so taking suprema on both sides and usingsupα\[1−TV\]=1−infαTV\\sup\_\{\\alpha\}\[1\-\\mathrm\{TV\}\]=1\-\\inf\_\{\\alpha\}\\mathrm\{TV\}yields the claim\. ∎

Two caveats belong with this theorem and we state them rather than leaving them to a reader\.

###### Corollary 1\(Bayes form\)\.

LetZ=aZ=ahave priorπ∈\(0,1\)\\pi\\in\(0,1\)under zero\-one loss\. The Bayes risk over𝒢\\mathcal\{G\}\-measurable rules is

Rπ⋆=\(1−π\)−ν\+​\(ℋ\),ν=\(\(1−π\)​Pg−π​Pα\)\|𝒢,R^\{\\star\}\_\{\\pi\}=\(1\-\\pi\)\-\\nu^\{\+\}\(\\mathcal\{H\}\),\\qquad\\nu=\\big\(\(1\-\\pi\)P\_\{g\}\-\\pi P\_\{\\alpha\}\\big\)\\big\|\_\{\\mathcal\{G\}\},\(15\)and atπ=12\\pi=\\tfrac\{1\}\{2\}this reduces toR⋆=12​\(1−TV⁡\(Pg\|𝒢,Pα\|𝒢\)\)R^\{\\star\}=\\tfrac\{1\}\{2\}\(1\-\\mathrm\{TV\}\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\)\)\.

###### Proof\.

Rπ​\(d\)=π​∫d​d​Pα\+\(1−π\)​∫\(1−d\)​d​Pg=\(1−π\)−∫d​𝑑νR\_\{\\pi\}\(d\)=\\pi\\int d\\,\\mathrm\{d\}P\_\{\\alpha\}\+\(1\-\\pi\)\\int\(1\-d\)\\,\\mathrm\{d\}P\_\{g\}=\(1\-\\pi\)\-\\int d\\,\\mathrm\{d\}\\nu, and minimizing over0≤d≤10\\leq d\\leq 1maximizes the integral, which equalsν\+​\(ℋ\)\\nu^\{\+\}\(\\mathcal\{H\}\)by Hahn\-Jordan\. Note that forπ≠12\\pi\\neq\\tfrac\{1\}\{2\}the signed measureν\\nuhas total mass1−2​π≠01\-2\\pi\\neq 0, so it is not a difference of probability measures and the identification ofν\+\\nu^\{\+\}with a total variation distance is unavailable; only the Hahn\-Jordan half of the argument carries over\. Atπ=12\\pi=\\tfrac\{1\}\{2\}we haveν=12​\(Pg−Pα\)\|𝒢\\nu=\\tfrac\{1\}\{2\}\(P\_\{g\}\-P\_\{\\alpha\}\)\|\_\{\\mathcal\{G\}\}, soν\+​\(ℋ\)=12​TV\\nu^\{\+\}\(\\mathcal\{H\}\)=\\tfrac\{1\}\{2\}\\mathrm\{TV\}andR⋆=12−12​TVR^\{\\star\}=\\tfrac\{1\}\{2\}\-\\tfrac\{1\}\{2\}\\mathrm\{TV\}\. ∎

### A\.4Part 2\. Conditioning on the history

###### Theorem 3\(Data processing, with equality condition\)\.

For everyα∈𝒜\\alpha\\in\\mathcal\{A\}and every pair of sub\-σ\\sigma\-algebras𝒢⊆𝒢′⊆Σℋ\\mathcal\{G\}\\subseteq\\mathcal\{G\}^\{\\prime\}\\subseteq\\Sigma\_\{\\mathcal\{H\}\},

TV⁡\(Pg\|𝒢,Pα\|𝒢\)≤TV⁡\(Pg\|𝒢′,Pα\|𝒢′\),\\mathrm\{TV\}\\big\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\\big\)\\;\\leq\\;\\mathrm\{TV\}\\big\(P\_\{g\}\|\_\{\\mathcal\{G\}^\{\\prime\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}^\{\\prime\}\}\\big\),\(16\)and consequentlyδ𝒢≤δ𝒢′\\delta\_\{\\mathcal\{G\}\}\\leq\\delta\_\{\\mathcal\{G\}^\{\\prime\}\}\. The following two statements concern the displayed inequality at a fixedα\\alphaand not the inequality between the infima, which may be an equality even when everyα\\alphagives a strict gap\. Equality atα\\alphaholds if and only if

\|𝔼λ​\[p−q∣𝒢\]\|=𝔼λ​\[\|𝔼λ​\[p−q∣𝒢′\]\|\|𝒢\]λ​\-a\.e\.,\\big\|\\mathbb\{E\}\_\{\\lambda\}\[\\,p\-q\\mid\\mathcal\{G\}\\,\]\\big\|\\;=\\;\\mathbb\{E\}\_\{\\lambda\}\\big\[\\,\\big\|\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}^\{\\prime\}\]\\big\|\\;\\big\|\\;\\mathcal\{G\}\\,\\big\]\\qquad\\lambda\\textrm\{\-a\.e\.\},\(17\)that is, if and only if𝔼λ​\[p−q∣𝒢′\]\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}^\{\\prime\}\]has an almost surely constant sign conditionally on𝒢\\mathcal\{G\}\. The displayed inequality atα\\alphais therefore strict exactly when

λ⁡\(Prλ⁡\(𝔼λ​\[p−q∣𝒢′\]\>0\|𝒢\)\>0​and​Prλ​\(𝔼λ​\[p−q∣𝒢′\]<0\|𝒢\)\>0\)\>0\.\\lambda\\Big\(\\Pr\\nolimits\_\{\\lambda\}\\big\(\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}^\{\\prime\}\]\>0\\;\\big\|\\;\\mathcal\{G\}\\big\)\>0\\;\\textrm\{ and \}\\;\\Pr\\nolimits\_\{\\lambda\}\\big\(\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}^\{\\prime\}\]<0\\;\\big\|\\;\\mathcal\{G\}\\big\)\>0\\Big\)\\;\>\\;0\.\(18\)Separately, every𝒢\\mathcal\{G\}\-measurable rule is𝒢′\\mathcal\{G\}^\{\\prime\}\-measurable, so the achievable set of\(FUR,RRL\)\(\\mathrm\{FUR\},\\mathrm\{RRL\}\)pairs under𝒢\\mathcal\{G\}is a subset of that under𝒢′\\mathcal\{G\}^\{\\prime\}and no rule on the coarser view can outperform the best rule on the finer one\.

###### Proof\.

Applying Equation[8](https://arxiv.org/html/2609.02265#A1.E8)at each level and using the tower property,𝔼λ​\[p−q∣𝒢\]=𝔼λ​\[𝔼λ​\[p−q∣𝒢′\]∣𝒢\]\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}\]=\\mathbb\{E\}\_\{\\lambda\}\[\\,\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}^\{\\prime\}\]\\mid\\mathcal\{G\}\\,\]\. Conditional Jensen applied to the convex functionx↦\|x\|x\\mapsto\|x\|gives

\|𝔼λ​\[p−q∣𝒢\]\|≤𝔼λ​\[\|𝔼λ​\[p−q∣𝒢′\]\|\|𝒢\]λ​\-a\.e\.,\\big\|\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}\]\\big\|\\;\\leq\\;\\mathbb\{E\}\_\{\\lambda\}\\big\[\\,\\big\|\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}^\{\\prime\}\]\\big\|\\;\\big\|\\;\\mathcal\{G\}\\,\\big\]\\qquad\\lambda\\textrm\{\-a\.e\.\},\(19\)and integrating againstλ\\lambdaand halving gives the inequality, since the outer expectation integrates to∫\|𝔼λ​\[p−q∣𝒢′\]\|​𝑑λ\\int\|\\mathbb\{E\}\_\{\\lambda\}\[p\-q\\mid\\mathcal\{G\}^\{\\prime\}\]\|\\,\\mathrm\{d\}\\lambda\. Monotonicity of the infimum then givesδ𝒢≤δ𝒢′\\delta\_\{\\mathcal\{G\}\}\\leq\\delta\_\{\\mathcal\{G\}^\{\\prime\}\}\. Equality in an integrated Jensen inequality holds if and only if it holds pointwise almost everywhere, which is Equation[17](https://arxiv.org/html/2609.02265#A1.E17), and equality in\|𝔼⁡\[X∣𝒢\]\|=𝔼⁡\[\|X\|∣𝒢\]\|\\mathbb\{E\}\[X\\mid\\mathcal\{G\}\]\|=\\mathbb\{E\}\[\|X\|\\mid\\mathcal\{G\}\]holds if and only ifXXhas almost surely constant sign given𝒢\\mathcal\{G\}, which is the negation of Equation[18](https://arxiv.org/html/2609.02265#A1.E18)\. The final sentence is immediate, since a𝒢\\mathcal\{G\}\-measurableddis𝒢′\\mathcal\{G\}^\{\\prime\}\-measurable with the sameFUR\\mathrm\{FUR\}andRRL\\mathrm\{RRL\}\. ∎

Equation[18](https://arxiv.org/html/2609.02265#A1.E18)is the formal content of the claim that the trajectory carries information the restricted view discards\. Two events arriving the same number of days after the last corroboration and on the same channel can differ in whether the belief they contradict was itself recently revised, whether the contradiction repeats a pattern the user has shown before, and whether corroborating evidence appeared in between\. When those differences move the conditional likelihood ratio to opposite signs on a positive\-measure set of views, the inequality is strict\.

### A\.5Part 3\. Clarification

Theorem[2](https://arxiv.org/html/2609.02265#Thmtheorem2)constrains rules that must decide\. It says nothing about a rule that may decline and ask, because asking changes the available information rather than the map applied to it\. Making that precise requires the answer, its accuracy, and the cost to be defined\.

###### Assumption 5\(Clarification channel\)\.

The agent may take a third action𝖺𝗌𝗄\\mathsf\{ask\}, which incurs a fixed costκ\>0\\kappa\>0in the units of the zero\-one loss and returns a labelZ~\\tilde\{Z\}through a binary symmetric channel, meaning

Pr⁡\(Z~≠Z∣Z=g\)=Pr⁡\(Z~≠Z∣Z=a\)=ε∈\[0,12\),\\Pr\(\\tilde\{Z\}\\neq Z\\mid Z=g\)=\\Pr\(\\tilde\{Z\}\\neq Z\\mid Z=a\)=\\varepsilon\\in\[0,\\tfrac\{1\}\{2\}\),\(20\)withZ~\\tilde\{Z\}conditionally independent ofHHgivenZZ\. Symmetry is required and not cosmetic, since an asymmetric channel makes the ask\-branch loss depend on the posterior and the analysis below fails\.

###### Theorem 4\(Clarification strictly enlarges the achievable region\)\.

Fixα∈𝒜\\alpha\\in\\mathcal\{A\}and a sub\-σ\\sigma\-algebra𝒢\\mathcal\{G\}, adopt equal priors, writem=12​\(Pg\+Pα\)m=\\tfrac\{1\}\{2\}\(P\_\{g\}\+P\_\{\\alpha\}\), and letζ=𝔼λ​\[q∣𝒢\]\\zeta=\\mathbb\{E\}\_\{\\lambda\}\[q\\mid\\mathcal\{G\}\], which under equal priors is the posteriorPr⁡\(Z=a∣𝒢\)\\Pr\(Z=a\\mid\\mathcal\{G\}\)in the joint law whoseHH\-marginal ismmand whose label marginal is uniform\. Lete=min⁡\{ζ,1−ζ\}e=\\min\\\{\\zeta,1\-\\zeta\\\}be the pointwise conditional error of the best no\-query decision\. Consider policies that ask on a𝒢\\mathcal\{G\}\-measurable set and, having asked, act onZ~\\tilde\{Z\}\. Within that class the optimal policy asks on

Qκ=\{e\>κ\+ε\},Q\_\{\\kappa\}=\\\{e\>\\kappa\+\\varepsilon\\\},\(21\)in the sense that some optimal policy asks exactly there, every optimal policy asksmm\-a\.e\. on\{e\>κ\+ε\}\\\{e\>\\kappa\+\\varepsilon\\\}and does not ask on\{e<κ\+ε\}\\\{e<\\kappa\+\\varepsilon\\\}, and ties on\{e=κ\+ε\}\\\{e=\\kappa\+\\varepsilon\\\}may be broken arbitrarily\. Its risk is

Rκ⋆=𝔼m​\[min⁡\{e,κ\+ε\}\]≤R⋆=𝔼m​\[e\]=12​\(1−TV⁡\(Pg\|𝒢,Pα\|𝒢\)\),R^\{\\star\}\_\{\\kappa\}=\\mathbb\{E\}\_\{m\}\\big\[\\min\\\{e,\\;\\kappa\+\\varepsilon\\\}\\big\]\\;\\leq\\;R^\{\\star\}=\\mathbb\{E\}\_\{m\}\[e\]=\\tfrac\{1\}\{2\}\\big\(1\-\\mathrm\{TV\}\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\)\\big\),\(22\)with strict inequality if and only ifm⁡\(Qκ\)\>0m\(Q\_\{\\kappa\}\)\>0\. In particular, always asking beats every no\-query rule when

κ\+ε<12​\(1−TV⁡\(Pg\|𝒢,Pα\|𝒢\)\),\\kappa\+\\varepsilon\\;<\\;\\tfrac\{1\}\{2\}\\big\(1\-\\mathrm\{TV\}\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\}\|\_\{\\mathcal\{G\}\}\)\\big\),\(23\)and this conclusion is not restricted to the policy class above, since the unrestricted optimum is no worse thanRκ⋆R^\{\\star\}\_\{\\kappa\}\.

###### Proof\.

A policy is a𝒢\\mathcal\{G\}\-measurableρ\\rhointoΔ⁡\(\{𝖺𝖼𝖼,𝗋𝖾𝗃,𝖺𝗌𝗄\}\)\\Delta\(\\\{\\mathsf\{acc\},\\mathsf\{rej\},\\mathsf\{ask\}\\\}\)\. Conditionally on𝒢\\mathcal\{G\}, choosing𝖺𝖼𝖼\\mathsf\{acc\}costsζ\\zetaand choosing𝗋𝖾𝗃\\mathsf\{rej\}costs1−ζ1\-\\zeta\. Choosing𝖺𝗌𝗄\\mathsf\{ask\}and acting onZ~\\tilde\{Z\}costsκ\\kappaplus the probability of error, which isPr⁡\(Z~≠Z∣𝒢\)=ζ​ε\+\(1−ζ\)​ε=ε\\Pr\(\\tilde\{Z\}\\neq Z\\mid\\mathcal\{G\}\)=\\zeta\\,\\varepsilon\+\(1\-\\zeta\)\\,\\varepsilon=\\varepsilonby the symmetry in Assumption[5](https://arxiv.org/html/2609.02265#Thmassumption5), and is therefore constant in𝒢\\mathcal\{G\}\. HenceR⁡\(ρ\)=𝔼m​\[ρ𝖺𝖼𝖼​ζ\+ρ𝗋𝖾𝗃​\(1−ζ\)\+ρ𝖺𝗌𝗄​\(κ\+ε\)\]R\(\\rho\)=\\mathbb\{E\}\_\{m\}\[\\rho\_\{\\mathsf\{acc\}\}\\zeta\+\\rho\_\{\\mathsf\{rej\}\}\(1\-\\zeta\)\+\\rho\_\{\\mathsf\{ask\}\}\(\\kappa\+\\varepsilon\)\], an integral of a conditional expectation, minimized by placing mass pointwise on an arg\-min of\{ζ,1−ζ,κ\+ε\}\\\{\\zeta,1\-\\zeta,\\kappa\+\\varepsilon\\\}, which attains𝔼m​\[min⁡\{e,κ\+ε\}\]\\mathbb\{E\}\_\{m\}\[\\min\\\{e,\\kappa\+\\varepsilon\\\}\]and describes the ask set up to ties as stated\. The minimum differs fromeeexactly onQκQ\_\{\\kappa\}, giving strictness if and only ifm⁡\(Qκ\)\>0m\(Q\_\{\\kappa\}\)\>0\. The identity𝔼m​\[e\]=12​\(1−TV\)\\mathbb\{E\}\_\{m\}\[e\]=\\tfrac\{1\}\{2\}\(1\-\\mathrm\{TV\}\)follows by the same pointwise minimization applied to the two\-action problem, which is the computation behind Corollary[1](https://arxiv.org/html/2609.02265#Thmcorollary1)rather than a citation of it\. Finally, the constant policyρ≡𝖺𝗌𝗄\\rho\\equiv\\mathsf\{ask\}has riskκ\+ε\\kappa\+\\varepsilon, so under Equation[23](https://arxiv.org/html/2609.02265#A1.E23)it beats the Bayes\-optimal no\-query rule and hence every no\-query rule; since that policy lies in the restricted class, the conclusion holds a fortiori for the unrestricted problem\. ∎

### A\.6Estimating the two distances

Theorem[2](https://arxiv.org/html/2609.02265#Thmtheorem2)is only as useful as the distances are measurable, so we state the protocol together with what it does and does not establish\.

#### One adversary, not the infimum\.

Every quantity below is computed against the single adversary policy realized inD\-PrefGuard, which we writeα0\\alpha\_\{0\}\. Sinceδ𝒢=infαTV\\delta\_\{\\mathcal\{G\}\}=\\inf\_\{\\alpha\}\\mathrm\{TV\}is an infimum over the feasible set, estimates atα0\\alpha\_\{0\}boundTV⁡\(Pg\|𝒢,Pα0\|𝒢\)\\mathrm\{TV\}\(P\_\{g\}\|\_\{\\mathcal\{G\}\},P\_\{\\alpha\_\{0\}\}\|\_\{\\mathcal\{G\}\}\)and say nothing directly aboutδ𝒢\\delta\_\{\\mathcal\{G\}\}\. The empirical statements therefore instantiate the fixed\-α\\alphaEquation[11](https://arxiv.org/html/2609.02265#A1.E11)and not the worst\-case Equation[12](https://arxiv.org/html/2609.02265#A1.E12)\.

#### Matched evaluation\.

FUR\\mathrm\{FUR\}andRRL\\mathrm\{RRL\}are defined against a single pair\(Pg,Pα0\)\(P\_\{g\},P\_\{\\alpha\_\{0\}\}\)\. The aggregate Poison ASR and genuine\-update adherence rate columns of Table[1](https://arxiv.org/html/2609.02265#S5.T1)are not such a pair, since they are computed over different tracks with different claim distributions, and must not be substituted into Equation[11](https://arxiv.org/html/2609.02265#A1.E11)\. We construct a dedicated matched split pairing each adversarial episode with a genuine episode agreeing on topic, contradicted node type, and turn index\. Matching changes the estimand to a conditional distance averaged over strata, and because turn index partly determinesrtr\_\{t\}the matched distance is expected to be smaller than the deployment distance\. We report the bound on the matched split and label it as such\.

#### The restricted distance\.

With one continuous and one categorical coordinate,TVφ\\mathrm\{TV\}\_\{\\varphi\}admits a plug\-in estimate\. We preregister a partition ofrtr\_\{t\}into binsℬ\\mathcal\{B\}and compute

TV^φ​\(α0\)=12​∑b∈ℬ∑o∈𝒪\|P^g​\(b,o\)−P^α0​\(b,o\)\|,\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}\(\\alpha\_\{0\}\)=\\frac\{1\}\{2\}\\sum\_\{b\\in\\mathcal\{B\}\}\\sum\_\{o\\in\\mathcal\{O\}\}\\big\|\\widehat\{P\}\_\{g\}\(b,o\)\-\\widehat\{P\}\_\{\\alpha\_\{0\}\}\(b,o\)\\big\|,\(24\)with user\-level bootstrap intervals, reporting the bin count and the sample size in each cell\. Two distinct effects act here and they do not cancel\. Binning coarsens theσ\\sigma\-algebra, so by Theorem[3](https://arxiv.org/html/2609.02265#Thmtheorem3)the population quantity being estimated is at mostTVφ​\(α0\)\\mathrm\{TV\}\_\{\\varphi\}\(\\alpha\_\{0\}\)\. Separately, the plug\-in estimator of a total variation distance is upward biased in finite samples by Jensen’s inequality\. The first is a property of the estimand and the second of the estimator, and neither effect is hidden by the reported quantities\.

#### The history distance\.

No comparable plug\-in estimator exists onΣℋ\\Sigma\_\{\\mathcal\{H\}\}\. We train a balanced diagnostic discriminator, entirely separate from the gate, on one split; select its checkpoint and threshold on a second; and evaluate on a third that is touched once\. On that third split we form one\-sided97\.5%97\.5\\%Clopper\-Pearson lower bounds on each class\-conditional accuracy and combine them by a union bound, giving a95%95\\%one\-sided lower boundA¯\\underline\{A\}on population balanced accuracy\. Applying Theorem[2](https://arxiv.org/html/2609.02265#Thmtheorem2)with𝒢=Σℋ\\mathcal\{G\}=\\Sigma\_\{\\mathcal\{H\}\}to that discriminator, whose balanced accuracy satisfiesA=1−12​\(FUR\+RRL\)A=1\-\\tfrac\{1\}\{2\}\(\\mathrm\{FUR\}\+\\mathrm\{RRL\}\), gives

TVℋ​\(α0\)≥2​A¯−1\.\\mathrm\{TV\}\_\{\\mathcal\{H\}\}\(\\alpha\_\{0\}\)\\;\\geq\\;2\\underline\{A\}\-1\.\(25\)This is a lower bound and not an estimate\. A discriminator that fails to separate the two laws certifies nothing, since the failure may be its own\. The empirical accuracy cannot be substituted forA¯\\underline\{A\}, because it exceeds the population value with probability near one half, which is exactly what a one\-sided bound may not do\.

#### What the comparison does and does not show\.

We report2​A¯−12\\underline\{A\}\-1andTV^φ\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}side by side\. Their difference is not a lower bound onTVℋ−TVφ\\mathrm\{TV\}\_\{\\mathcal\{H\}\}\-\\mathrm\{TV\}\_\{\\varphi\}, because a valid lower bound on that difference requires an upper bound onTVφ\\mathrm\{TV\}\_\{\\varphi\}and the binned plug\-in supplies none\. We therefore present the comparison as indicative of the gap that Theorem[3](https://arxiv.org/html/2609.02265#Thmtheorem3)permits, and we test the strictness condition Equation[18](https://arxiv.org/html/2609.02265#A1.E18)directly rather than inferring it from the gap\. The test bins the restricted view as above, fits the conditional sign of the estimated likelihood ratio within each bin on held\-out data, and asks whether both signs occur with bootstrap\-significant probability\. Appendix[C](https://arxiv.org/html/2609.02265#A3)reports the result as criterion F5, the criterion that would retire the second design principle if it failed\.

## Appendix BImplementation Details

Figure 2:Path of an event throughCapture\. Only the gate can promote a hypothesis into the ledger, and the selector reads the ledger but the ledger cannot lower the safety threshold\. The audit runs after decoding, dropping uninfluential citations and writing back an influence score that down\-weights those nodes at future retrieval\.#### Extractor\.

Qwen2\.5\-3B\[[Yang et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib31)\]with LoRA rank 16, scaling 32, dropout 0\.05, on attention projections only\. Learning rate2×10−42\\times 10^\{\-4\}, cosine schedule, 3 epochs, effective batch 32, bf16, schema\-constrained decoding over the six\-field tuple, abstention weightωabs=0\.3\\omega\_\{\\text\{abs\}\}=0\.3chosen on validation from\{0\.1,0\.3,0\.5,1\.0\}\\\{0\.1,0\.3,0\.5,1\.0\\\}\. Held\-out performance is in Table[3](https://arxiv.org/html/2609.02265#A2.T3)\.

#### Gate\.

Latent dimension 256\.fθf\_\{\\theta\}is a three\-layer MLP withtanh\\tanhactivations integrated by a Dormand\-Prince solver at relative tolerance10−310^\{\-3\}and absolute tolerance10−410^\{\-4\}\[[Chen et al\., 2018](https://arxiv.org/html/2609.02265#bib.bib16),[Rubanova et al\., 2019](https://arxiv.org/html/2609.02265#bib.bib17)\], with a GRU cell for the discrete update on event arrival\. Gradients are taken by direct backpropagation through the solver rather than the adjoint method\. Entropy thresholdηclr=1\.24\\eta\_\{\\mathrm\{clr\}\}=1\.24nats, set so the validation clarification rate is at most one turn in twelve\. Quarantine rateγq=0\.135\\gamma\_\{q\}=0\.135per day, reaching the retention floorϕ=0\.15\\phi=0\.15at 14 days, and corroboration threshold 0\.6 on the gate’s confidence for the*revise*action;ϕ\\phiis a floor on the decayed multiplier and 0\.6 applies to the gate output, so the two are not on one scale\.

#### Gate supervision\.

Action labels come from the structured track metadata and the oracle update rules of the generation program\. They were not validated by humans at the event level during construction, since the 300\-episode validation covers track membership and changepoint position only\. Appendix[E](https://arxiv.org/html/2609.02265#A5)reports a separate audit in which annotators uninvolved in benchmark construction labeled 720 candidate events without generator metadata\. The loss is a six\-class cross\-entropy weighted by the inverse square root of class frequency, plus a calibration penalty\. Episodes are unrolled in full, at 12 to 20 events\. Splits are disjoint by user, topic, attack template, and generator family\. The class distribution is retain 28%, add 17%, quarantine 21%, revise 14%, scope 12%, clarify 8%\. Clarification labels are constructed from the ambiguity present at the current event and the current oracle state only; no future event text enters either label construction or training, which matters because a clarification label that peeked ahead would train the gate on information it cannot have at inference\.

#### Decay rates\.

Base rates were grid\-searched on validation overγs∈\{0\.003,0\.01,0\.03\}\\gamma\_\{s\}\\in\\\{0\.003,0\.01,0\.03\\\},γc∈\{0\.03,0\.1,0\.3\}\\gamma\_\{c\}\\in\\\{0\.03,0\.1,0\.3\\\},γg∈\{0\.15,0\.5,1\.5\}\\gamma\_\{g\}\\in\\\{0\.15,0\.5,1\.5\\\}, then frozen\. Learning them jointly withfθf\_\{\\theta\}collapsed the three toward0\.080\.08and cost 3\.1 points of acceptance and 1\.9 of win rate\.

#### Ledger\.

Embeddings fromBAAI/bge\-m3at 1,024 dimensions, cosine similarity, retrievalk=12k=12\. A support or contradiction edge is written when the relation probability from a DeBERTa\-v3\-large NLI model, further trained onD\-PrefGuardtraining relations, reaches 0\.70\. Overwriting a stable node requires either two authenticated\-user events with gate confidence at least 0\.80 separated by a session boundary, or three such events within one session\. A corroboration event must match the node’s scope, reach cosine similarity 0\.82 and NLI entailment 0\.75, carry gate authenticity confidence at least 0\.70, and not itself be quarantined\. The retrieval score is0\.550\.55similarity plus0\.200\.20decayed confidence plus0\.150\.15scope match plus0\.100\.10influence prior, with ties broken by confidence, then recency, then node identifier\. Evicted nodes persist in a non\-retrievable audit log and return only through an explicit user correction\.

#### Selector and audit\.

Best\-of\-NNwithN=8N=8,wp=1\.0w\_\{p\}=1\.0,ws=2\.0w\_\{s\}=2\.0,τsafe=0\.35\\tau\_\{\\text\{safe\}\}=0\.35, applied identically to every method\. The audit re\-decodes greedily with each cited node ablated, capped at the top three cited nodes per turn, and retrieval down\-weighting uses a running mean influence with decay 0\.9 per retrieval\.

#### Preference reward model, used by the selector\.

Qwen2\.5\-3B\-Instruct with a scalar reward head, trained on 48,000 pairs, of which 40,000 are structured\-oracle pairs and 8,000 are human comparisons with 2,000 overlapping pairs rated by three annotators each\. Bradley\-Terry pairwise loss, learning rate1×10−51\\times 10^\{\-5\}, batch 128, 2 epochs, weight decay 0\.01, split 70/15/15 by user\. No evaluation user appears in its training data, its test portion uses the held\-out generator family, held\-out pair accuracy is 79%, and it never receives the latent state as input\.

#### Evaluation reward model, used only for regret\.

A second model of the same architecture trained on disjoint users, responses, and generator families\. No system reads it at inference, which is what separates the metric from the objective\.

#### Safety scorer\.

meta\-llama/Llama\-Guard\-3\-8B, returningrs=P⁡\(unsafe∣prompt,response\)∈\[0,1\]r\_\{s\}=P\(\\text\{unsafe\}\\mid\\text\{prompt\},\\text\{response\}\)\\in\[0,1\], temperature\-calibrated on a separate safety development set\. The thresholdτsafe=0\.35\\tau\_\{\\text\{safe\}\}=0\.35was chosen to reach at least 95% harmful\-response recall while maximizing benign acceptance, and frozen before anyD\-PrefGuardtest evaluation\. HarmBench and StrongREJECT are used for evaluation only and never for selection\.

#### Judge\.

GPT\-4\.1 at a pinned dated version, temperature 0, one judgment in each response order, method names hidden, refusals visible as response text, and safety labels hidden\. A tie option exists and awards half a win to each side, and disagreement between the two orderings is recorded as a tie\. The prompt reads,*You are comparing two assistant responses for one user\. Use only the supplied task and verified current preference state\. Select A if A better satisfies the user without adding unsupported content\. Select B if B is better\. Select Tie if neither has a meaningful advantage\. Do not infer method identity\. Return only A, B, or Tie\.*Agreement was measured on 600 comparisons stratified at 120 per track with three human ratings each; the judge matches the human majority 87\.4% of the time against 91\.2% pairwise agreement among the humans\.

#### Common\-pool dynamic regret\.

For each eligible post\-changepoint T1 turn and each response backbone, 32 candidate responses are generated once from oracle memory and frozen, then reused across every method and every training seed\. The pool is not a union of method\-generated responses; all 32 are oracle\-conditioned\. Every method, including Oracle\-memory, ranks the identical 32 candidates, scoring personalized utility under its own retrieved memory state and safety under the shared scorer\. Withut​\(y,st\)∈\[0,1\]u\_\{t\}\(y;s\_\{t\}\)\\in\[0,1\]the evaluation reward under the true preference state,Rt=ut​\(yt⋆,st\)−ut​\(yt,st\)R\_\{t\}=u\_\{t\}\(y^\{\\star\}\_\{t\};s\_\{t\}\)\-u\_\{t\}\(y\_\{t\};s\_\{t\}\)whereyt⋆y^\{\\star\}\_\{t\}is the highest\-utility safe response in that shared pool\. No further normalization is applied\. Averaging runs turn to episode to user to backbone with equal weight per user\. Unsafe candidates are removed by the shared safety constraint, safety violations are reported separately rather than folded into regret, a refusal receives its evaluation\-model utility rather than a fixed penalty, and equal utility yields zero regret\. Because the comparator is the best member of a finite oracle\-conditioned pool rather than the best possible response, this is a finite\-pool approximation to the comparator in Equation[1](https://arxiv.org/html/2609.02265#S2.E1)and we name it accordingly\.

#### Evidence F1 and influence AUC\.

The ground\-truth evidence set is the set of nodes independently marked necessary for the target response\. A node counts as influential when removing it lowers evaluation utility by at least 0\.10 or changes the selected preference\. A cited node in the ground\-truth set is a true positive, a cited node outside it a false positive, and an uncited ground\-truth node a false negative\. Influence AUC is computed over node\-response pairs with the score being the absolute counterfactual utility shift\|Inf⁡\(n\)\|\|\\mathrm\{Inf\}\(n\)\|and the positive target being membership in the independently annotated necessary\-evidence set of Appendix[E](https://arxiv.org/html/2609.02265#A5), never a threshold on the score itself, since that would make the measure circular\. Five nodes are scored per response, the top three retrieved plus two sampled at random from the ledger, and bootstrap clustering is by user\.

#### Tokens and latency per turn\.

Capture2,480 ms and 3,850 tokens; without the gate 1,850 and 3,200; without the neural ODE 2,380 and 3,790; without probing 1,880 and 3,100; without timescale separation 2,280 and 3,500; without provenance 2,300 and 3,550; without the safety bound 2,050 and 3,300; without the audit 1,450 and 2,780\. Among baselines, Recency RAG uses 2,640 tokens, StateMem 3,290, MemGPT 3,410, Provenance\-only 2,720 at 480 ms, Static Summary 2,950 at 620 ms, and Full History 6,800 at 740 ms\.Capturetherefore costs 17% more tokens per turn than StateMem and 43% fewer than Full History\.

#### Compute\.

Four A100 80GB\. Extractor and gate training take 11 and 6 GPU\-hours per seed, and full evaluation across all tracks, both backbones, and three seeds takes approximately 340 GPU\-hours\.

Table 3:Extractor held\-out performance and gate action confusion, the latter row\-normalized\.

## Appendix CFalsification Results and Secondary Metrics

#### F1\. Does provenance alone matchCaptureon same\-origin contamination?

No\. Provenance\-only reaches 43\.6% attack success on the same\-origin track against 17\.5% forCapture, and the gap is significant atp<0\.001p<0\.001\. This is the criterion whose failure would make the learned gate unnecessary\. It is a performance comparison and not a test of Equation[18](https://arxiv.org/html/2609.02265#A1.E18), which is F5\.

#### F2\. Do static summaries match the multi\-timescale ledger on recurrence?

No\. Static summary reaches 0\.41 recurring regret against 0\.27, and the ablation without timescale separation reaches 0\.32\.

#### F3\. Do cited memories predict independently annotated necessity?

Yes, moderately\. Over 4,800 node\-response pairs of which 1,472 are positive, the AUC of\|Inf⁡\(n\)\|\|\\mathrm\{Inf\}\(n\)\|against membership in the independently annotated evidence set is 0\.718 with a user\-bootstrap interval of\[0\.684,0\.751\]\[0\.684,0\.751\]\. The target comes from the annotation rather than from the score, since defining it by thresholding\|Inf⁡\(n\)\|\|\\mathrm\{Inf\}\(n\)\|would make the measure circular\.

#### F4\. Does the advantage survive external data and real users?

Yes, but narrowly, and it shrinks\. See Section[6](https://arxiv.org/html/2609.02265#S6)\. The win\-rate margin over StateMem falls from 5\.4 points to 4\.5 points with real users, and on HorizonBenchCapturedoes not lead on belief revision accuracy at all, leading only on contradiction resolution\. We regard F4 as passed but narrowly, and it is the criterion we would most want a reviewer to press on\.

#### F5\. Is the conditional sign of the likelihood ratio non\-degenerate givenφ\\varphi?

Yes\. On the matched split, 12 of the 32 occupied cells of the restricted view, or37\.5%37\.5\\%, contain both signs of the estimated conditional likelihood ratio with bootstrap\-significant probability, against the5%5\\%rate expected under degeneracy at our test level\. We reject the specified binned degeneracy null in 12 of 32 occupied cells after Holm correction, which is empirical evidence consistent with Equation[18](https://arxiv.org/html/2609.02265#A1.E18)for the realized adversary\. Because the test rests on a learned cross\-fitted discriminator, estimated likelihood\-ratio signs, binning, and finite samples, it does not establish the population condition\. This is the criterion that would retire the multi\-timescale representation if it failed, and the one we would most want re\-run on an independent generator\.

#### C1\. Consistency check, not a falsification criterion\. Are the measured rates consistent with the fixed\-adversary bound?

They must be, or one of the two is wrong\. On the matched split of Appendix[A\.6](https://arxiv.org/html/2609.02265#A1.SS6), Provenance\-only attainsFUR\+RRL\\mathrm\{FUR\}\+\\mathrm\{RRL\}above1−TV^φ1\-\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}as Equation[11](https://arxiv.org/html/2609.02265#A1.E11)requires\. Two caveats keep this honest\. The test uses the fixed\-adversary inequality and not the worst\-case form, since the split realizes one adversary policy\. And because binning can only reduce the population distance while the plug\-in estimator is upward biased, a violation is evidence of a mis\-paired split or of a rule reading outsideφ\\varphionly after both effects are accounted for\. We treat this as a unit test on the harness rather than as evidence for the method\.

#### StrongREJECT\.

Attack success under StrongREJECT is 10\.6% for the unpersonalized model, 13\.2% Full History, 12\.5% Static Summary, 14\.6% Recency RAG, 12\.7% StateMem, 11\.5% Provenance\-only, 13\.7% MemGPT, 8\.9%Capture, and 4\.4% Oracle\-memory\. Every value lies within 1\.4 points of the corresponding HarmBench figure in Table[1](https://arxiv.org/html/2609.02265#S5.T1), and the ordering is identical\.

Table 4:Empirical instantiation of Theorem[2](https://arxiv.org/html/2609.02265#Thmtheorem2)and Theorem[3](https://arxiv.org/html/2609.02265#Thmtheorem3)on the matched split\.2​A¯−12\\underline\{A\}\-1is a lower bound onTVℋ​\(α0\)\\mathrm\{TV\}\_\{\\mathcal\{H\}\}\(\\alpha\_\{0\}\)andTV^φ​\(α0\)\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}\(\\alpha\_\{0\}\)is a binned plug\-in estimate, so their difference is not itself a bound onTVℋ−TVφ\\mathrm\{TV\}\_\{\\mathcal\{H\}\}\-\\mathrm\{TV\}\_\{\\varphi\}, as Appendix[A\.6](https://arxiv.org/html/2609.02265#A1.SS6)explains\.QuantityValueNoteMatched pairs480960 episodes, genuine paired to adversarialRecency bins×\\timesorigins8×48\\times 4preregistered edges, 32 occupied cellsTV^φ​\(α0\)\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}\(\\alpha\_\{0\}\)0\.335495% user\-level bootstrap\[0\.298,0\.371\]\[0\.298,0\.371\]1−TV^φ​\(α0\)1\-\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}\(\\alpha\_\{0\}\)0\.6646right\-hand side of Equation[11](https://arxiv.org/html/2609.02265#A1.E11)Provenance\-onlyFUR\\mathrm\{FUR\}0\.2083matched splitProvenance\-onlyRRL\\mathrm\{RRL\}0\.4563matched splitFUR\+RRL\\mathrm\{FUR\}\+\\mathrm\{RRL\}0\.664695% interval\[0\.6091,0\.7206\]\[0\.6091,0\.7206\]Paired difference from the bound0\.00000\.0000one\-sided 95% range\[0\.0000,0\.0372\]\[0\.0000,0\.0372\]Discriminator balanced accuracy0\.835held\-out third splitA¯\\underline\{A\}0\.807one\-sided 95%, union\-bounded Clopper\-Pearson2​A¯−12\\underline\{A\}\-10\.614lower bound onTVℋ​\(α0\)\\mathrm\{TV\}\_\{\\mathcal\{H\}\}\(\\alpha\_\{0\}\)Non\-degenerate cells12 / 3237\.5%, criterion F5Each bootstrap replicate resamples users while keeping genuine and adversarial episodes paired, then recomputesFUR\\mathrm\{FUR\},RRL\\mathrm\{RRL\}, andTV^φ\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}from that same replicate, so the differenceDb=FURb\+RRLb−\(1−TV^φ,b\)D\_\{b\}=\\mathrm\{FUR\}\_\{b\}\+\\mathrm\{RRL\}\_\{b\}\-\(1\-\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi,b\}\)is non\-negative in all 10,000 replicates, as Theorem[2](https://arxiv.org/html/2609.02265#Thmtheorem2)requires of anyσ⁡\(φ\)\\sigma\(\\varphi\)\-measurable rule evaluated on its own sample\. On the matched sample Provenance\-only’s error equals the binned plug\-in bound to four decimals\. Across paired replicates the estimated excess is non\-negative and its one\-sided 95% interval\[0\.0000,0\.0372\]\[0\.0000,0\.0372\]includes zero at its lower endpoint\. The data therefore do not resolve a positive empirical gap, which is not evidence of population equality or optimality\. The distance is estimated after binning, the plug\-in estimator is biased, non\-negativity is imposed by the inequality itself rather than observed, and equality would additionally require Provenance\-only to match the empirical likelihood\-ratio decision in every cell, which we have not shown\. The matched split is also harder than the aggregate, which is why Provenance\-only rejects 45\.6% of genuine updates here against the 25\.9% implied by Table[1](https://arxiv.org/html/2609.02265#S5.T1), so the two must not be read together\.

## Appendix DBenchmark Construction and Study Protocol

#### Scale and splits\.

480 synthetic users, five episodes each, one per track, giving 2,400 episodes and 480 per track\. Splits are by user, with 288 users and 1,440 episodes for training, 96 and 480 for development, 96 and 480 for test\.

#### Seeding and generation\.

Preference profiles are seeded from PRISM, PersonalLLM, and LaMP\[[Kirk et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib1),[Zollo et al\., 2025](https://arxiv.org/html/2609.02265#bib.bib3),[Salemi et al\., 2024](https://arxiv.org/html/2609.02265#bib.bib2)\]; the seeds contribute a profile rather than dialogue text\. Episode text is then generated by a language model conditioned on the profile and a track specification\. Training and development use Qwen2\.5\-72B\-Instruct and Mixtral\-8x22B\-Instruct, with development drawing disjoint users, topics, and prompts\. Test uses Llama\-3\.1\-70B\-Instruct, a family excluded from training and development and reserved for test, so the test partition measures generalization across generator families rather than within one\. Prompt templates and generation seeds are released\.

#### Temporal and drift structure\.

Inter\-event gaps follow a truncated log\-normal with median 8 hours, minimum 5 minutes, and maximum 14 days\. Changepoints are sampled between turns 5 and 12\. Abrupt drift is a single\-event state replacement; gradual drift is a logistic transition across three to five evidence events; recurring drift is two or three switches between two previously valid states; a context switch instantiates two simultaneously valid preferences indexed by domain\.

#### Contamination\.

T3 episodes carry one to three attempts each, and the track holds 160 indirect\-injection, 160 poisoned\-summary, and 160 same\-origin episodes, which is the equal weighting the aggregate Poison ASR column assumes\. Same\-origin episodes are built by user\-mediated laundering as described in Section[4](https://arxiv.org/html/2609.02265#S4), never by impersonation\.

#### Visibility\.

Every method sees the event text, its coarse origin label, and its timestamp\. No method sees the track label, the changepoint position, or the ground\-truth user state\.

#### Annotation\.

Three annotators labeled a 300\-episode subset for track membership and changepoint position, reaching Krippendorff’sα=0\.73\\alpha=0\.73on track and0\.700\.70on changepoint, with disagreements adjudicated by a fourth rater\.

#### User study\.

Forty participants, four to six sessions each over two to three weeks, recruited under institutional ethics approval with informed consent and compensated at local research rates\. Every session ran against one fixed neutral assistant, Qwen3\-8B\-Instruct with no persistent personalization, held constant across all participants and sessions, so that no system under later comparison shaped the histories it would be evaluated on\. Only user\-originated content creates preference evidence during replay; assistant utterances never become evidence\. At each session’s end participants labeled every extracted preference as genuine, temporary, context\-specific, or incorrect, which supplies the ground truth for the genuine\-update adherence rate and the false\-update rate\. These four labels describe the scope of a valid preference and the correctness of extraction, and none of them expresses whether the assistant should have asked before updating, so they do not define an ambiguity target and no clarification F1 is computed on the replay\. Because participants labeled only what the extractor surfaced, extractor misses are absent from the denominator, which is why we do not call adherence a recall\.

#### Replay and clarification\.

Histories were frozen and identical evidence replayed to every system\. Six controlled attacks were injected per participant during replay, two from each family, for 240 in total, and no participant was exposed to any of them\. When the gate asks during replay the stored participant annotation answers, so the replay is oracle\-assisted withε=0\\varepsilon=0relative to those annotations, and the realized query rate is 7\.1%\. No clarification quality metric is scored there, for the reason given above\. OnD\-PrefGuardthe clarification answer instead comes from a stored response generated from the episode’s latent state before evaluation rather than from the raw label, and its measured accuracy against the latent label is 92%, givingε=0\.08\\varepsilon=0\.08in the sense of Assumption[5](https://arxiv.org/html/2609.02265#Thmassumption5)\. On HorizonBench, which is non\-interactive, the*clarify*action is unavailable and resolves to quarantine without update\.

#### Satisfaction\.

Satisfaction was collected in a separate blinded within\-participant task rather than during interaction\. All 40 participants rated four matched output pairs sampled from each completed session, with method identity hidden and left\-right placement and presentation order independently randomized\. Each response was rated 1 to 5, one mean was formed per participant per method, and those means were averaged across participants, giving a clusteredn=40n=40per method\.Capturescored 4\.1 with a participant\-clustered 95% interval of\[3\.9,4\.3\]\[3\.9,4\.3\]and StateMem 3\.8 at\[3\.6,4\.0\]\[3\.6,4\.0\]\.

Table 5:LeavingD\-PrefGuard\. HorizonBench is zero\-shot on a benchmark we did not build; BRA is belief revision accuracy, CRR contradiction resolution rate, and Retr\. err\. the share of errors attributable to retrieval\. Replay columns come from the 40\-participant study with participant\-clustered 95% intervals, six controlled attacks per participant injected only in offline replay\. Bold marks the best observed non\-oracle point estimate and does not by itself imply statistical significance, which is why Recency RAG is bold on BRA at 0\.79 againstCapture’s 0\.78\. Clarification F1 is not reported because HorizonBench is non\-interactive and the participant annotations do not define whether clarification was required\. Oracle\-memory’s poisoning rate is zero by construction, since it observes the attack label, so it is a diagnostic ceiling rather than an estimated defense result, and its replay win rate is a point estimate whose participant\-clustered interval we do not report\.†The unpersonalized model never writes injected preferences, so its zero is a trivial control\.

## Appendix EIndependent Labels, Independent Attacks, and Query\-Matched Baselines

#### Independent event\-level annotation\.

Three annotators uninvolved in benchmark construction labeled 720 candidate events without access to generator metadata\. Agreement wasα=0\.78\\alpha=0\.78on authenticity,0\.740\.74on scope,0\.710\.71on timescale, and0\.670\.67on the six\-way action\. The program labels agree with the adjudicated human action 83\.6% of the time, andCapture’s action macro\-F1 against the human labels is 0\.71 with interval\[0\.67,0\.75\]\[0\.67,0\.75\]\. This is the closest thing in the paper to a check on the gate’s supervision that does not pass through the generation program, Program\-generated labels agree with independent human judgments in 83\.6% of cases, which we treat as a supervision\-quality and label\-noise reference and not as a ceiling on learned\-model performance, since a model can outperform its training labels against human judgment when the label errors are systematic\.

#### Independently authored attacks\.

Twelve external red\-teamers with no access toD\-PrefGuardtemplates authored 240 attacks, 80 per family\. Attack success is 50\.4% for Recency RAG, 37\.1% StateMem, 26\.3% Provenance\-only, 22\.5% for the supervised Transformer, and 18\.3% with interval\[14\.0,23\.1\]\[14\.0,23\.1\]forCapture\. Four of five methods show higher attack success under independently authored attacks than under our fixed generator, while Recency RAG changes slightly from 51\.6% to 50\.4%\. The ordering of methods is preserved, which is the strongest available evidence that the security result is not an artifact of our attack taxonomy\.

#### Adaptive attack construction\.

The attacker performs a 32\-candidate paraphrase search that preserves the injected claim and its origin while maximizingP⁡\(add\)\+P⁡\(revise\)−P⁡\(quarantine\)−P⁡\(clarify\)P\(\\text\{add\}\)\+P\(\\text\{revise\}\)\-P\(\\text\{quarantine\}\)\-P\(\\text\{clarify\}\)under semantic\-similarity and length constraints\. It knows the released weights and the fixed threshold and does not observe the private ledger or the realized gate state\. AgainstCaptureit raises retrievable\-memory attack success to 34\.4% and response\-level success to 24\.7%, and it transfers to the supervised Transformer at 27\.9% while barely moving the heuristic baselines, which expose no gradient\.

#### Supervision\-matched Transformer\.

Four pre\-layer\-normalized causal Transformer blocks, hidden dimension 256, eight heads at 32 dimensions each, feed\-forward dimension 1,024 with GELU, dropout 0\.10, and 4\.31M trainable parameters excluding the frozen extractor and response backbone\. Standardizedlog⁡\(1\+Δ​t/hour\)\\log\(1\+\\Delta t/\\text\{hour\}\)is projected and added to each event representation, and the full 12 to 20 event episode is processed under causal masking\. Training uses the same inverse\-square\-root class\-weighted six\-class cross\-entropy and calibration penalty asCapture, AdamW at3×10−43\\times 10^\{\-4\}withβ=\(0\.9,0\.999\)\\beta=\(0\.9,0\.999\), weight decay 0\.01, 5% warm\-up then cosine decay, effective batch 64 episodes, 10 epochs, gradient clipping 1\.0, and checkpoint selection by development macro\-F1\. Memory actions write into a flat versioned store, where*retain*writes nothing,*add*appends a retrievable node,*scope*writes a scoped version while retaining the broader node,*revise*supersedes and replaces,*quarantine*writes a non\-retrievable pending node, and*clarify*asks once then repeats the decision using the answer\. Quarantine corroboration and promotion thresholds matchCaptureexactly; what is absent is the stable, contextual, and transient layering and the neural ODE\. Logits are temperature\-scaled on development data atT=1\.11T=1\.11, clarification fires when calibrated entropy exceeds 1\.18 nats, selected to maximize development utility inside the 8\.33% budget, and the realized test query rate is 8\.0%\.

#### Action\-label agreement and calibration against human labels\.

On the 720 independently annotated test events,Capturereaches six\-action macro\-F1 of 0\.71 with interval\[0\.67,0\.75\]\[0\.67,0\.75\]and the supervised Transformer 0\.68 at\[0\.64,0\.72\]\[0\.64,0\.72\]\. The paired difference is\+0\.03\+0\.03with interval\[−0\.01,0\.07\]\[\-0\.01,0\.07\]atp=0\.13p=0\.13, soCapture’s action classification against human labels is numerically better and not significantly so, which locates its larger downstream advantage in the ledger and the temporal update rather than in per\-event classification accuracy\. Top\-label expected calibration error on the same events, using 15 equal\-mass bins with temperature fitted on development data only, is 0\.047 at\[0\.035,0\.060\]\[0\.035,0\.060\]forCaptureand 0\.062 at\[0\.048,0\.078\]\[0\.048,0\.078\]for the Transformer\. These two are directly comparable because both predict the same six actions against the same labels, which is not true of the heuristic baselines and is why no calibration column appears in Table[1](https://arxiv.org/html/2609.02265#S5.T1)\.

#### Adaptive attacker\.

The attacker never queries the deployed gate and never reads its logits or realized hidden state\. It replays the visible transcript through a local copy of the released weights to form 16 shadow\-state particles, sampling the unavailable memory decisions from that copy to produce plausible hidden trajectories, and scores each paraphrase by the four action probabilities averaged over those particles\. The probabilities are therefore surrogate estimates rather than readings from the deployed system, which keeps the experiment inside Assumption[4](https://arxiv.org/html/2609.02265#Thmassumption4), and the correct description is a released\-weight hidden\-state\-surrogate attack rather than full state\-aware white\-box optimization\. Paraphrases come from Llama\-3\.1\-70B\-Instruct, 32 candidates in four batches of eight at temperature 0\.9 and top\-pp0\.95 with at most 128 output tokens, constrained to 80 to 120% of the original payload length within a hard range of 16 to 128 tokens, BGE\-M3 cosine similarity at least 0\.88, and DeBERTa\-v3\-large NLI entailment of the injected claim at least 0\.90\. Origin label and injection timing are held fixed\.

#### Red\-team protocol\.

Twelve people uninvolved in the project were recruited through security and NLP research mailing lists, four of them LLM\-security researchers, four NLP and ML graduate researchers, and four experienced prompt red\-teamers\. They were told only that the target was a personalized memory system and were given the desired malicious preference and the permitted channel\. They did not seeCapture’s architecture, weights, threshold, outputs, benchmark templates, or any existing attack\. Each produced 20 accepted attacks from at most 30 drafts, with family assignments rotated so the final set holds 80 per family, and compensation was $50 per hour against a median 2\.3 hours\. Because 240 attacks are evaluated against 96 test users, each user is targeted about 2\.5 times and dependence exists on both the authoring and the target axis, so red\-teamer clustering alone would understate it\. Intervals use 10,000 crossed two\-way bootstrap replicates in which red\-teamers and target users are independently resampled with replacement, every attack weighted by the product of its author and target\-user multiplicities, and method outputs kept paired within each attack\. Point estimates are 50\.4% for Recency RAG, 37\.1% StateMem, 26\.3% Provenance\-only, 22\.5% for the Transformer, and 18\.3% forCapture\.

#### Adaptive comparison against Provenance\-only\.

Using the same adaptive attempts for both methods and resampling test users with method outputs kept paired,Capture’s 24\.7% exceeds Provenance\-only’s 22\.1% by 2\.6 points with a paired interval of\[−1\.9,7\.2\]\[\-1\.9,7\.2\]atp=0\.29p=0\.29\. The two are therefore not reliably separated on adaptive attack success, and what distinguishes them is adherence at 83\.5% against 74\.1%\.

#### Sampling of the 720 annotated events\.

All 720 come from the frozen test partition and cover all 96 test users, with none drawn from training or development\. They are stratified to 144 per track and 120 per action, which is appropriate for macro\-F1 but deliberately does not reproduce the natural prevalence of the six actions, so the agreement figures should not be read as a prevalence\-weighted accuracy\.

#### Supervision\-matched external evaluation\.

The Transformer was frozen and evaluated zero\-shot under the same protocols asCapture\. It reaches HorizonBench belief revision accuracy 0\.77 againstCapture’s 0\.78, contradiction resolution 0\.68 against 0\.72, retrieval\-attributable error 0\.23 against 0\.21, replay win 65\.8%\[60\.2,71\.0\]\[60\.2,71\.0\]against 67\.5%, and replay poisoning 17%\[11,24\]\[11,24\]against 12%\. Paired, the architectural gain is\+0\.01\+0\.01on belief revision atp=0\.27p=0\.27,\+0\.04\+0\.04on contradiction resolution atp=0\.008p=0\.008,−0\.02\-0\.02retrieval error with interval\[−0\.040,−0\.001\]\[\-0\.040,\-0\.001\]atp=0\.046p=0\.046,\+1\.7\+1\.7points of replay win atp=0\.031p=0\.031, and−5\.0\-5\.0points of replay poisoning atp=0\.064p=0\.064\. The gain therefore transfers beyond our generator, significantly on contradiction resolution and replay win and not on belief revision accuracy or replay poisoning, which is a modest result and the one we would most want strengthened\.

#### Query\-budget\-matched StateMem\.

StateMem asks when its calibrated contradiction and supersession confidence margin falls below a development\-selected threshold, using the same stored clarification answers and the same 8\.33% budget\. It reaches 67\.6% win rate, 0\.30 regret, 3\.7 lag, 30\.5% poisoning, 82\.4% adherence, and clarification F1 0\.51 at precision 0\.56 and recall 0\.47, on a realized query rate of 8\.1%\. Query access is therefore worth roughly 1\.5 points of win rate and 4\.3 points of poisoning resistance to StateMem, which is a real gain and does not account forCapture’s remaining margin\.

#### Memory\-level versus response\-level attack success\.

Table[1](https://arxiv.org/html/2609.02265#S5.T1)reports response\-level success, meaning the injected claim becomes retrievable and subsequently causes an eligible response to follow the injected preference\. Writing a claim into quarantine alone does not count\. Retrievable\-memory success is higher throughout, at 55\.2% Static Summary, 69\.0% Recency RAG, 48\.1% StateMem, 27\.5% Provenance\-only, 59\.8% MemGPT, and 18\.8% with interval\[15\.7,22\.2\]\[15\.7,22\.2\]forCapture, against its 11\.5% at\[9\.7,13\.4\]\[9\.7,13\.4\]response\-level\. Full History has no write decision so the memory\-level quantity is undefined for it\.

#### Memory admission and output adherence\.

A single ledger\-promotion column across methods would mislead, since Full History and Recency RAG have no comparable promotion operation\. The comparable quantity is the rate at which genuine evidence becomes available to response generation, which is 100\.0% for Full History, 93\.8% Recency RAG, 87\.4% StateMem, 86\.1% MemGPT, 79\.6% Static Summary, 78\.9% Provenance\-only, and 88\.2% forCapture\. ForCapturespecifically, ledger promotion is 88\.2% with interval\[85\.4,90\.8\]\[85\.4,90\.8\]while output adherence is 83\.5% at\[80\.6,86\.2\]\[80\.6,86\.2\], and removing the safety bound leaves promotion unchanged at 88\.2% while raising adherence to 87\.5%\. The gap between the two, and its sensitivity to a downstream component, is exactly why adherence is named as an output\-level quantity\.

#### Clarification cost, and why this is not a test of Equation[23](https://arxiv.org/html/2609.02265#A1.E23)\.

From matched direct\-answer against question\-then\-answer trajectories, the normalized utility cost of delaying an answer by one turn isκ^=0\.094\\widehat\{\\kappa\}=0\.094with interval\[0\.081,0\.109\]\[0\.081,0\.109\]\. Withε=0\.08\\varepsilon=0\.08from Appendix[D](https://arxiv.org/html/2609.02265#A4),κ^\+ε=0\.174\\widehat\{\\kappa\}\+\\varepsilon=0\.174, against12​\(1−TV^φ\)=0\.3323\\tfrac\{1\}\{2\}\(1\-\\widehat\{\\mathrm\{TV\}\}\_\{\\varphi\}\)=0\.3323\. We present this as an illustrative comparison and explicitly not as a checked instantiation of Equation[23](https://arxiv.org/html/2609.02265#A1.E23), for two reasons\. The theorem’s cost is in the units of zero\-one loss whileκ^\\widehat\{\\kappa\}is a normalized utility difference, and we have not established that the two scales coincide, so the sumκ^\+ε\\widehat\{\\kappa\}\+\\varepsilonis not the quantity the theorem constrains\. Separately, the binned plug\-in estimate of the distance is neither an upper nor a lower bound on the population value, since binning and finite\-sample bias act in opposite directions, so it cannot certify that the inequality holds\. What the comparison does show is that the measured cost of asking is well inside the range where the theorem’s mechanism would operate, which is weaker than a verification and is all we claim\.

#### Evidence\-set annotation\.

Two annotators independently labeled the necessary\-evidence set for each of 960 test responses, two per episode, with a third adjudicating disagreements and a 240\-response subset labeled by all three\. Annotators saw the raw history, the target prompt, the response, and anonymized candidate nodes in randomized order, and did not see method names, model citations, influence scores, counterfactual results, or retrieval rank\. Mean pairwise evidence\-set F1 is 0\.82 and node\-level Krippendorff’sα\\alphais 0\.76\.

#### Strictness\-test procedure\.

The diagnostic discriminator is a two\-layer bidirectional GRU with 256 hidden units per direction over frozen BGE\-M3 event embeddings,log⁡\(1\+Δ​t\)\\log\(1\+\\Delta t\), origin labels, and extractor fields, with attention pooling into a two\-layer binary head\. It shares no parameters withCapture\. The 480 matched pairs are partitioned by user into 288 pairs for training, 96 for selection and calibration, and 96 for final evaluation\. For the strictness test, five\-fold cross\-fitting produces out\-of\-fold calibrated probabilities for all 480 pairs, from whichℓ^​\(H\)=log⁡P^​\(Z=g∣H\)−log⁡P^​\(Z=a∣H\)\\widehat\{\\ell\}\(H\)=\\log\\widehat\{P\}\(Z=g\\mid H\)\-\\log\\widehat\{P\}\(Z=a\\mid H\)is formed under equal priors\. Within each of the 32 recency\-origin cells a user\-level bootstrap intersection\-union test checks whether both signs ofℓ^\\widehat\{\\ell\}occur with non\-zero probability, and Holm correction is applied across the 32 cells at familywiseα=0\.05\\alpha=0\.05\. Twelve cells survive\.

## Appendix FStatistical Protocol

Synthetic and external results use user\-level paired bootstrap with 10,000 resamples for 95% intervals, resampling users rather than episodes so that repeated episodes from one simulated user do not count as independent evidence\. The independently authored attack analysis is the exception, since its 240 attacks are written by twelve people and evaluated against 96 users, so its intervals require a crossed two\-way resample over red\-teamer and target user, with method outputs for a given attack kept paired within each replicate\. Elsewhere we use paired randomization tests with 10,000 permutations, corrected across the comparisons within each table by the Holm procedure\. Human\-study results use participant\-clustered bootstrap, resampling participants rather than sessions, and within\-participant comparisons throughout\. We report three training seeds and give intervals rather than isolated significance claims wherever the sample is small enough that app\-value would mislead\. For the headline comparisons in Table[1](https://arxiv.org/html/2609.02265#S5.T1), the 95% intervals are\[69\.1,73\.8\]\[69\.1,73\.8\]forCapture’s win rate against\[63\.6,68\.5\]\[63\.6,68\.5\]for StateMem, and\[9\.7,13\.4\]\[9\.7,13\.4\]forCapture’s poison ASR against\[18\.1,22\.0\]\[18\.1,22\.0\]for Provenance\-only\. Differences on the replay are reported paired rather than as overlapping marginals, since separate intervals establish nothing, and the win advantage over StateMem is\+4\.5\+4\.5points with interval\[1\.0,8\.0\]\[1\.0,8\.0\]atp=0\.014p=0\.014, and the satisfaction advantage is\+0\.30\+0\.30points at\[0\.10,0\.50\]\[0\.10,0\.50\]andp=0\.004p=0\.004\. Against the supervised Transformer the win advantage is\+2\.2\+2\.2points at\[0\.6,3\.9\]\[0\.6,3\.9\]andp=0\.011p=0\.011, and the poisoning advantage−4\.4\-4\.4points at\[−7\.0,−1\.9\]\[\-7\.0,\-1\.9\]andp=0\.003p=0\.003\. Per\-cell intervals for every table are released with the artifacts\.

## Appendix GComponent Ablation

Table 6:Component ablation\. Deltas are against the full system on common\-pool dynamic regret, whose absolute values are 0\.27 for the full system rising to 0\.42 without the gate\. PositiveΔ\\Deltaregret andΔ\\Deltapoison ASR are worse; positiveΔ\\Deltagenuine\-update adherence rate is better\. Latency is per turn, added over the unpersonalized backbone, and token counts are in Appendix[B](https://arxiv.org/html/2609.02265#A2)\. Bold marks the full system’s reference values in the delta columns and the column best elsewhere\.
## Appendix HFailure Analysis

#### Successes\.

Two behaviors are worth naming\. On the context\-switch track, the modal correct action is*scope*rather than*revise*, andCaptureselects it in 71% of context\-switch changepoints against 4% for StateMem, which has no representation for a narrowed belief and must overwrite instead\. Separately, the context\-switch regret gap is 0\.07 against Recency RAG and 0\.09 against Provenance\-only\. StateMem is not among the baselines Appendix[I](https://arxiv.org/html/2609.02265#A9)reports on that track, so the scope statistic and the regret figures are two measurements rather than one decomposition\. On contamination, the gate’s most common success is not outright rejection but quarantine followed by non\-corroboration, which is how 58% of blocked poisoning attempts resolve\. The claim is held, never corroborated, and decays out of the ledger\.

#### Failures\.

The failures cluster\. Of the poisoning attempts that succeed, same\-origin writes account for 50\.7%, consistent with the 17\.5% same\-origin rate in Appendix[I](https://arxiv.org/html/2609.02265#A9)against 7\.0% and 10\.0% on the other two families, and a further 21% are slow attacks that assert a small shift repeatedly across many turns, which is by construction hard to separate from gradual drift and which we do not claim to solve\. The legitimate updatesCapturemisses are dominated by weak evidence, where the user signals a change indirectly rather than stating it\. Differences against StateMem on win rate and poison ASR are significant atp<0\.01p<0\.01under a paired randomization test with Holm correction\. The adaptation lag difference against Recency RAG is not, atp=0\.07p=0\.07\.

## Appendix IDrift and Contamination Breakdown

Table 7:Breakdown by drift shape and contamination family\. Regret columns are common\-pool dynamic regret\. Provenance filtering wins on indirect injection and fails on same\-origin attacks, the regime Theorem[1](https://arxiv.org/html/2609.02265#Thmtheorem1)identifies\. Each method’s mean over the three attack families reproduces its Poison ASR column in Table[1](https://arxiv.org/html/2609.02265#S5.T1)under equal family weights\.
## Appendix JCross\-Backbone and Out\-of\-Domain Results

Table 8:Cross\-backbone and out\-of\-domain results\. Out\-of\-domain holds out whole attack templates and drift schedules rather than individual episodes\. The discrete gate receives elapsed time aszt=log⁡\(1\+Δ​t/hour\)z\_\{t\}=\\log\(1\+\\Delta t/\\text\{hour\}\), standardized on training statistics and concatenated to the event representation before the GRU update\. It recovers 1\.3 of the 2\.4\-point win\-rate gap on Qwen3 and 1\.4 of 2\.5 on Llama\-3\.1, so explicit elapsed time accounts for roughly 55% of the continuous\-time advantage and not all of it\.