Whose Memory Is It? Scope-Aware Commit Rules for Long-Term LLM Memory

AI summary

Overview

Research area: Mechanistic interpretability and long-term memory for LLM agents, connecting discourse semantics (mental spaces) to a concrete memory-commit interface.

Technical level: Advanced. The paper combines causal interchange interventions, distributed alignment search, invariant representation theory, and formal claims (invariance, completeness, perturbation stability) with an applied memory-admission benchmark.

Scope in one sentence: The paper argues that persistent agent memory must store not just a proposition but the discourse owner that licenses it, and introduces Cask (Causally Anchored Scoping Keys), a compact, basis-invariant commit rule built from the model's own ownership-sensitive internal signal.

What This Paper Is About

An LLM agent that deliberates may generate plans, simulated tool outputs, reported beliefs, and counterfactual branches, then reject most of them. If a persistent memory keeps only the resulting sentences, a discarded branch can later return as a fact. The paper names the missing context discourse ownership — the world, branch, or speaker that licenses a proposition — and builds a mechanism that preserves it at the boundary between reasoning and retrieval.

Key Contributions

1. Identifies discourse ownership as the missing commit type. The authors define ownership formally (owners are the shared actual world ω₀ plus scoped owners such as hypothetical worlds and attitude holders), define a binary target a(c) indicating whether a proposition may become an unconditional shared-memory premise, and show through interchange interventions that the model's ownership route causally controls a frozen write decision.
2. Develops a stable relational key. Cask encodes the diagnostic response configuration as two separately typed Gram blocks (ownership-responsive and complementary) plus four output-logit differences, giving 46 features. Formal guarantees cover gauge invariance, completeness for ordered configurations, perturbation stability, and a typed-refinement result showing the two blocks cannot be recovered from the summed Gram alone.
3. Demonstrates downstream effects. Controlled long-conversation conflicts and generated tool-agent traces show improved memory admission, reduced premise contamination, and a measurable safety/utility trade-off against flat memory.
4. Proposes a provenance-aware deployment policy and an evaluation target. Runtime provenance (a ledger of event status) and Cask (proposition-level scope inside language, summaries, and reflections) are described as complementary levels, and premise licensing is proposed as an objective alongside retrieval and question answering.

Main Findings

• The routing variable is causally controllable. On Qwen2.5-3B, rank-16 interventions routed 134 of 146 held-out cases to the target mental space (91.78%), while matched random subspaces reached 3.22%. Clustering the 74 target scenarios gave an intervention advantage of 88.56 points (95% CI [83.30, 93.34]). The 1.5B replication showed 86.30% causal routing versus 20.86% for matched random subspaces, with donor content in 1.37% of cases.
• Intervening on the route changes the memory-commit decision. Replacing the ownership-subspace state with an opposite-scope donor moved commit probability by 0.715 toward the donor (95% CI [0.656, 0.775]), succeeded in the intended direction for 97.5% of records, and flipped 75.8% of decisions. The effect appeared in both directions (0.694 actual→scoped; 0.736 scoped→actual). In Table 1, the complement block gave 0.048 (6.6% flips), a norm-matched random rank-16 block gave 0.004 (0.6% flips), and a same-scope ownership swap gave −0.034 (5.9% flips).
• Cask leads every evaluated attachment representation at both scales. Table 2 reports 83.33% attachment on Qwen2.5-3B and 79.82% on Qwen2.5-1.5B at τ = 0.5. Complement Gram + logits was second on 3B, 2.16 points behind; the unrestricted full-hidden probe (2,048 coordinates) was second on 1.5B, 2.35 points behind.
• The gain is about scope, not payload. In the scope-only factorial control, where actual and nonactual examples have byte-identical evidence payloads, Cask reached 78.70%, above every invariant control and all 20 random decompositions. Holding scope fixed removed the advantage.
• Prompt and frame controls. The conversation-isolated gate reached 90.94% under unseen meaning-preserving diagnostic paraphrases and 93.44% on unseen reporting frames, versus 72.81% for TF–IDF on the latter. Holding out both banks jointly yielded 70.16% (chance 50%); the unchanged-data reference was 97.81%.
• Effects propagate to conflicting memory. Against the strongest invariant baseline in Table 3, Cask improved attachment by 2.05 points, raised recall@5 and MRR, and reduced contamination from 7.61% to 7.41%. Reader EM and F1 rose by 2.06 and 1.88 points, while injected-answer adoption tied at 1.03%. Flat memory reached 29.63 EM and 40.19 F1 while adopting the conflict 4.53% of the time.
• The chain repeats at smaller scale. At τ = 0.5 on 1.5B, Cask obtained 46.09% recall@5, 18.11% contamination, 26.13 EM, and 36.92 F1. The paper reports that the larger model has the cleaner safety profile.
• One scorer supports two policies. Cask@R95 selects a development threshold for at least 95% actual admission; it preserved flat-memory recall and reciprocal rank while reducing contamination by 11.19 points and conflict adoption by 1.17 points, with 29.42 EM and 40.30 F1.
• Natural tool-agent traces favor a hybrid. Across 75 generated tool-using episodes (511 records; ten conversations), a trace-adapted Cask fallback led learned gates in balanced accuracy at 91.10% versus TF–IDF's 90.40%, and admitted more actual observations (89.13% versus 81.52%). With exact provenance retained for half the records, the layered policy reached 95.02%. A six-way batched diagnostic pass cost 32.1 ms versus 24.8 ms for one diagnostic (1.29×).

Methodology in Plain English

The authors start from an observation about how models work. Using interchange interventions — replacing part of a target example's hidden state with the corresponding state from a paired "donor" example that has the opposite ownership — they test whether the model routes the target to the donor's mental space while keeping the target's own proposition. Distributed alignment search (DAS) learns the rank-16 subspace on which that replacement is performed.

They then freeze that subspace and ask six fixed Yes/No diagnostic prompts about each candidate memory record: shared-memory admission, premise licensing, speaker commitment, future factual use, actual-world ownership, and frame removal. For each prompt they collect the last-token hidden state at the selected block. Grouping these states into a matrix H, they project H onto the ownership subspace (giving G∥) and onto its orthogonal complement (giving G⟂), and record the four Yes/No pre-softmax score differences as ℓ. The feature is the concatenation of the upper triangles of both Gram blocks and ℓ: 21 + 21 + 4 = 46 numbers, fed to a logistic regression with 47 learned parameters after standardization. Because a Gram matrix is unchanged by an orthogonal change of basis inside the subspace, the key survives equivalent reparameterizations — unlike raw coordinates.

For evaluation, they use frozen Qwen2.5-3B-Instruct and Qwen2.5-1.5B-Instruct representations. Block 20 and rank 16 on 3B were fixed in a pilot; the 1.5B study matched relative depth at block 16 and transferred rank 16 without a new search. From LoCoMo, a benchmark of long multi-session conversations with 1,986 annotated questions, they use 486 questions with exact answer spans. The answer-conflict study contains 972 candidate records. Two factorial datasets (scope-only and payload-only) contain 4,860 records each (2,430 pairs). Alternative answers are drawn only from training conversations under source-isolated folds, with zero exact overlap against development or test answers. BM25 scores a common corpus once, and each gate filters the same ranking; conflicting-answer adoption is the fraction of outputs repeating the injected alternative.

Why This Matters

Impact on research. The paper reframes a systems question — what should an agent persist? — as a linguistic one, and grounds it in a causally validated internal variable. It proposes premise licensing as an evaluation objective distinct from retrieval quality and question answering, and gives formal results (gauge invariance, completeness, perturbation stability, typed refinement, and a composite commit-stability corollary) that let measured representation drift act as a certificate for the deployed decision.

Real-world applications

• Personal assistants that must not turn a considered plan (for example, "move to Paris") into a durable personal fact after the user chose otherwise.
• Tool-using agents that generate simulated or speculative tool results, where a hypothetical outcome must not be retrievable as an observed one.
• Multi-speaker or multi-agent settings where reported beliefs must stay attached to their holder rather than becoming shared-world premises.
• Long-running enterprise memory, where an audit trail of which world licensed each stored proposition matters for governance.

Industry relevance. Agent builders get a compact gate (46 features, 47 parameters) that can sit between deliberation and retrieval without changing the retriever, and a deployment policy that can be tuned toward safety-first or recall-first behavior without retraining. The provenance-first hybrid result indicates the gate combines with existing execution metadata rather than replacing it.

Future Directions

• Extending ownership to nested scopes, where a belief about a belief, or a plan inside a hypothetical, needs more than a binary actual/nonactual edge.
• Applying the interface to learned retrievers rather than the BM25 ranking held fixed in these experiments.
• Testing the approach on broader model families beyond the two frozen Qwen2.5 backbones evaluated here.
• Determining when a full runtime ledger (the privileged upper bound reported at 95.02% layered accuracy) is worth its cost, versus the gate alone.
• Further investigating the safety–utility trade-off: flat memory attained the highest EM and F1 in the conflict study while adopting the injected answer most often, so how to weigh aggregate QA against premise licensing remains open.

Target Audience

Researchers in LLM agent memory, mechanistic interpretability, and computational semantics; practitioners building persistent or tool-using agents who need a commit boundary between exploration and durable state; and evaluation designers interested in premise licensing as a measurable objective alongside retrieval and question answering. Readers without background in interchange interventions, DAS, or Gram-matrix arguments will find the method section demanding, while the problem framing and results tables are accessible to a broader agent-systems audience.

Authors’ abstract

Persistent memory allows an LLM agent to carry experience across conversations, but it also turns a local reasoning mistake into a durable one. During deliberation, an agent may consider a plan, simulate a tool result, report another speaker's belief, and then reject all of them. If memory retains only the resulting sentences, those once-useful possibilities can later return as facts. The record is neither fabricated nor irrelevant; it has simply been detached from the context in which it was valid. We identify this missing context as \emph{discourse ownership}: the world, branch, or speaker that licenses a proposition. Our first finding is counterintuitive. Language models already carry a causally active signal for ownership, yet conventional memory interfaces discard it when they convert reasoning into records. We introduce CASK (Causally Anchored Scoping Keys), a commit rule that preserves this signal so that shared-world facts enter durable memory while provisional content remains available only within its original scope. Our second finding is that the most obvious way to preserve the signal---storing the discovered internal coordinates---is unreliable because equivalent representations need not keep the same coordinates. CASK instead preserves the stable relations that express ownership. Controlled long-conversation conflicts and tool-agent traces show that this design improves memory admission and prevents provisional content from contaminating later answers while complementing runtime provenance. The resulting commit boundary lets agents explore more possibilities without granting every intermediate sentence authority over future behavior.