This work argues that a memory write is not a belief commit, and presents MemTX, a transactional belief-commit protocol, a transactional belief-commit protocol that leads all eight baselines with paired-McNemar significance on four backbones and statistically ties the best baseline on the fifth and strongest, while remaining the only method with zero downstream harm on every backbone.
Abstract
LLM agents increasingly coordinate through persistent shared memory: one agent's write becomes another agent's premise, and eventually a tool call with real side effects. Current agent memory systems treat every accepted write as immediately actionable truth, so a polluted tool result, a stale update, or a teammate's half-finished note can silently drive an irreversible action. We argue that a memory write is not a belief commit. We present MemTX, a transactional belief-commit protocol. Each record carries evidence, permissions, provenance, and validity. Writes are staged inside snapshot-isolated transactions and admitted by a validate-and-commit pipeline, irreversible tool calls are gated on in-flight belief state, and retracting a belief triggers typed cascading repair of its derived records and tool side effects. Two invariants, action-safety gating and cascade-repair completeness, are machine-checked by property-based testing and bounded exhaustive enumeration of 5.5 million protocol states, with zero violations. Across five backbones from three model families, MemTX leads all eight baselines with paired-McNemar significance on four backbones and statistically ties the best baseline on the fifth and strongest, while remaining the only method with zero downstream harm on every backbone. Backbone capability does not substitute for commit discipline.
MemTxn is a governance layer outside the answer model that verifies whether an update is supported by its source and restores the application-visible state after a fault, and achieves the highest average F1 across all twelve answer-model configurations.
Han-Shuai Cui, Zhiqing Tang, Z. Yao et al.· arXiv.org· 2 citations
TARL is introduced, a memory state update framework that maps each statement to one of five executable actions and is trained by comparing the memory states produced by alternative update operations, encouraging the model to select the operation that leads to the correct result.
Han Xiao, Hongjun Xu, Xin Zhang et al.· 0 citations
SafeCommit, a risk controlled layer between agent reasoning and external execution, is introduced, a calibrated set of plausible latent worlds from memory, observations, tool outputs, provenance, and policy constraints that permits a side effectful action only when a conformal action certificate shows that the action is safe in every retained world.
This work identifies one structural contributor: draft-anchored verification checks what a response says, and in an open-ended response the stale dependency is usually unsaid, so StateAuditor audits in the opposite direction, from stored state to draft.
GPM is introduced, an auditable bitemporal state-transition model with source-bound admission, derived lifecycle state, current public barriers, and fail-closed structured release with bounded contract and implementation results, not open-world model accuracy or evidence of world truth.
ChronoMem is the first open-source system and benchmark for systematic semantic global memory rollback in LLM agents, and a post-exposure evaluation protocol that tests whether an agent can behave counterfactually after rollback by answering queries and summarizing history as if future updates had never occurred.
Yongye Su, Wujiang Xu, Chaoji Zuo et al.· arXiv.org· 1 citation
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.