Pith. sign in

REVIEW 3 major objections 5 minor 26 references

This paper claims that agent memory writes should be staged and validated before they can drive irreversible tool calls, and that a transactional commit protocol with cascading repair turns memory corruption into a handled, audited event.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-07-31 23:31 UTC pith:VQ4D42BL

load-bearing objection MemTX is worth engaging: the write-vs-commit split is real, the verification is machine-checked, and the main caveat—undeclared provenance—is disclosed in the paper itself. the 3 major comments →

arxiv 2607.23929 v2 pith:VQ4D42BL submitted 2026-07-27 cs.AI

MemTX: Transactional Belief Commit for Stateful Agent Memory

Xiaoyang Li , Yiqi Wang , Haohui Lu , Zhi Chen , Mo Li , Pingan Song , Mingkai Zheng , Taotao Cai This is my paper
classification cs.AI
keywords agent memorybelief committransactionsaction gatingcascading repairLLM agentsmemory safetyconformance suite
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that existing agent memory systems conflate recording an observation with committing to a belief, so a polluted or stale memory can silently drive an irreversible tool call. It presents MemTX, a protocol that stages writes in snapshot-isolated transactions, admits them through a four-check validate-and-commit pipeline, gates irreversible actions on in-flight belief state, and repairs derived records and tool effects when a belief is retracted. Two invariants — action-safety gating and cascade-repair completeness — are machine-checked over 5.5 million protocol states with zero violations. On a purpose-built conformance suite of 90 cases across five backbones and eight baselines, MemTX ranks first on four backbones and statistically ties the strongest on task success while being the only method with zero downstream harm. The paper's central thesis is that backbone capability cannot substitute for commit discipline.

Core claim

A memory write is not a belief commit. MemTX treats each record as a governed object with evidence, permissions, provenance, and validity, moving through an eight-state lifecycle from tentative to action-safe. Irreversible tool calls execute only when no tentative record is in flight and, at external-action risk, when the snapshot holds an action-safe record; retraction walks the derivation DAG and dispatches typed repair. The empirical claim is that this discipline leads all eight baselines on four of five backbones, statistically ties the strongest, and is the only method with zero realized downstream harm.

What carries the argument

The belief-commit state machine: an eight-state lifecycle (raw, tentative, validated, committed, action-safe, plus quarantined, superseded, revoked), five read isolation levels, risk-tiered transactions, a four-check commit pipeline (evidence, validity, semantic conflict, dependency stability), an action gate for irreversible calls, and typed cascading repair with a rollback log. Two invariants carry the argument: I1 (action-safety gating) and I2 (cascade-repair completeness), with corollary G3 ensuring no committed or action-safe record has a revoked transitive ancestor.

Load-bearing premise

The repair invariant and zero-harm result assume agents declare every derivation edge at staging time; a derivation never written down is never repaired, and the paper shows that when an agent transcribes private content without declaring the parent, every method including MemTX fails every case.

What would settle it

Run the source-scope transcription scenario — an agent that paraphrases a private record into a shared summary without declaring the parent — and measure whether the irreversible action is blocked. The paper reports that every backbone fails every case for every method in that family, including MemTX, so observing such a failure confirms the provenance-completeness boundary; observing a fix would extend the protocol beyond declared provenance.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If MemTX is right, agent memory systems should separate recording from committing, extending memory correctness from write time to action time and post-hoc repair.
  • Irreversible tool calls become gated events rather than silent consequences of polluted or stale beliefs.
  • Retracting a belief can repair derived records and compensate or log tool side effects, making rollback an auditable process.
  • The controlled conformance suite suggests capability and commit discipline are orthogonal: stronger backbones compress accuracy differences but not harm differences.
  • The protocol's guarantees are bounded by declared provenance and static tool reversibility, so deployments must treat those boundaries explicitly.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The protocol's guarantees ride on the completeness of declared provenance; if LLM agents omit derived-from edges in real deployments, the cascade cannot repair what was never recorded — the paper's own source-scope negative result makes this concrete.
  • A natural extension is content-based provenance verification that checks parent declarations against the actual text being staged, rather than trusting the agent's self-reported derivation edges.
  • Static tool reversibility could be replaced by runtime reversibility checks, since the paper notes that boundary shifts, such as a refund that settles, are outside the current model.
  • The zero-harm result on the LLM path exercises only the weak form of the action gate; deployments with cold stores would need the strong form priced as the paper does for the scripted path.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes MemTX, a transactional belief-commit middleware for LLM agent memory. Records carry evidence, permissions, provenance, and validity and move through an eight-state lifecycle (raw, tentative, validated, committed, action-safe, quarantined, superseded, revoked). Writes are staged in snapshot-isolated transactions and admitted through a four-check commit pipeline; irreversible tool calls are gated on the absence of in-flight tentative records (and, for external-action transactions, on the existence of at least one action-safe record); retraction triggers typed cascading repair over the recorded derivation DAG. The authors machine-check two invariants (action-safety gating and cascade-repair completeness) plus a global corollary by bounded exhaustive enumeration (5.53M states, 10.54M transitions) and property-based testing, and evaluate MemTX against eight baselines on five LLM backbones with a purpose-built 90-case conformance suite and a 56-case hardened suite. The paper reports that MemTX ranks first or ties on the main suite, achieves zero downstream harm on all backbones, and exposes two open problems (undeclared provenance and retry escapes) in its own scope blind spots.

Significance. The paper is a serious, well-executed contribution to a timely problem: it makes a clear conceptual point (a memory write is not a belief commit) and implements a concrete protocol with staged admission, action gating, and typed repair. The strengths are substantial: the invariant verification is run against the executable implementation rather than an abstract model, the scoping of the verification is stated honestly (bounded, not unbounded), the empirical design includes paired trap/control cases to penalize over-blocking, statistical testing uses paired McNemar with Holm correction and a clustering check, and the authors report their own negative results in the source-scope and temporal-scope families. If the protocol holds up under scrutiny, it provides a useful template for making agent-memory safety an explicit, auditable discipline. The main limitations are that the safety guarantees are conditional on agents declaring complete provenance and that the action gate's support condition is existential; the benchmark, while carefully built, is a conformance test for the protocol's own design choices rather than an independent task benchmark.

major comments (3)
  1. [§3.4 and §3.5 (I2)] The cascade-repair invariant I2 is triggered only by transaction abort and explicit revocation of a committed record. A belief displaced by semantic-conflict adjudication (§3.2) enters the 'superseded' state but does not invoke the shared repair routine. Consequently, a summary or profile derived from a superseded belief can remain committed or action-safe, and a tool action based on it is neither compensated nor marked leaked. In the running example, if 'refund-eligible' is later superseded by a higher-authority 'rejected' record, the derived profile and any executed refund would not be repaired. This is a load-bearing gap between the protocol's lifecycle and its 'cascade-repair completeness' claim. Please either treat supersession as a retraction trigger, or explicitly scope I2 and the abstract's cascade claim to the two retraction entry points, and add a semantic-conflict test case wi
  2. [§3.3, §3.5, and Appendix C] The strong form of action-safety gating (I1) requires only that the snapshot contain at least one action-safe record, not that the inputs of the irreversible action are action-safe. The manuscript acknowledges this in §3.5 ('not that the action's own inputs did') and Appendix C's probe shows that unrelated action-safe records can satisfy the gate. This weakens the practical force of the 'action-safety gating' invariant: a store with any matured belief will pass the gate for any irreversible call, including calls driven by a tentative or committed-but-immature record. The claim 'irreversible tool calls are gated on in-flight belief state' is literally true, but the safety guarantee implied by 'action-safety gating' is stronger than what I1 certifies. Please reframe I1 as 'tentative-free gating with an existential maturation condition,' or add a per-action relevance check, and report how f
  3. [§3.4, §5 (Scope blind spots), and Abstract] The headline safety result—'retracting a belief triggers typed cascading repair of its derived records' and 'zero downstream harm on every backbone'—is conditional on complete declared provenance. The protocol observes provenance but does not enforce it, and §3.4 concedes 'a derivation never written down is never repaired.' The source-scope family in §5 confirms that when an agent transcribes content without declaring a parent edge, every method including MemTX fails every case. Since real LLM agents will omit or misdeclare derived-from edges at some nonzero rate, the practical reach of the guarantee is unknown. The paper honestly names this open problem, but the abstract and contributions do not carry the condition. Please quantify under-declaration behavior in the LLM path, or explicitly phrase the abstract's guarantee as 'for recorded provenance' and state that the zero-harm result ap
minor comments (5)
  1. [Table 1] The table's symbols are garbled in the text (repeated 'G #' tokens). Please ensure the rendered table uses clean check/cross marks and a legend. Also, 'GEM/MemState' in Table 1 is referred to as 'MemState' elsewhere; keep names consistent.
  2. [§5, Hardened suite] The text says 'all 32 paired comparisons there are significant' after discussing 'four strong backbones,' while Table 8 reports 40 tests for the full five-backbone hardened suite with one non-significant pair. Clarify that the 32 refers to the four strong backbones, and identify the one non-significant pair explicitly in the main text.
  3. [Appendix A] The threshold sweep concludes that the evidence gate is non-binding for the tested suites because no record has confidence below 0.3. This is a useful caveat but should be stated in the main text near the commit-pipeline description, so readers do not infer that the evidence check is exercised by the reported results.
  4. [§3.5 / Abstract] The phrase 'machine-checked' appears without qualification in the abstract. The paper later specifies 'bounded, runtime-level verification, deliberately weaker than the unbounded soundness theorems.' Consider adding 'bounded' to the abstract's invariant claim for precision.
  5. [Appendix E] Table 12 is dense with many columns per method. Consider splitting rollback recall, permission enforcement, and allow rate into separate tables or using a grouped layout for readability.

Circularity Check

1 steps flagged

Empirical comparison is a conformance test of the protocol's own six-family taxonomy; the benchmark is constructed so each family is load-bearing for one MemTX component, so the headline win over baselines is largely by construction.

specific steps
  1. fitted input called prediction [§4 Experimental Setup (Hardened suite), §1 Introduction, Appendix H.1]
    "We therefore construct a conformance suite of 90 cases over the six state-corruption families of the introduction ... Each family makes one protocol component load-bearing, so a method missing that component has a family it cannot defend."

    The benchmark is built from the same six corruption families that the MemTX protocol was designed to address, and the hardened suite is explicitly engineered so that each family is load-bearing for exactly one MemTX component. A baseline lacking that component is therefore guaranteed to fail that family; the comparison is a conformance test of the authors' own taxonomy rather than an independent probe. The headline empirical claim — MemTX 'leads all eight baselines' and is 'the only method with zero downstream harm' — largely measures the presence or absence of the components the test was constructed to require, reducing the 'prediction' to the test design.

full rationale

No self-citation chain is load-bearing: the closest related work is externally cited, and the machine-checked invariants are verified against the protocol's own executable implementation, which is a standard spec-conformance check rather than a circular derivation. The central circularity is empirical: the 90/56-case suite is purpose-built, and each hardened family is tied to one protocol component, so the comparison to baselines is a conformance test of the authors' own taxonomy. This is mitigated by the inclusion of controls, over-blocking penalties, an honest negative result in the source-scope family, and the fact that GPT-5.5 ties rather than wins on the main suite, so the benchmark does not fully force the outcome. Still, the primary support for the 'leads all baselines' claim is a test constructed from the same failure taxonomy the protocol implements, warranting a moderate circularity score.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

MemTX is a systems protocol, so its ledger holds hand-chosen constants and domain assumptions rather than fitted parameters. The two evidence constants (0.6 confidence, 0.9 authority) are hand-chosen but swept in Appendix A with every safety metric unchanged from 0.3 through the default, so they act as cost-ordering defense-in-depth, not fitted drivers; note that main-suite trap records are authored at the inclusive 0.6 boundary with 0.62 as the next occupied grid point, so the constant and the benchmark grid are co-designed. The six corruption families are adopted as the operative taxonomy; each is grounded in cited prior incidents, but both suites are constructed solely from these families, aligning the benchmark with the protocol's components ('each family makes one protocol component load-bearing'). Cascade repair and dependency-stability checking assume agents declare derived-from edges; the paper's own source-scope negative result shows the guarantee evaporates when lineage is undeclared. Tool reversibility is assumed static at action time. Tier declaration is assumed to be trusted harness configuration. No invented entities: lifecycle states, isolation levels, and gates are implemented constructs with operational definitions checked against the executable implementation.

free parameters (3)
  • Evidence confidence threshold = 0.6 (inclusive)
    §3.2 evidence check requires writer confidence ≥ 0.6 unless authority ≥ 0.9; hand-chosen, swept in Appendix A from 0.3 to 0.8 with safety metrics unchanged through the default, acting as cost-ordering defense-in-depth rather than a fitted driver. Note: main-suite trap records are authored at the inclusive 0.6 boundary with 0.62 as the next grid point, so constant and benchmark grid are co-designed
  • Authority bypass threshold = 0.9 (inclusive)
    §3.2; authority ≥ 0.9 bypasses the confidence requirement (user/system/high-trust tool feeds). Appendix A sweeps it from 0.8 to fully disabled with no change to any safety metric.
  • Per-case tier mapping (intent-based gate pricing) = 26 main-suite / 20 hardened cases marked external-action
    Appendix C marks cases whose prompts name an irreversible tool; this authored mapping drives only the strong-gate pricing arms, not the headline configuration, and is disclosed as pre-registered from prompt text alone.
axioms (5)
  • domain assumption Database-style snapshot isolation and transactional commit semantics transfer to an agent belief store (§3.2)
    The protocol models memory as a transactionally governed store with snapshots and commit; prior work (Khan 2026) machine-checks one instance of snapshot isolation in multi-agent settings, supporting transferability, but the mapping is a design premise.
  • domain assumption The six corruption families are the operative taxonomy of shared-memory failures (§1, §4, Table 15)
    Both suites are built entirely from these six families; if the taxonomy omits important corruption modes, the evaluation overstates coverage. Families are grounded in cited incidents, but taxonomy completeness is asserted, and the paper's own negative results show modes no method handles.
  • domain assumption Agents declare derived-from edges at staging time (§3.1, §3.4)
    Cascade repair and the dependency-stability check walk the declared derivation DAG; §3.4 states 'a derivation never written down is never repaired,' and the source-scope negative result (§5) shows every method fails when lineage is undeclared.
  • domain assumption Tool reversibility is a static, per-tool property (§3.4)
    Stated as a limitation: 'reversibility is a static per-tool designation... a boundary that shifts at action time... is outside the model.' Compensation and leak bookkeeping depend on this partition.
  • domain assumption Tier declaration is trusted harness configuration, not agent output (§3.1, §3.5)
    Action-gate strength depends on correct tier declaration; no agent-facing tool carries a tier argument, but the trusted-harness assumption remains explicit and unverified in deployment.

pith-pipeline@v1.3.0-alltime-deepseek · 20033 in / 29302 out tokens · 265844 ms · 2026-07-31T23:31:23.755684+00:00 · methodology

0 comments
read the original abstract

LLM agents increasingly coordinate through persistent shared memory: one agent's write becomes another agent's premise, and eventually a tool call with real side effects. Current agent memory systems treat every accepted write as immediately actionable truth, so a polluted tool result, a stale update, or a teammate's half-finished note can silently drive an irreversible action. We argue that a memory write is not a belief commit. We present MemTX, a transactional belief-commit protocol. Each record carries evidence, permissions, provenance, and validity. Writes are staged inside snapshot-isolated transactions and admitted by a validate-and-commit pipeline, irreversible tool calls are gated on in-flight belief state, and retracting a belief triggers typed cascading repair of its derived records and tool side effects. Two invariants, action-safety gating and cascade-repair completeness, are machine-checked by property-based testing and bounded exhaustive enumeration of 5.5 million protocol states, with zero violations. Across five backbones from three model families, MemTX leads all eight baselines with paired-McNemar significance on four backbones and statistically ties the best baseline on the fifth and strongest, while remaining the only method with zero downstream harm on every backbone. Backbone capability does not substitute for commit discipline.

Figures

Figures reproduced from arXiv: 2607.23929 by Haohui Lu, Mingkai Zheng, Mo Li, Pingan Song, Taotao Cai, Xiaoyang Li, Yiqi Wang, Zhi Chen.

Figure 1
Figure 1. Figure 1: The MemTX protocol as a folded timeline. Admission runs left to right, realizing invariant I1. When a committed [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Single-component ablation on the 90-case main [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The same removals on the 56-case hardened suite, [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

26 extracted references · 17 linked inside Pith

  1. [6]

    Harish Santhanalakshmi Ganesan

    URL https://arxiv.org/abs/2603.07670. Harish Santhanalakshmi Ganesan. Worlddb: A vector graph- of-worlds memory engine with ontology-aware write-time reconciliation.arXiv preprint arXiv:2604.18478,

    arXiv

  2. [7]

    GLM-4.5: Agentic, reasoning, and cod- ing (ARC) foundation models.arXiv preprint arXiv:2508.06471,

    GLM Team. GLM-4.5: Agentic, reasoning, and cod- ing (ARC) foundation models.arXiv preprint arXiv:2508.06471,

    Pith/arXiv arXiv

  3. [9]

    Sajjad Khan

    URL https://arxiv.org/abs/2602.06052. Sajjad Khan. Verified detection and prevention of concur- rency anomalies in multi-agent large language model sys- tems.arXiv preprint arXiv:2606.17182,

    arXiv

  4. [10]

    Safe- flow: A principled protocol for trustworthy and trans- actional autonomous agent systems.arXiv preprint arXiv:2506.07564,

    Peiran Li, Xinkai Zou, Zhuohang Wu, Ruifeng Li, Shuo Xing, Hanwen Zheng, Zhikai Hu, Yuping Wang, Haoxi Li, Qin Yuan, Yingmo Zhang, and Zhengzhong Tu. Safe- flow: A principled protocol for trustworthy and trans- actional autonomous agent systems.arXiv preprint arXiv:2506.07564,

    Pith/arXiv arXiv

  5. [11]

    Shuyi Liu, Yuming Shang, and Xi Zhang

    URL https://arxiv.org/abs/2604.16548. Shuyi Liu, Yuming Shang, and Xi Zhang. Truthfulrag: Resolving factual-level conflicts in retrieval-augmented generation with knowledge graphs,

    Pith/arXiv arXiv

  6. [12]

    Adyasha Maharana, Dong-Ho Lee, Sergey Tulyakov, Mohit Bansal, Francesco Barbieri, and Yuwei Fang

    URL https: //arxiv.org/abs/2511.10375. Adyasha Maharana, Dong-Ho Lee, Sergey Tulyakov, Mohit Bansal, Francesco Barbieri, and Yuwei Fang. Evaluating very long-term conversational memory of LLM agents. In Proceedings of the 62nd Annual Meeting of the Associa- tion for Computational Linguistics,

    arXiv

  7. [13]

    Governed shared memory for multi- agent llm systems.arXiv preprint arXiv:2606.24535,

    Yanki Margalit, Nurit Cohen-Inger, Erni Avram, Ran Taig, and Oded Margalit. Governed shared memory for multi- agent llm systems.arXiv preprint arXiv:2606.24535,

    Pith/arXiv arXiv

  8. [14]

    Is agent memory a database? rethinking data foundations for long-term ai agent memory.arXiv preprint arXiv:2605.26252,

    9 Abdelghny Orogat and Essam Mansour. Is agent memory a database? rethinking data foundations for long-term ai agent memory.arXiv preprint arXiv:2605.26252,

    Pith/arXiv arXiv

  9. [15]

    Memgpt: Towards llms as operating systems.arXiv preprint arXiv:2310.08560,

    Charles Packer, Vivian Fang, Shishir G Patil, Kevin Lin, Sarah Wooders, and Joseph E Gonzalez. Memgpt: Towards llms as operating systems.arXiv preprint arXiv:2310.08560,

    Pith/arXiv arXiv

  10. [16]

    ISBN 9798400701320

    Association for Computing Machinery. ISBN 9798400701320. doi: 10.1145/3586183.3606763. URL https://doi.org/10.1145/ 3586183.3606763. Qwen Team. Qwen2.5 technical report.arXiv preprint arXiv:2412.15115,

    arXiv

  11. [17]

    Qwen3 technical report.arXiv preprint arXiv:2505.09388,

    Qwen Team. Qwen3 technical report.arXiv preprint arXiv:2505.09388,

    Pith/arXiv arXiv

  12. [18]

    Zep: a temporal knowledge graph architecture for agent memory.arXiv preprint arXiv:2501.13956,

    Preston Rasmussen, Pavlo Paliychuk, Travis Beauvais, Jack Ryan, and Daniel Chalef. Zep: a temporal knowledge graph architecture for agent memory.arXiv preprint arXiv:2501.13956,

    Pith/arXiv arXiv

  13. [19]

    Gatemem: Benchmarking mem- ory governance in multi-principal shared-memory agents

    Zhe Ren, Yibo Yang, Yimeng Chen, Zijun Zhao, Benshuo Fu, Zhihao Shu, Bingjie Zhang, Yangyang Xu, Dandan Guo, and Shuicheng Yan. Gatemem: Benchmarking mem- ory governance in multi-principal shared-memory agents. arXiv preprint arXiv:2606.18829,

    Pith/arXiv arXiv

  14. [20]

    Collaborative memory: Multi-user memory sharing in llm agents with dynamic access con- trol.arXiv preprint arXiv:2505.18279,

    Alireza Rezazadeh, Zichao Li, Ange Lou, Yuying Zhao, Wei Wei, and Yujia Bao. Collaborative memory: Multi-user memory sharing in llm agents with dynamic access con- trol.arXiv preprint arXiv:2505.18279,

    Pith/arXiv arXiv

  15. [22]

    Memotime: Memory- augmented temporal knowledge graph enhanced large lan- guage model reasoning

    Xingyu Tan, Xiaoyang Wang, Qing Liu, Xiwei Xu, Xin Yuan, Liming Zhu, and Wenjie Zhang. Memotime: Memory- augmented temporal knowledge graph enhanced large lan- guage model reasoning. InProceedings of the ACM Web Conference 2026, pages 4220–4231,

    2026

  16. [23]

    Toki: A bitemporal operator algebra for con- tradiction resolution in llm-agent persistent memory.arXiv preprint arXiv:2606.06240,

    Ziming Wang. Toki: A bitemporal operator algebra for con- tradiction resolution in llm-agent persistent memory.arXiv preprint arXiv:2606.06240,

    Pith/arXiv arXiv

  17. [24]

    ISBN 978-981-92-1468-6

    Springer Nature Singapore. ISBN 978-981-92-1468-6. Rongwu Xu, Zehan Qi, Zhijiang Guo, Cunxiang Wang, Hon- gru Wang, Yue Zhang, and Wei Xu. Knowledge conflicts for llms: A survey. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8541–8565,

    2024

  18. [25]

    Temporal validity in retrieval memory: Elim- inating stale-fact errors for ai agents over evolving knowl- edge.arXiv preprint arXiv:2606.26511,

    Neeraj Yadav. Temporal validity in retrieval memory: Elim- inating stale-fact errors for ai agents over evolving knowl- edge.arXiv preprint arXiv:2606.26511,

    Pith/arXiv arXiv

  19. [26]

    10 A Threshold Sensitivity A.1 Sweep Design The commit pipeline’s two evidence constants are not tuned

    URL https://arxiv.org/abs/2603.10062. 10 A Threshold Sensitivity A.1 Sweep Design The commit pipeline’s two evidence constants are not tuned. A deterministic sweep on the scripted path varies the con- fidence threshold from 0.3 to 0.8 and the authority bypass from 0.8 to a setting that disables bypassing entirely. The sweep certifies the scripted path; th...

    arXiv

  20. [1995]

    ISBN 0897917103

    Associa- tion for Computing Machinery. ISBN 0897917103. doi: 10.1145/224964.224987. URL https://doi.org/10.1145/ 224964.224987. Aaditya Singh, Adam Fry, Adam Perelman, Adam Tart, Adi Ganesh, Ahmed El-Kishky, Aidan McLaughlin, Aiden Low, AJ Ostrow, Akhila Ananthram, et al. Openai gpt- 5 system card.arXiv preprint arXiv:2601.03267,

    arXiv

  21. [2000]

    A critique of ansi sql isolation levels.arXiv preprint cs/0701157,

    Hal Berenson, Phil Bernstein, Jim Gray, Jim Melton, Eliz- abeth O’Neil, and Patrick O’Neil. A critique of ansi sql isolation levels.arXiv preprint cs/0701157,

    Pith/arXiv arXiv

  22. [2009]

    doi: 10.1145/1620585.1620587

    ISSN 0362-5915. doi: 10.1145/1620585.1620587. URL https://doi.org/10. 1145/1620585.1620587. Hanxiang Chao, Yihan Bai, Rui Sheng, Tianle Li, and Yushi Sun. Stale: Can llm agents know when their memories are no longer valid?arXiv preprint arXiv:2605.06527,

    arXiv

  23. [2023]

    URL https: //arxiv.org/abs/2306.03901. Wei-Chieh Huang, Weizhi Zhang, Yueqing Liang, Yuanchen Bei, Yankai Chen, Tao Feng, Xinyu Pan, Zhen Tan, Yu Wang, Tianxin Wei, Shanglin Wu, Ruiyao Xu, Liang- wei Yang, Rui Yang, Wooseong Yang, Chin-Yuan Yeh, Hanrong Zhang, Haozhen Zhang, Siqi Zhu, Henry Peng Zou, Wanjia Zhao, Song Wang, Wujiang Xu, Zixuan Ke, Zheng Hu...

    Pith/arXiv arXiv

  24. [2024]

    URL https://proceedings.neurips.cc/paper files/paper/ 2024/file/eb113910e9c3f6242541c1652e30dfd6-Paper- Conference.pdf

    doi: 10.52202/079017-4136. URL https://proceedings.neurips.cc/paper files/paper/ 2024/file/eb113910e9c3f6242541c1652e30dfd6-Paper- Conference.pdf. Zheng Chen, Hanqing Liu, Duling Xu, Dong Dong, Jialin Li, Bangzheng Pu, and Jidong Zhai. Cordon: Seman- tic transactions for tool-using llm agents.arXiv preprint arXiv:2606.17573,

    Pith/arXiv arXiv 2024

  25. [2025]

    From untrusted input to trusted memory: A sys- tematic study of memory poisoning attacks in llm agents

    Pritam Dash, Tongyu Ge, Aditi Jain, Tanmay Shah, and Zhi- wei Shang. From untrusted input to trusted memory: A sys- tematic study of memory poisoning attacks in llm agents. arXiv preprint arXiv:2606.04329,

    Pith/arXiv arXiv

  26. [2026]

    Mem0: Building production-ready ai agents with scalable long-term memory.arXiv preprint arXiv:2504.19413,

    Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav. Mem0: Building production-ready ai agents with scalable long-term memory.arXiv preprint arXiv:2504.19413,

    Pith/arXiv arXiv