The Compliance Trap: Diagnosing How AI Agents Consume Conflicting Memory

Abstract: Memory is becoming a core component of long-horizon AI agents, allowing agents to reuse past experience when operating web browsers, software tools, and other interactive environments. Existing work mostly treats memory as a supply problem, asking what experience to write, how to store it, and which entry to retrieve for the next task. Yet we still lack a clear account of how models consume retrieved memory across a multi-step action trajectory. This consumption process matters because it determines not only what memories should be retrieved, but also what models and control policies are needed to use them safely. To diagnose this process, we propose Entry--Propagation--Recovery (E-P-R), a trajectory-level framework that asks where memory first changes an action, whether that change carries forward, and whether the agent can recover after leaving a correct path. We instantiate E-P-R on WebArena and on MemTrapBench, a controlled benchmark we build to isolate these phases. We find that the main failure often begins at entry: agents adopt conflicting memory at the first exposed decision point even when it is task-wrong. Repeated exposure then amplifies this early error, while recovery after divergence is weak. Together, these effects create a compliance trap: across models, conflicting memory induces similar compliance rates, but once agents comply, their success rates collapse to a low floor. Stronger agents therefore suffer larger absolute damage because each compliance event erases more baseline capability. These results suggest that memory-augmented agents should be evaluated not only by retrieval quality or final success rate, but by how they consume memory throughout the trajectory.

• The paper introduces the Entry-Propagation-Recovery (E-P-R) framework to decompose memory influence into entry, propagation, and recovery phases.
• It identifies a compliance trap where strong agents suffer larger performance damage due to high initial compliance with conflicting memory.
• Empirical results show that adaptive, consumption-aware policies outperform fixed memory schedules in mitigating long-horizon trajectory failures.

Diagnosing Memory Consumption Failures in Long-Horizon AI Agents

Motivation and Contribution

The paper "The Compliance Trap: Diagnosing How AI Agents Consume Conflicting Memory" (2607.10608) reframes the study of memory in AI agents from the supply-side problem (retrieval, storage, and writing) to the consumption-side dynamics. The core question addressed is how retrieved memory, particularly conflicting or task-wrong memory, alters the multi-step trajectories of long-horizon agents across web-based environments. The authors introduce a principled diagnostic framework, Entry-Propagation-Recovery (E-P-R), to systematically dissect the phases at which memory exerts its influence: Entry (first adoption), Propagation (continued effect), and Recovery (correction after divergence).

Three principal contributions are demonstrated:

1. Formalizing memory consumption as a trajectory-level problem and deploying E-P-R diagnostics.
2. Identifying the "compliance trap," where similar compliance rates across models lead to larger absolute damage for stronger agents.
3. Constructing MemTrapBench, a controlled benchmark isolating consumption dynamics, and showing that evaluation solely via final success-rate is insufficient to uncover memory-induced failures.

Theoretical Framework: Entry-Propagation-Recovery (E-P-R)

E-P-R decomposes agent trajectories with memory intervention into three stages:

• Entry: Where memory first influences agent action, marking deviation from the no-memory baseline.
• Propagation: Whether the initial divergence persists through subsequent steps under continued exposure.
• Recovery: The agent’s capacity to recover or return to task-correct trajectories after memory-induced divergence.

Methodologically, the consumption-side approach involves holding memory content fixed and manipulating its injection schedule, probing the agent's response rather than retrieval quality.

Empirical Findings: Memory-Induced Failure Modes

Compliance Trap and Damage Quantification

Empirically, conflicting memory is found to induce high compliance rates at the entry point (63–72% across models), with subsequent propagation leading to a collapse in task success rates to a low floor (17–31%), irrespective of baseline model capability. The cost metric, Damage Per Compliance (DPC), elucidates conditional harm: stronger agents show larger absolute damage since baseline success drops further post-compliance. For instance, Qwen3.5-27B exhibits a DPC of -25.5 percentage points upon compliance, a statistically significant decrement.

The trap dynamics are consistent across WebArena and MemTrapBench. Persistent conflicting memory amplifies harm relative to early injection, signifying the cumulative nature of propagation. Late injection is largely inert in shorter trajectories, confirming that memory-induced damage is not a single-step artifact but a longitudinal phenomenon.

Recovery Dynamics

Trajectory-level recovery after early adoption of conflicting memory is weak. While helpful memories allow for partial alignment with baseline trajectories (27–42% recovery), conflicting-memory trajectories show minimal re-alignment (7–15%), emphasizing the irreversibility of early erroneous actions in complex environments.

Gate Multiplicativity and Memory Channel Invariance

The authors validate the gate-chain mechanism via 2×2 factorial experiments, demonstrating that grounding and entry act multiplicatively on conflicting-damage while helpful-memory gains are bounded and more additive. Memory-induced harm is channel-agnostic—persistent-conflicting memory placement (system prompt vs. observation footer) does not alter compliance or success rates. This invariance affirms that the consumption dynamics, not delivery modality, underpin the trap.

Horizon Effects and Deployment Implications

The compliance trap requires substantial trajectory length for propagation and recovery failures to materialize. In short-horizon settings (MiniWoB++), memory effects are negligible, confirming that the identified failure mode is unique to long-horizon interactive environments.

Additionally, standard supply-side proxies (relevance, timing) are ineffective for reliably improving outcomes. Instead, adaptive policies—such as "retry-on-fail" that inject memory only after task failure—outperform fixed schedule policies and close >90% of the schedule-oracle gap, highlighting the need for consumption-aware memory management.

Practical and Theoretical Implications

The findings have several practical ramifications for agent design and evaluation:

• Evaluation frameworks must move beyond retrieval-centric metrics and incorporate trajectory-level diagnostics to expose failure modes concealed by aggregate success rates.
• Larger, more capable models are not inherently more robust to memory errors; instead, their vulnerability scales with baseline competence due to compliance-trap dynamics.
• Memory delivery mechanisms cannot mitigate compliance trap risks; only consumption-side control policies can.
• Policy adaptation conditioned on trajectory failures is essential for reliable deployment of memory-augmented agents.

Theoretically, the gate-multiplicative structure of memory consumption and compliance-trap asymmetry challenge prevailing assumptions in memory system design. Future work must investigate how E-P-R dynamics extend to other domains (terminal-use, robotics) and develop consumption-aware retrievers, controllers, and training-time interventions.

Conclusion

This study advances AI agent memory research by diagnosing consumption-induced trajectory failures via the E-P-R framework and controlled benchmarking. The compliance trap, characterized by high adoption of task-wrong memory and compounded, unrecoverable propagation effects, is substantiated across diverse models and benchmarks. The safety and reliability of long-horizon memory-augmented agents require explicit modeling and mitigation of consumption dynamics, not mere improvements in retrieval or storage. The presented methodologies and findings provide a foundation for systematic evaluation and design of robust agent memory systems.