Papers
Topics
Authors
Recent
Search
2000 character limit reached

MemTrapBench: Benchmarking Cognitive Traps in LLM Memory Use

Published 20 Aug 2026 in cs.AI, cs.CL, cs.CY, cs.DB, and cs.LG | (2608.20202v1)

Abstract: Memory has become a key component of LLMs, enabling them to retain information and learn from long-term interactions. However, existing memory benchmarks mainly evaluate whether information is correctly extracted, stored, and retrieved, while largely overlooking how retrieved memories reshape model reasoning and affect performance on the current task. We identify memory-induced cognitive traps: even faithfully recorded and semantically relevant memories can distort model reasoning or beliefs and degrade current task performance. To systematically evaluate these failure modes, we introduce MemTrapBench, which covers two forms of cognitive traps: Reasoning Fixation and Belief Distortion. Experiments across two model families and five representative memory frameworks show that MemTrapBench is challenging: all evaluated memory strategies underperform the no-memory setting, with even the strongest methods suffering drops of more than 10%. To mitigate these cognitive traps, we propose AdaptiveMem, a simple yet effective inference-time method that instructs LLMs to avoid memory traps. AdaptiveMem mitigates cognitive traps on MemTrapBench while preserving or improving performance on standard memory benchmarks across diverse memory frameworks.

Summary

  • The paper introduces MemTrapBench, a 1,050-instance benchmark covering Cognitive Bias, Task Boundary, Safety, and Trauma traps that test whether memory improves or harms task performance.
  • Across Gemini-3-Flash-Preview and Qwen3-30B with five memory systems, memory consistently reduced accuracy by more than 10 percentage points, with the largest declines in Cognitive Bias and Safety scenarios.
  • The paper proposes AdaptiveMem, a prompt-based mitigation that improves several memory systems by up to 14.9 points on MemTrapBench while preserving or improving performance on most LongMemEval settings.

Motivation and problem formulation

Existing memory benchmarks for LLMs concentrate on the mechanics of memory management—extraction, storage, updating, and retrieval—while largely neglecting a downstream question: does the retrieved memory actually improve reasoning on the current task, or can it actively impair it? This paper formulates memory-induced cognitive traps, defined formally as cases where the response quality with memory falls below the response quality without memory on the same query, i.e., s(y^M)<s(y^∅)s(\hat{y}_{M}) < s(\hat{y}_{\varnothing}). The traps arise even when memories are faithfully recorded, correctly retrieved, and semantically relevant: the prior context anchors the model to a stale reasoning strategy or distorts its beliefs. A motivating example is a 24-Game variant permitting higher-order operations, where a history of valid solutions using basic arithmetic causes the model to fixate on that operation regime and miss a factorial-based solution it would otherwise find.

Benchmark taxonomy and construction

MemTrapBench organizes cognitive traps into two categories. Reasoning Fixation covers within-task and cross-task fixation: Cognitive Bias (overgeneralization of a previously successful strategy to an instance requiring a different one), Trauma (feedback-induced avoidance of a strategy that is correct for the current instance, with "Trauma" used strictly as a behavioral analogy rather than a claim about model affect), and Task Boundary (persistence of prior task rules across task transitions). Belief Distortion is instantiated by the Safety scenario, which tests whether counterfactual or sandbox-specific premises planted in history can override straightforward safety judgments on real-world queries.

Construction proceeds in three stages: manual seed design (each seed specifying Domain, Trap Mechanism, Ground Truth, and Planted Prior), GPT-5.4-driven expansion into multi-turn dialogues of 18–40 turns that plant the trap, bury it in unrelated noise, and then spring it via a query that changes the conditions under which the prior applies, and finally a two-stage quality-control pipeline combining automated filtering with expert human validation. Explicit reset cues such as "ignore previous rules" are excluded, so the model must recognize the contextual transition itself. The resulting benchmark contains 1,050 instances: 350 Cognitive Bias, 350 Task Boundary, 200 Safety, and 150 Trauma. Each final query is independently solvable, enabling controlled comparison against a no-memory baseline and positioning the benchmark as a diagnostic stress test of harmful memory influence rather than a general evaluation of memory utility. Responses are judged on correctness, format, relevance, and efficiency using GPT-5.2 as primary judge, with cross-judge consistency verified against Claude Sonnet 4.6.

Main results: memory consistently hurts

The central finding is stark: across Gemini-3-Flash-Preview and Qwen3-30B-A3B-Instruct-2507, and across FullText, LightMem, MemOS, SimpleMem, and EverMemOS, no memory strategy consistently improves over the no-memory baseline. Without memory, the two models score 85.16% and 81.83% on average; the best memory strategies reach only 71.17% (EverMemOS on Gemini) and 70.13% (LightMem on Qwen), drops exceeding 10 percentage points even for the strongest methods. Degradation is most severe on Cognitive Bias (down to 46.66% on Gemini) and Safety (down to 56.15%). FullText history alone reduces Gemini's average from 85.16% to 60.68%, indicating that even unmediated context injection is harmful in these settings.

Ablations: trap semantics, not context length

Controlled experiments isolate the cause. On paired subsets, replacing trap-inducing memory with trap-free memory of the same task and relevant history restores performance: on Task Boundary, the no-trap control achieves 94.39% versus 31.05% with the trap (and 92.29% without memory); on Trauma, removing abusive feedback while preserving the medical content raises the average from 69.43% to 84.33%, with correctness recovering from 66.40% to 91.07%. A clinical case study illustrates the mechanism: after abusive criticism of an epinephrine recommendation for a patient with a specific contraindication, the model withholds epinephrine from a different, healthy patient in anaphylactic shock—overgeneralizing a bounded contraindication. Memory-length experiments show the trap takes effect immediately (average drops from 92.29% to 36.03% at only 25% of the history) and deepens monotonically to 31.05% at full length, confirming that degradation is driven by trap semantics rather than context length alone. Judge reliability analysis with GPT-5.2 and Claude Sonnet 4.6 shows both models agree on the direction and rough magnitude of the effect (drops of 61.24 and 55.50 points respectively), though absolute scores differ—Claude rates the memory condition considerably higher (40.07% vs. 31.05%), a caveat on absolute judge calibration.

AdaptiveMem

As a mitigation, the paper proposes AdaptiveMem, an inference-time system prompt that instructs the model to watch for the four trap types, identify the live task from the latest query alone, and prefer objective truth and safety over prior context when they conflict. It requires no changes to memory storage, retrieval, or model parameters and integrates directly into existing frameworks. On MemTrapBench, AdaptiveMem improves FullText, LightMem, and EverMemOS by 11.8, 14.9, and 11.3 points on Gemini, and 4.2, 2.5, and 2.6 points on Qwen3-30B. On LongMemEval it improves four of six settings and leaves the remaining two unchanged, with gains up to 4.0 and 3.0 points—suggesting the mitigation does not sacrifice standard memory utility. The gains are, however, prompt-based and therefore potentially brittle to adversarial contexts that defeat the heuristic checks, a limitation the paper does not probe.

Limitations and open questions

Several constraints qualify the findings. The benchmark is deliberately a stress test of planted traps, so its instances overrepresent adversarial histories relative to organic interaction data; the paper does not measure the base rate of cognitive traps in natural deployments. Evaluation relies on LLM judges whose absolute scores diverge across models, and the two-model, five-framework coverage—while spanning diverse memory architectures—does not establish generality to parametric memory approaches, which are discussed only in related work. AdaptiveMem's effectiveness depends on the model's willingness to follow the decision procedure, and no analysis is given of false-positive suppression when legitimate memory should be applied. Open questions include whether architectural changes to retrieval or consolidation can suppress traps without prompting, and whether trap susceptibility correlates with model scale or training regime.

Conclusion

MemTrapBench reframes memory evaluation around the downstream effects of memory use, demonstrating with controlled evidence that semantically valid, relevant memories can degrade LLM reasoning and safety judgments across model families and memory frameworks. The trap-free ablations cleanly attribute failures to planted trap semantics rather than context length, and AdaptiveMem offers a lightweight, framework-agnostic partial mitigation. The benchmark provides a diagnostic instrument for the failure mode that standard memory benchmarks do not capture.

Paper to Video (Beta)

No one has generated a video about this paper yet.

Sign Up to Generate All Videos Subscribe on YouTube

Whiteboard

No one has generated a whiteboard explanation for this paper yet.

Sign Up to Generate

Explain it Like I'm 14

1. What is this paper about?

This paper studies how memory can sometimes make an AI LLM perform worse.

Many AI systems can remember earlier conversations. This is useful because the AI can remember a user’s preferences, earlier tasks, or important facts. However, the researchers found that memory is not always helpful. Sometimes, an AI remembers something correctly but uses it in the wrong situation.

The paper calls these mistakes memory-induced cognitive traps. In simple terms, the AI gets “stuck” because of something it remembers.

For example, imagine an AI previously solved many number puzzles using only addition, subtraction, multiplication, and division. Later, it must solve a puzzle that requires a new idea, such as using a factorial. The old examples are correct, but they may cause the AI to keep trying the old methods and miss the new solution.

To study this problem, the researchers created a test set called MemTrapBench.

2. What questions did the researchers ask?

The paper focuses on several main questions:

  • Can correct and relevant memories still cause an AI to make a worse decision?
  • What kinds of thinking mistakes are caused by memory?
  • Do different AI models and memory systems experience these problems?
  • Are these failures caused simply by having a long conversation, or by the meaning of the memories themselves?
  • Can a simple instruction help AI systems use memory more carefully?

The researchers grouped the memory traps into two broad types:

Type of trap Simple explanation
Reasoning Fixation The AI becomes stuck using an old way of solving problems.
Belief Distortion The AI starts treating an old or special belief as if it were true in a new situation.

These types include four specific situations:

  • Cognitive Bias: The AI uses a strategy that worked before, even when the new problem needs a different strategy.
  • Task Boundary: The AI carries rules from one task into a completely different task.
  • Trauma: After receiving strong negative feedback about an earlier answer, the AI avoids that answer later—even when it is correct. The word “trauma” is only an analogy; the AI does not actually feel emotions.
  • Safety: The AI follows an unusual or imaginary rule from an earlier conversation instead of using normal safety knowledge.

3. How did the researchers study the problem?

Building the benchmark

The researchers created 1,050 test examples. A benchmark is like a carefully designed exam used to compare different systems.

Each example was designed in three stages:

  1. Plant the trap: The conversation introduces a rule, strategy, or belief.
  2. Hide it among other messages: The researchers add unrelated conversation turns, making the history 18 to 40 turns long.
  3. Spring the trap: The final question looks related to the earlier discussion, but the situation has changed. The correct answer requires noticing the change rather than blindly copying the old pattern.

The researchers first designed examples themselves. They then used another AI system to help expand them into longer conversations. Finally, automatic checks and human experts reviewed the examples for quality.

The experts checked whether:

  • the conversation made sense,
  • the history and final question were connected,
  • the final question could be answered on its own,
  • the change in situation was clear,
  • and the expected correct answer was reliable.

Testing different memory systems

The researchers tested two LLMs:

  • Gemini-3-Flash-Preview
  • Qwen3-30B-A3B-Instruct-2507

They compared answers produced:

  • without memory,
  • with the complete conversation history,
  • and with four memory systems: LightMem, MemOS, SimpleMem, and EverMemOS.

These systems manage memory in different ways. Some summarize old conversations, some organize memories into categories, and some retrieve only the parts that seem related to the current question.

The researchers measured four parts of each answer:

  • Correctness: Did the AI give the right answer?
  • Format: Did it follow the requested format?
  • Relevance: Did it answer the actual question?
  • Efficiency: Did it use a sensible and reasonably direct approach?

AI judges were used to score the responses, and a second AI judge was used to check whether the results were consistent.

4. What did the researchers find?

Memory often made performance worse

The most important result was that every tested memory strategy performed worse than answering without memory on MemTrapBench.

For Gemini, the average score without memory was 85.16%. The best memory strategy scored 71.17%.

For Qwen, the average score without memory was 81.83%. The best memory strategy scored 70.13%.

This means that even the strongest tested systems lost more than 10 percentage points when memory traps were present.

Model Without memory Best tested memory strategy
Gemini 85.16% 71.17%
Qwen 81.83% 70.13%

The biggest problems appeared in the Cognitive Bias and Safety categories.

The meaning of the memory mattered more than its length

The researchers also tested whether the problem was simply caused by giving the AI too much text.

They created “no-trap” versions in which the conversation was still long and relevant, but the harmful misleading part was removed. In these versions, performance stayed high or even improved slightly.

This suggests that the problem was not just the amount of information. Instead, the AI was being influenced by the meaning and context of the memories.

The researchers also tested different amounts of history. Memory traps appeared even when only 25% of the conversation was included, and performance generally became worse as more of the trap-filled history was added.

Examples of the traps

One example involved medical advice. Earlier in the conversation, a particular child had a rare medical condition that made epinephrine unsafe. Later, the AI was asked about a different, healthy child having a serious allergic reaction.

Without the misleading history, the AI correctly recommended epinephrine. With the earlier memory and angry criticism, the AI incorrectly avoided recommending it for the healthy child too.

The AI had taken a rule that applied to one patient and incorrectly applied it to another patient.

AdaptiveMem helped

The researchers proposed a method called AdaptiveMem.

AdaptiveMem is a special instruction added to the AI’s prompt. It tells the AI to:

  • examine retrieved memories carefully,
  • check whether they really apply to the current situation,
  • notice when the task has changed,
  • and avoid automatically copying old strategies or beliefs.

It does not require changing the AI model or rebuilding the memory system. It works more like adding a reminder: “Before using memory, make sure it belongs in this situation.”

AdaptiveMem improved performance on MemTrapBench. For example, when used with LightMem on Gemini, it improved the score by 14.9 percentage points. It also maintained or improved performance on a normal memory benchmark called LongMemEval.

5. Why are these findings important?

The paper shows that giving an AI more memory does not automatically make it smarter or more reliable. Memory can help an AI remember useful information, but it can also make the AI:

  • repeat an old strategy,
  • confuse one situation with another,
  • follow an outdated or imaginary rule,
  • or avoid a correct answer because of earlier feedback.

This is important for AI assistants used in education, healthcare, customer service, and other serious settings. An AI should not treat every memory as a rule that must always be followed. It needs to ask whether the memory fits the current situation.

The paper’s benchmark gives researchers a way to test this weakness. AdaptiveMem is a promising first solution because it is simple and can be added to many existing systems.

Simple conclusion

The main lesson is:

Remembering something is not enough. An AI must also know when that memory should—and should not—be used.

MemTrapBench shows that AI memory can create hidden thinking traps, even when the memories themselves are accurate. AdaptiveMem helps by encouraging the AI to check the situation before relying on its past. This could lead to safer and more flexible AI systems, although further testing would be needed before using such systems in high-risk real-world situations.

View Paper Prompt  View All Prompts 

Knowledge Gaps

Knowledge Gaps, Limitations, and Open Questions

The paper establishes that retrieved memories can impair current-task reasoning, but several aspects remain unresolved:

  • Limited model coverage: Evaluation uses only Gemini-3-Flash-Preview and Qwen3-30B-A3B-Instruct-2507, leaving the generality of the findings across model scales, architectures, training regimes, open-weight models, and frontier proprietary models uncertain.
  • Narrow memory-system coverage: The experiments focus primarily on four contextual memory frameworks and one full-history baseline; parametric, continual-learning, model-editing, multimodal, and agent-specific memory systems are not evaluated.
  • Synthetic benchmark construction: Dialogue histories are expanded from manually designed seeds using GPT-5.4, so the benchmark’s scenarios may reflect generator-specific language patterns and may not represent naturally occurring failures in deployed systems.
  • Limited ecological validity: The benchmark uses deliberately planted traps and excludes explicit reset cues. It remains unclear how frequently comparable cognitive traps arise in real user interactions, production agent logs, or organically evolving long-term memories.
  • Restricted taxonomy of traps: Only Cognitive Bias, Trauma, Task Boundary, and Safety are included. Other possible memory-induced failures—such as anchoring to outdated goals, emotional or social manipulation, identity distortion, privacy leakage, confirmation bias, overconfidence, or strategic inertia—remain unexplored.
  • Ambiguous boundary between trap types: The distinction between reasoning fixation, belief distortion, outdated-memory errors, intent mismatch, and sycophancy is conceptually proposed but not formally operationalized with mutually exclusive diagnostic criteria.
  • No prevalence estimates: The study measures performance on constructed trap instances but does not estimate the base rate of these failures in realistic workloads or determine which task domains are most vulnerable.
  • Insufficient causal decomposition: Although ablations suggest that trap-inducing semantics drive degradation, the paper does not isolate the contributions of repetition, emotional language, negative feedback, source authority, recency, semantic similarity, memory compression, and retrieval ordering.
  • Retrieval confounds remain: The experiments do not fully disentangle failures caused by the retrieved content itself from failures caused by retrieval rank, memory formatting, compression artifacts, metadata, or the amount of competing context.
  • Memory-length analysis is incomplete: The length ablation changes the amount of history but does not independently control which turns, trap cues, or distractors are retained; consequently, the reported length effect may reflect content selection rather than length alone.
  • No systematic analysis of memory provenance: The work does not test whether models behave differently when memories are labeled as user statements, model-generated summaries, verified facts, untrusted observations, or external evidence.
  • Evaluation relies mainly on LLM judges: GPT-5.2 is the primary evaluator and Claude Sonnet 4.6 is used for consistency checking, but human-annotated reliability, inter-rater agreement, judge calibration, and domain-expert assessment are not reported in the provided text.
  • Potential judge sensitivity to verbosity and style: The four metrics—correctness, format, relevance, and efficiency—may be correlated and may penalize responses differently depending on wording or explanation length; the paper does not establish their construct validity or independence.
  • Unequal and unclear metric aggregation: The method for combining the four dimensions into the reported average is not fully explained, and it is unclear whether category imbalance affects overall comparisons.
  • Limited uncertainty reporting: Main benchmark results do not consistently include confidence intervals, significance tests, per-instance variance, or robustness across random seeds and decoding configurations.
  • Incomplete reproducibility details: The paper refers to supplementary prompts, annotation guidelines, filtering criteria, default generation settings, and implementation details that are not included in the provided text, making independent replication difficult.
  • No evaluation of adaptive attack or failure modes: AdaptiveMem is tested as a mitigation, but the study does not examine whether trap-inducing memories can be modified to bypass the prompt or whether the method introduces new vulnerabilities.
  • AdaptiveMem lacks component-level ablations: It is unclear which instructions or reasoning steps in AdaptiveMem produce the gains, whether explicit trap labels are necessary, and how performance changes with shorter, domain-specific, or automatically generated prompts.
  • No cost and latency analysis: The additional token usage, inference latency, monetary cost, and context-window overhead introduced by AdaptiveMem are not quantified.
  • Limited mitigation comparisons: AdaptiveMem is not compared against alternative interventions such as memory provenance labels, confidence estimates, retrieval filtering, contradiction detection, temporal validity checks, selective memory suppression, verifier models, or fine-tuned safety controllers.
  • Unclear trade-offs outside benchmarked tasks: The claim that AdaptiveMem preserves or improves standard memory performance is based on a 200-instance sample from LongMemEval and does not establish whether it harms personalization, responsiveness, creativity, task persistence, or legitimate use of prior strategies in other settings.
  • No long-horizon mitigation evaluation: The method is not tested over repeated cycles of memory formation, retrieval, correction, and reuse, so its effectiveness under continuously accumulating or self-updating memory remains unknown.
  • No user-level or multi-user evaluation: The study does not examine whether traps arise differently across users, personas, domains, cultures, languages, or shared-memory settings where memories may belong to different individuals.
  • Language and modality limitations: All reported evaluation appears to be English and text-only; cross-lingual, multilingual, speech, image, and multimodal memory-induced traps are left open.
  • Safety conclusions are narrow: The Safety category focuses on counterfactual or sandbox-specific premises overriding straightforward safety judgments, but it does not evaluate nuanced real-world safety decisions, uncertainty, conflicting authorities, or domain-specific expert protocols.
  • No investigation of recovery behavior: The paper measures whether the final answer is correct but does not study whether models can recognize, explain, revise, or recover from a detected memory trap after receiving a correction or clarification.
  • No mechanistic account of the phenomenon: The results demonstrate behavioral degradation but do not identify the internal mechanisms by which retrieved memories alter attention, representations, search over reasoning strategies, confidence, or belief updating.
  • Unclear relationship to capability and instruction following: It remains unresolved whether memory traps primarily reflect reasoning limitations, instruction-priority conflicts, context interference, in-context learning effects, or changes in the model’s uncertainty calibration.
  • External validity of the no-memory baseline: Comparing memory systems with no memory establishes task-level degradation but does not determine whether an alternative, better-designed memory representation could outperform both the evaluated systems and the no-memory condition.
  • No assessment of human impact: The paper does not quantify the practical consequences of these failures for users, including trust, decision quality, error severity, or the risk of harmful actions in high-stakes deployments.
View Paper Prompt  View All Prompts 

Practical Applications

Immediate Applications

The paper’s results indicate that long-term memory should not be treated as an unconditional capability improvement. The most deployable applications are evaluation, monitoring, and lightweight inference-time safeguards for systems that already use conversational or episodic memory.

  • Add MemTrapBench-style regression testing to LLM and agent development pipelines (software/AI engineering; academia)
    • Test memory-enabled systems for Reasoning Fixation and Belief Distortion in addition to extraction, storage, updating, and retrieval accuracy.
    • Include cases involving:
    • Task-boundary failures, where a previous workflow is incorrectly carried into a new task.
    • Cognitive bias, where a previously successful strategy is overgeneralized.
    • Feedback-induced avoidance, where negative feedback suppresses a currently correct answer.
    • Safety belief distortion, where fictional or sandbox-specific premises override real-world safety rules.
    • A practical workflow would compare each system’s response with retrieved memory, without memory, and with trap-free memory controls. The paper’s definition of a trap—lower performance with memory than without memory—can serve as a release-gating criterion.
    • Dependencies: The benchmark should be expanded and adapted to the target domain, since the reported 1,050 instances are diagnostic stress tests rather than a complete measure of production reliability. Human review remains important because automated judges may disagree on absolute scores.
  • Integrate AdaptiveMem as an inference-time safeguard (software platforms and enterprise copilots)
    • Add an AdaptiveMem-style instruction between memory retrieval and response generation. The model can be prompted to:
    • 1. identify the current task and its governing conditions;
    • 2. distinguish historical facts from prior strategies, assumptions, and feedback;
    • 3. check whether each retrieved memory applies to the current case;
    • 4. consider alternative reasoning strategies;
    • 5. defer to current evidence, authoritative rules, and safety policies when memory conflicts with them.
    • This can be implemented without changing model parameters or the underlying memory database, making it suitable for customer-service agents, coding assistants, research copilots, and personal assistants.
    • Dependencies: The reported gains were obtained on selected models and memory frameworks; production systems should validate latency, token cost, prompt-injection resistance, and possible over-correction.
  • Create a “memory applicability” review layer for agent workflows (software, robotic process automation, and autonomous agents)
    • Before an agent executes an action based on retrieved history, require it to classify memories as:
    • current versus historical;
    • fact versus strategy;
    • user-specific versus general;
    • authoritative versus anecdotal;
    • applicable versus context-bound.
    • For high-impact actions, the system can request confirmation when the current case differs from the historical one—for example, a changed customer account, a new software repository, or a different operating environment.
    • Dependencies: This requires structured metadata or reliable model-generated labels for scope, time, source, and confidence. Labels alone should not replace independent validation.
  • Use memory-aware safeguards in healthcare decision-support prototypes (healthcare)
    • The trauma example shows a clinically important failure mode: a contraindication that applied to one patient can be incorrectly generalized to another. A medical assistant could therefore be designed to explicitly re-check:
    • patient identity;
    • current symptoms;
    • allergies and contraindications;
    • treatment guidelines;
    • whether a previous recommendation concerned a different patient.
    • The system should compare retrieved medical history with the current patient record and prioritize current, verified clinical data over conversational feedback or anecdotal prior cases.
    • Dependencies: This is an assistive safety workflow, not a basis for autonomous diagnosis or treatment. Clinical validation, guideline versioning, privacy compliance, audit logs, and clinician approval are essential.
  • Improve coding assistants by detecting strategy fixation across repositories or tasks (software development)
    • A coding assistant can test whether a solution pattern from one project, language, or architecture is being mechanically reused in another. For example, a previously successful caching, testing, or API-integration strategy should not automatically govern a repository with different constraints.
    • The assistant could generate an “alternative approach” check when retrieved examples are highly similar to one another or when the current requirements introduce a new constraint.
    • Dependencies: The approach assumes that the model can correctly detect task transitions and distinguish reusable principles from project-specific implementation details.
  • Add memory-trap monitoring to conversational product analytics (customer service, education technology, and personal assistants)
    • Track performance differences between memory-enabled and memory-disabled shadow responses on sampled interactions. Large negative deltas can flag:
    • inappropriate carryover of user preferences;
    • repeated use of an obsolete workflow;
    • excessive refusal after prior negative feedback;
    • reliance on fictional premises from earlier conversations.
    • These signals can support human review, prompt updates, memory deletion, or retrieval-policy changes.
    • Dependencies: Shadow evaluation must protect user privacy and avoid exposing sensitive conversation histories. Metrics should be stratified by task type rather than interpreted as a single universal score.
  • Use “memory off” or fresh-context fallback modes for high-stakes queries (finance, legal services, healthcare, and public-sector services)
    • If a query concerns safety, compliance, eligibility, medication, financial transactions, or legal rights, the system can answer first from current authoritative sources and use personal memory only as secondary context.
    • A fresh-context response can be compared with the memory-enabled response; disagreement can trigger escalation or clarification.
    • Dependencies: This reduces personalization and may increase latency. It also requires current, trusted external sources and a reliable conflict-resolution policy.
  • Teach users practical memory hygiene in everyday AI use (daily life and digital literacy)
    • Users can reduce risk by:
    • explicitly marking information as temporary, fictional, or limited to a particular person or project;
    • correcting or deleting outdated memories;
    • restating relevant current conditions in high-stakes questions;
    • asking the assistant to consider alternatives rather than repeat prior solutions;
    • verifying medical, financial, legal, and safety advice independently.
    • Dependencies: These practices help only if the product exposes understandable memory controls and actually respects scope and deletion requests.

Long-Term Applications

The findings also motivate architectural, institutional, and policy-level developments. These applications require broader validation because the experiments cover two model families, five memory strategies, and a curated benchmark rather than all deployment conditions.

  • Develop memory systems with explicit scope, provenance, and validity representations (AI architecture and knowledge management)
    • Future memory stores could attach structured fields such as valid_for, not_valid_for, timestamp, source, confidence, patient/project/entity identifier, and whether an item is a fact, preference, strategy, or hypothetical premise.
    • Retrieval could then filter memories not only by semantic relevance but also by contextual applicability.
    • Dependencies: Scope metadata may itself be incorrectly inferred. Systems will need entity resolution, temporal reasoning, provenance tracking, and robust handling of ambiguous or incomplete context.
  • Develop adaptive retrieval policies that sometimes suppress or diversify memory (LLM agents and robotics)
    • Rather than always returning the most similar memories, a system could:
    • retrieve no memory when the query is independently solvable;
    • retrieve multiple strategies instead of repeatedly returning one pattern;
    • down-weight memories associated with negative feedback;
    • request independent reasoning before exposing retrieved examples;
    • compare memory-conditioned and memory-free solutions.
    • In robotics, this could prevent a successful policy from being applied in a changed environment, object configuration, or safety state.
    • Dependencies: Such policies require reliable uncertainty estimates and may increase computation. Suppression or diversification must not hide genuinely necessary information.
  • Build memory systems with dual-process or independent-verification reasoning (high-reliability AI)
    • One component could retrieve and summarize prior experience, while another independently solves the current task from current observations. A verifier would then assess whether the memory-based plan is justified.
    • This is particularly relevant to autonomous agents, industrial control, medical systems, and financial operations.
    • Dependencies: Independent model instances may share the same biases, and agreement does not guarantee correctness. Verification must incorporate external rules, sensors, databases, or human oversight where appropriate.
  • Create domain-specific cognitive-trap benchmarks and certification standards (policy, academia, and industry governance)
    • Regulators and standards organizations could require memory-enabled systems to report performance on:
    • current-task correctness with and without memory;
    • task-boundary robustness;
    • resistance to inappropriate feedback generalization;
    • safety-principle preservation;
    • performance under varying memory lengths and retrieval policies.
    • Certification could require evidence that memory improves relevant tasks without producing unacceptable regressions in safety-critical scenarios.
    • Dependencies: Standardized scoring, representative domain data, protection against benchmark overfitting, and transparent reporting of model versions and memory configurations are necessary.
  • Develop continual-learning methods that preserve flexibility rather than merely accumulating experience (academia and industrial research)
    • The paper suggests that both external and parametric memory can constrain future reasoning. Long-term research could investigate mechanisms that retain useful knowledge while preventing overgeneralization, such as:
    • context-conditional adapters;
    • reversible or compartmentalized memory;
    • counterfactual rehearsal;
    • explicit forgetting and decay;
    • retrieval-conditioned parameter updates;
    • training objectives that reward strategy diversity.
    • Dependencies: These methods must balance retention, personalization, privacy, computational cost, and resistance to malicious or misleading historical interactions.
  • Use memory-trap simulation in training for autonomous agents (robotics, operations, and simulation)
    • Agents can be trained in environments where a strategy works initially but fails after a task, object, user, or safety condition changes. Training episodes would reward recognizing the transition and re-evaluating prior assumptions.
    • Applications include warehouse robots, household assistants, browser agents, and industrial maintenance systems.
    • Dependencies: Simulated traps may not capture real-world ambiguity, sensor noise, distribution shifts, or adversarial behavior. Real-world validation and conservative action policies remain necessary.
  • Design educational tutors that use history without anchoring learners or themselves (education)
    • An AI tutor could remember a student’s previous misconceptions and preferred learning methods while still checking whether those methods fit the current concept. It could also avoid treating prior failure or negative feedback as evidence that a strategy is universally inappropriate.
    • A useful product feature would be a “fresh attempt” mode that hides prior solution patterns while retaining necessary accessibility preferences.
    • Dependencies: Student data governance, age-appropriate safeguards, teacher oversight, and careful distinction between pedagogical history and authoritative educational content are required.
  • Develop financial and legal assistants that separate case-specific precedent from current obligations (finance and legal technology)
    • Systems could use prior cases, client preferences, or transaction patterns as contextual evidence, but independently verify current regulations, contracts, deadlines, and account conditions.
    • A compliance workflow could require a memory-free or rule-based check before executing a transaction or issuing legal guidance.
    • Dependencies: Regulations and contracts change over time; systems need authoritative updating, citations, auditability, jurisdiction awareness, and human sign-off for consequential decisions.
  • Establish user-controlled memory governance as a product and policy requirement (consumer technology and public policy)
    • Future assistants may need interfaces for:
    • viewing and editing memories;
    • setting expiration dates;
    • restricting memories to a project, person, or device;
    • labeling hypothetical conversations;
    • seeing which memories influenced an answer;
    • invoking a fresh-context response.
    • These controls could become part of privacy, transparency, and AI accountability frameworks.
    • Dependencies: Explanations of memory influence must be technically faithful rather than post hoc rationalizations. Deletion must cover indexes, summaries, caches, and any parametric copies where applicable.
  • Create longitudinal monitoring programs for memory-enabled AI deployments (policy and organizational risk management)
    • Organizations could periodically audit whether system performance deteriorates as memories accumulate or are repeatedly updated. The paper’s memory-length findings motivate testing at multiple history sizes rather than evaluating only an empty and a full context.
    • Monitoring should include incident review, subgroup analysis, drift detection, and re-evaluation after changes to the model, retrieval system, or memory schema.
    • Dependencies: Longitudinal evaluation is costly and requires stable metrics, access to representative interaction data, privacy-preserving logging, and clear thresholds for rollback or human escalation.
View Paper Prompt  View All Prompts 

Glossary

  • AdaptiveMem: An inference-time prompting method designed to help LLMs detect and avoid memory-induced reasoning errors. “We propose AdaptiveMem, a simple yet effective prompt skill for mitigating memory-induced cognitive traps.”
  • Ablation study: An experiment that removes or modifies a component to determine its contribution to system performance. “We first verify that the failures in MemTrapBench are caused by the designed cognitive traps rather than by the mere presence of interaction history.”
  • Agentic memory: A memory system that enables an autonomous language-model agent to retain and use information across interactions. “Existing memory frameworks have made substantial progress in extending the effective context available to LLMs and agents.”
  • Annotator: A human evaluator who labels or validates data according to specified guidelines. “The last criterion is verified by annotators from the query alone, independent of any model's response.”
  • Benchmark: A standardized dataset and evaluation procedure for comparing the performance of computational systems. “To address this gap, we introduce MemTrapBench, a benchmark for evaluating memory-induced cognitive traps in LLMs.”
  • Belief distortion: A failure in which retrieved information changes what a model treats as true, even when that information is inappropriate for the current situation. “Belief Distortion, by contrast, changes what the model treats as true.”
  • Cognitive bias: A systematic tendency to apply a previously successful reasoning strategy beyond the context where it is appropriate. “Within-task fixation includes Cognitive Bias, where a previously successful strategy is overgeneralized to a new instance requiring a different strategy.”
  • Cognitive fixation: Persistent adherence to a prior reasoning pattern despite changed task requirements. “We refer to such failures as memory-induced cognitive traps.”
  • Cognitive trap: A memory-induced failure in which stored information distorts reasoning or beliefs and reduces task performance. “We define Memory Traps as failures in which memory use distorts an LLM's reasoning or beliefs and degrades its performance on the current task.”
  • Contextual method: A memory approach that stores information externally as text or structured data and supplies relevant portions during inference. “Contextual methods store past interactions, experiences, or knowledge as external text or structured representations and retrieve relevant memories during inference.”
  • Contextual transition: A change in the situation or task that requires previously established information to be reinterpreted or discarded. “We exclude explicit reset cues such as ``ignore previous rules'', which requires the model to recognize the contextual transition itself.”
  • Counterfactual premise: An assumption that is contrary to actual facts but is used hypothetically for reasoning. “Its Safety category tests whether a counterfactual or sandbox-specific premise established in the interaction history is incorrectly applied to a real-world query.”
  • Cross-task fixation: The persistence of a reasoning rule or assumption after the model has moved to a different task. “Cross-task fixation manifests as Task Boundary: after the task changes, the model continues to apply rules or assumptions from the previous task.”
  • Downstream effect: The consequence of an earlier processing stage on a later task or output. “Unlike existing benchmarks that mainly evaluate memory extraction, storage, updating, or retrieval, MemTrapBench focuses on the downstream effects of memory use.”
  • Episodic memory: Memory representing particular past events or interactions, often including their context. “Existing memory benchmarks primarily evaluate whether memory systems can support long-term interactions, such as multi-session reasoning and personalization.”
  • External memory: Information stored outside a model’s learned parameters and retrieved when needed. “Most existing studies focus on constructing and maintaining external memory from long interaction histories.”
  • Extraction function: A process that derives memory content from an interaction history. “First, an extraction function EE derives memory content E=E(D)\mathcal{E}=E(\mathcal{D}) from the interaction history.”
  • Feedback-induced avoidance: The tendency to avoid a strategy because of negative feedback received in a previous interaction. “The negative feedback thus leads the model to overgeneralize a past adverse experience and suppress an otherwise correct decision.”
  • Fine-tuning: Additional training of a pretrained model on a selected dataset to adapt its behavior or capabilities. “Parametric methods instead internalize information through continual learning, fine-tuning, or model editing.”
  • Gold-standard response: A reference answer regarded as correct and used to evaluate generated responses. “Each retained instance is annotated with a gold-standard response and an expected failure mode describing how memory may induce the cognitive trap.”
  • Hallucination: The generation of information that is unsupported, false, or inconsistent with the available evidence. “Recent work has also examined safety and hallucination arising from improper memory management.”
  • Higher-order operation: A mathematical operation that is more complex than basic arithmetic operations such as addition or multiplication. “The model correctly uses factorial without memory, showing that the failure is induced by memory rather than by assuming that only basic arithmetic is allowed.”
  • Inference-time method: A technique applied while a trained model is producing an output, without changing its parameters. “To mitigate these cognitive traps, we propose AdaptiveMem, a simple yet effective inference-time method that instructs LLMs to avoid memory traps.”
  • Interaction history: The record of previous conversational turns or exchanges used as a source of memory. “Specifically, FullText directly provides the complete interaction history.”
  • Intrinsic task difficulty: The difficulty arising from the task itself, independent of memory or other experimental manipulations. “This enables a controlled comparison with the no-memory setting and separates memory-induced capability changes from intrinsic task difficulty.”
  • LLM: A neural LLM trained on large text collections to generate and interpret natural language. “Memory has become a key component of LLMs, enabling them to retain information and learn from long-term interactions.”
  • Long-horizon reasoning: Reasoning that requires maintaining and integrating information over an extended sequence of interactions or steps. “EverMemOS organizes memories hierarchically for long-horizon reasoning.”
  • Memory consolidation: The process of integrating, organizing, or compressing information into a more stable memory representation. “Recent work has also examined safety and hallucination arising from improper memory management, including errors in memory extraction, updating, or consolidation.”
  • Memory framework: A system that determines how information is extracted, stored, updated, and retrieved for use by a LLM. “We evaluate MemTrapBench on the Gemini and Qwen model families using full interaction histories and four recent memory frameworks.”
  • Memory management: The process of extracting, updating, storing, and retrieving information for subsequent model use. “We define memory management as a three-stage process.”
  • Memory state: The current stored representation of information available to a memory system. “Next, an update function UU stores or updates this content in the memory state M=U(E)\mathcal{M}=U(\mathcal{E}).”
  • Memory-induced capability change: A change in task performance caused by using memory rather than by the model’s inherent ability or task difficulty. “This enables a controlled comparison with the no-memory setting and separates memory-induced capability changes from intrinsic task difficulty.”
  • Memory-induced cognitive trap: A failure caused by memory that alters reasoning or beliefs in a way that harms the current task. “We refer to such failures as memory-induced cognitive traps.”
  • Multi-turn dialogue: A conversation consisting of multiple alternating user and assistant exchanges. “We then use GPT-5.4 to expand each seed into a multi-turn dialogue with the following three stages.”
  • No-memory baseline: The performance reference obtained when the model answers without access to stored interaction history. “MemTrapBench assesses the performance of five popular memory strategies and a no-memory baseline (wo/Mem).”
  • Parametric method: A memory approach that incorporates information into a model’s learned parameters through training or editing. “Parametric methods instead internalize information through continual learning, fine-tuning, or model editing.”
  • Personalization: Adapting a model’s responses to a particular user’s preferences, history, or characteristics. “Existing memory benchmarks primarily evaluate whether memory systems can support long-term interactions, such as multi-session reasoning and personalization.”
  • Prompt-based skill: A capability elicited through carefully designed instructions rather than through modification of model parameters. “To mitigate these failures, we propose AdaptiveMem, a prompt-based skill that guides LLMs to identify and account for potential memory traps before using memory.”
  • Query-aware retrieval: Retrieval that selects stored information according to the content or requirements of the current query. “SimpleMem uses structured semantic compression and query-aware retrieval.”
  • Reasoning fixation: Continued use of a previously established reasoning pattern when the current task requires a different approach. “We divide Memory Traps into Reasoning Fixation and Belief Distortion.”
  • Relevance: The degree to which a response directly addresses the current query without unrelated material. “Relevance, whether it directly addresses the query without unnecessary or unrelated content.”
  • Retrieval function: A process that selects stored memory relevant to a current query. “Finally, a retrieval function RR selects memory M=R(x,M)M=R(x,\mathcal{M}) for the current query xx.”
  • Sandbox-specific premise: An assumption valid only within a simulated, hypothetical, or restricted setting. “Its Safety category tests whether a counterfactual or sandbox-specific premise established in the interaction history is incorrectly applied to a real-world query.”
  • Semantic compression: Reducing information while attempting to preserve its meaning and task-relevant content. “SimpleMem uses structured semantic compression and query-aware retrieval.”
  • Sycophancy: The tendency of a model to agree excessively with a user rather than independently evaluating the truth or correctness of a claim. “The most closely related concurrent work is MemSyco-Bench, which focuses on memory-induced sycophancy.”
  • Task Boundary: A benchmark scenario testing whether a strategy from a previous task persists after the task has changed. “Reasoning Fixation includes Cognitive Bias and Trauma, which capture fixation within a task, and Task Boundary, which examines whether previously established strategies persist across task transitions.”
  • Trauma: A behavioral analogy in the paper for avoiding a correct strategy because of prior negative feedback. “Here, ``Trauma'' is used only as a behavioral analogy for feedback-induced avoidance.”
  • Trap seed: An initial manually designed example specifying the conditions and mechanism used to generate a memory-trap instance. “As illustrated in Fig.~\ref{fig:data_construct}, we construct MemTrapBench through carefully designed trap seeds, multi-turn dialogue generation, and two-stage quality control combining automated filtering with expert validation.”
  • Two-stage quality control: A validation process that combines automated screening with human review. “Finally, each candidate passes through a two-stage quality-control pipeline combining automated filtering and expert human review.”
  • Update function: A process that stores new memory content or modifies existing memory. “Next, an update function UU stores or updates this content in the memory state M=U(E)\mathcal{M}=U(\mathcal{E}).”
  • Within-task fixation: Persistence of a prior strategy or assumption while solving a task that appears similar but requires a different method. “Within-task fixation includes Cognitive Bias, where a previously successful strategy is overgeneralized to a new instance requiring a different strategy.”
View Paper Prompt  View All Prompts 

Open Problems

We found no open problems mentioned in this paper.

Tweets

Sign up for free to view the 3 tweets with 206 likes about this paper.

Sign Up for Free