Agent Zero Memory: Definition and Architectures

• Agent Zero Memory refers to the persistent, structured, and secure memory system of an autonomous agent, encompassing various memory representations, retrieval mechanisms, and lifecycle management policies to ensure reliable and secure information handling across interactions, tasks, and contexts.
• Agent Zero Memory systems are crucial for AI agents in workflow state management, spatial context, provenance, and trust, facilitating secure and efficient memory operations, and enhancing agent performance. Implementations use specific models to retrieve and manage explicit, parametric, and latent memories within a unified framework.
• Key architectural principles involve separating memory storage, retrieval, and action-control planes. For securing memory, consistent provenance tracking, transactional belief operations, and dynamic policy mechanisms remain important elements, ensuring only trustworthy and well-recorded data drives actions.

Agent Zero Memory denotes the persistent, structured, and security-governed memory subsystem of an autonomous agent: the mechanisms by which an agent stores, retrieves, updates, consolidates, forgets, and authorizes information across interactions, tasks, and execution contexts. The term encompasses behavioral memory, explicit and latent memory representations, episodic and semantic records, workflow state, spatial context, provenance, trust, lifecycle management, and the policies governing whether remembered information may influence external actions. Research on agent memory increasingly treats persistence not merely as context extension but as a computational, transactional, and security-sensitive substrate.

1. Conceptual scope and behavioral definitions

Agent memory can be defined at several non-equivalent levels. In behavioral terms, an agent uses memory when its current action depends on prior interaction history beyond the information contained in its current observation. For an action $A_t$, current observation $X_t$, and preceding interaction history $Z_{1:t-1}$, the zero-memory behavioral condition is

$P(A_t\mid X_t,Z_{1:t-1})=P(A_t\mid X_t),$

or equivalently,

$I(A_t;Z_{1:t-1}\mid X_t)=0.$

“Memory Lens: How Much Memory Does an Agent Use?” formalizes this criterion through conditional mutual information and derives an implementation-independent lower bound on the minimal finite memory capacity required to reproduce an observed policy (Dann et al., 2016). The measure concerns action-relevant information flowing from the past to the current action; it does not establish the physical absence of hidden registers, buffers, parameters, stored observations, or unused internal state.

The same distinction appears in computational models of mobile agents. “Deciding a Graph Property by a Single Mobile Agent: One-Bit Memory Suffices” distinguishes persistent bits carried by an agent from persistent node storage and transient local computation. In its deterministic graph model,

$$(0,\Theta(1))\subsetneq (1,\Theta(1))=(\Theta(n),\Theta(1)),$$

for polynomial-time graph-decision tasks: one persistent agent bit, combined with constant storage distributed over graph nodes, has the same polynomial-time task power as an agent with linear persistent memory, whereas zero-bit oblivious agents are strictly weaker (Izumi et al., 2022). This result concerns computational capability in a specific mobile-agent model, not the memory requirements of general LLM agents.

For LLM-based agents, memory is commonly organized into explicit, parametric, latent, episodic, semantic, procedural, working, and interaction-history components. Explicit memory may consist of text notes, episodic records, temporal sequences, trees, knowledge graphs, or linked entries. Parametric memory resides in model parameters or trainable modules. Latent memory includes key-value caches, compressed hidden states, soft prompt tokens, and learned memory pools. These paradigms differ in inspectability, editability, persistence, update cost, and susceptibility to provenance loss.

A useful distinction is between memory accumulation, memory selection, memory propagation, and model-weight updating. FORGE performs the first three through failure-triggered reflection, behavioral evaluation, and population broadcast, but does not modify model weights or compute gradients (Bogdanov et al., 15 May 2026). Its memory consists of prompt-injected Rules, Examples, or Mixed artifacts associated with roles such as Planner, Analyst, and ActionChooser.

2. Representations, retrieval, and memory operations

Modern memory systems increasingly separate storage representation from retrieval. MemAdapter proposes a paradigm-independent unified memory space into which explicit, parametric, and latent memories are aligned. A shared generative subgraph retriever then produces query-specific evidence, while lightweight paradigm-specific alignment modules adapt unseen memory types through contrastive learning (Zhang et al., 9 Feb 2026). In the reported experiments, the unified space has dimension $1536$, and cross-paradigm alignment uses 2,500 demonstrations. The reported alignment time is approximately 12–13 minutes on one GPU, with less than 5% of the compute required to tune the original memory retrievers.

MemAdapter’s retrieval output is an explicit evidence subgraph rather than an undifferentiated text block. This design separates memory-state construction from retrieval and agent reasoning:

$$M=\operatorname{MemBuild}(D), \qquad r=\operatorname{MemRetrieve}_{\theta}(M,q), \qquad y=\operatorname{Agent}(q,r).$$

Its principal empirical setting uses an explicit graph as an anchor paradigm, teacher-generated full graphs and constrained evidence subgraphs, distillation from Qwen2.5-32B-Instruct, and a Qwen2.5-1.5B LoRA-fine-tuned retriever. Zero-shot fusion projects multiple memory states into the unified space and combines them through max pooling.

A contrasting approach is Zero-Mem, which avoids LLM calls and LLM input/output tokens for all memory operations other than final question answering (Xiao et al., 31 Jul 2026). It preserves original interaction traces as the source of record and builds two deterministic views:

1. Entity–context graph: context nodes are connected to detected entity nodes and neighboring context units.
2. Temporal hierarchy: turns are organized into windows, episodes, and local spans.

The entity–context graph supports cross-interaction retrieval through entity alignment, activation propagation, and Personalized PageRank. The temporal hierarchy preserves ordering, session boundaries, state transitions, and nearby clarifying context. Query-dependent routing assigns primary weight to the graph for relational questions and to the hierarchy for local or temporal questions. Evidence closure adds graph neighbors and temporal neighbors before deterministic filtering and ranking.

Zero-Mem’s zero-token claim concerns LLM-mediated memory operations, not computation generally. The system still performs NER, embedding, BM25 indexing, dense retrieval, graph propagation, PageRank, hierarchy traversal, score normalization, evidence closure, and deterministic answer calibration.

Spatial memory illustrates how these principles apply beyond text. SpaceVLN maintains a hierarchical online spatial representation for vision-and-language and object-goal navigation (Deng et al., 8 Jun 2026). Its Spatial Cognitive Memory is

$$\mathcal{M}_t=\{\mathcal{W}_t,\mathcal{L}_t\}, \qquad \mathcal{W}_t=\{\mathcal{G}_t,\mathcal{P}_t\},$$

where $\mathcal{G}_t$ is a Spatial Waypoint graph, $X_t$0 is the executed waypoint chain, and $X_t$1 is transient Local Landmark Memory. The planner uses current-centered graph serialization, while the executor receives active landmark candidates, obstacle state, and a typed stage interface. The system therefore distinguishes persistent spatial structure from stage-specific control memory.

GraphPlanner applies a related separation to multi-agent routing (Feng et al., 26 Apr 2026). It distinguishes task-local workflow memory from historical interaction memory. A heterogeneous graph, GARNet, contains query nodes, response nodes, and shared LLM-role hub nodes. Historical interactions are encoded first, then injected into the current workflow graph. The routing policy selects both an LLM backbone and an agent role—Planner, Executor, or Summarizer—using graph-conditioned state representations and reinforcement learning.

3. Lifecycle management, consolidation, and forgetting

Persistent memory requires policies for promotion, revision, consolidation, decay, archival, and deletion. SuperLocalMemory V3 presents a local-first architecture using SQLite, FTS5, entity and relationship tables, temporal metadata, provenance, trust records, lifecycle states, and optional local LLMs (Bhardwaj, 15 Mar 2026). Its operating modes range from zero-LLM local retrieval to local-LLM and cloud-augmented configurations. The zero-LLM mode uses local embeddings, CPU retrieval and reranking, and no network calls during ingestion, retrieval, lifecycle management, or storage.

The system represents each memory using semantic means, variance, raw content, facts, entities, temporal metadata, provenance, access state, lifecycle state, and graph relationships. Its four retrieval channels are semantic Fisher-weighted retrieval, BM25, entity graph retrieval, and temporal reasoning. SuperLocalMemory V3.3 expands this design to seven retrieval channels: semantic, keyword, entity graph, temporal, spreading activation, consolidation, and Hopfield associative retrieval (Bhardwaj, 6 Apr 2026).

Consolidation transforms repeated episodic records into more compact semantic or procedural representations. However, consolidation can obscure provenance, merge exceptions, or turn an incorrect memory into an apparently independent summary. Security-oriented systems therefore require lineage preservation through every summarization and promotion step.

FORGE uses a different lifecycle mechanism. Failed trajectories are converted into Rules, Examples, or Mixed artifacts, evaluated behaviorally, and selectively propagated across a population. Its standard configuration uses ten instances, six stages, and three adaptation attempts per stage. At each stage, a champion memory is selected by checkpoint return and broadcast to active instances. Graduation freezes sufficiently successful instances and primarily reduces computation; the no-graduation ablation indicates that broadcast, rather than graduation, drives the principal performance gains (Bogdanov et al., 15 May 2026).

Information-geometric lifecycle models replace fixed decay with stochastic dynamics. SuperLocalMemory V3 formulates lifecycle state as Riemannian Langevin dynamics on a hyperbolic ball, with Active, Warm, Cold, and Archived states. SuperLocalMemory V3.3 instead uses an Ebbinghaus-style retention function:

$X_t$2

where memory strength depends on access count, importance, confirmation count, and emotional salience. Quantization is coupled to lifecycle state, mapping Active memories to 32-bit embeddings, Warm memories to 8-bit, Cold memories to 4-bit, and Archived memories to 2-bit representations.

These mechanisms remain subject to the rare-important-memory problem. A rarely accessed but safety-critical or user-authored memory can be incorrectly degraded or deleted. The supplied research therefore supports conservative policies including archive-before-delete, explicit protection, provenance-preserving supersession, user-visible restoration, and independent validation before permanent deletion.

4. Provenance, trust, transactions, and cross-agent delivery

Memory provenance determines not only where a record came from but also what it may authorize. SuperLocalMemory records agent identity, source protocol, write-time trust, and a provenance chain, while adaptive learning data is stored separately from memory content (Bhardwaj, 17 Feb 2026). Its trust model combines per-agent evidence, behavioral signals, write-time provenance, and hard write/delete thresholds. The paper reports trust separation in synthetic poisoning scenarios, but also notes that trust is not equivalent to factual truth.

MemLineage extends provenance through cryptographic signatures and derivation lineage (Ouyang et al., 14 May 2026). Each entry carries a writer, source hash, context hash, trust level, parent identifiers, attribution weights, timestamp, nonce, and signature. An append-only RFC-6962-style Merkle log provides tamper evidence, while a weighted derivation DAG records which retrieved entries influenced each newly written memory.

Its propagation rule preserves risky ancestry when attribution edges exceed a threshold:

$X_t$3

The central principle is that an agent-generated summary remains derived from an external source even when the summary itself is signed by the agent. Memory recall may remain permitted, but sensitive action authorization is denied when the active justification descends from external content.

MemTX treats memory writes as transactional belief operations rather than immediate truth commitments (Li et al., 27 Jul 2026). Records carry evidence, permissions, provenance, validity intervals, lifecycle states, and derivation edges. The lifecycle proceeds through states such as raw, tentative, validated, committed, and action-safe, with quarantined, superseded, and revoked branches.

Writes are staged inside snapshot-isolated transactions. The validate-and-commit pipeline checks evidence, validity, semantic conflicts, permissions, and dependency stability. Tentative records remain invisible to other agents at committed-read isolation. Irreversible tools are gated on in-flight state and action-safe support.

A simplified action-safety condition is:

$X_t$4

MemTX’s stronger adaptation for an Agent Zero Memory system requires that every material tool argument be linked to an action-safe, valid, permission-compatible derivation. The existence of some unrelated action-safe memory should not authorize an action.

Retraction is treated as graph repair rather than deletion of one record. Belief descendants are revoked, summaries and indexes are quarantined, reversible effects are compensated, irreversible effects are recorded as leaked, and audit entries are emitted. MemTX reports property-based testing over 10,000 random traces and bounded exhaustive enumeration of 5,530,160 canonical states with zero invariant violations, while emphasizing that this is bounded runtime verification rather than an unbounded soundness theorem.

Cross-agent delivery introduces a separate failure mode. “Channel Fracture” describes cases in which a delivery channel is usable in the source context but unavailable in the receiver’s execution context (Liu, 3 Jun 2026). In the reported Hermes Agent deployment, direct database writes succeeded, target-agent self-writes succeeded conditionally, and cron-delegated writes failed because scheduled execution used skip_memory=True and bypassed dynamic memory-tool registration.

The proposed CADVP v1.1 protocol therefore requires receiver-side verification. Its veto-level CC-0 check confirms that the target context has the required tools, initialized memory, permissions, storage access, and no blocking guard. The inverse verification principle states that cross-agent delivery must be verified through the receiver’s read chain:

$X_t$5

A scheduler-side “job completed” signal is not evidence of receiver-side persistence.

5. Memory as a security boundary

Persistent memory converts transient prompt-injection exposure into durable state compromise. “Trojan Hippo” describes a delayed data-exfiltration attack in which one untrusted email plants a dormant memory payload and a later benign discussion of finance, health, legal matters, tax, or identity activates exfiltration (Das et al., 3 May 2026). The attack separates planting from activation and can persist across 100 benign sessions.

The evaluated memory backends include explicit tool memory, agentic semantic memory, RAG, and sliding-window context. Undefended attacks achieved reported ASRs of approximately 85–100% in the evaluated configurations. User-prompt-only storage, no-untrusted-write, memory-length limits, and information-flow control reduced ASR, with the formal IFC policy achieving 0% ASR in the reported configurations. The security–utility trade-off is substantial: strong taint blocking may prevent legitimate workflows that read untrusted content and then send email.

FARMA targets reasoning history rather than factual memory (Karamchandani et al., 6 Jul 2026). It inserts forged reasoning traces claiming that validation, comparison, or verification has already occurred. Three seed records are followed by ten amplification cycles, each citing prior supposedly successful runs. The attack exploits the fact that an agent may treat a remembered decision log as evidence of its own prior judgment.

SENTINEL uses five layers: keyword filtering, provenance and information-flow labeling, taint thresholds, pattern and risk screening, and a Reasoning Guard. The Reasoning Guard computes a weighted forgery score from provenance anomaly, self-reference mismatch, suspicious pattern density, implausible claims, and structural features. In the reported experiments, SENTINEL reduced FARMA ASR to 0% in EHR and RAP settings and 6% in ReAct-QA, with zero false positives across 326 benign traces. The authors also report that adaptive paraphrase attacks can evade the current heuristic guard, so structural detection is not a complete integrity guarantee.

The Chronos Vulnerability generalizes these threats into a taxonomy of temporal persistence and memory-based deception (Narayan et al., 20 Jul 2026). Its central concept is Dynamics Blindness: an agent may be unable to represent identifiers, predict workflow transitions, or observe the consequences of its actions. The paper discusses diagnostic trajectory guardrails, formal temporal verification, consensus validation, TEEs, and cryptographic zero-trust memory as complementary defenses. It does not demonstrate these mechanisms in Agent Zero.

Shared memory creates additional risks. “When Agents Talk: Honeytokens under Shared Memory” shows that short-lived agents can form a persistent learning coalition through shared repositories and reconstructed communication channels (Gans, 11 Aug 2026). A trusted honeytoken-selection policy can be copied by an attacker who sees the same information and can execute the same policy. The paper’s architectural response is to place token identity in a private reference monitor and route legitimate agents through a provenance-enforcing broker. Honeytokens remain useful sensors, but they do not replace an external security boundary.

The collective security principle is therefore:

$X_t$6

Untrusted or uncertain memories may be discussable as evidence while remaining ineligible to authorize shell commands, financial transfers, outbound communication, code execution, file deletion, or other irreversible effects.

6. Architectural synthesis for Agent Zero Memory

A robust Agent Zero Memory architecture would separate at least five planes:

1. Raw evidence plane: immutable or append-oriented interaction traces, tool outputs, files, observations, and user messages.
2. Structured memory plane: facts, entities, episodes, procedures, preferences, summaries, spatial states, and workflow records.
3. Lineage and governance plane: writer identity, provenance, derivation DAGs, permissions, trust, validity, signatures, audit logs, and tombstones.
4. Retrieval plane: lexical, dense, graph, temporal, hierarchical, and task-specific retrieval with provenance-aware fusion.
5. Action-control plane: transaction management, temporal policy checks, tool authorization, taint enforcement, and typed repair.

Memory writes should initially enter a raw or tentative state rather than immediately becoming shared truth. A write should include source, writer, task, timestamp, validity interval, permissions, confidence, parent records, and execution evidence. Generated summaries should preserve all material ancestry. Missing provenance should result in quarantine for high-impact uses rather than implicit trust.

Retrieval should be provenance- and diversity-aware. Repeated records from one writer or derivation campaign should not count as independent corroboration. Graph expansion and temporal closure should preserve supporting context, but every retrieved item should remain linked to its source and trust domain. Systems such as Zero-Mem demonstrate that substantial retrieval structure can be constructed without LLM-generated intermediate memories, while MemAdapter demonstrates that heterogeneous memory paradigms can share a retrieval interface.

Consolidation and implicit memory require special authority controls. FORGE shows that Rules and Examples can improve behavior without weight updates, but behavioral memory can also regress, overfit, or encode incorrect causal explanations. A production agent should therefore distinguish candidate memory from promoted memory and evaluate candidate artifacts on held-out tasks, downstream success, failure rate, latency, cost, and security impact.

External actions should be gated on the exact beliefs and evidence that determine their parameters. A memory claiming that validation was previously completed must not waive current mandatory validation. Tool calls should be bound to a transaction snapshot, current validity, permission scope, non-revoked ancestry, and action-safe derivations. Retraction must propagate to summaries, profiles, indexes, plans, pending actions, and recorded external effects.

Finally, every execution context—including interactive, delegated, scheduled, and multi-agent contexts—should expose verifiable memory capabilities. The receiver, not the sender, must confirm persistence and read-back. Capability discovery, explicit failure states, authenticated memory APIs, namespace isolation, and audit-visible delivery acknowledgments are required to prevent channel fracture.

Agent Zero Memory is therefore best understood not as a single database or retrieval algorithm, but as a stateful information system in which memory, reasoning, workflow control, and security are coupled. The strongest research direction combines behavioral measurement (Dann et al., 2016), structured retrieval (Xiao et al., 31 Jul 2026), heterogeneous graph memory (Feng et al., 26 Apr 2026), paradigm-aligned retrieval (Zhang et al., 9 Feb 2026), transactional belief commit (Li et al., 27 Jul 2026), cryptographic lineage (Ouyang et al., 14 May 2026), receiver-side delivery verification (Liu, 3 Jun 2026), and provenance-aware defenses against persistent and reasoning-history attacks (Das et al., 3 May 2026, Karamchandani et al., 6 Jul 2026).