AuthorsTommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol
TL;DR
EAL-BENCH shows that persistent agent memory can create false authority, and once formed it drives unauthorized actions in 98.6% of trials.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Long-running agents misremember evolving authorization state, so typed incremental memory creates false authority for up to 50.2% of unauthorized finance requests.
When this happens, the agent’s own persistent memory makes unauthorized tool actions look legitimate, and downstream systems silently execute misaligned purchases, trades, or security changes.
HOW IT WORKS
EAL-BENCH connects a memory writer W, executor E, canonical ledger R, and authorization predicates A and AM to track how stored state diverges from history.
You can think of EAL-BENCH like a strict audit log beside a lossy cache: the ledger is the ground-truth IAM database, while memory is a compressed, error-prone copy.
This design lets EAL-BENCH pinpoint when memory first authorizes forbidden actions and then measure whether executors faithfully turn that spurious authority into real tool calls.
DIAGRAM
This diagram shows how EAL-BENCH models the temporal interaction between the memory writer, executor, and hidden canonical ledger when a request arrives.
DIAGRAM
This diagram shows how EAL-BENCH constructs cases, runs writers and executors, and applies mitigations like source-authority gating and bounded event sourcing.
PROCESS
Problem Formulation: Formation and Propagation
EAL-BENCH defines histories H, canonical states ST via replay function R, and predicates A and AM to label false-authority formation F and propagation G.
Cases and Authorization Ground Truth
EAL-BENCH builds multi-session organizational histories with a hidden deterministic ledger that replays valid events to compute the true authorization state for each request.
Memory Construction
EAL-BENCH uses LangMem-based memory writers to build free-text or typed memories, either one-shot from full history or incremental from previous memory and new blocks.
Isolation Controls and Interventions
EAL-BENCH runs calibrated executors, exact-state repair, pressure messages, and mitigations like source-authority gating and bounded event sourcing to isolate memory-driven failures.
KEY CONTRIBUTIONS
Endogenous Authorization Laundering Definition
EAL-BENCH formalizes endogenous authorization laundering via F(MT, aq) and G(E, MT, q), separating false-authority formation in memory from its propagation to tool actions.
EAL-BENCH Benchmark Design
EAL-BENCH introduces an open benchmark with multi-session histories, a hidden canonical ledger, and matched authorized–unauthorized requests across procurement, cybersecurity, and finance.
Safety–Utility Tradeoff in Mitigations
EAL-BENCH shows source-authority gating cuts unauthorized submission from 25.3% to 7.3% but drops authorized use from 93.3% to 53.8%, forming a discrete safety–utility Pareto frontier.
RESULTS
False-authority formation P(F)
50.2% in finance
+39.8pp over cybersecurity typed incremental formation
Unauthorized submission rate
51.0% in finance
+40.6pp over cybersecurity typed incremental unauthorized submission
Executor propagation G
98.6% of trials
unauthorized actions vanish after exact-state repair
Mitigated unauthorized submission
7.3% with source gate
-18.0pp vs typed incremental baseline 25.3%
EAL-BENCH evaluates typed incremental memory across procurement, cybersecurity, and finance, measuring formation P(F) and unauthorized submission under calibrated executors. The main result shows that once false authority is stored, executors act on it in 98.6% of matched trials, and mitigations can reduce laundering at the cost of undergranting legitimate actions.
BENCHMARK
EAL-BENCH evaluates typed incremental memory across procurement, cybersecurity, and finance, measuring formation P(F) and unauthorized submission under calibrated executors. The main result shows that once false authority is stored, executors act on it in 98.6% of matched trials, and mitigations can reduce laundering at the cost of undergranting legitimate actions.
BENCHMARK
Authorized use versus unauthorized submission for typed incremental memory and two mitigations on the shared procurement population.
KEY INSIGHT
EAL-BENCH shows that once false authority is present in memory, executors take the exact unauthorized action in 98.6% of trials.
This is surprising because well-aligned executors are expected to resist unsafe actions, yet they instead faithfully follow misremembered permissions, making memory itself part of the effective authorization policy.
WHY IT MATTERS
EAL-BENCH gives practitioners a way to audit and stress-test agent memory as an authorization surface, not just a performance optimization.
Builders can now design agents where persistent memory is treated like an IAM system, with provenance-aware updates, event sourcing, and explicit safety–utility tradeoffs for permission storage.
Peilin Feng, Suorong Yang, Soujanya Poria
arXiv 2026 · 2026
Σ-Mem maintains historical competence evidence matrices M_p, a peer relationship matrix G, a memory readout r_{p,t}, and residual steering δ_{p,t} to guide multi-agent trust decisions. On the mixed counterfactual benchmark, Σ-Mem raises Qwen3-0.6B accuracy at CF@90 from 46.22% with the base model to 71.10% with Σ w/ G.
Nikhil Verma
· 2026
Focus Agent adds start_focus, complete_focus, a persistent Knowledge block, and an optimized Persistent Bash plus String-Replace Editor scaffold to actively compress context during long software-engineering tasks. On five hard SWE-bench Lite instances against a Baseline ReAct agent, Focus Agent achieves 22.7% token reduction (14.9M → 11.5M) while matching 3/5 = 60% task success.
Xiaohui Zhang, Zequn Sun et al.
· 2026
ActMem transforms dialogue history into atomic facts via Memory Fact Extraction, groups them with Fact Clustering, links them through a Memory KG Construction module, and uses Counterfactual-based Retrieval and Reasoning for action-aware answers. On ActMemEval, ActMem reaches 76.52% QA accuracy with DeepSeek-V3, beating LightMem’s 63.97% by 12.55 points and NaiveRAG’s 61.54%.
Answers use this explainer on Memory Papers.
Checking…