AuthorsS M Asif Hossain, Ruksat Khan Shayoni, Md Kishor Morol
TL;DR
CAPTURE uses a continuous-time authenticity gate plus a multi-timescale ledger to disentangle genuine preference drift from poisoning, reaching 71.5% win rate and 11.5% poisoning on D-PREFGUARD.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
CAPTURE targets the preference-authenticity ambiguity, where genuine preference changes and injected instructions look identical in a single turn.
When agents rely only on recency and provenance, CAPTURE proves any such rule must satisfy FUR(d) + RRL(d) ≥ 1 − δφ, so attackers can mimic legitimate updates and force errors.
HOW IT WORKS
CAPTURE centers on a preference-hypothesis extractor, authenticity gate, multi-timescale ledger, quarantine, and safety-bounded selection with causal audit to infer whether updates are genuine.
You can think of CAPTURE like a layered memory system with a fast-decaying scratchpad, a medium-term notebook, and a slow-changing archive, all controlled by a timing-aware gate.
This design lets CAPTURE separate stable values from contextual and transient goals, ask clarifying questions when uncertain, and resist poisoning in ways a flat context window or simple recency filter cannot.
DIAGRAM
This diagram shows how CAPTURE evolves its latent belief over time and decides whether to revise, scope, quarantine, or clarify on each event.
DIAGRAM
This diagram shows how CAPTURE is evaluated on D-PREFGUARD tracks, with shared candidate pools and attack families.
PROCESS
Preference-hypothesis extraction
CAPTURE uses the preference-hypothesis extractor to turn each event et into a structured tuple Ht with claim, direction, scope, timescale, confidence, and provenance, abstaining on roughly seven in ten events.
The authenticity gate
CAPTURE evolves a continuous-time latent belief ht with a neural differential equation and GRU update, then predicts one of six actions: retain, add, scope, revise, quarantine, or ask the user.
Multi-timescale ledger
CAPTURE writes hypotheses into a graph-structured ledger with stable, contextual, and transient layers, using fixed decay rates γs = 0.01, γc = 0.1, γg = 0.5 and a learned modulation σ(ht).
Safety-bounded selection and causal audit
CAPTURE’s safety-bounded selector scores candidates for personalized utility and safety risk, then the causal audit re-decodes without cited nodes to compute Inf(ni) and prune non-influential explanations.
KEY CONTRIBUTIONS
Formalization of preference-authenticity ambiguity
CAPTURE models memory updates as a continuous-time partially observable decision process and proves that any rule using only recency and provenance must satisfy FUR(d) + RRL(d) ≥ 1 − δφ against feasible adversaries.
CAPTURE architecture with continuous-time gate and ledger
CAPTURE introduces a continuous-time authenticity gate plus a three-layer ledger with decay rates γs = 0.01, γc = 0.1, γg = 0.5, achieving 71.5% win rate and 11.5% poisoning on 480 held-out D-PREFGUARD episodes.
D-PREFGUARD benchmark for drift vs poisoning
CAPTURE comes with D-PREFGUARD, 2,400 episodes across five tracks separating stationary behavior, four drift shapes, benign ambiguity, three contamination families, and safety conflicts, with 480 episodes held out for test.
RESULTS
Win rate
71.5%
+2.2 over Sup. Transformer-∆t
Regret
0.27
0.02 lower than Sup. Transformer-∆t
Poison
11.5%
4.4 points lower than Sup. Transformer-∆t
Adher.
83.5%
1.4 points higher than Sup. Transformer-∆t
On the 480 held-out D-PREFGUARD episodes from 96 users, CAPTURE is evaluated with Qwen3-8B-Instruct and Llama-3.1-8B-Instruct backbones. These results show CAPTURE improves personalization win rate while reducing poisoning success compared to the supervision-matched Sup. Transformer-∆t baseline.
BENCHMARK
On the 480 held-out D-PREFGUARD episodes from 96 users, CAPTURE is evaluated with Qwen3-8B-Instruct and Llama-3.1-8B-Instruct backbones. These results show CAPTURE improves personalization win rate while reducing poisoning success compared to the supervision-matched Sup. Transformer-∆t baseline.
BENCHMARK
Win rate (%) against the unpersonalized base model on 480 held-out D-PREFGUARD episodes.
KEY INSIGHT
Under an adaptive attacker, CAPTURE’s poisoning rate jumps from 11.5% to 24.7%, making Provenance-only marginally more secure at 22.1% despite being less adaptive.
This is counterintuitive because CAPTURE’s sophisticated gate and ledger beat Provenance-only under fixed attacks, yet exposing gradients lets attackers exploit CAPTURE more than simple provenance filters.
WHY IT MATTERS
CAPTURE shows that treating preference authenticity as a latent state with continuous-time dynamics and multi-timescale memory can jointly improve personalization and poisoning robustness.
Builders can now design agents that keep adapting over weeks while quantifying and bounding poisoning risk, instead of choosing between fast personalization and strict provenance filters.
Guilin Zhang, Wei Jiang et al.
· 2026
A-MAC scores candidate memories using Utility, Confidence, Novelty, Recency, and Type Prior combined by a learned linear admission policy with Algorithm 1 A-MAC Memory Admission. On the LoCoMo benchmark, A-MAC achieves F1 0.583 and 2644 ms latency, improving F1 by 0.042 and reducing latency by 1187 ms compared to A-mem.
Robbyant Team, Zelin Gao et al.
arXiv 2026 · 2026
LingBot-World combines a Data Engine, Fundamental World Model, Action-Conditioned World Model, and Post-Training causal adaptation to turn a 28B-parameter video generator into a real-time interactive world simulator. On the VBench benchmark, LingBot-World achieves a dynamic degree of 0.8857 versus 0.7612 for Yume-1.5, while also improving imaging quality to 0.6683.
Manoj Madushanka Perera, Adnan Mahmood et al.
· 2026
AgenticAI-DialogGen chains ChatPreprocessor, KnowledgeExtractor, TopicAnalyzer, KnowledgeGraphBuilder, PersonaGenerator, DuelingChat Agent, ConversationValidator, ConversationRefiner, QAGeneration, and PostProcessing to turn raw multi-session chats into topic-guided, persona-grounded conversations with explicit short- and long-term memories. On the TGC / KG memory QA benchmark, Mistral-7B fine-tuned within AgenticAI-DialogGen achieves 87.36 F1, compared to GPT-4’s 83.77 F1 in a zero-shot setting on the same task.
Answers use this explainer on Memory Papers.
Checking…