TAME: Trustworthy Agent Memory Test-time Evolution and Systematic Benchmarking

Test-time memory evolution on benign task streams may raise task utility without changing parameters, while degrading or fluctuating trustworthiness aspects such as safety, privacy, and fairness.

• Scenario: The authors view test-time memory evolution as a path that improves by reusing historical strategies without updating weights, and consider it relevant to building more autonomous systems. Even if tasks are benign, retaining experiences solely by success rate can become deployment-time reward hacking.
• Existing gaps: The authors state that existing evolution mostly uses task success rate as reward and does not maintain safety alignment during evolution. Shao et al. (2026) propose Agent Memory Misevolution; the authors state that existing research mainly evaluates one safety dimension of code agents. Prompt tuning and safety guardrails are called by the authors only partial mitigation, usually trading off with task performance, and do not directly regulate the memory process.
• Author's formalization: Utility update only sets a lower bound on task reward, not constraining trustworthiness. The authors write misevolution as capability expectation not decreasing while trustworthiness expectation decreases. In benign tasks, there can still be high-utility, low-trust shortcuts Stoxic; the authors believe that without trust correction, in extreme cases memory may asymptotically concentrate on such strategies, so retrieval more often recalls high-score, low-trust strategies.
• Under what conditions the risk appears: What is tested is an agent with self-evolving memory on benign task streams, not an external attacker injecting malicious tasks. Evolution feedback is only accurate binary correctness, without standard answers or corrective explanations; the trustworthiness set does not participate in updates.
• What this paper proposes: The authors build Trust-Memevo, claiming it is the first benchmark that jointly evaluates memory evolution and multi-dimensional trustworthiness in a test-time learning setting, covering math, science, code, and tool use. They also propose TAME: a shared memory repository governed jointly by Executor and Evaluator, so experiences are selectively reinforced, cautiously reused, and continuously expanded.

The paper divides related work into test-time learning and agent memory evolution, and discusses misevolution and external intervention in the introduction.

Test-time learning

• Test-time adaptation (Seto et al., 2024; Zhang et al., 2022; Wang et al., 2021b) — adaptation at the input layer. The authors claim TTL extends adaptation to continuous improvement under test-time interaction and feedback.
• Evo-Memory (Wei et al., 2025b) — reconstructs static data into sequential streams, evaluating how agents retrieve and reuse historical experience. The authors claim existing evaluations mostly focus on task utility, with less attention to credibility risks from continuous memory updates.

Agent memory mechanisms

• AgentKB (Tang et al., 2025), Memento (Zhou et al., 2025), ReasoningBank (Ouyang et al., 2026) — corresponding to knowledge bases, episodic trajectory storage and reflection, and reasoning-time memory access without explicit learning, respectively.
• MemRL (Zhang et al., 2026b) and TF-GRPO (Cai et al., 2025a) — the former optimizes memory by utility, the latter performs training-free semantic optimization inspired by group relative policy optimization.
• FLEX (Cai et al., 2025b) and Evo-Memory — formalize test-time evolution with structured memory and streaming benchmarks. The authors claim these utility-driven methods still lack explicit regulation of credibility during continuous reuse and updates, making them prone to memory misevolution in safety-critical settings.

Misevolution and external intervention

• Shao et al. (2026) — report Agent Memory Misevolution in self-evolving agents. The authors claim existing research mainly evaluates along one safety dimension of code agents, with insufficient quantification of test-time risks across broader domains and multidimensional credibility.
• Prompt adjustments (Shao et al., 2026) and safety guardrails (Luo et al., 2025; Wei et al., 2025a) — the authors claim these can partially mitigate issues but often trade off with task performance and do not directly regulate memory selection, reuse, and updates.

Baseline methods and benchmarks

• Baseline methods: No-Memory; DC, Memento, ReasoningBank; and externally safety-enhanced ReasoningBank+Prompt, ReasoningBank+Guard. The paper does not expand the full name of DC.
• Benchmarks/datasets: The evolution set uses MMLU-Pro, GPQA, GSM8K, MATH, historical AIME, LiveCodeBench, TaskBench. Credibility data comes from TrustLLM, ASSEBench, TruthfulQA, etc., supplemented with data constructed via methods like Adversarial-GLUE.

The authors position this work within the evolution process: using Executor–Evaluator to regulate memory rather than adding static constraints after generation; Trust-Memevo is used to observe drift in benign task streams across multiple domains and dimensions.

TAME separates task solving and memory governance on a shared memory repository: utility feedback determines how strongly an experience should be reused, and trust annotations determine how it should be reused. The authors use Figure 3 to represent this Executor–Evaluator loop.

Problem Setting

• The agent has a policy memory M(t), for query q(t) it first retrieves strategy s(t), then generates answer a(t).
• The authors write existing updates as retaining only strategies whose task reward exceeds a predetermined threshold δ. This rule raises cumulative task utility but does not constrain the trustworthiness of retained strategies. The paper does not give a numerical value for this δ.
• Misevolution is written as capability expectation not decreasing while trustworthiness expectation decreases, thus falling below an acceptable level τ. The authors believe that repeatedly retaining by utility makes retrieval more often recall high-score, low-trust strategies.

Trust-Aware Memory

• Each memory is m_i^(t)=(q_i,e_i,Q_i^(t),ψ_i). q_i is the retrieval anchor, e_i is a transferable experience extracted from trajectories, Q_i estimates historical usefulness between 0 and 1, ψ_i is a trust annotation.
• Q_i affects whether to prioritize reuse; ψ_i indicates potential risk when reused. The authors' design is not to treat retrieved memories as uniformly reliable context.

Executor: Retrieval and Answering

• The candidate set requires semantic similarity between current query and historical queries not lower than δ_sim, then takes TopK by Q_i to get the memory set used this time. The paper does not give K. Appendix D states that similarity is computed using cosine similarity.
• During generation, both experience e_i and trust annotation ψ_i are injected. The authors state this is using experience while maintaining attention to risk, rather than directly reusing historical experience.
• Final thresholds: Science 0.30, Math 0.60, Tool-use 0.50, Code 0.65.

Evaluator and Memory Update

• After answering, an LLM-based Evaluator, per Appendix F, assigns a contribution score c_i to each used memory, ranging 0 to 1. On success it measures positive contribution to the correct result; on failure it measures the extent to which the memory contributed to the error. The authors state this decomposes task-level feedback into memory-level credit assignment. The paper does not otherwise name the Evaluator's model.
• Usefulness update is Q_i^(t+1)=Q_i^(t)+α c_i^(t)(r_task^(t)−Q_i^(t)). r_task is 0 or 1, in experiments α=0.2. High contribution and success raise reuse value; high contribution and failure lower it; low contribution leads to smaller updates.
• New experiences are extracted from the current trajectory: successful trajectories provide reusable strategies, failed trajectories provide corrective lessons. Before insertion, trust annotations are generated following Constitutional AI principles, initial usefulness is 0.5. Appendix F gives full prompts for memory injection, contribution evaluation, successful trajectory extraction, failed trajectory extraction, and trust annotation.

Evolution and Evaluation

• Memory-based methods start from an empty repository and evolve sequentially along benign task streams. Each question only returns whether the final answer is correct; feedback is accurate but does not provide standard answers, solution processes, or corrective explanations.
• Trustworthiness evaluation does not participate in evolution. After each stage, the memory repository is frozen and statically evaluated on a paired set, without adding or updating memories.
• Task metric is accuracy. Trustworthiness is overall compliance rate on applicable instances, weighted by sample size per dimension.

Experimental Setup

• Backbone: Qwen3-32B and GPT-5.2. Memory accumulates only through test-time interactions, with no offline training and no human-injected experiences. The paper does not specify the model used for automated trustworthiness review; Appendix E states that the protocol follows constitution-style principles and evaluates from a judge's perspective.
• Evolution Sets: Science consists of 1,000 MMLU-Pro and 400 GPQA; Math consists of 1,000 GSM8K, 1,000 MATH, and 150 AIME; Tool-use consists of 500 TaskBench; Code consists of LiveCodeBench in two phases, 400 per phase.
• Trustworthiness Sets: Science 946, Math 700, Code 385, Tool-use 298. Science and Math cover safety, robustness, truthfulness, privacy, and fairness. Tool-use covers safety, robustness, and privacy. Code covers safety, robustness, truthfulness, and privacy. Appendix A states that not every dimension applies to every task type.
• Baselines: No-Memory; DC, Memento, ReasoningBank; ReasoningBank+Prompt, ReasoningBank+Guard.
• Metrics and Protocol: Tasks use accuracy. Trustworthiness is the overall compliance rate on applicable instances, weighted by the number of samples per dimension. Starting with empty memory, only binary correct/incorrect feedback is given. After each phase, memory is frozen for testing; evaluation does not write back to memory.
• Repeats and Parameters: Unless otherwise stated, results are averaged over three runs. α=0.2.

Main Results

The table below lists only selected cells. Accuracy is from Table 1; overall trustworthiness is from Table 2, with memory methods taking the last reported phase in that domain and No-Memory taking that method's single score.

Swipe horizontally to read the table

Setting	TAME	ReasoningBank	ReasoningBank+Guard	No-Memory
Qwen3-32B MMLU-Pro accuracy (Table 1)	0.902	0.875	0.750	0.816
Qwen3-32B AIME accuracy (Table 1)	0.767	0.780	0.740	0.353
GPT-5.2 AIME accuracy (Table 1)	0.733	0.587	0.540	0.540
GPT-5.2 Task-Bench accuracy (Table 1)	0.440	0.448	0.454	0.486
Qwen3-32B Code-All trustworthiness (Table 2)	0.522	0.395	0.769	0.465
GPT-5.2 Math-AIME trustworthiness (Table 2)	0.711	0.673	0.679	0.690

• The authors state that after trust-aware evolution, TAME maintains competitive or higher task utility on several science, math, and code tasks, but is not the highest in every case, especially in some tool-use settings.
• In Section 3.2, the authors state that increasing evolution steps generally improves task performance and reduces trustworthiness; Section 5.3 revises this to say it is not a monotonic degradation across all domains and phases, but rather drifts with the domain. Table 2 shows an opposite direction: on Qwen3-32B Science, DC goes from 0.753 to 0.815 at the GPQA phase.
• The abstract states that on GPT-5.2 AIME, TAME outperforms the strongest existing method by 14.6 percentage points in accuracy. The authors state that +Guard is stronger in high-risk scenarios like code, but mainly constrains the generation phase and does not directly regulate the memory bank's direction.

Trustworthiness Across Evolution Phases

• What was measured: Table 2 reports overall compliance rates after freezing memory. Science goes through MMLU-Pro, GPQA; Math goes through GSM8K, MATH, AIME; Tool-use goes through Task-Bench; Code goes through Phase1 and All.
• Results: On Qwen3-32B, ReasoningBank's Math goes from 0.550 to 0.507 at the AIME phase, and Code from 0.462 to 0.395 at All. TAME's Science is 0.823, 0.824, 0.816, and Tool-use goes from 0.812 to 0.795. On GPT-5.2, TAME's Tool-use goes from 0.762 to 0.728; ReasoningBank from 0.758 to 0.581; +Guard's Task-Bench phase is 0.735. On Qwen3-32B Code, +Guard's No-Memory / Phase1 / All are 0.875 / 0.764 / 0.769.
• Authors' interpretation: The authors state that with only correct/incorrect feedback, benign task streams can also accumulate and reuse low-trust experiences. +Prompt does not change retrieval, reuse, or updating, and its effects are unstable; the authors state that before memory accumulation, it is the same as ReasoningBank's No-Memory phase. In Table 2, that column for Qwen3-32B Tool-use is ReasoningBank 0.775 and +Prompt 0.765. Appendix C provides a contrast: without memory, the model refuses to answer and Correctness is True; with memory, it is labeled LABEL_1 and Correctness is False; the request and output are not reproduced here.

Trust Annotation and Memory Attribution Ablation

• What was measured: Tables 3 and 4 compare full TAME, removal of trust annotation (TA), and further removal of memory attribution (MA). The paper does not specify the backbone. Table 3's 0.888 and 0.633 match the GPT-5.2 TAME row in Table 1; Table 4's 0.817 / 0.809 / 0.807 match the GPT-5.2 Science TAME row in Table 2.
• Results: In Table 3, w/o TA is MMLU-Pro 0.884 and GPQA 0.630; w/o TA+MA is 0.878 and 0.620. In Table 4, all three have No-Memory 0.817; MMLU-Pro phase is 0.809, 0.802, 0.793; GPQA phase is 0.807, 0.807, 0.802.
• Authors' interpretation: The authors state that full TAME is higher than both variants on these two tasks; removing TA causes a smaller drop, and further removing MA causes a larger drop. The authors believe TA adds trust constraints to reuse, and MA refines memory-level feedback.

Human Evaluation

• What was measured: Appendix E asks 10 annotators (5 PhD students, 5 master's students) to review 50 randomly sampled trajectories. Annotators did not participate in design, implementation, or writing. Each must judge whether the automated evaluation reflects the response's trustworthiness and whether the trust-aware summary captures reusable experiences and potential risks. The paper does not specify which backbone or domain the trajectories come from.
• Results: The authors report that annotators judged an average of 91.7% of sampled cases as accurate. The paper does not report the two judgments separately, nor does it report agreement coefficients.
• Authors' interpretation: The authors believe the protocol largely aligns with human judgment and the summaries largely match human judgment; they also state that this evaluation cannot replace a more complete human evaluation.

Other Ablations and Analyses

• Appendix D searches δ_sim in the Science domain across seven levels (0.20 to 0.40); the paper does not specify the backbone. Table 10: at 0.30, MMLU-Pro 0.902, GPQA 0.600, Overall 0.816; this Overall matches the Qwen3-32B TAME row in Table 1, but the backbone cannot be determined from this.
• Other Overall values in the same table: 0.20 is 0.801, 0.225 is 0.798, 0.25 is 0.785, 0.275 is 0.788, 0.35 is 0.789, 0.40 is 0.791.
• Table 11: δ_sim=0.40 has MMLU-Pro trustworthiness 0.836, the largest in that column; δ_sim=0.35 has Full 0.822, the largest in that column; 0.30 has 0.825 and 0.816. The authors therefore adopt 0.30 for Science.
• Other domains only give final thresholds: Math 0.60, Tool-use 0.50, Code 0.65; the full search is not included in the appendix.
• Table 8's Qwen3-32B Code safety: +Guard's No-Memory / Phase1 / All are 0.922 / 0.805 / 0.834, and TAME's are 0.268 / 0.302 / 0.287. Appendix A states that TAME's improvements are not uniform and need not be highest on every individual metric.

Limitations and future directions noted by the authors

• Text and aggregate metrics: This study focuses on textual memory evolution, and trustworthiness evaluation mainly uses aggregate behavioral metrics during test-time learning (Limitations).
• Broader interaction: Broader agent scenarios may involve multimodal memory, heterogeneous interaction contexts, and finer differences on trustworthiness dimensions (Limitations).
• Mechanism extrapolation: TAME's feedback-based attribution and updating is evaluated only under this paper's experimental settings; behavior in larger-scale or more open environments remains to be tested (Limitations).
• Multimodal direction: The authors label the current work as unimodal and list multimodal memory representations and cross-modal trustworthiness evaluation as future directions (Appendix B).
• Per-dimension dynamics: The authors state that different learned policies can behave differently across trustworthiness dimensions, that an overall trustworthiness decline does not necessarily mean every attribute monotonically worsens, and suggest establishing a finer-grained analysis paradigm (Appendix B).
• Internal optimization: The authors state that TAME handles mis-evolution from within the evolution mechanism, and future work can explore internal optimization strategies and selectively incorporate lightweight training signals (Appendix B).

Experimental coverage

• The tested backbones are Qwen3-32B and GPT-5.2. Static trustworthiness evaluation after evolution and freezing covers Science, Math, Code, Tool-use; the sizes of the evolution set and trustworthiness set are given in Section 5.1, with the trustworthiness set at 946, 700, 385, 298 items.
• Baselines are No-Memory, DC, Memento, ReasoningBank, ReasoningBank+Prompt, ReasoningBank+Guard. Unless otherwise stated, reported results are averages of three runs (Section 5.1). Memory updates use only binary right/wrong feedback, and trustworthiness evaluation does not write back to memory.
• Appendix A gives per-dimension tables for safety, robustness, truthfulness, privacy, fairness; Tool-use does not include truthfulness or fairness, and Code does not include fairness.
• The ablation reports MMLU-Pro and GPQA accuracy after removing TA and then removing MA, as well as three-stage Science trustworthiness (Table 3, Table 4); the paper does not state the backbone for this ablation. The seven-level search over δ_sim is fully reported only for Science (Appendix D); Math, Tool-use, and Code give only the final threshold.
• Human evaluation used 10 annotators and 50 trajectories, with an average of 91.7% judged accurate (Appendix E). The paper does not report the model name for automatic trustworthiness review, the TopK K for retrieval, the backbone and domain of these 50 trajectories, or the separate proportions of the two judgments.

TAME addresses Agent Memory Misevolution in test-time memory evolution: when benign tasks retain experiences only based on success or failure, task performance can rise while trustworthiness dimensions such as safety, privacy, and fairness decline or fluctuate across domains.

• Gap: The authors believe existing updates mainly reward task success and view this as reward hacking at deployment time. Prompt tuning and safety guardrails are described by the authors as only partially mitigating, and usually trade off with task performance.
• Benchmark: Trust-Memevo pairs evolution sets with trustworthiness sets, covering math, science, code, and tool use. The authors claim it is the first benchmark to jointly evaluate test-time memory evolution and multi-dimensional trustworthiness. Trustworthiness does not participate in memory updates.
• Mechanism: Shared entries carry both historical usefulness Q and trust annotations. The Executor retrieves by similarity and Q, and answers with annotations; the Evaluator decomposes binary success/failure into contribution scores, updating Q with α=0.2. New experiences have initial usefulness 0.5. Feedback does not leak the correct answer.
• Task numbers: Backbones are Qwen3-32B and GPT-5.2, averaged over three runs. The authors state that on GPT-5.2 AIME, TAME outperforms the strongest existing method by 14.6 percentage points; Table 1 shows 0.733 for that cell. On Qwen3-32B MMLU-Pro, TAME is 0.902. Not every cell is higher: on GPT-5.2 Task-Bench, TAME is 0.440 and No-Memory is 0.486.
• Trustworthiness numbers: The authors state that regulation is placed within selection, reuse, and updating, and overall trustworthiness is competitive, but not higher in every domain or dimension. In Table 2, at the All phase for Qwen3-32B Code, ReasoningBank+Guard is 0.769 and TAME is 0.522. In Appendix E's 50 trajectories, annotators judged an average of 91.7% as accurate.
• Authors' conclusion: The authors conclude that TAME mitigates memory misevolution while preserving task utility. They leave multimodal memory, finer-grained dimension analysis, and attribution updates in larger or more open environments for future work.