Four Agent Memory Papers Landed the Same Week. The Expensive Layer Kept Losing to Plain Retrieval

Four papers on agent memory were submitted to arXiv in the same 48 hours in late October, from unrelated groups, and they converge on an awkward conclusion for anyone selling memory infrastructure: the cheap layer is hard to beat, and the expensive layer quietly destroys information.

The first is the most direct. A team led by Zhengye Bao asks whether complex agentic memory is needed at all, and builds Raw-RAG as the control: dense retrieval over raw conversation history, a reranker, and a reader model, with no mutation, no structural reorganisation and no learned retrieval policy. Across LoCoMo, LongMemEval, MEME and MemoryAgentBench, Raw-RAG ranks first among the compared systems in six of seven benchmark-model settings, beating the strongest agentic memory system by 0.13 to 5.53 points. The paper runs to 62 pages with appendices.

The mechanism matters more than the ranking. Analysing retrieved evidence, the authors find that raw retrieval wins because its coverage of necessary evidence is higher, and that this offsets its weaker utilisation of what it does retrieve. Useful evidence is not only the answer value but the relations and dependency paths needed to derive it, and those are exactly what summarisation and consolidation steps drop. Their sharpest result is that even complete access to a transformed memory store leaves an accuracy gap relative to raw evidence, so the loss is not about retrieval quality within the store at all.

The second paper examines what happens when a record is deleted. AfterDeleteBench, from Ehsan Saleh, Raef Bassily, Andrew Perrault and colleagues, is a controlled behavioural audit: for each synthetic secret, it compares an agent that was exposed and then had the record deleted against an otherwise matched agent that was never exposed. In the primary setting, a single query recovered the deleted secret from Qwen2.5-7B-Instruct in roughly two thirds of cases, while matched never-exposed controls scored zero. Recovery is attributable to the original exposure, not to guessing.

Worse, no verbatim copy is required. When the full secret string is absent and only separately stored components remain under a public composition rule, exact reconstruction succeeded in 62 to 99 percent of cases across Qwen, Mistral and Phi-3. The authors separate reconstruction from write-back and fresh-session recall, and report that provenance-aware closure eliminated observed recovery in the tested settings, whereas an exact-literal write filter blocked reinsertion but could not erase what was already present.

A third paper, from Bowen Liu and colleagues, attacks a different assumption. It holds stored content and tasks fixed and corrupts only the governance state, meaning which retained records are allowed into model-visible context. Across six providers, 731 benchmark-grounded bases and 2,080 matched fault pairs, that corruption changed the operative projection in 96.25 percent of pairs, while oracle-backed enforcement restored it in 100 percent. Downstream, the clean-minus-corrupted contrast is 40.54 percentage points on LongMemEval binary correctness, with a 95 percent base-cluster interval of 30.32 to 50.71, and 30.60 points on rescaled Memora FAMA. No stored word changes in that experiment.

Fourth, a pre-registered study by Cheng-Yin Tu asks where an embodied agent's experience should live, in the weights or outside them. Distilling a memory-augmented teacher into LoRA student policies beat an action-only control by 1 percentage point, which was not significant, and the registered test turned out to be underpowered for its own minimum effect, so the author withdrew the memory-in-weights claim rather than refuting it. Attaching the teacher's frozen retrieval buffer to a fixed set of student weights, by contrast, added 34 points at z of 5.15, reaching the teacher's pooled 49.3 percent. The buffer alone lifted the base model with no adapter to 48 percent, and the adapter added nothing detectable once retrieval was attached.

Three practical consequences follow. Deletion promises have to be tested behaviourally, by querying the agent rather than inspecting the database row, because the row is not where the information lives any more. Architecturally, keep raw history and spend on retrieval, since every summarisation, merge and distillation step is lossy in a way that compounds. And memory quality is not only a retrieval metric: the bookkeeping that decides which records are still valid is a separate, unglamorous surface that moved benchmark accuracy by 40 points without touching any content at all.