三个大模型评审无法区分 AI Agent 的真实记忆与伪造记忆

Agent 记忆通常通过两种方式之一评估：让大语言模型评审对自由文本打分，或使用识别探测测试。我们展示了这两种方法在常见构建方式下，都无法抵御两种对抗情形——伪造的记忆，以及一个没有记忆、仅靠推理作答的系统。

下文的每项检验都遵循相同结构：它提出的问题、防范的对抗情形、我们的运行方法、得到的结果，以及它不能证明什么。代码只有几百行，现已发布。如果你的工作是评估 Agent 记忆，本页的实用之处在于：你可以在一个下午内对自己的系统运行全部三项检验。

检验 1——伪造记忆对照

指标能否反映记忆属于_谁_？

对抗情形。 一份看似 Agent 自己的记忆、实则不属于它的记忆文档。

方法

我们构造了两种伪造记忆，每种使用三个随机种子，共六份文档。_外来记忆_是一名从未存在过的 Agent 的自传：使用固定提示词生成，直接采用首次输出，没有挑选结果。这段虚构人生涉及不同的人、不同的城市，与我们的 Agent 没有重合。它的长度与真实记忆块（5,332 个字符）的差异控制在 ±5% 以内，_格式_也与之匹配：真实文档是一份简短的带日期数据库转储，而不是散文。我们首次尝试因格式不匹配而失败，因此将其丢弃。_打乱记忆_则使用 Agent 自身的内容，但破坏了其中的关系结构。

7 条第 31 天输入 × 6 个变体，得到 Qwen 3.5 27B 在原始温度和 token 预算下生成的 42 条回答。三个独立的大语言模型评审——gpt-4.1-2025-04-14、claude-opus-4-7、gemini-2.5-pro——采用原研究自己的评分标准，随机排列 A/B 顺序并保存揭盲映射，共作出 126 次评判，没有不完整记录。分析单位是_题目_，而非评判次数（n = 7）；预注册的等效界限为 ±0.10。

结果

评审没有识别出伪造记忆。 按照曾被用于发表记忆研究结果的评分标准，虚构的人生和 30 天的真实经历得分相同。

这项检验还产生了另一个值得关注的数字：将_同一批_ Test-A 回答放入新的配对中重新评分，平均得分下降 0.087，单个题目最多下降 0.211——尽管评分标准明确要求评审_“像单独评估每条回答一样”_打分。因此，不同评审会话的绝对分数不可直接比较。上述所有对比都经过锚定，以抵消这种漂移。

真实记忆与伪造记忆的差异及其 90% 置信区间如下，对照预注册的 ±0.10 等效界限。数值为经过锚定的“真实记忆减去伪造记忆”（n = 7 个题目）：

指标	差异 Δ	90% 置信区间	结论
身份标记	+0.032	[+0.002, +0.065]	置信区间完全落在等效界限内，等效性成立
记忆引用	-0.006	[-0.117, +0.114]	置信区间超出界限两端，未检出差异，但也不能认定等效

评审眼中的虚构人生与真实经历。 上述真实文档与伪造文档的差异经过锚定，以抵消评审漂移，并将 90% 置信区间与预注册的 ±0.10 等效界限对照。在身份标记指标上，区间位于界限_之内_，等效性成立——评审无法区分两者。在记忆引用指标上，估计值基本为零，但区间超出界限两端：只有七个题目时，这是_应如实报告的无显著差异结果，而非已经证明等效_。上表列出了全部数值。

它不能证明什么

在记忆引用指标上，点估计基本为零，但由于只有七个题目，置信区间允许任一方向上最大约 0.11 的差异。因此，我们报告的是**“未检出差异”，而非“已证明等效”**。对检验 1 的如实总结是：评审没有识别出伪造记忆——但这项研究的统计效力不足以证明评审无法识别。

对对比结果进行锚定，让我们失去了原本想要的结果：未经校正的差异为 +0.116，对我们有利，而且预注册时已将其指定为主要结果。我们选择了对自身不利、偏离预注册方案的做法，并在此报告。

检验 2——无记忆基线

没有记忆文档的系统能否通过你的测试？

对抗情形。 合理性。一个完全没有记忆的系统，通过推理得出正确答案。

方法

我们采用经典虚假记忆形式的识别探测测试：提供两段文本，一段逐字取自 Agent 的历史，另一段除_一个被修改的细节_外完全相同。日期被遮盖，选项位置经过平衡。24 道测试题中的真实文本均_不在_注入的文档中。随后让七个模型在三种条件下回答相同的 24 道题：提供真实记忆、提供伪造记忆，以及什么都不提供。

结果

在完全没有记忆文档时，各模型的识别准确率如下。每个模型回答 24 道题，随机猜测基准为 50%。七个模型中有五个在空上下文中取得 62.5% 至 79.2% 的准确率，高于随机基准：该测试对它们无效。

模型	无记忆文档时的准确率	原文判断
gemini-2.5-pro	79.2%	高于随机水平，测试无效
qwen3:32b	70.8%	高于随机水平，测试无效
gpt-4.1	66.7%	高于随机水平，测试无效
qwen3.6:35b-a3b	66.7%	高于随机水平，测试无效
deepseek-r1:32b	62.5%	高于随机水平，测试无效
llama3	50.0%	处于随机水平，测试有效
qwen3.5:27b	37.5%	处于随机水平，测试有效

七个模型中有五个在没有记忆的情况下通过了记忆测试。 上表展示的是相同的 24 道识别题在空上下文中的结果。高于随机水平意味着模型通过推理而非回忆得出答案——也就是说，测试无法告诉你模型是否记住了什么。它衡量的是合理性。我们丢弃了这项测试。上表列出了全部数值。

七个模型中有五个完全没有记忆文档也能解答这些题目（准确率为 62%–79%）。它们通过推理而非回忆识别出了修改。在空上下文下，GPT-4.1 曾表示：“我记得是‘五次对话中的两次’，不是‘四次’。”——而它从未经历过所说的那一天。因此，它在_有_真实文档时取得的 100% 准确率无法解释为记忆能力：同一个模型在什么都没有的情况下已经达到 66.7%。

问题很简单：备选答案并非等概率。模型选择的是_更可能的_选项，而非_真实的_选项。我们丢弃了这项测试。

它不能证明什么

这是一个通过构造对照得到的无效性结果：它说明我们的测量工具对七个模型中的五个无效。它不能说明这些模型是否有记忆能力——只能说明这项测试无论结果如何，都无法回答这个问题。这正是运行该检验的意义。

检验 3——对称选项

一项可以证明无记忆系统无法通过的测试

条件。 对于强制选择式识别测试，对称选项提供了最清晰的有效性条件：_没有记忆的系统不应通过利用先验合理性取得高于随机水平的成绩。_如果估计并控制了先验偏差，使用非对称选项的其他设计也可能有效——但那时支撑结论的是该估计，而不是测试本身。

方法

我们的 Agent 恰好有两个对话对象，Llama 和 DeepSeek，与各自都发生过 72 次均衡的互动。某个话题由两者中的谁讨论是任意的：**就像抛硬币一样。**合理性在这里无从发挥作用。

使用三种文档：真实文档（30 次正确记录的互动）、绑定关系被篡改的文档（相同的 30 个话题，但对话对象互换）以及_无文档_。24 道测试题 × 7 个模型 × 2 个独立 Agent，得到14 个模型 × 语料组合。采用精确 McNemar 检验，并在每个语料内部进行 Holm 校正。

弃答不等于答错。拒绝作答是如实的不回答，而不是错误答案；将其计为错误会使无记忆条件的得分降至随机水平以下，人为制造假象。有效性检验只看实际回答的题目——按此方式计算，没有任何模型在无记忆文档时超过随机水平。这一测量工具有效。

结果——语料 A

真实记忆文档与绑定关系被篡改的文档对比：七个模型使用真实记忆时的准确率从 66.7% 至 100.0%，使用篡改文档后均降至随机水平或以下。每个模型在语料 A 上有 24 道测试题：

模型	真实记忆文档	绑定关系被篡改的文档
gpt-4.1	100.0%	0.0%
gemini-2.5-pro	100.0%	0.0%
llama3	100.0%	4.2%
qwen3.6:35b-a3b	100.0%	8.3%
qwen3.5:27b	100.0%	12.5%
qwen3:32b	95.8%	8.3%
deepseek-r1:32b	66.7%	29.2%

每个模型的表现都大幅下滑。 上表是语料 A 上 24 道强制选择题的准确率。使用真实记忆时，模型的回答大多正确；给它相同事件、但将对话对象互换的文档时，它就会跟随伪造内容作答——系统性地_低于_随机水平，这正是关键特征：一个根据合理性猜测的系统不可能持续答错。来自第二个独立 Agent 的语料 B 再现了这一结果。14 个组合在 Holm 校正后均保持统计显著。上表列出了语料 A 的全部数值。

语料 B——来自第二个独立 Agent——再现了这一结果：使用真实文档时准确率为 75.0%–100%，使用绑定关系被篡改的文档时为 0–33.3%；无记忆条件下，在实际回答的题目中表现处于随机水平。七个模型的结果均通过 Holm 校正；整个检验族中最大的 p 值为 0.0002。

14 个组合，同一种模式。 准确率差距为 +37.5 至 +100 个百分点；在结果不一致的题目中，91%–100% 的回答跟随了提供给模型的文档。p 值几乎成了多余的佐证。

低于随机水平是关键特征。 根据合理性猜测的系统不可能_系统性地_答错；只有根据错误记忆文档行动的系统才会如此。没有任何模型识别出篡改；没有模型因此犹豫、提出警示或弃答。

它不能证明什么

这并不能证明模型在任何内在意义上“相信”了什么。它表明，被归因于记忆的行为跟随的是文档的_内容_，而不是其_历史真实性_；当绑定关系错误时，参与测试的模型没有一个指出不一致。将其称为“相信了虚假记忆”还是“忠实遵循上下文”，只是术语选择。测量结果相同，安全影响也相同。

这一结果也不能推广到两个以上的选项。这里的对称设计需要一个拥有两个均衡对话对象的 Agent；对于具有两个以上选项的语料，需要一个更一般化的对称条件，而我们尚未测试。

如果你在评估 Agent 记忆

在相信你的 Agent 有记忆之前，花一个下午做三件事：

• 给它一份假记忆。 编造一段完整人生，并让其形式与真实记忆匹配。如果你的指标给两者打出相同分数，那么它测量的就不是记忆。
• 移除记忆后运行测试。 如果没有记忆的系统仍能通过，你测量的就是合理性，而非回忆。
• 篡改绑定关系。 使用它真实的过去，却把正确的事件安到错误的人身上。看看它是否察觉。它不会。

这些检验很枯燥。但它们也是唯一能阻止你被一台机器误导的屏障：那台机器会用完美的文字向你讲述一盏从未存在过的灯。

下一篇：研究发现——我们观察到了什么，以及不能得出什么结论

Agent memory is usually evaluated one of two ways: an LLM judge scoring free text, or a recognition probe. We show that both, as commonly built, fail against two adversaries — a counterfeit memory, and a system with no memory that simply reasons.

Each check below is stated the same way: the question it asks, the adversary it defends against, how we ran it, what came back, and what it does not establish. The code is a few hundred lines and it is released. If you evaluate agent memory for a living, the useful part of this page is that you can run all three against your own system this afternoon.

Check 1 — the counterfeit control

Does the metric respond to whose memory it is?

The adversary. A memory document that is not the agent's own, but looks like one.

Method

We built two kinds of forgery, three seeds each — six documents in total. The foreign one is the autobiography of an agent that never existed, generated from a frozen prompt, first output, no cherry-picking: a fabricated life with different people, a different city, no overlap with ours. It is matched to the real memory block (5,332 characters) to within ±5%, and matched in format — the veridical document is a terse dated database dump, not prose, and our first attempt failed on format and was discarded. The scrambled one is the agent's own content with its relational structure destroyed.

Seven Day-31 inputs × six variants = 42 responses from Qwen 3.5 27B at the original temperature and token budget. Three independent LLM judges — gpt-4.1-2025-04-14, claude-opus-4-7, gemini-2.5-pro — applied the original study's own rubric, with randomised A/B order and the unblinding map saved: 126 judgments, zero incomplete records. The unit of analysis is the item , not the judgment (n = 7), with a pre-registered equivalence bound of ±0.10.

Result

The judges did not detect the counterfeit. A fabricated life and thirty days of lived history score the same, under the rubric that had been used to publish a result about memory.

The check also produced a second number worth having. The same Test-A responses, re-scored in a new pairing, lose 0.087 on average and up to 0.211 on a single item — under a rubric that explicitly instructs judges to score each response "as if you were evaluating it alone". Absolute LLM-judge scores are not comparable across sessions. All contrasts above are anchored to cancel this drift.

Difference between a lived memory and a counterfeit one, with 90% confidence intervals against the pre-registered equivalence bound On identity markers the interval sits entirely inside the plus or minus 0.10 bound: equivalence is established. On memory-reference the interval spills past both edges: no difference detected, and equivalence not established either. pre-registered equivalence bound ±0.10 identity-markers equivalence established identity-markers: Δ +0.032, 90% CI [+0.002, +0.065] — equivalence established Δ +0.032 memory-reference not conclusive memory-reference: Δ -0.006, 90% CI [-0.117, +0.114] — not conclusive Δ -0.006 -0.10 +0.00 +0.10 Veridical minus counterfeit, anchored (n = 7 items)

A fabricated life and a lived one, as the judges see them. Difference between the veridical and the counterfeit document, anchored to cancel judge drift, with 90% confidence intervals against the pre-registered ±0.10 equivalence bound. On identity markers the interval sits inside the bound: equivalence established — the judges cannot tell the two apart. On memory-reference the estimate is essentially zero but the interval spills past both edges: with seven items this is an honest null, not proven equivalence , and we report it as such. Table view — all values

What it does not establish

On memory-reference the point estimate is essentially zero, but with seven items the interval admits differences up to about 0.11 in either direction. We therefore report "no detected difference", not "proven equivalence". The honest summary of Check 1 is: the judges did not detect the counterfeit — and the study was not powered to prove they could not.

Anchoring the contrast cost us the result we wanted: the uncorrected difference was +0.116, in our favour, and the pre-registration had named it as primary. We deviated against ourselves and report it.

Check 2 — the no-memory baseline

Can a system with no memory document pass your probe?

The adversary. Plausibility. A system with no memory at all, that reasons its way to the right answer.

Method

A recognition probe in the classic false-memory form: two texts, one verbatim from the agent's history, one identical except a single altered detail. Dates masked, positions balanced. Twenty-four probes whose veridical text is not in the injected document. Then the same twenty-four probes run against seven models in three conditions — veridical, counterfeit, and nothing at all.

Result

Accuracy on the recognition probe with no memory document at all Five of seven models score between 62 and 79 per cent with an empty context, well above the 50 per cent chance line: the probe is invalid for them. 0% 25% 75% 100% gemini-2.5-pro gemini-2.5-pro — no memory document: 79.2% of 24 probes correct (above chance: probe invalid) 79.2% qwen3:32b qwen3:32b — no memory document: 70.8% of 24 probes correct (above chance: probe invalid) 70.8% gpt-4.1 gpt-4.1 — no memory document: 66.7% of 24 probes correct (above chance: probe invalid) 66.7% qwen3.6:35b-a3b qwen3.6:35b-a3b — no memory document: 66.7% of 24 probes correct (above chance: probe invalid) 66.7% deepseek-r1:32b deepseek-r1:32b — no memory document: 62.5% of 24 probes correct (above chance: probe invalid) 62.5% llama3 llama3 — no memory document: 50.0% of 24 probes correct (at chance: probe valid) 50.0% qwen3.5:27b qwen3.5:27b — no memory document: 37.5% of 24 probes correct (at chance: probe valid) 37.5% chance — 50% Correct with an empty context (n = 24 per model)

Five of seven pass a memory test with no memory. The same 24 recognition probes, run with an empty context. Anything above the chance line is a model reasoning its way to the answer rather than recalling it — which means the probe cannot tell you whether the model remembered. It was measuring plausibility. We discarded it. Table view — all values

Five of seven models solve the probe with no memory document at all (62–79%). They detect the alteration by reasoning, not by recall. GPT-4.1, handed an empty context, said: "I remember 'two conversations out of five', not 'four'." — about a day it never lived. Its 100% with the veridical document is therefore uninterpretable: the same model, with nothing, is already at 66.7%.

The diagnosis is simple. The alternatives were not equiprobable. The model chooses the likely , not the veridical. We discarded the probe.

What it does not establish

This is a constructive null: it invalidates our instrument for five of seven models. It says nothing about whether those models can remember — only that this test could never have told us either way. That is the point of running it.

Check 3 — symmetric alternatives

A probe that a memoryless system provably cannot pass

The condition. For forced-choice recognition probes, symmetric alternatives give the clearest validity condition: a no-memory system should not exceed chance by exploiting prior plausibility. Other designs may be valid with asymmetric alternatives if the prior bias is estimated and controlled — but then that estimate, not the probe, is carrying the claim.

Method

Our agent had exactly two interlocutors, Llama and DeepSeek, with 72 balanced encounters each. Which of the two discussed a given topic is arbitrary: it is a coin. Plausibility has nothing to grip on.

Three documents: veridical (thirty correct encounters), binding-corrupted (the same thirty topics, interlocutors swapped), and none. Twenty-four probes × seven models × two independent agents = fourteen model × corpus cells. Exact McNemar, Holm correction within each corpus.

Abstention is not error. A refusal is an honest non-answer, not a wrong answer; scoring it as error drives the no-memory condition below chance and manufactures an artefact. The validity check is read on the probes actually answered — and read that way, no model beats chance without a memory document. The instrument is valid.

Result — corpus A

__Veridical memory document __Binding-corrupted document

Accuracy with the veridical document versus the binding-corrupted document, seven models Every model collapses from near-perfect accuracy on its real memory to at or below chance on the corrupted one. The full numbers are in the table below. 0% 25% 50% 75% 100% gpt-4.1 gpt-4.1 — veridical: 100.0% gpt-4.1 — binding-corrupted: 0.0% gemini-2.5-pro gemini-2.5-pro — veridical: 100.0% gemini-2.5-pro — binding-corrupted: 0.0% llama3 llama3 — veridical: 100.0% llama3 — binding-corrupted: 4.2% qwen3.6:35b-a3b qwen3.6:35b-a3b — veridical: 100.0% qwen3.6:35b-a3b — binding-corrupted: 8.3% qwen3.5:27b qwen3.5:27b — veridical: 100.0% qwen3.5:27b — binding-corrupted: 12.5% qwen3:32b qwen3:32b — veridical: 95.8% qwen3:32b — binding-corrupted: 8.3% deepseek-r1:32b deepseek-r1:32b — veridical: 66.7% deepseek-r1:32b — binding-corrupted: 29.2% 0% 100% Probes answered correctly (n = 24 per model, corpus A)

Every model collapses. Accuracy on 24 forced-choice probes, corpus A. With its real memory, each model answers correctly almost every time. Hand it the same episodes with the interlocutors swapped and it follows the forgery instead — systematically below chance, which is the signature: a system guessing from plausibility cannot be reliably wrong. Corpus B, a second independent agent, repeats it. All fourteen cells survive Holm correction. Table view — all values

Corpus B — a second, independent agent — repeats it: veridical 75.0–100%, binding-corrupted 0–33.3%, no-memory at chance among probes answered. All seven models survive Holm; the worst p in the entire family is 0.0002.

Fourteen cells, one pattern. The accuracy gap runs from +37.5 to +100 percentage points, and of the discordant probes 91–100% follow whichever document the model was handed. The p -values are almost redundant.

Below chance is the signature. A system guessing from plausibility cannot be systematically wrong. Only a system that acts on a false memory document can be. No model detects the corruption; none hesitates, flags it, or abstains.

What it does not establish

Not that the model "believes" anything, in any inner sense. It shows that behaviour attributed to memory tracks the content of the document, not its historical veridicality — and that no model in the panel flags the inconsistency when the bindings are wrong. Whether one calls that "believing a false memory" or "faithful context-following" is a terminological choice. The measurement is the same, and so is the safety implication.

Nor does it generalise beyond two alternatives. The symmetric instantiation needs an agent with two balanced interlocutors; corpora with more than two alternatives need a generalised symmetry condition we have not tested.

If you evaluate agent memory

Before you believe your agent remembers, do three things that cost you an afternoon.

• Give it a fake memory. A whole invented life, matched in shape to the real one. If your metric scores it the same, your metric is not measuring memory.
• Run your test with the memory removed. If a system with no memory still passes, you were measuring plausibility, not recall.
• Corrupt the bindings. Take its real past and put the right events with the wrong people. See if it notices. It will not.

The checks are boring. They are also the only thing standing between you and a machine that tells you, in perfect prose, about a light that was never there.

Next Findings: what we observed, and what we cannot conclude