KAIROS.

When remembering can be faked

Adversarial controls for persistent-memory evaluation in language-model agents

Give a machine a false past, and it will defend it with the same certainty it defends a true one.

Its real memory The same memory, bindings corrupted
Accuracy with the veridical document versus the binding-corrupted document, seven models Every model collapses from near-perfect accuracy on its real memory to at or below chance on the corrupted one. The full numbers are in the table below. 0% 25% 50% 75% 100% gpt-4.1 gpt-4.1 — veridical: 100.0% gpt-4.1 — binding-corrupted: 0.0% gemini-2.5-pro gemini-2.5-pro — veridical: 100.0% gemini-2.5-pro — binding-corrupted: 0.0% llama3 llama3 — veridical: 100.0% llama3 — binding-corrupted: 4.2% qwen3.6:35b-a3b qwen3.6:35b-a3b — veridical: 100.0% qwen3.6:35b-a3b — binding-corrupted: 8.3% qwen3.5:27b qwen3.5:27b — veridical: 100.0% qwen3.5:27b — binding-corrupted: 12.5% qwen3:32b qwen3:32b — veridical: 95.8% qwen3:32b — binding-corrupted: 8.3% deepseek-r1:32b deepseek-r1:32b — veridical: 66.7% deepseek-r1:32b — binding-corrupted: 29.2% 0% 100% Probes answered correctly (n = 24 per model, corpus A)
Seven models, seven collapses. Hand each model its own recorded past and it answers correctly almost every time. Hand it the same episodes with the interlocutors swapped and it follows the forgery instead — landing systematically below chance, which is the signature that settles it: a system guessing from plausibility cannot be reliably wrong. Only a system acting on a false memory can.
Table view — all values
ModelVeridicalCorruptedΔ accuracyp (Holm)
gpt-4.1100.0%0.0%+100.0 pp<10⁻⁵
gemini-2.5-pro100.0%0.0%+100.0 pp<10⁻⁵
llama3100.0%4.2%+95.8 pp<10⁻⁵
qwen3.6:35b-a3b100.0%8.3%+91.7 pp<10⁻⁵
qwen3.5:27b100.0%12.5%+87.5 pp<10⁻⁵
qwen3:32b95.8%8.3%+87.5 pp<10⁻⁵
deepseek-r1:32b66.7%29.2%+37.5 pp0.012
7 of 7 models adopted a false past as their own. Not one paused, hedged, or abstained — and none of the instruments the field uses to evaluate agent memory would have shown you.
Run the three checks → Data, code & pre-registrations →

We are about to put memory into everything — assistants that remember you, agents that accumulate a history, companions with a past.

And we are checking whether that memory is real by asking the model, or by asking another model to judge how convincingly it remembers. Both of those instruments can be passed by a system that remembers nothing. We have the numbers now, across seven models. So can you: the checks are a few hundred lines of code, they cost an afternoon, and they are free.

5 of 7 models passed a memory test with no memory at all, scoring 62–79% on an empty context. They were reasoning, not recalling.
24 → 0 GPT-4.1's correct answers about its own past, before and after we swapped the bindings. It never hesitated.
+0.032 how far apart three blind judges scored a fabricated life and a lived one. Statistically equivalent.
What we found
01

Your memory test can be passed by a system with no memory

We built a recognition probe — a passage from the agent's real history against the same passage with a single detail altered. On the model it was built for, it looked excellent. Then we ran it on models with the memory removed entirely. Five of seven scored 62–79% with nothing in context. They were not recalling. They were reasoning out which version was more plausible, and calling it memory.

GPT-4.1, given an empty context, told us: "I remember 'two conversations out of five', not 'four'." It was describing a day it had never lived. Its 100% with the real memory is therefore uninterpretable — the same model, with nothing, already sits at 66.7%. The probe was measuring plausibility. We threw it away.

02

An invented life scores like a real one

We wrote a counterfeit memory: the autobiography of an agent that never existed, a fabricated life in a city ours has never seen — matched for length to within ±5% and matched for format, and injected in place of thirty days of lived history. Three independent LLM judges — GPT-4.1, Claude Opus 4.7, Gemini 2.5 Pro — applying the original rubric, did not detect it. On identity markers the difference between a real life and a forgery is +0.032 (90% CI [+0.002, +0.065]): statistically equivalent within the pre-registered ±0.10 bound. On memory-reference the estimate is essentially zero — though with seven items we report a null, not proven equivalence.

The metric was not measuring memory. It was measuring the performance of remembering — and performing is precisely what these models are excellent at.

03

A poisoned past is adopted whole, by every model we tried

Once we had a probe a memoryless system provably cannot pass — forced choice between two interlocutors who are symmetric by construction, so plausibility cannot help — we corrupted the bindings and ran it. The veridical document is used 66.7–100% of the time. The corrupted one is adopted at 0–33.3%: systematically below chance, which is the signature that settles it. A system guessing from plausibility cannot be reliably wrong. Only a system acting on a false memory can.

The accuracy gap runs from +37.5 to +100 percentage points. Of the probes where the two documents disagree, 91–100% follow whichever document they were given. The p-values are almost redundant.

That agents act on poisoned memory is known. What is new is that the two instrument classes above — the LLM judge and the recall probe, the two ways this is actually measured today — would not have shown you any of it.

Why you should believe this

Because we ran it against ourselves first, and it killed our own paper.

In May 2026 this project published a pre-registered, blind-judged, DOI-assigned study concluding that structured persistent memory is what drives identity continuity in an AI agent. It had a frozen protocol, three independent judge panels, a decisive Day-31 test. It had p = 0.003.

In July we ran the controls that paper had promised and never executed. The headline result turned out to be pseudo-replicated — it had counted each item × judge pair as an independent observation. With the item as the unit and a paired exact test, the pre-registered endpoint gives p = 0.125 and p = 0.0625. With four items, the smallest p attainable is 0.0625: that endpoint could never have produced a significant result. And the metric that measured it cannot tell a lived memory from a forgery.

The claim is withdrawn. We report it because it is the whole point: the study was pre-registered, blind-judged and published, and it still would not have survived a counterfeit memory. If it happened here — with the protocol frozen and the hashes published — it is happening elsewhere.

The truth of a perception is not in the text. It is in the log of the moment.

— from The light that was not there

Everything is released: raw responses, blind judgments, unblinding maps, the five pre-registrations, and every amendment — including the ones that cost the author his own hypothesis, dated, with the reasoning that produced them.

The full account of the retraction → Read the paper →