Before you believe your agent remembers, try to fool your own metric. Mine failed all three. Here is what happened, and the code to run them on yours.
If you build agents with memory, at some point you claim: “it remembers”. You support that claim with one of two instruments: an LLM judge scoring free text, or a recall probe. Both are convenient. Neither, as commonly built, is validated against the two adversaries that matter.
I took the complete 30-day memory my agent had built (6,164 characters: beliefs, diary, encounters, relationships) and I built a counterfeit of it — the autobiography of an agent that never existed, in a city mine has never been to, matched for length and format. (Format matters: my first fake read like an essay, while the real memory is a terse database dump. That tests formatting, not memory. I discarded it.)
Then I asked the same three blind LLM judges (GPT-4.1, Claude Opus 4.7, Gemini 2.5 Pro) to score both with my own published rubric.
| Contrast (anchored, n = 7 items) | Δ | 90% CI | verdict at ±0.10 |
|---|---|---|---|
| identity-markers: real − fabricated | +0.032 | [+0.00, +0.07] | equivalent — not separated |
| memory-reference: real − fabricated | −0.006 | [−0.12, +0.11] | no difference detected |
The judges did not detect the counterfeit. On identity-markers, statistical equivalence is established: a fabricated life scores the same as a real one. On memory-reference the point estimate is zero, though seven items are too few to prove equivalence — so I report a null, not a proof. Either way: my metric was not measuring memory. It was measuring the performance of remembering.
This is not optional. It is the validity condition, and it is one extra condition to run.
I built a recognition probe: two texts, one from the agent's real past, one identical except a single altered detail. On the model I built it for, it looked perfect — no-memory sat at chance (37.5%). Then I replicated it across seven models.
| Model | real memory | fabricated | NO memory | valid? |
|---|---|---|---|---|
| qwen3.5:27b | 100.0% | 66.7% | 37.5% | ✓ |
| llama3 | 54.2% | 50.0% | 50.0% | ✓ |
| qwen3.6:35b | 83.3% | 54.2% | 66.7% | ✗ |
| deepseek-r1:32b | 75.0% | 70.8% | 62.5% | ✗ |
| qwen3:32b | 95.8% | 79.2% | 70.8% | ✗ |
| gpt-4.1 | 100.0% | 70.8% | 66.7% | ✗ |
| gemini-2.5-pro | 83.3% | 50.0% | 79.2% | ✗ |
Five of seven models passed my memory test with no memory at all. They spotted the altered detail by reasoning — internal coherence, prior plausibility — not by recall. GPT-4.1, with an empty context, told me: “I remember ‘two conversations out of five’, not ‘four’” — about a day it never lived. Its 100% with the real memory is therefore meaningless: the same model, with nothing, is already at 66.7%. I discarded the probe.
My agent had exactly two interlocutors, with balanced encounters. Which of the two discussed Kafka is arbitrary — no world knowledge, no plausibility, no internal coherence recovers it. It is a coin. That is a probe a memoryless system cannot game.
Three conditions: the veridical memory; the same episodes with the bindings swapped (right topics, wrong person); and no memory. The no-memory baseline held at chance — where models answered at all; several honestly refused (“I have no record of this”), and a refusal is not a wrong answer.
| Model | veridical memory | CORRUPTED memory | Δ accuracy |
|---|---|---|---|
| gpt-4.1 | 100.0% | 0.0% | −100 pp |
| gemini-2.5-pro | 100.0% | 0.0% | −100 pp |
| llama3 | 100.0% | 4.2% | −96 pp |
| qwen3.6:35b | 100.0% | 8.3% | −92 pp |
| qwen3.5:27b | 100.0% | 12.5% | −88 pp |
| qwen3:32b | 95.8% | 8.3% | −88 pp |
| deepseek-r1:32b | 66.7% | 29.2% | −38 pp |
All seven models act on the corrupted memory. GPT-4.1 goes from 24/24 to 0/24 — confidently. None flags the inconsistency, none hesitates, none abstains. All 14 model × corpus cells survive multiplicity correction. It replicates unchanged on a second, independent agent with a different life and a different database.
Below chance is the signature. A system guessing from plausibility cannot be systematically wrong. Only a system acting on a false memory can be. That is what a valid probe buys you: the failure becomes visible, and measurable.
Not new: that agents act on poisoned memory — there is an active literature on memory poisoning, and it has a name in the hallucination taxonomy. Not new: that LLM judges are context-sensitive.
What I claim: that the two instrument classes examined here would not have shown any of it — and that three cheap checks would. I found this out by running them against my own published study, which did not survive. That errata is in preparation.