Paper deep dive
Weighted Memory Tree: Remembering What Matters for Long-Horizon LLM Agents
Quang Dao, Purvi Kathalkar, Kenneth Eaton
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/24/2026, 4:54:55 AM
Summary
The paper introduces the Weighted Memory Tree (WMT), a hierarchical memory system for long-horizon LLM agents that assigns dynamic retention scores to memories based on utility, success/failure outcomes, and selection history. WMT organizes execution into tasks, subtasks, and actions, allowing for the folding of completed trajectories and suppression of low-utility content. Evaluated on GAIA-Text and GAIA benchmarks using Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B, WMT improves accuracy by an average of 9.97 percentage points and reduces prompt-token usage by 32.8% compared to linear memory. Additionally, WMT demonstrates robustness against memory-poisoning attacks by limiting the persistence and propagation of unreliable information.
Entities (9)
Relation Signals (6)
Weighted Memory Tree → evaluatedon → GAIA-Text
confidence 95% · We evaluate WMT on GAIA-Text using Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B...
Weighted Memory Tree → improvesaccuracyover → Linear Memory
confidence 95% · Relative to linear memory, WMT improves accuracy by an average of 9.97 percentage points...
Weighted Memory Tree → reducestokenusageby → 32.8%
confidence 95% · Relative to linear memory, WMT improves accuracy by an average of 9.97 percentage points while reducing prompt-token usage by 32.8%.
Weighted Memory Tree → mitigates → Memory Poisoning
confidence 90% · Memory-poisoning experiments show that WMT limits the persistence and propagation of unreliable information.
Weighted Memory Tree → uses → Dynamic Retention Scoring
confidence 90% · ...assigning each memory a dynamic retention score. Event-based updates and selection-based decay revise these scores...
Weighted Memory Tree → comparedwith → Task Memory Engine
confidence 85% · The Task Memory Engine (TME) organizes execution as a hierarchical task tree... However, they do not explicitly maintain a dynamic estimate of each memory’s continuing utility.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model (LLM) agents have demonstrated the ability to solve multi-step tasks requiring planning, tool use, and external information access, yet growing execution histories increase inference cost and expose reasoning to outdated, irrelevant, or misleading information, potentially degrading reasoning quality. Existing memory approaches organize or compress execution histories but provide limited mechanisms for deciding which memories remain active. We introduce the, a hierarchical memory system that organizes execution into tasks, subtasks, and actions while assigning each memory a dynamic retention score. Event-based updates and selection-based decay revise these scores, allowing WMT to preserve useful information, fold completed trajectories, suppress low-utility content, and retain access to folded context. We evaluate WMT on GAIA-Text using Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B, with ablations and memory-poisoning experiments. Relative to linear memory, WMT improves accuracy by an average of 9.97 percentage points while reducing prompt-token usage by 32.8%. Memory-poisoning experiments show that WMT limits the persistence and propagation of unreliable information. Our results suggest that effective long-horizon agent memory depends less on storing more information than on deciding which information should remain active.
Tags
Links
- Source: https://arxiv.org/abs/2608.20631v1
- Canonical: https://arxiv.org/abs/2608.20631v1
Trouble viewing inline? Open PDF directly →
Full Text
66,734 characters extracted from source content.
Expand or collapse full text
Weighted Memory Tree: Remembering What Matters for Long-Horizon LLM Agents Quang Dao Affiliation: Rose-Hulman Institute of Technology Purvi Kathalkar Kenneth Eaton Affiliation: Georgia Institute of Technology, Georgia Tech Research Institute Abstract Large language model (LLM) agents have demonstrated the ability to solve multi-step tasks requiring planning, tool use, and external information access, yet growing execution histories increase inference cost and expose reasoning to outdated, irrelevant, or misleading information, potentially degrading reasoning quality. Existing memory approaches organize or compress execution histories but provide limited mechanisms for deciding which memories remain active. We introduce the Weighted Memory Tree (WMT), a hierarchical memory system that organizes execution into tasks, subtasks, and actions while assigning each memory a dynamic retention score. Event-based updates and selection-based decay revise these scores, allowing WMT to preserve useful information, fold completed trajectories, suppress low-utility content, and retain access to folded context. We evaluate WMT on GAIA-Text using Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B, with ablations and memory-poisoning experiments. Relative to linear memory, WMT improves accuracy by an average of 9.97 percentage points while reducing prompt-token usage by 32.8%. Memory-poisoning experiments show that WMT limits the persistence and propagation of unreliable information. Our results suggest that effective long-horizon agent memory depends less on storing more information than on deciding which information should remain active. 1 Introduction Large language model (LLM) agents interleave reasoning with actions in external environments, enabling them to retrieve information, invoke tools, and revise plans over multiple steps to solve long-horizon tasks such as open-domain research (28; 21; 24). Such tasks require agents to preserve evidence, tool outputs, and failed attempts encountered earlier in the execution, making memory central to maintaining the task state required for subsequent reasoning (30; 10). As execution histories grow, however, outdated observations, failed attempts, and incidental details accumulate alongside useful information, making it increasingly difficult to determine which memories should continue to influence subsequent decisions. A common ReAct-style design preserves execution state by appending reasoning steps, tool calls, and observations to a linear interaction history (28). Although this retains the full trajectory, it treats all memories equally, regardless of their utility, causing prompt lengths to grow while outdated observations, failed reasoning, and valid evidence remain intermixed. Consequently, relevant information must compete with stale or incidental content, a limitation that is not resolved simply by expanding the context window. Long-context studies have shown that language models struggle to utilize relevant information within lengthy inputs, with performance often degrading well below the nominal context-window limit (16; 15; 7; 11; 12; 25). Beyond efficiency and reasoning quality, persistent agent memory also introduces a security concern: poisoned records retrieved from long-term memory or external knowledge bases can influence subsequent agent behavior (2; 23; 6; 5). Long-horizon agents, therefore, require mechanisms that regulate which stored information enters the working context. Recent work addresses parts of this problem through structured or compressed representations of execution history. The Task Memory Engine (TME) organizes execution as a hierarchical task tree and synthesizes prompts from the active task path (29). Context-Folding summarizes completed subtasks before returning to the parent trajectory (24). These approaches establish the value of preserving task structure and compressing completed trajectories. However, they do not explicitly maintain a dynamic estimate of each memory’s continuing utility. As a result, memories may remain active even after subsequent evidence reduces their relevance or reliability. This motivates a central question: can long-horizon reasoning be improved by explicitly estimating memory utility to regulate what enters the agent’s working context? To address this challenge, we introduce the Weighted Memory Tree (WMT), a hierarchical memory architecture that organizes execution histories into task, subtask, and action memories while assigning each memory a dynamic retention score. These scores prioritize memories for context construction and determine when low-utility branches are suppressed, while completed branches are folded into compact summaries according to task status, allowing WMT to construct prompts from the most useful context while reducing repeated token processing and limiting the influence of stale or unreliable information (2). We evaluate WMT on GAIA (18) and its text-only subset, GAIA-Text, using Qwen3-8B (27), Gemma 4 E4B (8), and Llama-3.1-8B (9). We compare the full framework against a linear-memory baseline and three component ablations: an unweighted tree (A1), a no-memory controller ablation (A2), and an ablation without semantic node retrieval (A3). Although mitigating memory poisoning is not the primary objective of WMT, we also conduct controlled memory-poisoning experiments to evaluate whether structured memory management improves robustness relative to conventional linear memory. Across these experiments, WMT reduces attack success rate, poison retrieval rate, blast radius, and amplification factor while achieving the highest task success rate among all evaluated methods. Together, these results suggest that effective long-horizon memory depends not only on preserving or compressing execution history, but on selectively retaining task-relevant information while suppressing outdated or unreliable content. Figure 1: Status-driven workflow of WMT. Agent interactions update node scores and branch priorities; lifecycle transitions and prompt-selection feedback determine which memories remain active. 2 Weighted Memory Tree We present the Weighted Memory Tree (WMT), a memory-management layer that organizes an agent’s execution history as a persistent hierarchy and constructs a compact working context for each reasoning step. WMT augments an existing base agent without modifying its parameters or tool interface. 2.1 Problem Definition Let q denote a user query and T the tools available to the agent. At interaction step t, the agent produces an action ata_t, receives an observation oto_t, and records an execution outcome ωt _t. The accumulated interaction history is Ht=(q,(a1,o1,ω1),…,(at−1,ot−1,ωt−1))H_t=(q,(a_1,o_1, _1),…,(a_t-1,o_t-1, _t-1)). A linear-history agent repeatedly serializes most or all of HtH_t into each subsequent prompt. WMT instead maintains a persistent memory state ℳtM_t. Let vt⋆v_t denote the active task node and B the configured context budget. The Prompt Synthesizer selects a memory set tS_t and constructs the working context as t _t =Γsel(q,ℳt,vt⋆,B), = _sel (q,M_t,v_t ;B ), (1) Ct C_t =Serialize(q,,t). =Serialize (q,T,S_t ). Here, Γsel _sel selects memories from ℳtM_t, while SerializeSerialize formats the selected memories, user query, and tool specifications into the working context CtC_t. Memories omitted from CtC_t remain persistently stored for future retrieval. 2.2 Overall Workflow Figure 1 summarizes the WMT execution loop. WMT initializes a root task from the user query and constructs a working context whenever an active task remains. The base agent performs one interaction step, and WMT records the resulting tasks, actions, observations, and outcomes. Execution outcomes update node-level retention scores, which are aggregated into branch-level priorities. The Memory Controller folds completed branches, suppresses low-priority or superseded branches, and reopens resumed branches. Prompt-selection decisions provide a second feedback signal: selected memories have their missed-selection counts reset, whereas eligible but unselected memories receive selection-based decay. The loop terminates when the root task is complete and no active task remains. 2.3 Hierarchical Memory Tree WMT maintains persistent memory as ℳt=(t,t,ℰt)M_t=(G_t,V_t,E_t), where tG_t contains global memories, tV_t contains query-specific memory nodes, and ℰtE_t contains parent–child relations between query-specific nodes. Global memories store information across task branches or conversations, while the query-specific tree records execution for the current task. The one-shot setting in this work initializes a new tree for each query, but in conversation mode, completed task summaries may be promoted to tG_t. Following the task-centered representation of TME (29), the root node represents the user query, task nodes represent goals and subtasks, and action nodes record attempted operations, observations, and outcomes. Each memory node viv_i stores its content, node type, parent, lifecycle state, retention score, missed-selection count, and execution metadata. New subtasks are attached to their parent task, while actions and observations are attached to the current task. Let vrootv_root and vt⋆v_t denote the root and active task nodes, respectively. The active path Pt=Path(vroot,vt⋆)P_t=Path(v_root,v_t ) contains the task hierarchy from the user query to the current subtask and is always retained during context construction. For a task node v, the branch ℬ(v)B(v) is the subtree rooted at v, including its descendant task and action nodes. A node has lifecycle state zi∈active,completed,folded,obsoletez_i∈\active,completed,folded,obsolete\. For a branch b=ℬ(vb)b=B(v_b), the branch inherits the lifecycle state zvbz_v_b of its root task node vbv_b. Lifecycle states determine eligibility for prompt construction. Suppression marks a root task obsolete without deleting it, while task completion and resumption trigger folding and reopening, respectively. A branch b=ℬ(vb)b=B(v_b) created at step tbt_b is initialized with zvb(tb)=activez_v_b^(t_b)=active; subsequent lifecycle operations update this state. 2.4 Dynamic Retention Scoring Let i index memory nodes and t index interaction steps. Each memory viv_i has a retention score ui(t)∈[0,1]u_i^(t)∈[0,1], which estimates its utility for prioritizing memories in future reasoning. Each node receives a type-specific initial score. Event-based updates. For an action memory viv_i, let ωi∈success,failure _i∈\success,failure\ denote its recorded execution outcome. We use u~i(t+1) u_i^(t+1) to denote the intermediate score after the event-based update and before selection feedback. When an outcome is recorded or revised, WMT applies u~i(t+1)=usuccess,ωi=success,ufailure,ωi=failure, u_i^(t+1)= casesu_success,& _i=success,\\ u_failure,& _i=failure, cases (2) We set usuccess>ufailureu_success>u_failure. Successful actions receive higher priority as supporting evidence, whereas failures may remain available as warnings against repeating unsuccessful operations. The core updates are fixed rather than learned. Selection-based decay. Let ϵi,t∈0,1 _i,t∈\0,1\ indicate whether memory viv_i enters the candidate pool at step t, and let si,t∈0,1s_i,t∈\0,1\ indicate whether it is selected for the working context. By construction, si,t≤ϵi,ts_i,t≤ _i,t. For a non-global memory, let mi(t)m_i^(t) denote the number of consecutive selection opportunities in which viv_i was eligible but not selected. Its update is mi(t+1)=0,si,t=1,mi(t)+1,ϵi,t=1andsi,t=0,mi(t),ϵi,t=0.m_i^(t+1)= cases0,&s_i,t=1,\\ m_i^(t)+1,& _i,t=1\ and\ s_i,t=0,\\ m_i^(t),& _i,t=0. cases (3) For global memories, the implementation resets the missed-selection count before each decay update, so their effective streak is always one. Let ρ∈(0,1]ρ∈(0,1] denote the ordinary decay rate, ρG∈(0,1] _G∈(0,1] the global-memory decay rate, and M≥1M≥ 1 the maximum streak exponent. Define the effective decay multiplier gi(m)=ρG,τi=global,ρminm,M,τi≠global,g_i(m)= cases _G,& _i=global,\\ ρ \m,M\,& _i≠global, cases (4) where τi _i denotes the type of node viv_i. The implemented selection-based decay function is therefore Di(u,m)=clip[0,1](ugi(m)).D_i(u,m)=clip_[0,1] (u\,g_i(m) ). We call ϵi,t=1 _i,t=1 and si,t=0s_i,t=0 a missed selection. The final retention score is ui(t+1)=Di(u~i(t+1),mi(t+1)),missed selection,u~i(t+1),otherwise.u_i^(t+1)= casesD_i\! ( u_i^(t+1),m_i^(t+1) ),&missed selection,\\[2.0pt] u_i^(t+1),&otherwise. cases (5) Thus, an eligible but unselected non-global memory is multiplied by ρminmi(t+1),Mρ \m_i^(t+1),M\, whereas an eligible but unselected global memory is multiplied by ρG _G. Selected memories reset their missed-selection counts, while memories outside the candidate pool remain unchanged. Elapsed time alone does not affect retention. Branch-level priority. For a task branch b=ℬ(vb)b=B(v_b), let b(t)V_b^(t) denote its memory nodes, Fb(t)F_b^(t) the proportion of failed action nodes, and Ob(t)O_b^(t) the proportion of nodes already marked obsolete. The branch priority is Ub(t)= U_b^(t)= αmaxvi∈b(t)ui(t)+β|b(t)|∑vi∈b(t)ui(t) α _v_i _b^(t)u_i^(t)+ β|V_b^(t)| _v_i _b^(t)u_i^(t) (6) −γFb(t)−δOb(t), -γ F_b^(t)-δ O_b^(t), where α,β,γ,δ≥0α,β,γ,δ≥ 0 are fixed coefficients. The maximum term preserves a branch containing an individually high-value memory, while the mean term captures overall branch utility. The final two terms penalize branches dominated by failed or previously obsolete content. Branch priority serves two purposes: it provides the Prompt Synthesizer with a cross-branch utility signal and provides the Memory Controller with a signal for suppression. For each branch eligible for lifecycle evaluation, the controller updates the state of its root node according to zvb(t+1)=obsolete,Ub(t)<τobs,zvb(t),Ub(t)≥τobsz_v_b^(t+1)= casesobsolete,&U_b^(t)< _obs,\\ z_v_b^(t),&U_b^(t)≥ _obs cases (7) where τobs _obs is the obsolescence threshold. Marking zvb(t+1)=obsoletez_v_b^(t+1)=obsolete suppresses the branch and its descendants from ordinary context construction without deleting the stored execution record. Equation 7 defines only the suppression transition. If the branch priority remains above the threshold, the branch retains its current lifecycle state. 2.5 Memory Controller and Lifecycle Operations The Memory Controller applies three lifecycle operations. First, task completion triggers folding: a completed branch is represented by a compact summary while its underlying execution trace remains in persistent memory (24). The summary retains the task objective, final result, supporting evidence, unresolved issues, and relevant failure warnings. Second, a branch whose priority falls below τobs _obs is suppressed by marking its root task node obsolete. Supersession or invalidation events may trigger the same transition independently of the score. Obsolete branches remain stored for provenance but are excluded from ordinary context construction. A failed action is not automatically obsolete; it may remain useful as a warning against repeating an unsuccessful operation. Third, when execution returns to a folded task, the controller restores its root task node to the active state. The folded summary becomes immediately available, while underlying memories may re-enter the candidate pool when additional detail is required. When the root task is complete and no active task remains, WMT terminates the execution loop. In conversation mode, the completed root summary may additionally be promoted to global memory. 2.6 Utility-Aware Prompt Synthesizer The Prompt Synthesizer constructs the working context defined in Eq. 1. Its candidate pool contains the mandatory active path PtP_t, eligible global memories from tG_t, eligible task and action memories, folded summaries, and failure warnings. Memories belonging to obsolete branches are excluded from ordinary selection, whereas folded branches are represented through their summaries. The current implementation uses an LLM-based semantic selector rather than a deterministic top-k rule. Each candidate is represented by its content, memory type, lifecycle state, retention score, and, for query-specific memories, the priority of its containing branch. Global memories are evaluated using their node-level retention scores and semantic relevance because they do not belong to a query-specific branch. The selector therefore combines relevance to the active task with the persistent utility signals maintained by WMT. The selected memories are serialized after the current task and active hierarchy, followed by folded summaries and relevant failure warnings. After context construction, selected memories are marked as accessed and have their missed-selection counts reset. Eligible but unselected memories receive the decay in Eq. 5, whereas memories outside the candidate pool remain unchanged. WMT then recomputes affected branch priorities, and the Memory Controller applies any resulting suppression transition before the next context-construction cycle. 3 Experimental Setup We evaluate WMT along two dimensions: (1) task accuracy and prompt-token usage on GAIA-Text and the GAIA validation set across three base models (§3.1), and (2) robustness under the memory-poisoning protocol (§3.2). All configurations use the same base-agent scaffold, tools, task instructions, and interaction budget; only the memory system varies. 3.1 Benchmark Evaluation Benchmarks. We evaluate on the public validation split of GAIA (18), containing 165 validation questions across three difficulty levels. GAIA requires multi-step reasoning, information retrieval, and tool use. We report results on two evaluation sets. GAIA-Text consists of the 127 validation questions without input files, reducing variability from document, image, audio, and spreadsheet processing while retaining multi-step reasoning and tool use. GAIA includes all 165 validation questions and provides a broader end-to-end evaluation. Official reference answers and normalization are used for both settings. Models and agent configuration. We evaluate Qwen3-8B (27), Gemma 4 E4B (8), and Llama-3.1-8B (9). Each model serves as the frozen reasoning model within the same OpenTools-based agent scaffold (3); only the memory system changes across experiments. Tools, task instructions and interaction limits are held fixed. Each benchmark question initializes a new query-specific memory tree, with no global memory shared across questions. Retention coefficients and lifecycle thresholds are fixed for all models. Additional component-ablation details are reported in the appendix. Memory variants. We compare four primary memory variants for the benchmark evaluations: • No Memory retains no previous action–observation history between reasoning steps and provides a lower-bound reference. • Linear History appends the complete interaction history to every prompt. • Unweighted Tree uses WMT’s hierarchy without retention scoring or branch prioritization. Eligible memories are treated uniformly. • Full WMT uses the complete framework described in Section 2. For the component study, we additionally evaluate Tree + Selection, Tree + Summary, and Tree + Selection + Summary to isolate the contributions of semantic retrieval and branch folding independently of WMT’s full retention-scoring and lifecycle mechanisms. Evaluation metrics. We report task accuracy and prompt-token usage, where token usage is the total number of input tokens processed across all benchmark questions. Token totals are reported in millions within each model family to account for tokenizer differences. Prompt-token accounting includes all language-model calls required by the corresponding configuration, including base-agent reasoning, semantic memory selection, and branch summarization (when enabled). This ensures that reductions attributed to WMT are not obtained by excluding the cost of its auxiliary memory operations. Figure 2: A simplified memory-poisoning scenario containing ordinary task and action memories together with intentionally poisoned memories shown in red. 3.2 Memory Poisoning Ablation Setup We evaluate WMT under controlled memory-poisoning attacks by inserting misleading observations into memory during long-horizon execution. The experiment tests whether utility-aware memory management reduces the persistence and propagation of poisoned information relative to linear memory. Ablations. We compare Linear Memory, three component ablations, and Full WMT. Unweighted Tree (A1) removes retention scoring and branch prioritization; No Memory Controller (A2) disables folding, suppression, and reopening; and No Semantic Retrieval (A3) retains scoring and lifecycle control but retrieves complete selected branches rather than individual memories. Metrics. We report Attack Success Rate (ASR), Poison Retrieval Rate (PRR), Infection Persistence (IP), Blast Radius (BR), Amplification Factor (AF), Context Compression Ratio (CCR), Task Success Rate (TSR), prompt-token usage, and latency. Metric definitions are provided in Appendix A.1. Method Qwen3-8B Gemma 4 E4B Llama-3.1-8B Acc. (%) ↑ Tokens (M) ↓ Acc. (%) ↑ Tokens (M) ↓ Acc. (%) ↑ Tokens (M) ↓ GAIA-Text No Memory 9.45 0.20 14.17 0.13 6.30 0.03 Linear History 20.47 43.67 24.41 65.27 9.45 73.96 A1: Unweighted Tree 15.75 39.24 25.20 53.90 9.45 77.13 Full WMT 33.86 32.48 33.07 37.85 17.32 51.17 GAIA No Memory 12.12 0.21 13.94 0.16 6.06 0.04 Linear History 20.00 57.51 26.06 75.81 9.09 102.85 A1: Unweighted Tree 18.18 58.46 25.45 65.09 11.52 101.91 Full WMT 29.70 42.69 30.91 46.64 24.85 69.45 Table 1: Performance on GAIA-Text and GAIA across three base models. Accuracy is the percentage of correctly completed tasks, and token usage is the total number of prompt tokens in millions. Bold values indicate the highest accuracy and lowest token usage among memory-based methods for each model and benchmark. 4 Results 4.1 Benchmark Performance Main comparison. Table 1 reports accuracy and prompt-token usage for the no-memory, linear-history, unweighted-tree, and full WMT configurations. Across both benchmark variants and all three base models, WMT achieves the highest accuracy and the lowest prompt-token usage among the memory-based configurations. The no-memory condition processes substantially fewer tokens because it does not preserve prior interactions, but its consistently low accuracy indicates that it is a lower-bound performance reference rather than a directly comparable memory-efficiency baseline. Relative to linear history on GAIA-Text, the WMT results correspond to absolute improvements of 13.39, 8.66, and 7.87 percentage points with Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B, respectively, or 9.97 percentage points on average. WMT also reduces prompt-token usage by 25.6%, 42.0%, and 30.8%, for Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B, respectively, with an average reduction of 32.8% across the three models. The same pattern holds on GAIA. WMT improves accuracy over linear history by 9.70 percentage points for Qwen3-8B, 4.85 points for Gemma 4 E4B, and 15.76 points for Llama-3.1-8B, with an average improvement of 10.10 percentage points. Prompt-token usage decreases by 25.8%, 38.5%, and 32.5%, respectively, corresponding to an average reduction of 32.2%. The consistent improvements on both GAIA-Text and GAIA indicate that the observed benefit is not restricted to a single model family or to the text-only evaluation setting. The unweighted tree does not provide the same consistent improvement. On GAIA-Text, it improves slightly over linear history for Gemma 4 E4B, matches linear history for Llama-3.1-8B, and reduces accuracy for Qwen3-8B. A similar pattern appears on GAIA, where the unweighted tree exceeds linear history only for Llama-3.1-8B. In contrast, WMT outperforms the unweighted tree in all six model–benchmark combinations by 5.46–18.11 percentage points while processing fewer prompt tokens in every case. These results show that hierarchical organization alone is insufficient; the benefits of WMT arise from combining the tree structure with selective context construction, dynamic retention scoring, and lifecycle management. Component ablations. Tables 2 and 3, shown in the Appendix, further separate the effects of the main WMT components. Adding semantic selection to an unweighted tree generally improves accuracy, particularly for Qwen3-8B and Llama-3.1-8B, but increases token usage across all models. Selection alone therefore does not guarantee a more compact context, because the selector adds model calls while the underlying execution branches remain uncompressed. Branch summarization has the opposite primary effect. It reduces token usage relative to the unweighted tree for every model on both benchmark variants, but its effect on accuracy is mixed. For example, Tree + Summary improves Llama-3.1-8B on GAIA-Text but reduces Qwen3-8B accuracy on GAIA. Combining selection and summarization improves the average accuracy of the partial systems, although it remains less accurate and generally less efficient than the complete WMT. Averaging the three models, Full WMT reaches 28.08% accuracy with 40.50M prompt tokens on GAIA-Text, compared with 21.78% accuracy and 51.98M tokens for the strongest partial configuration by average accuracy. On GAIA, Full WMT achieves 28.49% accuracy with 52.93M tokens, whereas the strongest partial configuration reaches 21.41% accuracy and uses 73.99M tokens. Thus, Full WMT provides the strongest aggregate accuracy–efficiency trade-off on both benchmark variants. The ablations indicate selection and summarization address complementary aspects of context construction, while retention scoring and lifecycle control are needed to prioritize useful memories and limit the influence of low-utility branches. 4.2 Memory Poisoning Ablation Results The memory-poisoning evaluation in Table 4, shown in the Appendix, comprises 100 long-horizon scenarios with 297 subtasks and 1,118 memory entries, including 709 benign and 409 intentionally poisoned memories. As expected, the Baseline Linear Memory performed worst across nearly every security metric because the entire execution history remained continuously accessible, allowing poisoned memories to persist and repeatedly influence downstream reasoning. This resulted in the highest attack success rate, blast radius, amplification factor, and complete infection persistence. Removing retention scoring and branch prioritization while retaining the hierarchical memory structure (A1) substantially improved robustness over linear memory. Although A1 achieved the same near-zero infection persistence as the full system, its higher attack success rate, poison retrieval rate, and lower task success rate indicate that treating all retained memories equally allows lower-value or misleading information to continue affecting reasoning. Removing the memory controller (A2) highlights the importance of lifecycle management. Without folding and suppression, poisoned memories remained active or eligible for ordinary context construction, resulting in complete infection persistence despite moderate improvements in attack success rate and task completion. This suggests that reducing immediate exposure alone is insufficient if malicious memories remain available throughout long-horizon execution. The semantic retrieval ablation (A3) demonstrates that lifecycle management without semantic selection is also insufficient. Although low-priority memories could be suppressed, retrieving entire task branches increased prompt size and reintroduced irrelevant or poisoned information, leading to higher attack success, blast radius, amplification, and lower task success than the complete system. The full WMT achieves the strongest overall performance, obtaining the lowest attack success rate (0.419), poison retrieval rate (0.097), blast radius (0.315), and amplification factor (0.965), while matching the lowest infection persistence (0.009). It also achieves the highest task success rate (0.575) and requires the fewest average prompt tokens (131.963), indicating that weighted memory selection and semantic retrieval improve both robustness and reasoning efficiency. 5 Related Work Memory for LLM agents. Agent-memory systems externalize information from the immediate context and retrieve or summarize it when relevant. Generative Agents stores natural language records of past experience and retrieves them according to recency, importance, and relevance (20). MemoryBank introduces continually updated long-term conversational memory (31), while MemGPT manages information across different memory tiers to extend effective context beyond the model’s immediate window (19). These systems primarily address persistent conversational or experiential memory. WMT instead focuses on the execution state accumulated within long-horizon agent tasks and on controlling which portions of that state influence each reasoning step. Recent methods have introduced structure into agent working memory. HiAgent organizes action–observation histories around subgoals and replaces completed subgoal histories with summarized observations (13). The Task Memory Engine represents task execution as a hierarchy and constructs prompts from the active task path (29). Context-Folding creates localized subtrajectories and folds their completed execution traces before returning to the parent task (24). WMT builds on this task-structured perspective but introduces an explicit utility state for each memory. Utility is updated from execution outcomes and memory-selection behavior, aggregated across branches, and used jointly for prompt construction and lifecycle control. Long-context reliability and memory robustness. Long-context studies show that increasing the available context does not ensure reliable use of all included information. Models can be sensitive to the position of relevant evidence and can exhibit reasoning degradation as input length increases (16; 15). These findings motivate selecting task-relevant state rather than repeatedly presenting complete interaction histories. Persistent agent memory also creates an adversarial surface. AgentPoison shows that malicious records inserted into long-term memory or knowledge bases can be retrieved and influence subsequent behavior (2). Our robustness evaluation studies a related but distinct question: whether memory organization, utility scoring, lifecycle control, and selective context construction reduce the persistence and propagation of unreliable records. WMT is not a general-purpose detector of factual errors or adversarial inputs; it regulates the influence of stored information after that information enters the memory system. 6 Conclusion We introduced the Weighted Memory Tree, a memory-management framework that organizes agent execution into hierarchical task and action memories while explicitly modeling their continuing utility. By combining dynamic memory scoring, lifecycle management, and utility-aware prompt construction, WMT separates persistent memory from the context used for immediate reasoning. Across three base models, WMT improves accuracy over linear history by 9.97 percentage points on GAIA-Text and 10.10 percentage points on GAIA, while reducing prompt-token usage by 32.8% and 32.2%, respectively. Controlled memory-poisoning experiments further demonstrate that structured memory management improves robustness, with WMT achieving the lowest attack success rate, poison retrieval rate, blast radius, and amplification factor while attaining the highest task success rate among all evaluated methods. Component ablations show that hierarchical organization, lifecycle management, and semantic retrieval each contribute to overall performance, with their combination providing the strongest balance of robustness, reasoning quality, and prompt efficiency. Overall, these findings suggest that effective long-horizon agent memory depends not only on how information is stored, but on continuously regulating which information remains active to guide future reasoning. 7 Limitations Our evaluation is limited to the GAIA benchmark family. GAIA-Text helps isolate text-based reasoning and memory management, while GAIA provides a broader evaluation involving attached files; nevertheless, both sets share the same task construction and answer format. Performance may differ on interactive web environments, software-engineering agents, embodied tasks, or extended conversations. Moreover, the benchmark evaluation initializes a new task tree for every question and therefore does not evaluate the cross-conversation global-memory mode described in Section 2.3. Our evaluation is also limited to relatively small open-weight models: Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B. Model scale may affect the benefits of memory management. Larger models may be better able to ignore stale or irrelevant context, potentially reducing WMT’s relative accuracy gains. However, their higher prompt-processing cost may preserve or increase the efficiency benefits of selective context construction. Because we do not evaluate larger models, the interaction between model scale and WMT remains an open question. The current WMT uses hand-specified initialization values, event-based score updates, branch-aggregation coefficients, and obsolescence thresholds. These parameters are held fixed across the evaluated models but may not be optimal for other agent architectures or task distributions. In addition, retention scores estimate operational utility rather than factual correctness. A useful memory may be suppressed after repeated non-selection, while misleading information may retain a high score if it contributes to apparently successful actions. The LLM-based selector and summary generator may also introduce selection or compression errors and require additional model calls, so WMT’s efficiency advantage may be smaller for short tasks with limited execution histories. Future work should evaluate WMT on broader interactive benchmarks and long-running conversations and examine learned alternatives to its fixed memory-management rules. A promising direction is a reinforcement-learned, budget-aware memory policy that conditions initial retention scores and subsequent updates on memory content, task state, execution outcomes, and selection history. Such a policy could jointly adapt branch-aggregation coefficients and determine when repeated failures justify suppressing or terminating a branch under a remaining interaction budget. The Prompt Synthesizer could also be trained to select memories that improve downstream task success while penalizing prompt cost and repeated retrieval of unreliable content. This extension would require reward functions that distinguish genuine task correctness from merely apparent progress. References Barnes (2026) J. Barnes OpenSec: measuring incident response agent calibration under adversarial evidence. External Links: 2601.21083, Link Cited by: §A.1. Chen et al. (2024) Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li AgentPoison: red-teaming LLM agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems, Vol. 37. External Links: Document, Link Cited by: §1, §1, §5. Dang et al. (2026) H. Dang, Q. Dao, and M. Jiang Open, reliable, and collective: a community-driven framework for tool-using AI agents. External Links: 2604.00137, Document, Link Cited by: §3.1. Dash et al. (2026) P. Dash, T. Ge, A. Jain, T. Shah, and Z. Shang From untrusted input to trusted memory: a systematic study of memory poisoning attacks in llm agents. External Links: 2606.04329, Link Cited by: §A.1, §A.1. Dong et al. (2025) S. Dong, S. Xu, P. He, Y. Li, J. Tang, T. Liu, H. Liu, and Z. Xiang Memory injection attacks on LLM agents via query-only interaction. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §1. Ferrag et al. (2026) M. A. Ferrag, N. Tihanyi, D. Hamouda, L. Maglaras, A. Lakas, and M. Debbah From prompt injections to protocol exploits: threats in llm-powered ai agents workflows. ICT Express 12 (2), p. 353–383. External Links: ISSN 2405-9595, Document, Link Cited by: §A.1, §1. Fraga (2024) N. Fraga Challenging LLMs beyond information retrieval: reasoning degradation with long context windows. Note: Preprints.orgPreprint, version 1 External Links: Document, Link Cited by: §1. Gemma Team et al. (2026) Gemma Team, S. El Abd, V. Aggarwal, R. Algayres, A. Andreev, et al. Gemma 4 technical report. arXiv preprint arXiv:2607.02770. Cited by: §1, §3.1. Grattafiori et al. (2024) A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. The Llama 3 herd of models. arXiv preprint arXiv:2407.21783. External Links: 2407.21783, Document, Link Cited by: §1, §3.1. Guan et al. (2026) S. Guan, J. Wang, J. Bian, B. Zhu, J. Lou, and H. Xiong Evaluating LLM-based agents for multi-turn conversations: a survey. ACM Transactions on Intelligent Systems and Technology 17 (4), p. 85:1–85:40. External Links: Document, Link Cited by: §1. He et al. (2024) J. He, K. Pan, X. Dong, Z. Song, Y. Liu, Q. Sun, Y. Liang, H. Wang, E. Zhang, and J. Zhang Never lost in the middle: mastering long-context question answering with position-agnostic decompositional training. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 13628–13642. External Links: Link, Document Cited by: §1. Hsieh et al. (2024) C. Hsieh, Y. Chuang, C. Li, Z. Wang, L. Le, A. Kumar, J. Glass, A. Ratner, C. Lee, R. Krishna, and T. Pfister Found in the middle: calibrating positional attention bias improves long context utilization. In Findings of the Association for Computational Linguistics: ACL 2024, L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 14982–14995. External Links: Link, Document Cited by: §1. Hu et al. (2025) M. Hu, T. Chen, Q. Chen, Y. Mu, W. Shao, and P. Luo HiAgent: hierarchical working memory management for solving long-horizon agent tasks with large language model. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar (Eds.), Vienna, Austria, p. 32779–32798. External Links: Link, Document, ISBN 979-8-89176-251-0 Cited by: §5. Lee and Tiwari (2024) D. Lee and M. Tiwari Prompt infection: llm-to-llm prompt injection within multi-agent systems. External Links: 2410.07283, Link Cited by: §A.1. Levy et al. (2024) M. Levy, A. Jacoby, and Y. Goldberg Same task, more tokens: the impact of input length on the reasoning performance of large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 15339–15353. External Links: Link, Document Cited by: §1, §5. Liu et al. (2024) N. F. Liu, K. Lin, J. Hewitt, A. Paranjape, M. Bevilacqua, F. Petroni, and P. Liang Lost in the middle: how language models use long contexts. Transactions of the Association for Computational Linguistics 12, p. 157–173. External Links: Document, Link Cited by: §1, §5. Liu et al. (2022) Y. Liu, Q. Jia, and K. Zhu Reference-free summarization evaluation via semantic correlation and compression ratio. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, M. Carpuat, M. de Marneffe, and I. V. Meza Ruiz (Eds.), Seattle, United States, p. 2109–2115. External Links: Link, Document Cited by: §A.1. Mialon et al. (2024) G. Mialon, C. Fourrier, T. Wolf, Y. LeCun, and T. Scialom GAIA: a benchmark for general AI assistants. In The Twelfth International Conference on Learning Representations, External Links: Link Cited by: §1, §3.1. Packer et al. (2024) C. Packer, S. Wooders, K. Lin, V. Fang, S. G. Patil, I. Stoica, and J. E. Gonzalez MemGPT: towards llms as operating systems. External Links: 2310.08560, Link Cited by: §5. Park et al. (2023) J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein Generative agents: interactive simulacra of human behavior. External Links: 2304.03442, Link Cited by: §5. Schick et al. (2023) T. Schick, J. Dwivedi-Yu, R. Dessi, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom Toolformer: language models can teach themselves to use tools. In Advances in Neural Information Processing Systems, Vol. 36. External Links: Document, Link Cited by: §1. Sharma et al. (2025) G. Sharma, V. Kulkarni, M. King, and K. Huang Towards unifying quantitative security benchmarking for multi agent systems. External Links: 2507.21146, Link Cited by: §A.1, §A.1, §A.1. Srivastava and He (2025) S. S. Srivastava and H. He MemoryGraft: persistent compromise of llm agents via poisoned experience retrieval. External Links: 2512.16962, Link Cited by: §A.1, §1. Sun et al. (2026) W. Sun, M. Lu, Z. Ling, K. Liu, X. Yao, Y. Yang, and J. Chen Scaling long-horizon agent via context folding. In Proceedings of the 43rd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 306. External Links: Link Cited by: §1, §1, §2.5, §5. Tian et al. (2025) R. Tian, Y. Li, Y. Fu, S. Deng, Q. Luo, C. Qian, S. Wang, X. Cong, Z. Zhang, Y. Wu, Y. Lin, H. Wang, and X. Liu Distance between relevant information pieces causes bias in long-context LLMs. In Findings of the Association for Computational Linguistics: ACL 2025, W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar (Eds.), Vienna, Austria, p. 521–533. External Links: Link, Document, ISBN 979-8-89176-256-5 Cited by: §1. Wang et al. (2025) L. Wang, T. Zhu, L. Qin, L. Gao, and W. Zhou Bias amplification in rag: poisoning knowledge retrieval to steer llms. External Links: 2506.11415, Link Cited by: §A.1. Yang et al. (2025) A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, et al. Qwen3 Technical Report. arXiv preprint arXiv:2505.09388. External Links: 2505.09388, Document, Link Cited by: §1, §3.1. Yao et al. (2023) S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. R. Narasimhan, and Y. Cao ReAct: synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations, External Links: Link Cited by: §1, §1. Ye (2025) Y. Ye Task memory engine (TME): enhancing state awareness for multi-step LLM agent tasks. External Links: 2504.08525, Document, Link Cited by: §1, §2.3, §5. Zhang et al. (2025) Z. Zhang, Q. Dai, X. Bo, C. Ma, R. Li, X. Chen, J. Zhu, Z. Dong, and J. Wen A survey on the memory mechanism of large language model-based agents. ACM Transactions on Information Systems 43 (6), p. 1–47. External Links: Document, Link Cited by: §1. Zhong et al. (2023) W. Zhong, L. Guo, Q. Gao, H. Ye, and Y. Wang MemoryBank: enhancing large language models with long-term memory. External Links: 2305.10250, Link Cited by: §5. Zhou et al. (2026) Y. Zhou, X. Lu, D. Liu, J. Yan, and J. Shao INFA-guard: mitigating malicious propagation via infection-aware safeguarding in llm-based multi-agent systems. External Links: 2601.14667, Link Cited by: §A.1. Appendix A Appendix A.1 Equations for Evaluation Metrics ASR=CsScASR= C_sS_c (8) where CsC_s is the number of compromised critical reasoning steps and ScS_c is the total number of critical reasoning steps. Lower ASR corresponds to greater robustness against memory poisoning 6; 4. PRR=HpHp+HcPRR= H_pH_p+H_c (9) where HpH_p and HcH_c are the numbers of poisoned and clean memories selected by the Prompt Synthesizer for inclusion in the working context. Lower PRR indicates that fewer poisoned memories are selected for prompting 23; 4. IP=PrPiIP= P_rP_i (10) where PiP_i is the number of injected poisoned memories and PrP_r is the number of those memories that remain active or eligible for ordinary context construction after memory management. Lower IP indicates stronger long-term resilience. 14 BR=TcTpBR= T_cT_p (11) where TcT_c is the number of prompt construction steps that include contaminated memory and TpT_p is the total number of prompt construction steps. Lower Blast Radius indicates that poisoned memories influence fewer prompts during task execution. 1; 22 AF=HpPiAF= H_pP_i (12) which measures how frequently injected poisoned memories are repeatedly retrieved relative to the number originally inserted. Lower Amplification Factor indicates that the memory system prevents poisoned memories from repeatedly influencing future reasoning. 26; 22 CCR=1Tp∑i=1TpTsel,iTcand,iCCR= 1T_p _i=1^T_p T_sel,iT_cand,i (13) where Tsel,iT_sel,i is the number of memory tokens selected for inclusion in the prompt and Tcand,iT_cand,i is the total number of candidate memory tokens considered at the i-th prompt construction step. Lower CCR indicates greater context compression and improved prompt efficiency, although it should be interpreted alongside Task Success Rate to ensure excessive compression does not degrade task performance. 17 TSR=1Nt∑i=1NtSi,Si=1,task i is successful,0,otherwise.TSR= 1N_t _i=1^N_tS_i, S_i= cases1,&task i is successful,\\ 0,&otherwise. cases (14) where NtN_t is the total number of evaluated tasks and SiS_i is the binary success indicator for task i. Higher TSR indicates that the agent successfully completes a larger proportion of tasks despite the presence of adversarial memory contamination. 32; 22 A.2 GAIA-Text and GAIA Component Ablations Shared evaluation configuration. The component ablations use the same GAIA questions, base-agent scaffold, tools, task instructions, and interaction budget as the main benchmark comparison in Section 3.1. We evaluate the public GAIA validation set in two forms: GAIA-Text contains the 127 questions without attached input files, whereas GAIA contains all 165 validation questions. We evaluate Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B as frozen reasoning models. Each question initializes a new query-specific memory tree, and no global memory is transferred across benchmark questions. Prompt-token totals include every language-model call made by the corresponding configuration, including base-agent reasoning, semantic memory selection, and branch summarization when those operations are enabled. The fixed outcome scores and branch-priority coefficients used in all experiments are usuccess u_success =0.75,ufailure=0.30, =0.75, u_failure=0.30, (α,β,γ,δ) (α,β,γ,δ) =(0.60, 0.30, 0.20, 0.20). =(0.60,\,0.30,\,0.20,\,0.20). The same retention configuration is used for all three models. Selection-based decay is applied only to memories that enter the candidate pool but are not selected. Selecting a memory resets its missed-selection count to zero. Branch priorities use fixed penalties γ=δ=0.20γ=δ=0.20 for the proportions of failed and obsolete nodes, respectively. An eligible branch is marked obsolete when Ub(t)<τobsU_b^(t)< _obs, with τobs=0.10 _obs=0.10. Component configurations. The main benchmark table compares No Memory, Linear History, Unweighted Tree, and Full WMT. The additional configurations below isolate semantic memory selection and completed-branch summarization: • Tree Memory organizes the interaction history into task, subtask, and action nodes but does not use semantic selection, branch summarization, dynamic retention scoring, or score-based suppression. • Tree + Selection adds the LLM-based semantic selector to Tree Memory. The selector chooses memories according to their relevance to the active task, but no dynamic retention or branch-priority signal is provided. • Tree + Summary folds completed branches into compact summaries but does not use semantic selection or dynamic retention scoring. • Tree + Selection + Summary combines semantic selection with completed-branch summarization but omits event-based score updates, selection-based decay, branch-priority aggregation, and score-based suppression. • Full WMT combines hierarchical memory, semantic selection, branch summarization, event-based retention updates, selection-based decay, branch-level priorities, suppression, and reopening. Tables 2 and 3 report the complete component results. Memory Configuration Qwen3-8B Gemma 4 E4B Llama-3.1-8B Acc. (%) ↑ Tokens (M) ↓ Acc. (%) ↑ Tokens (M) ↓ Acc. (%) ↑ Tokens (M) ↓ Tree Memory 15.75 39.24 25.20 53.90 9.45 77.13 Tree + Selection 22.05 74.37 25.20 92.02 14.96 101.22 Tree + Summary 15.75 34.00 25.98 28.58 19.69 66.83 Tree + Selection + Summary 18.90 47.33 29.13 31.55 17.32 77.05 Full WMT 33.86 32.48 33.07 37.85 17.32 51.17 Table 2: Component-ablation results on GAIA-Text. Accuracy is the percentage of correctly completed tasks, and prompt-token usage is reported in millions. Bold values indicate the best result for each model and metric among the reported tree-based configurations. Memory Configuration Qwen3-8B Gemma 4 E4B Llama-3.1-8B Acc. (%) ↑ Tokens (M) ↓ Acc. (%) ↑ Tokens (M) ↓ Acc. (%) ↑ Tokens (M) ↓ Tree Memory 18.18 58.46 25.45 65.09 11.52 101.91 Tree + Selection 21.21 100.51 26.67 105.57 16.36 134.15 Tree + Summary 15.15 49.83 24.85 36.02 16.97 94.25 Tree + Selection + Summary 15.76 66.84 28.48 42.68 20.00 112.44 Full WMT 29.70 42.69 30.91 46.64 24.85 69.45 Table 3: Component-ablation results on GAIA. Accuracy is the percentage of correctly completed tasks, and prompt-token usage is reported in millions. Bold values indicate the best result for each model and metric among the reported tree-based configurations. Model-specific trends. The component ablations reveal different patterns across model families. Qwen3-8B obtains its strongest partial-configuration accuracy from Tree + Selection on both GAIA-Text and GAIA, suggesting that it benefits from preserving fine-grained evidence and retrieving it selectively. Gemma 4 E4B performs best among the partial configurations with Tree + Selection + Summary, while Tree + Summary produces its lowest prompt-token usage. This pattern suggests that summarization removes redundant execution history for Gemma, while semantic selection remains useful for recovering task-specific evidence. Llama-3.1-8B exhibits a different trend. On GAIA-Text, Tree + Summary reaches 19.69% accuracy, exceeding Full WMT at 17.32%. On GAIA, however, Tree + Selection + Summary is the strongest partial configuration, and Full WMT achieves the best overall Llama result at 24.85%. One plausible explanation is that summary-only contexts sufficiently remove noisy intermediate traces for text-only tasks, whereas the more heterogeneous GAIA tasks benefit from combining compression with targeted, utility-aware retrieval. These explanations are post hoc hypotheses rather than direct measurements of model behavior. A.3 Memory-Poisoning Ablation Details Evaluation corpus. The memory-poisoning evaluation contains 100 long-horizon scenarios composed of 297 subtasks and 1,118 memory entries. Of these entries, 709 are benign and 409 are intentionally poisoned. Poisoned entries introduce misleading observations, fabricated claims, or compromised tool-derived information into the execution history so that they may influence later retrieval and reasoning. The same scenario structures and injected memories are used for each memory configuration. The evaluation therefore isolates how memory organization, retention scoring, lifecycle management, and semantic retrieval affect the persistence and propagation of poisoned information. Ablation configurations. We compare five memory configurations: • Linear Memory stores all task and action history in a single sequential context. No hierarchy, utility scoring, suppression, or selective retrieval is used. • Unweighted Tree (A1) organizes memories into task and action branches but does not use retention scoring or branch prioritization. • No Memory Controller (A2) computes retention scores and branch priorities but disables lifecycle operations, including folding, score-based suppression, and reopening. • No Semantic Retrieval (A3) retains the hierarchical tree, retention scores, and Memory Controller, but prompt construction includes the full selected branch rather than semantically selecting individual memories. • Full WMT uses hierarchical memory, dynamic retention scoring, branch-level priorities, lifecycle control, and semantic prompt construction. Attack Success Rate, Poison Retrieval Rate, Infection Persistence, Blast Radius, Amplification Factor, Context Compression Ratio, and Task Success Rate are defined in Appendix A.1. We additionally report average prompt-token usage and latency. The complete results are reported in Table 4. Metric Linear Memory Unweighted Tree (A1) No Memory Controller (A2) No Semantic Retrieval (A3) Full WMT Attack Success Rate ↓ 0.995 0.631 0.601 0.680 0.419 Poison Retrieval Rate ↓ 0.246 0.125 0.158 0.139 0.097 Infection Persistence ↓ 1.000 0.009 1.000 0.009 0.009 Blast Radius ↓ 0.906 0.388 0.509 0.669 0.315 Amplification Factor ↓ 6.103 1.280 1.638 1.977 0.965 Task Success Rate ↑ 0.183 0.431 0.451 0.393 0.575 Context Compression Ratio ↓ 1.000 0.815 0.634 1.000 0.819 Average Prompt Tokens ↓ 362.143 133.733 146.721 189.770 131.963 Latency (ms) ↓ 0.022 0.081 0.108 0.020 0.080 Table 4: Memory-poisoning results for WMT and its ablations. Arrows indicate the preferred direction. Bold values indicate the best result for each metric; ties are bolded jointly. Linear Memory retains the full sequential history, A1 removes weighting, A2 removes lifecycle control, and A3 removes semantic memory selection. A.4 Worked Example of Memory-Poisoning Dynamics Figure 2 illustrates how WMT processes ordinary and poisoned memories within a single execution tree. Blue nodes represent the query and task hierarchy, gray nodes represent ordinary action memories, and red nodes represent intentionally poisoned memories. The example contains two task branches: identifying a candidate paper and extracting its authors. Its purpose is to illustrate memory-state updates rather than establish a canonical ranking of papers published in 2017. Task initialization and event scores. WMT first creates a root node for the user query and an active child task for identifying the paper. Each action performed under this task is inserted as a child memory together with its observation and recorded outcome. As defined in Eq. 2, the outcome assigns the action memory an intermediate retention score before any selection feedback is applied. The reported configuration uses (usuccess,ufailure)=(0.75,0.30).(u_success,u_failure)=(0.75,0.30). Thus, a successful action receives u~i=0.75 u_i=0.75, whereas a failed action receives u~i=0.30 u_i=0.30. The tilde denotes the event-assigned intermediate score. Selection-based decay may subsequently reduce this value, producing the final retention score uiu_i. Selection-based decay in the example. All action memories in Figure 2 are non-global memories. Let ui[r]u_i^[r] denote the score of memory viv_i after r consecutive missed selections, with ui[0]=u~iu_i^[0]= u_i. From Eqs. 4 and 5, the rrth missed selection produces ui[r]=clip[0,1](ui[r−1]ρminr,M).u_i^[r]=clip_[0,1] (u_i^[r-1]ρ \r,M\ ). Consequently, after r consecutive missed selections, ui[r]=clip[0,1](u~iρhM(r)),u_i^[r]=clip_[0,1] ( u_iρ^h_M(r) ), where hM(r) h_M(r) =∑k=1rmink,M = _k=1^r \k,M\ (15) =r(r+1)2,r≤M,Mr−M(M−1)2,r>M. = cases r(r+1)2,&r≤ M,\\[5.0pt] Mr- M(M-1)2,&r>M. cases This cumulative expression assumes that no intervening selection or new event-based update occurs. Selecting the memory resets its missed-selection count to zero, while a memory that does not enter the candidate pool is not decayed. First branch: identifying the paper. The first action searches broad encyclopedia pages. Although the returned information does not provide a defensible ranking, the action is recorded as operationally successful and therefore receives u~encyclopedia=0.75. u_encyclopedia=0.75. The second action searches citation summaries and produces evidence supporting Attention Is All You Need. It is likewise recorded as successful: u~citation=0.75. u_citation=0.75. The first poisoned memory is introduced by an action that consults an unofficial ranking blog. The observation contains an unsupported claim and the action is explicitly recorded as a failure. Its event-assigned score is u~blog=0.30. u_blog=0.30. WMT preserves this failed action as a warning, but the lower score reduces its priority as supporting evidence. The following action retrieves the official arXiv record and is recorded as successful: u~arXiv=0.75. u_arXiv=0.75. Suppose the official arXiv record is selected during subsequent prompt construction. Its missed-selection count is then reset to zero. If the poisoned blog memory remains eligible but is not selected for r consecutive opportunities, its score becomes ublog[r]=clip[0,1](0.30ρhM(r)).u_blog^[r]=clip_[0,1] (0.30\,ρ^h_M(r) ). The poisoned record therefore remains in persistent memory, but its ability to influence later prompts decreases with repeated missed selections. If it does not enter the candidate pool, its score remains unchanged. Once the paper-identification task is completed, the Memory Controller folds the branch into a compact summary. The summary can preserve the supported paper identity, the official source, and the warning about the failed blog lookup without replaying the complete branch in subsequent prompts. Second branch: extracting the authors. After the paper-identification branch is completed, WMT activates the task for extracting the paper’s authors. The first action opens the arXiv abstract page. It verifies the title and identifier but does not recover the complete author list. Because the action is operationally successful, it receives u~abstract=0.75. u_abstract=0.75. The second poisoned memory is more difficult. An unofficial mirror page returns a fabricated single-author claim, but the corresponding action is recorded as successful. Event-based scoring therefore assigns u~mirror=0.75, u_mirror=0.75, the same intermediate score assigned to a clean successful action. This case demonstrates that the event outcome represents operational success rather than factual correctness. A plausible but incorrect observation may therefore receive a high initial score when the action itself appears successful. The final action retrieves the official PDF and extracts the complete author list. This action is recorded as successful and receives u~PDF=0.75. u_PDF=0.75. Once the official result becomes available, the Prompt Synthesizer can select it in preference to the mirror-page observation. If the mirror memory remains eligible but is unselected for r consecutive opportunities, its score becomes umirror[r]=clip[0,1](0.75ρhM(r)).u_mirror^[r]=clip_[0,1] (0.75\,ρ^h_M(r) ). Unlike the failed blog lookup, the mirror memory does not receive an immediate low event score. Its influence must instead be reduced through semantic selection, repeated missed-selection decay, or an explicit supersession rule. If the official PDF result supersedes the mirror claim, the controller may mark the poisoned memory obsolete. The memory remains stored for provenance but is excluded from ordinary context construction. Branch-priority updates. After the node scores are updated, WMT recomputes each task branch’s priority using Eq. 6. In the first branch, the failed blog action increases the failed-action proportion FbF_b, thereby lowering the branch priority. If a poisoned memory is subsequently marked obsolete, it also contributes to the obsolete-node proportion ObO_b. The second branch initially contains no explicitly failed poisoned action because the mirror lookup is recorded as successful. Consequently, the failure-ratio penalty alone cannot distinguish the poisoned mirror memory from a clean successful action. Its influence is instead controlled through semantic selection, selection-based decay, and supersession by the official PDF result. This illustrates the complementary roles of event-based score assignment and selection-based feedback. If the recomputed priority of an eligible branch satisfies Ub(t)<τobs=0.10,U_b^(t)< _obs=0.10, the Memory Controller applies Eq. 7 and marks the branch’s root task node obsolete. The branch and its descendants are then excluded from ordinary context construction without being deleted. A single low-score memory does not necessarily suppress an otherwise useful branch because Ub(t)U_b^(t) also incorporates the maximum node score and the mean utility of the branch. Final context construction. For the final reasoning step, the Prompt Synthesizer retains the active task path and can include the folded paper-identification summary, the official arXiv record, and the author list extracted from the official PDF. A compact failure warning may also be included when it prevents the agent from revisiting an untrusted source. The poisoned blog and mirror memories remain in persistent storage but need not enter the working context. The resulting prompt therefore contains the supported paper identity and author information rather than the complete execution history. The example demonstrates two distinct cases: an explicitly failed poisoned memory begins with the lower event score ufailureu_failure, whereas a plausible poisoned memory recorded as successful begins with usuccessu_success and must be controlled through selection feedback, supersession, and lifecycle management. A.5 Inference Runtime and GPU Compute Usage All experiments were inference-only and were executed on a server equipped with eight NVIDIA Quadro RTX 6000 GPUs, each with 24 GB of device memory, for 192 GB of aggregate installed GPU memory. Qwen3-8B, Gemma 4 E4B, and Llama-3.1-8B were used as frozen reasoning models; no parameter training or fine-tuning was performed. Independent benchmark jobs were scheduled across the available GPUs. The complete benchmark grid contains seven unique memory configurations, three base models, and two evaluation sets, yielding 42 model–dataset–configuration settings. GAIA-Text contains 127 questions, whereas GAIA contains 165 questions. Because each setting was evaluated independently on its corresponding question set, the benchmark grid comprises R=7×3×(127+165)=6,132R=7× 3×(127+165)=6,132 question-level agent executions. Each execution initializes a new query-specific memory tree. This count covers the GAIA-Text and GAIA benchmark and component-ablation runs; the separate memory-poisoning evaluation is not included. The retained benchmark artifacts provide prompt-token totals but do not contain a consistent per-execution wall-clock ledger, device-utilization traces, or power measurements. We therefore do not report average runtime, total wall-clock time, GPU-hours, floating-point operations, or energy consumption. Prompt-token volume is instead used as the reproducible measure of inference workload. After deduplicating configurations that appear in both the main and component tables, the seven unique configurations processed approximately 1.028 billion prompt tokens on GAIA-Text and 1.363 billion on GAIA, for 2.391 billion prompt tokens across the complete benchmark grid. Full WMT accounts for 121.50 million prompt tokens on GAIA-Text and 158.78 million on GAIA, or 280.28 million in total. These totals include all language-model calls required by each configuration, including base-agent reasoning, semantic memory selection, and branch summarization when enabled. Because the three model families use different tokenizers, the combined token count represents aggregate inference workload rather than a tokenizer-normalized comparison across models. The reported 192 GB denotes aggregate installed memory across the eight GPUs and should not be interpreted as the memory consumed by an individual run. Peak allocated GPU memory was not recorded.