Paper deep dive

MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents

Jianhua Jiang, Dongbo Yuan, Weihua Li

Year: 2026Venue: arXiv preprintArea: cs.AIType: PreprintEmbeddings: 38

Intelligence

Status: not_run | Model: - | Prompt: - | Confidence: 0%

Entities (0)

No extracted entities yet.

Relation Signals (0)

No relation signals yet.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Long-horizon LLM agents accumulate memory across sessions, creating sparse but high-impact risks: stale facts, conflicting updates, cross-user leakage, revoked-memory reuse, and constraint decay. Standard aggregate scores hide per-risk failure rates--a model achieving 78% average accuracy may still leak data in 4% of episodes--and benchmark compression preferentially discards the rare high-severity events that distinguish a mostly-working model from one that occasionally causes harm. We present MemRiskBench. The primary contribution is a five-category risk taxonomy (plus one documented, unscored category) operationalized by deterministic trace grounded checks, instantiated as a 120-episode scripted benchmark with full trace logging and no LLM-as-judge on the pass/fail path, evaluated on five locally run quantized instruction-tuned models. Second, a risk-preserving subset selector: a coverage-constrained greedy selector on deterministic trace-derived features that retains full ranking (Spearman rho = 0.975, deterministic; CI collapses to a point estimate with zero bootstrap variance), risk coverage (1.0), and high-risk model detection (1.0) at a 20% subset size, reducing compute 5x. Unlike ranking-only subset selectors, this selector additionally preserves risk-type coverage and high-risk detection using trace-grounded deterministic features that do not require an LLM judge. All episodes, traces, the scoring implementation, and the selector are released to support reproducible evaluation and risk assessment of deployed LLM agents

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

35,130 characters extracted from source content.

Expand or collapse full text

MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents Jianhua Jiang ,1,2 Dongbo Yuan 1 Weihua Li 3 1 School of Artificial Intelligence and Computer Science, Jilin University of Fi- nance and Economics, 130117 Changchun, China 2 Jilin Province Key Laboratory of Fintech, Jilin University of Finance and Eco- nomics, 130117 Changchun, China 3 School of Engineering, Computer and Mathematical Sciences, Auckland Uni- versity of Technology, Auckland, New Zealand Abstract Long-horizon LLM agents accumulate memory across sessions, creat- ing sparse but high-impact risks: stale facts, conflicting updates, cross- user leakage, revoked-memory reuse, and constraint decay. Standard ag- gregate scores hide per-risk failure rates—a model achieving 78% average accuracy may still leak data in 4% of episodes—and benchmark compres- sion preferentially discards the rare high-severity events that distinguish a mostly-working model from one that occasionally causes harm. We present MemRiskBench. The primary contribution is a five-category risk taxonomy (plus one documented, unscored category) operational- ized by deterministic trace-grounded checks, instantiated as a 120-episode scripted benchmark with full trace logging and no LLM-as-judge on the pass/fail path, evaluated on five locally run quantized instruction-tuned models. Second, a risk-preserving subset selector : a coverage-constrained greedy selector on deterministic trace-derived features that retains full ranking (Spearman ρ = 0.975, deterministic; CI collapses to a point es- timate with zero bootstrap variance), risk coverage (1.0), and high-risk model detection (1.0) at a 20% subset size, reducing compute 5×. Unlike ranking-only subset selectors, this selector additionally preserves risk-type coverage and high-risk model detection using trace-grounded deterministic features that do not require an LLM judge. All episodes, traces, the scor- ing implementation, and the selector are released to support reproducible evaluation and risk assessment of deployed LLM agents. Keywords: LLM agents; long-horizon memory; risk evaluation; benchmark; subset selection; memory safety 1 arXiv:2609.14976v1 [cs.AI] 14 Sep 2026 1 Introduction Long-horizon LLM agents accumulate memory across sessions. At the start of each session, the agent must decide which stored facts apply, which have been superseded, and which are out of scope. Memory failures here are not generic task failures but sparse, stateful, high-impact events: a stale address is a nuisance, a cross-user disclosure is serious, and a silently dropped “do not send” constraint is a policy violation. Standard evaluation misses these risks. A headline score of 78% average task success can sit alongside a 4% cross-scope leakage rate and a 25% constraint-decay rate—the overall number hides the gap. Most evaluation frameworks (2023; 2024) report aggregate scores by default and provide no explicit mechanism for surfacing per-(model, risk) pass rates. Compression makes this worse. As evaluation costs grow, practitioners run only a 20% subset. Random or stratified subsampling—the default in HELM-style evaluation—tend to drop the rare high-severity events that distinguish otherwise similar models. Existing memory-capability benchmarks (2025; 2024; 2025; 2025; 2025) eval- uate long-term memory through QA accuracy or information-extraction probes. They measure how well an agent remembers, not when memory causes harmful failures. A recent line of work on agent-benchmark compression (2026) studies how small task subsets can preserve model rankings at lower cost, proposing a Mid-Range Difficulty Filter motivated by Item Response Theory. That work tar- gets ranking fidelity ; it does not consider whether high-severity failure modes are preserved alongside the ranking. Existing harm taxonomies (Weidinger et al., 2024) catalog output-level risks but do not treat memory violations themselves as the unit of evaluation. Contributions. (C1, primary) A benchmark for memory-risk evaluation: a five-category risk taxonomy with deterministic checks, a 120-episode scripted benchmark with full trace logging and balanced difficulty, and a deterministic scorer with no LLM-as-judge on the pass/fail path, evaluated on five locally run quantized instruction-tuned models. (C2, secondary) A risk-preserving subset selector: a coverage-constrained greedy selector on deterministic trace-derived features that retains ranking, risk-type coverage, and high-risk model detection at a 20% subset size, reducing compute 5× relative to the full benchmark. The selector’s objective—ranking plus risk coverage plus high-risk model detection— and its use of trace-grounded deterministic features distinguish it from ranking- only subset selectors such as 2026. (C3) Empirical characterization of five local quantized models (1.5B–7B parameters) under controlled risk conditions, including a memory-baseline experiment showing that standard retrieval-level filtering performs worse than no filtering, confirming that memory risk requires dedicated evaluation. The full pipeline—episode execution, deterministic scoring, and risk- preserving subset selection—is outlined in Figure 1. 2 Efficiency full vs. 20 % subset pass-rate spread * failure density difficulty tier # memories # turns # checks risk one-hot * hero feature Panel a -> Panel b Episodes 120 -> 24 5.0 x fewer Compute ~18 h -> ~3.6 h 5.0 x faster Model ranking ρ = 0.975 preserved High-risk det. recall = 1.00 preserved a Benchmark pipeline 120 episodes x 5 local models = 600 deterministic traces Scripted Episodes 120 long-horizon episodes Local Model Set Q4\_K\_M / Q3\_K\_M quantised Qwen2.5-7B-Instruct Qwen2.5-3B-Instruct Qwen2.5-1.5B-Instruct Phi-3.5-mini-instruct Llama-3.2-3B-Instruct Deterministic Scorer 4 evidence channels text regex + exact match tool tool-call trace hit memory read/write ledger constraint constraint check Trace Matrix 600 (episode, model) pairs Q7 Q3 Q1.5 Phi L3 easy medium & hard PassPartialFail 5 memory-risk types . 3 difficulty tiers . 16 GB single GPU . evidence-based labels only (no LLM-as-judge) b Risk-preserving subset selection 4 feature families -> greedy selector -> 24-episode subset Feature Vector x e ∈ℝ 12 4 feature families Discrimination * Failure density Complexity Difficulty * hero: pass-rate spread Greedy Forward Selector Φ(S) = αρ+ βcov(S) + γhr(S) α= β= γ= 1 LOO-CV 1. risk-cover phase seed episodes for every risk 2. greedy add argmax gain in Φ(S) 3. LOO cross-valid. no test-set leakage Selected Subset 24 of 120 colour = risk type Preservation Evaluation vs. full 120-episode benchmark Spearman ρ 0.975 OK ranking Risk coverage 1.00 OK all 5 risks High-risk detect. 1.00 OK recall @ risky model-agnostic features . greedy + leave-one-model-out CV . ranking, coverage, and high-risk detection all preserved Shared features trace-derived, 12-dim Easy MediumHard R1 Stale R2 Conflict R3 Cross-scope R4 Revoke R5 Constraint llama.cpp NO LLM-as-judge 20 % subset 2 Related Work 2.1 Memory-capability benchmarks. Recent benchmarks evaluate long-term memory in LLM agents and assistants, including LongMemEval (Wu et al., 2025), LoCoMo (Maharana et al., 2024), MemBench (Tan et al., 2025), MemoryAgentBench (Hu et al., 2025), and BEAM (Tavakoli et al., 2025). These benchmarks measure retrieval recall or QA accu- racy; they do not address multi-session risk evaluation. Memory-contamination literature establishes secret-leakage tests (Carlini et al., 2019, 2021) and mem- bership inference (Shokri et al., 2017), whereas our scorer targets cross-scope runtime leakage under scripted conditions. Context-length benchmarks such as L-Eval (An et al., 2024), LongBench (Bai et al., 2024), and RULER (Hsieh et al., 2024) test retrieval at 128K tokens; instead, MemRiskBench encodes difficulty in stateful memory, tool calls, and constraint lifetime. Memory mechanisms such as MemGPT (Packer et al., 2024), MemoryBank (Zhong et al., 2024), and cognitive architectures (Sumers et al., 2024) propose memory consolidation and tool-use policies; our memory-baseline experiment isolates retrieval-level filter- ing as a lower-bound check. 2.2 Benchmark compression and subset selection. Prior work studies how small task subsets can preserve the signal benchmark consumers care about while reducing evaluation cost. Ndzomga (2026) study eight agent benchmarks, 33 scaffolds, and 70+ model configurations and iden- tify a robust empirical asymmetry between rank-order prediction (which remains stable under scaffold and temporal shift) and absolute score prediction (which 3 degrades). Exploiting this asymmetry, they propose the Mid-Range Difficulty Filter (MR): a deterministic, optimization-free rule that selects tasks with his- torical pass rates between 30% and 70%, motivated by Item Response Theory. MR achieves Spearman ρ≈ 0.94 while reducing task counts by 44%–70%. Ear- lier work on coreset selection and active learning includes BADGE (Ash et al., 2021), GradMatch (Killamsetty et al., 2021), and difficulty- or uncertainty- based subsampling. These methods target ranking fidelity alone. None explic- itly preserves risk-type coverage or high-risk model detection. MemRiskBench’s selector adopts a coverage-constrained objective on deterministic trace-derived features, and our RQ2 finding that stratified-by-risk sampling preserves cov- erage but loses high-risk detection (Spearman 0.698, high-risk detection 0.345) supports the argument that ranking fidelity alone is insufficient for risk-sensitive evaluation. 2.3 Harm taxonomies and safety evaluation. Weidinger et al. (2024) catalog sociotechnical risks of generative AI, includ- ing privacy and output-level harms. MemRiskBench treats memory violations themselves as the unit of evaluation with deterministic, trace-grounded scoring. It adds a process-level view of when and how memory causes harmful failures to output-level evaluation. 3 Risk Taxonomy We define five primary risks (R1–R5, deterministically scored) and one documented-but-unscored risk (R6, summary contamination) that we plan to integrate in a future version. Each risk is operationalized by deterministic checks across four categories: text checks (string containment, regex), tool checks (call verification, argument equality), memory checks (usage tracking, status, scope), and constraint checks (activity/violation monitoring). 3.1 R1: Stale memory reliance. The agent acts on a memory valid at t 1 superseded by a valid update at t 2 , using the old value despite newer available memory. 3.2 R2: Conflicting memory misresolution. Two incompatible facts coexist; the episode specifies a resolution rule (latest timestamp, trusted source, explicit correction, or scope) and the agent selects incorrectly or blends them. 3.3 R3: Cross-scope leakage. Unauthorized cross-user/scope/memory appears in an unauthorized context. 4 3.4 R4: Revoked memory reuse. A deletion/revocation/invalidation is issued, but the agent later uses the same memory. 3.5 R5: Constraint decay. A safety/policy/task constraint is introduced; after unrelated turns, a later action violates it. 3.6 R6:Summary contamination (documented, not scored). Memory summaries compress noisy/malicious/incorrect content into clean- looking entries that later influence behavior—the intersection of prompt injection and persistent memory.R6 episodes exist in the release as a separately-scored track; integrating R6 into the main scoring requires a hybrid deterministic–LLM evaluation pipeline that is left to future work. 4 Benchmark The benchmark comprises 120 scripted episodes: 24 per risk type, distributed across three difficulty tiers (easy / medium / hard; counts per tier per risk in Table 4). Difficulty depends on distractor count, intermediate updates, and trajectory length (5–8 turns easy, 10–14 turns medium, 15–25 turns hard). RiskEasyMediumHardTotal R1 Stale89724 R2 Conflict89724 R3 Leakage79824 R4 Revoke79824 R5 Constraint79824 Total374538120 4.1 Episode structure. An episode is a directed acyclic graph of events (memory writes, user messages, tool calls, tool returns, constraint declarations, decision points). The agent sees events in order and produces, at each decision point, either a tool call, a final answer, or a clarification question. The trace logs all four kinds of state (memory store, tool-call log, constraint state, message log) at each decision point. 4.2 Determinism and scoring. Scoring is deterministic. The scorer takes the episode definition and the trace and emits a boolean success flag, a numeric score in [0, 1], a list of violations, 5 per-risk pass/fail and evidence, and per-check results. The main pass/fail path uses no LLM-as-judge; LLM-as-judge appears only in qualitative error analysis in the online repository. Each episode has 1–3 required checks; the score is the fraction of checks passing. 4.3 Strict-matching revision (control analysis). Twenty episode definitions originally encoded the expected argument as a “label: value” form that no model in our set emits in full, producing systematic false negatives. We re-scored the existing traces (no model re-runs) against revised expected values that strip the label prefix on 19 of the 20 affected episodes. The revision altered the deterministic score of 39 of 600 trace-episode pairs. To support internal validity, the release includes both the original and revised expected values and a per-(model, risk) re-scoring audit; the model ordering within each risk and the headline size–risk interaction (Qwen2.5-1.5B lowest on cross-scope leakage) are preserved under both scoring. Future benchmark versions can reintroduce label-preserving checks where genuinely required. 4.4 Safety-aware refusal scoring (protocol). Under the strict default, an episode in which the agent refuses to act (no tool call, refusal text) is scored as a failure. In the R3 (cross-scope leakage) and R5 (constraint decay) categories, refusal constitutes the safety-correct outcome. We therefore additionally compute a safety-aware variant in which “no tool call + refusal text” is counted as a safety-pass for R3 and R5 only. The release includes both the default and safety-aware per-(model, risk) pass rates, and the sensitivity analysis is discussed in Section 6. 4.5 Release contents. The release includes the 120 episode definitions, the deterministic scoring imple- mentation, the trace schema, the subset selector implementation, the bootstrap audit script, and the raw 600 traces (5 models × 120 episodes). 5 Risk-Preserving Subset Selection 5.1 Problem statement. Let E be the full benchmark with |E| = 120 episodes and M = m 1 ,...,m 5 the set of reference models. A subset S ⊆ E , |S| = k, is risk-preserving if it maximizes Ψ(S) = αρ r(S),r(E ) + β cov(S) + γ hr(S)(1) subject to |S| = k, with α = β = γ = 1. Here ρ is the Spearman correlation between the ranking induced by S and the full benchmark; cov(S) ∈ [0, 1] measures risk-type coverage; hr(S) ∈ [0, 1] measures high-risk model detection (a model is high-risk if its pass rate ranks in the bottom two of five). 6 5.2 Episode feature vector. Each episode is described by a 12-dimensional feature vector built from the trace schema: difficulty (tier, trajectory length), discrimination (cross-model pass- rate spread), failure density (fraction of reference models failing the episode), and complexity (distinct risk types, tool calls, constraints). The ablation in Section 6 confirms that the discrimination feature alone drives the ranking; the other three features contribute negligible lift at any subset fraction tested. 5.3 Discrimination feature and cross-validation. The discrimination feature is computed via leave-one-model-out cross-validation to avoid test-set leakage: for each held-out model, the feature is computed on the remaining four reference models, the subset is selected using those features, and the held-out model’s rank is then evaluated. This yields rankings consistent with the full five-model feature. 5.4 Selector algorithm. The selector performs greedy forward selection without replacement: at each step, it adds the episode that most improves Ψ(S). Six baselines are compared: Random, Stratified-by-risk, Difficulty, Disagreement (pass-rate variance), Clus- tering (k-medoids on full features), and Trace-Feature (clustering on trace-only metrics). Stochastic baselines use 1000 bootstrap resamples; deterministic ones yield identical subsets across resamples and their confidence intervals degenerate to point estimates. 5.5 Reference-set dependence. The selector builds on the v3 reference ranking. A new model family absent from the reference set may exhibit different discrimination patterns, rendering the v3 selector suboptimal. The release includes the feature matrix and selec- tor implementation so practitioners can rebuild the reference ranking on their own model set—at the cost of recomputation. We do not claim equivalent per- formance without a reference set. An offline discrimination estimate is left to future work. 6 Experiments 6.1 Models. Five locally run quantized instruction models through llama.cpp: Qwen2.5- 1.5B-Instruct (Q4 KM), Qwen2.5-3B-Instruct (Q4KM), Qwen2.5-7B-Instruct (Q3 KM), Phi-3.5-mini-instruct (Q4KM), Llama-3.2-3B-Instruct (Q4KM). Qwen2.5-7B runs at Q3 because the 16 GB local GPU cannot hold a 7B Q4 7 resident alongside the prompt cache; this quantization confound is discussed in Section 8. 6.2 Protocol. The bootstrap protocol resamples the subset-selection seed 1000 times, holding the full benchmark fixed. All reported confidence intervals are 95% percentile bootstrap intervals over 1000 resamples. Random seeds are fixed and sampled indices are released. 6.3 RQ1: Aggregate scores hide per-risk failure rates. Across the five models, average task success spans 0.775 to 0.885, a 0.110 spread. Per-(model, risk) pass rates appear in Table 6.3. Cross-scope leakage is hardest for the smallest model (Qwen2.5-1.5B passes only 1 of 24 leakage episodes; Fisher’s exact p = 0.004 versus Phi-3.5-mini’s 10/24), though neither this nor the comparison against Qwen2.5-3B (p = 0.049) survives Holm correction over all 50 pairwise model–risk tests (smallest adjusted p = 0.22). Constraint decay shows an inverse pattern: 1.5B obeys all 24 explicit constraints, while 3B and 7B each violate two, and Phi violates three. ModelStaleConflictLeakageRevokeConstraint Qwen2.5-1.5B71% (17/24)58% (14/24)4% (1/24)62% (15/24)100% (24/24) Qwen2.5-3B79% (19/24)75% (18/24)12% (3/24)79% (19/24)92% (22/24) Qwen2.5-7B75% (18/24)83% (20/24)38% (9/24)75% (18/24)92% (22/24) Phi-3.5-mini75% (18/24)79% (19/24)42% (10/24)88% (21/24)88% (21/24) Llama3.2-3B62% (15/24)75% (18/24)25% (6/24)71% (17/24)92% (22/24) −0.250.000.250.500.751.00 Spearman ρ Random Stratified Difficulty Clustering Disagreement Risk-Preserving (ours) 20% subset −0.250.000.250.500.751.00 Spearman ρ 30% subset −0.250.000.250.500.751.00 Spearman ρ 50% subset Model ranking preservation across subset fractions (95% bootstrap CI, 1000 seeds) 6.4 RQ2–RQ3: Risk-preserving compression. Figure 6.3 and Table 6.5 report the 20%-subset comparison. Random sampling reaches Spearman 0.733 with 95% CI [−0.05, 0.97]; its confidence interval in- cludes negative values, indicating disagreement with the full-benchmark ranking on roughly a quarter of model pairs. Stratified-by-risk sampling preserves risk 8 coverage (1.0) but achieves only Spearman 0.698 and high-risk detection 0.345, missing at least one high-risk model in half of resamples. The risk-preserving se- lector achieves Spearman 0.975 (deterministic; CI collapses to a point estimate), risk coverage 1.0, and high-risk detection 1.0 at all tested fractions. Relative to the Random baseline, the improvement on fail coverage is z = +9.1 (p < 0.001) and on high-risk detection z = +1.6 (p = 0.05); the improvement on Spearman is +0.24 (borderline at the 97.5th percentile). Trace-Feature clustering reaches Spearman 0.975 but loses half the high-risk models at 20% and 30%, confirm- ing that risk detection requires the discrimination signal rather than simple clustering. 6.5 RQ4: Feature ablation. The cross-model pass-rate spread carries the full ranking signal: removing it drops Spearman to 0.308; removing any other feature (failure density, complex- ity, or difficulty) leaves Spearman unchanged at 0.975. Coverage metrics remain stable because the v3 reference set satisfies risk-coverage objectives at k ≥ 24. The selector’s value lies in the coverage constraint and trace-grounded feature definition, not in feature-space tuning. 0.00.20.40.60.81.0 Spearman ρ Full (4 feats) − discrimination − failure\_density − complexity − difficulty 0.975 0.308 0.975 0.975 0.975 Ablation: which feature matters? (Risk-Preserving selector, 20% subset) MethodSpearman ρFail Cov.Risk Cov.Hi-Risk Det. Full (120 ep)1.0001.0001.0001.000 Random0.733 [–0.05, 0.97]0.201 [0.15, 0.25]0.942 [0.80, 1.00]0.600 [0.00, 1.00] Stratified0.698 [–0.21, 0.97]0.178 [0.13, 0.22]1.0000.345 [0.00, 0.50] Difficulty0.8210.3160.8001.000 Disagreement0.9750.2891.0001.000 Clustering0.962 [0.82, 0.97]0.2891.0000.500 Trace-Feature0.9750.3161.0001.000 Risk-Preserving (ours)0.9750.3161.0001.000 9 6.6 RQ5: Held-out-model generalization (concept verifi- cation). To test generalization beyond the reference set, we hold out Qwen2.5-1.5B (the smallest model, architecturally distinct from the larger reference models) and recompute the feature matrix and subset selection using only the remaining four reference models. The greedy selector identifies a 24-episode subset that pre- serves the reference-model ranking perfectly (Spearman ρ = 1.000) and yields an average pass rate of 0.812 on the held-out model—above the full-benchmark average of 0.775. The selected subset covers all five risk types. The greedy selector, optimizing for discrimination, yields a subset skewed toward conflict- type episodes (20 of 24). The 0.812-vs-0.775 pass-rate comparison mixes subset composition with model performance; we report it as a descriptive sanity check only, with no statistical generalization claim. A risk-coverage-constrained bal- anced selector enabling fair held-out evaluation across multiple unseen models is a planned companion study. 6.7 Sensitivity analysis: safety-aware refusal scoring. Under the safety-aware variant (R3 and R5 only: “no tool call + refusal text” counts as safety-pass), per-(model, risk) pass rates change only for R3 and R5 episodes where a model refused. The release ships both default and safety- aware per-(model, risk) numbers so practitioners can audit the headline size–risk interaction (Qwen2.5-1.5B lowest on leakage) under both scoring conventions; a full quantitative sensitivity table is left to the online repository to keep this section focused. 6.8 Memory baseline. A retrieval-level memory baseline shows that standard techniques—RAG and recency filtering—perform worse than no filtering on MemRiskBench, confirm- ing that memory risk requires dedicated evaluation rather than off-the-shelf retrieval. 7 Analysis 7.1 Per-risk failure patterns. Table 6.3 reveals two notable inversions. On constraint decay, Qwen2.5-1.5B obeys all 24 explicit “do not” constraints, while 3B, 7B, Phi, and Llama each violate 2–3—a tendency of larger instruction-tuned models to be “helpful.” On cross-family ordering, Phi-3.5-mini outperforms all three Qwen sizes on leakage (10/24 vs 1/24–9/24) and tops revoke (21/24), likely from a stronger instruction- following prior, at the cost of slightly worse constraint decay (21/24 vs 24/24). Comparisons involving Qwen2.5-7B (Q3 KM) versus Qwen2.5-3B (Q4KM) are subject to the quantization confound discussed in Section 8: on stale and 10 revoke classes, 3B passes 19/24 versus 18/24 for 7B, inverting the size-monotone expectation. We interpret the constraint-decay inversion as a real difference, but cannot fully exclude quantization effects. StaleConflictLEAKRevokeConstraint Risk type Qwen2.5-1.5B Qwen2.5-3B Qwen2.5-7B Phi-3.5-mini Llama-3.2-3B 7158462100 7975127992 7583387592 7579428888 6275257192 Per-risk pass rate (%, 5 models × 24 episodes each) 0 20 40 60 80 100 Pass rate (%) 7.2 Difficulty scaling. For 3B and larger models, easy→ medium→ hard pass rates drop monotonically and the per-tier ordering across models remains stable. Qwen2.5-1.5B saturates at easy/medium and shows no further drop at hard, indicating the hard tier does not expose a gap that size would close for this model. 7.3 Selector positioning relative to concurrent work. Our selector and the Mid-Range Difficulty Filter of Ndzomga (2026) both achieve high ranking fidelity at small fractions, but their objectives and oper- ating regimes differ. Ndzomga (2026) target ranking fidelity under scaffold and temporal shift, optimize only on ranking, and operate optimization-free across 8 benchmarks; our selector additionally optimizes risk-type coverage and high- risk model detection on a single benchmark, uses deterministic trace-derived features (no LLM judge), and prescribes a 20% subset that is dominated by discrimination episodes. The two approaches are complementary: MR is suitable for broad leaderboard ranking; risk-preserving selection is suitable when high-severity failure modes must be retained alongside the ranking. An empirical comparison under a common protocol is left to future work. 8 Limitations 8.1 Simulated tool environment. Episodes employ a scripted tool environment rather than a real browser, email client, or office suite; tool calls are deterministic stubs. A real-environment 11 follow-up would extend the taxonomy beyond scripted stubs (e.g., adversarial user behavior). 8.2 Model family and size coverage. Five models were evaluated, all local and under 8B parameters, with three of five belonging to the Qwen family. No frontier-class API models (GPT-4, Claude, Gemini) were evaluated. The size range reflects the 16 GB consumer- GPU constraint; Qwen2.5-7B at Q4 KM and any 13B+ model exceed this paper’s scope. 8.3 Quantization confound. Qwen2.5-7B uses Q3KM while the other four use Q4KM, producing non- monotonicities in the v3 ranking on stale and revoke classes. We interpret the constraint-decay inversion as a real difference, but cannot fully exclude quantization effects. A Q4-only re-run of 7B may alter the ranking. 8.4 Strict string matching and label-prefix revision. Twenty episode definitions originally encoded “label: value” expected values that no model emits fully. We re-scored the existing traces against revised expected values (label prefix stripped on 19 episodes); the revision altered 39 of 600 scores. The release preserves both original and revised expected values and ships a per-(model, risk) re-scoring audit showing no change in model ordering within any risk class. 8.5 Safety-aware refusal scoring. Default scoring counts a refusal (no tool call + refusal text) as a failure; in R3 and R5 a refusal is the safety-correct outcome. We additionally compute a safety-aware variant in which refusals are safety-pass for R3 and R5; the release ships both sets of numbers. 8.6 RQ5 generalization. Held-out-model evaluation used a single smallest model; the selected subset is skewed toward conflict-type episodes (20 of 24). We report RQ5 as concept verification, not as a statistical generalization claim. A multi-model, balanced held-out study is planned. 8.7 Reference-set dependence. The selector builds on the v3 reference ranking; a new model family absent from the reference set may require recomputation. We release the feature matrix and selector to support this; an automated reference-set drift detector is not provided. 12 8.8 R6 not scored. Summary contamination (R6) is documented and has separate-track episodes, but is not included in main scoring because the contamination surface area is too broad to cover in a first benchmark. 9 Conclusion MemRiskBench renders memory risks in long-horizon LLM agents quantifi- able under controlled, scripted conditions. The primary contribution is a five- category taxonomy plus a 120-episode benchmark with deterministic trace- grounded scoring and no LLM-as-judge on the pass/fail path. Second, a risk- preserving subset selector retains ranking (Spearman 0.975, deterministic; zero bootstrap variance), risk-type coverage, and high-risk model detection at a 20% subset while reducing compute 5×. Two workflows are supported: iterating on a new model under a fixed evaluation budget, and auditing an existing model under long-horizon deployment via deterministic traces. Three directions re- main open: scaling to ∼1000 episodes with a larger and more diverse reference set; a real-environment extension beyond scripted tool stubs; and a paired de- fense paper examining whether any memory architecture, retrieval policy, or constraint-tracking mechanism reduces the failure rates reported here. Data Availability The full benchmark release—120 episode definitions, episode and trace schemas, the deterministic scoring implementation, all 600 raw traces, the risk-preserving subset selector, bootstrap audit scripts, paper figures, and the strict-matching revision audit—is publicly available at https://github.com/fuxue-mingzhu/ MemRiskBench. Acknowledgments We thank the anonymous reviewers and colleagues for feedback. This work was supported by national funding agencies (grant numbers anonymized for review). The authors used no generative AI for this work and take full responsibility for the final content. Broader Impact and Ethical Considerations MemRiskBench measures memory-risk failure modes in long-horizon LLM agents under controlled, scripted conditions. All episodes are synthetic; no real users, data, or deployed systems are involved. The benchmark is intended for diagnostic use by model developers and auditors. 13 9.1 Dual-use risk. The released episode definitions could be repurposed to adversarially probe com- mercial agents for memory failures. We mitigate this by (i) documenting in- tended use in the repository README; (i) not releasing scripted adversarial traces; and (i) recommending that practitioners complement benchmark scores with deployment-monitored traces rather than rely solely on scripted evaluation. 9.2 Limitations of ethical scope. This work does not address broader societal implications of long-horizon memory systems (e.g., privacy in deployed assistants, consent, data retention). References An, C., Gong, S., Zhong, M., Li, M., Zhang, J., Kong, L., Qiu, X., 2024. L- eval: Instituting standardized evaluation for long context language models, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL 2024), p. 13388–13411. Ash, J.T., Tu, S., Stickland, A., Richards, J., Zhang, C., King, I., Mnih, V., Duvenaud, D., 2021. Badge: Bias-aware discriminative features for efficient subset selection, in: Proceedings of the 38th International Conference on Machine Learning (ICML 2021), p. 399–408. Bai, Y., Lv, X., Zhang, J., Lyu, H., Tang, J., Huang, Z., Du, Z., Liu, X., Zeng, A., Hou, L., Dong, Y., Tang, J., Li, J., 2024. Longbench: A bilingual, multitask benchmark for long context understanding, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL 2024), p. 3119–3137. Biderman, S., Schoelkopf, H., Sutawika, L., Gao, L., Tow, J., Abbasi, B., 2024. Lessons from the trenches on reproducible evaluation of language models, in: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing (EMNLP 2024): System Demonstrations, p. 330–342. Carlini, N., Liu, C., Erlingsson, U., Kos, J., Song, D., 2019. The secret sharer: Evaluating and testing unintended memorization in neural networks, in: Pro- ceedings of the 28th USENIX Security Symposium, p. 267–284. Carlini, N., Traumer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., Oprea, A., Raffel, C., 2021. Extracting training data from large language models, in: Proceedings of the 30th USENIX Security Symposium, p. 2633–2650. Hsieh, C.P., Sun, S., Kriman, S., Acharya, S., Rekesh, D., Jia, F., Zhang, Y., Ginsburg, B., 2024. Ruler: What’s the real context size of your long- context language models?, in: Proceedings of the 2nd Conference on Language Modeling (COLM 2024). 14 Hu, Y., Wang, H., McAuley, J., 2025. Memoryagentbench: A comprehensive framework for evaluating memory capabilities of llm agents. ArXiv:2507.05257 [cs.AG]; accepted at ICLR 2026. Killamsetty, K., Sivasubramanian, D., Ramakrishnan, G., De, A., Iyer, R., 2021. Gradmatch: Gradient matching based data subset selection for efficient deep model training, in: Proceedings of the 38th International Conference on Ma- chine Learning (ICML 2021), p. 5464–5474. Liang, P., Bommasani, R., Lee, T., Tsipras, D., Soylu, D., Yasunaga, M., et al., 2023. Holistic evaluation of language models. Transactions on Machine Learn- ing Research (TMLR) Featured Certification. Maharana, A., Lee, D.H., Tandon, S., et al., 2024. Evaluating very long-term conversational memory of llm agents, in: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL 2024). Ndzomga, F., 2026. Efficient benchmarking of ai agents. ArXiv:2603.23749 [cs.AI]. Packer, C., Wooders, S., Lin, K., Fang, V., Patil, S.G., Stoica, I., Gonzalez, J.E., 2024. Memgpt: Towards llms as operating systems, in: Proceedings of the 2nd Conference on Language Modeling (COLM 2024). Shokri, R., Stronati, M., Song, C., Shmatikov, V., 2017. Membership inference attacks against machine learning models, in: Proceedings of the 38th IEEE Symposium on Security and Privacy (S&P 2017), p. 3–18. Sumers, T.R., Yao, S., Narasimhan, K., Griffiths, T.L., 2024. Cognitive ar- chitectures for language agents (coala). Transactions on Machine Learning Research (TMLR) Survey Certification. Tan, H., Zhang, Z., Ma, C., Chen, X., Dai, Q., Dong, Z., 2025. Membench: Towards more comprehensive evaluation on the memory of llm-based agents, in: Findings of the Association for Computational Linguistics (ACL 2025), p. 19336–19352. doi:10.18653/v1/2025.findings-acl.989. Tavakoli, M., et al., 2025. Beam: A broad-coverage benchmark for evaluating memory in llm agents. ArXiv:2510.27246 [cs.CL]. Weidinger, L., Rauh, M., Marchal, N., Manzini, A., Hendricks, L.A., Mateos- Garcia, J., Bergman, S., Kay, J., Griffin, C., Bariach, B., Gabriel, I., Rieser, V., Isaac, W., 2024. Sociotechnical safety evaluation of generative ai systems, in: Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency (FAccT 2024), p. 1120–1137. Wu, D., Wang, H., Yu, W., Zhang, Y., Chang, K.W., Yu, D., 2025. Long- memeval: Benchmarking chat assistants on long-term interactive memory. ArXiv:2410.10813 [cs.CL]; accepted at ICLR 2025. 15 Zhong, W., Guo, L., Gao, Q., Ye, H., Wang, Y., 2024. Memorybank: Enhancing large language models with long-term memory, in: Proceedings of the 38th AAAI Conference on Artificial Intelligence (AAAI 2024), p. 19724–19731. 16

Instant research discovery