DerivAudit paper asks whether agent memories follow from the history behind them

Researchers Hongjun Liu and Chen Zhao have posted a preprint proposing DerivAudit, a framework for checking whether a long-running AI agent's stored memory is actually supported by the interactions available when that memory was written. The paper was submitted to arXiv on 28 September 2026 and has not, as far as we can tell, been peer reviewed.

The problem, as the authors describe it, is that agents compress past interactions into persistent memories that later tasks may treat as premises. Two things can go wrong. Evidence for a valid memory may be scattered across earlier exchanges, so the citations attached by the memory writer can make it look unsupported. Conversely, compression can combine individually supported facts into a stronger statement, or introduce relations or event status, that the history never established.

DerivAudit separates three questions: whether supporting evidence lies beyond the writer's citations, whether the composed memory introduces unsupported meaning, and how write-time admission decisions affect later use of the memory. The authors call these evidence scope, compositional validity and admission reliability.

What is new is the reported measurement. According to the authors, across two natural memory corpora, audits that drew on broader pre-write history recovered support for nearly 60% of memories that looked unsupported from citations alone. Even so, 17-21% stayed unsupported after the expansion.

The second finding is less comfortable for builders. The authors report that broader evidence does not by itself make admission reliable: verification models still frequently admitted unsupported memories, and expanding the evidence alone made admission worse on two model backbones.

Why it matters: a memory pipeline that judges only cited excerpts may wrongly flag good memories, while one that simply searches more history may still let unsupported claims through. The paper's framing suggests treating those as separate checks, though that reading is ours rather than a claim the abstract makes.

What is confirmed and what is not: everything above comes from the authors' own abstract. We have not reviewed the full paper, the corpora, the verification models or the backbones involved, and the abstract does not name them. We found no independent second source, replication or outside commentary on this work, so the results should be read as the authors' claims.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.