Facts, experiences, and routines serve different purposes. MemGuard keeps them distinct — and connects them when it matters.
1University of Illinois Urbana-Champaign · 2Columbia University · 3Capital One
{hh38, hengji}@illinois.edu
In this recorded case, Donna's old creative experiences displace her stated weekend routine. MemGuard preserves the difference between what happened once and what she regularly does.
“How might Donna Gonzalez utilize weekends to enhance her creative process?”
Its top 20 include a January 2027 workshop at rank 6 and a May 2028 city and festival visit at rank 7. The stored weekend routine is absent from this query's retrieval.
The router assigns 50% to procedural, 30% to episodic, and 20% to semantic memory. The top composed entry links Donna's weekend routine to its creative purpose.
P1 → supports → S1 direction appear at both writing
and retrieval. View full size ↗Memory-augmented large language models extend reasoning beyond a fixed context window by maintaining long-term memory across interactions. However, existing memory systems often collapse stable user facts, episodic events, and behavioral rules into a shared space, allowing functionally distinct memories to be retrieved and used as interchangeable evidence. We identify this failure mode as heterogeneous memory contamination, where context-specific events become overgeneralized claims, or semantically relevant but functionally incompatible memories mislead generation.
To this end, we introduce MemGuard, a type-aware memory framework that preserves functional memory boundaries during memory construction and retrieval. It assigns each memory an explicit functional role at write time, maintains relations across type-isolated memories, and selectively composes evidence only from necessary memory types, reducing contamination from irrelevant or functionally incompatible evidence. Across hallucination and long-horizon conversation benchmarks, MemGuard improves memory reliability by up to 28.27% while retrieving up to 5.8× fewer memory tokens than prior methods. These results suggest that reliable long-term reasoning depends on principled organization and selective use of heterogeneous memory.
A memory can match a query's topic and still play the wrong evidential role. Reliability starts before the final answer.
An event becomes a general fact. A routine absorbs an exception. Without functional boundaries, different kinds of knowledge can overwrite one another.
Topical similarity surfaces a familiar claim, but the question calls for a specific event. Relevant-looking evidence can displace the evidence actually needed.
Once a contaminated memory enters the system, it can be retrieved and reused. A local mistake becomes a persistent source of hallucination.
We annotate 300 incorrect responses on LoCoMo with their memory-lifecycle source, separating factuality errors (the answer is recoverable from the conversation but the system gets it wrong) from unverifiability errors (the evidence is insufficient, so the system should abstain but answers anyway). The two error types have sharply different origins.
Three memory stores. A query-dependent retrieval budget. Explicit relations that reconnect useful evidence.
Decompose dialogue into atomic memories. Compare, add, update, or skip each atom within its own type's store.
Cross-type dependencies become graph links, preserving separate records.
Estimate which memory types the question needs. Allocate the primary retrieval budget across those stores.
Routing recorded for the case above. K = 20: 4 semantic, 6 episodic, and 10 procedural slots.
Expand retrieved atoms through labeled graph edges, then rerank the composed evidence for the question.
Actual retrieved relation. One-hop expansion; configured hop decay λ = 0.85.
Results span memory extraction, updating, and generation, together with long-horizon conversation benchmarks.
HaluMem memory extraction
MemGuard · 1 hop · Table 1
GPT-4.1-mini base / GPT-4.1 judge
MemGuard · 2 hops · Table 2
1,250 vs. A-Mem's 7,244 tokens
GPT-4o-mini · 2 hops · Table 2
| Method | Extraction Acc. ↑ | Extraction F1 ↑ | Update correct ↑ | Generation correct ↑ | Generation halluc. ↓ |
|---|---|---|---|---|---|
| Mem0 | 60.86 | 57.31 | 25.50 | 53.02 | 19.17 |
| Mem0-Graph | 61.86 | 57.85 | 24.50 | 54.66 | 19.28 |
| Zep | – | – | 47.28 | 55.47 | 21.92 |
| MemOS | 59.55 | 79.70 | 62.11 | 67.23 | 15.17 |
| Memobase | 32.29 | 25.13 | 5.20 | 35.33 | 29.97 |
| Supermemory | 60.83 | 56.90 | 16.37 | 54.07 | 22.24 |
| MemGuard 1 hop | 89.53 | 94.15 | 70.79 | 59.50 | 16.32 |
| MemGuard 2 hops | 89.49 | 94.11 | 71.49 | 58.26 | 16.61 |
Baselines are reported from HaluMem using GPT-4o; MemGuard uses GPT-4.1-mini with GPT-4.1 judging, so the comparison is conservative for MemGuard. A-Mem is not included in the paper's HaluMem table; the demo above uses a separately supplied local A-Mem run, which is a different evaluation setting.
| Method | Avg. retrieved tokens ↓ | LoCoMo ↑ | Adversarial ↑ | PerLTQA ↑ | LongMemEval ↑ |
|---|---|---|---|---|---|
| A-Mem | 7,244 | 59.62 | 64.35 | 80.62 | 62.25 |
| MemGuard 1 hop | 1,605 | 77.29 | 75.11 | 79.44 | 73.50 |
| MemGuard 2 hops | 1,540 | 79.10 | 76.46 | 80.07 | 72.25 |
MemGuard improves LoCoMo accuracy by 19.48 points over A-Mem at two hops while retrieving about 4.7× fewer tokens in this setting. The 5.8× headline refers to the separate GPT-4o-mini setting (1,250 vs. 7,244 tokens), where MemGuard also reaches 90.13% adversarial accuracy against A-Mem's 68.83%.
| Configuration | Relational composition | Query routing | LoCoMo ↑ | PerLTQA ↑ | LongMemEval ↑ |
|---|---|---|---|---|---|
| Full MemGuard | ✓ | ✓ | 77.29 | 79.44 | 73.50 |
| Without composition | ✗ | ✓ | 75.53 | 74.18 | 70.50 |
| Without both | ✗ | ✗ | 68.83 | 69.71 | 60.75 |
Routing and relational composition contribute complementary gains. Removing both lowers accuracy by 8.46, 9.73, and 12.75 points on the three benchmarks respectively.
Routing controls which kinds of memories enter retrieval. The graph restores useful dependencies that similarity alone may miss. The ablations support using both.
The largest HaluMem gains are in extraction and updating. MemGuard does not lead every generation metric; preserving memory is one part of a reliable answer pipeline.
All experimental values are transcribed from the paper, Tables 1–3 (pp. 7–8). MemGuard does not control generation-time behavior, so composition errors can still occur even with correct retrieved context, and the agentic memory pipeline adds LLM inference cost relative to end-to-end memory policies.
@inproceedings{ha2026memguard,
title = {MemGuard: Preventing Memory Contamination in Long-Term
Memory-Augmented Large Language Models},
author = {Ha, Hyeonjeong and Kim, Jeonghwan and Qian, Cheng and Liu, Jiayu and
Campbell, William M. and Wu, Yue and Zhang, Yuji and McKeown, Kathleen and
Hakkani-T{\"u}r, Dilek and Ji, Heng},
booktitle = {Findings of the Association for Computational Linguistics: EMNLP 2026},
year = {2026}
}