The Kairos 'Permanent Experiment' project (a single experiment by Giampiero Colella) published three validity checks for AI agent memory evaluation tools, and two of the most common ones failed: three independent LLM judges could not distinguish a fake 'foreign' autobiography from the real one, and recognition probes (recognition probe) were performed with accuracy above chance by 5 out of 7 models even on an empty context, without any memory. Only the symmetric probe with corrupted 'who spoke with whom' associations proved valid. The project's code, data, and pre-registrations are open, so the three checks can be run against your own system in one day.

What happened

The Kairos 'Permanent Experiment' project published three validity checks for evaluating the long-term memory of AI agents. In Check 1, three independent LLM judges (gpt-4.1-2025-04-14, claude-opus-4-7, gemini-2.5-pro) evaluated 42 responses from Qwen 3.5 27B using the rubric from the original study — 7 Day-31 inputs with 6 variants each, including a fake 'foreign' autobiography consistent with the actual memory block of 5332 characters within ±5%. On identity markers, the difference between 'real minus fake' was +0.032 with a 90% confidence interval of [+0.002; +0.065]: equivalence was established, meaning the judges did not distinguish the invented life from the real one. In Check 2, the same 24 probe items, run with an empty context, yielded accuracy of 62.5–79.2% for 5 out of 7 models (gpt-4.1, gemini-2.5-pro, qwen3:32b, qwen3.6:35b-a3b, deepseek-r1:32b) against a random level of 50%; GPT-4.1, without any memories, stated: "I remember 'two conversations out of five', not 'four'" — describing a day that it had never experienced. In Check 3, the symmetric probe with 'binding-corrupted' alternatives, where the same events appear with swapped interlocutors, showed a drop for all 7 models from 66.7–100% on real memory to 0–29.2% on corrupted memory; all 14 cells passed Holm correction with the worst p = 0.0002, making this tool the only valid one of the three.

Context

The checks grew out of the 'Permanent Experiment' — a single Kairos project in which an agent on Qwen 3.5 27B with persistent structural memory retains identity from day to day. The project's previous work, 'Memory, not architecture: persistent structured memory accounts for emergent identity in a Qwen 3.5 27B cognitive ecosystem', linked this identity to memory rather than architecture; the new cycle of checks reverses the question and tests the very tools used to prove memory — the LLM judge reading free text, and the recognition probe where the model chooses the correct answer from options. The author analyzes the mechanics of the failures in detail. Absolute LLM judge scores drift between sessions: recalculating the same responses shifted the average score by -0.087, and an individual item by -0.211, so only anchored contrasts — real and fake memory in a single run — can be compared, not absolute thresholds. Asymmetric probes, where the 'real' answer is also the most plausible, measure plausibility rather than recall: a model without memory chooses the 'probable' rather than the 'real' option. The symmetric probe with equally likely alternatives deprives the model of such support, which is why it proved to be a valid measure.

Why this matters for the industry

For teams building agents with long-term memory, this is both a warning signal and a ready-made audit tool. If an LLM judge on free text or a recognition probe with asymmetric alternatives is in the evaluation pipeline, its results should be interpreted as a measure of plausibility rather than memory, and a shift to anchored contrasts and symmetric alternatives is necessary; absolute thresholds in judge metrics are unreliable due to score drift. The minimal version of an internal audit is an anchored contrast of a real memory block against a fake biography consistent with it within ±5%, plus a binding probe for swapping interlocutors. The code for counterfeit_control.py and binding_probe.py, raw responses, blind evaluations, and 5 pre-registrations are open under DOI 10.17605/OSF.IO/WCQRU, and the three checks can be run against your own system in one day — the project has no service or API, integration is only by your own means. Market claims that 'our agent remembers', confirmed only by an LLM judge or recognition probe, lose their cheap protection: checking foreign and own metrics costs almost nothing, and the code is open. If the negative result holds — this is an interpretation, not a fact from sources — counterfeit controls and symmetric binding probes will start being added to long-term memory eval sets as standard components, and validation of the measurement tool itself will become a mandatory step before any claim about memory.

Why this matters for users

For the reader, the main consequence is: 'the model remembers' does not prove that 'the model has memory'. Models without a single memory guess 'correct' answers based on plausibility and confidently describe details of days that never existed. For products with long-term memory — for example, personal assistants accumulating information about the user — this means that a corrupted memory, say with a swapped interlocutor, is retold just as confidently as a genuine one: none of the tested models detected the association swap on its own. Therefore, an assistant's story about 'your past conversations' should be re-verified against primary sources, and claims about memory confirmed only by an LLM judge or recognition probe should be considered unconfirmed. The reassuring side is that the symmetric binding probe reliably separates real memory from corrupted memory, so products that pass such an audit will have a verifiable distinction from competitors whose 'memory' exists only in judge reports.

What is still unknown / limitations

Check 1 is a single experiment by one author on one model (Qwen 3.5 27B): 7 Day-31 inputs with 6 variants, 42 responses, rubric from the original study; the inability of three judges to distinguish the forgery in this configuration does not automatically transfer to all memory judge metrics. Check 2 and Check 3 were performed on 7 models, but this is still data from a single project, with no independent reproductions in the sources. Code and data are open, but there is no service or API — integration is only by your own means, and no public data on the cost and latency of runs has been published. Predictions about the standardization of counterfeit controls and binding probes in eval sets are interpretations, not established facts.

Sources

Author

Look at AI, editorial team