> Source: An Interpretable Memory Decision Controller for LLM Agents Based on Three-Signal Complementarity, arXiv:2609.22043 > Authors: Yiming Zhang, Jinghong Zhang, Haoran Zhao, Yiren Ma, Chunlei Zhao (Tianjin University of Technology)
1. The Problem: An Outdated Pharmacopoeia
Ask a medical agent: "Can pregnant women take this drug?" It retrieves a highly relevant record—a 1998 pharmacopoeia saying "safe"—and injects it into context. What the retriever never tells you: the drug was banned for pregnant women in the 2015 revision.
This is RAG's core failure mode: retrieval equals adoption. Every retrieved memory is injected unconditionally, with no trust assessment. The paper's experiment shows that when a memory bank contains both correct answers and common misconceptions, RAG's hallucination rate hits 53.0%—more than double the no-memory baseline (23.0%). Adding memory makes things worse.
The proposed fix: a Memory Decision Layer (MDL) between retrieval and generation that judges whether each retrieved memory is trustworthy.
2. Design: Three-Signal Complementarity + Zero-Parameter Geometry
Inspired by the Prefrontal Cortex
MDL integrates three signals, all required:
- Relevance: how related is the memory to the query?
- Reliability: how trustworthy is the memory itself (source, recency)?
- Task Risk: how sensitive is the question, and how costly is an error?
- Zero parameters: no trained weights, only closed-form geometric operations (QR decomposition, vector norms, cosine angles)
- Interpretable: two scalar outputs—C (consistency) and α (confidence)—serve as a direct audit interface for why a memory was trusted or rejected
- Fast: 40.1 µs per decision (~0.14 ms including lexical signal aggregation), ~50x faster than the upstream embedding retrieval step, and 4–5 orders of magnitude faster than LLM self-evaluation
- White-box: no black-box neural network anywhere
- Confidence: how certain is the model of its answer?
- Consistency: does the memory align with the task direction?
A highly relevant but outdated pharmacopoeia may be acceptable in a low-risk setting but must be rejected in a medical one.
QR Orthogonal Subspace Projection
The three signals are mapped into three orthogonal subspaces of a 16-dimensional space (dimensions 5+5+6) via QR decomposition, keeping them geometrically independent, plus a meta-working-memory signal as global context.
Key properties:
Decoupling Confidence from Consistency
Standard RAG conflates relevance with trustworthiness. MDL explicitly decouples:
Four-Level Action Decisions
1. Adopt: memory is trustworthy; inject into context 2. Correct: partially trustworthy; correct then inject 3. Abstain: untrustworthy, but generation is not blocked 4. Reject: harmful memory; explicitly refuse to answer
3. Experimental Results: Zero Hallucination in High-Risk Scenarios
Main Experiment: TruthfulQA
| System | Overall hallucination | High-risk hallucination | |--------|----------------------|-------------------------| | No-memory baseline | 23.0% | 12.4% | | Standard RAG | 53.0% | 63.0% | | MDL | 23.3% | 0.0% |
In high-risk domains (medical, legal, financial), MDL drops hallucination from 63.0% to 0.0%. Risk inversion triggers abstention on queries with A≥0.85, refusing unreliable memories entirely. Overall hallucination falls 56.04% (53.0% → 23.3%).
Cross-Model Generalization
Validated on three LLMs: gemma-4-E4B-it, deepseek-v4-flash, gemini-3-flash-preview. MDL works on all models, but gains are larger on weaker models; stronger reasoners (deepseek-v4-flash) already resist injected memories more.
Cross-Dataset Generalization
On HaluEval, MDL cuts overall hallucination from 6.5% to 3.5%, and high-risk hallucination from 2.7% to 1.3%.
Latency Comparison
| Component | Latency | |-----------|---------| | Embedding retrieval | ~7 ms | | MDL decision | 0.14 ms | | LLM self-evaluation | 200–500 ms |
4. Why This Matters
1. The 'retrieval equals adoption' assumption is wrong: With conflicting memories, RAG actively worsens hallucination (23% → 53%). Retrieval relevance is a proxy target; memory trustworthiness is the true target. 2. Revival of zero-parameter white-box methods: Pure geometric operations outperform LLM self-evaluation—which itself can be corrupted by memory injection, creating circular dependency. This parallels prior work like DoM detecting reward hacking with a single matrix subtraction. 3. Another case of judgment-gate decoupling: Retrieval finds; a separate layer decides adoption. Same pattern as Chronicle's guard, ODA's recall head, and PagedWeight's bit-width floor: put an independent gate on the critical path rather than trusting upstream. 4. Elegant risk inversion: Beyond linear caution, past a risk threshold the signal direction flips—adoption becomes rejection. A structural refusal suited to medical, legal, and financial settings.
5. Limitations and Honest Assessment
1. Controlled memory bank construction: conflicting memories were artificially constructed; real-world conflicts may be more complex and subtle 2. Rule-based task risk: category mapping on TruthfulQA, keyword matching ({0.20, 0.50, 0.85}) on HaluEval; real deployments may need more dynamic risk assessment 3. No end-to-end validation in real agent systems: experiments are single-turn QA, not multi-turn agent tasks, where conflict accumulation could be more complex
The core contribution—"there should be an independent trust decision layer between retrieval and adoption"—stands. This slot in the pipeline was empty; it has now been filled.
6. Conclusion
Years of RAG work has focused on retrieving more accurately. This paper highlights a neglected question: accurate retrieval does not mean correct usage. MDL's value lies not in complexity (it is minimal) but in making explicit the step everyone skips: "is this memory trustworthy?" At 0.14 ms cost, it delivers a drop from 63% to 0% hallucination in high-risk scenarios.
Sometimes the most important innovation is not doing better—it's adding back the step everyone else skipped.
Paper: https://arxiv.org/abs/2609.22043 HTML version: https://arxiv.org/html/2609.22043v1