Memory, Drift, and the Long-Horizon Agent: From Context Accumulation to Governed Reconstruction

Abstract

Long-horizon language model agents, those that operate across many turns, sessions or days on a single case or task, face a memory problem that short single-session agents do not. The working context available to the model is bounded, the volume of relevant history grows without bound. The mechanisms used to bridge that gap, summarisation, retrieval, external memory stores, each introduce their own failure modes.

This paper reviews the published research on this problem, from empirical findings on context degradation, sometimes called context rot, through architectural responses including context compression, streaming attention and structured memory systems, to retrieval architectures purpose-built for long-horizon recall, including graph-based approaches such as GraphRAG and HippoRAG.

It further reviews the emerging literature on memory as an attack surface, where an adversary manipulates what an agent remembers rather than what it is asked. The paper's position, informed by the author's practitioner experience running long-horizon agents inside Tier 1 banks, is that memory architectures modelled on an ever-growing buffer are a poor fit for regulated operation. Proposes instead a pattern of periodic Markovian reconstruction of a governed case state from provenance-gated writes.

1. Introduction

A short-horizon agent, one that answers a single question or completes a single bounded task within one session, can often treat its context window as sufficient working memory, since the entire relevant history of the interaction fits within it. A long-horizon agent, handling a customer's case over several weeks, monitoring a portfolio continuously, or working through a multi-stage compliance investigation, cannot make this assumption, because the total volume of relevant history will, given enough time, exceed any practically deployable context window. Because much of that history will become stale, superseded, or simply irrelevant to the decision the agent must make now.

The research community's response to this problem has moved through several distinct phases. Early work, exemplified by Generative Agents (Park et al., 2023), proposed a memory stream architecture in which every observation is stored, periodically synthesised into higher-level reflections. Retrieved by relevance, recency and importance at each decision point. Parallel work established that simply extending the context window does not solve the underlying problem, since the empirical literature on long-context degradation, discussed in Section 3, shows that models make systematically worse use of information placed in the middle of a long context than information placed near either end, regardless of window size.

This has driven two further strands of work: architectural techniques that compress, stream or otherwise manage what enters the context window (Section 4). Structured external memory systems that separate what is remembered from what is currently in context (Section 5). A separate but related strand, retrieval-augmented generation and its more recent graph-structured descendants, addresses a closely related but distinct problem, grounding an agent's answers in an external, checkable corpus rather than only in its own accumulated history (Section 6). Finally, as agent memory has moved into production, a security literature has emerged studying memory itself as an attack surface (Section 7).

Section 8 develops this paper's central position: that the conversation-buffer or ever-growing memory stream pattern common across the frameworks reviewed in Sections 2 to 5 is a poor match for long-horizon regulated operation. That a periodic, governed reconstruction of an agent's working state from a provenance-checked case record is preferable. Section 9 discusses implementation considerations and limitations, Section 10 sets out a migration path from existing conversation-buffer architectures, and Section 11 concludes.

As with the companion papers in this series, the position in Section 8 reflects the author's practitioner experience architecting long-running agentic systems for Tier 1 banks and is offered as synthesis rather than as a peer-reviewed novel result.

2. The memory problem in long-horizon agents

Three distinct sub-problems are frequently conflated under the single label of agent memory, and separating them clarifies much of the literature reviewed below. The first is context management, the mechanical problem of what token sequence is actually presented to the model at each step, bounded by a fixed window size. The second is recall, the problem of retrieving the specific prior facts relevant to the current decision from a much larger store of history.

The third is state maintenance, the problem of knowing what is currently true, given that facts recorded earlier may have since been superseded, corrected or reversed, which is a different problem from recall even when recall works perfectly, since a memory system can correctly retrieve a fact that is no longer accurate.

Much of the architectural literature reviewed in Sections 4 and 5 addresses context management and recall well, and addresses state maintenance only implicitly or not at all.

This is a significant limitation for a banking use case, where an agent handling, for example, a disputed transaction case over several weeks must not only recall that a customer previously stated a certain fact. But must also know whether that fact was subsequently corrected, and must be able to justify, on audit, which version of the fact it acted on and why.

Cognitive Architectures for Language Agents, CoALA (Sumers et al., 2023), is the paper in this period that most explicitly separates these concerns, proposing a structured framework distinguishing working memory, episodic memory, semantic memory and procedural memory, each with distinct update and retrieval dynamics, a distinction the position in Section 8 builds on directly.

3. Context rot and long-context degradation

Liu et al.

(2023), in "Lost in the Middle", provided the empirical finding most frequently cited as evidence that simply lengthening a model's context window does not solve the recall problem. Across several long-context tasks, model accuracy at retrieving and using a piece of information was highest when that information appeared near the start or end of the context and degraded substantially when it appeared in the middle, a pattern that held across model families and that the paper links to positional biases in how transformer attention is trained.

Hsieh et al. (2024), with the RULER benchmark, extended this line of evaluation by testing models against a battery of synthetic long-context tasks of increasing structural difficulty, finding that many models advertising very large context windows show substantial performance degradation well before that advertised limit is reached, particularly on tasks requiring the aggregation of multiple scattered facts rather than the retrieval of a single fact.

Kuratov et al. (2024), with BABILong, pushed the evaluated context length further still, embedding simple reasoning tasks inside very long, largely irrelevant background text. Found that reasoning accuracy for most evaluated models degraded sharply well before the stated context limit, with only a small number of specifically long-context-trained models maintaining performance across the full range tested. An et al. (2024) investigated why effective context length falls short of the trained or advertised limit. Identified training data distribution, specifically the rarity of long-range dependencies of the kind evaluated in these benchmarks within typical pretraining corpora, as a substantial contributing factor rather than an architectural limitation alone.

More recently, a widely discussed technical report from Chroma (Chroma Research, 2025) coined the term context rot to describe a related but distinct empirical pattern. Performance on a fixed, well-defined task measurably degrades as irrelevant or loosely relevant content accumulates in the context window, even when the specific information needed to answer correctly remains present and has not moved position within the context, suggesting that the degradation is not solely a positional retrieval problem of the kind Liu et al. (2023) documented, but also a function of the sheer volume and heterogeneity of accumulated content competing for the model's attention.

Table 1 summarises the empirical findings reviewed in this section and their practical implication for long-horizon agent design.

These findings collectively motivate a design conclusion this paper takes as a starting premise. A long-horizon agent should not treat "keep everything and let the model sort it out" as a viable memory strategy, regardless of how large its context window is, because the evidence surveyed here indicates that larger raw context does not straightforwardly translate into more reliable use of that context.

4. Architectural responses: compression and streaming

One family of responses to the findings in Section 3 attempts to compress history so that more of it fits usefully within a bounded working context. Mu et al. (2023), with gist tokens, trained models to compress a prompt into a small number of learned summary tokens that could be cached and reused in place of the original prompt, reducing the effective context cost of repeated or templated instructions.

Chevalier et al. (2023), with AutoCompressor, extended this idea to long documents, recursively compressing earlier segments of text into a small number of summary vectors that are then prepended to the processing of later segments, allowing a model with a fixed window to condition on an effectively much longer document. Bertsch et al. (2023), with Unlimiformer, took a retrieval-based approach to the same underlying problem, indexing the hidden states of an entire long input in an external datastore and retrieving the most relevant states at each attention computation, rather than compressing the input into a fixed-size summary.

A second family addresses the streaming case, where an agent must process a continuous, unbounded input rather than a single long document. Xiao et al. (2023), with StreamingLLM, made the empirical observation that a small number of initial tokens in a sequence, termed attention sinks, receive disproportionate attention regardless of their semantic content. That retaining these sink tokens alongside a sliding window of recent tokens allows a model trained with a fixed context length to process an effectively unbounded stream without the quality collapse that naive window truncation produces.

Fountas et al. (2024), with EM-LLM, proposed an architecture directly inspired by human episodic memory, segmenting an incoming stream into discrete events using a surprise-based boundary detection method drawn from cognitive science. Retrieving relevant past events for the current context using a combination of semantic similarity and temporal contiguity, an approach that, notably, treats the segmentation of history into discrete, recallable episodes as a first-class design problem rather than an incidental side effect of a fixed summarisation window.

These compression and streaming approaches share a common limitation relevant to the position in Section 8: all of them optimise for making more of an agent's history usable within a bounded context. But none of them address the state maintenance problem named in Section 2, since a compressed or streamed representation of a fact is still a representation of whatever was true when that fact was recorded. None of the methods reviewed here include a mechanism for checking whether that fact remains current at the point of use.

5. Structured memory systems

A distinct family of work treats memory as an external, structured store the model consults through explicit operations, rather than as content folded directly into the context window. Generative Agents (Park et al., 2023) established the memory stream pattern discussed in Section 1. A flat, timestamped log of observations, periodically synthesised into higher-level reflections, retrieved by a weighted combination of recency, importance and relevance to the current situation. Zhong et al.

(2023), with MemoryBank, proposed a related architecture with an explicit forgetting mechanism inspired by the Ebbinghaus forgetting curve, in which the retrieval weight of a memory decays over time unless it is reinforced by repeated access, an attempt to prevent the unbounded accumulation problem named in Section 3 by allowing genuinely unused memories to fade from active retrieval.

Packer et al. (2023), with MemGPT, took an explicitly operating-system-inspired approach, treating the model's limited context window as analogous to physical memory and an external store as analogous to disk, with the model itself issuing function calls to page information in and out of context as needed, managed by an interrupt-like mechanism that triggers when context approaches its limit. This design is notable for the position developed in Section 8 because it gives the agent explicit, auditable operations, a page-in, a page-out, a write, rather than an implicit, opaque retrieval step, which is a precondition for the provenance-gated write mechanism proposed later in this paper.

Sumers et al. (2023), with CoALA, as introduced in Section 2, provided the clearest conceptual scaffolding for this family of work, distinguishing working memory from episodic, semantic and procedural memory and proposing that an agent's decision procedure should explicitly reason about which memory type to consult for a given sub-task, rather than treating memory as an undifferentiated pool. Reflexion (Shinn et al., 2023) contributed a narrower but practically important pattern within this family, a short-term episodic buffer of self-generated reflections on recent failures, carried forward specifically to influence the next attempt at a similar task, illustrating that not all useful memory needs to be long-lived to be valuable.

Table 2 compares the memory architectures reviewed in this section and Section 4 against the specific requirements of a long-horizon regulated banking case, alongside the Markovian reconstruction pattern proposed in Section 8.

6. Retrieval architectures

Retrieval-augmented generation, in its original formulation (Lewis et al., 2020), addressed a problem adjacent to but distinct from the agent memory problem discussed above. Grounding a model's output in an external corpus retrieved at inference time, rather than relying solely on knowledge encoded in its parameters. Gao et al. (2023) surveyed the subsequent rapid expansion of this idea, covering variations in what is retrieved, when retrieval occurs, and how retrieved content is integrated into generation.

RETRO (Borgeaud et al., 2021) demonstrated early that retrieval augmentation from a very large corpus could allow a comparatively small model to match the performance of a much larger parametric model on knowledge-intensive tasks, evidence that some of what a model needs to know is better stored externally and retrieved than memorised in weights.

A body of work addressed when and how retrieval should occur within a multi-step reasoning process rather than only once at the start. IRCoT (Trivedi et al., 2022) interleaved retrieval steps with chain-of-thought reasoning steps, using each intermediate reasoning step to formulate the next retrieval query, an approach well suited to multi-hop questions that a single upfront retrieval would not answer.

FLARE (Jiang et al., 2023) proposed active retrieval, triggering a new retrieval step specifically when the model's own generation confidence for the next span of text falls below a threshold, rather than retrieving on a fixed schedule. Self-RAG (Asai et al., 2023) trained a model to emit explicit reflection tokens deciding whether retrieval is needed. Separately critiquing the relevance and support that retrieved passages provide for its own generated output, folding a verification step directly into the generation process itself.

Two more recent lines of work moved retrieval from flat document chunks toward structured, graph-based representations, directly relevant to the case-state reconstruction proposed in Section 8. GraphRAG (Edge et al., 2024) constructs an entity and relationship graph from a source corpus using a language model, then generates community-level summaries of clusters within that graph. Answers a query by combining relevant community summaries rather than by retrieving individual passages alone, a design intended specifically to support the kind of query-focused summarisation across an entire corpus that flat-passage retrieval handles poorly.

HippoRAG (Gutierrez et al., 2024) took explicit inspiration from the hippocampal indexing theory of human long-term memory, building a knowledge graph from the corpus and using a personalised PageRank-style spreading activation process over that graph at query time to identify relevant nodes, reporting particular strength on multi-hop questions that require connecting facts recorded at different times or in different source documents, precisely the pattern a long-horizon banking case generates as new facts accumulate over the life of a case.

The kNN-LM approach of Khandelwal et al. (2019) is worth noting as an early precursor to this entire line of work, demonstrating that augmenting a language model's next-token prediction with a nearest-neighbour lookup over a large datastore of prior contexts could improve performance without any additional training, establishing the basic principle, non-parametric external memory improves on parametric memory alone, that the later graph-based and agent memory architectures all build on in different ways.

7. Memory attacks and provenance risks

As agent memory systems have moved into production, a security literature has emerged studying memory specifically as an attack surface, distinct from the more familiar problem of adversarial prompts submitted directly by a user. Greshake et al.

(2023) demonstrated indirect prompt injection, in which an attacker embeds instructions within content the agent is expected to retrieve or process, such as a web page or a document, rather than within the direct user prompt, causing the agent to follow attacker-supplied instructions that neither the user nor the system designer authorised. This is directly relevant to any memory or retrieval architecture reviewed in Sections 4 to 6, since all of them retrieve and act on content the agent did not generate itself and did not necessarily verify.

Chen et al. (2024), with AgentPoison, extended this line of attack specifically to agent memory and retrieval-augmented knowledge bases, demonstrating that an attacker who can insert even a small number of carefully crafted entries into an agent's long-term memory or retrieval corpus can cause the agent to retrieve those poisoned entries reliably for a targeted class of future queries, backdooring the agent's behaviour without needing to alter the underlying model at all.

This finding is significant for the position developed in Section 8 because it demonstrates concretely that a memory system without provenance checks on what it writes is not merely an accuracy risk of the kind discussed in Sections 3 and 4, but a distinct and separately exploitable security vulnerability. Zou et al.

(2023), while primarily concerned with adversarial suffixes that jailbreak a model's safety behaviour directly, is relevant here because the transferability the paper demonstrates across models and prompts suggests that an attacker need not have detailed knowledge of a specific target agent's memory architecture to construct a payload likely to succeed against it, which argues against relying on architectural obscurity as a defence.

The practical conclusion the author draws from this literature, based on practitioner experience assessing agentic pilots for Tier 1 banks, is that a memory architecture's write path deserves at least as much security scrutiny as its read path. Much of the architectural literature reviewed in Sections 4 and 5 focuses on how memory is retrieved and used. Comparatively little of it specifies how a candidate memory entry is validated before it is written, which is precisely the gap the provenance-gated write mechanism in Section 8 is intended to close.

8. Position: markovian case-state reconstruction with provenance-gated writes

The pattern common to nearly all of the architectures reviewed in Sections 4 and 5, a memory store that grows over the life of an agent's operation and is consulted through some form of retrieval or paging at each step, treats memory management as fundamentally an accumulation-and-retrieval problem.

The position argued here, drawn from the author's practitioner experience running long-horizon agents on customer cases and portfolio monitoring tasks inside Tier 1 banks, is that this framing is a poor fit for regulated long-horizon operation, for a reason distinct from but related to the context rot findings of Section 3. An accumulation-based memory store makes it structurally difficult to answer the question a bank's audit and compliance functions will actually ask, which is not "what has this agent ever observed" but "what does this agent currently believe to be true about this case. On what verified evidence is that belief based."

The alternative proposed here has two components. The first is Markovian case-state reconstruction: rather than extending a single, ever-growing conversational or memory-stream context across the life of a case, the agent's full working state is periodically and deliberately rebuilt from a compact, structured case record, discarding the raw historical trace and retaining only the current, reconciled facts the case record contains.

This is termed Markovian because, at each reconstruction point, the agent's subsequent behaviour depends only on the current case state and the current request, not on the specific sequence of prior turns that produced that state, in the same sense that a Markov process's future depends only on its current state.

This directly addresses the context rot findings of Liu et al. (2023) and Chroma Research (2025), since the working context presented to the model at any point is bounded and curated rather than accumulated. Directly addresses the state maintenance gap named in Section 2, since the case state is defined to hold only the current, reconciled version of each fact rather than every version ever recorded.

The second component is provenance-gated writes: every fact that becomes part of the governed case state must be written through an explicit gate that records its source, whether a specific customer statement, a specific verified system of record, or a specific human decision. A superseding write must reference and formally retire the fact it replaces rather than silently overwriting it. This addresses the security gap identified through AgentPoison (Chen et al., 2024) directly, since a candidate write lacking an acceptable provenance class is rejected before it can influence any future agent decision, rather than being accepted into an undifferentiated memory pool alongside verified facts.

It also gives the audit function exactly the artefact it needs. A case state that is, at every point in time, a reconciled and source-attributed record of what the agent currently believes, together with a full, separately retained history of superseded facts and their provenance, available on request but not part of the working context the agent reasons over day to day.

The retrieval architectures reviewed in Section 6, particularly the graph-based approaches of Edge et al. (2024) and Gutierrez et al. (2024), are complementary to this position rather than in tension with it: a knowledge graph built over a case's provenance-gated facts is a natural implementation substrate for the governed case state described here. The spreading-activation retrieval technique HippoRAG demonstrates is well suited to surfacing the specific reconciled facts relevant to a new query against that graph, provided the graph itself is built only from writes that have passed the provenance gate rather than from an unfiltered accumulation of everything the agent has ever seen.

A control framework for reconstructed state

Long-horizon memory needs two separate records. The event ledger preserves what was observed. The case state represents what is currently accepted as true. Reconstructing the second from the first makes supersession and correction explicit.

Recall is not truth. Retrieval can return a faithfully stored but obsolete fact. Summarisation is not reconciliation. A shorter narrative may preserve a contradiction instead of resolving it. Every state transition needs provenance. The source must be identifiable and authorised for that field.

The working state should be disposable. It can always be rebuilt from governed records. The event ledger should be append-only under ordinary operation. Corrections enter as new events rather than silent edits. Missing state should fail closed for dependent actions. The agent may ask for repair; it should not fill the gap from its own prior prose.

Primary findings and architectures include Lost in the Middle, RULER, CoALA, MemGPT, Self-RAG, GraphRAG and AgentPoison. They motivate separate parts of the design; they do not collectively prove this synthesis.

State must remain reconstructible. Sources can conflict. Policies resolve recognised cases. Missing fields stop dependent actions. Humans adjudicate unresolved contradictions. Rollback preserves prior accepted versions.

9. Implementation considerations and limitations

This architecture carries costs that should be acknowledged directly. Periodic reconstruction of working state discards, by design, the raw conversational texture that a flat memory stream preserves, which may reduce an agent's ability to answer questions about how a conclusion was reached in narrative terms, as opposed to what the conclusion currently is. A separate, retained audit log of superseded facts and rejected writes is necessary to recover that narrative when required, adding storage and retrieval complexity of its own.

Provenance gating requires an explicit taxonomy of acceptable source types to be defined and maintained for each use case, a design task the published literature does not standardise and that the author's practitioner experience suggests is genuinely domain-specific, differing considerably between, for example, a disputed transaction case and a continuous portfolio monitoring task.

A second limitation is that reconstruction introduces latency and computational cost at each session boundary. Rebuilding a working context requires at least a retrieval pass and, depending on implementation, a synthesis pass. That cost must be weighed against the context rot and unbounded accumulation it avoids, and it interacts directly with routing and caching choices.

A third limitation, again organisational rather than technical, is that provenance-gated writes only improve outcomes if the institution maintains clear ownership of what counts as an acceptable source for a given fact class. The author has observed pilots where this ownership question, which business function is accountable for defining what qualifies as a verified source for a given case type, took considerably longer to resolve than the technical implementation of the gate itself.

Finally, as with the reference architecture proposed in the companion multi-agent paper, Markovian case-state reconstruction with provenance-gated writes has not been evaluated against the retrieval or memory benchmarks reviewed in Sections 3 and 6 in a controlled, published sense. It is offered as a synthesis of the research reviewed in this paper and the author's practitioner experience, intended to inform architectural decisions for long-horizon agent deployments in regulated settings, not as a measured improvement over any specific published baseline.

10. Migrating from conversation-buffer architectures

Many agentic systems the author has reviewed across global financial-institution programmes were built on the conversation-buffer or flat memory-stream pattern described in Sections 1 and 5, typically because popular agent frameworks make it the shortest route to a working prototype. This is a practitioner observation, not an estimate of industry prevalence. A practical question this paper's position raises, and one the published literature does not address since it is organisational rather than algorithmic, is how an institution migrates an existing deployment toward Markovian case-state reconstruction without a disruptive rebuild.

The author's practitioner recommendation, drawn from several such migrations, is to treat the migration as three separable steps rather than a single cut-over. The first step is to introduce provenance tagging retrospectively, attaching a source classification to existing memory entries wherever it can be recovered from surrounding metadata such as which system produced a given record. Explicitly marking entries where provenance cannot be recovered as unverified, without yet changing how the agent retrieves or uses those entries.

This step alone, in the author's experience, is often sufficient to reveal to a business owner just how large a fraction of an existing agent's working memory has no recoverable source, which is frequently the single most persuasive piece of evidence for committing to the fuller migration.

The second step introduces the case-state reconstruction boundary alongside the existing buffer. The team can then compare both regimes on real or replayed traffic before retiring the buffer. This parallel run lets the business owner confirm that reconstructed state contains everything the task needs, including fields that the first schema often misses.

The third step is to retire the flat buffer as the agent's primary working context once the parallel-running period has demonstrated equivalent or improved task performance, retaining the original buffer only as a historical audit artefact rather than as an input to the agent's live reasoning. Only at this point does the provenance gate described in Section 8 become a hard constraint on new writes rather than an advisory tag on old ones.

This sequencing is deliberately conservative relative to what a greenfield deployment could adopt directly. An institution building a new long-horizon agent from scratch has no reason to pass through the parallel-running stage at all.

The sequence addresses a common case: an existing production agent built on a conversation buffer that must enter a governed operating model without a full rebuild. In regulated institutions, organisational migration cost is often the binding constraint, not the technical cost of the target architecture.

11. Conclusion

The research reviewed in this paper traces a clear arc. From an initial assumption that more context or a larger memory stream would straightforwardly improve a long-horizon agent's performance, through empirical findings that undermined that assumption, to increasingly structured memory and retrieval architectures that treat what is remembered, how it is organised and how it is retrieved as first-class design problems.

What the literature has addressed less thoroughly is the question of what is currently true, as distinct from what was ever observed. The question of whether a given memory entry can be trusted at all, as distinct from whether it can be retrieved efficiently.

Markovian case-state reconstruction with provenance-gated writes is proposed here as a response to both gaps, built from the vocabulary and mechanisms this literature has established. Tested against the author's own practitioner experience running long-horizon agents inside Tier 1 banks, offered as a considered starting position for further scrutiny rather than a settled answer.

References

1. Park, J. S., O'Brien, J., Cai, C. J., Morris, M. R., Liang, P. and Bernstein, M. S. (2023). Generative Agents: Interactive Simulacra of Human Behavior. arXiv:2304.03442.

2. Sumers, T. R., Yao, S., Narasimhan, K. and Griffiths, T. L. (2023). Cognitive Architectures for Language Agents. arXiv:2309.02427.

3. Liu, N. F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F. and Liang, P. (2023). Lost in the Middle: How Language Models Use Long Contexts. arXiv:2307.03172.

4. Hsieh, C.-P., Sun, S., Kriman, S., Acharya, S., Rekesh, D., Jia, F. and Ginsburg, B. (2024). RULER: What's the Real Context Size of Your Long-Context Language Models? arXiv:2404.06654.

5. Kuratov, Y., Bulatov, A., Anokhin, P., Rodkin, I., Sorokin, D., Sorokin, A. and Burtsev, M. (2024). BABILong: Testing the Limits of LLMs with Long Context Reasoning-in-a-Haystack. arXiv:2406.10149.

6. An, C., Huang, F., Zhang, J., Gong, S., Qiu, X., Zhou, C. and Kong, L. (2024). Why Does the Effective Context Length of LLMs Fall Short? arXiv:2404.08865.

7. Chroma Research (2025). Context Rot: How Increasing Input Tokens Impacts LLM Performance. Chroma Technical Report.

8. Mu, J., Li, X. L. and Goodman, N. (2023). Learning to Compress Prompts with Gist Tokens. arXiv:2304.08467.

9. Chevalier, A., Wettig, A., Ajith, A. and Chen, D. (2023). Adapting Language Models to Compress Contexts. arXiv:2305.14788.

10. Bertsch, A., Alon, U., Neubig, G. and Gormley, M. R. (2023). Unlimiformer: Long-Range Transformers with Unlimited Length Input. arXiv:2305.01625.

11. Xiao, G., Tian, Y., Chen, B., Han, S. and Lewis, M. (2023). Efficient Streaming Language Models with Attention Sinks. arXiv:2309.17453.

12. Fountas, Z., Benfeghoul, M. A., Oomerjee, A., Christopoulou, F., Lampouras, G., Bou-Ammar, H. and Wang, J. (2024). Human-like Episodic Memory for Infinite Context LLMs. arXiv:2407.09450.

13. Zhong, W., Guo, L., Gao, Q., Ye, H. and Wang, Y. (2023). MemoryBank: Enhancing Large Language Models with Long-Term Memory. arXiv:2305.10250.

14. Packer, C., Fang, V., Patil, S. G., Lin, K., Wooders, S. and Gonzalez, J. E. (2023). MemGPT: Towards LLMs as Operating Systems. arXiv:2310.08560.

15. Shinn, N., Cassano, F., Berman, E., Gopinath, A., Narasimhan, K. and Yao, S. (2023). Reflexion: Language Agents with Verbal Reinforcement Learning. arXiv:2303.11366.

16. Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Kuttler, H., Lewis, M., Yih, W., Rocktaschel, T., Riedel, S. and Kiela, D. (2020). Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. arXiv:2005.11401.

17. Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J. and Wang, H. (2023). Retrieval-Augmented Generation for Large Language Models: A Survey. arXiv:2312.10997.

18. Borgeaud, S., Mensch, A., Hoffmann, J., Cai, T., Rutherford, E., Millican, K., van den Driessche, G., Lespiau, J.-B., Damoc, B., Clark, A., de Las Casas, D., Guy, A., Menick, J., Ring, R., Hennigan, T., Huang, S., Maggiore, L., Jones, C., Cassirer, A., Brock, A., Paganini, M., Irving, G., Vinyals, O., Osindero, S., Simonyan, K., Rae, J. W., Elsen, E. and Sifre, L. (2021). Improving Language Models by Retrieving from Trillions of Tokens. arXiv:2112.04426.

19. Trivedi, H., Balasubramanian, N., Khot, T. and Sabharwal, A. (2022). Interleaving Retrieval with Chain-of-Thought Reasoning for Knowledge-Intensive Multi-Step Questions. arXiv:2212.10509.

20. Jiang, Z., Xu, F. F., Gao, L., Sun, Z., Liu, Q., Dwivedi-Yu, J., Yang, Y., Callan, J. and Neubig, G. (2023). Active Retrieval Augmented Generation. arXiv:2305.06983.

21. Asai, A., Wu, Z., Wang, Y., Sil, A. and Hajishirzi, H. (2023). Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection. arXiv:2310.11511.

22. Edge, D., Trinh, H., Cheng, N., Bradley, J., Chao, A., Mody, A., Truitt, S. and Larson, J. (2024). From Local to Global: A Graph RAG Approach to Query-Focused Summarization. arXiv:2404.16130.

23. Gutierrez, B. J., Shu, Y., Gu, Y., Yasunaga, M. and Su, Y. (2024). HippoRAG: Neurobiologically Inspired Long-Term Memory for Large Language Models. arXiv:2405.14831.

24. Khandelwal, U., Levy, O., Jurafsky, D., Zettlemoyer, L. and Lewis, M. (2019). Generalization through Memorization: Nearest Neighbor Language Models. arXiv:1911.00172.

25. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T. and Fritz, M. (2023). Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv:2302.12173.

26. Chen, Z., Xiang, Z., Xiao, C., Song, D. and Li, B. (2024). AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases. arXiv:2407.12784.

27. Zou, A., Wang, Z., Kolter, J. Z. and Fredrikson, M. (2023). Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv:2307.15043.

28. Wang, G., Xie, Y., Jiang, Y., Mandlekar, A., Xiao, C., Zhu, Y., Fan, L. and Anandkumar, A. (2023). Voyager: An Open-Ended Embodied Agent with Large Language Models. arXiv:2305.16291.