arXiv CSopen access

FORGE: Self-Evolving Agent Memory With No Weight Updates via Population Broadcast

FORGE: Self-Evolving Agent Memory With No Weight Updates via Population Broadcast Igor Bogdanov

[email protected] Carleton University Ottawa, Ontario, Canada

arXiv:2605.16233v1 [cs.AI] 15 May 2026

Jie Gao

[email protected] Carleton University Ottawa, Ontario, Canada

Chung-Horng Lung

[email protected] Carleton University Ottawa, Ontario, Canada

Adrian Taylor

[email protected] Defence R&D Canada Ottawa, Ontario, Canada

Abstract Can LLM agents improve decision-making through self-generated memory without gradient updates? We propose FORGE (FailureOptimized Reflective Graduation and Evolution), a staged, populationbased protocol that evolves prompt-injected natural-language memory for hierarchical ReAct agents. FORGE wraps a Reflexion-style inner loop, where a dedicated reflection agent (using the same underlying LLM, no distillation from a stronger model) converts failed trajectories into reusable knowledge artifacts: textual heuristics (Rules), few-shot demonstrations (Examples), or both (Mixed), with an outer loop that propagates the best-performing instance’s memory to the population between stages and freezes converged instances via a graduation criterion. We evaluate on CybORG CAGE-2, a stochastic network-defense POMDP at a 30-step horizon against the B_line attacker, where all four tested LLM families (Gemini2.5-Flash-Lite, Grok-4-Fast, Llama-4-Maverick, Qwen3-235B) exhibit strongly negative, heavy-tailed zero-shot rewards. Compared against both a zero-shot baseline and a Reflexion baseline (isolated single-stream learning), FORGE improves average evaluation return by 1.7-7.7× over zero-shot and by 29-72% over Reflexion in all 12 model-representation conditions, reducing major-failure rates (below −100) to as low as ∼1%. We find that (1) population broadcast is the critical mechanism, with a no-graduation ablation confirming that broadcast carries the performance gains while graduation primarily saves compute; (2) Examples achieves the strongest returns for three of four models, while Rules offers the best cost-reliability profile with ∼40% fewer tokens; and (3) weaker baseline models benefit disproportionately, suggesting FORGE may mitigate capability gaps rather than amplify strong models. All evidence is confined to CAGE-2 B_line; cross-family findings are directional evidence.

CCS Concepts • Computing methodologies → Artificial intelligence; Multiagent systems; Intelligent agents; Partially-observable Markov Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). ACM CAIS ’26, San Jose, CA, USA © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2415-2/26/05 https://doi.org/10.1145/3786335.3813155

Thomas Kunz

[email protected] Carleton University Ottawa, Ontario, Canada

Marzia Zaman

[email protected] Cistel Technology Ottawa, Ontario, Canada

decision processes; Reinforcement learning; Planning and scheduling; Natural language processing.

Keywords LLM agents, self-improvement, memory evolution, populationbased training, prompt-only learning, cyber defense, POMDP ACM Reference Format: Igor Bogdanov, Chung-Horng Lung, Thomas Kunz, Jie Gao, Adrian Taylor, and Marzia Zaman. 2026. FORGE: Self-Evolving Agent Memory With No Weight Updates via Population Broadcast. In ACM Conference on AI and Agentic Systems (ACM CAIS ’26), May 26–29, 2026, San Jose, CA, USA. ACM, New York, NY, USA, 19 pages. https://doi.org/10.1145/3786335.3813155

1

Introduction

Large language models (LLMs) can act as general-purpose reasoning engines for sequential decision-making with ability to self-reflect and improve when embedded in agentic scaffolds such as ReAct [23], Reflexion [15], and Voyager [20]. Yet most such agents remain single-episode systems: they reason and act within an episode, but retain little actionable knowledge that reliably improves future behavior. This gap is especially problematic in stochastic, partially observable environments where policies must be discovered through repeated interactions rather than specified in advance. Since fine-tuning is often infeasible and expensive, prompt-only self-improvement offers a promising alternative. However, three critical questions remain for applying this to stochastic, long-horizon sequential decision-making: (1) What should be remembered? Existing approaches typically commit to a single representation (heuristics/rules or behavior examples) without controlled comparison. (2) How should memory propagate? Unlike serial reflection, population-based training suggests parallel exploration could accelerate learning, but its prompt-only analogue is underexplored. (3) Is the training method transferable across LLMs? Whether gradient-free evolution yields consistent gains across diverse model families remains an open empirical question. We address these questions via FORGE, a staged population protocol where 𝑁 hierarchical ReAct agents evolve prompt-injected memory over 𝑆 stages. We evaluate four model families (Gemini2.5-Flash-Lite, Grok-4-Fast, Llama-4-Maverick, Qwen3-235B) under three conditions: zero-shot, Reflexion [15] (isolated single-stream learning), and FORGE (Reflexion plus population broadcast and

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

graduation), comparing three memory representations across multiple independent sessions per model. We study this challenge in CybORG CAGE-2 [8], a stochastic cyber-defense POMDP that combines four properties making it a demanding stress test for prompt-only adaptation: (1) a long horizon (30 steps) with partial observability, where LLM-based defense remains underexplored; (2) near-catastrophic zero-shot LLM performance, so memory-based learning is genuinely necessary; (3) scalar per-step reward with no natural-language feedback, requiring the agent to infer from numerical signals alone what went wrong; and (4) a practically important domain with a public leaderboard (DRL top score −3.47 [8]) providing absolute reference points. In this setting, a ReAct agent based on four contemporary LLM families without any environment knowledge displays deeply negative zero-shot returns. All evidence in this paper is confined to CAGE-2 B_line red agent at a 30-step horizon; generalization to other attacker types and environments remains future work. Contributions. Our main contributions are: (1) A populationbased, gradient-free self-improvement protocol, FORGE. The protocol evolves prompt-injected natural-language memory through staged learning with champion broadcast and graduation-based early stopping. We compare three conditions – zero-shot, Reflexion (isolated reflection, no broadcast), and FORGE – and observe 1.7–7.7× improvements in average returns over zero-shot, with the single best observed checkpoint return reaching −3.60 (against a maximum of 0 and a DRL top score of −3.47); (2) A controlled comparison of memory representations in a stochastic longhorizon environment. Rules, Examples, and Mixed representations reach comparable final performance in the replicated Gemini study, with Examples achieving the best return (−24.5) and Rules offering the best cost-reliability profile with higher graduation rates and ∼40% fewer tokens than Examples; (3) Evidence that population-level transfer is critical. Champion broadcast improves performance by 29–72% over the Reflexion baseline in all 12 model-representation conditions and reduces catastrophic-failure rates to as low as ∼1%; and (4) Directional cross-family evidence. FORGE improves over both zero-shot and Reflexion for all four tested model families, with disproportionately higher gains on weaker baselines.

2

Related Work

Prompt-Only Self-Improvement & Baseline Selection. A growing body of literature explores replacing weight updates with linguistic feedback. Reflexion [15] stores critiques after failures, while Self-Refine [9] applies iterative critiques within a single response. CLIN [10] extends prompt-only self-improvement to cross-episode causal-memory abstractions. Recent work on context evolution and test-time adaptation highlights that unconstrained self-edits can accumulate errors, motivating mechanisms that select and propagate only robust improvements across trials [17, 25]. TextGrad [24] takes a complementary approach, performing gradient descent over text representations using LLM-generated feedback as the optimization signal. Voyager [20] and ExpeL [26] learn reusable skills or experience from successful episodes. Among these, Reflexion is the directly comparable baseline in our setting: it requires only a scalar success/failure indicator, applies failure-triggered verbal memory

Bogdanov et al.

updates, and needs no task-specific engineering to operate with CAGE-2’s per-step reward signal. The remaining methods would each require nontrivial adaptation: Voyager and ExpeL depend on reusable successes, scarce at CAGE-2 initialization where zero-shot performance is near-catastrophic; CLIN is built for structured textsimulator feedback rather than scalar per-step reward; Dynamic Cheatsheet [17] and ACE [25] use update regimes that differ from scalar per-step cyber-defense reward; and TextGrad would require an auxiliary evaluator to convert environment reward into the textual optimization signal it expects (it is the most tractable future comparison). We therefore adopt Reflexion as the primary baseline and compare it against FORGE under identical model, memory representation, and training budget. Memory Representations. How to efficiently represent the knowledge that an agent should remember still remains an open question. Systems like AutoGuide [5], ExpeL [26], and Voyager [20] demonstrate the value of learning guidelines, experience, or skills represented by executable code. Complementary systems treat memory as a managed context resource or workflow artifact, e.g., MemGPT [12], Agent Workflow Memory [21], and Dynamic Cheatsheet [17], but they rarely provide controlled comparisons of representation choices under identical training dynamics. While prior work compares instructions vs. exemplars in single-step tasks [19] or even sequential decision-making [14], we extend artifact efficiency comparison to adversarial POMDPs, evaluating Rules, Examples, and Mixed representations under identical staged learning conditions. Population-Based Selection. Population-Based Training (PBT) [7] is a canonical strategy for parallel exploration. Unlike classic hyperparameter PBT, our population mechanism selects among textual artifacts that shape the agent’s policy via prompting. Whereas prompt-evolution methods typically optimize a single monolithic prompt and focus on single-step tasks [4, 6, 22], we evolve structured lists of rules or examples, tied to specific failure modes, enabling targeted repairs without damaging unrelated competencies. Cyber Defense Agents. CybORG [16] and the CAGE-2 challenge [8] provide a rigorous SOTA testbed currently dominated by reinforcement learning (RL) methods. Prior LLM-based cyber defenders are often evaluated either as fixed-prompt policies in CAGE-2 [11] or in later CybORG variants (e.g., CAGE 4) as components within hybrid multi-agent systems [3]. Our work demonstrates that LLM agents can improve their defense policies online without gradient updates. Positioning. Our work combines three separate directions: (1) gradient-free self-improvement, (2) memory representation, and (3) population-based selection into a coherent protocol. Unlike memory-centric architectures that store complete records of agentic behavior [13], FORGE performs explicit trajectory analysis to update structured knowledge artifacts for specialized sub-agents, aligning with modular agent design patterns [18]. Our approach builds a Reflexion-inspired [15] inner loop on ReAct [23] scaffolding and wraps it with population-level selection and broadcast for hierarchical agents in an adversarial, stochastic cyber-defense POMDP.

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Figure 1: System Overview. (Left) Hierarchical ReAct agent with dynamic memory injection. (Right) Reflexion learning loop: upon a reward below threshold, a dedicated Reflector or Exemplifier agent analyzes the full trajectory and synthesizes knowledge artifacts that are injected back into the agent’s memory.

3

Method

We introduce FORGE (Failure-Optimized Reflective Graduation and Evolution), a multi-stage population protocol for evolving promptinjected memory without weight updates. The method has three components: (1) a hierarchical ReAct agent with dynamic and persistent memory sections (Figure 1, left); (2) an inner Reflexion-style learning loop [15] that converts failures into reusable knowledge artifacts (Figure 1, right); and (3) an outer population protocol that runs parallel instances in stages and propagates the best-discovered memory via champion broadcast (Figure 2). A critical design constraint is that no external oracle or stronger model is used: the same LLM generates actions and synthesizes memory.

3.1

Agent Architecture: Hierarchical ReAct with Dynamic Memory Injection

Figure 1 (left) illustrates the hierarchical agent architecture. At each environment step, a top-level Planner selects the final defense action while delegating two sub-tasks to on-demand (implemented as tools) ReAct sub-agents: Analyst (interprets host-level observations) and ActionChooser (ranks valid actions with justification). All agents use the same underlying LLMs, and differ only in their role-specific system prompts and their injected memory. The FORGE protocol runs 𝑁 copies of this agent hierarchy in parallel, each called an instance. Instance 𝑖 ∈ {1, ..., 𝑁 } maintains persistent and dynamic memory 𝑀𝑖 = (𝑀𝑖𝑃 , 𝑀𝑖𝐴 , 𝑀𝑖𝐶 ) for the Planner, Analyst, and ActionChooser. Persistent memory is instructions and specific knowledge set by the user; in this setup, only the ActionChooser and the learning agents (Reflector, Exemplifier) receive the environment action reference table, while the Planner has no pre-supplied action knowledge so that any strategic competence it acquires is attributable to learned artifacts. Dynamic memory is initially empty and accumulates knowledge artifacts generated by the

Algorithm 1 Failure-Triggered Reflexion Loop Require: Agent instance with memory 𝑀𝑖 , attempts 𝑘𝐴 , failure trigger 𝜏, representation ∈ {Rules, Examples, Mixed} 1: for 𝑎 = 1 to 𝑘𝐴 do 2: Track per-step reward 𝑟𝑠𝑡𝑒𝑝 3: Run episode with memory 𝑀𝑖 4: if ∃ 𝑠𝑡𝑒𝑝 such that 𝑟𝑠𝑡𝑒𝑝 < 𝜏 then Abort; snapshot ← trajectories, 𝑀𝑖 , metadata, environment state 5: 6: Δ ← UpdateMemory(snapshot, representation) ⊲ Reflector / Exemplifier 7: Apply edits: 𝑀𝑖 ← Apply(𝑀𝑖 , Δ) 8: end if 9: end for 10: return Updated memory 𝑀𝑖

learning agents during training. The representation of these artifacts is the central experimental variable, taking one of three forms: (a) Rules: ordered lists of conditional heuristics; (b) Examples: structured demonstrations that mimic ReAct agent interaction (thought, tool, observation, answer) [23]; or (c) Mixed: both rules and examples generated separately over the same context. Appendix C provides verbatim examples of generated Rules and Examples artifacts. Memory is stored on disk and re-injected into each agent’s system prompt at every attempt, with a fixed capacity to prevent unbounded context growth. Sub-agents are instantiated on-demand within the Planner’s reasoning loop with their own prompts and memory.

3.2

Inner Loop: Failure-Triggered Reflexion

Figure 1 (right) illustrates the learning mechanism. Within each episode, the agent executes actions until completion or until a perstep reward 𝑟𝑠𝑡𝑒𝑝 drops below a failure threshold 𝜏. Upon failure, the

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Bogdanov et al.

Figure 2: Protocol Details. (Left) The FORGE protocol involves parallel execution, champion selection, graduation and broadcast between stages. (Right) Inner learning loop inside each attempt. episode is aborted immediately and the full trajectory is captured. A dedicated learning agent using the same underlying LLM, Reflector (for Rules) or Exemplifier (for Examples), analyzes the trajectory up to the failure point together with the environment state and synthesizes a knowledge artifact: either a conditional heuristic (Rules) or a structured interaction demonstration (Examples). In the Mixed condition, both agents generate artifacts over the same context. The generated artifact is appended to the agent’s memory, and the episode restarts from step 0. This abort-and-restart cycle converts failures into a structured learning sequence, iterating up to 𝑘𝐴 attempts per stage. Algorithm 1 formalizes this loop. This loop constitutes a complete single-stream learning system implementing the Reflexion pattern [15]. When run in isolation, each instance independently accumulates memory from its own trajectories without any cross-instance knowledge transfer. However, single-stream reflection in stochastic, partially observable environments lacks a selection pressure that distinguishes genuine policy improvement from noise: isolated instances can accumulate counterproductive artifacts that degrade performance below the zero-shot starting point, and even successful instances produce high-variance policies. A population-based protocol that runs multiple instances in parallel and propagates only the best-performing memory addresses this limitation structurally.

3.3

Outer Loop: The FORGE Protocol

To address the instability of isolated Reflexion, we propose FORGE, a multi-stage, population-based protocol that wraps the Reflexion inner loop (Algorithm 1) with three additional mechanisms: staged training that creates periodic synchronization points, champion broadcast that propagates the best-discovered memory to the population, and graduation that freezes strong solutions and conserves compute. Figure 2 illustrates the protocol and Algorithm 2 formalizes it. FORGE adapts the Population-Based Training (PBT) framework [7] from weight space to prompt space. The PBT exploit step maps to champion broadcast, which copies the best instance’s memory

Algorithm 2 FORGE: Staged Population Memory Training Require: Instances 𝑁 , stages 𝑆, attempts 𝑘𝐴 , graduation threshold 𝜃 , failure trigger 𝜏, representation, condition ∈ {FORGE, Reflexion} 1: Initialize dynamic memory 𝑀𝑖 ← ∅ for 𝑖 ∈ {1, . . . , 𝑁 } 2: Initialize graduated set 𝐺 ← ∅ 3: for 𝑠 = 1 to 𝑆 do ⊲ Outer loop: staged knowledge transfer 4: Initialize each instance 𝑖 in a uniquely seeded CAGE-2 environment with 𝑀𝑖 5: Initialize attempt graduated set 𝐻 ← ∅ 6: Initialize checkpoint Return 𝑅𝑖 = 0 7: for instance 𝑖 ∉ 𝐺 in parallel do ⊲ Concurrent Independent Instances 8: 𝑀𝑖 ← ReflexionLoop(𝑀𝑖 , 𝑘𝐴 , 𝜏, representation) ⊲ Algorithm 1 9: 𝑅𝑖 ← Checkpoint(𝑀𝑖 ) ⊲ frozen evaluation, no learning 10: end for 11: 𝐻 ← {𝑖 ∉ 𝐺 | 𝑅𝑖 > 𝜃 } ⊲ new graduates 12: Freeze memories of 𝐻 ; 𝐺 ← 𝐺 ∪ 𝐻 13: if condition = FORGE and |{𝑖 ∉ 𝐺 }| > 0 then 14: 𝑖 ∗ ← arg max𝑖∉𝐺 𝑅𝑖 ⊲ champion selection 15: for instance 𝑖 ∉ 𝐺 do 16: 𝑀𝑖 ← 𝑀𝑖 ∗ ⊲ broadcast: full memory replacement 17: end for 18: end if 19: end for 20: return Final evaluation of all 𝑁 frozen instances.

artifacts to all active instances; the explore step maps to the Reflexion inner loop, which independently evolves each instance’s memory through failure-triggered reflection within the next stage. Two structural differences follow from operating on discrete textual artifacts rather than continuous weights: (1) broadcast performs full replacement rather than interpolation, because merging two natural-language rule sets would require a conflict-resolution

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Table 1: Experiment Count and Evaluated Episodes by Model and Condition

Model Gemini-2.5-Flash-Lite Grok-4-Fast Llama-4-Maverick Qwen3-235B

Zero-Shot

Reflexion (instances)

Episodes

Rules

Ex

Mix

Rules

Ex

Mix

Rules

Ex

Mix

70 100 50 50

70 30 70 30

50 30 30 30

50 30 30 50

7 (70) 3 (60) 3 (110) 4 (80)

7 (70) 3 (60) 3 (60) 3 (60)

7 (140) 3 (60) 3 (60) 3 (60)

2 (40) 2 (40) 2 (40) 2 (40)

2 (40) 2 (40) 2 (40) 2 (40)

2 (40) 2 (40) 2 (40) 2 (40)

mechanism that is itself unreliable, and (2) the explore step is not a random perturbation but a semantically grounded reflection on new failure trajectories. Staged Training. Training is organized into 𝑆 sequential stages. At the beginning of each stage, every active instance is initialized in a uniquely seeded environment with its current memory 𝑀𝑖 . Within the stage, each instance independently executes the Reflexion loop (Algorithm 1) for up to 𝑘𝐴 attempts. Stages serve as synchronization points: all instances complete their inner-loop attempts before any between-stage mechanism (checkpoint, graduation, broadcast) is applied. Champion Broadcast. After each stage, a frozen checkpoint evaluation produces a return 𝑅𝑖 for each active instance. The instance with the highest checkpoint return among active (non-graduated) instances is designated the champion, and its complete memory state replaces the memory of every other active instance. This is a destructive operation: each recipient discards its own accumulated artifacts and begins the next stage from the champion’s memory. The design prioritizes convergence toward the best-discovered strategy over preserving population diversity. Graduation and Early Stopping. Instances whose checkpoint return exceeds a graduation threshold 𝜃 are graduated: their memory is frozen and they are excluded from all subsequent stages. Graduation prevents regression by locking strong solutions before the next broadcast cycle can overwrite them, and conserves compute by excluding converged instances from further training. When broadcast is disabled (condition = Reflexion), the protocol reduces to parallel independent Reflexion, the baseline against which FORGE is compared. After all stages complete, every instance (graduated or not) undergoes a final frozen evaluation.

4

Experimental Setup

Evaluation Task and Environment: CybORG CAGE-2. We evaluate FORGE on CybORG CAGE-2 [8, 16], a cybersecurity gym environment modelled as POMDP where a blue defender protects a 13-host enterprise network against an automated red attacker over a 30-step horizon (canonical setting also includes 50- and 100-step episodes). CAGE-2 leaderboard is dominated by RL methods; public reference points against the B_line attacker over 30 steps include CardiffUni PPO −3.47 (DRL top score) [2], rule-based heuristic −58.83, random action −154.06, and no-action (sleeping) −218.65 [8]. We define two failure severity levels anchored to this scale: return < −100 (major failure, between the heuristic and random baselines) and return < −150 (catastrophic failure, near-random performance). Conversely, returns above −50 represent significant improvement

FORGE (sessions)

FORGE w/o grad (sessions)

Table 2: Models, FORGE Configuration, and Metrics Category

Configuration / Description

Models

Gemini-2.5-Flash-Lite (Primary), Grok-4-Fast, Llama-4Maverick, Qwen3-235B Agent (Planner/Analyst/ActionChooser): temp=0, max_tokens=10000 Learning (Reflector/Exemplifier): temp=0, max_tokens=20000 Zero-shot: Empty memory, no training Reflexion: Isolated single-stream reflection, no broadcast FORGE: Reflexion + champion broadcast + graduation FORGE w/o grad: Reflexion + champion broadcast, no graduation Rules, Examples, or Mixed memory

LLM Config

Conditions

Representations Protocol Params Hyperparameters Metrics

𝑁 = 10 parallel instances, 𝑆 = 6 stages, 𝑘𝐴 = 3 attempts per stage Failure trigger 𝜏 = −1.1 (per-step reward); Graduation 𝜃 = −15 (episode return) Í Evaluation Return: Mean return (𝑅 = 𝑟𝑠𝑡𝑒𝑝 , closer to 0 is better) Graduation Rate: % of instances reaching 𝜃 = −15 during checkpoint Token Cost: Total prompt + completion tokens (training + eval) Tail Risk: Frequency of catastrophic failures (return < −100)

over the rule-based heuristic (−58.83), approaching the regime of competitive RL policies. Failure Trigger Sensitivity. The failure trigger 𝜏 = −1.1 is derived from the environment’s reward structure rather than tuned as a hyperparameter. Additionally, analysis of per-step penalties across 540 zero-shot episodes (Appendix D) reveals that penalties fall into distinct groups: Restore actions always cost −1.0 and are legitimate defensive operations, not failures; small failures cost −1.1 or −1.2; moderate failures −2.0 to −3.2; and severe failures −11 to −14 (with no values between −3.3 and −10.9). Since the trigger fires when 𝑟𝑠𝑡𝑒𝑝 < 𝜏, setting 𝜏 = −1.1 is the smallest threshold that excludes legitimate Restore penalties (exactly −1.0) while capturing real failures with 100% precision (zero false positives) at 74% recall (7,346 of 9,926 true triggers). A sensitivity sweep over 𝜏 ∈ {−1.1, −2.0, −3.0, −11.0}, corresponding to the natural penalty groups, is reported alongside the main results. We set graduation

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Bogdanov et al.

Table 3: Combined results: mean return ± SD by model, representation, and condition. ↑ = improvement, ↓ = degradation over the reference column. Bold marks the best result per model across all FORGE variants. Reflexion Model

Zero-Shot Representation

Gemini

Mean±SD

−189.6 ± 53.9

Rules Examples Mixed

−62.7 ± 60.5 −78.9 ± 60.4 −81.9 ± 74.6

−58.4 ± 55.2

Rules Examples Mixed

−79.9 ± 62.6 −64.8 ± 52.4 −114.4 ± 76.8

−113.1 ± 81.5

Rules Examples Mixed

−101.4 ± 61.0 −53.9 ± 59.7 −44.2 ± 40.6

−103.3 ± 87.3

Rules Examples Mixed

−88.4 ± 83.5 −57.6 ± 69.5 −80.4 ± 89.4

Grok

Llama

Qwen

FORGE ΔZS

−30.6 ± 37.0 −24.5 ± 21.1 ↑57% −32.2 ± 28.1

ΔZS ΔRefl

Mean±SD

↑83%

−33.1 ± 26.5 −37.7 ± 27.2 ↑61% −32.7 ± 30.7

↑42%

↑58%

ΔZS ΔRefl ΔFORGE

↑67%

↑84%

↑51%

↑83%

↑47%

↑58%

↑87%

↑69%

↑80%

↑52%

↓37%

−33.7 ± 26.1 ↓11% −42.7 ± 43.3 ↓96% −42.2 ± 36.9

↓8%

↓54%

↑83%

↑60%

↓1%

↑58%

↑69%

↑27%

↑76%

↑78%

↑67%

↑60%

↑80%

↑45%

↑28%

−24.5 ± 15.1 ↑34% −14.0 ± 2.0 ↑63% −23.2 ± 19.4

↑10%

↑36%

↑29%

↑32%

↑24%

↑52%

↑75%

↑48%

↑63%

↑22%

↓49%

↑79%

↑46%

↑19%

↑83%

↑80%

↑31%

↑85%

↑73%

↑36%

↑83%

↑78%

↑39%

−72.0 ± 46.6 −28.3 ± 15.7 ↑61% −29.6 ± 25.6 −25.2 ± 21.0 ↑44% −24.3 ± 35.8 ↑22% −29.3 ± 20.4 ↑14%

threshold 𝜃 = −15, which corresponds to roughly 10× improvement over random agent performance [8]. Evaluation Modes. To explicitly distinguish selection from reporting, we define two evaluation modes: (1) Checkpoint: a frozen single-episode probe used during training to determine graduation and champion selection and (2) Post-Session Evaluation: a separate measurement of frozen instances, obtained after full FORGE session completion. Gemini-2.5-Flash-Lite serves as the primary study model with 7 independent FORGE sessions per representation followed by 1-2 evaluations per instance. Other models receive 3–4 FORGE sessions per representation as directional cross-family probes (Table 1) followed by at least 2 evaluations per instance. The no-graduation ablation receives 2 sessions per model per representation across all four families followed by at least 2 evaluations per instance. Baselines and Conditions. All results are compared against two baselines. The zero-shot baseline evaluates the agent with empty memory and no training, measuring the total improvement attributable to memory evolution. The Reflexion baseline runs the same failure-triggered reflection loop (Algorithm 1) but without champion broadcast: each instance evolves its own memory in isolation. Comparing FORGE against zero-shot quantifies the overall gain; comparing against Reflexion isolates the specific contribution of population-level knowledge transfer. We evaluate four LLM families under four conditions (Table 2): zero-shot, Reflexion, FORGE (Reflexion plus broadcast and graduation, Algorithm 2), and FORGE without graduation (broadcast only). Each trained condition is crossed with three memory representations (Rules, Examples, Mixed). Table 1 breaks down session and episode counts per condition.

5

Mean±SD

FORGE w/o grad

Results

We compare four conditions (zero-shot, Reflexion, FORGE, and FORGE without graduation) across four model families and three memory representations (Table 3). Results are organized around five questions: (1) the magnitude of improvement over zero-shot and Reflexion baselines across model families, (2) the comparative efficacy

↑27%

↑74%

−76.7 ± 54.7 −42.2 ± 35.3 ↑33% −23.8 ± 9.3

↑76%

↑72%

↑77%

↑58%

↑72%

↑64%

−17.3 ± 2.6 −15.5 ± 2.3 −17.9 ± 2.8

↓7%

of memory representations (Rules vs. Examples vs. Mixed), (3) token cost and graduation dynamics, (4) cross-model generalization patterns, and (5) the contribution of population broadcast versus isolated Reflexion. We additionally report a no-graduation ablation that isolates the contribution of graduation from that of broadcast. A sensitivity sweep over the failure trigger threshold 𝜏 probes whether the chosen value (−1.1) is optimal or whether restricting reflection to more severe failures changes convergence behavior. We report post-session evaluation metrics unless explicitly referring to checkpoint probes used for intermediate champion selection.

5.1

Main Findings

Performance over Zero-Shot and Reflexion. FORGE improves over both zero-shot and Reflexion baselines for every model family under all three representations (Table 3). Under the FORGE protocol, the strongest configurations reduce mean negative returns to the midtwenties: Gemini improves from −189.6 to −24.5 (Examples, 7.7×), Qwen from −103.3 to −24.3 (Examples, 4.3×), Llama from −113.1 to −28.3 (Examples, 4.0×), and Grok from −58.4 to −33.7 (Rules, 1.7×). Compared to the Reflexion baseline, FORGE improves in all 12 model-representation conditions (Table 3, ΔRefl columns). Figure 3 provides a detailed comparison across all models under each representation. The peak observed checkpoint return reaches −3.60 (Gemini Rules), approaching the DRL top score of −3.47, although post-session evaluation means remain lower due to sampling variance. Representation Analysis. Figure 3 compares all three representations across all four models under zero-shot, Reflexion, and FORGE conditions. Examples achieves the best FORGE return for three of four models (Gemini, Llama, Qwen), while Grok performs best under Rules. In the replicated Gemini study (7 sessions per condition), all three representations yield large improvements over the zeroshot baseline (−189.6): Examples −24.5 ± 21.1, Rules −30.6 ± 37.0, and Mixed −32.2 ± 28.1. Examples achieves the best mean return and lowest variance, while Rules provides the most reliable costperformance profile with ∼40% fewer total tokens than Examples

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Figure 3: Comparison of memory representations (Rules, Examples, and Mixed) across zero-shot, Reflexion, and FORGE conditions for all four model families. Bars represent mean return; error bars denote SEM. Improvement factors over zero-shot annotated above FORGE bars; checkmarks indicate the winning condition.

Figure 4: Combined analysis for Gemini-2.5-Flash-Lite. (A) Performance: All representations consistently outperform Baseline. (B) Token Cost: Rules representation is more efficient than others. (C) Evaluation Cost-Benefit: Rules offers best balance of low cost and high return. (Figure 4, Panel B). This efficiency gap arises because example-based memory inflates prompt length, while rule-based artifacts are more compact and lead to faster graduation. Mixed falls between the two on both cost and performance (Figure 4). Token Cost Analysis. In the replicated Gemini study (Figure 4, Panel B), Rules consumes ∼106M total tokens compared to ∼177M for Examples and ∼188M for Mixed, a ∼40% cost reduction. This efficiency stems from both shorter prompts and fewer active instances due to faster graduation. The no-graduation variants consume more tokens across all representations because all 10 instances remain active for all 6 stages, confirming that graduation’s primary contribution is compute savings (Figure 4, Panel C). Cross-Model Analysis: Weak Models Benefit Most. We examine generalization across model families as directional evidence (nonGemini models receive 3-4 FORGE sessions per representation). The magnitude of improvement inversely correlates with baseline strength: Gemini (worst baseline, −189.6) gains 7.7×, followed by

Qwen (4.3×) and Llama (4.0×), while Grok (best baseline, −58.4) gains 1.7× (Figure 3). This pattern suggests FORGE functions primarily as a variance-reduction mechanism for unreliable policies, mitigating capability gaps rather than amplifying strong models. For every tested family, FORGE outperforms both zero-shot and Reflexion under all three representations.

Population Broadcast vs. Isolated Reflexion. Comparing FORGE against the Reflexion baseline isolates the contribution of populationlevel knowledge transfer (Figure 5, Panel A). FORGE improves post-session evaluation return by 29-72% over Reflexion in all 12 model-representation conditions (Table 3, ΔRefl columns). The nograduation variant also outperforms Reflexion in all 12 conditions, confirming that champion broadcast is the essential mechanism. Reflexion instances exhibit persistently high volatility across stages (Figure 5, Panel B), whereas FORGE steadily compresses score variance.

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Bogdanov et al.

Figure 5: Protocol comparison. (A) Mean evaluation return across four models under four conditions: FORGE, FORGE without graduation, Reflexion (isolated learning), and zero-shot. FORGE and its no-graduation variant both outperform Reflexion and zero-shot for every model. (B) Standard deviation of checkpoint scores across stages; FORGE reduces volatility steadily while Reflexion remains near the zero-shot level (dashed).

Figure 6: Graduation dynamics and no-graduation ablation (all models pooled). (A) Active instances and per-instance compute by stage: FORGE (solid lines) reduces active count via graduation, while the no-graduation variant (dashed) keeps all 10 instances active throughout. Faded bars show per-active-instance token cost. (B) Adaptation tokens per instance vs. final evaluation return by stage: FORGE’s per-instance cost drops as instances graduate; the no-graduation variant achieves a slightly better pooled evaluation return at higher total cost. Reflexion baseline (dotted) shown for reference.

5.2

Ablation: No-Graduation

The no-graduation variant retains champion broadcast but keeps all 10 instances active throughout all 6 stages, isolating the contribution of graduation from that of broadcast. Across models, FORGE reduces the active instance count as stages progress (Figure 6, Panel A, solid lines), with per-instance adaptation cost dropping as instances graduate. The no-graduation variant (dashed) consumes roughly twice the adaptation tokens per instance by S6 (Figure 6, Panel B). The effect of graduation on final performance is model-dependent: removing it helps Grok and Qwen (up to 67% improvement over FORGE, Table 3), while Gemini and Llama perform better with

graduation in 2 of 3 representations. This split suggests that graduation’s memory-freezing mechanism protects strong early-stage artifacts in some models but terminates learning prematurely in others. Both FORGE variants outperform the Reflexion baseline in all 12 conditions, confirming that broadcast is the essential mechanism regardless of whether graduation is enabled.

5.3

Sensitivity: Failure Trigger Threshold

The failure trigger 𝜏 determines which per-step penalties invoke reflection and restart the episode, directly controlling the learning signal’s composition. To assess whether the chosen 𝜏 = −1.1 is optimal, we sweep 𝜏 ∈ {−1.1, −2.0, −3.0, −11.0} on Gemini Rules

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Figure 7: Risk and variance analysis. (A) Cumulative distribution of evaluation scores (all models pooled): zero-shot shows a heavy left tail; Reflexion partially compresses it; FORGE shifts the distribution sharply rightward. (B) Mean return ± SD by model under zero-shot, Reflexion, and FORGE (best representation per model). (the primary configuration). The result is non-monotone: 𝜏 = −2.0 (mean −52.0) and 𝜏 = −3.0 (mean −46.0) both degrade relative to 𝜏 = −1.1 (mean −30.6, 83% graduation), while 𝜏 = −11.0 yields the best result (mean −24.6, 93% graduation). Restricting reflection to only the most severe failures appears to produce a cleaner learning signal, though skipping moderate failures hurts. The improvement at 𝜏 = −11.0 suggests that harsher triggers and multi-threshold triggering strategies warrant further investigation. The reward distribution motivating 𝜏 = −1.1 is detailed in Appendix D.

broader design space of harsher triggers and multi-threshold triggering remains unexplored. Future work should address these limitations by testing additional attacker variants. Promising extensions include cross-strategy seeding (e.g., Mixed from Rules), crossmodel artifact transfer, co-evolutionary adversarial training, costcontrolled comparisons against parameter-efficient fine-tuning to clarify the trade-offs of prompt-only adaptation, and replacing the Reflexion inner loop with alternative self-improvement methods (e.g., TextGrad [24], Dynamic Cheatsheet [17]) to test whether the population broadcast mechanism generalizes further.

6

8

Discussion

The protocol’s efficacy stems from four interacting mechanisms: (1) reducing major failures by eliminating the heavy tail of low zero-shot returns (Figure 7, Panel A); (2) compressing variance to stabilize outcomes (Figure 7, Panel B); (3) population-level distillation via champion broadcast; and (4) graduation-based early stopping to reduce compute. Figure 7, Panel A shows that Reflexion (orange) partially compresses the zero-shot tail, but FORGE shifts the distribution rightward, reducing the rate of episodes below −100 from ∼90% (zero-shot) to ∼1% under the strongest configurations. The broadcast mechanism’s consistent 29-72% improvement over Reflexion across all 12 conditions suggests that the primary bottleneck in prompt-only adaptation is not the quality of individual reflections but the absence of a selection pressure that propagates rare discoveries to the population.

7

Limitations & Future Work

Our study faces limitations in scope (single attacker type, fixed 30-step horizon in one application domain) and protocol dynamics (brittle single-best broadcast, checkpoint-evaluation misalignment). All evidence is confined to CAGE-2 B_line; generalization to other attacker types and POMDP environments remains untested. Crossfamily findings are presented as directional evidence based on 34 sessions per non-Gemini model. The failure trigger sensitivity sweep reveals that 𝜏 = −11.0 outperforms the submitted 𝜏 = −1.1, indicating that the chosen threshold is not optimal and that the

Conclusion

We introduced FORGE, a staged, population-based protocol for improving LLM agents via prompt-injected memory evolution, demonstrating that effective long-horizon strategies can be learned without gradient updates or stronger teacher models. By coupling a Reflexion-style inner loop that converts failures into dynamic knowledge artifacts (Rules, Examples, or both) with an outer loop that stabilizes learning through champion broadcast and graduationbased early stopping, FORGE achieves 1.7-7.7× improvement over zero-shot baselines and 29-72% improvement over the Reflexion baseline across all 12 model-representation conditions on CybORG CAGE-2 B_line at a 30-step horizon. Among representations, Examples achieves the strongest returns for three of four models, while Rules offers the best cost-reliability profile with ∼40% fewer tokens. The no-graduation ablation confirms that champion broadcast is the essential mechanism, with graduation primarily contributing compute savings. Cross-family results are directional evidence based on 3-4 sessions per non-Gemini model; generalization to other attacker types and environments remains future work. Within this benchmark, these results suggest that evolving interpretable natural-language memory provides a viable adaptation path for prompt-only learning in stochastic POMDPs where weight updates are infeasible, and encourage further research into alternative strategies. Reproducibility details and ethics considerations are in Appendix A. The archived artifact is available at https://doi.org/10.5281/zenodo.19907612; the development repository is available at https://github.com/isbogdanov/forge-protocol.

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

References [1] 2022. TTCP CAGE Challenge 2. https://github.com/cage-challenge/cagechallenge-2 [2] CardiffUni Team. 2022. CybORG CAGE-2 Winning Agent: PPO + Greedy Decoys. https://github.com/john-cardiff/-cyborg-cage-2. [3] Sebastián R. Castro, Roberto Campbell, Nancy Lau, Octavio Villalobos, Jiaqi Duan, and Alvaro A. Cardenas. 2025. Large Language Models are Autonomous Cyber Defenders. arXiv:2505.04843 [cs.CR] https://arxiv.org/abs/2505.04843 [4] Chrisantha Fernando, Dylan Sunil Banarse, Henryk Michalewski, Simon Osindero, and Tim Rocktäschel. 2024. PromptBreeder: Self-Referential SelfImprovement via Prompt Evolution. In The Twelfth International Conference on Learning Representations. arXiv:2309.16797 [cs.CL] https://openreview.net/ forum?id=HKkiX32Zw1 [5] Yao Fu, Dong-Ki Kim, Jaekyeom Kim, Sungryull Sohn, Lajanugen Logeswaran, Kyunghoon Bae, and Honglak Lee. 2024. AutoGuide: Automated Generation and Selection of Context-Aware Guidelines for Large Language Model Agents. In Advances in Neural Information Processing Systems. arXiv:2403.08978 [cs.AI] https://openreview.net/forum?id=mRIQz8Zd6O [6] Qingyan Guo, Rui Wang, Junliang Guo, Bei Li, Kaitao Song, Xu Tan, Guoqing Liu, Jiang Bian, and Yujiu Yang. 2024. Connecting Large Language Models with Evolutionary Algorithms Yields Powerful Prompt Optimizers. In The Twelfth International Conference on Learning Representations. arXiv:2309.08532 [cs.CL] https://openreview.net/forum?id=ZG3RaNIsO8 [7] Max Jaderberg, Valentin Dalibard, Simon Osindero, Wojciech M. Czarnecki, Jeff Donahue, Ali Razavi, Oriol Vinyals, Green Tim, Iain Dunning, Karen Simonyan, et al. 2017. Population Based Training of Neural Networks. arXiv:1711.09846 [cs.LG] https://arxiv.org/abs/1711.09846 [8] Mitchell Kiely, David Bowman, Maxwell Standen, and Christopher Moir. 2023. On Autonomous Agents in a Cyber Defence Environment. arXiv:2309.07388 [cs.CR] https://arxiv.org/abs/2309.07388 [9] Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, Shashank Gupta, Bodhisattwa Prasad Majumder, Katherine Hermann, Sean Welleck, Amir Yazdanbakhsh, and Peter Clark. 2023. Self-Refine: Iterative Refinement with Self-Feedback. In Advances in Neural Information Processing Systems. https: //openreview.net/forum?id=S37hOerQLB [10] Bodhisattwa Prasad Majumder, Bhavana Dalvi, Peter Jansen, Oyvind Tafjord, Niket Tandon, Li Zhang, Chris Callison-Burch, and Peter Clark. 2024. CLIN: A Continually Learning Language Agent for Rapid Task Adaptation and Generalization. In The Twelfth International Conference on Learning Representations. arXiv:2310.10134 [cs.AI] https://openreview.net/forum?id=d5DGVHMdsC [11] Hamoun Mohammadi, Jonathan J. Davis, and Mitchell Kiely. 2025. Leveraging Large Language Models for Autonomous Cyber Defense: Insights from CAGE-2 Simulations. IEEE Intelligent Systems 40, 4 (2025), 29–36. doi:10.1109/MIS.2025. 3568209 [12] Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. 2023. MemGPT: Towards LLMs as Operating Systems. arXiv:2310.08560 [cs.AI] https://arxiv.org/abs/2310.08560 [13] Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, Meredith Ringel Morris, Percy Liang, and Michael S. Bernstein. 2023. Generative Agents: Interactive Simulacra of Human Behavior. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology (UIST). doi:10.1145/3586183.3606763 [14] Vishnu Sarukkai, Zhiqiang Xie, and Kayvon Fatahalian. 2025. Self-Generated In-Context Examples Improve LLM Agents for Sequential Decision-Making Tasks. arXiv:2505.00234 [cs.LG] https://arxiv.org/abs/2505.00234 [15] Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik R. Narasimhan, and Shunyu Yao. 2023. Reflexion: Language Agents with Verbal Reinforcement Learning. In Advances in Neural Information Processing Systems. https: //openreview.net/forum?id=vAElhFcKW6 [16] Maxwell Standen, Martin Lucas, David Bowman, Toby J. Richer, Junae Kim, and Damian Marriott. 2021. CybORG: A Gym for the Development of Autonomous Cyber Agents. arXiv:2108.09118 [cs.CR] https://arxiv.org/abs/2108.09118 [17] Mirac Suzgun, Mert Yüksekgönül, Federico Bianchi, Dan Jurafsky, and James Zou. 2025. Dynamic Cheatsheet: Test-Time Learning with Adaptive Memory. arXiv:2504.07952 [cs.LG] https://arxiv.org/abs/2504.07952 [18] Khanh-Tung Tran, Dung Dao, Minh-Duong Nguyen, Quoc-Viet Pham, Barry O’Sullivan, and Hoang D. Nguyen. 2025. Multi-Agent Collaboration Mechanisms: A Survey of LLMs. arXiv:2501.06322 [cs.AI] https://arxiv.org/abs/2501.06322 [19] Xingchen Wan, Ruoxi Sun, Hootan Nakhost, and Sercan O. Arik. 2024. Teach Better or Show Smarter? On Instructions and Exemplars in Automatic Prompt Optimization. In Advances in Neural Information Processing Systems. arXiv:2406.15708 [cs.CL] https://openreview.net/forum?id=IdtoJVWVnX [20] Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar. 2023. Voyager: An Open-Ended Embodied Agent with Large Language Models. arXiv:2305.16291 [cs.AI] https://arxiv.org/ abs/2305.16291

Bogdanov et al.

[21] Zora Zhiruo Wang, Jiayuan Mao, Daniel Fried, and Graham Neubig. 2025. Agent Workflow Memory. In International Conference on Machine Learning. arXiv:2409.07429 [cs.AI] https://openreview.net/forum?id=NTAhi2JEEE [22] Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc V. Le, Denny Zhou, and Xinyun Chen. 2024. Large Language Models as Optimizers. In The Twelfth International Conference on Learning Representations. arXiv:2309.03409 [cs.LG] https://openreview.net/forum?id=Bb4VGOWELI [23] Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R. Narasimhan, and Yuan Cao. 2023. ReAct: Synergizing Reasoning and Acting in Language Models. In International Conference on Learning Representations. arXiv:2210.03629 [cs.CL] https://openreview.net/forum?id=WE_vluYUL-X [24] Mert Yuksekgonul, Federico Bianchi, Joseph Boen, Sheng Liu, Zhi Huang, Carlos Guestrin, and James Zou. 2024. TextGrad: Automatic "Differentiation" via Text. arXiv:2406.07496 [cs.CL] https://arxiv.org/abs/2406.07496 [25] Qizheng Zhang, Changran Hu, Shubhangi Upasani, Boyuan Ma, Fenglu Hong, Vamsidhar Kamanuru, Jay Rainton, Chen Wu, Mengmeng Ji, Hanchen Li, Urmish Thakker, James Zou, and Kunle Olukotun. 2025. Agentic Context Engineering: Evolving Contexts for Self-Improving Language Models. arXiv:2510.04618 [cs.AI] https://arxiv.org/abs/2510.04618 [26] Andrew Zhao, Daniel Huang, Quentin Xu, Matthieu Lin, Yong-Jin Liu, and Gao Huang. 2024. ExpeL: LLM Agents Are Experiential Learners. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 19632–19642. arXiv:2308.10144 [cs.AI] doi:10.1609/aaai.v38i17.29936

A

Ethics Statement & Reproducibility

All authors adhere to the ACM Code of Ethics1 . No human-subject data, personally identifiable information, or user-generated content is collected; all results are based on simulator-generated traces. Experiments are confined to the CybORG CAGE-2 benchmark and do not interact with real systems. We frame FORGE strictly for defensive decision-making but recognize the dual-use potential of cybersecurity automation. Since the protocol is compute-intensive, we report cost metrics and use graduation to reduce unnecessary runs. As non-native English speakers, we used LLM-based tools for language polishing and assistance with data processing scripts.

A.1

Artifact Availability and Scope

The artifact supporting this paper is archived on Zenodo at https: //doi.org/10.5281/zenodo.19907612. The development repository is available at https://github.com/isbogdanov/forge-protocol. Detailed build, configuration, and execution instructions are provided in the artifact README. The archived artifact contains the implementation of the FORGE protocol, the experiment runner, container specification, API-key template, and configuration files for running the population-broadcast and Reflexion-style baselines. agent_base/ contains the main implementation, including the hierarchical Planner, Analyst, and ActionChooser agents, the Reflector and Exemplifier learning agents, the CybORG coordinator, the learning coordinator, provider configuration, and metric/logging utilities. The acting agents are configured through YAML definition files, including static prompt components and dynamic memory files e.g. reflection_knowledge.yaml and reflection_examples.yaml. These files are updated during training when the learning agents synthesize rules or examples from failed trajectories. Experiments are launched through run_experiment.py. The release includes experiment_forge_eval.yaml for the FORGE condition (transfer_strategy: best, champion broadcast, 10 instances) and experiment_reflexion_eval.yaml for the isolated 1 https://www.acm.org/code-of-ethics

FORGE: Self-Evolving Agent Memory With No Weight Updates

Reflexion baseline (transfer_strategy: individual, no population broadcast). The configuration files expose the main protocol parameters, including the number of stages, the graduation threshold, the per-step failure threshold, the memory representation (rules, examples, or mixed), and the number of learning attempts per stage. The released FORGE configuration uses six stages, a graduation threshold of −15, a per-step reflection trigger of −1.1, and three learning attempts per stage. A run creates an experiment directory containing the copied configuration, stage-level summaries, workspaces with the learned memory snapshots, final evaluation reports, aggregate summaries, runtime logs, and connector token-usage logs for that run. Full raw LLM-provider transcripts and evolved memory artifacts from the original study are not bundled in the public artifact because of storage size and API cost. They may be available upon request from the authors, subject to transfer and storage constraints. Because original run seeds and provider-side execution state are not bundled, the artifact supports executable reruns of the released protocol configurations rather than bit-for-bit regeneration of the original logs. The paper itself reports the per-instance evaluation scores used for the aggregate statistics; the artifact is intended to let readers inspect the implementation, verify the protocol configuration, and rerun selected FORGE or Reflexion conditions under the documented setup.

B

CAGE-2 Environment Details

We evaluate the protocol on the CAGE-2 autonomous cyber-defense challenge [1, 16], a partially observable Markov decision process (POMDP) where a blue defender protects an enterprise network against an automated red attacker. Topology and Assets. The simulated network (Figure 8a) consists of 3 subnets hosting 13 nodes: user workstations (Subnet 1), enterprise servers (Subnet 2), and a high-value operational server (Subnet 3). The defender’s goal is to maintain the availability and integrity of these assets, particularly the operational server. Attacker Model (b_line). The red agent follows a scripted policy implementing a standard kill chain (Figure 8b). Starting from an external position, it progresses through phases of Discovery (scanning for IPs), Access (identifying services), Lateral Movement (exploiting user privileges), and Escalation (gaining root). The defender can push the attacker back to earlier states via remediation actions, creating a dynamic tug-of-war. Action Space. Episodes last 𝑇 =30 steps. At each step, the blue agent selects an action: • Monitor: Passive observation with no intervention. • Analyse ℎ: Inspect host ℎ for anomalies (low cost). • Remove ℎ: Terminate suspicious processes (moderate cost, imperfect success). • Restore ℎ: Reimage ℎ to a clean state (high cost, guarantees remediation). • Decoy ℎ: Deploy a honeypot to misdirect the attacker (moderate cost). Partial Observability and Reward. The defender observes only host-level indicators (processes, connections, files) and must infer

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

the attacker’s latent state. The per-step reward 𝑟𝑠𝑡𝑒𝑝 ≤ 0 penalizes both ongoing compromise and the operational cost of defensive actions. An effective defense minimizes this penalty (achieving returns closer to zero) by balancing timely detection with targeted, cost-efficient interventions and proactive defense.

C

Knowledge Artifact Examples

This section provides verbatim examples of the two artifact types generated during FORGE training, illustrating what is stored in prompt memory and how the representations differ. Both artifacts below were produced by a Qwen3-235B training session. Rules Artifact. The Reflector distills each failed trajectory into conditional heuristics, organized per agent role. These rules are injected into the agent’s system prompt via a <reflection_knowledge> section. Examples Artifact. The Exemplifier converts the failed trajectory into a structured few-shot demonstration that mimics a complete ReAct interaction cycle (Thought–Tool–Observation–Answer), injected via a <TOOL_USE_EXAMPLES> section.

D

Failure Trigger Threshold Analysis

The failure trigger 𝜏 determines which per-step rewards abort the episode and invoke the reflection agent. Figure 11 shows the distribution of per-step penalties across 540 zero-shot episodes (all four model families, 13,446 penalized steps). Penalties cluster into distinct groups: Restore actions at −1.0 (3,520 occurrences, red), small failures at −1.1 to −1.2, moderate failures at −2.0 to −3.2, and severe failures at −11 to −14, with a gap between −3.3 and −10.9. The chosen threshold 𝜏 = −1.1 achieves 100% precision (zero false positives from Restore) while capturing 74% of all real failure events (7,346 of 9,926 true triggers). To assess sensitivity, we tested three additional thresholds on Gemini Rules (the primary model-representation pair with 7-session coverage). Relative to 𝜏 = −1.1 (mean return −30.6, 83% graduation rate): 𝜏 = −2.0 yields mean −52.0 over 40 episodes; 𝜏 = −3.0 yields mean −46.0 over 40 episodes; and 𝜏 = −11.0 yields mean −24.6 with 93% graduation over 60 episodes. The result is non-monotone: skipping small and moderate failures (𝜏 = −2.0, −3.0) degrades performance, but restricting reflection to only the most severe failures (𝜏 = −11.0) improves over the submitted value. This suggests that triggering on severe failures produces a cleaner learning signal, though the broader design space of multi-threshold triggering remains unexplored. Table 4 provides session-level aggregates for each threshold, and Table 5 reports the complete per-instance evaluation scores. Table 4: Failure Trigger Threshold Sweep: Session-Level Results (Gemini Rules) Threshold (𝜏 )

Runs

Episodes

Mean Return

SD

Grad. Rate

−1.1 (default) −2.0 −3.0 −11.0

7 2 2 3

140 40 40 60

−30.6 −52.0 −46.0 −24.6

37.0 59.6 52.9 28.2

83% 65% 75% 93%

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Bogdanov et al.

(a) Network Topology: 3 subnets containing user hosts, enterprise servers, and operational servers.

(b) Attacker State Transitions: The progressive kill chain from discovery to root compromise. Figure 8: CAGE-2 Environment Overview. (a) The defender protects a 13-host network segmented into subnets [8]. (b) The automated attacker follows a multi-stage state machine; successful exploits advance the attacker’s position, while defender actions (like Restore) can reset this progress [8].

E

Supplementary Analysis Tables

Table 6 reports standard deviations corresponding to the mean results in the main paper (Table 3). Table 7 summarizes the experimental setup across all conditions. Table 8 presents per-strategy Reflexion results across all models, providing detailed ablation data for the single-instance learning baseline.

E.1

Primary Model Statistical Detail

Table 9 provides session-level detail for the primary model (Gemini2.5-Flash-Lite), which received the most comprehensive evaluation with 7 independent runs per strategy.

E.2

Graduation Dynamics

Table 10 reports the distribution of graduation rates across models and strategies, quantifying how many instances successfully completed the learning curriculum.

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Table 5: Raw Evaluation Scores: Failure Trigger Threshold Sweep (Gemini Rules, FORGE Protocol) 𝜏

Instance

R1-E1

R1-E2

R2-E1

R2-E2

R3-E1

R3-E2

Tokens (M)

Grad

−2.0

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

−35.1 −44.9 −14.8 −17.8 −17.8 −161.4 −19.3 −197.8 −14.2 −198.8

−13.2 −84.8 −16.6 −37.2 −172.2 −41.2 −17.5 −177.2 −17.3 −67.8

−51.2 −22.2 −20.4 −51.3 −198.8 −14.1 −16.7 −36.2 −21.1 −20.5

−14.7 −19.9 −37.0 −13.3 −16.9 −92.2 −14.2 −18.1 −15.2 −19.2

— — — — — — — — — —

— — — — — — — — — —

195.2

13/20

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

−62.7 −36.1 −15.1 −12.3 −14.2 −22.3 −46.5 −15.5 −69.3 −15.3

−30.4 −172.2 −14.5 −111.2 −52.2 −223.6 −17.6 −13.9 −197.3 −14.5

−13.2 −77.4 −16.7 −17.5 −18.5 −16.4 −37.3 −14.7 −93.6 −11.2

−125.5 −14.5 −15.6 −17.7 −13.1 −47.1 −16.3 −16.0 −84.2 −16.2

— — — — — — — — — —

— — — — — — — — — —

226.7

15/20

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

−72.5 −16.5 −15.6 −15.2 −12.7 −12.5 −16.2 −12.2 −13.4 −14.4

−14.2 −13.1 −59.7 −14.2 −14.2 −16.7 −15.4 −15.4 −12.4 −22.2

−12.5 −15.4 −13.4 −12.5 −13.5 −27.5 −14.4 −13.2 −14.2 −15.2

−26.1 −89.9 −13.2 −61.2 −21.7 −50.0 −17.5 −12.4 −13.4 −14.2

−27.2 −13.3 −17.5 −19.2 −17.4 −201.4 −49.5 −15.5 −11.8 −16.2

−38.2 −15.4 −15.9 −15.1 −16.7 −20.4 −14.0 −20.2 −16.2 −45.2

320.9

28/30

−3.0

−11.0

Table 6: Standard deviations of episode return corresponding to Table 3. Lower SD = more reliable policy. Bold marks the lowest SD per model across all FORGE variants. ↑/ ↓ = reduction/increase relative to the reference. Reflexion Model Gemini

Grok

Llama

Qwen

Repr

SD

ΔZS

53.9

Rules Examples Mixed

60.5 60.4 74.6

↓12% ↓12% ↓38%

55.2

Rules Examples Mixed

62.6 52.4 76.8

81.5

Rules Examples Mixed Rules Examples Mixed

ZS SD

87.3

FORGE

ΔRefl

SD

ΔZS

ΔRefl

ΔFORGE

21.1

28.1

↑31% ↑61% ↑48%

↑39% ↑65% ↑62%

26.5 27.2 30.7

↑51% ↑50% ↑43%

↑56% ↑55% ↑59%

↑28% ↓29% ↓9%

↓14% ↑5% ↓39%

26.1 43.3 36.9

↑53% ↑21% ↑33%

↑58% ↑17% ↑52%

15.1

↑73% ↑96% ↑65%

↑76% ↑96% ↑75%

↑42% ↑96% ↑47%

61.0 59.7 40.6

↑25% ↑27% ↑50%

46.6 15.7 25.6

↑43% ↑81% ↑69%

↑24% ↑74% ↑37%

54.7 35.3

↑33% ↑57% ↑89%

↑10% ↑41% ↑77%

↓17% ↓125% ↑64%

83.5 69.5 89.4

↑4% ↑20% ↓2%

21.0 35.8 20.4

↑76% ↑59% ↑77%

↑75% ↑48% ↑77%

↑97% ↑97% ↑97%

↑97% ↑97% ↑97%

↑88% ↑94% ↑86%

37.0

Table 7: Experimental Setup Summary Component

Description

Models

Gemini-2.5-Flash-Lite, Grok-4-Fast, Llama-4-Maverick, Qwen3-235B

Conditions

Zero-Shot: No adaptation (empty memory) Rules: Contextual Instructions (Textual guidelines) Examples: Few-shot Demonstrations (State-Action pairs) Mixed: Combined Rules and Examples

Methods

FORGE: Population-based continual learning (champion broadcast) Reflexion: Single-instance learning (no population broadcast)

Key Metrics

Evaluation Reward: Cumulative reward per episode (Higher is better) Graduation Rate: % of learning stages successfully completed Token Efficiency: Total tokens processed to reach performance Volatility: Standard deviation of rewards across stages

Scale

FORGE w/o grad

ΔZS

SD

Zero-Shot: 5 experiments, 270 episodes Reflexion: 38 experiments, 1,000 episodes FORGE: 49 experiments, 890 episodes FORGE w/o grad: 24 experiments, 480 episodes Total: 116 experiments, 2,640 episodes, 12364.0M tokens

E.3

2.0

19.4

9.3 2.6

2.3

2.8

Computational Cost Breakdown

Table 11 breaks down token consumption by phase (Adaptation vs. Evaluation), providing transparency into the computational cost structure of the protocol.

E.4

Baseline (Zero-Shot) Evaluation

Table 12 reports zero-shot evaluation scores for all models.

F

Raw Evaluation Scores

Tables 15–16 report post-session evaluation scores for trained agents under the Best transfer protocol. This appendix provides complete per-instance, per-run evaluation scores for all 2,640 evaluated episodes across 116 experiments. These raw data support the aggregate statistics reported in Table 3 and enable full transparency regarding variances, outliers, and tail

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Bogdanov et al.

Planner rules: - When lateral movement is confirmed, then Plan: Isolate path + Analyse adjacent hosts - When reconnaissance is confirmed on an Enterprise host, then Plan: Deploy DecoySERVICE immediately - When a host has undergone two consecutive Analyses and remains in changed state with high severity, then Plan: Execute Remove or Restore

Table 9: Flash-Lite Session Results: Rules vs Examples vs Mixed (FORGE). Avg = mean eval return across 10 instances in that session (± within-session SD).

Analyst rules: - When Analyse confirms C2 beaconing, then Recommend Deploy DecoySERVICE on Server host - When multiple critical anomalies are present, then set recommended_focus to 'containment'

Repr

Session

Avg Return

Grad

Tokens

Rules

1 2 3 4 5 6 7

-19.86±15.9 -47.80±34.8 -21.76±11.2 -16.26±3.7 -28.24±41.2 -50.20±65.4 -29.85±41.1

10/10 6/10 10/10 7/10 7/10 10/10 8/10

4.7M 8.8M 6.2M 8.4M 9.0M 6.2M 7.5M

Mean

-30.57±13.4

8.3/10

7.3M±1.6M

1 2 3 4 5 6 7

-28.73±20.4 -18.72±13.7 -24.24±15.0 -23.18±18.7 -36.11±38.1 -24.45±21.8 -16.01±4.1

7/10 9/10 10/10 9/10 8/10 8/10 10/10

8.3M 8.6M 6.0M 6.7M 9.3M 10.5M 9.4M

Mean

-24.49±6.6

8.7/10

8.4M±1.6M

1 2 3 4 5 6 7

-20.04±13.3 -38.67±18.4 -42.06±52.9 -34.37±16.4 -38.46±36.8 -27.43±18.0 -24.36±18.5

8/10 7/10 9/10 6/10 7/10 7/10 10/10

11.4M 12.6M 8.3M 11.4M 8.4M 10.1M 8.8M

Mean

-32.20±8.3

7.7/10

10.2M±1.7M

Examples

Figure 9: Rules artifact generated by the Reflector after a failed episode. Each rule is a conditional heuristic injected into the agent’s system prompt. <example description='PlanMonitorAndDecoy AfterReconAnalysis'> Thought: Enterprise_Host shows signs of reconnaissance from 10.0.247.46. Per reflection knowledge, plan monitoring and decoy deployment. Tool: get_suggestion_for_next_action: {"target_host": "Enterprise_Host", "situation": "recon confirmed", "severity": "high", ...} PAUSE Observation: [ {"action": "Monitor", "confidence": 0.95}, {"action": "DecoySSHD hostname=Enterprise_Host", "confidence": 0.90}, ...] Thought: Monitoring and decoy deployment are highest-priority. Answer: Monitor </example>

Mixed

Table 10: Graduation Stage Distribution

Figure 10: Examples artifact generated by the Exemplifier after a failed episode (abbreviated). The demonstration mimics a full ReAct interaction cycle. Table 8: Reflexion baseline evaluation detail. 𝑁 = independent instances evaluated (each runs the Reflexion loop in isolation; no cross-instance interaction). Failure rate = episodes with return < −100. Model

Repr

𝑁

Mean

SD

Failure Rate (< −100)

Gemini

Rules Examples Mixed

70 50 50

−62.7 −78.9 −81.9

60.5 60.4 74.6

21% 28% 36%

Grok

Rules Examples Mixed

30 30 30

−79.9 −64.8 −114.4

62.6 52.4 76.8

33% 27% 50%

Llama

Rules Examples Mixed

70 30 30

−101.4 −53.9 −44.2

61.0 59.7 40.6

50% 17% 17%

Qwen

Rules Examples Mixed

30 30 50

−88.4 −57.6 −80.4

83.5 69.5 89.4

33% 23% 28%

Model

Representation

S1

S2

S3

S4

S5

S6

Never

Gemini Gemini Gemini

rules examples mixed

12 6 10

8 13 12

16 16 12

7 13 9

9 5 8

6 8 3

12 9 16

Grok Grok Grok

rules examples mixed

3 7 5

8 9 9

8 2 6

3 4 2

2 1 4

2 1 0

4 6 4

Llama Llama Llama

rules examples mixed

1 1 4

2 3 4

2 1 1

3 5 4

0 3 0

2 2 4

20 15 13

Qwen3 Qwen3 Qwen3

rules examples mixed

5 6 3

4 4 3

2 2 1

2 6 1

3 5 1

5 4 0

19 3 21

Í behavior. Each table reports episode returns (𝑅 = 𝑡30=1 𝑟𝑡 ) with learning disabled (frozen evaluation). Column headers E1, E2, etc., denote independent evaluation runs; "—" indicates no data for that run. Summary. The raw data reveal three key patterns supporting the main text claims: (1) baseline distributions are heavy-tailed with frequent catastrophic failures; (2) FORGE Protocol training substantially compresses this variance and elevates the returns of most instances into the −10 to −50 range; and (3) Reflexion exhibits higher instability, with several instances regressing to near-baseline performance. These complete data are provided for reproducibility and to enable meta-analyses of representation-specific failure modes.

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Figure 11: Failure trigger threshold analysis. (Left) Per-step penalty distribution across zero-shot episodes (log scale). The red bar at −1.0 represents legitimate Restore actions; blue bars are real failures. (Right) Triggers captured vs. threshold: 𝜏 = −1.1 captures 7,346 real triggers with 0 false positives. Table 11: Average Token Usage per Instance (Adaptation Phase, FORGE & Reflexion)

G

Model

Method

Representation

Avg Total/inst

Avg Prompt/inst

Avg Compl/inst

P/C Ratio

Gemini Gemini Gemini Gemini Gemini Gemini

FORGE Reflexion FORGE Reflexion FORGE Reflexion

Rules Rules Examples Examples Mixed Mixed

7.3M±1.6M 11.4M±0.5M 8.4M±1.6M 13.1M±0.4M 10.2M±1.7M 17.0M±0.5M

6.4M 10.1M 7.7M 12.1M 9.2M 15.8M

0.8M 1.3M 0.7M 1.0M 0.9M 1.2M

7.8 7.9 10.4 11.7 10.0 13.2

Grok Grok Grok Grok Grok Grok

FORGE Reflexion FORGE Reflexion FORGE Reflexion

Rules Rules Examples Examples Mixed Mixed

4.7M±0.9M 8.8M±0.5M 8.4M±4.0M 17.3M±0.9M 9.3M±1.3M 19.9M±0.8M

3.8M 7.2M 7.5M 15.5M 8.2M 17.9M

0.9M 1.6M 0.9M 1.8M 1.1M 2.0M

4.2 4.4 8.3 8.8 7.3 8.9

Llama Llama Llama Llama Llama Llama

FORGE Reflexion FORGE Reflexion FORGE Reflexion

Rules Rules Examples Examples Mixed Mixed

5.1M±0.2M 5.5M±0.8M 4.6M±0.8M 5.7M±0.2M 5.5M±0.9M 7.4M±0.0M

4.8M 5.2M 4.4M 5.5M 5.3M 7.1M

0.3M 0.3M 0.2M 0.2M 0.2M 0.3M

17.2 17.0 23.1 23.5 23.8 25.7

Qwen3 Qwen3 Qwen3 Qwen3 Qwen3 Qwen3

FORGE Reflexion FORGE Reflexion FORGE Reflexion

Rules Rules Examples Examples Mixed Mixed

5.1M±1.2M 5.8M±0.4M 5.1M±1.6M 9.8M±0.5M 7.3M±3.8M 9.6M±0.2M

4.8M 5.6M 4.9M 9.4M 7.1M 9.3M

0.2M 0.2M 0.2M 0.3M 0.2M 0.3M

22.3 22.8 23.0 27.3 32.6 31.9

Per-Run Detailed Results

This section provides session-level summaries for all experiments, aggregating the raw evaluation data from Appendix F into persession metrics. Table 13, Table 14, Table 17 and Table 18 list average return, total token cost, and graduation counts for each training run, enabling direct comparison of resource efficiency across configurations.

G.1

Learning Dynamics: Per-Stage Checkpoint Progression

Tables 19–20 report checkpoint returns at each stage (S1-S6) during training, computed by averaging the frozen checkpoint scores

across all instances. Under the Best protocol (Table 19), most configurations exhibit progressive improvement or stabilization across stages. For example, Gemini Rules converges from −93.7 (S1) to −27.7 (S5), while Qwen3 Examples rapidly stabilizes by S2 (−22.3). Notable exceptions include Grok Rules, which experiences latestage regression (S4–S6 ≈ −224), reflecting rare failure cascades despite earlier success. Under the Reflexion baseline (Table 20), learning trajectories are more erratic. Without champion broadcast, instances often regress between stages (e.g., Gemini Examples degrades from S5 to S6, while Qwen3 Mixed consistently worsens from S2 onward). Comparing the “Final” columns across protocols confirms that FORGE achieves systematically better post-session evaluation performance than

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Bogdanov et al.

Table 12: Raw Evaluation Scores: Zero-Shot (All Models)

Table 14: Complete Experimental Results: Qwen3

Model

Instance

S1

#

Method

Representation

Avg Reward

Tokens

Graduated

Gemini

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-215.10 -205.84 -171.80 -200.23 -198.80 -182.64 -174.09 -183.83 -171.19 -192.60

1 2 3 4 5 6 7 8 9 10

FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE

Examples Examples Examples Mixed Mixed Mixed Rules Rules Rules Rules

-17.04 -20.22 -35.58 -47.82 -19.41 -20.70 -34.67 -26.99 -21.62 -17.35

6.1M 5.8M 3.3M 11.6M 5.9M 4.3M 6.6M 4.9M 5.1M 3.6M

9/10 9/10 9/10 2/10 3/10 4/10 2/10 2/10 9/10 8/10

11 12 13 14 15 16

Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion

Examples Examples Mixed Mixed Rules Rules

-56.15 -60.41 -69.15 -125.41 -86.19 -89.48

10.0M 9.3M 9.5M 9.9M 6.1M 5.6M

— — — — — —

17

Zero-Shot

—

-103.34

0.4M

—

Model

Instance

S1

S2

Grok

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-93.92 -62.18 -83.82 -51.84 -33.50 -58.64 -89.34 -77.94 -52.30 -57.58

-31.84 -64.32 -86.48 -28.00 -16.46 -51.70 -116.58 -35.76 -43.00 -33.66

Model

Instance

S1

Llama

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-113.34 -111.98 -92.24 -184.46 -122.64 -140.82 -113.66 -104.24 -60.48 -87.24

Model

Instance

S1

Qwen3

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-88.48 -97.98 -94.80 -103.26 -60.58 -73.00 -152.06 -83.60 -180.50 -99.16

Table 15: Raw Evaluation Scores: Gemini Flash-Lite, FORGE Repr

Instance

S1

S2

S3

S4

S5

S6

S7

Rules

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-64.90 -16.20 -13.20 -15.30 -12.40 -15.60 -14.20 -16.20 -16.60 -14.00

-73.30 -18.20 -39.40 -108.20 -100.00 -37.20 -49.80 -15.50 -22.10 -14.30

-18.20 -15.20 -13.30 -36.20 -12.50 -18.20 -43.20 -14.70 -32.70 -13.40

-14.60 -13.20 -17.20 -25.40 -16.20 -18.20 -13.70 -15.20 -16.50 -12.40

-18.10 -14.20 -13.20 -14.20 -12.20 -14.10 -20.80 -15.60 -145.30 -14.70

-69.50 -25.20 -13.30 -14.50 -14.10 -15.50 -12.40 -38.30 -223.80 -75.40

-17.50 -13.20 -15.20 -22.00 -17.70 -15.70 -146.50 -14.30 -17.20 -19.20

Examples

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-15.20 -60.80 -15.60 -15.50 -13.90 -13.70 -63.10 -14.90 -27.10 -47.50

-13.40 -13.20 -17.30 -15.40 -57.40 -13.40 -15.60 -16.50 -13.10 -11.90

-46.80 -16.50 -14.00 -40.20 -49.30 -15.60 -21.40 -13.40 -12.40 -12.80

-14.30 -14.20 -63.50 -14.20 -14.40 -14.80 -53.20 -15.20 -13.40 -14.60

-36.60 -14.40 -14.60 -135.50 -13.90 -15.40 -14.20 -53.00 -15.20 -48.30

-27.40 -16.60 -27.50 -12.20 -18.30 -13.60 -13.50 -17.20 -13.60 -84.60

-26.20 -15.40 -17.30 -15.20 -13.30 -14.30 -15.20 -11.40 -13.50 -18.30

Mixed

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-17.85 -14.65 -14.20 -55.70 -14.25 -13.45 -27.95 -15.05 -13.50 -13.80

-31.80 -79.70 -19.25 -45.75 -30.00 -52.85 -44.75 -17.75 -27.20 -37.70

-27.40 -76.35 -17.05 -14.70 -28.40 -25.45 -16.75 -15.45 -15.75 -183.25

-16.20 -48.25 -42.95 -16.35 -35.75 -50.30 -15.90 -21.85 -34.25 -61.85

-10.70 -13.70 -14.25 -14.85 -15.45 -88.05 -30.65 -107.20 -14.75 -75.00

-68.00 -15.30 -17.50 -13.50 -16.40 -45.80 -11.00 -36.55 -21.70 -28.55

-23.70 -15.05 -17.90 -50.25 -14.35 -66.20 -13.90 -13.30 -14.75 -14.25

Table 13: Complete Experimental Results: Llama #

Method

Representation

Avg Reward

Tokens

Graduated

1 2 3 4 5 6 7 8 9

FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE

Examples Examples Examples Mixed Mixed Mixed Rules Rules Rules

-33.12 -19.16 -32.62 -27.82 -36.96 -23.91 -92.59 -82.50 -40.78

5.5M 4.3M 4.0M 5.4M 4.7M 6.5M 5.1M 5.3M 5.0M

2/10 8/10 5/10 5/10 7/10 5/10 4/10 1/10 5/10

10 11 12 13 14 15 16 17

Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion

Examples Examples Mixed Mixed Rules Rules Rules Rules

-48.07 -65.69 -46.81 -39.11 -63.32 -113.69 -88.19 -121.42

5.8M 5.5M 7.4M 7.4M 7.0M 5.3M 5.3M 5.2M

— — — — — — — —

18

Zero-Shot

—

-113.11

0.4M

—

Reflexion for most configurations, with particularly large gaps for weaker baseline models (Qwen, Llama).

H

Reflexion Baseline Raw Scores

Tables 21–22 present evaluation scores under the Reflexion baseline, where each instance evolves memory from its own trajectories without cross-instance propagation. Gemini Reflexion. Table 21 reports Gemini scores under the Reflexion baseline where cross-instance transfer is disabled. Each of the three memory representations (Rules/Examples/Mixed) received 2 evaluation runs.

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Table 16: Raw Evaluation Scores: FORGE (Grok, Llama, Qwen) Model

Instance

Rules

Examples

Mixed

S1

S2

S3

S4

S1

S2

S3

S1

S2

S3

Grok

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-39.10 -14.30 -144.65 -32.00 -34.00 -13.55 -15.80 -49.30 -14.80 -36.20

-45.60 -28.00 -39.35 -14.95 -13.65 -30.05 -18.20 -71.60 -15.15 -24.55

-14.00 -39.40 -32.85 -43.40 -13.60 -52.35 -15.35 -12.35 -36.90 -56.35

— — — — — — — — — —

-125.35 -44.80 -141.80 -132.70 -46.15 -16.30 -128.20 -62.05 -49.60 -136.95

-16.55 -17.85 -46.35 -26.15 -41.30 -13.85 -15.45 -16.45 -13.35 -20.90

-14.55 -14.30 -15.05 -37.75 -13.80 -15.25 -14.70 -15.60 -13.20 -13.60

-14.70 -81.40 -33.40 -21.70 -15.60 -79.15 -44.75 -38.60 -165.45 -14.20

-18.10 -79.85 -114.50 -43.20 -71.60 -31.85 -38.50 -16.70 -103.50 -16.75

-29.80 -13.55 -18.00 -16.30 -14.70 -41.35 -46.25 -14.70 -14.80 -14.15

Llama

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-138.40 -104.83 -108.60 -129.01 -52.69 -120.97 -125.31 -51.94 -20.41 -73.76

-37.40 -62.30 -42.45 -192.05 -149.15 -76.20 -15.20 -80.00 -51.10 -119.20

-109.65 -36.40 -25.40 -22.05 -20.05 -38.75 -33.65 -50.60 -40.45 -30.85

— — — — — — — — — —

-56.85 -21.90 -44.20 -26.80 -27.00 -26.30 -32.95 -20.50 -20.50 -54.20

-16.40 -16.30 -16.75 -20.70 -27.05 -19.85 -29.55 -14.20 -15.30 -15.50

-13.70 -26.30 -21.80 -23.25 -65.50 -40.05 -17.95 -29.05 -14.90 -73.75

-13.85 -18.20 -27.65 -15.20 -26.50 -18.85 -19.85 -95.65 -27.25 -15.20

-15.45 -13.90 -34.25 -24.75 -18.80 -106.70 -12.65 -42.60 -68.35 -32.15

-19.50 -15.20 -16.20 -89.00 -15.55 -14.50 -14.85 -15.60 -24.60 -14.15

Qwen3

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-24.50 -18.30 -127.70 -25.10 -15.05 -18.10 -52.25 -30.90 -19.90 -14.85

-28.40 -17.55 -22.60 -21.80 -19.55 -71.65 -22.55 -24.05 -22.20 -19.55

-18.00 -68.35 -17.50 -15.00 -16.75 -16.35 -14.25 -16.10 -19.80 -14.05

-14.35 -15.90 -15.80 -15.60 -14.75 -17.35 -22.70 -24.25 -18.70 -14.10

-14.85 -15.15 -20.40 -19.60 -17.35 -20.65 -16.45 -15.70 -16.45 -13.75

-16.70 -16.70 -19.00 -32.45 -34.85 -16.05 -21.55 -15.30 -14.10 -15.50

-212.35 -13.80 -15.00 -14.95 -16.25 -16.60 -15.90 -14.25 -20.75 -15.95

-36.20 -39.95 -119.55 -46.50 -43.15 -31.10 -45.05 -17.45 -52.10 -47.15

-17.10 -20.65 -22.60 -15.70 -17.55 -21.60 -24.70 -18.80 -16.15 -19.25

-16.75 -18.80 -22.90 -18.75 -17.25 -19.75 -20.25 -35.15 -16.70 -20.65

Table 18: Complete Experimental Results: Grok

Table 17: Complete Experimental Results: Gemini Flash-Lite

#

Method

Representation

Avg Reward

Tokens

Graduated

#

Method

Representation

Avg Reward

Tokens

Graduated

1 2 3 4 5 6 7 8 9

FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE

Examples Examples Examples Mixed Mixed Mixed Rules Rules Rules

-88.39 -22.82 -16.78 -50.89 -53.45 -22.36 -39.37 -30.11 -31.65

12.2M 4.1M 9.0M 8.0M 10.7M 9.1M 3.7M 4.9M 5.5M

4/10 10/10 10/10 9/10 7/10 10/10 9/10 8/10 9/10

10 11 12 13 14 15 16 17 18

Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion

Examples Examples Examples Mixed Mixed Mixed Rules Rules Rules

-67.09 -65.44 -61.76 -111.75 -118.07 -113.24 -100.22 -72.60 -66.95

16.3M 17.8M 17.8M 20.6M 19.1M 20.1M 8.6M 9.4M 8.4M

— — — — — — — — —

19 20

Zero-Shot Zero-Shot

— —

-66.11 -50.78

0.5M 0.5M

— —

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE FORGE

Examples Examples Examples Examples Examples Examples Examples Mixed Mixed Mixed Mixed Mixed Mixed Mixed Rules Rules Rules Rules Rules Rules Rules

-28.73 -18.72 -24.24 -23.18 -36.11 -24.45 -16.01 -20.04 -38.67 -42.06 -34.37 -38.46 -27.43 -24.36 -19.86 -47.80 -21.76 -16.26 -28.24 -50.20 -29.85

8.3M 8.6M 6.0M 6.7M 9.3M 10.5M 9.4M 11.4M 12.6M 8.3M 11.4M 8.4M 10.1M 8.8M 4.7M 8.8M 6.2M 8.4M 9.0M 6.2M 7.5M

7/10 9/10 10/10 9/10 8/10 8/10 10/10 8/10 7/10 9/10 6/10 7/10 7/10 10/10 10/10 6/10 10/10 7/10 7/10 10/10 8/10

22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion Reflexion

Examples Examples Examples Examples Mixed Mixed Mixed Mixed Rules Rules Rules Rules Rules Rules Rules

-58.60 -77.38 -102.35 -53.70 -63.05 -71.89 -82.00 -110.60 -34.42 -48.01 -96.88 -66.29 -84.29 -77.06 -31.73

13.0M 12.5M 13.4M 13.3M 16.6M 17.8M 16.8M 16.9M 11.6M 11.2M 11.6M 12.5M 11.0M 11.3M 10.7M

— — — — — — — — — — — — — — —

37

Zero-Shot

—

-189.61

0.5M

—

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Bogdanov et al.

Table 19: Per-Stage Checkpoint Rewards (FORGE, All Models) Model

Representation

S1

S2

S3

S4

S5

S6

Final

Gemini Gemini Gemini

rules examples mixed

-93.74±84.8 -90.33±78.9 -97.12±82.5

-55.16±63.6 -46.01±51.8 -71.32±72.2

-43.31±63.3 -28.32±26.1 -45.83±53.9

-49.79±62.8 -23.36±21.6 -62.50±68.6

-27.73±40.8 -45.20±65.2 -70.24±73.4

-43.88±57.3 -27.45±20.9 -62.10±73.4

-30.57±37.0 -24.49±21.1 -32.20±34.6

Grok Grok Grok

rules examples mixed

-120.10±79.4 -88.97±85.9 -139.28±82.8

-42.29±50.9 -83.18±89.6 -32.21±43.8

-47.07±57.6 -97.10±92.4 -55.71±72.4

-43.39±61.7 -57.92±52.3 -47.69±59.1

-48.49±71.5 -109.28±82.4 -63.44±68.3

-51.75±61.1 -114.13±60.5 -134.65±59.3

-33.71±32.8 -42.66±54.1 -42.24±44.5

Llama Llama Llama

rules examples mixed

-99.43±83.7 -73.62±68.1 -67.14±74.8

-86.97±78.4 -56.81±61.6 -60.11±64.6

-68.36±70.2 -46.77±41.8 -42.92±32.3

-75.38±69.9 -44.04±46.4 -27.91±16.8

-78.69±77.1 -46.58±52.2 -90.59±72.0

-89.58±75.6 -30.71±26.3 -43.40±68.0

-81.34±76.5 -28.30±22.3 -29.57±37.6

Qwen3 Qwen3 Qwen3

rules examples mixed

-82.60±86.6 -49.42±62.8 -74.77±79.5

-70.50±80.2 -22.78±18.5 -63.03±74.9

-41.61±54.6 -23.43±27.9 -72.81±78.8

-34.70±46.9 -35.04±51.9 -45.27±52.3

-37.00±45.2 -41.68±65.2 -45.47±54.5

-33.25±43.2 -44.86±79.4 -40.29±37.4

-25.16±30.5 -24.28±36.1 -29.31±23.1

Table 20: Per-Stage Checkpoint Rewards (Reflexion, All Models) Model

Representation

S1

S2

S3

S4

S5

S6

Final

Gemini Gemini Gemini

rules examples mixed

-82.75±80.3 -115.00±83.4 -116.16±85.3

-92.69±84.4 -107.55±77.4 -110.89±87.1

-74.49±72.9 -85.93±71.9 -93.21±83.6

-71.64±76.2 -83.23±73.5 -106.12±84.3

-89.30±136.5 -76.66±74.9 -80.95±82.1

-67.74±73.1 -89.64±75.2 -81.47±81.6

-62.67±69.2 -78.88±71.6 -81.91±80.1

Grok Grok Grok

rules examples mixed

-106.42±89.7 -85.56±84.1 -107.05±90.5

-93.64±85.2 -80.56±72.7 -60.00±60.9

-83.54±69.1 -78.12±69.5 -79.84±69.6

-79.27±72.0 -67.28±62.0 -120.35±82.8

-91.54±77.6 -81.71±76.1 -113.72±85.4

-97.76±66.5 -56.60±59.5 -107.11±79.4

-79.92±73.0 -64.76±66.7 -114.35±81.6

Llama Llama Llama

rules examples mixed

-84.84±78.3 -80.95±79.6 -60.04±69.9

-100.55±73.3 -67.70±61.1 -75.45±79.5

-81.14±73.9 -98.51±78.3 -65.17±68.2

-83.23±73.2 -63.47±63.0 -55.68±59.1

-95.30±77.5 -77.85±71.9 -37.64±43.1

-87.73±77.6 -49.66±62.9 -58.96±61.7

-101.42±77.6 -53.95±64.8 -44.24±51.1

Qwen3 Qwen3 Qwen3

rules examples mixed

-56.77±65.9 -76.81±79.4 -72.06±84.5

-68.90±81.1 -43.70±52.0 -75.34±82.5

-88.17±91.4 -54.92±72.0 -83.01±90.5

-78.50±90.6 -52.81±68.8 -90.80±93.8

-84.23±86.0 -64.06±75.0 -86.43±92.6

-97.83±94.5 -54.48±73.6 -80.61±89.6

-88.38±86.4 -57.57±71.3 -80.40±89.3

Table 21: Raw Evaluation Scores: Gemini Flash-Lite, Reflexion Instance

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10 instance_11 instance_12 instance_13 instance_14 instance_15 instance_16 instance_17 instance_18 instance_19 instance_20

Rules

Examples

Mixed

S1

S2

S3

S4

S5

S6

S7

S1

S2

S3

S4

S1

S2

S3

S4

-13.90 -27.35 -32.40 -15.75 -18.90 -31.70 -15.15 -59.45 -69.20 -60.40 — — — — — — — — — —

-17.30 -177.90 -110.30 -13.30 -33.85 -13.85 -29.25 -14.25 -55.40 -14.70 — — — — — — — — — —

-210.70 -14.85 -31.00 -211.20 -49.80 -86.60 -128.95 -108.50 -45.35 -81.85 — — — — — — — — — —

-210.70 -15.75 -14.10 -29.45 -19.70 -117.75 -118.85 -93.00 -20.20 -23.35 — — — — — — — — — —

-181.10 -16.80 -37.45 -45.90 -15.20 -223.80 -14.85 -18.60 -98.20 -191.00 — — — — — — — — — —

-47.80 -74.45 -31.70 -15.15 -16.45 -120.60 -80.00 -134.90 -204.60 -45.00 — — — — — — — — — —

-13.80 -35.15 -36.60 -16.20 -16.35 -71.70 -16.85 -74.80 -21.65 -14.25 — — — — — — — — — —

-25.80 -142.50 -57.95 -65.25 -112.75 -14.20 -36.20 -32.25 -37.70 -61.45 — — — — — — — — — —

-28.30 -222.55 -37.85 -15.10 -222.70 -143.55 -34.90 -17.55 -14.80 -36.45 — — — — — — — — — —

-88.55 -99.50 -42.20 -161.80 -17.40 -182.90 -118.25 -37.25 -224.25 -117.95 -119.00 -223.80 -59.85 -55.25 -101.30 -82.35 -62.35 -82.85 -74.80 -95.40

-94.60 -18.35 -94.80 -33.45 -15.95 -15.60 -24.00 -119.30 -38.40 -82.60 — — — — — — — — — —

-15.60 -207.50 -13.75 -177.90 -15.80 -24.50 -13.85 -108.50 -33.30 -19.85 — — — — — — — — — —

-54.30 -223.35 -14.10 -106.75 -146.55 -33.20 -38.30 -69.95 -14.60 -17.80 — — — — — — — — — —

-33.05 -14.40 -21.70 -183.40 -224.20 -34.50 -30.20 -27.75 -110.95 -100.30 -38.70 -34.95 -30.15 -223.80 -38.35 -223.75 -28.80 -193.20 -14.45 -33.40

-92.85 -17.80 -36.85 -176.70 -15.35 -163.05 -215.20 -82.10 -132.05 -174.10 — — — — — — — — — —

FORGE: Self-Evolving Agent Memory With No Weight Updates

ACM CAIS ’26, May 26–29, 2026, San Jose, CA, USA

Table 22: Raw Evaluation Scores: Reflexion (Grok, Llama, Qwen) Model

Instance

Rules

Examples

Mixed

S1

S2

S3

S4

S1

S2

S3

S1

S2

S3

Grok

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10

-15.05 -210.70 -46.50 -98.65 -217.75 -15.40 -28.75 -14.15 -190.45 -164.75

-20.15 -106.70 -110.70 -15.15 -72.80 -57.65 -45.35 -113.80 -101.80 -81.90

-13.95 -62.70 -21.55 -58.95 -13.00 -83.60 -72.65 -188.20 -121.40 -33.45

— — — — — — — — — —

-19.95 -105.15 -162.45 -76.35 -35.05 -15.60 -24.30 -99.10 -17.75 -115.20

-97.30 -31.10 -22.70 -14.00 -105.25 -39.40 -39.40 -24.50 -130.25 -150.45

-206.40 -110.15 -14.85 -86.25 -22.35 -50.75 -61.95 -31.20 -13.05 -20.65

-53.85 -134.30 -41.90 -26.50 -165.60 -59.70 -41.30 -223.80 -146.75 -223.80

-196.70 -14.80 -38.50 -139.70 -223.75 -20.95 -202.55 -202.90 -54.20 -86.60

-91.40 -199.80 -172.30 -174.30 -22.30 -136.35 -29.60 -57.25 -224.30 -24.80

Llama

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10 instance_11 instance_12 instance_13 instance_14 instance_15 instance_16 instance_17 instance_18 instance_19 instance_20

-16.20 -71.50 -29.40 -43.25 -108.60 -128.15 -29.10 -173.35 -18.85 -14.80 — — — — — — — — — —

-63.20 -132.30 -166.55 -22.55 -56.20 -149.80 -174.05 -68.20 -37.15 -199.35 -138.05 -122.20 -224.15 -129.80 -28.10 -106.70 -75.10 -89.50 -125.00 -165.75

-113.60 -90.80 -196.30 -159.45 -218.70 -125.20 -121.75 -34.45 -112.05 -36.95 -28.35 -80.85 -40.25 -66.55 -49.45 -35.60 -83.90 -43.25 -33.80 -92.50

-27.00 -23.60 -114.10 -24.80 -143.60 -168.60 -225.65 -216.35 -127.50 -125.75 -96.45 -157.10 -82.75 -148.95 -54.85 -136.75 -210.40 -32.15 -137.95 -174.10

-14.50 -19.10 -17.25 -51.95 -14.15 -36.05 -53.55 -48.30 -31.00 -24.90 -20.10 -31.05 -179.70 -16.75 -17.00 -30.35 -223.80 -34.00 -62.70 -35.25

-15.05 -14.00 -37.35 -16.05 -122.35 -18.95 -89.30 -224.30 -106.20 -13.35 — — — — — — — — — —

— — — — — — — — — — — — — — — — — — — —

-13.45 -132.30 -16.55 -17.15 -69.95 -18.05 -135.40 -38.35 -27.95 -13.95 -20.30 -119.75 -15.55 -22.65 -29.70 -19.70 -13.90 -122.25 -72.25 -17.00

-26.40 -93.05 -103.70 -16.35 -12.80 -36.20 -42.15 -14.55 -22.55 -23.30 — — — — — — — — — —

— — — — — — — — — — — — — — — — — — — —

Qwen3

instance_1 instance_2 instance_3 instance_4 instance_5 instance_6 instance_7 instance_8 instance_9 instance_10 instance_11 instance_12 instance_13 instance_14 instance_15 instance_16 instance_17 instance_18 instance_19 instance_20 instance_21 instance_22 instance_23 instance_24 instance_25 instance_26 instance_27 instance_28 instance_29 instance_30 instance_31 instance_32 instance_33 instance_34 instance_35 instance_36 instance_37 instance_38 instance_39 instance_40

-18.90 -37.95 -95.25 -23.55 -16.95 -16.85 -182.75 -223.80 -223.75 -22.20 — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

-20.30 -26.70 -132.00 -21.30 -85.15 -16.35 -223.75 -186.35 -15.55 -223.80 -20.05 -21.20 -14.55 -204.70 -68.70 -23.15 -95.40 -223.75 -22.65 -144.15 — — — — — — — — — — — — — — — — — — — —

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

-22.65 -20.60 -16.05 -184.95 -21.65 -115.85 -23.70 -17.20 -176.30 -41.35 -148.60 -15.40 -16.65 -18.10 -16.35 -19.75 -17.05 -21.35 -193.65 -15.75 — — — — — — — — — — — — — — — — — — — —

-17.60 -14.15 -16.00 -14.00 -16.35 -192.70 -21.30 -15.75 -224.30 -72.00 — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

-30.90 -223.70 -15.10 -224.35 -15.65 -47.90 -211.70 -58.35 -24.50 -40.85 -17.75 -223.80 -25.50 -19.70 -24.50 -16.55 -224.30 -223.75 -58.25 -18.30 -19.20 -14.35 -18.90 -18.95 -25.45 -22.60 -20.75 -24.05 -21.35 -41.40 -223.60 -15.25 -223.80 -14.20 -21.20 -222.15 -19.65 -19.05 -16.30 -18.45

-212.20 -223.75 -72.25 -19.35 -18.00 -20.65 -29.65 -210.70 -223.80 -223.70 — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —