arXiv CSopen access

Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory

Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory Beining Wu∗ , Zihao Ding∗ , Jun Huang∗ , and Yanxiao Zhao† ∗ Department of Electrical Engineering and Computer Science, South Dakota State University, Brookings, SD 57007, USA

arXiv:2606.25115v1 [cs.LG] 23 Jun 2026

Email: [email protected], [email protected], [email protected] † Virginia Commonwealth University, Richmond, VA, USA Email: [email protected]

Abstract—On-device language-model agents improve by accumulating experience in retrieved memory rather than by updating weights. This memory is hard-bounded and exposed: it consumes RAM and energy, reaches peers through a thin uplink, and becomes an attack surface because it is writable by what the agent reads. Existing systems each cover one part of this problem: agentic memories grow without a budget, on-device methods keep entries by success alone, and poisoning is studied mainly as an attack rather than as a memory-governance problem. We propose CURATOR, a single net-value-per-byte score that governs an agent’s experience-memory lifecycle. The main idea is to let the budget act as the curator: each entry is scored as value minus harm, per byte, so one ruler decides what to keep, share, and trust. CURATOR makes three decisions: (1) KEEP evicts low-value bytes under the RAM and energy budget; (2) SHARE sends an insight only when its value exceeds its uplink cost; and (3) TRUST gates a peer entry by provenance. On language-model-agent taskdrift benchmarks and a real heterogeneous Jetson testbed with two robot-arm nodes and a hub, CURATOR reduces memory by 2.7× and uplink by 2.4×, drives injection success from 0.75 to zero, and raises accuracy on cases corrupted by poison or stale memory. Curating by net value reduces footprint, energy, uplink, and injection success together without reducing accuracy. In this setting, forgetting by net value improves the agent rather than weakening it. Index Terms—On-device LLM agents, continual learning, experience memory, edge computing, memory governance, valueaware eviction, cross-agent memory sharing, memory poisoning.

I. I NTRODUCTION N-device language agents are moving from cloud-only services to local hardware. Apple [1], Google [2], Microsoft [3], Meta [4], and Alibaba [5] now ship language models that run directly on phones, and similar agents are being deployed on robots and other edge devices [6]–[10]. They remain local to protect private data and to keep working when connectivity drops. After deployment, however, they are still expected to improve in the field without sending user data back for retraining. They do so by accumulating experience rather than updating weights: successful and failed task episodes are distilled into reusable insights, written to an external memory, and retrieved at inference time [11]. This shift does not remove the continual-learning problem; it moves the problem from parameter updates to memory access [11]. On a server, a growing memory is mostly a management cost; on the edge, it is a resource and a security constraint. An on-

O

Structure-based Memory Need: long-horizon recall Need: fit the context budget Exemplary Work: Exemplary Work: A-MEM, Agentic Memory MemGPT, MemoryBank

Memory only grows, never forgets! Ranks

Grows The Crux of On-Device Memory

Need: keep the entries worth most Exemplary Work: MaRS, A-MAC, ondevice replay

Curates value, blind to the fleet!

Value-based Curation

Governs

Budget-curated Governance Forget by net value, and improve! Aim: govern keep, share, and trust with one netvalue-per-byte ruler Our Contribution: CURATOR

Fig. 1: The on-device agent-memory design space: CURATOR uses one net-value-per-byte score to decide what to keep, what to share, and what to trust. device agent runs under fixed RAM and energy limits, reaches peers through a thin and intermittent wireless link, and exposes a writable memory surface to whatever the agent reads. Three edge constraints force three decisions about the same memory. The RAM and energy budget forces KEEP: which accumulated experiences earn their bytes. Recency and replayby-success, the usual signals, can retain over-specific and stale entries. Much raw experience even carries negative value, reducing accuracy on hard cases when it is kept verbatim rather than distilled [11]. This gives the first question (Q1): under a hard footprint budget, which experiences are worth keeping? Because the memory is writable by anything the agent reads, it also forces TRUST. A poisoned entry crafted to help on an attacker’s queries is exactly what a value-only filter keeps, and a handful of such entries can raise injection success to 90–99% [12], [13]. This gives the second question (Q2): how can the memory admit useful experience without admitting attacks? Finally, the thin uplink to a peer raises SHARE: which distilled insights are worth sending. Keeping an entry locally, sharing it over the uplink, and trusting a received entry are three forms of the same question: whether an experience is worth its footprint. This gives the third question (Q3): can a single score govern all three decisions together? Existing work answers at most one of these questions

(Figure 1). On-device replay adaptation ranks which successful episodes to keep, but it does so on one device, by success alone, with no treatment of energy, sharing, or trust [14]. Agentic-memory architectures such as A-MEM organize and grow memory but do not evict it under a budget [15], [16]. Budgeted text-memory scoring curates by value but does not model energy, cross-agent sharing, or poisoning [17], [18]. A recent framework for governing evolving agent memory remains conceptual, without an empirical mechanism [19]. Memory poisoning is studied mainly as an attack rather than as part of value-aware memory governance [12], [20]. None answers, with one mechanism, what to keep, what to send, and whom to trust under three physical budgets. We propose CURATOR, a Continual, bUdget-cuRated Agent-memory neT-value scOreR. A single net-value-per-byte score answers Q1–Q3 by reading one quantity under three budgets. The score weighs an entry’s expected future value against a harm term that combines negative transfer and doubtful provenance into one currency. Under this rule, demoting a stale local entry and demoting a peer entry of suspect origin become the same operation. For Q1, CURATOR maintains the resident set by evicting the least valuable bytes under the RAM and energy budget. For Q2, the provenance term gates admission: a useful-looking but suspect entry (external, instruction-like, and unreinforced) receives a low score and is held at the door. For Q3, the same score prices a candidate insight against its uplink cost before sharing, so one ruler governs the memory lifecycle from local retention to cross-agent exchange. Our contributions are as follows.

print, energy, and uplink fall; injection success falls; and task accuracy holds, rising precisely on the cases that stale or poisoned memory had corrupted. This holds for two reasons: a frozen agent resists forgetting, so shedding low-value bytes costs little [21], and much accumulated raw experience carries negative value, so removing it repairs rather than weakens the agent. On the edge, the budget does not damage the agent; it edits the agent’s memory. To our knowledge, CURATOR is the first system to govern an on-device agent’s experience memory, including cross-agent sharing and trust, with a single budgeted value score, and to validate it on a real heterogeneous Jetson testbed.

We formulate on-device experience-memory governance around a single principle: the budget is the curator. Net value per byte is the missing state variable in recency- and success-based policies. Eviction alone saves footprint and energy; only the net-value ruler also carries the uplink, safety, and accuracy-recovery axes. • We demonstrate that this single score covers the full memory lifecycle. A lifecycle-coverage grid places every prior method on at most one of keep, share, and trust; perbudget Pareto fronts show that accuracy holds to each budget’s knee; and a component ablation confirms that provenance is what drives injection success to zero. • We provide real on-device evidence with an explicit poison analysis. Across LLM-agent task-drift benchmarks and three backbones, CURATOR cuts peak memory by 2.7× and per-round uplink by 2.4×, drives injection success from 0.75 to zero, and raises accuracy on the cases stale or poisoned memory had corrupted. The score reaches 97% of a full-memory oracle’s accuracy at 37% of its footprint. On a real heterogeneous Jetson testbed (two robot-arm nodes and a hub), the same governance rule holds: measured energy, memory, and uplink each fall to 0.38–0.64 of keep-all.

Edge memory budgets. On a server, a growing memory is mostly a management cost; on the edge, it is a hard resource limit [28]–[33]. Resident entries compete for a fixed RAM budget [34]; each retrieval and re-embedding step consumes battery energy; and sharing an insight with a peer uses a thin, intermittent wireless uplink [35]–[38]. None of these budgets grows with the memory, so keeping every entry is not a hardware-feasible baseline.

•

Contrary to the intuition that forgetting trades away capability, curating memory by net value moves four usually competing axes in the same beneficial direction: peak foot-

II. BACKGROUND AND M OTIVATION

A. Experience Memory on the Edge On-device continual learning. An on-device language agent adapts mainly by changing what it remembers, not by updating its weights. Successful and failed task episodes are distilled into reusable insights, stored in an external memory, and retrieved at inference time [11], [22]–[27]. The agent in this paper is a frozen large language model (LLM) planner that calls fixed low-level primitives. Continual learning therefore does not disappear under this design; it moves from parameter updates to memory access [11].

Memory as an attack surface. The memory can be written by anything the agent reads: an observation, a tool output, or an insight received from a peer. A single poisoned entry that survives retrieval can steer the agent on attacker-selected queries [13], [39]. In retrieval-augmented memory, as few as five crafted entries can raise the injection attack success rate (ASR) to 90–99% [12]. Once an entry is rewritten across sessions, it becomes difficult to separate from a useful one [20], [40]–[42]. A larger store widens this opening rather than closing it [43], [44]. Table I quantifies the cost of keeping every entry on our benchmark. The footprint stays at its maximum, and a freshness-first retriever leaves injection ASR at 0.75. An exhaustive retriever over the same full store surfaces every poisoned entry and reaches 1.00, so more memory is not safer under either retrieval rule. The edge prevents the agent from keeping everything, and the next two insights show that the agent should not keep everything either.

Metric Peak footprint (KB) Injection ASR

No curation 286.7 0.75

Full-memory oracle 286.7 1.00

2. Perform

1

Injection ASR

Accuracy (%)

40 no curation CURATOR

20

0.8 value-only keep-all provenance

0.6 0.4

Victim

Poison

0

2

4

6

10

Experience stream

Reuse value

Keep

Conditional utility

Harm estimate

Share

Provenance

Byte footprint

Trust

Curated memory

15

Poisoned entries

(a) Accuracy by subset

Recent queries

1. Curate

Retrieval propensity

Fig. 3: Overview of CURATOR: one net-value-per-byte score ρ governs K EEP, S HARE, and T RUST.

0.2 0

Clean

4. Update value

LLM agent

80 60

Task outcome / verifier

3. Feedback

TABLE I: Cost of keeping everything. Both columns store every entry, so the footprint is identical; they differ only in the retriever, freshness-first versus exhaustive, which sets the injection ASR.

(b) Why provenance

Fig. 2: Forgetting by net value (solid: Qwen2.5-3B, dashed: Qwen2.5-7B, dotted in (b): Phi-3.5-mini; 5–15 seeds). (a) value-aware curation recovers the victim and poison subsets while clean accuracy holds; (b) a value-only filter and the keep-all oracle both leave injection ASR high, while the provenance term in ρ holds it at zero. B. Insight: Forgetting by Net Value Insight 1: Evicting low-value experience has little cost, because a frozen agent retains its skills, and much accumulated experience is worth less than the bytes it occupies. Two properties make value-aware forgetting safe. First, a frozen agent does not lose a skill when its memory shrinks, because the skill remains in the model weights rather than in the discarded bytes [21]. Shedding low-value bytes therefore has little effect on clean-task accuracy. Second, accumulated experience is not uniformly useful. A raw trajectory kept verbatim can carry negative value on hard cases, while distilling the same trajectory into abstract insight moves its net contribution from −26.1 to +3.3 [11]. Figure 2(a) shows the consequence on both 3B and 7B backbones: value-aware curation recovers the negative-transfer and poisoned cases that a no-curation store answers incorrectly, while clean-task accuracy is preserved. Value alone is not enough. A poisoned entry is written to look useful, so a value-only filter keeps it and injection ASR stays high; only when the net-value-per-byte score ρ also charges doubtful provenance does injection ASR fall to zero (Figure 2(b)). A memory that keeps everything therefore pays twice: once in footprint and once in accuracy lost to stale or poisoned entries. Opportunities of value-aware forgetting. If forgetting is cheap and some experience is harmful, the question is not how much to keep but which bytes earn their place. Recency and replay-by-success can retain the over-specific or adversarial entries that cause the damage. The agent instead needs a value signal: how much an entry will help future tasks, net of the

harm it can cause, per byte it occupies [45]–[47]. C. Insight: One Ruler for Keep, Share, and Trust Insight 2: Keeping, sharing, and trusting answer the same question: whether an experience is worth its footprint. A single net-value-per-byte score can therefore govern all three. Each edge constraint forces a decision about the same memory: RAM and energy force KEEP (which entries stay resident), the uplink forces SHARE (which distilled insights to send to a peer), and an untrusted peer forces TRUST (which received entries to admit). These decisions are usually handled by separate mechanisms, such as replay policies, communication schedulers, and security filters, each with its own threshold. That separation is unnecessary here. All three decisions ask whether an experience is worth its cost, where the cost may be resident bytes, uplink bytes, or risk from doubtful origin. One score answers all three because the costs share a currency: it estimates value per byte and subtracts a harm term for stale, over-specific, or doubtfulorigin experience. Table II reports one such score cutting the footprint by 2.7×, reducing the uplink by more than half, and driving injection ASR to zero at the same time. Opportunities of one-ruler governance. One score for all three decisions removes the hand-tuned weights of separate modules and puts de-staling and safety on one code path: the same harm term that demotes a stale local entry also demotes a peer entry of doubtful provenance. III. S YSTEM D ESIGN A. Overview CURATOR uses a single score to govern a frozen large language model (LLM) agent’s experience memory across three phases: profile, score, and govern (Figure 3). The profile phase keeps three lightweight statistics: a device-level sliding TABLE II: One score governs keep, share, and trust. Decision KEEP SHARE TRUST

Metric Peak mem (KB) Uplink (B/round) Injection ASR

Without ρ 286.7 1068 0.75

With ρ 107.4 454 0.00

sketch of recent query embeddings, a label-free estimate of each entry’s effect on task outcomes, and an origin tag for each entry. The sketch updates in O(d) time and stores no history, and the per-entry statistics are constant-size, so profiling adds negligible overhead. The score phase combines these statistics with the entry’s byte cost into one score ρ, the entry’s net value per byte. The govern phase reads ρ three times: K EEP maintains the resident set under a memory budget, S HARE selects which distilled insights to send to a peer under an uplink budget, and T RUST decides which peer entries to admit. Algorithm 1 performs all three decisions in one pass. CURATOR does not update agent parameters. The LLM planner and its low-level primitives remain frozen and receive no gradients, so lifetime adaptation comes only from memory content. The only learned component is the label-free helpfulness head inside V̂ , which is fitted online but never changes a planner or task parameter. B. The Net-Value-Density Score All three decisions act on the same object, a memory entry, and ask the same question: whether the entry is worth its bytes. CURATOR therefore estimates one quantity, net value per byte, and reads it three ways. A single score removes the separate weights that a replay policy, a communication scheduler, and a security filter would otherwise tune, and places de-staling and safety on the same code path. CURATOR scores an entry m as V̂ (m) − λ Ĥ(m) , (1) ρ(m) = b(m) where b(m) is the footprint of m, λ trades value against harm, and the denominator makes ρ a density. An entry therefore competes on value per byte rather than on value alone. Table III summarizes the notation. The value V̂ (m) multiplies three factors, V̂ (m) = p(m) q(m) a(m),

(2)

the retrieval propensity p, the conditional helpfulness q, and the abstraction gain a,
exp ⟨em , q̄⟩/κ b0 (m)
, a(m) = , b(m) ′ m′ ∈M exp ⟨em , q̄⟩/κ   q(m) = Ex U (x; Rx ∪ {m}) − U (x; Rx ) .

p(m) = P

(3)

Propensity is the softmax retrieval probability of m against a running sketch q̄ ← ϕ q̄ + (1 − ϕ) q of recent query embeddings, at temperature κ. The sketch is one vector and keeps no history. Helpfulness is the average marginal utility of admitting m to the retrieved  set Rx . Its utility is read labelfree as U (x; R) = Ey c(y) , the expected self-consistency c(·) of the agent’s sampled answers y under context R. The term q is tracked online by a calibrated streaming head, so no ground-truth reward is required. Abstraction gain is the ratio between the raw trajectory’s bytes b0 (m) and the bytes kept after distillation. Compressing an episode into an insight shrinks b(m) and can turn a negative verbatim contribution into a useful entry [11].

TABLE III: Notation used in CURATOR. Symbol Meaning Memory and score m, M a memory entry; the experience memory b(m), b0 (m) stored and raw byte footprint of m ρ(m), ρs (m) net-value density of m; its share-score variant λ value/harm trade-off weight Value and harm V̂ (m), V̂p (m) estimated value of m, locally and at a peer p, q, a retrieval propensity, helpfulness, abstraction gain x, Rx , U a query, its retrieved set, and the utility function estimated harm of m Ĥ(m) η, π negative-transfer and provenance risk s, σ entry specificity and the logistic function Estimators em , q̄ entry and running query-sketch embeddings ϕ, κ sketch smoothing and retrieval temperature µ, Σ working-task centroid and covariance w, ψ provenance weights and feature map Budgets and decisions B, L resident-memory and uplink budgets τ, θ, δ share, trust, and redundancy thresholds S, U , A resident, shared, and admitted sets Q, ν, ε̄ energy queue, weight, and budget

The harm Ĥ(m) adds two risks that a value-only ruler ignores, Ĥ(m) = η(m) + π(m),
π(m) = σ w⊤ ψ(m) .

η(m) = s(m) em − µ Σ−1 ,

(4)

The negative-transfer risk weights an entry’s specificity s(m) by the Mahalanobis distance of its embedding from the working-task centroid µ under covariance Σ. This term charges an entry that overfits a distant episode. The provenance risk π(m) is load bearing: it is a logistic gate over a feature map ψ(m) that encodes the entry’s origin (external, peer, or self-derived), its self-reinforcement count across sessions [20], and its resemblance to an injected instruction. The gate weights w are a fixed prior, set once and shared across backbones and devices rather than fitted online. As a result, the helpfulness head inside V̂ remains the only learned component, and the gate gives an attacker no training surface to shift. Because π enters ρ, a poisoned entry is charged before it can steer the agent. C. Three Decisions Under Three Budgets 1) Problem Formulation: K EEP chooses the resident set of greatest retained value under the memory budget, max

S⊆M

s.t.

X

V̂ (m) − λ Ĥ(m)

m∈S

X

(5)

b(m) ≤ B.

m∈S

Proposition 1 (Density-ordered optimality, folklore): Sorting M by ρ and admitting greedily until B is exhausted solves the continuous relaxation of Equation (5) exactly and loses at most one entry to integrality, so for entries small against

single query sketch q̄p , against which the sender re-projects the retrieval propensity,

Algorithm 1: Budget-Curated Memory Governance Input: memory M; budgets B, L; thresholds τ, θ; weight λ. Output: resident set S; shared set U; admitted set A. 1 foreach m ∈ M do 2 V̂ (m) ← p(m) q(m) a(m) 3 Ĥ(m) ← η(m) + π(m)
4 ρ(m) ← V̂ (m) − λ Ĥ(m) /b(m) 5 end 6

/* K E E P : resident set under budget B

exp ⟨em , q̄p ⟩/κ
q(m) a(m), V̂p (m) = P ′ m′ ∈M exp ⟨em , q̄p ⟩/κ | {z } pp (m)

*/

sort M by ρ descending; S ← ∅ 8 foreach m ∈ M in order do 9 if b(S)+b(m) > B then m ← D ISTILL(m) 10 if b(S)+b(m) ≤ B then S ← S ∪ {m} 11 end 7

12

/* S H A R E : value-vs-uplink knapsack

*/

U ←∅ 14 foreach m ∈ S by ρs descending do 15 if ρs (m)>τ and m not redundant and b(U)+b(m)≤L then U ← U ∪ {m} 16 end 13

17

/* T R U S T : provenance-gated admission

*/

A←∅ ′ 19 foreach peer entry m do 20 if ρ(m′ ) > θ then A ← A ∪ {m′ } 21 end 22 return S, U, A 18

B the retained net value is near-optimal, in O(|M| log |M|) time [48]. Memory and energy impose different limits. The budget B caps footprint and enters Equation (5) directly. Energy is not bytes, so it stays out of the denominator of ρ. Instead, CURATOR holds the time-averaged retrieval and re-embedding energy below a budget ε̄ with a virtual queue   Q(t+1) = Q(t) + ε(t) − ε̄ + , (6) and admits an entry by the drift-plus-penalty cost ρ(m) − ν −1 Q(t) ε(m). Admission therefore tightens as the queue Q(t) grows. A standard drift-plus-penalty argument [49] keeps the queue mean-rate stable, limT →∞ E[Q(T )]/T = 0, so the timeaveraged energy stays within ε̄ while ν trades the residual value against the backlog. The score remains one currency, while the budgets remain separate. 2) Three Rules from One Score: Algorithm 1 reads ρ three times. K EEP runs the density-ordered greedy that realizes Proposition 1: entries enter in order of ρ until B is full. An entry about to fall out is first distilled, which can raise its ρ enough to keep it resident. S HARE applies the same rule over the uplink budget. A distilled insight goes to a peer only when its value there, net of harm, clears the transmission cost, ρs (m) =

V̂p (m) − λ Ĥ(m) > τ. b(m)

(8)

(7)

The peer value V̂p is unobservable because a device never sees another device’s queries. Each peer instead advertises a

so the distilled helpfulness q and abstraction gain a transfer unchanged while only the propensity is recomputed under the peer’s working set. One vector crosses the link, so no raw query or trajectory leaves a device. Because Ĥ enters Equation (7), an entry of doubtful origin scores low and is held back, so a poisoned insight is not amplified across peers. A redundancy test keeps m only when maxm′ ∈U ⟨em , em′ ⟩ < δ, dropping near-duplicates already sent, and τ rises as the remaining uplink shrinks. T RUST admits a peer entry m′ only when ρ(m′ ) > θ. The receiver scores m′ with the sender-advertised helpfulness and abstraction gain but recomputes propensity and harm locally. Admission therefore never depends on a peer’s claim about its own trustworthiness, and the provenance term in Ĥ(m′ ) pushes a poisoned entry below θ before it becomes resident. One harm term thus acts three times on one adversary: a selfreinforcing entry is evicted by K EEP, withheld by S HARE, and rejected by T RUST, with no separate objective re-tuned between them. The provenance term does the real work behind this safety result. Because a poisoned entry is built to help on the attacker’s queries, its value V̂ is positive, so the term π is the only reason injection success falls as the memory is curated, which a provenance ablation tests directly. Throughout, CURATOR governs only the agent’s experience memory, namely the task and planning insights it stores, shares, and retrieves. It never governs a motion or action policy. IV. I MPLEMENTATION We implement CURATOR as a lightweight governance layer over the agent runtime, without retraining the planner. The layer maintains the experience store, the ρ scorer with its value and harm heads, the K EEP, S HARE, and T RUST governors in Algorithm 1, and the per-budget accounting for B and L. The planner remains frozen, and the only component fitted online is the label-free helpfulness head inside V̂ . Qwen2.5-3BInstruct is the primary backbone. Phi-3.5-mini and Qwen2.57B-Instruct repeat the main comparison as on-device robustness checks. All planners run at 4-bit, with the retrieval sketch built over bge-small and e5-small embeddings. The main evaluation substrate is a set of on-device large language model (LLM) agent benchmarks that cover text and tool use under task drift and prompt injection. S HARE and T RUST, which require more than one agent, run on a simulated peer group of M ∈ {2, 4, 8} agents [50]–[52] with a measured-bandwidth uplink model. Across these runs, the scorer adds less than 2% compute and a few kilobytes of state, so governance is not the bottleneck. For physical deployment, we build a real heterogeneous three-node testbed (Figure 4). Two budget-constrained agents

TABLE IV: Lifecycle coverage: only ρ scores all three decisions with one quantity. ✓ full, ∼ partial, blank none; Deploy = validated on real edge hardware.

Wireless uplink

Jetson AGX Orin 1

Jetson AGX Orin 2

Jetson AGX Thor

CAN Protocol Robotic Arm Controller

Panthera-HT Arm 1

AGX Orin 1

CAN Protocol

AGX Thor(hub)

KEEP SHARE TRUST ✓ ✓ ✓ ∼ ∼ ∼ ✓

Harm ✓ ∼

1-score Deploy ✓ ✓ ∼ ✓

V. E VALUATION Panthera-HT Arm 2

AGX Orin 2

Robotic Arm Controller

Panthera-HT (Arm 1)

System CURATOR A-MAC [57] MaRS [17] A-MEM / Agentic [15], [16] naive-LRU

Panthera-HT (Arm 2)

Fig. 4: Real heterogeneous testbed: two NVIDIA Jetson AGX Orin 64 GB nodes, each running the 3B planner and driving one HighTorque Panthera-HT arm, and a Jetson AGX Thor hub (Blackwell, 128 GB, 7B planner) over a real wireless uplink on which S HARE and T RUST exchange insights. are NVIDIA Jetson AGX Orin 64 GB nodes, each running the 3B planner and driving one HighTorque Panthera-HT arm. A higher-tier NVIDIA Jetson AGX Thor node, with a Blackwell GPU and 128 GB of memory, runs the 7B planner and serves as the sharing hub. The three nodes communicate over a real wireless uplink on which S HARE and T RUST exchange insights. This heterogeneity is deliberate. On an Orin node the memory budget binds first, whereas on the higher-power Thor node memory is ample but the larger energy draw and the thin uplink bind instead. One score ρ therefore governs each node under whichever budget is scarce, with no perdevice retuning. The planner emits high-level actions, such as a parameterized pick or a tool call, and off-the-shelf lowlevel controllers execute them. CURATOR therefore governs only the planner’s experience memory and never a motion policy. We measure on-device cost per node and across both Jetson generations: an INA3221 rail monitor reports energy in joules, tegrastats reports peak resident memory, and the system counts the bytes actually sent over the wireless uplink. These measurements, reported with our evaluation, show that one score ρ keeps each node within real energy, memory, and bandwidth limits.

A. Experimental Setup Agent and benchmarks. The agent is a frozen large language model (LLM) planner that calls fixed low-level primitives, so its only adaptation across a task stream comes from the content of an external experience memory. Qwen2.5-3B-Instruct is the primary planner, and we repeat the main comparison on Phi-3.5-mini and Qwen2.5-7B-Instruct to separate the effect of the ruler from backbone capacity. The workload consists of task-drift sequences in which later episodes conflict with earlier ones. These sequences are built on ALFWorld [53] and BabyAI-style [54] tool environments, the selective-forgetting and test-time-learning tracks of MemoryAgentBench [55], and long tool-use chains. Each sequence interleaves clean tasks with a victim subset whose correct behavior can be corrupted by stale or over-specific entries. Drift and poison harness. To probe T RUST, we inject PoisonedRAG-, MemoryGraft-, and MINJA-style poisoned insights into the shared memory and measure injection success on an attacker query set, with np =4 poisoned entries per run [12], [13], [56]. A poisoned entry is written to help on the attacker’s own queries, so a purely utility-driven scorer has every reason to keep it. Baselines. We compare against no-curation (keep all), naiveLRU, recency, A-MEM [15], Agentic Memory [16], and a text-only port of MaRS [17]. Baselines without a sharing policy broadcast every distilled insight, so their uplink is the broadcast cost. We also report a full-memory oracle, a nondeployable upper bound that keeps every entry and retrieves exhaustively. It bounds the accuracy any curation could recover while paying the full footprint and exposing the full attack surface. Metrics and protocol. We report task quality, selective forgetting (SF) measured as accuracy on the victim subset, peak memory footprint, energy, uplink bytes per sharing round, and injection attack success rate (ASR). Peak memory is resident store bytes in the benchmark environment and process RAM on the testbed. Energy is an on-device proxy in the benchmark environment and measured joules on the testbed. Uplink is the per-round bytes of the measured-bandwidth uplink model in the benchmark environment and the bytes counted on the real wireless link on the testbed. Results are reported as mean and standard deviation over 15 seeds on the primary task-drift benchmark and at least 5 seeds elsewhere.

TABLE V: On-device LLM-agent task-drift benchmark (frozen Qwen2.5-3B, 15 seeds; injection ASR at np =4, 5 seeds). Arrows give the change vs no-curation; red marks the best deployable footprint, uplink, and ASR; the oracle is a non-deployable upper bound. No baseline charges provenance, so all sit at or above the undefended ASR of 0.75. Accuracy gaps to the strongest deployable baseline are within seed noise. Victim Acc (SF) 0.294±0.154 0.247±0.141 0.262±0.128 0.337±0.169 0.329±0.150 0.373±0.219 0.468±0.132 0.420±0.196 (↑0.126)

B. Main Result: Forget to Improve One score is enough to govern the whole lifecycle. Table IV positions ρ against prior memory systems: each prior method covers only part of the lifecycle, such as a replay policy that evicts under a budget, a text memory that distills value, or an admission scorer with no physical budget. None scores keep, share, and trust with a single net-value-per-byte quantity, and none charges both negative transfer and provenance to one harm term. Table V reports the quantitative comparison on the primary benchmark. 1) Four-Axis Improvement: Curating by net value moves every budget axis in the beneficial direction at once. Against keeping every entry, ρ shrinks the resident footprint from 287 to 107 KB, a 2.7× reduction, lowers an on-device energy proxy by 38% (the real testbed shows a measured 36–40% saving, Figure 9), and cuts the per-round uplink from 1068 to 454 B, while driving injection success from 0.75 to 0. Over the same run, task accuracy rises from 0.528 to 0.605 and victimsubset accuracy from 0.294 to 0.420 (Table V). Footprint, energy, uplink, and attack surface fall together, while accuracy is held or recovered rather than paid down. Because every method shares the 15 seeds, the task gain over no-curation is consistent across seeds, whereas the accuracy gap to the MaRS port stays within seed noise. The decisive, low-variance wins are footprint, uplink, and attack surface. Against the non-deployable oracle, ρ reaches 97% of its task accuracy at 37% of its footprint and with none of its attack surface; the oracle pays a full injection ASR of 1.00 for the experience it refuses to forget. The memory-growing baselines show the cost of structure without governance: AMEM and Agentic Memory link and consolidate entries across sessions, so an admitted poisoned entry gains retrieval paths rather than losing them [20]. Their ASR rises to 0.85, while the connective scaffolding competes with task content inside the same footprint and drags accuracy below even the no-curation store. Organizing memory is no substitute for governing it. 2) Accuracy Recovery on Corrupted Cases: The recovered accuracy is concentrated on the cases a no-curation store gets wrong. When we decompose the stream, clean-task accuracy is unchanged within noise, while the victim and poison subsets recover, as previewed in Figure 2(a). This effect comes from the ruler rather than from having a smaller store. Recency and naive-LRU reach the same 107 KB footprint yet leave victim

Peak Mem (KB) 287 287 287 107 107 107 287 107 (↓180)

Uplink (B/round) 1068 1068 1068 1068 1068 1068 1068 454 (↓614)

ASR 0.75 0.85 0.85 0.75 0.75 0.75 1.00 0.00 (↓0.75)

TABLE VI: Backbone robustness: the ρ gain over no-curation holds across planner sizes at the same 2.7× footprint cut. Backbone Phi-3.5-mini Qwen2.5-7B

0.8

Policy no-curation CURATOR (ρ) no-curation CURATOR (ρ)

no curation CURATOR

Task Acc 0.487±0.174 0.589±0.135 0.597±0.092 0.663±0.094

Victim accuracy (SF)

Task Acc 0.528±0.086 0.483±0.104 0.491±0.096 0.554±0.091 0.556±0.075 0.586±0.108 0.621±0.083 0.605±0.099 (↑0.077)

Task accuracy

Method no-curation A-MEM [15] Agentic Memory [16] naive-LRU recency MaRS-port [17] full-mem oracle CURATOR (ρ)

0.6 0.4 0.2

0.6

Victim (SF) 0.342±0.217 0.462±0.192 0.343±0.171 0.466±0.188

Mem (KB) 287.8 107.4 286.7 107.4

no curation CURATOR

0.4

0.2

0

0 Qwen-3B

Phi-3.5

Qwen-7B

(a) Task accuracy

Qwen-3B

Phi-3.5

Qwen-7B

(b) Victim accuracy (SF)

Fig. 5: Backbone robustness across three on-device planners (Qwen2.5-3B 15 seeds; Phi-3.5-mini and Qwen2.5-7B 5 seeds; error bars are SEM). (a) task and (b) victim-subset accuracy both rise under curation on every backbone, at the same 2.7× footprint cut. accuracy near 0.33 and injection success at 0.75, because agebased eviction retains the over-specific and poisoned entries that cause the damage. Replacing ρ with recency removes the safety axis and nearly three quarters of the selective-forgetting gain (Table V). This isolates net value, rather than eviction itself, as the source of the improvement. 3) Backbone-Independent Gains: A stronger planner raises the absolute numbers but not the gap closed by curation (Table VI, Figure 5). On Phi-3.5-mini, ρ lifts task accuracy from 0.487 to 0.589 and on Qwen2.5-7B from 0.597 to 0.663, with injection success again falling to 0 from 0.72, both at the same 2.7× footprint reduction. The operating point is determined by the budget rather than assumed. Figure 6(a) traces accuracy as the resident store shrinks. Below the knee near 107 KB, the store can no longer hold the high-value insights and net-value curation gives up accuracy. Keeping every entry, at full memory (287 KB), spends 2.7× the footprint for no gain. The uplink budget behaves the same way, with the knee at 454 B (Figure 6(b)). We therefore treat the budget dependence of the operating point as part of the finding rather than tuning it away.

40 3B task 3B victim

7B task 7B victim

50 40

Phi task Phi victim

3B task 3B victim

Phi task Phi victim

30 0

100

200

Resident memory (KB)

(a) Memory budget

300

0

200

400

600

800

no defense forged origin provenance

0.4 0.2

1000

Task Acc Victim (SF) Mem (KB) Inj. ASR 0.605±0.099 0.420±0.197 107 0.00 0.543±0.122 (↓0.062) 0.336±0.208 (↓0.084) 107 0.00 0.604±0.101 0.417±0.203 108 0.75 (↑0.75) 0.601±0.103 0.418±0.201 258 (↑151) 0.00 0.557±0.091 (↓0.048) 0.312±0.194 (↓0.108) 107 0.79 (↑0.79)

2

C. Trust Under Poisoning A purely utility-driven scorer cannot protect the memory: a poisoned entry earns a high V̂ , so without the provenance subterm, injection success stays near 0.8 across poisoning budgets, no better than keeping everything (Figure 7(a)). Charging doubtful origin in Ĥ closes this opening. With provenance, ASR is 0 at every budget from two to fifteen poisoned entries. The zero is structural rather than statistical: this injection attack reaches the store only through admission, and the provenance gate scores every injected entry below the trust threshold, so the poison never gains the retrieval priority it depends on.

0.4 0.2

4

6

10

15

0

5

10

15

20

Sharing round

(a) Admission (TRUST)

(b) Residency (KEEP)

Fig. 7: One provenance term across the memory lifecycle (5 seeds; solid: Qwen2.5-3B, dashed: Qwen2.5-7B, dotted in (a): Phi-3.5-mini). (a) provenance holds injection ASR at zero where no defense does, while a forged origin degrades the gate gracefully; (b) admitted poison falls to one fifth of its residency within three rounds while genuine entries stay resident. 70

0.8

60 50 40 Task (3B) Task (7B)

30

Victim (3B) Victim (7B)

Qwen-3B Qwen-7B

0.6 0.4 0.2 0

0

4) Component Ablation: Each term in ρ earns its place (Table VII). Each removal is charged on its natural axis. When a variant holds the full score’s accuracy, we report the footprint it needs; when it cannot, we match the footprint and report the accuracy it gives up. Dropping insight abstraction, so that raw trajectories are stored, costs task and victim accuracy (0.605 to 0.543, 0.420 to 0.336) but touches neither footprint nor safety. Dropping the provenance sub-term of Ĥ leaves accuracy and footprint within seed noise yet returns injection success to 0.75, the unguarded level. Dropping the per-byte normalization keeps accuracy and safety but inflates the footprint from 107 to 258 KB, because the score no longer prefers compact insights. Setting λ=0 removes the harm term entirely and degrades accuracy and safety at once. Each component is therefore load-bearing on a different axis, and the full score is the only configuration that holds all four. The same single-axis pattern holds on Qwen2.5-7B (task 0.601 without abstraction, ASR 0.72 without provenance, 259 KB without per-byte normalization).

poison (no prov.) genuine (prov.) poison (prov.)

0.6

Poisoned entries

(b) Uplink budget

TABLE VII: Component ablation on Qwen2.5-3B (5 seeds): removing each part of ρ degrades one axis only; ↑/↓ vs the full score.

0.8

0 0

Uplink budget (B/round)

Fig. 6: Per-budget Pareto fronts on three on-device planners (3B blue, 7B orange, Phi green; solid ◦ task, dashed □ victimsubset accuracy). Accuracy holds as each budget shrinks to its knee, 107 KB memory (a) and 454 B uplink (b), and falls only below it.

Variant CURATOR (full ρ) w/o abstraction w/o provenance w/o per-byte b w/o harm (λ=0)

0.6

0

Accuracy (%)

30

7B task 7B victim

1

Injection ASR

50

60

Injection ASR

60

1 0.8

Fraction resident

70

Accuracy (%)

Accuracy (%)

70

0.25 0.5

1

2

(harm weight)

(a) Accuracy

4

8

0

0.25 0.5

1

2

4

8

(harm weight)

(b) Injection ASR

Fig. 8: Sweeping the harm weight λ in ρ = (V̂ − λĤ)/b (5 seeds; solid: Qwen2.5-3B, dashed: Qwen2.5-7B). (a) accuracy traces an inverted-U peaking near λ≈1; (b) injection ASR falls to zero once λ≥1. Both backbones share the same safe band. The gate does not act on origin alone. A poisoned entry written to issue an instruction scores high on instructionlikeness and is demoted below the trust threshold whatever utility it forges. A genuine peer insight shares the external origin but scores low on self-reinforcement and instructionlikeness and is admitted. The same term acts at the other two decisions: in the simulated peer group it cuts the fraction of poisoned entries forwarded at S HARE from 0.73 to 0.03, and at K EEP it evicts poison that slips past admission to one fifth of its residency within three rounds (Figure 7(b)). A provenance prior is not a proof of origin, and an attacker who forges a self-derived origin recovers some success. Even then, ASR reaches only 0.30 at fifteen poisoned entries, well below the 0.75 that an unguarded store suffers from four, while genuine residency and forwarding remain intact. The same behavior holds on the smaller Phi-3.5-mini and the larger Qwen2.5-7B planners: across all three backbones the nodefense, forged-origin, and provenance curves nearly coincide (Figure 7(a)), so the gate is model-independent. The harm weight λ in ρ = (V̂ − λĤ)/b sets how aggressively the agent forgets. At λ=0 the score ignores harm and reduces to a pure value scorer; when λ is too large, it discards genuinely useful experience. Sweeping λ exposes a wide safe operating band (Figure 8). Injection ASR falls from 0.79 at λ=0 to zero once λ≥1, as the harm term comes to

Cost vs. keep-all

Energy (J/decision)

30

1

no curation CURATOR

20 10 0

Qwen-3B

Qwen-7B

0.8 0.6 0.4 0.2 0

-3B -7B r-3B hor-7B Orin Orin Tho T

(a) Energy per decision

Energy

RAM

Uplink

(b) Cost vs. keep-all

Fig. 9: Per-decision cost on real hardware across two Jetson generations and two planner sizes (INA3221 power monitor, tegrastats, 5 seeds). (a) absolute energy rises with device tier (Orin → Thor) and model (3B → 7B), yet curation cuts it in every configuration; (b) as a fraction of keep-all, energy, RAM, and uplink all fall to 0.38–0.64 on both backbones. TABLE VIII: Heterogeneous testbed on the real wireless link (Orin peer ← Thor hub, 5 seeds, both planners). ρ-share matches broadcast at a third of the uplink; provenance holds cross-agent poisoning near zero. Planner Mode broadcast-all ρ-share 3B + provenance TRUST − provenance TRUST broadcast-all ρ-share 7B + provenance TRUST − provenance TRUST

Uplink (B/round) 642±30 209±12 211±10 208±15 637±26 210±10 212±14 203±11

accuracy with cross-agent injection success at 0.02. Admitting peer insight ungated lets poison erode accuracy to 0.381 and returns injection success to 0.64, the unguarded level; the same holds on the Qwen2.5-7B planner (Table VIII). These accuracy gains come from clearing negative-transfer and poisoned entries, not from changing the frozen planner, which keeps its skills regardless of how much memory it sheds [21].

Task qual. 0.990±0.007 0.992±0.005 0.991±0.008 0.984±0.012 0.987±0.009 0.995±0.004 0.989±0.006 0.981±0.012

Victim Acc 0.402±0.025 0.410±0.023 0.408±0.030 0.381±0.028 0.460±0.024 0.465±0.022 0.460±0.029 0.434±0.026

Cross-agent ASR 0.66±0.055 0.02±0.013 0.03±0.017 0.64±0.069 0.66±0.052 0.03±0.019 0.03±0.022 0.62±0.064

outweigh the value a poisoned entry can forge (Figure 8(b)). Task and victim-subset accuracy trace an inverted-U that peaks near λ≈1 and declines only beyond λ=4, where the penalty begins evicting useful memory (Figure 8(a)). The band is the same on both planners, so a single default λ=1 is safe and near-optimal across backbones without per-device tuning. D. Real-Hardware Deployment 1) Cross-Generation Consistency: On the real heterogeneous testbed (Figure 4), each governed decision issues a parameterized pick that the arm executes, so the energy, memory, and uplink we measure are the cost of a real embodied workload, not a synthetic loop. Measured per decision, ρ reduces every physical cost on both generations (Figure 9(a)). On Orin, energy falls from 12.84 to 8.19 J, resident memory from 51.6 to 19.4 MB, and uplink from 118 to 47 B per decision; on the higher-power Thor, from 27.0 to 16.1 J, 62.0 to 24.0 MB, and 118 to 47 B. The same pattern holds for the Qwen2.5-7B planner, whose larger model raises the absolute energy but leaves the saving ratio unchanged: every axis falls to 0.38–0.64 of the keep-all cost on both backbones and both generations (Figure 9(b)). Decision latency is unchanged. 2) Cross-Agent Sharing and Trust: The same score governs S HARE and T RUST over the real wireless link (Table VIII). Value-vs-uplink sharing sends barely a third of the bytes required by broadcasting every insight, 209 versus 642 per round on an Orin peer, with no loss of task quality. Provenance is again load bearing on real hardware, on both axes at once: under gated sharing each Orin peer holds 0.410 victim-subset

VI. R ELATED W ORK A. Agent Memory and Continual Learning To improve without weight updates, on-device agents distill task experience into an external memory and retrieve it at inference time [11]. Xu et al. [15] propose A-MEM, which links and grows notes for long-horizon recall, while context-budget memory managers such as MemGPT and MemoryBank [58]– [60] move entries between the prompt and external storage to fit a context budget. MemoryAgentBench [55] evaluates such memories on test-time learning and selective forgetting. Gradient-free schemes [23] adapt the agent online, on-device methods [14], [61] personalize a frozen backbone, and classical continual learning [62], [63] updates model weights. These methods either structure memory or update parameters, but they leave an entry’s byte cost outside the policy. CURATOR is complementary to all of them: it governs which bytes survive under the footprint and energy budget. B. Memory Poisoning and Trust Because an agent’s memory is writable by whatever it reads, the memory also becomes an attack surface. Zou et al. [12] show with PoisonedRAG that a few crafted entries can raise injection success to near certainty, AgentPoison [39] extends the attack to agent memories with optimized triggers, and persistent variants [13], [20], [64] can survive ordinary memory turnover. Existing defenses rely on separate posthoc detectors [43], [65] that screen entries after admission, or weight retrieval by an estimated source reliability [66]. These defenses are compatible with CURATOR, which instead prices provenance into the same value score, so a poisoned entry is not worth keeping in the first place. C. Budgeted Memory Governance Closest to ours, a few systems curate memory by value rather than recency. Zhang et al. [57] propose A-MAC, which is similar to ours in scoring memory admission with multiple utility factors, but it assumes no physical budget, no sharing, and no trust. Other methods weigh text utility alone [17], frame governance only conceptually [19], or reduce the edge footprint through compression [35], [67]. CURATOR differs in its goal: one net-value-per-byte score governs keep, share, and trust together, so sharing becomes the same value question rather than a separate reconciliation of discrete skill bundles across agents.

VII. C ONCLUSION In this paper, we have proposed CURATOR, a governance layer that curates an on-device large language model (LLM) agent’s experience memory by net value per byte. The score charges each entry for the harm it can carry, so a harmful entry loses its place even when it looks useful. Because keeping, sharing, and trusting all ask whether an entry is worth its footprint, one score replaces the separate replay, communication, and security modules an edge deployment would otherwise tune by hand. On LLM-agent task-drift benchmarks, three backbones, and a two-generation Jetson testbed, curation cuts every physical cost to 0.38–0.64 of keep-all, drives injection success to zero, and recovers the accuracy that stale and poisoned memory had cost. The agent improves because it forgets. R EFERENCES [1] Apple, “Apple Intelligence Foundation Language Models: Tech Report 2025,” arXiv preprint arXiv:2507.13575, 2025. [2] Gemini Team, Google, “Gemini: A Family of Highly Capable Multimodal Models,” arXiv preprint arXiv:2312.11805, 2023. [3] Microsoft, “Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone,” arXiv preprint arXiv:2404.14219, 2024. [4] Llama Team, Meta AI, “The Llama 3 Herd of Models,” arXiv preprint arXiv:2407.21783, 2024. [5] Qwen Team, Alibaba, “Qwen2.5 Technical Report,” arXiv preprint arXiv:2412.15115, 2024. [6] X. Wang, Q. Li, and W. Jia, “Cognitive Edge Computing: A Comprehensive Survey on Optimizing Large Models and AI Agents for Pervasive Deployment,” arXiv preprint arXiv:2501.03265, 2025. [7] J. Xu, Z. Li, W. Chen, Q. Wang, X. Gao, Q. Cai, and Z. Ling, “OnDevice Language Models: A Comprehensive Review,” arXiv preprint arXiv:2409.00088, 2024. [8] B. Wu, Z. Ding, L. Ostigaard, and J. Huang, “Reinforcement LearningBased Energy-Aware Coverage Path Planning for Precision Agriculture,” in 2025 ACM Research on Adaptive and Convergent Systems (RACS). ACM, 2025, pp. 1–8. [9] Z. Fang, Z. Liu, J. Wang, S. Hu, Y. Guo, Y. Deng, and Y. Fang, “Task-Oriented Communications for Visual Navigation with Edge-Aerial Collaboration in Low Altitude Economy,” in Proc. IEEE Global Communications Conference (GLOBECOM), 2026. [10] Z. Fang, J. Wang, Y. Ma, Y. Tao, Y. Deng, X. Chen, and Y. Fang, “RACP: Real-Time Adaptive Collaborative Perception Leveraging Robust Task-Oriented Communications,” IEEE Journal on Selected Areas in Communications, 2025. [11] Q. Hu, Q. Long, and W. Wang, “When Continual Learning Moves to Memory: A Study of Experience Reuse in LLM Agents,” arXiv preprint arXiv:2604.27003, 2026. [12] W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models,” in Proceedings of the USENIX Security Symposium, 2025. [13] S. S. Srivastava and H. He, “MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval,” arXiv preprint arXiv:2512.16962, 2025. [14] S. Kim and J. Kim, “SPRInG: Continual LLM Personalization via Selective Parametric Adaptation and Retrieval-Interpolated Generation,” arXiv preprint arXiv:2601.09974, 2026. [15] W. Xu, Z. Liang, K. Mei, H. Gao, J. Tan, and Y. Zhang, “A-MEM: Agentic Memory for LLM Agents,” in Advances in Neural Information Processing Systems, 2025. [16] Y. Yu, L. Yao, Y. Xie, Q. Tan, J. Feng, Y. Li, and L. Wu, “Agentic Memory: Learning Unified Long-Term and Short-Term Memory Management for Large Language Model Agents,” arXiv preprint arXiv:2601.01885, 2026. [17] S. Alqithami, “Forgetful but Faithful: A Cognitive Memory Architecture and Benchmark for Privacy-Aware Generative Agents,” arXiv preprint arXiv:2512.12856, 2025.

[18] Z. Fang, S. F. Hu, Z. Chang, Y. Guo, Y. Tao, H. Liu, M. Ruan, J. Huang, and Y. Fang, “Inference-Time Budget Control for LLM Search Agents,” arXiv preprint arXiv:2605.05701, 2026. [19] C. Lam, J. Li, L. Zhang, and K. Zhao, “Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the Stability and Safety Governed Memory (SSGM) Framework,” arXiv preprint arXiv:2603.11768, 2026. [20] X. Yang, Y. He, S. Ji, B. Hooi, and J. S. Dong, “Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections,” arXiv preprint arXiv:2602.15654, 2026. [21] H. Liu, C. Kim, B. Liu, M. Liu, and Y. Zhu, “Pretrained VisionLanguage-Action Models are Surprisingly Resistant to Forgetting in Continual Learning,” arXiv preprint arXiv:2603.03818, 2026. [22] J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative Agents: Interactive Simulacra of Human Behavior,” in Proceedings of the ACM Symposium on User Interface Software and Technology, 2023. [23] Y. He, J. Liu, Y. Liu, Y. Li, T. Cao, Z. Hu, X. Xu, and B. Hooi, “EvoTest: Evolutionary Test-Time Learning for Self-Improving Agentic Systems,” in International Conference on Learning Representations, 2026. [24] B. Wu, Z. Ding, and J. Huang, “A Review of Continual Learning in Edge AI,” IEEE Transactions on Network Science and Engineering, vol. 13, pp. 6571–6588, 2026. [25] B. Wu and J. Huang, “Lifecycle-Aware Federated Continual Learning in Mobile Autonomous Systems,” arXiv preprint arXiv:2604.20745, 2026. [26] B. Wu, J. Huang, and Y. Zhao, “From Alpha to Omega: LifecycleAware Forgetting Defense in Federated Continual Learning for Planetary Exploration,” in Proceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS), 2026. [27] B. Wu, Z. Ding, and J. Huang, “PRISM: Exposing and Resolving Spurious Isolation in Federated Multimodal Continual Learning,” arXiv preprint arXiv:2605.01061, 2026. [28] Z. Yu, S. Liang, T. Ma, Y. Cai, Z. Nan, D. Huang, X. Song, Y. Hao, J. Zhang, T. Zhi, Y. Zhao, Z. Du, X. Hu, Q. Guo, and T. Chen, “Cambricon-LLM: A Chiplet-Based Hybrid Architecture for On-Device Inference of 70B LLM,” in Proceedings of the IEEE/ACM International Symposium on Microarchitecture, 2024, pp. 1474–1488. [29] R. Yi, L. Guo, S. Wei, A. Zhou, S. Wang, and M. Xu, “EdgeMoE: Empowering Sparse Large Language Models on Mobile Devices,” IEEE Transactions on Mobile Computing, vol. 24, no. 8, pp. 7059–7073, 2025. [30] B. Wu, Z. Ding, and J. Huang, “RELIEF: Turning Missing Modalities into Training Acceleration for Federated Learning on Heterogeneous IoT Edge,” arXiv preprint arXiv:2604.04243, 2026. [31] Z. Ding, B. Wu, J. Huang, and S. Mao, “Application-Aware Twin-inthe-Loop Planning for Federated Split Learning over Wireless Edge Networks,” arXiv preprint arXiv:2604.26105, 2026. [32] C.-C. Xing, Z. Ding, and J. Huang, “A Stochastic Geometry-Based Analysis of SWIPT-Assisted Underlaid Device-to-Device Energy Harvesting,” SIGAPP Appl. Comput. Rev., vol. 25, no. 4, pp. 18–34, 2026. [33] D. Pan, B.-N. Wu, Y.-L. Sun, and Y.-P. Xu, “A Fault-Tolerant and Energy-Efficient Design of a Network Switch Based on a QuantumBased Nano-Communication Technique,” Sustainable Computing: Informatics and Systems, vol. 37, p. 100827, 2023. [34] K. Alizadeh, S. I. Mirzadeh, D. Belenko, S. K. Khatamifard, M. Cho, C. C. Del Mundo, M. Rastegari, and M. Farajtabar, “LLM in a Flash: Efficient Large Language Model Inference with Limited Memory,” in Proceedings of the Annual Meeting of the Association for Computational Linguistics, 2024, pp. 12 562–12 584. [35] Y. P. Shkolnikov, “Agent Memory Below the Prompt: Persistent Q4 KV Cache for Multi-Agent LLM Inference on Edge Devices,” arXiv preprint arXiv:2603.04428, 2026. [36] B. Wu, J. Huang, Q. Duan, L. Dong, and Z. Cai, “Enhancing Vehicular Platooning With Wireless Federated Learning: A Resource-Aware Control Framework,” IEEE/ACM Transactions on Networking, pp. 1–1, 2025. [37] J. Huang, B. Wu, Q. Duan, L. Dong, and S. Yu, “A Fast UAV Trajectory Planning Framework in RIS-Assisted Communication Systems With Accelerated Learning via Multithreading and Federating,” IEEE Transactions on Mobile Computing, pp. 1–16, 2025. [38] Z. Fang, S. Hu, J. Wang, Y. Deng, X. Chen, and Y. Fang, “Prioritized Information Bottleneck Theoretic Framework With Distributed Online Learning for Edge Video Analytics,” IEEE Transactions on Networking, pp. 1–17, 2025.

[39] Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “AgentPoison: Redteaming LLM Agents via Poisoning Memory or Knowledge Bases,” in Advances in Neural Information Processing Systems, 2024. [40] Z. Ding, B. Wu, and J. Huang, “SCALE: Sensitivity-Aware Federated Unlearning with Information Freshness Optimization for Mobile Edge Computing,” in Proceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS), 2026. [41] ——, “EASE: Federated Multimodal Unlearning via EntanglementAware Anchor Closure,” arXiv preprint arXiv:2605.00733, 2026. [42] U. Pudasaini, Z. Ding, and J. Huang, “Securing Smart Agriculture with Communication-Efficient Federated Unlearning,” in 2026 IEEE International Conference on High Performance Switching and Routing (HPSR). IEEE, 2026, pp. 1–8. [43] S. B. Devarangadi, I. Sinha, P. Maheshwari, S. Todmal, S. Mallik, and S. M. Mishra, “Memory Poisoning Attack and Defense on Memory Based LLM-Agents,” arXiv preprint arXiv:2601.05504, 2026. [44] Z. Ding, J. Huang, and J. Qi, “Learning to Defend: A Multi-Agent Reinforcement Learning Framework for Stackelberg Security Game in Mobile Edge Computing,” in International Conference on Computing, Networking and Communications (ICNC). IEEE, 2026. [45] B. Wu, J. Huang, and S. Yu, ““X of Information” Continuum: A Survey on AI-Driven Multi-Dimensional Metrics for Next-Generation Networked Systems,” IEEE Communications Surveys & Tutorials, vol. 28, pp. 5307–5344, 2026. [46] B. Wu, Z. Cai, W. Wu, and X. Yin, “AoI-Aware Resource Management for Smart Health via Deep Reinforcement Learning,” IEEE Access, 2023. [47] B. Wu, J. Huang, and Q. Duan, “Real-Time Intelligent Healthcare Enabled by Federated Digital Twins With AoI Optimization,” IEEE Network, vol. 40, no. 2, pp. 184–191, 2026. [48] H. Kellerer, U. Pferschy, and D. Pisinger, Knapsack Problems. Springer, 2004. [49] M. J. Neely, Stochastic Network Optimization with Application to Communication and Queueing Systems. Morgan & Claypool, 2010. [50] B. Wu and W. Wu, “Model-Free Cooperative Optimal Output Regulation for Linear Discrete-Time Multi-Agent Systems Using Reinforcement Learning,” Mathematical Problems in Engineering, vol. 2023, no. 1, p. 6350647, 2023. [51] B. Wu, J. Huang, and Q. Duan, “FedTD3: An Accelerated Learning Approach for UAV Trajectory Planning,” in International Conference on Wireless Artificial Intelligent Computing Systems and Applications (WASA). Springer, 2025, pp. 13–24. [52] Z. Ding, J. Huang, Q. Duan, C. Zhang, Y. Zhao, and S. Gu, “A DualLevel Game-Theoretic Approach for Collaborative Learning in UAVAssisted Heterogeneous Vehicle Networks,” in 2025 IEEE International Performance, Computing, and Communications Conference (IPCCC). IEEE, 2025, pp. 1–8. [53] M. Shridhar, X. Yuan, M.-A. Côté, Y. Bisk, A. Trischler, and M. Hausknecht, “ALFWorld: Aligning Text and Embodied Environments for Interactive Learning,” in International Conference on Learning Representations, 2021. [54] M. Chevalier-Boisvert, D. Bahdanau, S. Lahlou, L. Willems, C. Saharia, T. H. Nguyen, and Y. Bengio, “BabyAI: A Platform to Study the Sample Efficiency of Grounded Language Learning,” in International Conference on Learning Representations, 2019. [55] Y. Hu, Y. Wang, and J. McAuley, “Evaluating Memory in LLM Agents via Incremental Multi-Turn Interactions,” in International Conference on Learning Representations, 2026. [56] S. Dong, S. Xu, P. He, Y. Li, J. Tang, T. Liu, H. Liu, and Z. Xiang, “Memory Injection Attacks on LLM Agents via Query-Only Interaction,” arXiv preprint arXiv:2503.03704, 2025. [57] G. Zhang, W. Jiang, X. Wang, A. Behr, K. Zhao, J. Friedman, X. Chu, and A. Anoun, “Adaptive Memory Admission Control for LLM Agents,” arXiv preprint arXiv:2603.04549, 2026. [58] C. Packer, S. Wooders, K. Lin, V. Fang, S. G. Patil, I. Stoica, and J. E. Gonzalez, “MemGPT: Towards LLMs as Operating Systems,” arXiv preprint arXiv:2310.08560, 2023. [59] W. Zhong, L. Guo, Q. Gao, H. Ye, and Y. Wang, “MemoryBank: Enhancing Large Language Models with Long-Term Memory,” in Proceedings of the AAAI Conference on Artificial Intelligence, 2024, pp. 19 724– 19 731. [60] Z. Fang, Y. Guo, J. Wang, Y. Zhang, H. An, Y. Wang, and Y. Fang, “Shared Spatial Memory Through Predictive Coding,” arXiv preprint arXiv:2511.04235, 2025.

[61] J. Zeng, Y. Qi, H. Li, C. Li, Z. Lyu, L. Cui, and L. Bai, “RAIE: Region-Aware Incremental Preference Editing with LoRA for LLMbased Recommendation,” in Proceedings of the ACM Web Conference, 2026. [62] J. Kirkpatrick, R. Pascanu, N. Rabinowitz, J. Veness, G. Desjardins, A. A. Rusu, K. Milan, J. Quan, T. Ramalho, A. Grabska-Barwinska, D. Hassabis, C. Clopath, D. Kumaran, and R. Hadsell, “Overcoming Catastrophic Forgetting in Neural Networks,” Proceedings of the National Academy of Sciences, vol. 114, no. 13, pp. 3521–3526, 2017. [63] L. Wang, J. Xie, X. Zhang, H. Su, and J. Zhu, “HiDe-PET: Continual Learning via Hierarchical Decomposition of Parameter-Efficient Tuning,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 47, no. 8, pp. 6687–6702, 2025. [64] G. Zhao, H. Wu, X. Zhang, and A. V. Vasilakos, “ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs,” IEEE Transactions on Information Forensics and Security, vol. 21, pp. 4625–4639, 2026. [65] B. Zhang, H. Xin, M. Fang, Z. Liu, B. Yi, T. Li, and Z. Liu, “Traceback of Poisoning Attacks to Retrieval-Augmented Generation,” in Proceedings of the ACM Web Conference, 2025, pp. 2085–2097. [66] J. Hwang, J. Park, H. Park, D.-W. Kim, S. Park, and J. Ok, “RetrievalAugmented Generation with Estimation of Source Reliability,” in Proceedings of the Conference on Empirical Methods in Natural Language Processing, 2025, pp. 34 267–34 291. [67] C. A. Pham, P. Vepakomma, and S. Horváth, “Learning in the Null Space: Small Singular Values for Continual Learning,” in Proceedings of the Conference on Parsimony and Learning, 2026.