arXiv CSopen access

MeClear: Cooperative Game-Theoretic Attribution and Risk-Aware Memory Clearance for Long-Horizon LLM Agents

· arxiv_cs

arXiv CS · Papers · License: Open Access

artificial intelligence, reasoning, knowledge representation

MeClear: Cooperative Game-Theoretic Attribution and Risk-Aware Memory Clearance for Long-Horizon LLM Agents Boyu Yang∗1 , Jiazheng Sun∗1 , Zilong Lu1 , Zhi Qiu2 , Xin Peng1 , Jun Zheng2 , 2

1 College of Computer Science and Artificial Intelligence, Fudan University, Shanghai 200433, China School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing 100081, China

arXiv:2609.09115v1 [cs.AI] 8 Sep 2026

Abstract Long horizon Large Language Model (LLM) agents rely on external memory systems to preserve user preferences and task knowledge across extended interactions. Conventional retrieval mechanisms optimize semantic compatibility rather than downstream utility, frequently introducing outdated, misleading, or conflicting evidence into the active context. We present MeClear, a task conditioned memory clearance framework that identifies memories featuring negative downstream utility through cooperative attribution and selectively suppresses them from agent execution. MeClear combines Leave One Out screening with sampled cooperative Shapley attribution to distribute utility across interacting evidence, effectively resolving redundant conflict masking where single removal evaluations fail. Utilizing attribution rankings, MeClear executes a query scoped minimal clearance strategy over a nested filtration, verifying task recovery on the cleared context without permanently altering the persistent memory bank. Comprehensive experimental evaluations across ten long dialogue memory pools demonstrate that MeClear achieves a target recall of 85.9% and an overall task recovery rate of 82.3%, representing a 25.5 percentage point improvement over Leave One Out (LOO) baselines.

Code — https://github.com/FudanSELab/MeClear

Introduction Long-horizon Large Language Model (LLM) agents increasingly depend on external memory to retain preferences, observations, and state across extended interactions (Wang et al. 2024a; Zhang et al. 2025). Early architectures demonstrated that persistent experience supports planning, reflection, and continual adaptation (Park et al. 2023). However, growing interaction histories accumulate stale, misleading, redundant, or incompatible records. Recent studies reveal that inaccurate experiences propagate errors across future tasks (Xiong et al. 2025), while semantically related memories often prove contextually inappropriate or functionally harmful (Zhang et al. 2026a; Ha et al. 2026). These findings expose a fundamental failure of relevance-centered retrieval: high semantic similarity does not ensure downstream task utility. Reliable memory deployment therefore demands task-conditioned, postretrieval evaluation of how retrieved records causally influence agent execution. ∗

These authors contributed equally.

As illustrated in Figure 1, jointly processed memories exhibit complex dependencies such as redundancy and joint harm, causing isolated record evaluations to fail. While recent frameworks refine credit assignment via evidenceanchored rewards (Ma et al. 2026) or single-record causal interventions (Srivastava 2026), single-record deletion collapses when redundant memories independently sustain task failure, yielding zero observable counterfactual change. Coalition-based attribution resolves this local masking by measuring marginal contributions across subset permutations (Ghorbani and Zou 2019; Jia et al. 2019a; Nematov et al. 2025). Because exact coalition enumeration is computationally prohibitive for multi-record context windows, practical clearance must efficiently approximate cooperative interaction effects while preserving sufficient contextual variation to uncover masked toxicity. Directly modifying persistent memory introduces severe safety risks due to the inherently query-conditioned nature of memory utility across long-horizon deployment. A stored record that degrades performance on a query can provide indispensable contextual grounding for subsequent tasks, rendering permanent database overwrites prone to catastrophic cross-task performance regression (Wang et al. 2024b; Xu 2025). Retrieval-time defenses mitigate this danger by dynamically regulating active context visibility during inference rather than altering database records (Ha et al. 2026; Zhang et al. 2026a). Nevertheless, existing admission filters fail to isolate which interacting memories causally induce downstream task failures, nor do they verify whether suppressing records restores execution accuracy. Reliable memory maintenance consequently demands reversible, minimal context clearance accompanied by explicit, post-suppression behavioral recovery verification. To address this problem, we present MeClear, a cooperative game-theoretic attribution and risk aware memory clearance framework for long horizon Large Language Model agents. MeClear formulates memory maintenance as a task conditioned decision process connecting counterfactual screening, cooperative Shapley attribution, and verified context clearance. The framework first isolates active contexts from retrieval stochasticity and applies Leave One Out (LOO) screening to filter strong positive evidence. It subsequently executes sampled cooperative attribution to quantify individual memory contributions across diverse coalitions,

Redundant Harm

Joint Harm

Q: What kind of fiction stories does Tim write?

Q: What kind of dream did James have recently?

Reference: Fantasy stories with plot twists

Redundant harmful memories can mask each other

Reference: a dream with a medieval castle full of puzzles and traps

Two memories become harmful only when combined

Tim writes science fiction about technology and space.

James's dream was a futuristic space station with robotic challenges.

Tim says his stories use science-fiction and interstellar themes.

John linked James's sketch to the same space-station dream.

Game-theoretic attribution enables us to quantify the contribution of each memory to answering user queries, identifying unreliable memories for query-scoped removal

Figure 1: Motivation of MeRepair. Semantic relevance alone cannot determine whether retrieved memories are useful for future tasks. Historical utility may hide temporal degradation and memory interactions. MeRepair estimates future memory utility and performs uncertainty-aware repair to maintain reliable long-term memory for LLM agents. resolving redundant conflict masking where local deletion fails. Based on attribution priorities, MeClear executes a query scoped minimal clearance strategy over a nested candidate filtration, verifying task recovery prior to output generation without permanently altering the underlying memory bank. To the best of our knowledge, we are the first to leverage cooperative game-theoretic allocation to address harmful memory context clearance in LLM agents. Our contributions are summarized as follows: • We propose MeClear, a task conditioned memory clearance framework for long horizon Large Language Model agents, unifying cooperative game attribution, structural interaction diagnosis, and verified risk aware context clearance. • We develop a cooperative memory attribution methodology integrating Leave One Out screening with sampled Shapley estimation, effectively resolving redundant conflict masking and modeling multi memory interactions. • We conduct comprehensive evaluations across ten long dialogue memory pools, demonstrating that MeClear achieves an injected target recall of 85.9% and an overall task recovery rate of 82.3%, representing a 25.5 percentage point improvement over Leave One Out baselines.

Related Work Memory Management and Operations for LLM Agents External memory enables LLM agents to retain information across extended interactions. Early paradigms rely on heuristic retrieval (Park et al. 2023), hierarchical context (Packer et al. 2023), or verbal reflection (Shinn et al. 2023), whereas recent frameworks optimize structured memory operations via graph representations, offline consolidation, or reinforcement learning (Chhikara et al. 2025; Zhang et al. 2026b; Wu et al. 2026; Yu et al. 2026; Yan et al. 2026). However, superior retrieval does not guarantee downstream task utility. Semantic relevance frequently retrieves stale, redundant, or functionally incompatible records (Zhang et al. 2026a; Ha

et al. 2026; Liu et al. 2026). Rather than relying solely on semantic similarity or admission filtering, MeClear evaluates post-retrieval functional effects and contextual interactions to dynamically regulate memory visibility. Long-Term Memory Evaluation and Attribution Longterm memory benchmarks assess overall response quality across multi-session dialogues and reasoning (Maharana et al. 2024; Wu et al. 2024; Li et al. 2026), but offer limited causal credit assignment for individual records. While operation-level rewards (Ma et al. 2026) and single-record counterfactual interventions (Saha Roy et al. 2025; Srivastava 2026) attempt fine-grained attribution, they miss interaction-dependent phenomena such as mutual redundancy or joint toxicity. Although Shapley-based valuations capture coalition-level marginal contributions (Ghorbani and Zou 2019; Jia et al. 2019a; Nematov et al. 2025), applying them to agentic context remains unexplored. MeClear adapts coalition-aware attribution to persistent memory, unifying interaction diagnostics with behaviorally verified context clearance under bounded computational budgets. Memory Editing and Safe Context Clearance Model editing updates factual representations via parameter shifts or external patching (Meng et al. 2022a,b; Mitchell et al. 2021a,b; Wang et al. 2024b). In agent memory, record utility is dynamic and query-dependent; permanent modification risks propagating irreversible errors across future tasks (Yu et al. 2026; Yan et al. 2026; Xu 2025). Retrieval-time filtering avoids database overwrites (Ha et al. 2026; Zhang et al. 2026a) but fails to verify interaction-dependent behavioral consequences before suppressing context. MeClear bridges this gap by unifying reversible visibility control, counterfactual contribution analysis, and behavioral verification, suppressing harmful memory influences on a per-query basis while leaving the underlying database intact.

Problem Formulation Consider a long-horizon Large Language Model (LLM) agent that continuously accumulates information across extended interactions. At task step t, the agent maintains an external memory bank Bt containing historical observations, factual evidence, and evolving user-specific information. Given a query qt , an existing retrieval mechanism ρ returns a bounded execution context Mt = ρ(qt , Bt ; K) = {m1 , m2 , . . . , mK } ⊆ Bt ,

(1)

where K is the retrieval budget determined by the underlying memory system and the available context capacity. Each memory record is represented as mi = (xi , ξi ), where xi denotes its textual content and ξi contains auxiliary information such as timestamp, source, confidence, or provenance. MeClear does not replace the underlying retriever. Instead, it operates on the already retrieved context Mt and evaluates whether each exposed memory actually benefits the current task. This separation is essential because semantic relevance does not guarantee downstream utility: a retrieved memory may be topically related to the query while being outdated, misleading, redundant, or incompatible with other active evidence. Let Aθ denote the task agent parameterized by θ. For any active memory coalition S ⊆ Mt , the agent generates an output y according to pθ (y | qt , S). We define the task-conditioned value of coalition S as vt (S) = Ey∼pθ (·|qt ,S) [rt (y)] ,

vt : 2Mt → [0, 1], (2)

where rt (y) ∈ [0, 1] measures task correctness, and vt (S) denotes the query-conditioned expected utility under memory subset S, empirically estimated as vbt (S) via agent execution. Because retrieved memories interact non-independently through redundancy or complementarity, we formulate (Mt , vt ) as a cooperative game with memories as players and vt as the characteristic function. The cooperative contribution of memory mi is defined as ψt,i = X S⊆Mt \{mi }

|S|! (K − |S| − 1)! [vt (S ∪ {mi }) − vt (S)] . K!

(3) The coefficient in Equation (3) equals the probability that S forms the predecessor coalition of mi under a uniformly random ordering of the K memories. Thus, ψt,i measures the marginal effect of mi across diverse contextual coalitions rather than only around the complete retrieved context. The PK resulting allocation satisfies i=1 ψt,i = vt (Mt ) − vt (∅). A positive contribution indicates that the memory improves task utility on average, whereas a negative value indicates that its presence decreases task utility across coalition contexts. To separate meaningful harm from negligible negative variation, we introduce a single tolerance τ ≥ 0 and define the query-conditioned harmful memory set as Ht = {mi ∈ Mt | ψt,i < −τ } .

(4)

Membership in Ht is not an intrinsic or permanent property of a memory record. It is determined jointly by the current query qt , the retrieved context Mt , the task agent Aθ , and the task-value function vt . MeClear therefore treats harmfulmemory attribution as a query-conditioned visibility decision rather than an irreversible modification of the persistent memory bank. For any candidate clearance set C ⊆ Ht , clearing C produces the active context Mt \ C. The corresponding task gain is defined as gt (C) = vt (Mt \ C) − vt (Mt ). A desirable intervention should first maximize task recovery and then, among all interventions attaining the same recovery, remove the fewest memories. We formulate this parameter-free lexicographic objective as Gt = max gt (C), C⊆Ht

Ct ∈ arg min {|C| | gt (C) = Gt } , C⊆Ht

(5) where Gt determines the maximum task gain attainable by clearing a subset of harmful memories, while Ct selects a minimum-cardinality intervention among all clearance sets attaining this gain. The formulation implements the minimal-intervention principle without introducing an additional weighting coefficient. Because ∅ ⊆ Ht and gt (∅) = 0, the optimal gain always satisfies Gt ≥ 0. If no nonempty subset improves the task, the minimum-cardinality solution is Ct = ∅. The exact contribution values and task gains are generally unavailable during execution. MeClear therefore approximates them through finite counterfactual evaluations and verifies the selected intervention on the current query.

Method As shown in Figure 2, MeClear selectively suppresses harmful memories from the active context without modifying persistent storage. It operates across four stages: adaptive retrieval, local screening, cooperative attribution, and verified clearance. The architecture introduces no stage specific tuning coefficients, governed transparently by context capacity, permutation budget, and a single tolerance threshold. Adaptive Task-Conditioned Context Retrieval For query qt , the external memory system retrieves an active context Mt . The term adaptive denotes the query-dependent nature of context selection rather than a re-trained retrieval model, as MeClear operates as a post-retrieval layer without modifying the parameters or indexing of ρ. This separation prevents semantic similarity from being conflated with downstream utility, as the retriever estimates query-record compatibility whereas vt (S) evaluates agent behavior under exposed coalition S. Consequently, memories with comparable retrieval scores can produce distinct task outcomes due to temporal drift, factual conflicts, redundancy, or contextual interaction: Mt = ρ(qt , Bt ; K).

(6)

To isolate the behavioral impact of memory suppression from retrieval volatility, MeClear freezes Mt prior to attribution, executing all subsequent interventions on subsets of this fixed context without re-invoking the retriever. For each coalition S ⊆ Mt , the empirical value vbt (S) is obtained by executing the task agent on S under a fixed evaluator and

Task-Conditioned Context Retrieval

Local Counterfactual Screening & Counterfactual Cooperative Attribution

... External Memory Bank

Verified Clearance Harmful Memories (sorted by increasing contribution)

... Task Query Marginal Effect

Agent

Nested Clearance Candidates (ordered removals)

Existing Retriever Leave-One-Out (LOO) evaluation for each

Active Memory Context (frozen)

＞＜

Positive Near-additive Negative Pairwise Interaction Analysis (optional) Retained

... Stop

Baseline Task Execution (full context) is held fixed for all counterfactual analyses and verification steps.

Candidate Gain (value improvement)

Positive Gain

＞

Recovery Perdicate

ConfidenceBound Estimate Output (query-scoped, reversible) Flagged Harmful

Coalition-Averaged (Shapley) Contribution

Figure 2: Overall architecture of MeClear, combining local screening and cooperative Shapley attribution to output a queryscoped cleared context without modifying persistent storage. cached by memory identity. Evaluating the complete context value vbt (Mt ) first establishes a shared reference baseline for all subsequent counterfactual comparisons. Local Counterfactual Screening MeClear first establishes a local contribution profile using Leave-One-Out (LOO) counterfactual interventions. For each retrieved record mi ∈ Mt , the empirical local effect is defined as: dbt,i = vbt (Mt ) − vbt (Mt \ {mi }) .

(7)

A negative value of dbt,i indicates that suppressing mi improves execution performance on the complete context, whereas a positive value reflects a reduction in task utility upon removal. Values approaching zero remain inconclusive because auxiliary or substitutable evidence may mask the underlying effect. Consequently, MeClear utilizes LOO as an interpretable local screening signal rather than a definitive harmfulness criterion. The structural limitation of singlerecord deletion becomes particularly pronounced under redundant harmful evidence, where multiple records independently induce task degradation. Theorem 1 (Redundant-Harm Blind Spot). Let mi and mj be substitutable harmful memories whose joint effect on the task value function satisfies: vt (S) = ut (S \ {mi , mj }) − ∆t 1 [S ∩ {mi , mj } ̸= ∅] ,

∆t > 0,

(8)

where ut is independent of mi and mj . If both records are present in Mt , then: ∆t dt,i = dt,j = 0, ψt,i = ψt,j = − . (9) 2 Deleting either record leaves the other active, maintaining the degradation penalty in Equation (8) and yielding zero LOO effect. Under random permutations, mi precedes mj with probability 1/2, yielding expected contribution ψt,i = −∆t /2 as shown in Appendix A. Theorem 1 demonstrates that a zero LOO effect does not imply zero cooperative

harm. While LOO measures utility only locally, cooperative attribution evaluates marginal contributions across coalitions where redundant substitutes are absent. MeClear therefore retains the local profile as a diagnostic reference while anchoring harmful memory selection on coalition-averaged contributions. Counterfactual Cooperative Attribution MeClear next estimates memory contributions through the equivalent permutation representation. As depicted in Figure 3, individual memory utility is quantified via permutation sampled Shapley contribution estimation across contextual permutations, while pairwise interaction profiles diagnose structural dependencies among evidence. Let Πt denote the set of all permutations of Mt . For π ∈ Πt , let Pi (π) contain the memories appearing before mi . The exact contribution is: 1 X ψt,i = [vt (Pi (π) ∪ {mi }) − vt (Pi (π))] . (10) |Πt | π∈Πt

Unlike single-record screening, Equation (10) evaluates the marginal contribution of mi across diverse predecessor coalitions, exposing negative utility masked by substitution or redundancy in the full context. Because enumerating all permutations is computationally infeasible for non-trivial context size K, MeClear draws L independent permutations π (1) , . . . , π (L) and computes the sample-average estimate: 1 (L) ψbt,i = L

L h i X vbt Pi (π (ℓ) ) ∪ {mi } − vbt Pi (π (ℓ) ) . ℓ=1

(11) Each permutation is sampled over the context Mt , ensuring beneficial, neutral, and harmful memories co-occur in predecessor coalitions to preserve the underlying game structure. Proposition 1 (Finite-Sample Cooperative Estimation). For independent uniformly sampled permutations, the estimator in Equation (11) is unbiased: h i (L) E ψbt,i = ψet,i , (12)

Paired Counterfactual Marginal Evaluation ...

Which memory is harmful?

Repeated Full-Context Screening ...

...

＞

...

＜

Coalition-Averaged Attribution

＜

1 Repeated Full-Context Effects

Harmful Safe

2 Coalition-Averaged Effects

？

How isharm structured

Interaction-Aware Harm Analysis (Interaction Profile)

Marginal effect of 𝑚𝑖 given 𝑚𝑗

＞＜

Marginal effect of 𝑚𝑖 without 𝑚𝑗 𝑚𝑗 increase the harm from 𝑚𝑖 𝑚𝑗 mitigates the harm from 𝑚𝑖

Direct harm Redundant harm Joint harm Approximately additive Uncertain

Figure 3: Counterfactual attribution and interaction profiling in MeClear. Top: Individual memory harm attribution. Bottom: Pairwise interaction analysis diagnosing direct, redundant, and joint memory harm dependencies. and for any ε > 0, satisfies the concentration bound: Lε2 (L) b e Pr max ψt,i − ψt,i ≥ ε ≤ 2K exp − . 1≤i≤K 2 (13) The summands in Equation (11) represent independent bounded observations of marginal contribution. Applying Hoeffding’s inequality with a union bound across all K records yields the concentration result in Appendix B. Proposition 1 characterizes the approximation error introduced by finite sampling for a fixed empirical game without assuming the underlying model is an unbiased population estimator. MeClear constructs the operational harmful set by thresholding estimated contributions with tolerance τ : n o bt = mi ∈ Mt ψb(L) < −τ . H (14) t,i Using the unified tolerance τ avoids introducing additional hyperparameter thresholds into attribution. To characterize higher-order structural dependencies, MeClear further estimates pairwise non-additivity. Let ∆ij vbt (S) = vbt (S ∪ {mi , mj }) − vbt (S ∪ {mi }) − vbt (S ∪ {mj }) + vbt (S). For predecessor set Pij (π) preceding both mi and mj , the sampled interaction effect is: (L)

ω bt,ij =

L 1X ∆ij vbt Pij (π (ℓ) ) , L

i ̸= j.

(15)

ℓ=1

The resulting interaction profile diagnoses non-additive structures such as substitution, complementarity, and joint interference, serving as a structural behavioral diagnostic rather than a semantic classifier.

Verified Query-Scoped Clearance While the operational harmful set identifies candidate negative memories, suppressing all negatively attributed records may eliminate more context than necessary for task recovery. MeClear therefore approximates the ideal objective in Equation (5) through an ordered sequence of query-scoped clearance candidates. Let bt |. The records in H bt are ordered from the most ht = |H negative to the least negative estimated contribution: (L) (L) (L) ψbt,σt (1) ≤ ψbt,σt (2) ≤ · · · ≤ ψbt,σt (ht ) ,

(16)

bt . A smaller index where σt is a permutation of indices in H indicates a stronger negative contribution and thus a higher priority for removal. MeClear constructs a nested family of clearance candidates along this priority chain: Ct,j = mσt (1) , mσt (2) , . . . , mσt (j) , 0 ≤ j ≤ ht , (17) with baseline Ct,0 = ∅. The candidate sequence satisfies Ct,j−1 ⊆ Ct,j and |Ct,j | = j, reducing the combinatorial search space from 2ht arbitrary subsets to ht + 1 candidate contexts. For each candidate, MeClear computes the empirical query-scoped gain: gbt (j) = vbt (Mt \ Ct,j ) − vbt (Mt ).

(18)

Because all candidates are masked directly from the frozen context Mt without re-invoking retrieval, any observed behavioral gain is strictly attributable to memory removal. Let νt (S) ∈ {0, 1} denote a fixed task-recovery predicate for query qt . The set of admissible candidate indices

Panel A. Case construction and causal signature Case Fault A B C

QA → Gold

Injected pair M

Temporal John in Italy: which month? → Dec. 2023 Conflict Dogs’ reaction to snow? → Confused Factual Effect on Calvin’s songs? → Fresh vibe

Causal signature c

Two paraphrases: Jan. 2023 Two paraphrases: excited/thrilled Two paraphrases: warm, vintage tone

Mechanism

(1.00, 0.50, 0.50, 0.50) Flat plateau; each fault masks the other’s local effect (1.00, 0.00, 0.00, 0.00) Each fault independently reaches the failure floor (1.00, 0.00, 0.00, 0.00) Floor masking; LOO instead selects background G3

Panel B. Attribution and deletion outcome Case

MeClear contribution b 1 ), ψ(F b 2) ψ(F

(−0.094, −0.219)

(−0.281, −0.156)

(−0.206, −0.075)

LOO

MeClear

ContextCite

ProxySPEX

LLM baseline

∅ 0.50 / No ∅ 0.00 / No {G3 } 0.10 / No

M (Exact) 1.00 / Yes M (Exact) 1.00 / Yes M (Exact) 1.00 / Yes

∅ 0.50 / No {F1 } 0.10 / No {F2 } 0.10 / No

{F1 } 0.50 / No {F1 } 0.10 / No ∅ 0.00 / No

∅ 0.50 / No M∪{G1 } 0.00 / No M (Exact) 1.00 / Yes

Notes. c = (v(G), v(G+F1 ), v(G+F2 ), v(G+M )), with frozen top-5 context G and error set M = {F1 , F2 }. Cells report deleted set H, post-deletion task value, and Recovery status (requiring 2/2 correct trials). Hyperparameters: MeClear L = 16, κ = τ = 0.05; ContextCite and ProxySPEX B = 32; LLM baseline score threshold ≥ 0.5. Cases are qualitative examples from qualifying redundant scenarios.

Table 1: Representative redundant-conflict cases illustrating how MeClear resolves local masking.

Experiments

Jt ⊆ {0, 1, . . . , ht } is defined as: n Jt = {0} ∪ j ∈ {1, . . . , ht } o gbt (j) > 0, νt (Mt \ Ct,j ) = 1 .

(19)

Including j = 0 ensures Jt is non-empty. MeClear selects the admissible candidate maximizing verified empirical gain with minimal intervention cardinality: b jt = min arg max gbt (j). (20) j∈Jt

The maximization isolates candidates with peak empirical recovery, while the outer minimum breaks ties by choosing the smallest index and minimal intervention cardinality. The ft = Mt \ C b , resulting query-conditioned context is M t,jt which serves as a query-scoped active context without permanently modifying the persistent memory bank Bt . Theorem 2 (Query-Scoped Clearance Guarantee). For any fixed empirical evaluator vbt and nested clearance family in Equation (17), the context selected by Equation (20) guarantees empirical non-degradation: ft ≥ vbt (Mt ) . vbt M (21) If b jt > 0, the selected context satisfies verified recovery: ft = 1. νt M (22) Furthermore, Ct,bjt achieves minimal cardinality among all admissible candidates attaining the maximum gain. Because the unchanged baseline Ct,0 = ∅ is always admissible with zero gain, the selected candidate cannot yield negative empirical gain, ensuring non-degradation as detailed in Appendix C.

We evaluate MeClear using Kimi-k2.6 as the task agent and Qwen3.6-Flash as the judge evaluator across 745 causally verified test cases containing 1,115 fault records, synthesized from 368 clean queries over ten LoCoMo conversations. Under a hybrid retrieval budget K = 5, memory faults span direct conflicts with n = 375 and |M | = 1, redundant conflicts with n = 285 and |M | = 2, and joint interactions with n = 85 and |M | = 2. We compare MeClear configured with τ = κ = 0.05 and sampling budget L = 16 against Leave-One-Out, ContextCite, and ProxySPEX across four metrics: Target Recall at |M |, Complete Set Recall, Exact Set Match, and Binary Task Recovery. Detailed dataset construction, fault verification protocols, and metric definitions are provided in Appendix D.

Overall Attribution Accuracy and Task Recovery MeClear outperforms all baselines in attribution precision and downstream task recovery. As shown in Figure 4, MeClear achieves 85.9% memory micro-recall, 47.0% exact fault set identification, and 82.3% binary task recovery, whereas LOO suffers from local blind spots, obtaining only 38.3% recall and 56.8% recovery. While ContextCite and ProxySPEX yield high recall, their inability to isolate complete harmful coalitions limits exact identification to 43.5% and 54.2%. Paired comparisons across n = 745 samples in Figure 6 confirm MeClear’s dominance, yielding 212 wins against 22 losses over LOO and significant recovery gains of +25.5% over LOO, +5.0% over ProxySPEX, and +38.7% over Qwen3.5-Plus.

Complete M ⊆ H (case macro)

Recall@|M| (memory micro)

A Overall paired wins/losses MeClear

100%

86.3

85.9

86.7

80.9

81.2

74.9

75%

81.5

76.8

LOO

Δ Recovery, pp [95% CI] +25.5 [+20.9, +29.8]

22 212 both 401 · neither 110

64.2

+0.8 [-4.4, +6.7]

ContextCite 60

50%

B Cross-conversation recovery delta

both 547 · neither 72

+5.0 [+0.7, +9.3]

ProxySPEX

25%

88 both 525 · neither 81

+38.7 [+31.8, +45.5]

qwen3.5-plus

0% Binary recovery (case macro)

50%

81.5

82.3

75%

47.0

43.5

qwen3.5-plus

−10 0 10 20 30 40

conv-41 (n=77) conv-42 (n=88) conv-44 (n=69) conv-47 (n=31) conv-48 (n=100) conv-49 (n=71) conv-50 (n=88)

331

Overall

250

paired cases (n = 745) 77.3

43.6

42.4

Δ Recovery (pp, MeClear − comparator)

Figure 6: Paired comparative advantage and recovery gains. Panel A: head-to-head win/loss statistics across n = 745 cases; Panel B: recovery differentials ∆Recovery with 95% confidence intervals.

56.8

54.2

ProxySPEX

conv-30 (n=55)

both 282 · neither 89

100%

ContextCite

conv-26 (n=67)

conv-43 (n=99)

38.3

Exact H = M (case macro)

LOO

comparator

34.2

25% 0% LOO

MeClear

ContextCite

ProxySPEX

qwen3.5-plus A Clearance outcome per paired case

Figure 4: Overall attribution accuracy and task recovery across evaluation cases compared to baselines.

91.8 96.5 92.9 90.6

87.1 81.8 75.9

36.5

41.2 43.5

184 (24.7%)

Recall

Exact LOO

Recovery MeClear

302 (40.5%)

328 (44.0%)

ContextCite

35.3 36.5

10 conversations · 368 QA · 745 paired cases · 1115 injected memories

235 (31.5%)

MeClear

58.8

59.4

B Clearance composition LOO

272 (36.5%)

307 (41.2%)

ProxySPEX

5.8%

150 (20.1%)

289 (38.8%)

110 (14.8%) 5.5%

259 (34.8%)

383 (51.4%)

qwen3.5-plus 23.5

37.2

conflict 36 factual 44 temporal 5

121 (16.2%) 148 (19.9%)

393 (52.8%)

25%

50%

75%

100%

share of paired cases 6.3

2.5

Joint · n=85

conflict 135 factual 122 temporal 28

12.3

25%

Redundant · n=285

conflict 173 factual 161 temporal 41

LOO MeClear ContextCite ProxySPEX qwen3.5-plus

Joint interaction (n = 85)

43.2

46.0 46.3

49.1

68.4 71.2 64.2

83.2 84.9 77.9 79.5 45.6

56.8 46.1 50.1 64.5

50%

43.7

75.2

rate

75%

68.3

100%

Redundant conflict (n = 285)

87.2 89.6 86.7 84.3

89.6 90.4 87.7

Direct (n = 375)

Direct · n=375

Recall

Exact

ContextCite

Exact + recovered

Recovery

Recall

ProxySPEX

qwen3.5-plus

Exact

Over-selected + recovered

Incomplete + recovered

Exact + not recovered

Non-exact + not recovered

Recovery

Figure 5: Performance across direct conflict, n = 375, redundant masking, n = 285, and joint interaction, n = 85.

Performance Across Structural Fault Mechanisms Stratifying evaluation across direct conflicts with n = 375, redundant masking with n = 285, and joint faults with n = 85 reveals that performance gaps stem from multimemory dependencies, as shown in Figure 5. In direct conflicts, LOO achieves 68.3% recall and 87.2% recovery, while MeClear reaches 83.2% recall and 89.6% recovery. Under redundant conflicts, local substitution causes LOO to collapse to 12.3% recall and 6.3% recovery. By evaluating marginal contributions across permutations, MeClear overcomes local masking, sustaining 83.2% recall, 49.1% exact identification, and 68.4% recovery. Under joint non-additive interactions where LOO fails with 0.0% exact match, MeClear achieves 87.1% recall and 91.8% recovery, demonstrating robust handling of higher-order evidence dependencies.

Case Studies on Redundant Masking Resolution Table 1 illustrates how MeClear resolves local masking in representative redundant fault scenarios. Under plateau (c = [1.00, 0.50, 0.50, 0.50]) and floor (c = [1.00, 0.00, 0.00, 0.00]) masking signatures, LOO fails by returning ∅ or removing benign records because single-fault removals leave substitute harm active. In contrast, MeClear accurately attributes negative cooperative contributions (e.g., b 1 ) = −0.094 and ψ(F b 2 ) = −0.219 in Case A), successψ(F

Figure 7: Query-scoped memory clearance and context composition. Panel A: clearance profiles by conflict type; Panel B: context composition across exact recovery, over-selection, and non-recovery. fully isolating the exact harmful set M and restoring the full task utility.

Query-Scoped Clearance and Context Composition Figure 7 confirms that MeClear consistently maximizes task recovery while minimizing context distortion. MeClear achieves an 80.5% overall recovery rate (44.0% exact set and 36.5% harmless over-selection) with only 14.8% unrecovered failures. Conversely, LOO yields 40.5% failures due to missed redundant faults, and direct baseline LLM filtering via Qwen3.5-Plus results in 52.8% failures from overtruncation or hallucinated deletion. Thus, MeClear’s verified selection rule effectively isolates minimal harmful coalitions while preserving the beneficial task context.

Conclusion Unchecked memory accumulation threatens long-horizon LLM agents by turning external memory into an executiondegrading bottleneck of conflicting evidence. To break this impasse, we propose MeClear, a framework combining permutation-sampled Shapley attribution with a queryscoped verified clearance gateway. Extensive evaluations demonstrate that MeClear achieves an 85.9% target recall and an 82.3% task recovery rate, outperforming Leave-One-Out baselines by 25.5 percentage points. Ultimately, this work es-

tablishes coalition-aware context clearance as a foundational pillar for safe, non-destructive agent memory maintenance.

References Chhikara, P.; Khant, D.; Aryan, S.; Singh, T.; and Yadav, D. 2025. Mem0: Building production-ready ai agents with scalable long-term memory. arXiv preprint arXiv:2504.19413. Ghorbani, A.; and Zou, J. 2019. Data shapley: Equitable valuation of data for machine learning. In International conference on machine learning, 2242–2251. PMLR. Ha, H.; Kim, J.; Qian, C.; Liu, J.; Campbell, W. M.; Wu, Y.; Zhang, Y.; McKeown, K.; Hakkani-Tur, D.; and Ji, H. 2026. MemGuard: Preventing Memory Contamination in Long-Term Memory-Augmented Large Language Models. arXiv preprint arXiv:2605.28009. Jia, R.; Dao, D.; Wang, B.; Hubis, F. A.; Hynes, N.; Gürel, N. M.; Li, B.; Zhang, C.; Song, D.; and Spanos, C. J. 2019a. Towards efficient data valuation based on the shapley value. In The 22nd international conference on artificial intelligence and statistics, 1167–1176. PMLR. Jia, R.; Dao, D.; Wang, B.; Hubis, F. A.; Hynes, N.; Gürel, N. M.; Li, B.; Zhang, C.; Song, D.; and Spanos, C. J. 2019b. Towards efficient data valuation based on the shapley value. In The 22nd international conference on artificial intelligence and statistics, 1167–1176. PMLR. Li, Y.; Guo, W.; Zhang, L.; Xu, R.; Huang, M.; Liu, H.; Xu, L.; Xu, Y.; and Liu, J. 2026. Locomo-plus: Beyond-factual cognitive memory evaluation framework for llm agents. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 25085–25100. Liu, C.; Yang, Y.; Pu, S. X.; Liu, Y.; Long, L.; Guo, Y.; Chen, N.; Weng, Z.; Kochkina, E.; Kaur, S.; et al. 2026. WorldMemArena: Evaluating Multimodal Agent Memory Through Action-World Interaction. arXiv preprint arXiv:2605.29341. Ma, W.; Feng, X.; Huang, L.; Feng, X.; Ma, Z.; Xu, J.; Gao, J.; Hao, J.; He, R.; and Qin, B. 2026. Fine-Mem: Fine-Grained Feedback Alignment for Long-Horizon Memory Management. arXiv preprint arXiv:2601.08435. Maharana, A.; Lee, D.-H.; Tulyakov, S.; Bansal, M.; Barbieri, F.; and Fang, Y. 2024. Evaluating very long-term conversational memory of llm agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 13851–13870. Meng, K.; Bau, D.; Andonian, A. J.; and Belinkov, Y. 2022a. Locating and editing factual associations in gpt. In Advances in neural information processing systems. Meng, K.; Sharma, A. S.; Andonian, A. J.; Belinkov, Y.; and Bau, D. 2022b. Mass-editing memory in a transformer. In The eleventh international conference on learning representations. Mitchell, E.; Lin, C.; Bosselut, A.; Finn, C.; and Manning, C. D. 2021a. Fast model editing at scale. arXiv preprint arXiv:2110.11309. Mitchell, E.; Lin, C.; Bosselut, A.; Finn, C.; and Manning, C. D. 2021b. Fast model editing at scale. arXiv preprint arXiv:2110.11309.

Nematov, I.; Kalai, T.; Kuzmenko, E.; Fugagnoli, G.; Sacharidis, D.; Hose, K.; and Sagi, T. 2025. Source attribution in retrieval-augmented generation. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, 317–332. Springer. Packer, C.; Fang, V.; Patil, S. G.; Lin, K.; Wooders, S.; and Gonzalez, J. E. 2023. MemGPT: Towards LLMs as operating systems. arXiv preprint arXiv:2310.08560. Park, J. S.; O’Brien, J.; Cai, C. J.; Morris, M. R.; Liang, P.; and Bernstein, M. S. 2023. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th annual acm symposium on user interface software and technology, 1–22. Saha Roy, R.; Schlotthauer, J.; Hinze, C.; Foltyn, A.; Hahn, L.; and Kuech, F. 2025. Evidence contextualization and counterfactual attribution for conversational qa over heterogeneous data with rag systems. In Proceedings of the Eighteenth ACM International Conference on Web Search and Data Mining, 1040–1043. Shinn, N.; Cassano, F.; Berman, E.; Gopinath, A.; Narasimhan, K.; and Yao, S. 2023. Reflexion: Language Agents with Verbal Reinforcement Learning. arXiv:2303.11366. Srivastava, S. S. 2026. Causal Intervention-Based Memory Selection for Long-Horizon LLM Agents. arXiv preprint arXiv:2605.17641. Wang, L.; Ma, C.; Feng, X.; Zhang, Z.; Yang, H.; Zhang, J.; Chen, Z.; Tang, J.; Chen, X.; Lin, Y.; et al. 2024a. A survey on large language model based autonomous agents. Frontiers of Computer Science, 18(6): 186345. Wang, P.; Li, Z.; Zhang, N.; Xu, Z.; Yao, Y.; Jiang, Y.; Xie, P.; Huang, F.; and Chen, H. 2024b. Wise: Rethinking the knowledge memory for lifelong model editing of large language models. Advances in Neural Information Processing Systems, 37: 53764–53797. Wu, D.; Wang, H.; Yu, W.; Zhang, Y.; Chang, K.-W.; and Yu, D. 2024. Longmemeval: Benchmarking chat assistants on long-term interactive memory. arXiv preprint arXiv:2410.10813. Wu, Z.; Zhang, H.; Lin, F.; Xu, W.; Xu, X.; Chen, Y.; Zou, H. P.; Chen, S.; Zhang, W.; Liu, X.; et al. 2026. Gam: Hierarchical graph-based agentic memory for llm agents. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 34647–34664. Xiong, Z.; Lin, Y.; Xie, W.; He, P.; Liu, Z.; Tang, J.; Lakkaraju, H.; and Xiang, Z. 2025. How memory management impacts llm agents: An empirical study of experiencefollowing behavior. arXiv preprint arXiv:2505.16067. Xu, J. 2025. Memory Management and Contextual Consistency for Long-Running Low-Code Agents. arXiv preprint arXiv:2509.25250. Yan, S.; Yang, X.; Huang, Z.; Nie, E.; Ding, Z.; Li, Z.; Ma, X.; Bi, J.; Kersting, K.; Pan, J. Z.; et al. 2026. Memory-r1: Enhancing large language model agents to manage and utilize memories via reinforcement learning. In Proceedings of the

64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 12805–12825. Yu, Y.; Yao, L.; Xie, Y.; Tan, Q.; Feng, J.; Li, Y.; and Wu, L. 2026. Agentic memory: Learning unified long-term and short-term memory management for large language model agents. arXiv preprint arXiv:2601.01885. Zhang, J.; Chen, K.; Ma, J.; Hu, Y.; He, L.; Zhang, Y.; Liu, J.; Yang, X.; Zhang, T.; and Jia, R. 2026a. Beyond Similarity: Trustworthy Memory Search for Personal AI Agents. arXiv preprint arXiv:2606.06054. Zhang, J.; Zhang, C.; Chen, S.; Huang, Z.; Zheng, P.; Wang, Z.; Guo, P.; Mo, F.; Bae, S.-H.; Zou, J.; et al. 2026b. Lightweight llm agent memory with small language models. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 12914–12929. Zhang, Z.; Dai, Q.; Bo, X.; Ma, C.; Li, R.; Chen, X.; Zhu, J.; Dong, Z.; and Wen, J.-R. 2025. A survey on the memory mechanism of large language model-based agents. ACM Transactions on Information Systems, 43(6): 1–47.

Appendix

A.2 Why LOO Misses Redundant Harm

Due to the strict page limit of the main paper, we provide supplementary theoretical analyses and experimental details in the appendix. Appendix A proves the redundant-harm blind spot theorem and analyzes why LOO fails under redundant harmful memories. Appendix B establishes the finite-sample guarantee of cooperative attribution estimation. Appendix C provides the theoretical guarantee for query-scoped verified clearance. Appendix D reports the complete experimental configurations, baseline settings, evaluation protocols, and additional analyses.

Appendix A: Redundant-Harm Blind Spot This appendix proves Theorem 1 and explains why a singlerecord Leave-One-Out (LOO) test can miss redundant harmful memories. Throughout Appendix A, the task step t and the retrieved context Mt are fixed. For the theoretical analysis, let dt,i = vt (Mt ) − vt (Mt \ {mi }) denote the exact counterpart of the empirical LOO effect dbt,i in Equation (7).

A.1 Proof of Theorem 1 Assume that mi and mj satisfy the redundant-harm model in Equation (8): vt (S) = ut (S \ {mi , mj }) − ∆t 1[S ∩ {mi , mj } ̸= ∅] , ∆t > 0, (23) where ut does not depend on mi or mj , and both memories belong to Mt . Proof. Because both mi and mj are present in Mt , the penalty in Equation (23) is active and vt (Mt ) = ut (Mt \ {mi , mj }) − ∆t ,

(24)

Removing mi leaves mj in the context, so the penalty remains: vt (Mt \ {mi }) = ut (Mt \ {mi , mj }) − ∆t .

(25)

Hence dt,i = 0. By symmetry, dt,j = 0. We next consider the cooperative contribution. Shapley-based valuation measures a player’s contribution by averaging its marginal effect over different coalitions (Ghorbani and Zou 2019; Jia et al. 2019b). Let π be a uniformly random permutation of Mt , and let Pi (π) contain the memories appearing before mi . Define Xt,i (π) = vt (Pi (π) ∪ {mi }) − vt (Pi (π)) .

(26)

If mi appears before mj , then mj ∈ / Pi (π). Adding mi activates the penalty for the first time, so Xt,i (π) = −∆t . If mj appears before mi , the penalty is already active and Xt,i (π) = 0. The two relative orders are equally likely, each with probability 1/2. Therefore, using Equation (10), ψt,i = Eπ [Xt,i (π)] = −

∆t . 2

(27)

The argument gives ψt,j = −∆t /2. Thus dt,i = dt,j = 0 while ψt,i = ψt,j = −∆t /2, proving Theorem 1.

LOO and cooperative attribution evaluate a memory under different contexts. The LOO effect measures the performance change caused by removing one memory from the retrieved context. Specifically, for memory mi , it evaluates dt,i = vt (Mt ) − vt (Mt \ {mi }).

(28)

Under Equation (8), removing mi leaves the substitutable harmful memory mj active. Therefore, the degradation term remains unchanged before and after the deletion: vt (Mt ) = vt (Mt \ {mi }),

(29)

which directly leads to dt,i = 0. Cooperative attribution instead evaluates the marginal contribution of mi over different predecessor coalitions. Following the permutation formulation of Shapley-based valuation (Ghorbani and Zou 2019; Jia et al. 2019b), the contribution of mi is obtained by averaging ∆t,i (π) = vt (Pi (π) ∪ {mi }) − vt (Pi (π)),

(30)

where Pi (π) denotes the set of memories preceding mi in permutation π. When mj is not included in Pi (π), the marginal contribution of mi reflects its harmful effect because no redundant memory provides the same evidence. When mj is already included, the harmful evidence is already present and the additional contribution of mi is masked by redundancy. Therefore, coalition-level marginal evaluation can reveal harmful contributions that remain invisible under the single-memory deletion test. The result should be interpreted narrowly. Theorem 1 only establishes that a zero LOO effect does not exclude harmful cooperative contribution under redundant harmful memories. It does not imply that every memory with a zero or small LOO effect is harmful. Accordingly, MeClear interprets the LOO profile using tolerance κ: dbt,i < −κ provides local evidence of harm, |dbt,i | ≤ κ is treated as locally inconclusive, and dbt,i > κ provides local evidence of benefit. This local profile does not replace cooperative attribution; the operational harmful set remains determined by the sampled contribution in Equation (11) with harm tolerance τ .

A.3 Extension to Multiple Redundant Memories The same blind spot occurs for a redundant group with more than two memories. Corollary A.1 (Multi-Memory Redundant Harm). Let R = {m1 , . . . , mr } with r ≥ 2, and suppose vt (S) = ut (S \ R) − ∆t 1[S ∩ R ̸= ∅] ,

∆t > 0, (31)

where ut does not depend on any memory in R. If R ⊆ Mt , then every mi ∈ R satisfies dt,i = 0 and ψt,i = −∆t /r. Proof. Since r ≥ 2, deleting one memory mi leaves at least one member of R in the context. The penalty in Equation (31) therefore remains active, so dt,i = 0. Along any permutation, the penalty −∆t is introduced exactly once: when the first member of R appears. Under a uniformly random permutation, each member of R is first with probability 1/r. Thus the marginal contribution of mi is −∆t with probability 1/r and zero otherwise, which gives ψt,i = −∆t /r.

Corollary A.1 shows that the blind spot is not limited to a pair of redundant memories. Under the stated substitution model, LOO assigns zero effect to every member of the redundant group, while the cooperative allocation distributes the total penalty −∆t across the group.

Appendix B: Finite-Sample Cooperative Estimation This appendix proves Proposition 1. The analysis conditions on the fixed empirical value function vbt and isolates the approximation error caused by sampling permutations.

B.1 Exact Shapley Value of the Empirical Game For the fixed empirical game, define 1 X ψet,i = [b vt (Pi (π) ∪ {mi }) − vbt (Pi (π))] . (32) |Πt | π∈Πt

Conditional on vbt , this quantity is fixed. The use of sampled permutations to approximate Shapley values follows the standard permutation view used in efficient Shapley estimation (Ghorbani and Zou 2019; Jia et al. 2019b). Equation (32) is equivalent to ψet,i = X S⊆Mt \{mi }

|S|!(K − |S| − 1)! [b vt (S ∪ {mi }) − vbt (S)] . K!

(33) To see this, fix S ⊆ Mt \ {mi } with |S| = s. There are s!(K − s − 1)! permutations for which S is exactly the predecessor set of mi : the s memories in S can appear before mi in any order, and the remaining K − s − 1 memories can appear after mi in any order. Dividing by the total number K! of permutations gives the coefficient in Equation (33). The empirical Shapley values also satisfy the efficiency property K X

ψet,i = vbt (Mt ) − vbt (∅).

(34)

Proof. Fix a permutation π = (mπ1 , . . . , mπK ) and define the prefix sets S0 = ∅ and Sr = {mπ1 , . . . , mπr }. The marginal contributions along this permutation telescope: [b vt (Sr ) − vbt (Sr−1 )] = vbt (Mt ) − vbt (∅).

(35)

r=1

Averaging the left-hand side over all permutations gives P e i ψt,i , while the right-hand side is unchanged. This proves Equation (34). Replacing vbt with vt gives the population identity stated after Equation (3).

B.2 Unbiasedness and Uniform Concentration For a sampled permutation π (ℓ) , define (ℓ) Xt,i = vbt Pi (π (ℓ) ) ∪ {mi } − vbt Pi (π (ℓ) ) .

(L)

Since the empirical game is fixed in Proposition 1, this is the unbiasedness statement in Equation (12). Because vbt (S) ∈ [0, 1] for every coalition S, each sampled marginal (ℓ) satisfies Xt,i ∈ [−1, 1]. Hoeffding’s inequality therefore gives, for every fixed i and ε > 0, Lε2 (L) Pr ψbt,i − ψet,i ≥ ε vbt ≤ 2 exp − . (38) 2 Applying the union bound over the K memories yields Lε2 (L) b e Pr max ψt,i − ψt,i ≥ ε vbt ≤ 2K exp − , 1≤i≤K 2 (39) which proves Equation (13). The estimates for different memories need not be independent because one sampled permutation contributes to several memories. This does not affect the proof: Hoeffding’s inequality is applied separately to the L independent permutation samples for each fixed memory, and the final union bound does not require independence across memories.

B.3 Consequences for Sampling, Thresholding, and Ranking Equation (39) gives a sufficient sample size for uniform accuracy. For any ε > 0 and δ ∈ (0, 1), if 2K 2 , (40) L ≥ 2 log ε δ then, with probability at least 1 − δ, (L) max ψbt,i − ψet,i < ε.

i=1

K X

(1)

Xt,i , . . . , Xt,i are independent and identically distributed conditional on vbt , because the permutations are sampled in(ℓ) dependently and uniformly. By Equation (32), E[Xt,i | vbt ] = ψet,i . Linearity of expectation therefore gives h i (L) E ψbt,i | vbt = ψet,i . (37)

(36)

(L) Then Equation (11) can be written as ψbt,i = P (ℓ) L −1 L For each fixed i, the variables ℓ=1 Xt,i .

1≤i≤K

(41)

This is a sufficient worst-case bound based only on vbt (S) ∈ [0, 1]; it is not a claim that the resulting value of L is necessary or optimal in practice. We next consider the threshold in Equation (14). Define the exact harmful set of the empirical et = {mi ∈ Mt | ψet,i < −τ }, and assume that game as H no exact empirical contribution lies on the threshold. Let γt = mini |ψet,i + τ | > 0. Setting ε = γt in Equation (40) gives 2 2K L ≥ 2 log . (42) γt δ bt = H et with probability at least Under this condition, H 1 − δ, because no estimate can cross the threshold −τ when its error is smaller than γt . The same argument controls the ordering in Equation (16). If ψet,j − ψet,i > 2ε and the uni(L) (L) form estimation error is smaller than ε, then ψbt,i < ψbt,j . Thus, pairs of memories separated by more than twice the estimation error keep the same order. These results apply

Algorithm 1: MeClear: Cooperative Attribution and Verified Clearance Input: Query qt , memory bank Bt , retriever ρ, evaluator vbt , recovery predicate νt Parameters: Retrieval budget K, permutation budget L, screening tolerance κ, harm tolerance τ ft Output: Cleared context M 1: Retrieve and freeze Mt using Eq. (6) 2: Evaluate and cache v bt (Mt ) 3: Compute LOO effects {dbt,i } using Eq. (7) 4: Classify the local LOO effects using tolerance κ b(L) } using Eq. (11) 5: Estimate {ψ t,i bt using Eq. (14) 6: Construct H bt using Eq. (16) 7: Order H bt | and Jt ← {0} 8: Set ht ← |H 9: for j = 1 to ht do 10: Construct Ct,j using Eq. (17) 11: Compute gbt (j) using Eq. (18) 12: if gbt (j) > 0 and νt (Mt \ Ct,j ) = 1 then 13: Jt ← Jt ∪ {j} 14: end if 15: end for 16: Select b jt using Eq. (20) ft ← Mt \ C b 17: M t,jt ft 18: return M

to the fixed empirical game only. Proposition 1 controls the (L) difference between ψbt,i and ψet,i . It does not by itself con(L) trol the difference between ψbt,i and the population contribution ψt,i . Such a statement would require an additional assumption relating vbt to vt . The analysis above concerns the approximation error of cooperative attribution and therefore depends on the harm tolerance τ . The LOO tolerance κ is used only to interpret the preceding local counterfactual profile and does not alter the finite-sample guarantee for the sampled Shapley estimator.

Appendix C: MeClear Procedure and Clearance Guarantee This appendix gives the full MeClear procedure using the definitions in the main paper and proves Theorem 2. All counterfactual evaluations are performed on the same frozen context Mt , as specified in the main method.

C.1 Proof of Theorem 2 Algorithm 1 follows the four stages described in the main paper: retrieval, local screening, cooperative attribution, and verified clearance. The LOO profile is interpreted using screening tolerance κ: strongly negative local effects provide direct evidence of harm, near-zero effects remain inconclusive, and strongly positive effects indicate local benefit. The final operational harmful set is determined by cooperative contributions with harm tolerance τ . The interaction score in Equation (15) is used only for structural analysis and does

not affect harmful-set construction or clearance decisions. Repeated coalition values may be cached without changing the sampled estimator in Equation (11). Recall that Equation (19) always includes the baseline index 0, while every positive index must have both positive empirical gain and verified recovery. Equation (20) selects the maximum-gain admissible index and uses the smallest index to break ties. Proof. Since 0 ∈ Jt and Ct,0 = ∅, Equation (18) gives gbt (0) = 0. Therefore maxj∈Jt gbt (j) ≥ 0. Because b jt is ft = selected from this set of maximizers, gbt (b jt ) ≥ 0. With M Mt \ Ct,bjt , we obtain ft ) ≥ vbt (Mt ), vbt (M

(43)

which proves Equation (21). Now suppose b jt > 0. Since b jt ∈ Jt , the definition of Jt requires νt (Mt \ Ct,bjt ) = 1. ft ) = 1, which proves Equation (22). Finally, let Hence νt (M Jtmax = arg max gbt (j).

(44)

j∈Jt

By Equation (20), b jt = min Jtmax . The nested construction in Equation (17) satisfies |Ct,j | = j. Thus, for every jt ≤ j = |Ct,j |. Therefore Ct,bjt has j ∈ Jtmax , |Ct,bjt | = b minimum cardinality among the admissible candidates that attain the maximum empirical gain. The baseline also gives a simple fallback. If no positive index satisfies the gain and recovery conditions, then Jt = {0} and MeClear returns the unchanged context. If at least one positive admissible candidate exists, its gain is strictly larger than the baseline gain, so the selected index is positive and the returned context satisfies the recovery predicate.

C.2 Scope of the Guarantee and Evaluator Error The ideal objective in Equation (5) considers all subsets of the harmful set, whereas Theorem 2 is established over the nested family in Equation (17) with ht +1 candidates. It guarantees empirical non-degradation, verified recovery for positive admissible selections, and minimum cardinality among maximum-gain candidates within this family, but does not bt . The guaranimply global optimality over all subsets of H tee is conditional on the operational harmful set produced by bt the preceding attribution stage and does not assert that H equals the unknown exact harmful set Ht . Global optimality would additionally require that a minimum-cardinality unrestricted maximizer be represented in the nested family and, when nonempty, satisfy the recovery predicate. Suppose that, for the baseline and every candidate evaluated by MeClear, |b vt (S) − vt (S)| ≤ ηt

(45)

for some ηt ≥ 0. Let gt (j) = vt (Mt \ Ct,j ) − vt (Mt ). Then the triangle inequality gives |b gt (j) − gt (j)| ≤ 2ηt .

(46)

Since Theorem 2 gives gbt (b jt ) ≥ 0, it follows that gt (b jt ) ≥ b −2ηt . Moreover, if gbt (jt ) > 2ηt , then gt (b jt ) > 0. This

Setting

Configuration

Setting

Value

Dataset Conversations Clean queries Verified cases Fault records Direct conflicts Redundant conflicts Joint interactions Memory framework Memory records Retrieval budget K

LoCoMo, categories 1–4 10 368 745 1,115 375 285 85 Mem0 2.0.12 + Qdrant 11,302 5

MeClear retrieval budget K MeClear permutation budget L MeClear checkpoints MeClear screening tolerance κ MeClear harm tolerance τ Task-value range Task agent Judge evaluator Memory construction Fault generation LOO threshold ContextCite budget / α ProxySPEX budget / order Direct LLM Direct LLM threshold

5 16 4, 8, 16 0.05 0.05 [0, 1] Kimi-k2.6 Qwen3.6-Flash Moonshot-v1-32k Qwen3.7-Plus dbt,i < −0.05 32 / 0.01 32 / 2 Qwen3.5-Plus ≥ 0.5

Table 2: Dataset statistics and evaluation configuration. Panel A: Cohort construction and paired-case funnel Stage

Unit

LoCoMo QA Stable clean-correct QA Injection proposals Causal-valid proposals Selected cases Final paired cases

QA QA Proposal Proposal Case Paired case

Retention

1,540 624 7,986 1,178 747 745

– 40.5% – 14.8% 63.4% 99.7%

Panel B: Final cohort by fault and interaction Fault type

Direct

Redundant

Joint

All

Explicit conflict Precise factual Precise temporal

173 161 41

135 122 28

36 44 5

344 327 74

All faults

375

285

745

Table 3: Cohort construction and final paired-case coverage. Panel A summarizes the main data-selection milestones, and Panel B reports the final 745 cases by interaction structure and fault type. last statement is conditional on Equation (45). It does not turn the empirical guarantee into an unconditional population guarantee; it only shows how a known uniform evaluator error transfers to the selected gain.

Appendix D: Experimental Details and Parameter Settings Due to the strict page limit of the main paper, we provide additional experimental configuration, parameter settings, and supplementary analyses in this appendix.

D.1 Experimental Setup We evaluate MeClear on LoCoMo using Kimi-k2.6 as task agent and Qwen3.6-Flash as judge evaluator. The evaluation is constructed from 368 clean queries across ten conversations and contains 745 causally verified cases with 1,115 fault records. The cohort includes 375 direct conflicts with |M | = 1, 285 redundant conflicts with |M | = 2, and 85

Table 4: Main method, model, and baseline settings.

joint interactions with |M | = 2. Two of the 747 initially selected cases were excluded before paired evaluation because complete attribution outputs could not be obtained. These exclusions resulted from evaluation failures rather than method scores, leaving 745 cases with valid outputs for compared methods under the same evaluation protocol. The interactionby-fault composition contains 344 explicit-conflict cases, 327 precise-factual cases, and 74 precise-temporal cases. Among them, the direct-conflict group contains 173 explicit, 161 factual, and 41 temporal cases; the redundant group contains 135 explicit, 122 factual, and 28 temporal cases; and the joint-interaction group contains 36 explicit, 44 factual, and 5 temporal cases. Memories are constructed with Mem0 2.0.12 and stored in Qdrant, resulting in 11,302 memory records. For each query, the memory system uses the retrieval budget K = 5 specified in the main paper. The retrieved context is frozen before counterfactual attribution, and all coalition evaluations and clearance operations are performed without re-running retrieval, consistent with Equation (6). Controlled faults are retained only after behavioral verification. The clean context must remain correct in both trials, while a direct conflict must make the corrupted context incorrect in both trials. For redundant conflicts, the corrupted context must remain incorrect when either injected fault is retained alone, ensuring that each record can independently sustain the failure and mask the local effect of the other. For joint interactions, each injected record must remain harmless when evaluated alone, whereas their combination must induce task failure. These conditions provide behaviorally verified target sets for evaluating direct, redundant, and jointly expressed harmfulmemory effects. Figure 8 reports performance across the interaction-byfault combinations. MeClear shows its advantage under redundant conflicts, where local deletion is most susceptible to masking. Across the three redundant-fault categories, MeClear achieves 81.9–84.8% Recall@|M | compared with only 10.7–16.1% for LOO. Exact Set Match increases from

B Exact H = M

C Recovery

Direct / Explicit conflict (n=173)

Direct / Precise factual (n=161)

Direct / Precise temporal (n=41)

Redundant / Explicit conflict (n=135)

Redundant / Precise factual (n=122)

Redundant / Precise temporal (n=28)

Joint / Explicit conflict (n=36)

Joint / Precise factual (n=44)

100

O LO

ear

ite

us EX -pl SP x tC 3 .5 xy n te en Pro Co w q

O LO

ear

ite

ear

ite

100%

Rate

A Recall@|M|

50%

Joint / Precise temporal (n=5)

C Me

us EX -pl SP x tC 3 .5 xy n te en Pro Co w q

O LO

C Me

us EX -pl SP x tC 3 .5 xy n te en Pro Co w q

Figure 8: Interaction-by-fault performance heatmap for five memory-clearance methods. Panels show target-micro Recall@|M |, case-macro Exact Set Match, and Binary Task Recovery across nine interaction-by-fault cells. Cell annotations report percentages and case counts; the MeClear column is outlined, and cells with n < 10 are hatched. All panels share a 0–100% scale with consistent visual encoding for comparison across fault structures. A Recall@|M|

MeClear

A Recall@|M|

B Complete

100%

B Complete

LOO

W/L 380/17

W/L 196/28

ContextCite

76/81

85/44

ProxySPEX

120/66

114/40

qwen3.5-plus

190/89

105/66

100% 120 60

75%

50%

C Exact H = M

C Exact H = M D Extra background (lower is better)

Extra memories per case

75%

50%

0.75 0.70 0.65 0.60 0.55

Permutation budget L

W/L 175/80

ContextCite

169/143

66/60

ProxySPEX

104/158

88/51

Permutation budget L

Figure 9: MeClear sensitivity to permutation budgets L = 4, 8, and 16 on 745 cases. Results report Recall@|M |, Complete Set Recall, Exact Set Match, and extra-background selection with 95% two-level cluster-bootstrap intervals.

1.6–3.6% for LOO to 45.2–53.6% for MeClear, while Binary Task Recovery increases from 5.9–7.1% to 63.7–78.6%. MeClear also attains the highest observed Recall@|M | across the joint-interaction cells and achieves or ties the highest Recovery in most interaction-by-fault cells. The joint precise-temporal cell contains only five cases and is therefore interpreted descriptively rather than as a stable subgroup estimate. Overall, the structural breakdown supports the role of coalition-aware attribution when harmful evidence is redundant or jointly expressed.

W/L 212/22

188/154

qwen3.5-plus

0.50

25%

D Recovery

LOO

−20

MeClear - comparator (percentage points)

331/43

−20

MeClear - comparator (percentage points)

Figure 10: Paired differences between MeClear and each comparator on the common 745-case cohort. Points show MeClear-minus-comparator estimates for Recall@|M |, Complete Set Recall, Exact Set Match, and Binary Task Recovery; horizontal segments show 95% two-level clusterbootstrap intervals. The vertical line marks zero, and the right-side W/L counts report case-level positive and negative differences.

D.2 Parameter and Baseline Settings MeClear follows the main-paper configuration with retrieval budget K = 5, permutation budget L = 16, and tolerance settings κ = τ = 0.05. The LOO profile uses κ to identify locally informative or inconclusive memories, while cooperative contributions are estimated using Equation (11) and thresholded by τ in Equation (14). The task value is normalized to [0, 1] as assumed in Proposition 1. All primary

Risk frontier (lower-left is better)

Target-memory rank ECDF

Axes start: x=10 pp, y=0.35

100%

0.95

Cumulative target rate (%)

80%

Injected targets with rank <= k

Over-clearance burden (extra background / case)

qwen3.5-plus Exact 42.4% | Rec. 43.6%

0.75 MeClear Exact 47.0% | Rec. 82.3% LOO Exact 34.2% | Rec. 56.8%

0.55 ProxySPEX Exact 54.2% | Rec. 77.3%

ContextCite Exact 43.5% | Rec. 81.5%

Method

60%

40%

Residual-error risk, 1 - Complete (percentage points)

30.6 43.5 50.7

MeClear

60.5 88.1 93.6

ContextCite

61.1 87.6 92.3

ProxySPEX

59.1 82.2 86.2

qwen3.5-plus

49.1 80.2 89.9

LOO MeClear ContextCite ProxySPEX qwen3.5-plus

20%

0.35 10

LOO

0% 1

Rank cutoff k

Figure 11: Risk frontier of five methods on the common cohort. The x-axis shows residual-error risk, defined as one minus Complete Set Recall, the y-axis shows the average number of extra background memories selected per case, and bubble size indicates Binary Task Recovery. Lower values are preferred on both axes.

results use L = 16, with L ∈ {4, 8, 16} evaluated for sensitivity analysis. ContextCite and ProxySPEX use sampling budget B = 32, with α = 0.01 for ContextCite and interaction order two for ProxySPEX. The direct LLM baseline uses Qwen3.5-Plus with threshold 0.5, while LOO uses dbt,i < −κ = −0.05. Memory construction and fault generation use Moonshot-v1-32k and Qwen3.7-Plus, respectively. All paired comparisons use identical frozen retrieved contexts. Figure 9 shows that larger permutation budgets improve attribution quality. Recall@|M | increases from 67.6% at L = 4 to 85.9% at L = 16, Complete Set Recall increases from 68.1% to 86.7%, and Exact Set Match improves from 37.3% to 47.0%. Extra-background selection remains nonmonotonic (0.581, 0.685, and 0.623 for L = 4, 8, 16), indicating that the improvement is not caused by excessive deletion. Therefore, L = 16 is adopted for the main experiments. All recovery evaluations use two independent Answer/Judge trials with fixed random seeds.

D.3 Metrics and Supplementary Evaluation Following the main paper, we evaluate MeClear using four metrics: Target Recall at |M |, Complete Set Recall, Exact Set Match, and Binary Task Recovery. For a case with verified fault set F and |F | = m, let r1 , . . . , rm denote the top-m ranked memories. Recall@|M | is defined as TR@ |M | =

|{r1 , . . . , rm } ∩ F | . |F |

(47)

The overall Recall@|M | is target-micro averaged over the 1,115 verified fault records. Complete Set Recall measures whether all verified faults are selected, while Exact Set Match additionally requires no background selection. Binary Task Recovery counts only cases where both independent postclearance trials succeed. These metrics respectively evaluate ranking quality, harmful-set completeness, selection precision, and task recovery.

Figure 12: Target-memory rank ECDF over 1,115 injected targets. Curves show cumulative target coverage within rank k, with summary rates reported at k = 1, 2, and 3.

All comparisons use the same paired cohort of 745 cases to ensure that performance differences are attributable to method behavior rather than changes in evaluation samples. We report percentile 95% confidence intervals using 2,000 two-level cluster-bootstrap replicates, with conversations and query clusters resampled hierarchically to preserve dependencies among cases from the same source. Paired differences are computed before resampling. Figure 10 shows that MeClear improves over LOO by 47.6, 22.6, 12.8, and 25.5 percentage points in Recall@|M |, Complete Set Recall, Exact Set Match, and Recovery, respectively. Compared with ProxySPEX, MeClear improves Recall@|M |, Complete Set Recall, and Recovery by 5.0, 9.9, and 5.0 points, while ProxySPEX achieves higher Exact Set Match by 7.2 points. MeClear also improves Recovery over Qwen3.5-Plus by 38.7 points. ContextCite remains the closest comparator, with intervals overlapping zero across metrics. MeClear primarily improves harmful-memory coverage and recovery by leveraging cooperative attribution to identify interacting harmful evidence. Figure 11 evaluates the trade-off between incomplete harmful-set removal and unnecessary context modification. MeClear achieves the lowest residual-error risk of 13.3% and highest Binary Task Recovery of 82.3%, while selecting 0.623 extra background memories per case. ProxySPEX selects fewer extra memories at 0.408 per case and obtains higher Exact Set Match of 54.2%, but suffers higher residual risk of 23.2% and lower Recovery of 77.3%. ContextCite achieves comparable Recovery of 81.5% with 0.576 extra selections, but retains higher residual risk of 18.8%. LOO and Qwen3.5-Plus show larger trade-offs, with residual risk of 35.8% and extra selection of 0.934, respectively. Figure 12 further shows that MeClear provides stronger multirank concentration of harmful memories, reaching 88.1% and 93.6% target coverage at ranks 2 and 3. Although ContextCite slightly exceeds MeClear at rank 1 with 61.1% versus 60.5%, MeClear surpasses it at higher ranks. It is important for redundant and joint interactions, where effective clearance requires identifying multiple harmful memories rather than a single salient record.

Record · ID 668075 · SHA-256 722cd43ffdbdd313
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.