Artificial intelligence agents built on large language models are no longer one-shot text generators. They plan, call tools, reflect on feedback, and persist across sessions, users, and changing environments. In doing so, they accumulate state: memories of past interactions, notes from reflection, edited parameters, steering configurations, and revised workflows. A new Perspective published in Frontiers in Big Data argues that this accumulation has become the field’s most underexamined problem, and that the central question is no longer whether an agent can update its knowledge, but where that update should live.
The authors, Gabriel Chavira Juárez, Eder Jahir Gonzalez Bravo, Guadalupe Esmeralda Rivera GarcÃa, Javier A. Arcos Espinosa, and Salvador W. Nava-DÃaz, from Universidad Autónoma de Tamaulipas and Tecnológico Nacional de México, propose a substrate-aware view of controlled knowledge updating. Their argument is deceptively simple: when new evidence arrives, an agent should alter the least invasive substrate sufficient for the claim’s scope, expected persistence, and evidentiary strength. Sometimes that means editing model parameters. Sometimes it means writing to external memory. Sometimes it means doing nothing at all.
The substrate concept is the framework’s technical core. A substrate is any component of the agentic system whose content, state, or configuration can be changed to shape subsequent behavior. The authors list transient context, external memory, model parameters, activation states, and reusable tool or workflow definitions as comparable intervention targets. Each differs in scope, persistence, reversibility, and auditability. Model editing changes parameters directly, while forgetting can remove or attenuate information across several substrates at once. The invasiveness of a change combines its blast radius, the difficulty of reversal, the opacity of its audit trail, and its computational cost.
Three principles make this perspective operational. Substrate proportionality means that update persistence and blast radius should match the scope of the claim, the confidence of the evidence, and the expected half-life of the information. Temporal defeasibility means that persistent knowledge remains revisable: each update should carry validity conditions and a path for revision, attenuation, or rollback. Auditable continuity means that future behavior remains traceable to update decisions, sources, and affected substrates. Together, these principles translate the least invasive substrate into concrete decision variables: scope, evidence confidence, expected duration, reversibility requirement, interference tolerance, and audit requirement.
The authors describe a control loop that begins with an update candidate: a user correction, environmental feedback, a new document, a contradiction, a failed action, or an instruction. The agent first classifies the evidence and intended scope. Uncertain or transient claims may remain in retrieval or context injection. User-specific or task-specific claims may move to external memory. Stable global corrections may justify a curated global update, such as an external knowledge-base change or, under stricter evidence and regression tests, model editing. Behavioral modulation may be better handled through steering vectors, changes in how the agent acts may belong in tools or workflows, and obsolete, harmful, or unauthorized information may call for forgetting or attenuation.
A concrete example illustrates the framework. Consider an assistant serving the same user across sessions. A one-off request to keep answers short classifies as transient evidence with no persistent effect. The same preference confirmed across several unrelated sessions moves to external memory, since evidence has accumulated and the scope is user-level. A later request for full detail on a single report remains a same-turn override, leaving the stored preference untouched. An unverified instruction embedded in a retrieved document is logged and refused rather than written to any substrate. Structurally similar inputs are routed to different substrates once scope, evidence accumulation, and persistence are taken into account.
Forgetting becomes part of the same control problem. Rather than a memory failure alone, it is a control action that limits the future influence of obsolete, contradicted, unsafe, or low-value state. The authors note that forgetting can mean deletion, decay, masking, reduced retrieval priority, provenance-preserving archival, or replacement by a superseding memory. These choices have different privacy, reliability, and audit consequences. A system that remembers everything can still be unreliable if it cannot attenuate the influence of what should no longer guide behavior.
Hard cases make the control problem visible. Supersession occurs when a once-valid memory is replaced by newer evidence. Contradiction occurs when two retained items cannot both guide behavior. Personalization drift occurs when a local preference is overgeneralized across contexts. Privacy revocation occurs when previously authorized information should no longer be used. Adversarial memory injection occurs when an external actor tries to persist a malicious instruction or false fact through an integrated application or poisoned retrieval corpus. Failure to separate these cases reflects weak governance of persistent state.
Evaluation as longitudinal control is the framework’s second major contribution. A correct response does not establish that the underlying update was justified. An agent may answer correctly after storing information that should have remained temporary. The authors outline criteria for assessing whether an agent controls knowledge updates rather than merely accumulating state: scope fit, evidence quality, temporal validity, interference, reversibility, auditability, efficiency, and robustness. Each criterion has an operational test and a failure signal. A local preference becoming a global behavioral change, or a stable correction remaining trapped in transient context, signals a scope fit error. Persisting rumors, adversarial instructions, or single-instance noise signals an evidence quality error.
The authors propose a minimal benchmark unit with four phases. First, an update event presents new evidence together with uncertainty, source, scope, and expected duration. Second, the agent must choose a substrate or refuse to update, with a short justification. Third, the system is immediately probed for factual correctness and interference. Fourth, delayed probes test temporal consistency, supersession, abstention, and audit trace. Selection can be scored against a reference policy or expert labels, while execution and maintenance can be scored by behavioral probes. Scoring can then separate selection error, execution error, and maintenance error rather than reducing all failures to a single end-task score.
Since substrate selection involves policy judgment, evaluation should allow a set of admissible choices rather than a single gold label. A benchmark instance can be annotated by multiple experts who assign an update event to one or more acceptable substrates and record the rationale in terms of scope, evidence strength, expected duration, reversibility, and audit needs. Disagreement should be reported rather than hidden: high-agreement cases test basic competence, while low-agreement cases identify ambiguous update policies and can be scored with partial credit or preference rankings. The primary unit of analysis should be the update event, with scores aggregated over trajectories to capture accumulation, supersession, and interference across time.
The research agenda that follows has four priorities. The first is update triage: agents need policies that classify evidence, scope, persistence, and risk before changing state. These policies could be rule-based, learned, or hybrid, but they should be explicit enough to audit. The second is memory design, with provenance and validity tracked across other substrates as well. Memory items should retain their source, time, confidence, validity conditions, and supersession status. Corresponding records should link parameter edits, steering configurations, and workflow revisions to their evidence and justification.
Cross-substrate benchmarking is the third priority, building on the selection criteria established by triage policies and the update traces provided by provenance records. Benchmarks of long-term memory and agent task performance could be extended with controlled update trajectories that assess selection, execution, and maintenance under delayed contradiction or supersession. Finally, forgetting should be an explicit design and evaluation target within longitudinal maintenance. The relevant question is not only whether information disappears from recall, but which mechanism limits its future influence and whether that mechanism preserves the required audit trail.
The practical value of controlled knowledge updating, the authors conclude, is restraint. A well-designed agent avoids parametric edits for local or uncertain information, persistent memory for transient context, reliance on superseded evidence as if it were current, and irreversible deletion when traceability is required. The long-term aim is not agents that remember more, but agents that know what deserves to persist, what should remain provisional, and what must be revised, attenuated, or forgotten.
Subject of Research: Artificial Intelligence
Article Title: Controlled knowledge updating in memory-enabled AI agents: beyond model editing and recall
Article References: Chavira Juárez, G., Gonzalez Bravo, E. J., Rivera GarcÃa, G. E., Arcos Espinosa, J. A., & Nava-DÃaz, S. W. (2026). Controlled knowledge updating in memory-enabled AI agents: beyond model editing and recall. Frontiers in Big Data, 9, Article 1938137. https://doi.org/10.3389/fdata.2026.1938137
Image Credits: AI Generated
DOI: 10.3389/fdata.2026.1938137
Keywords: AI agents, LLM, memory, knowledge editing, machine learning, benchmarking, Controlled, knowledge, updating, memory-enabled, agents, beyond
News Source: Blake Davidson. (October 15, 2026). AI agents must learn where to store knowledge, not just how to recall it. Scienmag.
