The same classical tradeoff in four AI-memory mechanisms — and where it breaks

What should an agent forget? When should it believe a contradicting fact? How fast should it distrust a source that turns bad? These look like separate engineering questions. They are the same problem, it has a known optimal solution — one that detection theory and neuroscience settled decades ago — and the rules people actually ship are often far from it. Here is that classical tradeoff, measured across four mechanisms, plus the exact line where it becomes unsolvable.

One problem wearing four hats

Each mechanism reads a single stream that carries both signals at once:

• genuine change you must adapt to fast, and
• adversarial corruption you must resist.

The trap is that, at the instant a deviation appears, an isolated corruption and the first sample of a real change are the same observation. You cannot tell them apart until you see whether the deviation persists.

The adaptation–corruption coupling. No single aggregation rule can be both fast to genuine novelty and bounded against corruption on a shared stream. This is a classical result — Grossberg's stability–plasticity dilemma (1980), stated for agent memory. The known escape is architectural: a corroboration-gated slow channel + a fast channel + a persistence selector — the same fast/slow-plus-gate design neuroscience arrived at as Complementary Learning Systems (McClelland, McNaughton & O'Reilly 1995). It converts the tradeoff into a detection-latency floor — a per-mechanism floor, not one universal constant. You can have both robustness and fast adaptation, but not at zero latency.

Measured in four places (same three signatures)

Each instance shows a single-rule frontier (fast = fragile, slow = laggy), a two-channel escape, and a latency floor. Minimal, fully-reproducible simulations.

The trust case was a pre-registered prediction — before running it, we claimed binary reputation would show the same three signatures. It did. That is what makes the unification predictive rather than a list of coincidences. (best-of-N is the odd one out: it has no temporal fast/slow channel, so we treat it as a selection-pressure analog, not a fourth time-series instance.)

It is not magic — it is optimal detection

The honest core: this is the sequential change-detection tradeoff (mean-time-to-false-alarm vs detection delay), which is a theorem — CUSUM is optimal (Page 1954 introduced it; Lorden 1971 proved asymptotic minimaxity; Moustakides 1986 the exact result). We red-teamed our own escape against CUSUM on the trust task. Minimum detection delay at false-distrust ≤ 5%:

The two-channel matches the optimum, and both beat the naive decay rule in the regime that matters. How far naive decay sits from the bound is regime-dependent (validated across change-magnitude × noise): up to ~2× when the change is subtle and the signal noisy, and it reverses — the naive rule is marginally better (ratio ~0.92) — when changes are large and the signal is clean. So this is a regime-dependent advantage, not a universal one; the fix where it matters is a persistence-based detector (CUSUM optimally; a two-channel store practically). Every simulation number here is reproducible from one open probe.

Where it becomes unsolvable

The escape needs corruption to be more transient than the change you must catch. Sweeping poison-burst length B against selector delay d, the escape holds iff B < d; once a poison campaign persists for B ≥ d steps it is indistinguishable from real change and false-distrust jumps to 1.00. And you cannot just raise d — detection delay grows ~1:1 with it. This is exactly the known transient-change-detection result: a change that ends before the decision window closes becomes a missed detection.

The boundary. The escape is valid iff B_corruption < d < your change-detection budget. If an adversary can sustain corruption as long as a genuine change must persist to be caught, the window is empty and no persistence-based architecture helps — the coupling is irreducible in this regime. (One caveat this rests on: an adversary who is oblivious to your selector. A detector-aware attacker who sets B just below d and can probe for it turns the fixed floor into a game — the open frontier below.)

If you build agent memory, RAG, trust, or reward models

Don't tune a single decay rate and hope — in hard regimes (subtle change, noisy signal) that is a choice between gullibility and rigidity and leaves up to ~2× of the achievable frontier on the table. Treat the update as sequential change detection: a persistence-based detector (or a value-protected + recency-aged two-tier store), with the confirmation latency set to your stream's corruption-vs-change ratio. Two caveats this buys nothing for: an adversary who can sustain corruption as long as a real change (irreducible), and signals where the genuine change is itself transient (then a fast rule is better — the persistence detector would miss it). We've shipped this classical fast/slow architecture — the same one neuroscience calls Complementary Learning Systems — into our open memory core in three places; our contribution is measuring where it pays and where it breaks, not the design.

Does it hold on real data?

Not just simulations. We tested it on 16 real, expert-labelled anomaly streams (the Numenta Anomaly Benchmark — machine/temperature failures, server misconfigurations, network/cpu/latency telemetry, taxi demand, tweet volume). For each stream an objective classifier labels its anomaly sustained (the level shifts and stays) or transient (a spike that returns), then we compare a naive point-detector against a persistence (CUSUM) detector, scored by the false alarms each needs to catch every labelled window.

The clean part — and the actionable one — is an asymmetry:

On real data, no sustained-change stream is ever better served by the naive detector (0 / 6) — persistence wins or ties every one. And every win the naive detector scores (5 / 5) is on a transient spike.

So "is the genuine change sustained?" is sufficient to know you need a persistence detector — in one case the difference is 0 vs 1181 false alarms. What is not clean is the converse: transient streams split roughly evenly (5 naive / 5 CUSUM), because some "transient" anomalies still persist a few samples and accumulate. An earlier 6-stream cut looked like a perfect "type predicts the winner" biconditional; expanding to 16 streams showed that was small-sample luck. The robust, honest claim is the asymmetry — sustained ⇒ use persistence, never the reverse — not a strict two-way rule. (Scope: 16 streams, one detector family each, a simple shift-based classifier.)

The falsifierIf a single aggregation rule were simultaneously fast-to-novelty and bounded-against-corruption on a shared stream (no frontier), or a detector beat the latency floor (robustness at zero delay), the claim would be false. Across the mechanisms it never did; at zero delay robustness collapses every time; a pre-registered new instance behaved as predicted; and on 16 real labelled streams the actionable asymmetry held — no sustained-change stream was ever better served by the naive detector.

FAQ

Is this a new theorem or law? No — it's an expository unification of classical results. The coupling is Grossberg's stability–plasticity dilemma; the fast + slow-gated escape is Complementary Learning Systems (McClelland, McNaughton & O'Reilly 1995); the two-tier cache is ARC (Megiddo & Modha 2003); the latency floor is CUSUM optimality (Page 1954; Lorden 1971; Moustakides 1986). What's ours is the cross-mechanism measurement, a pre-registered instance (the trust case), and the real-data asymmetry — not a new proof.

Where does it fail? Two boundaries. (1) If corruption can persist as long as a genuine change must to be caught (B ≥ d), it's the known transient-detection missed-detection regime — no persistence-based architecture helps. (2) If the genuine signal you care about is itself transient, a fast rule beats the persistence detector. And the whole result assumes a detector-oblivious adversary.

Does it hold on real data? Asymmetrically, yes — on 16 expert-labelled NAB streams, no sustained-change stream was ever better served by the naive detector; the converse isn't clean. Caveat: the scoring metric favors the accumulating detector, so read it as an asymmetry, not a biconditional.

What should I do with it? Treat memory / RAG / trust / reward updates as sequential change detection: a persistence-based detector (CUSUM) or a value-protected + recency-aged two-tier store (the Complementary Learning Systems design), with the confirmation latency set to your stream's corruption-vs-change ratio.

Related research

• Memory poisoning hits AI agents 70–95% — and the corroboration gate that stops it
• What should an AI agent forget? Two tiers beat every single rule
• Does long context kill RAG? We measured it

The classical anchors (prior art)

• Grossberg — the stability–plasticity dilemma and Adaptive Resonance Theory: the coupling, resolved by match-based gating.
• McClelland, McNaughton & O'Reilly (1995), Psychological Review — Complementary Learning Systems: the fast/slow-plus-gate escape.
• Megiddo & Modha (2003), USENIX FAST — the ARC cache: the two-tier eviction instance, shipped in ZFS.
• Page (1954), Lorden (1971), Moustakides (1986) — CUSUM optimality: the latency floor.
• Guépié, Fillatre & Nikiforov (2012), Sequential Analysis — transient change detection: the B<d boundary. Numbers reproducible from our open probe.