这篇论文揭示了内容筛选和来源权重检索的局限性，通过实验数据展示了虚假信息对持久记忆的影响，值得一读。
持久记忆使虚假信息持久化，通过单次生成的简单文字虚假断言，未进行指令、触发或检索器优化，我们发现污染 LongMemEval 语料库的 1.2% 将准确率从 0.850 降至 0.300。一个四阶段的写入时筛选流程在间接提示注入上达到 0.832 的召回率，同时标记了 1.5% 的触发词密集的良性文本，但拒绝了 360 个受污染的记忆。我们论证这暴露了仅内容筛选的局限性。然后我们评估了基于来源权重的检索，发现更强的权重只能通过排除不受信任的内容来恢复效用。在混合来源语料库中，不受信任的内容大多是良性的，准确率从 0.3167 提高到 0.7000；当答案本身到达时不受信任，证据召回率降至零，准确率降至 0.0417。在测量的相似度机制下，添加来源项没有可用的设置：足够强大的权重可以抵抗查询形状的污染，也可以抑制合法的不受信任的证据。因此，我们主张在检索时采用有限的占用约束，而不是添加来源惩罚，并发布了工具、语料库和汇总运行报告。
Persistent memory makes false information durable: once a false statement is stored, it can be retrieved into future sessions that match it. We measure the cost of this failure mode using plainly worded false assertions generated in a single pass, with no instruction, trigger, or retriever optimization. Poisoning 1.2% of a LongMemEval corpus reduces accuracy from 0.850 to 0.300. A four-stage write-time screening pipeline that reaches 0.832 recall on indirect prompt injection while flagging 1.5% of trigger-word-laden benign text rejects 0 of 360 poisoned memories. We argue this exposes a boundary of content-only screening: distinguishing a false assertion from a true one generally requires external grounding beyond the text itself. We then evaluate provenance-weighted retrieval. The shipped weight is statistically indistinguishable from no defense (p=0.80), while a stronger weight recovers utility only by excluding untrusted content. In a mixed-provenance corpus where untrusted content is mostly benign, accuracy rises from 0.3167 to 0.7000; when the answer-bearing evidence itself arrives untrusted, evidence recall falls to zero and accuracy to 0.0417. Under the measured similarity regime, the additive provenance term has no usable setting: a weight strong enough to resist query-shaped poison is also strong enough to suppress legitimate untrusted evidence. We therefore argue for bounded occupancy constraints at retrieval rather than additive provenance penalties, and release the harnesses, corpora, and aggregate run reports.