The four ways a shared robot memory goes wrong

A paper that named four modes and shipped two of them

On 23 June 2026 five researchers published a taxonomy of what breaks when several agents write to one memory. Governed Shared Memory for Multi-Agent LLM Systems — the system is MemClaw — "identifies four foundational failure modes: unauthorized leakage, stale propagation, contradiction persistence, and provenance collapse" (arXiv 2606.24535). Then, in the same abstract, it discloses two of them running in its own production service.

The first is a scope defect: "Tenant isolation held, but sub-tenant scope was initially bypassed on direct GET-by-id requests for agent-scoped credentials (disclosed and remediated during the study)." The scope key was right; the retrieval path around it was not.

The second is stranger and, for anyone building this, more useful: "While contradiction supersession works for admitted writes, a synchronous near-duplicate gate can prematurely reject contradictory writes before the asynchronous contradiction detector can evaluate them." The de-duplication machinery was eating the contradictions before the contradiction detector could see them. Two records that are nearly identical and two records that cannot both be true look alike to a similarity test, and the similarity test ran first.

Nothing here is theoretical. Both defects are self-disclosed, which is what makes citing them fair.

Those four names are the four we publish on Brain. Three are MemClaw's own words in its own order. Our first — leakage across scopes — paraphrases "unauthorized leakage" to name the boundary that actually failed rather than the permission that was violated.

Three things follow, and they are the argument of this piece. The four modes are separable and each has been measured. Three of them have a mechanism whose failure is itself measurable and bounded; the fourth has no mechanism at all, and the two leading systems say so out loud. And almost every number in the field came from a text agent or a simulator — nobody has measured what happens when two robot writers put conflicting observations into the same store, which is the only configuration a site memory ever runs in.

One measurement each

Leakage across scopes. AgentLeak (arXiv 2602.11510, 12 February 2026) instrumented seven pathways across 1,000 scenarios and 4,979 validated traces and found 68.9% total system privacy exposure. The figure that should change an audit requirement is a different one: "output-only audits miss 41.7% of violations". Multi-agent configurations reduce final-output leakage, 27.2% against 43.2% for a single agent, while raising total exposure: adding agents moves the leak off the channel the auditor watches.

MemClaw's own probes are the other side of the same mode. Fleet-sibling visibility was 117 of 120 probes, 0.975 with a 95% Wilson interval of [0.929, 0.991]. Cross-fleet leakage was 0 of 80 foreign-fleet probes, 95% Wilson interval [0.000, 0.046]. That is an upper bound of 4.6%, not a demonstration that leakage cannot happen, and it comes from the study that also found the sub-tenant bypass. The last item on the authors' own limitations list is "No comparand": a service evaluating itself against nothing.

Stale propagation. MELD (arXiv 2608.16357, 17 August 2026) reports that a per-claim status CRDT "reconverges in 30/30 real partition-heal trials where last-writer-wins manages 11/30". The default fix — most recent write wins — fails nineteen times in thirty.

Contradiction persistence. MemToC (arXiv 2608.26295, 26 August 2026) ran 6,504 evaluation episodes from 542 quality-controlled questions and found that models hold onto a verified-correct memory answer against an incorrect tool return in only 6.5% to 17.1% of eligible cases.

Provenance collapse. "Utility Under Attack" (arXiv 2608.21230, 21 August 2026) [single source] poisoned 1.2% of a LongMemEval corpus and watched accuracy fall from 0.850 to 0.300. Its write-time screening pipeline "rejects 0 of 360 poisoned memories", and its provenance weighting — the shipped kind, where trust becomes a ranking multiplier — "is statistically indistinguishable from no defense (p=0.80)". A single-author preprint, unreplicated, which is how it should be read.

Across the lifecycle rather than per mode, MemSecBench (arXiv 2607.27080, 29 July 2026) runs a controlled Write–Execute–Forget protocol over 310 cases and 24 configurations, and finds malicious memory persisting in 84.2% of cases.

One more failure sits outside the quartet. It belongs here for what it does to a per-write defence. Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw (arXiv 2608.01637, 3 August 2026) shows that "multiple benign-looking memories may jointly induce unsafe behavior": Memory Save Rate 81.3%, Attack Success Rate 75.0%, across 48 scenarios. Every individual write passes. The combination is the payload, and a screen that evaluates writes one at a time never has the combination in front of it [inference].

A second surface sits on the coordination channel rather than the store. "When Coordination Becomes a Threat" (arXiv 2608.06830, 7 August 2026) drives 97.8% unsafe-action success against one multi-robot architecture in NVIDIA Isaac Sim 4.5.0. That is message integrity, not memory, and it belongs to its own piece.

Leakage across scopes

• AgentLeak — output-only audits miss 41.7% of violations, over 4,979 validated tracestext agent
• MemClaw — 117 of 120 intra-fleet probes visible, 0 of 80 cross-fleet probes leakedtext agent

Stale propagation

• MELD — a per-claim status CRDT reconverges in 30 of 30 partition-heal trials, last-writer-wins in 11 of 30text agent
• EvoNav-Bench — outdated prior observations fused with new ones on ProcTHOR; no rate publishedsimulated robot · single agent

Contradiction persistence

• MemToC — a verified-correct memory survives an incorrect tool return in 6.5% to 17.1% of eligible cases, over 6,504 episodestext agent

Provenance collapse

• Utility Under Attack — write-time screening rejects 0 of 360 poisoned memories; provenance as a ranking weight is indistinguishable from no defence at p = 0.80text agent · single source
• PACT — excluding a constructed adversarial arm, a provenance partition cuts ncsAURC by 0.0557 against singleton aggregationoffline human-robot data
• Seeing is Not Believing — telemetry forged beneath the provenance layer, 87% success against an AI-based detectorreal hardware · single arm · single source

Two robot writers, one store

• Leakage across scopesnot measured
• Stale propagationnot measured
• Contradiction persistencenot measured
• Provenance collapsenot measured

• Text agent — software agents only, no body
• Simulated robot — measured in a simulator
• Real world — a physical robot or recorded human-robot data; no entry here has two robot writers
• Not measured — no published result for that cell

Simulated, real, or not measured at all

Almost every measurement of the four modes came from software agents. The three exceptions sit in the figure above: a simulated navigator, an offline human-robot dataset and a single physical arm. None of them has a second robot writing. The memory-security and memory-governance literature is entirely text-agent: AgentLeak, MemSecBench, MemToC, MELD, MemGauge, Nous, "Utility Under Attack", the Salami Attack, MAP-Graph — whose authors state their evaluation is synthetic only — and MemClaw itself, which describes its scope as software agents.

The embodied memory literature is large, and it measures something else: whether the robot can remember at all. MEMOBench (arXiv 2609.07047, 7 September 2026) is 30 tasks on LIBERO and robosuite, best memory-module baseline 31.9%, and its authors write that it "is constructed entirely in simulation, which enables data collection at large scale and reproducible evaluation but cannot fully capture real world factors". One robot. EvoNav-Bench (arXiv 2609.08292, 8 September 2026) puts lifelong navigation on ProcTHOR with the environment changed between tasks and finds that "existing methods may fuse outdated prior observations with new observations" — stale propagation, in a body, qualitative, no rate published.

Then RoboOS-NeXT (BAAI, arXiv 2510.26536, 30 October 2025), the closest anyone has come to a multi-robot shared memory with numbers attached. Its Spatio-Temporal-Embodiment Memory folds "spatial scene geometry, temporal event history, and embodiment profiles into a shared representation". Its failure decomposition is the number this field quotes: memory operations account for 30.2% of failures, which is 16 cases, from 53 analysed failures out of 200 simulated restaurant-scenario trials. Tool invocation accounts for 45.3% (24 cases) and subtask generation for 24.5% (13 cases). In the Household domain under the no-error condition it reports 89.2 against a memory-less baseline of 81.6; under injected tool failure, 71.3 against 23.5; under injected hallucination, 78.5 against 31.0. Those are Household figures. The paper states no aggregate across restaurant, supermarket and household, and none can be derived from its tables.

Every one of those numbers comes from simulation. The paper's own §IV-A calls its setting "a mock setting that abstracts away physical uncertainties". The real-hardware work in the same paper — a Unitree G1, an Agilex dual-arm, a Realman arm — is three qualitative demonstrations with no trial counts, no success rates and no durations. This is the best multi-robot memory result published, and it is a mock setting. The authors name the next problem themselves: "Over long horizons, noise in update/selection accumulates, degrading temporal consistency."

The only real-hardware shared-memory result we have found with a number attached is the Semantic Autonomy Framework (arXiv 2605.02525, 4 May 2026): two differential-drive robots on Raspberry Pi 5, memory organised under a scope taxonomy of "global environment knowledge, per-operator preferences, per-robot capabilities". A preference learned on one robot is promoted to a deterministic rule and transferred, in one direction, to the second through a shared compiled digest — 33 of 33 transfers correct, 95% CI [0.894, 1.000], over 82 scenario-level decisions. It is the nearest published thing to what a site memory does, and it measures whether the transfer succeeded — never what happens when the two robots disagree.

That is the shape of the field: security measured on text, capability measured in simulators, the real-world exceptions qualitative or single-writer, and one cell nobody has filled.

1. One object, two writersRobot A observes it at t1. Robot B observes the same object at t2 and records something that cannot also be true. Neither robot is wrong about what it saw.
2. Delivery — the two writes reach the store out of orderStale propagation lands here: the earlier observation arrives last. A per-claim status CRDT reconverges in 30 of 30 partition-heal trials where last-writer-wins manages 11 of 30 — and reconvergence is agreement, not correctness.

3. Admission — the one branch with no mechanism

   Near-duplicate gate, then contradiction detectorMemClaw's own disclosure: the synchronous near-duplicate gate can reject contradictory writes before the asynchronous detector evaluates them. Two records that are nearly identical and two that cannot both be true look alike to a similarity test.

   A named personOn this branch and no other. A corrected belief waits on a queue while the fleet keeps acting on the store as it stands.

   Contradiction persistence lands here. MELD does not adjudicate truth; MemToC measures the arbitration failure directly, at 6.5% to 17.1% retention of a verified-correct memory over 6,504 episodes.

4. Merge and re-indexProvenance collapse lands here: which writer produced which claim is lost. Screening at write time rejected 0 of 360 poisoned memories, and provenance as a ranking weight came out indistinguishable from no defence at p = 0.80.
5. Retrieval — the rest of the fleet readsLeakage across scopes lands here: the retrieval path answers around the scope key rather than through it. Output-only audits miss 41.7% of violations.

• A step with a mechanism whose failure is measurable and bounded
• A named human gate, standing where no mechanism exists

What a robot memory has that a chat memory does not

Four properties, each taken from robotics work rather than asserted.

A physical clock. RoboOS-NeXT's memory carries temporal event history, and its failure analysis names accumulating update and selection noise as degrading temporal consistency. A chat memory has turn order; a robot memory has wall-clock time, against which a door state or a spill expires whether or not anyone reads it.

A pose. The same memory carries spatial scene geometry, and the Semantic Autonomy Framework indexes its scopes by environment, operator and robot. An entry is true somewhere, and the place is part of the entry.

An actuator that has already moved. PACT (arXiv 2609.01662, 31 August 2026) exists because an admission decision gates a typed action, mapping unmet release conditions to hold, confirm or fallback. The provenance layer under that decision rests on telemetry that can be forged. "Seeing is Not Believing" (arXiv 2609.08280, 8 September 2026) [single source] shows one ROS 2 environment variable giving an adversary a pre-built hook to "covertly intercept and inject both telemetry and control signals before they are published", at 87% success against an AI-based detector on a physical Franka arm.

A second writer that saw the same object at a different time. That is the property with no measurement behind it.

Three mechanisms and one absence

Leakage has a mechanism: hard authorisation separated from graded trust. MAP-Graph (arXiv 2608.10509, 11 August 2026) excludes permission-ineligible records before ranking rather than down-weighting them, reporting 94.96% task success over 2,700 synthetic tasks per method — synthetic only, by the authors' own statement. Its failure is bounded and nameable: it misses what an output-only audit misses, and it would not have caught MemClaw's GET-by-id bypass, a path that never consulted the scope at all.

Stale propagation has a mechanism: freshness gates plus a per-claim status CRDT. Its failure is bounded too, once you are exact about what 30/30 means. Reconvergence is agreement, not correctness. All replicas end up holding one state; nothing in a CRDT tells you which of two truthfully observed states is true now.

Provenance collapse has a mechanism, and the cheap version of it demonstrably does not work: screening at write time rejected 0 of 360 poisoned memories, and provenance as a ranking weight came out indistinguishable from no defence at p=0.80. What works is structural. PACT partitions provenance and counts independent observations instead of agreeing ones, because "repeated inference over one observation can multiply agreement without adding evidence" and "agreement constitutes corroboration only when provenance permits separate accumulation". Across 31,200 evaluations it reports an ncsAURC of 0.0861 and, excluding a constructed adversarial-consensus arm, a reduction of 0.0557 against singleton aggregation; eightfold within-camera duplication leaves its 720 typed responses per checkpoint unchanged. Eight cameras agreeing is one observation. That work is offline human-robot collaboration: recorded scenes, not a robot in the loop. It is the nearest thing we have to a sign that a text-agent mechanism survives contact with a body.

Contradiction persistence has no mechanism, and the two leading systems decline, in writing, to build one. MELD: "MELD does not adjudicate truth; a detected contradiction is preserved for later adjudication, never silently resolved." Nous (arXiv 2606.22030, 20 June 2026) [single source] reports that "Bayesian belief updating alone provides little benefit over naive last-write-wins because existing conversational memory benchmarks rarely contain contradictory or differently reliable evidence" — and that on a purpose-built contradiction benchmark it substantially beats last-write-wins. The technique looks worthless until somebody builds the cases that test it. MemToC's 6.5% to 17.1% is that arbitration failure measured directly. And MemClaw's supersession works only for writes that were admitted, which is where the near-duplicate gate comes back.

That collision is the best evidence in this literature, and it is why de-duplication is not a fifth peer of the four but the machinery that broke one of them. MELD's answer is protocol-level: five admission outcomes — insert, merge, relate, conflict, reject. Merge and conflict are different verdicts reached by different tests, and a system that routes both through one similarity threshold will silently discard the second.

On Brain we publish that core memory changes only through a named human. That is a containment decision, not a solution. Nobody has a mechanism, so we put a person where the mechanism would be, on exactly one of four branches, and the cost is real: a corrected belief waits on a queue. The pattern is not ours. Harness Robotic OS (arXiv 2609.11225, 10 September 2026) [single source] describes "a safety-gated self-evolution loop [that] converts execution traces into versioned candidate updates without permitting unconstrained online modification", on a quadruped, published the day before this article was commissioned.

What would have to be measured

The missing experiment is specific enough to write down: a Write–Execute–Forget protocol, in a body, with two or more writers.

Every piece of it exists separately. MemSecBench has the protocol and no body. MEMOBench has the body and one writer. RoboOS-NeXT has several robots and a mock setting. CoCoBench (arXiv 2608.28266, 28 August 2026) has multi-robot coordination over 897 oracle-validated instances and no memory measurement at all. MA-EgoQA (arXiv 2603.09827, 10 March 2026) has multiple egocentric streams and measures aggregation, not conflict.

We have not found the benchmark, and we have looked twice — about forty arXiv category queries across cs.RO, cs.AI, cs.MA and cs.CR on 5 and 11 September 2026 [inference]. That is a negative from two searches, not a proof. If it exists, we would like to be sent it.

What it would measure is not a success rate. Two robots observe the same object at different times, both write, and the store holds two claims that cannot both be true. The quantities are: which write survives, how long the fleet acts on the wrong one before anything notices, whether the audit reconstructs who wrote what, and how much a de-duplication gate removed before any of it was recorded.

For a buyer with a mixed fleet, the asymmetry is the usable part. Three of the four have mechanisms a vendor can demonstrate, so ask with denominators attached: how many scope probes, and how many failed; how many partition-heal trials, and how many reconverged. Then ask whether provenance is a hard filter on eligibility or a weight in a ranking, because on the weighting version the published evidence is that it performs like no defence at all. The fourth has no mechanism to demonstrate. There the question is not which algorithm resolves contradictions but who resolves them, how long the queue is, and what the robots do while it is unresolved.

Our own position, plainly: Crew is not shipped, the site memory service is in design, and no measurement in this article is ours. Brain commits us to publishing a small benchmark for multi-writer robot memory alongside our own results. We have not run it. When we do, the failures go in the same place as the numbers.