Falsification-gated agent memory reduced harmful accepted updates in controlled trials

Agents that learn from their own history can preserve mistaken rules. Falsification-Gated Self-Evolution (FGSE) addresses that by requiring each candidate memory to state the intended behavior and a falsifiable test before being committed.

The proposed workflow runs target tasks, counterexamples and regression checks, then monitors updates after storage. In the benchmark ablations, harmful accepted updates were 3.6% with the full gate versus 10.6% without falsification probes; post-commit violations were 3.1% versus 9.4%. Results depend on trusted verifiers and a limited evaluation environment. An attacker able to compromise the verifier or contaminate the regression archive might still get an unsafe rule admitted.

Memory admission must be a separate authorization boundary, not an automatic consequence of a locally successful run.

The mechanism reduces self-reinforcing errors under trusted probes but creates a new verification dependency. An attacker who controls archived traces or the check used to label success may still insert a persistent wrong rule. This differs from WikiTrace, which preserves source trajectories for later inspection but does not itself prove that a trajectory is authentic.