MemEvoBench
https://arxiv.org/abs/2604.15774
QA tasks across 7 domains / 36 risk types plus workflow tasks adapted from 20 Agent-SafetyBench environments with noisy tool returns; both use mixed benign-and-misleading memory pools in multi-round interactions. Targets memory-evolution safety, not recall accuracy — first benchmark specifically targeting adversarial degradation of evolving memory.
At a glance
- Type
- Adversarial memory-evolution safety benchmark
- Tier
- T4
- Section
- Memory benchmarks & evaluation
- Created
- 2026-04
- Latest release
- not applicable — not OSS
- License
- not applicable — not OSS
- GitHub
- not applicable — no GitHub repo
- Pricing
- not applicable — not commercial
- Funding
- not applicable — not commercial
Taxonomy
- storage
- n/a
- retrieval
- n/a
- persistence
- n/a
- update
- read-only
- unit
- n/a
- governance
- n/a
- conflict
- n/a
When to use
Optimised for: not applicable - eval dataset, not a system
Anti-fit: not applicable - eval dataset, not a system
Pros & cons
Pros
Addresses a largely unexamined attack surface — adversarial memory injection into agents with evolving long-term stores — rather than standard retrieval accuracy.
Cons
Too new for independent replication; 36 risk types lack a formal threat-model taxonomy; no comparison against known memory-safety defenses.
Claims & capabilities
Substantial safety degradation under biased memory updates; static prompt defenses insufficient. April 17, 2026.
Technical surface
- API surface
- not applicable — eval dataset, not a system
- Backend storage
- not applicable — eval dataset, not a system
- Deployment
- not applicable — not a deployable product
- Embedding model
- not applicable — eval dataset, not a system
- Multi-tenancy
- not applicable — eval dataset, not a system
- MCP
- not applicable — benchmark / evaluation harness
- A2A
- not applicable — benchmark / evaluation harness
- OpenTelemetry
- not applicable — benchmark / evaluation harness
Similar systems
Other memory benchmarks & evaluation in the catalog, ranked by inbound references.
- LoCoMo T3
Conversations spanning up to 35 sessions / 300 turns / ~9K tokens, built from LLM-agent personas grounded on temporal event graphs and verified by human annotators. Tests QA (single-hop, multi-hop, temporal, commonsense, adversarial), event-graph summarisation, multimodal dialogue.
- LongBench T3
Tsinghua THUDM. 21 datasets across 6 categories (single-doc QA, multi-doc QA, summarisation, few-shot ICL, synthetic, code completion) in English + Chinese. ~6.7K words English / 13.4K chars Chinese average. v2 at ACL 2025 with harder, longer instances.
- LongMemEval T3
5 core memory abilities — info extraction, multi-session reasoning, temporal reasoning, knowledge updates, abstention — via 500 curated questions in synthetic chat histories. Two scales: LongMemEval-S (115K tokens), LongMemEval-M (up to 1.5M).
- RULER T3
NVIDIA. Extends NIAH with multi-needle retrieval, multi-hop entity tracing, aggregation, QA — configurable for arbitrary length / difficulty. Evaluated 17 long-context models on 13 tasks.
- InfiniteBench (∞Bench) T3
Tsinghua / OpenBMB. First benchmark with average input >100K tokens. 12 tasks across English + Chinese: long novel QA, code debugging, math in long context, summarisation, retrieval. Realistic documents (novels, code) rather than synthetic filler.
- Atari 100k T3
Sample-efficiency benchmark protocol on Arcade Learning Environment (ALE) — agents limited to 100k environment steps (~2 hours of game-play) before evaluation. Introduced by SimPLe (Kaiser et al. 2019) and adopted by EfficientZero, IRIS, BBF, DreamerV3, Storm. Tests world-model / model-based methods where memory-as-imagination matters more than huge replay buffers.