A living document
This is not a finished paper. It is the working record of a final-year project that runs to April 2027, and I update it as the work moves rather than writing it once at the end. Section 8 is the changelog, and the status table below is the fastest way to see what is actually true today.
Two disciplines carry over from the thesis into this page. Nothing is claimed as a result until it has been measured, and anything still pending says so in plain words. Where the work has already proved me wrong, that is on the page too, because those are the parts worth reading.
1. The problem
A memory system reads your conversation and distils it into short facts it can recall later. That distilling step is done by a language model, and a language model can write down something you never said. This much is well known.
The harder problem is the one that arrives afterwards. A fact can be recorded perfectly and still stop being true. You move city. You change jobs. You sell the laptop. Nothing was hallucinated and nothing was attacked; the world simply moved, and the memory did not.
I hit this in my own system before I read about it anywhere. I told the assistant I had switched to a MacBook. Consolidation admitted the new fact thirteen seconds before my next question. Retrieval pulled it into context. The answer still said ThinkPad.
Nothing in that sequence is a bug in the ordinary sense. Every component did its job. The gap is that no component's job was to notice that an old fact had just been outlived, and that is the gap this project sits in.
2. What ANAMNESIS is
A local-first memory system for long-running conversations with a language model. Memory is organised in four tiers, loosely mapped to how cognitive neuroscience decomposes human long-term memory: a working tier for the live turn, an append-only episodic record, a distilled semantic tier built by out-of-band consolidation, and a procedural tier for response patterns. The whole store is a single SQLite file. The only network call in the write path is to the chat model itself; retrieval, entailment checking, and risk scoring all run locally on CPU.
Every candidate fact travels the same short path before it becomes memory.
The load-bearing property is that nothing enters semantic memory unexamined, and nothing is ever deleted. A rejected fact is quarantined with its audit record intact, so a refusal can be inspected rather than silently swallowed.
3. Why the obvious version is not the contribution
This is the section I would want to read first if someone else had written this page.
I started in May 2026 with a claim I was confident about: that nobody was measuring or gating whether memory consolidation is faithful. A literature scan the following day dismantled it. Brain-inspired tiered memory had been built several times over. Persistent single-conversation memory had shipped. A benchmark purpose-built for hallucination in memory systems, HaluMem, had been published in November 2025. Write-time gates had been specified.
So the claim moved: nobody had integrated these pieces and tested whether they help each other. That survived about three weeks. In June I ran an adversarial audit of the 2024 to 2026 field, specifically trying to kill my own narrowed claim, and it worked. ProMem had already built write-time verification, benchmarked it on HaluMem, and beaten Mem0 doing it. Several other systems had shipped gated or trained memory operations in the same window.
What survived the third pass is the part the audit could not find anywhere. Every one of those systems checks a memory in the present tense: is this supported right now. None of them forecast which currently-clean memory is going to rot, and none close a repair loop driven by that forecast.
That is what the project is, and the narrowness is deliberate.
The three mechanisms and their honest novelty scoping:
| Mechanism | The question it asks | Novel |
|---|---|---|
| GATE, past tense | Was this supported when it was written | No. ProMem got there first. |
| PREDICT, future tense | Will it corrupt within the next N turns | Yes. This is the contribution. |
| HEAL, present action | What to do about that forecast | Only the trigger. The repairs are borrowed. |
GATE decomposes a candidate fact into atomic claims and admits it only if every claim is entailed by the union of the episodes it cites, using a local entailment model. It is not novel and I do not claim it. The worked example from a live run: consolidation proposed that a cat named Whiskers was born in March 2021, an inference the source turns never stated. Decomposition isolated the assertion, the entailment score came back at 0.055, and the fact was rejected and quarantined with the failing claim named.
4. How it is evaluated
Forecasting corruption needs labelled examples of memories that later became corrupted, with the timing known. No such dataset is published, so the labels are derived from datasets that contain the information implicitly, at no cost.
| Dataset | Role | What it supplies |
|---|---|---|
| HaluMem | Faithfulness anchor | Update chains that record which fact replaced which, giving supersession labels directly |
| MINJA | Poisoning | A published attack procedure, so poison and matched benign controls are generated rather than downloaded |
| STALE | Silent staleness | Invalidation pairs where nothing contradicts the old fact and the world simply moves on |
| LongMemEval | Long-horizon recall | Secondary cross-check, including questions where a fact has changed |
| LoCoMo | Abstention | Adversarial questions whose honest answer is that it was never said |
Three rules keep the evaluation honest. Every dataset ships its own gold memories and none of them are ever loaded, because memory construction is the thing under test; the raw conversations are replayed and the system builds its own memory. The splits are temporal rather than random, because the label is itself future information and a random split would leak it. And every statistical procedure was fixed before the runs, so the analysis cannot drift toward a preferred answer.
The whole evaluation runs under a hard budget of one hundred US dollars, on one laptop, with the write path free by design.
5. Status
| Component | State | Detail |
|---|---|---|
| Four-tier memory store | Built | Single SQLite file, append-only episodic record, full audit trail |
| Hybrid retrieval | Built | Dense vectors plus lexical search, fused by rank |
| GATE | Built | Local entailment, verified live on a real inferred fact |
| PREDICT | v1 heuristic built, model trained once | Calibrated model is the v2 workstream |
| HEAL | Manual re-verify built | The automatic background loop is v2 |
| Evaluation harness | Built | Sixteen command-line stages, offline except one |
| Scored results | Pending | Phase 5 to 6, January to March 2027 |
Suites stand at 220 backend and 222 frontend tests. Spend to date is zero dollars across 211 recorded model calls, on free-tier models only.
6. What the first numbers actually say
The forecaster has been trained once, end to end. Three seconds on a laptop CPU, no money spent. It is a plumbing verification rather than a scientific result, and the honest reading matters more than the number.
Forward AUROC on the strictly later test split came out at 0.665, meaning that given one memory that later corrupted and one that did not, the model ranks them correctly about two times in three. Better than chance, well short of useful. A logistic regression trained on identical features scored 0.6647, so the gradient-boosted model beat the simplest reasonable baseline by 0.0007, which is a tie. I had committed in writing to reporting exactly that outcome before the result existed.
Three caveats, all of which I would want an examiner to raise:
| Caveat | What it means |
|---|---|
| Thirteen positives in the test split | Every test metric rests on thirteen events, so the intervals are wide |
| A calibration score that flattered | Expected calibration error read 0.00012, which looks flawless until you plot the reliability diagram and find every prediction sitting in one bucket. A model that says the same thing about everything is trivially calibrated and tells you nothing. |
| Most of the signal will not survive deployment | The dominant feature carried 76.8 percent of the model's gain and is a dataset annotation that is a hardcoded constant in the running system. The model took a shortcut, which is what models do when the production-signal features are the ones left unpopulated. |
That third one is the most useful thing the project has taught me so far, and I found it by checking the trained model's features against the live database schema rather than trusting the training run.
7. Three things worth taking away
These generalise past this project, which is why they are here rather than only in the thesis.
The obvious feature can be the wrong one. Building an anomaly detector, the instinct is to reach for embedding distance and look for outliers. The MINJA paper shows that poisoned memories planted through ordinary conversation sit entangled with benign ones in embedding space, because the attack works by blending in. A detector built on that geometry would be blind to exactly the attack it most needs to catch, so the feature set here is behavioural and structural, and contains no embedding distance at all. The same representation is load-bearing for retrieval and deliberately excluded from forecasting.
A summary statistic can be gamed by a degenerate model. The calibration number above was excellent and meaningless. Any scalar can hide a model that has learned to say one thing; the diagram behind it cannot.
Dumping the data into a table and looking at it beats reading the code. Two real bugs in this project were found that way, not by reading source: the shortcut-learning problem above, and a string mismatch that silently zeroed three features across every one of 14,823 rows.
8. Changelog
| Date | Change |
|---|---|
| 2026-08-03 | Page created. Status, first forward numbers, and the feature-transfer finding recorded. |
Context
ANAMNESIS is my final-year project at the Informatics Institute of Technology, affiliated with the University of Westminster, for the 2026 to 2027 academic year, supervised by Shiham Farook. It shares one research territory with Project Hydra, my longer-running personal work on sovereign personal AI, but has its own scope, deliverables, and deadline. The earlier article in the Hydra series that named this slice is a snapshot of where the idea started in May 2026, before the reshaping described in section 3.
Selected sources behind the design: Chen et al. (2025) on HaluMem; Dong et al. (2025) on memory injection attacks; Chao et al. (2026) on implicit staleness; Yang et al. (2026) on proactive memory extraction; Min et al. (2023) on atomic factual precision; Guo et al. (2017) on calibration; Angelopoulos and Bates (2021) on conformal prediction.