What a model lets into long-term memory matters more than how it learns

We set out to answer three questions that keep coming up in our continual-learning work: whether a model should keep separate short- and long-term memories, what the correct way and order is to train a world model, and how a learning system should decide which sources to trust. We reviewed the literature through November 2026 and ran three small experiments of our own. The three questions turned out to share an answer. What matters most is not how much a model learns or in what order, but what it allows into the slow, hard-to-revise knowledge held in its weights.

On memory, the episodic store does most of the work. In our Split-MNIST experiments, run as five two-digit tasks with no task label at test time, a network with no protection ended at 0.197 accuracy, about one task's worth. Elastic weight consolidation did nothing in this setting at any strength we tried. A buffer of 500 stored images lifted accuracy to 0.852, and 2,000 images to 0.924. Adding a separate slow network updated during a short post-task distillation "sleep" raised the 500-image result to 0.888, a gain of about 3.6 points that extra training steps alone did not reproduce. Google's Sleep framework points the same way at LLM scale: without its self-generated rehearsal, knowledge uptake fell from 48.1 to 35.7, barely above plain finetuning at 33.4. The rehearsal content matters more than moving knowledge between tiers.

Neuroscience suggests consolidation should be selective. Sun, Saxe and colleagues showed that memories should move into the slow system only to the extent that this improves generalization, because consolidating noisy or unpredictable memories makes it overfit. Most machine consolidation still runs on a fixed clock. Gating writes by whether they generalize, and by whether they fit what the model already knows, is largely untested in ML.

Source trust is where gating mattered most. Brains are poor at it: people forget where a claim came from faster than the claim, and retractions typically at most halve reliance on misinformation. LLMs fail similarly. In ClashEval, six leading models adopted incorrect retrieved content over their own correct prior more than 60% of the time. Poison also works at fixed doses: about 250 documents backdoored models from 600M to 13B parameters, and MINJA planted malicious agent memories through ordinary queries alone.

In our second experiment we split MNIST into five sources, one small and trusted, three noisy, and one targeted poisoner that relabelled every 7 as a 1 and every 3 as a 5. Tagging each example with its source was the strongest single method, raising clean accuracy from 0.833 to 0.944, but only because the poisoner could be identified by its tag. Weighting sources by their estimated reliability backfired, pushing the 7-to-1 attack rate from 0.468 to 0.696, even though the estimates themselves were accurate. Down-weighting the noisy sources increased the poisoner's share. The useful signal was per example: does this label agree with what trusted memory predicts? Used as a gate before updating a long-term model, that check held the attack rate at 0.037 while keeping most of the stream's benefit. Consolidating everything, even with trusted examples replayed alongside, let the attack reach 0.936. Corrections after consolidation did not undo the poison; a gate before it did.

World models showed the same pattern. Models look right before they are physically right: on Physics-IQ, Sora had the best visual realism but scored 10.0%, and the best model on World Models' Last Exam in Physics reached 57.76 out of 100. The levers with evidence are data coverage, an objective matched to how the model will be used, and inductive bias. In our point-mass simulator, data from one narrow control policy made one-step error 3.9 times higher on uniformly sampled states and actions, and training on 10-step rollouts cut 20-step error 3.2 times. Easy-first ordering was a null result, and we found no controlled study in the literature that permutes world-model training stages. When the physics changed partway through, replay plus a signal telling the model which regime it was in matched training on everything at once.

These experiments are toy-scale: small MLPs on MNIST and a 2-D simulator, three to five seeds, with several conditions added after seeing pilot results. They are directional evidence, not general claims. The practical upshot is to treat consolidation as a security and generalization boundary rather than a storage step, and to keep low-trust or idiosyncratic knowledge in external memory longer, because removing it from weights is unreliable. The experiment that matters next is a learned consolidation gate, tested at LLM scale against an attacker that spreads across sources and forges provenance.