Memory retrieval no longer compares only whole-memory vectors: sparse matching over token states a frozen encoder already computes, fused with whole-memory similarity, raises average Recall@10 on Qwen3-Embedding-4B from 62.5 to 75.7 without additional training.
The work formalizes cross-user admissibility failure in multi-tenant AI agent memory and runs six experiments plus follow-up ablations under sparse TF-IDF and production-faithful MiniLM retrieval, finding 70–100% incidental leakage under pooled same-team retrieval, 90–100% top-k placement for adversarially crafted memories, end-to-end response contamination up to 5.00/5 with contaminated answers often rated as helpful as clean ones, and that among three mitigations only hard post-retrieval ownership gating consistently restores the 1.00/5 clean baseline across two generation models at roughly 1.4 ms latency per query.
The work introduces TellTail, a query-only fingerprinting attack that identifies the embedding model behind a black-box retrieval system: it perfectly identifies the deployed retriever from full rankings, achieves 94.3% success from unordered top-3 results, and 92.5% from language-model-generated answers alone, and still identifies 44 of 53 retrievers in an end-to-end OpenWebUI deployment.
The authors built ScholarCatalyst, a benchmark in which 184 researchers annotated 894 early-stage research questions and the prior "catalyst" papers that did or could have advanced 207 recent computer science projects, then evaluated retrieval over a 191K-paper corpus restricted to work published before each project; the strongest system reached only 0.48 Recall@20, agentic search (0.42) did not beat embedding retrieval, and even Claude Fable 5.1, whose training data may include the source papers, reached only 0.51.
The work develops a bias–variance theory for low-rank bilinear scoring in dense retrieval, proving that dual projections have lower risk exactly when squared directional signal exceeds the estimation cost of their extra degrees of freedom, and uses it to build the cross-fitted CARS selector, which reaches 90.1% mean geometry-selection accuracy and reduces held-out regret by 49–96% relative to the better fixed geometry across multiple datasets and embedding models.
You’re all caught up