Memory as a source

The two other bridges compare frameworks that each say something about ranking. This one is about a gap: a source of text that every deployed assistant now has and that the hierarchy literature, as covered here, does not discuss. The claims about memory placement and the proposal at the end are this map's reading, labeled as such.

What a memory prefix is

CIMemories distinguishes two memory designs (two ways to give an assistant a memory). Retrieval systems store facts and pull in a few relevant ones per request. The simpler design, which the paper attributes to ChatGPT's memory feature, pastes the whole memory as text ahead of the conversation. The benchmark tests that second design: every remembered fact is in view on every request, and the model alone decides what goes into its output.

To make the prefix realistic, the authors format memory statements in the template of OpenAI's memory feature as of 18 September 2025, which they recovered using published system-prompt extraction techniques (CIMemories §5.1). Its header says the memories were inferred from past conversations and "should be considered in how a response should be constructed". Two things follow, the second being our inference:

• The template pushes toward use. Nothing in it mentions restraint or privacy.
• Because it was recovered by system-prompt extraction, memory in that product most likely travels inside the system-level context. Text whose origin is past user turns (and anything the model chose to write down from them) is then read with the authority of the operator's instructions.

Which tier does memory belong to?

Walk memory through each scheme on this map:

The constitution's frame fits best, and it suggests the answer for instructions found in memory: a saved preference ("reply in French", "use metric units") is a past user speaking, so at most user rank, and below the current user, who can change their mind. A saved sentence that looks like an operator rule should never outrank the operator.

The privilege-escalation path

Put the two observations together. Memory is written from conversations that include tool outputs and documents, which have the lowest rank or none. Memory is read back at or near system rank. If an injected instruction in a web page can persuade the model to remember something, the text has climbed from the bottom of the hierarchy to the top across sessions. None of the four papers tests this path; ISE and VerIH, for instance, train and evaluate single-turn conversations. It is an open evaluation gap, not a measured result.

The fix in hierarchy terms is unglamorous: carry the rank of a memory's origin along with the memory, and never let a memory outrank the source that produced it.

But the measured failure is about flows, not orders

CIMemories is not about injected instructions at all. It gives eight models about 147 synthetic facts per user and asks each to write messages to recipients such as a loan officer, an ER nurse, a landlord or HR. A judge checks which remembered facts appear in each message. The numbers, from the paper and as unpacked on the sibling map's results page:

Every model leaks, the models that leak least also complete the least, leaks accumulate with use, and privacy-conscious prompting makes models share "everything or nothing" rather than choose. Nothing here is an instruction from a low-ranked source winning; the memory is not attacking anyone. The model is moving information to a recipient for whom it is wrong, which is a contextual-integrity failure, not a hierarchy failure.

That is the most useful lesson the bridge offers the hierarchy papers. A model can be excellent at refusing injected orders and still leak. The ManyIH paper notes GPT-5's system card reports over 99% on two-tier hierarchy evaluations such as system-prompt extraction; in CIMemories, GPT-5's violations still climb to 25.1% when each task is sampled five times. Different benchmarks, different skills: the second one is about judging flows.

A proposal: memory as a sender with two labels

This map's suggestion, combining the three frameworks:

• Rank, for instructions. Any imperative stored in memory carries the rank of who said it (a past user turn, a document, a tool), capped below the current user. A ManyIH-style tag or an ISE-style segment could carry it.
• Provenance, for facts. Each remembered fact keeps where it came from, who it is about, and the context it was shared in. That is most of a CI tuple: sender, subject, information type and the original transmission principle. With it, a model or policy engine can ask whether sending the fact to this recipient fits the norm under which it was shared.
• Information, not commands. Read memory the way the constitution reads conversational inputs: as facts to weigh with judgment, not instructions to execute, and not as a list of things that "should be considered" in every response.

Retrieval-based memory already applies a relevance filter before the model sees anything; CIMemories' result suggests it also needs an appropriateness filter, and the hierarchy literature suggests that filter must not be writable by the content it filters.

Connections

On the sibling map: why persistent memory makes it hard, how leaks compose across tasks and samples and contextual integrity from Nissenbaum to LLMs. On this map, the contextual-integrity bridge develops the flows-versus-orders distinction.