A new preprint stores past tool successes and failures in a graph so frozen small language models can retrieve repairs without retraining.

Researchers introduced FRESH, short for Failure-aware Retrieval over Experience-Structured Heterogeneous graphs, on 23 September. The framework records tasks, actions, errors, repairs and execution conditions as connected entities. Before a tool-using agent acts, it can retrieve relevant experience and avoid repeating a previously observed mistake.

Why it matters

Small and medium-sized language models are cheaper to run locally or at high volume, but they struggle with long workflows. They may write before gathering required information, repeat a failed tool call or violate an action’s prerequisites. In a stateful system, such errors can alter data or trigger irreversible actions.

Fine-tuning can teach better behavior, but it requires training data, compute and a new model version. External memory offers another route: leave the model weights unchanged and supply a relevant lesson at inference time. FRESH focuses on failures because a failed action is useful only when its context and repair are preserved.

A flat text memory might retrieve “do not call this tool” without explaining that the call failed only before authentication. The proposed graph connects a task to actions, conditions, errors and successful repairs. Retrieval can therefore distinguish a generally bad strategy from an action that was premature or missing a prerequisite.

The authors evaluate FRESH with several open-source models on τ-Bench and AppWorld, two environments for agents that use tools to complete stateful tasks. They report more successful tasks and more reliable tool use than agents with no memory and representative memory baselines. These are author-run results from a new preprint, not independent confirmation.

What deployment would require

Failure memory creates its own risks. A stored repair may become obsolete when an API changes. An attacker could poison the memory with a misleading failure or unsafe workaround. A retrieved example may also contain sensitive data from an earlier session. Production systems need provenance, expiration, access controls and a way to remove bad experience.

The graph must decide what counts as the same situation. Too broad a match can prevent a valid action because it resembles an old failure. Too narrow a match leaves the agent unable to reuse the lesson. The paper’s benchmark gains do not settle how retrieval behaves across a company’s changing tools and policies.

Small models are the most interesting target because they have less capacity to infer missing preconditions on their own. A structured memory can act like a maintenance log: before repeating a repair, the technician checks what failed, under which conditions and what fixed it. The analogy also reveals the limitation—a bad log can institutionalize the wrong procedure.

Teams testing this approach should separate read-only and destructive tools, measure repeated-error rates and inspect retrieved memories. They should compare the graph with simpler checklists and explicit tool schemas, because structure has an engineering cost.

The next useful evidence will be an open implementation, independent benchmark runs and longer tests in changing environments. FRESH offers a plausible way to improve small agents without retraining, but safe memory management becomes part of the agent’s security boundary.

Verification

  1. VERIFIED — The FRESH preprint was submitted to arXiv on 23 September 2026. Primary source: https://arxiv.org/abs/2609.28003
  2. VERIFIED — FRESH represents tasks, actions, errors, repairs and execution conditions in a heterogeneous graph. Primary source: the arXiv paper above.
  3. VERIFIED — The method supplies external experience to frozen language models rather than requiring fine-tuning. Primary source: the arXiv paper above.
  4. VERIFIED AS AUTHOR-REPORTED RESULTS — Experiments on τ-Bench and AppWorld improved success and tool reliability over stated baselines. Primary source: the arXiv paper above.
  5. UNVERIFIED — Independent reproduction and production security testing were not located. The work is a new preprint.

Glossary candidates

  • Heterogeneous graph: A network containing several kinds of entities and relationships.
  • Frozen model: A model used without changing its trained parameters.
  • Memory poisoning: Introducing false or harmful records that influence later behavior.

Cold-reader sentence: FRESH uses graph-structured failure memory to improve small tool agents without retraining, but independent and adversarial testing is still needed.