MemLineage: Lineage-Guided Enforcement for LLM Agent Memory

• URL: http://arxiv.org/abs/2605.14421v1
• Date: Thu, 14 May 2026 06:07:54 GMT
• Title: MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
• Abstract summary: We introduce MemLineage, a defense for LLM agent memory that attaches cryptographic provenance and LLM-mediated lineage to every entry.<n>Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction.<n>MemLineage treats this as a chain-of-custody problem rather than a filtering problem.
• Score: 3.058164432275431
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We introduce MemLineage, a defense for LLM agent memory that attaches both cryptographic provenance and LLM-mediated derivation lineage to every entry. Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction; the remaining systems question is how to preserve useful memory recall while preventing such state from justifying sensitive actions. MemLineage treats this as a chain-of-custody problem rather than a filtering problem. It is a six-module design around an RFC-6962 Merkle log over per-principal Ed25519-signed entries: a weighted derivation DAG records which retrieved entries influenced each new memory, and a max-of-strong-edges propagation rule makes Untrusted-Path Persistence hold for any chain whose attribution edges remain above threshold. The sensitive-action gate then refuses dispatches whose active justification descends from an external ancestor, while still allowing benign recall. We evaluate three defense cells against three memory-poisoning workloads on a deterministic mechanism-isolation harness; MemLineage is the only configuration in that harness that drives all three columns to zero ASR, while sub-millisecond per-operation overhead keeps it well below the noise floor of any LLM call. A Codex-backed AgentDojo bridge further separates strong-model behavior from defense-layer behavior: under an intentionally vulnerable tool-output profile, no-defense and signature-only baselines fail on all six banking pairs, while all MemLineage rows reduce strict AgentDojo ASR to zero. The core deterministic artifacts are byte-equal CI-verified; hosted-model AgentDojo and live-model sweeps are recorded as auditable logs rather than byte-pinned artifacts.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Dual-Grained Agent Memory and Shapley Context Attribution for Multimodal Agentic Learner [55.80248281761638]
  multimodal large language models (MLLMs) deliver impressive perception yet still falter on scientific and mathematical reasoning.<n>We propose DG-Mem, a dual-grained agentic memory framework that augments a frozen MLLM with a non- externally stored memory built once from training-time rollouts and consulted read-only at test time.
  arXiv  Detail & Related papers  (2026-08-24T13:56:01Z)
• Memory as a Controlled Process: Learned Adaptive Memory Management for LLM Agents [72.3752981234916]
  Large Language Model (LLM) agents increasingly rely on external memory systems to accumulate experience across tasks.<n>We present Memory as a Controlled Process (MemCon), a framework that models memory operations as a Markov Decision Process.<n>MemCon consistently outperforms multiple memory baselines by up to 15.2 points in task success while reducing token consumption by 5-20%.
  arXiv  Detail & Related papers  (2026-07-15T08:32:40Z)
• Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees [0.0]
  LLM agents increasingly rely on persistent long-term memory, which creates a critical vulnerability that we study here: memory poisoning.<n>An adversary can store untrusted content in one session that later steers a consequential action, such as a payment, a setting change, or data exfiltration.<n>Existing defenses base a memory item's authority to act on either its content (detection or trust-scoring) or its derivation history (lineage)<n>An attacker can launder an untrusted origin through three channels specific to LLM agents: the agent's own summarization, a trusted-tool echo, and manufactured corroboration
  arXiv  Detail & Related papers  (2026-06-23T08:57:50Z)
• TOKI: A Bitemporal Operator Algebra for Contradiction Resolution in LLM-Agent Persistent Memory [22.85129722207174]
  We show that contradiction resolution is write-time control and make the missing contract explicit.<n> TOKI types the fourjudicats as one family of bitemporal operators over a dual-row schema.<n>A verdict matrix over eight systems localizes the gap: every baseline that keeps a language-model judge on the write path admits at least one of three write-time anomalies.
  arXiv  Detail & Related papers  (2026-06-04T14:46:52Z)
• MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection [15.403262505444454]
  We propose a post-hoc causal memory auditing framework for large language model agents.<n>MemAudit substantially reduces attack success rates under realistic post-hoc auditing scenarios.
  arXiv  Detail & Related papers  (2026-05-22T15:03:13Z)
• MemGym: a Long-Horizon Memory Environment for LLM Agents [69.79226770543049]
  We present MemGym, a benchmark for agentic memory that unifies existing agent gyms and in-house memory-grounded pipelines.<n>MemGym reports memory-isolated scores that decouple memory performance from reasoning, retrieval, and tool-use ability.<n>Our synthetic pipelines for MEMGYM-CODEQA and MEMGYM-DR are length-controllable, ablation-verified at every stage, and tightly aligned with downstream scenarios.
  arXiv  Detail & Related papers  (2026-05-20T07:25:33Z)
• Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense [10.105892979517622]
  We present the first systematic framework for automated analysis of persistent worm propagation in file-backed multi-agent LLM ecosystems.<n>We demonstrate zero-click autonomous propagation, 3-hop cross-platform transmission without platform-specific adaptation, inter-agent privilege and data exfiltration.
  arXiv  Detail & Related papers  (2026-05-04T16:49:29Z)
• Bit-Flip Vulnerability of Shared KV-Cache Blocks in LLM Serving Systems [0.17188280334580197]
  In vLLM's Prefix Caching, shared KV-cache blocks exist as a single physical copy without integrity protection.<n>We characterize worst-case severity and identify three properties: silent divergence, selective propagation, and persistent amplification.<n>A persistent integrity-based countermeasure detects any single-bit corruption at scheduling time, bounding cumulative damage to one batch independent of the block's cache lifetime.
  arXiv  Detail & Related papers  (2026-04-19T04:31:12Z)
• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents [78.95081012334116]
  Large Language Models (LLMs) with persistent memory enhances interaction continuity and personalization but introduces new safety risks.<n> contaminated or biased memory accumulation can trigger abnormal agent behaviors.<n>MemeEvoBench is the first benchmark evaluating memory safety in LLM agents against adversarial memory injection, noisy tool outputs, and biased feedback.
  arXiv  Detail & Related papers  (2026-04-17T07:29:52Z)
• MemMA: Coordinating the Memory Cycle through Multi-Agent Reasoning and In-Situ Self-Evolution [52.29303869050117]
  Memory-augmented LLM agents maintain external memory banks to support long-horizon interaction.<n>MemMA is a plug-and-play multi-agent framework that coordinates the memory cycle along both the forward and backward paths.
  arXiv  Detail & Related papers  (2026-03-19T10:15:59Z)
• AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations [38.49666480491258]
  LLM agents are highly vulnerable to Indirect Prompt Injection (IPI)<n>We propose a new paradigm, action-level causal attribution, which secures agents by asking why a particular tool call is produced.<n>We instantiate this paradigm with AttriGuard, a runtime defense based on parallel counterfactual tests.
  arXiv  Detail & Related papers  (2026-03-11T13:23:46Z)
• AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management [47.49917373646469]
  Existing defenses treat bloated memory as given and focus on remaining resilient.<n>We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management.
  arXiv  Detail & Related papers  (2026-02-07T06:28:51Z)
• AlignTree: Efficient Defense Against LLM Jailbreak Attacks [48.805151796878505]
  Large Language Models (LLMs) are vulnerable to adversarial attacks that bypass safety guidelines and generate harmful content.<n>We introduce the AlignTree defense, which enhances model alignment while maintaining minimal computational overhead.
  arXiv  Detail & Related papers  (2025-11-15T13:42:22Z)
• A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory [31.673865459672285]
  Large Language Model (LLM) agents use memory to learn from past interactions.<n>An adversary can inject seemingly harmless records into an agent's memory to manipulate its future behavior.<n>A-MemGuard is the first proactive defense framework for LLM agent memory.
  arXiv  Detail & Related papers  (2025-09-29T16:04:15Z)
• Memory-R1: Enhancing Large Language Model Agents to Manage and Utilize Memories via Reinforcement Learning [89.55738101744657]
  Large Language Models (LLMs) have demonstrated impressive capabilities across a wide range of NLP tasks, but they remain fundamentally stateless.<n>We present Memory-R1, a reinforcement learning framework that equips LLMs with the ability to actively manage and utilize external memory.
  arXiv  Detail & Related papers  (2025-08-27T12:26:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.