MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems

• URL: http://arxiv.org/abs/2605.25002v1
• Date: Sun, 24 May 2026 11:04:35 GMT
• Title: MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems
• Abstract summary: Memory-backed agents need provenance that can survive leaked or migrated snapshots.<n>MemMark embeds an owner-controlled signal into latent memory-write decisions.<n>MemMark is feasible for long-term agent memory without surviving traces, trusted metadata, or utility-degrading.
• Score: 13.133650395551507
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Memory-backed agents need provenance that can survive leaked or migrated snapshots, where logs, visible outputs, and trusted metadata may be absent. We propose MemMark, a state-evolution attribution watermark that embeds an owner-controlled signal into latent memory-write decisions. At each internal LLM call, MemMark samples among admissible candidates using keyed, distribution-preserving selection, and records cryptographic commitments with signed session anchors and reveal evidence. This makes attribution depend on reproducible backend behavior rather than mutable provenance fields. Across A-Mem and Graphiti on LoCoMo, with three LLM backbones, MemMark preserves memory utility: Overall F1 retains 99.6% of the unwatermarked baseline, while BLEU-1 changes by +0.2%. It also provides usable carrier capacity, with 1.16, 1.14, and 1.26 bits of mean entropy for update-target, link-target, and semantic-realization decisions. In the snapshot-only R3 setting, MemMark recovers the full 40-bit payload from final snapshots, while wrong-key verification remains near chance. Under nine memory-lifecycle attacks, verification distinguishes tampering, evidence deletion, and partial payload recovery. These results show that robust snapshot-only attribution is feasible for long-term agent memory without surviving traces, trusted metadata, or utility-degrading.

Related papers

• MemGuard: Persisting Verifier Signals for LLM-Agent Memory Governance [21.021172368088504]
  LLM agents are moving from single-prompt use to long task streams in which reusable memory becomes a core capability.<n>MemGuard treats verifier output not as a one-shot filter, but as persistent lifecycle metadata.<n>MemGuard achieves the best success metric and lowest average steps in all 16 backbone-benchmark settings.
  arXiv  Detail & Related papers  (2026-08-22T09:25:23Z)
• Memory as a Controlled Process: Learned Adaptive Memory Management for LLM Agents [72.3752981234916]
  Large Language Model (LLM) agents increasingly rely on external memory systems to accumulate experience across tasks.<n>We present Memory as a Controlled Process (MemCon), a framework that models memory operations as a Markov Decision Process.<n>MemCon consistently outperforms multiple memory baselines by up to 15.2 points in task success while reducing token consumption by 5-20%.
  arXiv  Detail & Related papers  (2026-07-15T08:32:40Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• MemLeak: Diagnosing Information Leaks in Multimodal Agent Memory [12.853875632489114]
  When a multimodal AI agent is asked to forget a fact, current memory systems usually delete the text entry and report success.<n>We find that the fact can remain recoverable from retained user images, including images tagged to entirely different facts.<n>We introduce the Information Provenance Graph (IPG), a taxonomy that classifies memory representations by deletion affordance.
  arXiv  Detail & Related papers  (2026-06-29T05:07:02Z)
• MEMPROBE: Probing Long-Term Agent Memory via Hidden User-State Recovery [58.64329475683699]
  We argue that long-term memory should be evaluated as an auditable post-interaction artifact.<n>We instantiate this view in MEMPROBE, a benchmark in which a memory-equipped agent assists simulated users.<n>We find that successful assistance and recoverable memory behave as distinct capabilities.
  arXiv  Detail & Related papers  (2026-06-23T13:52:46Z)
• Beyond Similarity: Trustworthy Memory Search for Personal AI Agents [25.265839311088516]
  We study memory search as a trust boundary in personal AI agents.<n>MemGate is a lightweight and deployable memory plug-in for trustworthy memory search.
  arXiv  Detail & Related papers  (2026-06-04T11:54:29Z)
• Same Ranking, Different Winner: How Scoring Targets Shape LLM Memory Benchmarks [2.9089118242427627]
  Conversational-memory systems transform dialogue history into facts, summaries, timelines, and other source-linked descendants.<n>This raises an underspecified evaluation question: which stored form should receive retrieval credit?<n>We show that this scoring-target choice is often left implicit and can materially change benchmark conclusions.
  arXiv  Detail & Related papers  (2026-05-22T02:53:07Z)
• MemGym: a Long-Horizon Memory Environment for LLM Agents [69.79226770543049]
  We present MemGym, a benchmark for agentic memory that unifies existing agent gyms and in-house memory-grounded pipelines.<n>MemGym reports memory-isolated scores that decouple memory performance from reasoning, retrieval, and tool-use ability.<n>Our synthetic pipelines for MEMGYM-CODEQA and MEMGYM-DR are length-controllable, ablation-verified at every stage, and tightly aligned with downstream scenarios.
  arXiv  Detail & Related papers  (2026-05-20T07:25:33Z)
• Is One Score Enough? Rethinking the Evaluation of Sequentially Evolving LLM Memory [50.857546269660276]
  We introduce SeqMem-Eval, a diagnostic evaluation framework for sequentially evolving large language models (LLMs) memory.<n>Rather than focusing only on final performance, SeqMem-Eval evaluates how memory states evolve, generalize, consolidate experience, and retain useful information during sequential inference.
  arXiv  Detail & Related papers  (2026-05-14T20:15:22Z)
• MemLineage: Lineage-Guided Enforcement for LLM Agent Memory [3.058164432275431]
  We introduce MemLineage, a defense for LLM agent memory that attaches cryptographic provenance and LLM-mediated lineage to every entry.<n>Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction.<n>MemLineage treats this as a chain-of-custody problem rather than a filtering problem.
  arXiv  Detail & Related papers  (2026-05-14T06:07:54Z)
• Mem-W: Latent Memory-Native GUI Agents [50.87647372904382]
  We introduce Mem-W, a series of latent-memory-native GUI agents that treat memory as part of the agent's continuous context.<n>Across four web and mobile navigation benchmarks, Mem-W consistently improves diverse backbones and memory-enhanced baselines.
  arXiv  Detail & Related papers  (2026-05-10T04:31:23Z)
• Belief Memory: Agent Memory Under Partial Observability [56.41506249481312]
  We propose BeliefMem, which shifts the memory paradigm from committing to a single conclusion per observation to retaining multiple candidate conclusions with their probabilities.<n> BeliefMem preserves the uncertainty that the deterministic paradigm discards, enabling the agent to act with high confidence.<n> Empirical evaluations on LoCoMo and ALFWorld benchmarks show that, even with limited data, BeliefMem achieves the best average performance.
  arXiv  Detail & Related papers  (2026-05-07T02:03:13Z)
• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents [78.95081012334116]
  Large Language Models (LLMs) with persistent memory enhances interaction continuity and personalization but introduces new safety risks.<n> contaminated or biased memory accumulation can trigger abnormal agent behaviors.<n>MemeEvoBench is the first benchmark evaluating memory safety in LLM agents against adversarial memory injection, noisy tool outputs, and biased feedback.
  arXiv  Detail & Related papers  (2026-04-17T07:29:52Z)
• MemRerank: Preference Memory for Personalized Product Reranking [14.982376048234386]
  We propose MemRerank, a preference memory framework that distills user purchase history into concise, query-independent signals for personalized product reranking.<n>Experiments with two LLM-based rerankers show that MemRerank consistently outperforms no-memory, raw-history, and off-the-shelf memory baselines.
  arXiv  Detail & Related papers  (2026-03-31T04:16:18Z)
• AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management [47.49917373646469]
  Existing defenses treat bloated memory as given and focus on remaining resilient.<n>We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management.
  arXiv  Detail & Related papers  (2026-02-07T06:28:51Z)
• InfMem: Learning System-2 Memory Control for Long-Context Agent [43.413381779578266]
  InfMem is a control-centric agent that instantiates System-2-style control via a PreThink-Retrieve-Write protocol.<n>On ultra-long QA benchmarks from 32k to 1M tokens, InfMem consistently outperforms MemAgent across backbones.
  arXiv  Detail & Related papers  (2026-02-02T19:15:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.