Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

• URL: http://arxiv.org/abs/2607.29167v1
• Date: Fri, 31 Jul 2026 08:46:27 GMT
• Title: Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory
• Abstract summary: Provenance-Preserving Memory Fire wall (PPMF) is a lightweight memory that preserves platform-maintained provenance and authorizes tool calls by matching action risk to authority of action-relevant memories.<n>With intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate.
• Score: 2.98985980237058
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context. We identify memory provenance laundering: during LLM-based memory consolidation, an external observation may be rewritten as apparent user history or workflow support, preserving an action trigger while erasing the low-trust source that should limit its authority. Existing prompt filters, content sanitizers, and tool guards do not enforce source-authority non-amplification after lossy memory consolidation. We formalize this boundary and instantiate it as Provenance-Preserving Memory Fire wall (PPMF), a lightweight memory middleware that preserves platform-maintained provenance and authorizes tool calls by matching action risk to the authority of action-relevant memories. In our schema-grounded evaluation with fixed risk policies, vulnerable consolidated memories reach up to 1.000 attack success rate(ASR); with intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate while confirmed benign actions and targeted low-risk memory use remain executable.

Related papers

• When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents [17.320527773100732]
  We propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents.<n> PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory.<n>Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code.
  arXiv  Detail & Related papers  (2026-09-12T11:27:53Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents [74.64265314956441]
  We propose a unified black-box attack framework that poisons graph-structured external memory with coordinated text-image evidence.<n>MemVenom achieves strong end-to-end attack success with minimal impact on benign performance, reaching up to 99.15% on GPT-5-family web agents.
  arXiv  Detail & Related papers  (2026-06-09T11:53:25Z)
• Beyond Similarity: Trustworthy Memory Search for Personal AI Agents [25.265839311088516]
  We study memory search as a trust boundary in personal AI agents.<n>MemGate is a lightweight and deployable memory plug-in for trustworthy memory search.
  arXiv  Detail & Related papers  (2026-06-04T11:54:29Z)
• Memory is Reconstructed, Not Retrieved: Graph Memory for LLM Agents [51.30250860677378]
  We propose MRAgent, a framework that combines an associative memory graph with an active reconstruction mechanism.<n>Running on a Cue-Tag-Content graph, our active reconstruction mechanism integrates reasoning directly into memory access.<n>Experiments on the LoCoMo benchmark and LongMemEval benchmark demonstrate significant improvements over strong baselines.
  arXiv  Detail & Related papers  (2026-06-04T11:29:46Z)
• Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction [3.809725488301918]
  Large language model (LLM) agents increasingly leverage long term memory to support persistent and autonomous task execution.<n>Existing memory poisoning attacks assume that injected content can be stored directly in memory, overlooking the selective extraction and rewriting stages.<n>Mechanistic analysis indicates that the attack exploits embedding-space anisotropy and shifts attention patterns.
  arXiv  Detail & Related papers  (2026-05-28T14:02:00Z)
• Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents [18.83666486835137]
  In deployment, a single agent serves many independent tasks over a long horizon, and memory accumulated during earlier tasks can affect behavior on later, unrelated ones.<n>We introduce a trigger-probe protocol that evaluates a fixed probe set against read-only memory snapshots at varying prefix lengths.<n>We apply this protocol across three deployment scenarios spanning records, memos, forms, and email correspondence and eight memory architectures.
  arXiv  Detail & Related papers  (2026-05-18T04:06:34Z)
• Learning When to Remember: Risk-Sensitive Contextual Bandits for Abstention-Aware Memory Retrieval in LLM-Based Coding Agents [0.0]
  coding agents increasingly rely on external memory to reuse prior experience, repair traces, and repository-local operational knowledge.<n>This paper reframes issue-memory use as a selective, risk-sensitive control problem rather than a pure top-k retrieval problem.<n>We introduce RSCB-MC, a risk-sensitive contextual bandit memory controller that decides whether an agent should use no memory, inject the top resolution, summarize multiple candidates, perform high-precision or high-recall retrieval, abstain, or ask for feedback.
  arXiv  Detail & Related papers  (2026-04-30T00:32:53Z)
• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents [78.95081012334116]
  Large Language Models (LLMs) with persistent memory enhances interaction continuity and personalization but introduces new safety risks.<n> contaminated or biased memory accumulation can trigger abnormal agent behaviors.<n>MemeEvoBench is the first benchmark evaluating memory safety in LLM agents against adversarial memory injection, noisy tool outputs, and biased feedback.
  arXiv  Detail & Related papers  (2026-04-17T07:29:52Z)
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections [57.64370755825839]
  Self-evolving agents update their internal state across sessions, often by writing and reusing long-term memory.<n>We study this risk and formalize a persistent attack we call a Zombie Agent.<n>We present a black-box attack framework that uses only indirect exposure through attacker-controlled web content.
  arXiv  Detail & Related papers  (2026-02-17T15:28:24Z)
• Memory Injection Attacks on LLM Agents via Query-Only Interaction [49.14715983268449]
  We propose a novel Memory INJection Attack, MINJA, without assuming that the attacker can directly modify the memory bank of the agent.<n>The attacker injects malicious records into the memory bank by only interacting with the agent via queries and output observations.<n> MINJA enables any user to influence agent memory, highlighting the risk.
  arXiv  Detail & Related papers  (2025-03-05T17:53:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.