MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory

• URL: http://arxiv.org/abs/2608.02843v1
• Date: Mon, 03 Aug 2026 19:58:37 GMT
• Title: MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory
• Abstract summary: We present MutMem, an authorized-mutation protocol in a persistent agent-memory engine.<n>MutMem retains memory content, records signed positive and negative outcome evidence without age-based expiry.<n>We evaluate utility, mutation integrity, and poisoning adaptation.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Persistent agent memory must adapt as later outcomes change earlier evidence, yet mutable retrieval weights create an attribution problem: reviewers must distinguish authorized adaptation from database tampering. We present MutMem, an authorized-mutation protocol in HOM-AIMOS, a persistent agent-memory engine. MutMem retains memory content, records signed positive and negative outcome evidence without age-based expiry, and commits each nontrivial weight change as a housekeeper-authorized transition. Each transition binds a terminal provenance node, signer epoch, quantized old and new weights, a no-fork predecessor, and two domain-separated SHA-256 commitments. Ed25519 verification runs in both the database writer and a portable verifier. Content classified as poison-likely is retained with signed, revisable labels used by recall as trust evidence. We evaluate utility, mutation integrity, and poisoning adaptation. HOM-AIMOS answers 459/500 LongMemEval questions correctly under LLM judgment (91.8%). On LoCoMo, it obtains 74.12% judged accuracy and, under a separate upstream-compatible protocol, 58.20 token F1. A native suite passes all declared authorization, topology, tamper, signer-epoch, and post-mutation-recall cases; median signed-transition latency is 4.865 ms. In a declared N=100 PoisonedRAG adaptation, no injected poison appears in attacked top-5 disclosures (0/100; 95% Wilson upper bound 3.70%), while induced target-answer attack success among 98 clean-negative targets is 1/98 (1.02%). A preregistered four-arm ablation attributes the retrieval reduction to signed stored labels: the retriever selects poison for 94/100 targets when epistemic policy is bypassed and 0/100 when labels are restored. MutMem provides evidence of integrity, authorization, traceability, and historical continuity; it does not establish content truth.

Related papers

• AI-Assisted Design of a Post-Quantum Cryptographic Accelerator: A Deployed-Silicon Case Study [0.4251773265892765]
  We replace the standard acceptance gate with a byte-exact goldenreference oracle.<n>We report 232 experiments in which an agentic large language model drove a unified ML-KEM-768 and ML-DSA-65 accelerator.
  arXiv  Detail & Related papers  (2026-09-03T16:34:50Z)
• MutMem-V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence [0.0]
  MutMem V2 is a cryptographically authorized mutation for persistent agent memory.<n>It does not establish semantic truth, universal robustness, or independent replication.
  arXiv  Detail & Related papers  (2026-09-01T13:34:44Z)
• Hindsight Memory-PRM: Supervising Memory Management with Auditable Hindsight Credit [48.811961095386]
  Hindsight Memory-PRM exploits this audit trail twice.<n> offline to train an operation-conditioned memory-utility critic.<n>Online, where retrievals, citations, and one controlled deletion-and-reanswer per probe settle an intervention-calibrated entry-level presence credit.
  arXiv  Detail & Related papers  (2026-08-30T06:53:13Z)
• Turning Interaction History into Execution State: A Runtime Layer for Long-Horizon Coding Agents [48.967927222079965]
  Ledger is a runtime layer that distills an agent's completed interactions into an explicit execution state.<n> Ledger keeps this state in an online execution ledger and applies it at two boundaries of every step.<n>Across all 500 SWE-bench Verified instances, Ledger raises Pass@1 from 56.2% to 64.2% with GPT-5 mini and from 75.8% to 81.0% with MiniMax M2.5.
  arXiv  Detail & Related papers  (2026-08-01T18:25:00Z)
• DarwinX: Evolving Agent Harnesses Through Natural Selection [48.64258219266629]
  DarwinX treats self-evolution as selection over a population of harnesses with the model frozen.<n>General agent competence, not benchmark-specific patches, so it survives changes of task, verifier, and base model.
  arXiv  Detail & Related papers  (2026-07-31T05:34:02Z)
• Keep It InMind: Benchmarking the Implicit-Association Blind Spot in Agent Memory [32.094723684433895]
  Long-term memory systems store what a user says in an external store and retrieve it when a related query arrives.<n>This interface rests on an assumption so natural that it is rarely stated: a memory that is needed will resemble the query that needs it.<n>We call this failure mode the implicit-association blind spot and introduce InMind, a benchmark spanning ten life domains.
  arXiv  Detail & Related papers  (2026-07-27T12:42:12Z)
• MemTX: Transactional Belief Commit for Stateful Agent Memory [11.31806112920862]
  LLM agents increasingly coordinate through persistent shared memory.<n>Current agent memory systems treat every accepted write as immediately actionable truth.<n>We present MemTX, a transactional belief-commit protocol.
  arXiv  Detail & Related papers  (2026-07-27T01:57:39Z)
• Fantastic Adaptive Taxonomies and How to Use Them [100.20614173157708]
  AdaMAST converts execution traces into a compact, evidence-grounded failure taxonomy.<n>No code is hand-authored, no trace human-annotated.<n>In agent-system search, taxonomy-coded diagnoses of failed candidates outperform free-form.
  arXiv  Detail & Related papers  (2026-07-17T17:41:16Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• AgenticSTS: A Bounded-Memory Testbed for Long-Horizon LLM Agents [34.450981549319266]
  Memory for a long-horizon LLM agent is a contract about what each future decision is allowed to see.<n>We instrument an alternative bounded contract: every decision is made from a fresh user message assembled by typed retrieval.<n>We instantiate the contract in Slay the Spire 2, a closed-rule deck-building game.
  arXiv  Detail & Related papers  (2026-07-02T14:44:32Z)
• Getting Better at Working With You: Compiling User Corrections into Runtime Enforcement for Coding Agents [99.67681154381803]
  Test-time Rule Acquisition and Compiled Enforcement (TRACE) is a skill-layer pipeline for coding-agent runtimes.<n>Unlike runtime checks written ahead of time by developers, TRACE skills come from the user's own chat corrections.
  arXiv  Detail & Related papers  (2026-06-11T10:43:40Z)
• SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems [3.0458514384586404]
  Retrieval-augmented generation (RAG) agents increasingly run with persistent memory that accumulates across user sessions.<n>An adversary interacting only through normal channels can inject crafted memories that, once retrieved, steer the agent's responses for future users.<n>We call this Multi-Session Memory Poisoning (MSMP) and show that no existing defence certifies against it.<n>We present Signed Memory with Smoothed Retrieval (SMSR), the first defence with a certified robustness bound for this setting.
  arXiv  Detail & Related papers  (2026-06-10T21:45:52Z)
• Hierarchical Certified Semantic Commitment for Byzantine-Resilient LLM-Agent Collaboration [30.310793549183117]
  We introduce Hierarchical Certified Semantic Commitment (H-CSC), a BFT-inspired protocol that converts embedding-derived finality signals over verdict-emitting proposal groups into one of three typed outcomes.<n>H-CSC commits with low angular deviation on BFT-feasible buckets (0.31 to 2.04 degrees) and aborts 100% of beyond-BFT rounds (n3f+1) as intended.
  arXiv  Detail & Related papers  (2026-06-05T14:35:58Z)
• MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems [13.133650395551507]
  Memory-backed agents need provenance that can survive leaked or migrated snapshots.<n>MemMark embeds an owner-controlled signal into latent memory-write decisions.<n>MemMark is feasible for long-term agent memory without surviving traces, trusted metadata, or utility-degrading.
  arXiv  Detail & Related papers  (2026-05-24T11:04:35Z)
• MOSS: Self-Evolution through Source-Level Rewriting in Autonomous Agent Systems [36.221246203666745]
  MOSS is a system that performs self-rewriting at the source level on production agentic substrates.<n>It lifts a four-task mean grader score from 0.25 to 0.61 in a single cycle without human intervention.
  arXiv  Detail & Related papers  (2026-05-21T17:48:33Z)
• The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems [1.0262304700896199]
  We formalize emphSemantic Norm Drift (SND) as a third path to agent misconduct.<n>In SND, a policy-formatted document enters a shared vector store through normal uploads and later reappears as trusted system context.<n>Counterfactual Composition Testing identifies the causal entry with 87.5% accuracy and zero false positives.
  arXiv  Detail & Related papers  (2026-05-12T20:21:47Z)
• InfMem: Learning System-2 Memory Control for Long-Context Agent [43.413381779578266]
  InfMem is a control-centric agent that instantiates System-2-style control via a PreThink-Retrieve-Write protocol.<n>On ultra-long QA benchmarks from 32k to 1M tokens, InfMem consistently outperforms MemAgent across backbones.
  arXiv  Detail & Related papers  (2026-02-02T19:15:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.