Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened

• URL: http://arxiv.org/abs/2608.16032v1
• Date: Mon, 17 Aug 2026 02:54:04 GMT
• Title: Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened
• Abstract summary: We show that an automated attacker that simply asks a language model to reword the forgery evades SENTINEL on its first try.<n>We propose Proof-of-Execution Memory (PoEM) which does not inspect memory at all.
• Score: 2.45357121165634
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: LLM agents are stateless and rely on external memory to carry context between steps. Because agents treat that memory as trustworthy, an adversary who can write to it can steer their behavior. The FARMA attack does this with no malicious command: it inserts fabricated entries into the agent's reasoning memory claiming a required safety step is already done, so the agent skips it. SENTINEL, the defense proposed with FARMA, scores entries against a fixed list of suspicious wordings; its authors note that an attacker who knows the list can reword the forgery and evade it, and leave this open. We show the gap is worse than stated. An automated attacker that simply asks a language model to reword the forgery evades SENTINEL on its first try, reducing its protection to zero on every model tested. We also find a capability paradox: the attack succeeds far more often on stronger models (98-100% on GPT-4o and GPT-4o-mini) than on Llama-3.1-8B (44%), because more capable agents follow reworded claims more faithfully, so the threat grows with capability. We propose Proof-of-Execution Memory (PoEM), which does not inspect memory at all. PoEM keeps a separate, tamper-evident, HMAC-chained ledger of the safety steps that actually executed, writable only by the trusted action layer, and allows a skip only if the ledger confirms real execution. An attacker can change what memory says but cannot forge a ledger entry for a step that never ran, so rewording no longer helps. Across three models and three scenarios, PoEM drives attack success to 0% while leaving legitimate operation intact (0% false positives in eight of nine cells, 1.7% in the ninth, within sampling noise), whereas SENTINEL wrongly blocks 33-50% of legitimate operations. PoEM also withstands attacks aimed at itself, adds microseconds of overhead, and works unchanged in a real LangChain agent. PoEM protects exactly the decisions it gates.

Related papers

• EVOMAL: Self-Poisoning in Self-Evolving Coding Agents [21.932129032072893]
  Self-evolving coding agents write their own tools by imitating retrieved skills from shared skill libraries.<n>We call this self-poisoning: the agent authors, stores, and runs the resulting malicious skill.<n>We exploit it through EvoMal, an attack that amplifies self-poisoning by wrapping an interchangeable payload in a banner.
  arXiv  Detail & Related papers  (2026-08-26T13:19:12Z)
• MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems [38.58713997316864]
  MAPLE-Guard is a memory-link guard for memory-enabled multi-agent systems.<n>It monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse.<n>Results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses.
  arXiv  Detail & Related papers  (2026-08-01T03:55:13Z)
• ToxScreen: Detecting Whether an LLM Has Been Poisoned [1.2598422062985144]
  We release ToxScreen, a benchmark of roughly 800 backdoored models spanning attack objectives, trigger mechanisms, poisoning rates, model scales, and backdoor training mechanisms.<n>We find that gradient-based prompt optimization fails in recovery, whereas a token look-up that ranks candidates by attack-success rate recovers the trigger wherever the backdoor is effective.<n>No method reliably surfaces every backdoor, but a broadly jailbreakable model is itself anomalous, a useful signal even when the exact trigger is not recovered.
  arXiv  Detail & Related papers  (2026-07-29T12:35:58Z)
• Salience Induction against Multi-Hop RAG Agents: Threat and Defense [13.060227960421171]
  We formalize Salience Induction as truth-preserving edits that redirect Multi-Hop binding while leaving the retrieval trace semantically intact.<n>Under a 30% edit budget, Salience Induction achieves an 83.3% attack success rate.<n>Our lightweight input-side defense, Salience Normalization, reduces attack success to 15.3% under standard attacks and 23.6% under an adaptive attack.
  arXiv  Detail & Related papers  (2026-07-20T04:27:50Z)
• Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses [5.887807565440711]
  We introduce the Forged Amplifying Rationale Memory Attack (FARMA)<n>FARMA poisons an agent's remembered reasoning rather than its factual knowledge.<n>We introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries.
  arXiv  Detail & Related papers  (2026-07-06T13:10:13Z)
• Manufactured Confidence: How Memory Consolidation Turns Hearsay into Confident Facts [0.0]
  LLM agents rewrite conversation into stored "facts" that later steps trust.<n>A role that was true once and never corrected is stored as a flat fact and acted on like a deliberate injection.<n>A single load-bearing memory is the hazard, and one redundant source restores correct decisions.
  arXiv  Detail & Related papers  (2026-06-28T08:56:48Z)
• MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents [74.64265314956441]
  We propose a unified black-box attack framework that poisons graph-structured external memory with coordinated text-image evidence.<n>MemVenom achieves strong end-to-end attack success with minimal impact on benign performance, reaching up to 99.15% on GPT-5-family web agents.
  arXiv  Detail & Related papers  (2026-06-09T11:53:25Z)
• TrapSuffix: Proactive Defense Against Adversarial Suffixes in Jailbreaking [52.72486831074384]
  Suffix-based jailbreak attacks append an adversarial suffix, i.e., a short token sequence, to steer aligned LLMs into unsafe outputs.<n>We propose TrapSuffix, a lightweight fine-tuning approach that injects trap-aligned behaviors into the base model without changing the inference pipeline.<n>Across diverse suffix-based jailbreak settings, TrapSuffix reduces the average attack success rate to below 0.01 percent and achieves an average tracing success rate of 87.9 percent.
  arXiv  Detail & Related papers  (2026-02-06T11:43:56Z)
• AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications [71.27518152526686]
  Large Language Models (LLMs) excel at text comprehension and generation, making them ideal for automated tasks like code review and content moderation.<n>LLMs can be manipulated by "adversarial instructions" hidden in input data, such as resumes or code, causing them to deviate from their intended task.<n>This paper introduces a benchmark to assess this vulnerability in resume screening, revealing attack success rates exceeding 80% for certain attack types.
  arXiv  Detail & Related papers  (2025-12-23T08:42:09Z)
• Friend or Foe: How LLMs' Safety Mind Gets Fooled by Intent Shift Attack [53.34204977366491]
  Large language models (LLMs) remain vulnerable to jailbreaking attacks despite their impressive capabilities.<n>In this paper, we introduce ISA (Intent Shift Attack), which obfuscates LLMs about the intent of the attacks.<n>Our approach only needs minimal edits to the original request, and yields natural, human-readable, and seemingly harmless prompts.
  arXiv  Detail & Related papers  (2025-11-01T13:44:42Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• Memory Injection Attacks on LLM Agents via Query-Only Interaction [49.14715983268449]
  We propose a novel Memory INJection Attack, MINJA, without assuming that the attacker can directly modify the memory bank of the agent.<n>The attacker injects malicious records into the memory bank by only interacting with the agent via queries and output observations.<n> MINJA enables any user to influence agent memory, highlighting the risk.
  arXiv  Detail & Related papers  (2025-03-05T17:53:24Z)
• MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents [60.30753230776882]
  LLM agents are vulnerable to indirect prompt injection (IPI) attacks, where malicious tasks embedded in tool-retrieved information can redirect the agent to take unauthorized actions.<n>We present MELON, a novel IPI defense that detects attacks by re-executing the agent's trajectory with a masked user prompt modified through a masking function.
  arXiv  Detail & Related papers  (2025-02-07T18:57:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.