Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees
- source_url: https://arxiv.org/abs/2606.24322
- source_type: paper
- platform: arxiv
- author: Yedidel Louck
- original_date: 2026-06-23
- added_date: 2026-07-21
- arxiv_id: 2606.24322
- arxiv_categories: cs.CR
- pdf_url: https://arxiv.org/pdf/2606.24322v1
- category: agents
- tags: agent-memory, security, memory-poisoning, authority, llm-agents, arxiv
- quality_score: 4
摘要（中文）
论文把 LLM agent 长期记忆的核心风险定义为 memory poisoning：攻击者可在一次会话中写入不可信内容，并在未来会话中诱导支付、设置变更或数据外泄等高后果动作。作者指出基于内容检测、信任打分或 lineage 的现有防御都可被“摘要洗白、可信工具回声、伪造佐证”绕过，因此提出不可篡改、绑定来源的 authority 模型，并给出机器检查的分离定理。
Summary (English)
LLM agents increasingly rely on persistent long-term memory, which creates a critical vulnerability that we study here: memory poisoning. An adversary can store untrusted content in one session that later steers a consequential action, such as a payment, a setting change, or data exfiltration, in a future session. Existing defenses base a memory item's authority to act on either its content (detection or trust-scoring) or its derivation history (lineage). We show that both signals are malleable. An attacker can launder an untrusted origin through three channels specific to LLM agents: the agent's own summarization, a trusted-tool echo, and manufactured corroboration. Each makes the content look benign and breaks or flips its derivation edge to ``trusted.'' We formalize malleability for the memory write-retrieve-act pipeline and prove a machine-checked separation theorem. No content- or lineage-based defense is sound under laundering (T1), write-time origin binding is necessary (T2), and non-malleable origin-bound authority with Sybil-resistant corroboration-gated elevation is sufficient (T3). Our construction, TMA-NM (Tamper-evident Memory Authority, Non-Malleable), instantiates non-malleable information-flow control (IFC) for LLM-agent memory. A cross-defense, cross-attack, and cross-model benchmark over eight frontier models shows that existing defenses fail exactly where the theory predicts (up to 68% laundering attack-success), while TMA-NM reaches 0% attack success on both direct and laundering attacks across all models and channels, at full legitimate utility. We release the benchmark, harness, and machine-checked TLA+ models to support reproducibility.
One-liner
长期记忆需要来源绑定和权限边界，而不能只靠内容看起来可信。
原文 / 元数据抓取
Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees
作者: Yedidel Louck
原文链接: https://arxiv.org/abs/2606.24322
PDF: https://arxiv.org/pdf/2606.24322v1
发布时间: 2026-06-23
更新时间: 2026-06-23
分类: cs.CR
LLM agents increasingly rely on persistent long-term memory, which creates a critical vulnerability that we study here: memory poisoning. An adversary can store untrusted content in one session that later steers a consequential action, such as a payment, a setting change, or data exfiltration, in a future session. Existing defenses base a memory item's authority to act on either its content (detection or trust-scoring) or its derivation history (lineage). We show that both signals are malleable. An attacker can launder an untrusted origin through three channels specific to LLM agents: the agent's own summarization, a trusted-tool echo, and manufactured corroboration. Each makes the content look benign and breaks or flips its derivation edge to ``trusted.'' We formalize malleability for the memory write-retrieve-act pipeline and prove a machine-checked separation theorem. No content- or lineage-based defense is sound under laundering (T1), write-time origin binding is necessary (T2), and non-malleable origin-bound authority with Sybil-resistant corroboration-gated elevation is sufficient (T3). Our construction, TMA-NM (Tamper-evident Memory Authority, Non-Malleable), instantiates non-malleable information-flow control (IFC) for LLM-agent memory. A cross-defense, cross-attack, and cross-model benchmark over eight frontier models shows that existing defenses fail exactly where the theory predicts (up to 68% laundering attack-success), while TMA-NM reaches 0% attack success on both direct and laundering attacks across all models and channels, at full legitimate utility. We release the benchmark, harness, and machine-checked TLA+ models to support reproducibility.
Obsidian intake evidence excerpt
该内容文件由 AAIF content-fetcher 根据 active/high-score entry 与 OpenCLI arXiv 元数据补齐。
- entry_id: 75e1c4aa
- title: Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees
- source: https://arxiv.org/abs/2606.24322
- existing_summary_zh: 论文研究 LLM agent 长期记忆的投毒风险，并提出 non-malleableorigin-bound authority 等约束来保护记忆来源与权限边界，包含机器检查保证收录理由：长期记忆是生产级智能体的核心能力，此文把安全边界和权限模型具体化，值得作为 agent memory 安全参考