Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper investigates the vulnerability of long-term memory in LLM agents to memory poisoning attacks, where adversaries can manipulate stored content to influence future actions. The authors demonstrate that existing defenses based on content or lineage are ineffective against sophisticated laundering techniques that can disguise untrusted origins as benign. They introduce TMA-NM, a non-malleable information-flow control mechanism that binds memory writes to their origins, achieving zero attack success against both direct and laundering attacks while maintaining full legitimate utility across eight advanced models.
Memory poisoning in LLM agents can be completely thwarted with a novel non-malleable authority system that ensures zero successful attacks, even under sophisticated laundering tactics.
LLM agents increasingly rely on persistent long-term memory, which creates a critical vulnerability that we study here: memory poisoning. An adversary can store untrusted content in one session that later steers a consequential action, such as a payment, a setting change, or data exfiltration, in a future session. Existing defenses base a memory item's authority to act on either its content (detection or trust-scoring) or its derivation history (lineage). We show that both signals are malleable. An attacker can launder an untrusted origin through three channels specific to LLM agents: the agent's own summarization, a trusted-tool echo, and manufactured corroboration. Each makes the content look benign and breaks or flips its derivation edge to ``trusted.'' We formalize malleability for the memory write-retrieve-act pipeline and prove a machine-checked separation theorem. No content- or lineage-based defense is sound under laundering (T1), write-time origin binding is necessary (T2), and non-malleable origin-bound authority with Sybil-resistant corroboration-gated elevation is sufficient (T3). Our construction, TMA-NM (Tamper-evident Memory Authority, Non-Malleable), instantiates non-malleable information-flow control (IFC) for LLM-agent memory. A cross-defense, cross-attack, and cross-model benchmark over eight frontier models shows that existing defenses fail exactly where the theory predicts (up to 68% laundering attack-success), while TMA-NM reaches 0% attack success on both direct and laundering attacks across all models and channels, at full legitimate utility. We release the benchmark, harness, and machine-checked TLA+ models to support reproducibility.