Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees

Abstract

LLM agents increasingly rely on persistent long-term memory, which creates a critical vulnerability that we study here: memory poisoning. An adversary can store untrusted content in one session that later steers a consequential action, such as a payment, a setting change, or data exfiltration, in a future session. Existing defenses base a memory item's authority to act on either its content (detection or trust-scoring) or its derivation history (lineage). We show that both signals are malleable.

Categories

Framework mappings

Suggested from the entry's categories.

@misc{louck2026securing,
  title = {{Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees}},
  author = {Yedidel Louck},
  year = {2026},
  month = jun,
  eprint = {2606.24322},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.24322}
}