Forensic Trajectory Signatures for Agent Memory Poisoning Detection

Abstract

We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit. Under the evaluated architecture, this invariant follows from the attack's information-retrieval dependency rather than being merely an empirical correlation, and suppressing it

Categories

Framework mappings

Suggested from the entry's categories.

@misc{leong2026forensic,
  title = {{Forensic Trajectory Signatures for Agent Memory Poisoning Detection}},
  author = {Jun Wen Leong},
  year = {2026},
  month = jun,
  eprint = {2606.30566},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.30566}
}