MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
Open accessAbstract
We introduce MemLineage, a defense for LLM agent memory that attaches both cryptographic provenance and LLM-mediated derivation lineage to every entry. Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction; the remaining systems question is how to preserve useful memory recall while preventing such state from justifying sensitive actions. MemLineage treats this as a chain-of-custody problem rather than a filtering problem. It is a six-module design around an RFC-6962 Merkle log over per-principal Ed25519-signed entries: a weighted derivation DAG records which retrieved entries influenced each new memory, and a max-of-strong-edges propagation rule makes Untrusted-Path Persistence hold for any chain whose attribution edges remain above threshold. The sensitive-action gate then refuses dispatches whose active justification descends from an external ancestor, while still allowing benign recall. We evaluate three defense cells against three memory-poisoning workloads on a deterministic mechanism-isolation harness; MemLineage is the only configuration in that harness that drives all three columns to zero ASR, while sub-millisecond per-operation overhead keeps it well below the noise floor of any LLM call. A Codex-backed AgentDojo bridge further separates strong-model behavior from defense-layer behavior: under an intentionally vulnerable tool-output profile, no-defense and signature-only baselines fail on all six banking pairs, while all MemLineage rows reduce strict AgentDojo ASR to zero. The core deterministic artifacts are byte-equal CI-verified; hosted-model AgentDojo and live-model sweeps are recorded as auditable logs rather than byte-pinned artifacts.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
MemLineage tracks provenance and gates sensitive actions, but it re-derives its verdict at dispatch and offers no path for legitimate untrusted information to ever act.
“The closest structural defense, MemLineage [14], tracks provenance and gates sensitive actions, but it re-derives its verdict at dispatch and offers no path for legitimate untrusted information to ever act.”
From Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees (2026) · cites this paper as [14]
Section 3 (Design) says MemLineage tracks provenance and lineage, and §3.7 says its gate checks active context when a sensitive tool call is emitted. But the paper describes trust labels attached during retrieval, not a verdict re-derived from scratch at dispatch. The claim that legitimate untrusted information has no path to act is also too broad: §6.5 allows it for non-sensitive answers, while §3.7 describes repair-and-retry for sensitive calls when trusted evidence supplies authorized parameters. (LLM, conf=0.85)
Experimental — accuracy not yet measuredProvenance labeling marks tool-derived memories as untrusted and discounts them during planning.
“Provenance labeling marks tool-derived memories as untrusted and discounts them during planning [22, 29].”
From Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents (2026) · cites this paper as [29]
Section 3.6 says retrieved memories carry trust labels into the agent’s context, and §3.7 says those labels govern whether sensitive tool calls can proceed. But §2.3 classifies returns from sandboxed or audited tools and entries derived from them as semi-trusted, not categorically untrusted. The paper describes gating sensitive actions, not discounting tool-derived memories during planning; no page numbers are available in our copy. (LLM, conf=0.88)
Experimental — accuracy not yet measuredExisting defenses base a memory item's authority to act on either its content or its derivation history (lineage).
“Existing defenses base a memory item's authority to act on either its content (detection or trust-scoring) or its derivation history (lineage).”
From Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees (2026) · cites this paper as [14]
MemLineage [14] persists an origin-derived label across sessions, but its derivation edge is the malleable object the laundering attack defeats, since its own LLM-judge attribution can be suppressed and then falls back to 'trusted,' and it has neither corroboration-gated elevation nor a machine-checked guarantee.
“MemLineage [14] persists an origin-derived label across sessions, but its derivation edge is the malleable object our laundering attack defeats, since its own LLM-judge attribution can be suppressed and then falls back to 'trusted,' and it has neither corroboration-gated elevation nor a machinechecked guarantee.”
From Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees (2026) · cites this paper as [14]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
Srivastava, S. S., & He, H. (2025) · arXiv · doi:10.48550/arxiv.2512.16962 · cited 7×
“The first two attacks correspond to published threat models [4, 14]; sleeper-via-derivation is derived from the persistent-memory pattern studied by Zombie Agents and concurrent delayed-trigger evaluations [18, 10], but is parameterised to stress the specific distinction between signature-only and…”
Influential
Flagged first, then by citations
Research works printed but not linked: 16
- Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. High-speed high-security signatures. Journal of Cryptographic Engineering, 2(2):77-89, 2012. Verified via DOI 10.1007/s13389- 012-0027-1. Originally CHES 2011; this is the journal- extended version. · DOI
- Yuxuan Cai, Wei Tang, Cheng Wen, and Shuo Qin. Ghost in the agent: Redefining information flow track- ing for LLM agents. arXiv preprint arXiv:2604.23374, 2026. Introduces the NeuroTaint system: the first comprehensive taint-tracking framework for LLM agents, with cross-session memory persistence and a TaintBench evaluation comparing against Fides. Verified via CT discrepancy-resolution round; arXiv 2604.23374 confirmed as the canonical reference under the system alias "NeuroTaint". · arXiv
- Zhaorun Chen, Zhen Xiang, Chaowei Xiao, and Dawn Song. AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases. arXiv preprint arXiv:2407.12784, 2024. Accepted at NeurIPS 2024; verified via arXiv 2407.12784. · arXiv
- Manuel Costa, Boris Köpf, Aashish Kolluri, An- drew Paverd, Mark Russinovich, Ahmed Salem, Shruti Tople, Lukas Wutschitz, and Santiago Zanella- Béguelin. Securing AI agents with information-flow control. arXiv preprint arXiv:2505.23643, 2025. Intro- duces Fides, an IFC-based agent planner that tracks confidentiality and integrity labels and determinis- tically enforces security policies. Verified via arXiv 2505.23643 (browser MCP, Scholar). Author list per arXiv abs page (9 authors). · arXiv
- Shen Dong, Shaochen Xu, Pengfei He, and Yige Li. Memory injection attacks on LLM agents via query- only interaction. arXiv preprint arXiv:2503.03704, 2025. Verified via arXiv 2503.03704. · arXiv
- Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. arXiv preprint arXiv:2302.12173, 2023. Accepted at AISec 2023 workshop (ACM CCS); verified via arXiv 2302.12173. Author list extended to commonly-cited 6-author form per arXiv record. · arXiv
- Zimo Ji, Xunguang Wang, Zongjie Li, Pingchuan Ma, Yudong Gao, Daoyuan Wu, Xincheng Yan, Tian Tian, and Shuai Wang. Taxonomy, evaluation and exploita- tion of IPI-centric LLM agent defense frameworks. arXiv preprint arXiv:2511.15203, 2025. Comprehen- sive SoK over 23 IPI-centric defense frameworks (5- dimension taxonomy); used as the canonical "land- scape of named defenses" reference. Verified via arXiv 2511.15203. · arXiv
- Jun Wen Leong. Defense effectiveness across archi- tectural layers: A mechanistic evaluation of persis- tent memory attacks on stateful LLM agents. arXiv preprint arXiv:2605.08442, 2026. Concurrent May 2026 preprint evaluating persistent-memory attack defenses across architectural layers; verified via arXiv 2605.08442v1. · arXiv
- Pankayaraj Pathmanathan, Michael-Andrei Panaitescu-Liess, Cho-Yu Jason Chiang, and Furong Huang. RAGPart & RAGMask: Retrieval-stage de- fenses against corpus poisoning in retrieval-augmented generation. arXiv preprint arXiv:2512.24268, 2025. · arXiv
- Dongdong She, Yizheng Chen, Baishakhi Ray, and Suman Jana. Neutaint: Efficient dynamic taint analy- sis with neural networks. In 2020 IEEE Symposium on Security and Privacy (S&P), 2020. Verified via DOI 10.1109/SP40000.2020.00022 and arXiv 1907.03756. NOTE: this is "Neutaint" not "NeuroTaint" -update prose accordingly. · DOI
- Tianneng Shi, Jingxuan He, Zhun Wang, and Linyu Wu. Progent: Programmable privilege control for LLM agents. arXiv preprint arXiv:2504.11703, 2025. Verified via arXiv 2504.11703. · arXiv
- Mahzabin Tamanna, Sivana Hamer, Mindy Tran, and Sascha Fahl. Analyzing challenges in deployment of the SLSA framework for software supply chain secu- rity. arXiv preprint arXiv:2409.05014, 2024. Verified via arXiv 2409.05014. Used as the best published refer- ence to SLSA when a paper-style citation is required; the framework itself is documented at slsa.dev. · arXiv
- Santiago Torres-Arias, Hammad Afzali, Tris- hank Karthik Kuppusamy, Reza Curtmola, and Justin Cappos. in-toto: Providing farm-to-table guaran- tees for bits and bytes. In 28th USENIX Security Symposium (USENIX Security 19), pages 1393-1410. USENIX Association, 2019. Verified via USENIX page; ACM DL DOI 10.5555/3361338.3361435. Page numbers are conservative (USENIX 2019 proceedings range). · DOI
- Qianshan Wei, Tengchao Yang, Yaochen Wang, Xin- feng Li, Lijun Li, Zhenfei Yin, Yi Zhan, Thorsten Holz, Zhiqiang Lin, and XiaoFeng Wang. A-MemGuard: A proactive defense framework for LLM-based agent memory. arXiv preprint arXiv:2510.02373, 2025. Ver- ified via arXiv 2510.02373v1. · arXiv
- Xianglin Yang, Yufei He, Shuo Ji, Bryan Hooi, and Jin Song Dong. Zombie agents: Persistent control of self-evolving LLM agents via self-reinforcing injections. arXiv preprint arXiv:2602.15654, 2026. Published as a workshop paper in Lifelong Agent @ ICLR 2026; verified via arXiv 2602.15654v2. · arXiv
- Mingming Zha and Xiaofeng Wang. Autonomous LLM agent worms: Cross-platform propagation, auto- mated discovery and temporal re-entry defense. arXiv preprint arXiv:2605.02812, 2026. Concurrent May 2026 preprint introducing file-backed agent-worm anal- ysis and the RTW-A temporal re-entry defense; veri- fied via arXiv 2605.02812v1. · arXiv
Cited by
Sorted by citations
Louck, Y. (2026) · arXiv · doi:10.48550/arxiv.2606.24322
“We do not claim origin-tagging or cross-session enforcement themselves, since prior systems already provide these (for example, MemLineage [14]).”
InfluentialTransferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents
Zang, C., Wang, J., Chen, W., Meng, X., Wang, L., Gao, X., Li, Z., & Guo, S. (2026) · arXiv
- Authors
- Ouyang, C., & Hou, R.
- Affiliations
- Institute of Information Engineering (CN)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2605.14421
- OpenAlex
- W7161300865
- Cited by
- 0
- References
- 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Keywords
- memory poisoning, cryptographic provenance, Ed25519 signing, agent security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
