AuthorsCiyan Ouyang, Rui Hou
TL;DR
MemLineage attaches cryptographic provenance plus a weighted derivation DAG to every memory entry, and is the only defence cell in the harness that drives all three memory-poisoning attack columns to 0 ASR with sub-millisecond overhead.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Untrusted content can be written into persistent agent state and later re-enter sessions as instruction, and signature-only layers cannot recover what an entry was derived from.
A patient adversary can plant ingredients in External sources, let the agent’s normal summarisation produce an authentic derived entry, and later trigger a sensitive action justified entirely by laundered memory.
HOW IT WORKS
MemLineage combines Provenance metadata, Ed25519 signature binding, an RFC 6962 Merkle log, a weighted lineage DAG, verifier-aware retrieval, and a sensitive-action gate around one memory store.
Think of MemLineage as a supply-chain system for agent memory: every entry has a signed bill of materials and a dependency graph, not just a blob of text in a vector store.
This design lets MemLineage preserve benign recall while refusing only those sensitive tool calls whose justification descends along strong edges from External or Derived-Untrusted ancestors.
DIAGRAM
This diagram shows how an External plant is laundered through LLM-mediated derivation into an authentic agent-written entry and then blocked by MemLineage’s lineage gate.
DIAGRAM
This diagram shows how the deterministic harness runs three attack families against three defence profiles and records ASR and τ × K ablations.
PROCESS
Plant phase
MemLineage ingests an External entry e0 through Provenance metadata and Ed25519 signing, marking it as trust level External in the memory store.
Derivation chain
As the agent summarises e0 into e1...eK, MemLineage’s lineage DAG records edges with attribution weights and propagates trust using the max-of-strong-edges rule.
Trigger session
A later query retrieves eK via verifier-aware retrieval, which verifies signatures, checks the Merkle log, and attaches the Derived-Untrusted label.
Sensitive-action gate
MemLineage’s sensitive-action gate inspects justification memories, detects Derived-Untrusted ancestry, and denies or repairs tool calls into Tsens according to authority rules.
KEY CONTRIBUTIONS
Lineage-stress memory-laundering workload
MemLineage introduces a three-stage sleeper-via-derivation workload that operationalises untrusted content transformed into authentic agent-written entries and separates signature-only, coarse-taint, and lineage-aware defences.
Six-module MemLineage design
MemLineage defines six modules around one memory store and proves an Untrusted-Path Persistence theorem using a max-of-strong-edges propagation rule over a weighted derivation DAG.
Attribution algorithms and reproducible harness
MemLineage evaluates Coarse, LM-self-eval, and white-box attention attribution, quantifies τ × K trade-offs, and ships a CI-verified deterministic harness plus a Codex-backed AgentDojo bridge.
RESULTS
ASR AgentPoison style
0.00
-1.00 vs no_defense (1.00 ASR)
ASR MemoryGraft style
0.00
-1.00 vs no_defense (1.00 ASR)
ASR Sleeper derivation
0.00
-1.00 vs sig_only_baseline (1.00 ASR)
Verify hot path latency
sub-millisecond
well below any LLM call noise floor
On the deterministic harness’s three attack families, MemLineage is the only defence profile that achieves 0.00 ASR across all columns, while per-operation overhead for verification and logging remains under one millisecond, keeping the defence invisible compared to LLM latency.
BENCHMARK
On the deterministic harness’s three attack families, MemLineage is the only defence profile that achieves 0.00 ASR across all columns, while per-operation overhead for verification and logging remains under one millisecond, keeping the defence invisible compared to LLM latency.
BENCHMARK
ASR on the deterministic harness for AgentPoison-style, MemoryGraft-style, and sleeper-via-derivation attacks.
KEY INSIGHT
Under a degrading LM-self-eval judge schedule w0 = 0.9 and d = 0.7, the safe lineage threshold τ shrinks as chain length K grows.
A deployment that looks safe at τ ≤ 0.30 for K = 1 actually needs τ ≤ 0.10 when allowing K = 5 hops, reversing the intuition that higher τ is always safer.
WHY IT MATTERS
MemLineage shows that LLM agents can keep rich cross-session memory while still enforcing chain-of-custody constraints on sensitive actions.
Builders can now treat agent memory like a verifiable supply chain, combining cryptographic provenance, derivation lineage, and policy-aware gating instead of relying on coarse recall removal or brittle signature-only checks.
Peilin Feng, Suorong Yang, Soujanya Poria
arXiv 2026 · 2026
Σ-Mem maintains historical competence evidence matrices M_p, a peer relationship matrix G, a memory readout r_{p,t}, and residual steering δ_{p,t} to guide multi-agent trust decisions. On the mixed counterfactual benchmark, Σ-Mem raises Qwen3-0.6B accuracy at CF@90 from 46.22% with the base model to 71.10% with Σ w/ G.
Nikhil Verma
· 2026
Focus Agent adds start_focus, complete_focus, a persistent Knowledge block, and an optimized Persistent Bash plus String-Replace Editor scaffold to actively compress context during long software-engineering tasks. On five hard SWE-bench Lite instances against a Baseline ReAct agent, Focus Agent achieves 22.7% token reduction (14.9M → 11.5M) while matching 3/5 = 60% task success.
Xiaohui Zhang, Zequn Sun et al.
· 2026
ActMem transforms dialogue history into atomic facts via Memory Fact Extraction, groups them with Fact Clustering, links them through a Memory KG Construction module, and uses Counterfactual-based Retrieval and Reasoning for action-aware answers. On ActMemEval, ActMem reaches 76.52% QA accuracy with DeepSeek-V3, beating LightMem’s 63.97% by 12.55 points and NaiveRAG’s 61.54%.
Answers use this explainer on Memory Papers.
Checking…