AuthorsAyan Roy, Kaustuvi Basu
TL;DR
MemSentry uses a security-state projection and blast-radius model to gate persistent memory writes, with SBERT+LR reaching 91.7% accuracy and 0.908 macro-F1.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Persistent memory poisoning lets adversarial content be stored in long-term memory and then influence future agent behavior without further interaction.
In autonomous SOC or email agents, poisoned memories can suppress alerts, override policies, or alter trust relationships, degrading security posture without changing model weights.
HOW IT WORKS
MemSentry uses a 9-step pipeline combining Source Trust, Semantic Classification, Attack Radius, Access Risk, and Security State Projection to score each memory write.
You can think of MemSentry like a firewall plus change-management system for agent memory, checking provenance and impact before anything is written to disk.
This lets MemSentry estimate how a write changes security posture and blast radius, enabling deterministic Accept, Review, or Quarantine decisions that a plain context window cannot provide.
DIAGRAM
This diagram shows how MemSentry routes a candidate memory operation to Accept, Review, or Quarantine using trust, risk, and policy rules.
DIAGRAM
This diagram shows how MemSentry evaluates scenarios over a 20-asset dependency DAG and a 10×20 access-control matrix with different semantic classifiers.
PROCESS
Step 1 Source Trust
MemSentry computes T(source) from origin, identity verification, and channel integrity, classifying sources as external unverified, external verified, internal unverified, or internal verified.
Step 2 Semantic Classification
MemSentry maps the operation to a semantic category and risk score rsem using pluggable classifiers like Regex, TF-IDF+SVM, SBERT+LR, or SetFit.
Step 3 Attack Radius and Access Risk
MemSentry traverses the 20-asset dependency DAG to compute attack radius AR and uses the 10×20 access-control matrix to derive Raccess over affected components.
Step 4 Security State Projection and Decision Rules
MemSentry projects the new security posture via π(Si+1), computes δ(O) and R, then applies deterministic rules to Accept, Review, or Quarantine the memory write.
KEY CONTRIBUTIONS
Structured Pre Admission Evaluation Pipeline
MemSentry introduces a 9-step pre-admission pipeline that evaluates provenance, semantic risk, attack radius, and access risk before committing persistent memory writes.
Security State Projection and Blast Radius Model
MemSentry defines a criticality-weighted security-state projection over a 20-asset dependency DAG, computing δ(O) and AR to estimate downstream impact before writes.
Counterfactual Impact Evaluation Framework
MemSentry adds a counterfactual impact-evaluation framework that compares executions with and without a candidate memory to validate blast-radius predictions over components.
RESULTS
Accuracy
91.7%
+3.7 percentage points over TF-IDF+SVM
Macro F1
0.908
vs TF-IDF+SVM macro-F1 0.866
Quarantine Detection
100%
all four methods detect 100% external quarantine class threats
Review Accuracy
72.2%
SBERT+LR review class accuracy vs SetFit 22.2%
On a 1,000-scenario GPT-4 dataset with a 70/30 split, MemSentry evaluates semantic methods for Step 2 classification. SBERT+LR’s 91.7% accuracy and 0.908 macro-F1 show that MemSentry can reliably distinguish Accept, Review, and Quarantine cases, especially in the ambiguous review class.
BENCHMARK
On a 1,000-scenario GPT-4 dataset with a 70/30 split, MemSentry evaluates semantic methods for Step 2 classification. SBERT+LR’s 91.7% accuracy and 0.908 macro-F1 show that MemSentry can reliably distinguish Accept, Review, and Quarantine cases, especially in the ambiguous review class.
BENCHMARK
Accuracy comparison of semantic classifiers used inside MemSentry.
KEY INSIGHT
MemSentry never auto quarantines verified insider operations, yielding 0% quarantine accuracy in the insider authorization sweep by design.
This is surprising because you might expect high risk scores to force quarantine, but MemSentry’s (1 − T) scaling and policy deliberately fail to review for trusted insiders.
WHY IT MATTERS
MemSentry gives builders a configurable, auditable gate on persistent memory, tying each write to quantified security impact and deterministic decisions.
With MemSentry, developers can deploy agentic systems that keep rich long term memory while systematically containing poisoning attacks, especially from external channels.
Guilin Zhang, Wei Jiang et al.
· 2026
A-MAC scores candidate memories using Utility, Confidence, Novelty, Recency, and Type Prior combined by a learned linear admission policy with Algorithm 1 A-MAC Memory Admission. On the LoCoMo benchmark, A-MAC achieves F1 0.583 and 2644 ms latency, improving F1 by 0.042 and reducing latency by 1187 ms compared to A-mem.
Robbyant Team, Zelin Gao et al.
arXiv 2026 · 2026
LingBot-World combines a Data Engine, Fundamental World Model, Action-Conditioned World Model, and Post-Training causal adaptation to turn a 28B-parameter video generator into a real-time interactive world simulator. On the VBench benchmark, LingBot-World achieves a dynamic degree of 0.8857 versus 0.7612 for Yume-1.5, while also improving imaging quality to 0.6683.
Manoj Madushanka Perera, Adnan Mahmood et al.
· 2026
AgenticAI-DialogGen chains ChatPreprocessor, KnowledgeExtractor, TopicAnalyzer, KnowledgeGraphBuilder, PersonaGenerator, DuelingChat Agent, ConversationValidator, ConversationRefiner, QAGeneration, and PostProcessing to turn raw multi-session chats into topic-guided, persona-grounded conversations with explicit short- and long-term memories. On the TGC / KG memory QA benchmark, Mistral-7B fine-tuned within AgenticAI-DialogGen achieves 87.36 F1, compared to GPT-4’s 83.77 F1 in a zero-shot setting on the same task.
Answers use this explainer on Memory Papers.
Checking…