AuthorsArulnidhi Karunanidhi
TL;DR
Aegis uses provenance-weighted ranking plus staged write-path screening, yet 1.2% false-fact poison still cuts LongMemEval accuracy from 0.850 to 0.300.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Aegis shows that adding just 360 false assertions — 1.2% of the corpus — drops LongMemEval_S accuracy from 0.850 to 0.300.
This means a trusted assistant’s persistent memory can be durably corrupted, so future sessions repeatedly retrieve and act on wrong facts.
HOW IT WORKS
Aegis combines a four stage content screening pipeline, a trust level based provenance prior, and provenance weighted ranking over a semantic memory store.
Think of Aegis like a database with spam filters at write time and a ranking engine that prefers records from more trusted channels, not unlike a search engine boosting reputable sites.
This design lets Aegis defend at both write and read time, enabling utility under attack measurements that a plain context window or static RAG store cannot provide.
DIAGRAM
This diagram shows how Aegis processes writes and reads, and where false fact poison flows through screening into retrieval.
DIAGRAM
This diagram shows how Aegis is evaluated on LongMemEval_S, then poisoned and re-run under different provenance weights.
PROCESS
Staged content screening
Aegis runs the four stage content screening pipeline — input validation, sensitive data detection, injection rules, and optional LLM classification — on every write.
Trust level assignment
Aegis assigns each memory a trust level based on its channel, mapping untrusted, unknown, internal, privileged, and system to a fixed provenance prior τ(m).
Semantic retrieval
For each user question, Aegis performs semantic search over the memory store, over fetching candidates by cosine similarity to the query.
Provenance weighted ranking
Aegis re scores candidates using provenance weighted ranking, combining ws·sim(q,m) with wt·τ(m) and other terms before sending the top k memories to the reader.
KEY CONTRIBUTIONS
Utility under attack protocol for agent memory
Aegis introduces a utility under attack protocol by poisoning LongMemEval_S with 360 false memories (1.2% of the corpus) and measuring accuracy dropping from 0.850 to 0.300.
Boundary of write time content screening
Aegis shows its four stage content screening pipeline, which reaches 0.832 recall on indirect injection, refuses 0 of 360 false fact poisons, arguing falsity is structurally invisible to content only detectors.
Margin analysis of provenance weighted ranking
Aegis derives that at shipped weights wt=0.15 and ws=0.60, provenance can outbid similarity only within a 0.175 margin, explaining why the defense is statistically indistinguishable from no defense (p=0.80).
RESULTS
Accuracy clean corpus
0.850
baseline utility before poisoning on LongMemEval_S
Accuracy poisoned no defense
0.300
-0.550 vs clean corpus (35% utility retained)
Accuracy poisoned wt=0.15
0.317
+0.017 over no defense, p=0.80
Accuracy poisoned wt=0.35
0.475
+0.175 over no defense, p=0.0015
These results come from LongMemEval_S, a 500 question benchmark of conversational memory. They show that Aegis loses most of its utility under weak poisoning, and only a high provenance weight recovers accuracy at the cost of excluding untrusted evidence.
BENCHMARK
These results come from LongMemEval_S, a 500 question benchmark of conversational memory. They show that Aegis loses most of its utility under weak poisoning, and only a high provenance weight recovers accuracy at the cost of excluding untrusted evidence.
BENCHMARK
Accuracy of Aegis under different provenance configurations when 1.2% of the corpus is poisoned with false assertions.
BENCHMARK
Recall on InjecAgent indirect injection corpus for Aegis and baseline detectors.
KEY INSIGHT
Aegis’s shipped provenance weight wt=0.15, combined with ws=0.60, yields a similarity margin of only 0.175, so the defense is statistically indistinguishable from no defense (p=0.80).
This is counterintuitive because provenance weighting was expected to help, yet a simple three line derivation shows it cannot outbid a 0.32 similarity gain from query shaped poison.
WHY IT MATTERS
Aegis demonstrates that measuring utility retained under attack, not just attack success rate, reveals when an agent memory has become effectively useless even if attacks rarely fully succeed.
Builders can now design memory systems that treat provenance as a bounded occupancy constraint rather than an additive score, avoiding both blind trust in untrusted data and denial of service against valuable untrusted evidence.
Nikhil Verma
· 2026
Focus Agent adds start_focus, complete_focus, a persistent Knowledge block, and an optimized Persistent Bash plus String-Replace Editor scaffold to actively compress context during long software-engineering tasks. On five hard SWE-bench Lite instances against a Baseline ReAct agent, Focus Agent achieves 22.7% token reduction (14.9M → 11.5M) while matching 3/5 = 60% task success.
Xingyu Lyu, Jianfeng He et al.
· 2026
ADAM combines Anchor extraction, Distribution estimation, Anchor selection, and Query generation to adaptively probe agent memory via an auxiliary generator and entropy based selection. On the EHRAgent benchmark with Llama2-7b-chat, ADAM reaches EQ=77 and ASR=1.00, compared to MEXTRA’s EQ=44 and ASR=0.89.
Shannan Yan, Jingchen Ni et al.
· 2026
AdaMem organizes dialogue history into Working Memory, Episodic Memory, Persona Memory, and Graph Memory coordinated by a Memory Agent, Research Agent, and Working Agent. On LoCoMo with GPT-4.1-mini, AdaMem achieves 44.65 F1 overall, beating the best baseline LangMem at 41.76 F1 by +2.89.
Answers use this explainer on Memory Papers.
Checking…