MemLineage: Lineage-Guided Enforcement for LLM Agent Memory

Abstract: We introduce MemLineage, a defense for LLM agent memory that attaches both cryptographic provenance and LLM-mediated derivation lineage to every entry. Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction; the remaining systems question is how to preserve useful memory recall while preventing such state from justifying sensitive actions. MemLineage treats this as a chain-of-custody problem rather than a filtering problem. It is a six-module design around an RFC-6962 Merkle log over per-principal Ed25519-signed entries: a weighted derivation DAG records which retrieved entries influenced each new memory, and a max-of-strong-edges propagation rule makes Untrusted-Path Persistence hold for any chain whose attribution edges remain above threshold. The sensitive-action gate then refuses dispatches whose active justification descends from an external ancestor, while still allowing benign recall. We evaluate three defense cells against three memory-poisoning workloads on a deterministic mechanism-isolation harness; MemLineage is the only configuration in that harness that drives all three columns to zero ASR, while sub-millisecond per-operation overhead keeps it well below the noise floor of any LLM call. A Codex-backed AgentDojo bridge further separates strong-model behavior from defense-layer behavior: under an intentionally vulnerable tool-output profile, no-defense and signature-only baselines fail on all six banking pairs, while all MemLineage rows reduce strict AgentDojo ASR to zero. The core deterministic artifacts are byte-equal CI-verified; hosted-model AgentDojo and live-model sweeps are recorded as auditable logs rather than byte-pinned artifacts.

• The paper introduces MemLineage, a cryptographic framework that records provenance, signatures, Merkle-log history, and weighted derivation lineage to prevent untrusted memory from authorizing sensitive actions.
• The paper reports zero attack success across AgentPoison-style, MemoryGraft-style, and lineage-stress workloads, while adding only 214 microseconds to writes and 82 microseconds to verification.
• The paper shows that lineage enforcement can preserve benign utility, but its soundness depends on attribution recall, threshold calibration over chain depth, and addressing the fail-open behavior when strong parent edges are missing.

Problem and motivation

LLM agents accumulate persistent memory across sessions — chat logs, ingested documents, tool returns, and self-derived observations. This store is both the agent's capability substrate and an attack surface: published memory-poisoning attacks (AgentPoison, MINJA, MemoryGraft) and the concurrent Zombie Agents line establish that attacker-controlled content can be written through legitimate update paths and later re-enter a different session as instruction. The paper frames the resulting systems problem as chain of custody rather than filtering: how to preserve useful recall while preventing untrusted memory ancestry from authorising sensitive actions.

The hard case is laundering. A patient adversary plants ingredients in untrusted sources; the agent's normal retrieval-and-summarise loop emits a fresh derived entry committed under the agent's own writer principal. That entry is cryptographically authentic, indistinguishable from a benign summary. Existing defences each miss part of this: signature-only layers verify who wrote but not what was derived from; IFC planners such as Fides enforce labels at planning time but do not persist them across the LLM derivation step; retrieval-stage filters cannot distinguish a benign summary from a laundered payload arriving under an authentic principal; coarse controls (Memory Sandbox-style recall removal, RTW-A capability attenuation) are effective but sacrifice fine-grained utility.

Design

MemLineage attaches cryptographic provenance and derivation lineage to every memory entry via six modules around one store: (M1) canonical CBOR provenance metadata recording writer principal, source/context hashes, trust level, and parent-edge list; (M2) per-principal Ed25519 signatures; (M3) an RFC 6962 Merkle log with tombstone-only deletion; (M4) a weighted lineage DAG with a trust-propagation rule; (M5) verifier-aware retrieval rendering signed trust labels into the prompt; (M6) a Progent-compatible sensitive-action gate.

The core mechanism is the max-of-strong-edges propagation rule: an entry's trust is the maximum over parents whose attribution weight exceeds threshold $\tau$, so any path from an External ancestor whose every edge remains strong forces the tip to inherit Derived-Untrusted. The paper proves Untrusted-Path Persistence by induction on chain length. Three attribution algorithms instantiate edge weights: Coarse (constant weight 1.0 for anything in the retrieval context), LmSelfEval (a hardened secondary-LLM judge), and AttnAttr (white-box attention readout). M6 offers five verdicts — Allow, Deny, Require-User, Strip-and-Retry, and Repair-and-Retry, the last rewriting attacker-sourced parameters only when trusted authority evidence supplies replacements.

The soundness guarantee is explicitly conditional: it holds only when attribution recall $r_K$ keeps every critical-path edge above $\tau$. The no-strong-parent fallback returns Trusted when no edge exceeds $\tau$ — a fail-open default whose adversarial consequences the paper confronts directly in its adaptive analysis.

Evaluation

The headline results come from a deterministic mechanism-isolation harness that pins attacker behaviour and replaces LLM judgement with scripted schedules, yielding byte-equal CI-verified artifacts with zero measurement variance (validated by a 1000-rerun stress test).

Attack success rate. On three workloads — AgentPoison-style trigger backdoors, MemoryGraft-style oracle-retrieval poisoning, and the paper's lineage-stress sleeper-via-derivation workload — no_defence fails all three (ASR 1.00); the signature-only baseline closes only AgentPoison-style (0.00 / 1.00 / 1.00); MemLineage drives all three columns to 0.00. The two-session RAG-to-memory workflow reproduces the same separation: the signature-only baseline admits a summary authentically written by the user principal after the External document has left scope, while MemLineage preserves the untrusted parent edge across sessions.

Threshold–depth interaction. Under a degrading judge schedule ($w_0 = 0.9$, $d = 0.7$), the safe $\tau$ ceiling shrinks with chain depth because the deepest edge $w_K = 0.9 \cdot 0.7^{K-1}$ sets the binding constraint: a deployment allowing $K=5$ hops needs $\tau \le 0.10$, not the $r_K$0 a single-hop measurement would suggest. Calibration must be joint over $r_K$1 and expected chain depth, and counterintuitively, higher $r_K$2 weakens propagation.

Performance. Per-operation overhead is sub-millisecond: full write path 214 µs, verify path 82 µs, lineage propagation and policy gate near 1 µs — far below LLM-call noise floors. Merkle proof generation grows logarithmically and is unbatched (299 µs at $r_K$3).

Utility. All twelve benign-workflow cells reach 1.00 legitimate-dispatch rate — zero false positives on the deterministic harness. Against harness-level coarse profiles, MemLineage matches Memory-Sandbox-style blocking on all three attacks while retaining all four benign workflows, where recall removal retains none. In mixed-context sensitive turns, coarse context taint recovers 0/13 benign actions while parameter-level authority blocks all 13 attacker values and recovers 9/13.

External validity. A Codex-backed AgentDojo bridge anchors the results on a public benchmark: under the conservative DirectAttack profile, baselines satisfy the attacker goal on 1/6 banking pairs; under an intentionally vulnerable tool-output profile, both no-defence baselines reach 6/6 strict ASR while all MemLineage rows hold 0/6. Authority repair achieves the best trade-off there (5/6 utility, 0.33 denied calls per row versus 5.17 for strip-and-retry). Notably, the paper reports that gpt-5.3-codex produced an all-zero ASR table even without defence under benign queries — an artifact of modern instruction-hierarchy safety, not defence efficacy — and uses the task-relevant injection result to show the same model is exploitable when the payload is relevant to the task.

Limitations and open questions

The paper is candid about boundaries. Soundness depends on attribution recall $r_K$4, which is measured but not bounded theoretically; establishing lower bounds under stated paraphrase distributions is left open. The no-strong-parent fallback fail-opens against adversaries who suppress attribution edges (e.g., by prompt-injecting the judge); JSON-envelope hardening narrows but does not eliminate this, and strict-mode mitigations trade utility — parentless-deny blocks the benign direct workflow entirely. AttnAttr requires open-weight inference unavailable in most production deployments, and its ablation is deferred. Adaptive querying (threat-model capability 5) is not exercised in headline numbers; only three mechanism-level laundering boundaries (parent omission, edge dilution, semantic decay) plus strict mitigations are evaluated. The Merkle root is single-host; multi-host replication needs a consensus protocol that is sketched but not evaluated. Trusted LLM weights and host integrity are assumed throughout. Finally, the AgentDojo authority-repair rows rely on benchmark-side trusted-source hints rather than production connector labels — an integration gap the authors flag rather than resolve.

Conclusion

MemLineage reframes persistent-memory poisoning as a chain-of-custody enforcement problem and supplies the missing primitive: cryptographically bound, cross-session-persistent derivation lineage coupled to a sensitive-action gate with utility-preserving recovery. Its distinguishing claim is joint coverage of four dimensions — label integrity, derivation attribution, label persistence, and agent-derived-entry coverage — that prior systems cover only separately. The deterministic evaluation shows zero ASR across all modelled attacks at sub-millisecond cost with zero measured false positives, though the guarantee's dependence on attribution recall and the fail-open fallback remain the substantive open problems.