Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees
Yedidel Louck
Abstract
An agent based on a large language model (LLM) may store an untrusted document
and use it weeks later to select a payment destination. Preventing this action
requires evidence of authorization that remains valid when stored text changes.
We study a policy that requires either endorsements (explicit approvals) from
two separately administered sources or explicit user authorization. In an
abstract memory model, we prove the policy is preserved under permitted
transformations for stores of any size, assuming correct source and authority
binding, protected records, and checks on every consequential action. We
evaluate the executable monitor, which checks calls before execution,
separately from the proof.
In 1,152 controlled tool-use episodes, GPT-4o-mini executes attacker-selected
actions in 61 of 72 undefended episodes and none of the 72 monitored episodes.
Clean-task completion remains 24 of 24 when both endorsers are available. A
separate 1,728-episode experiment tests recovery after denial. Returning to
signed records instead of rereading a contaminated note raises attacked-task
completion from 14/72 to 72/72 for GPT-4o-mini and from 22/72 to 43/72 for
Gemini 2.5 Flash, without executing an attacker-selected action. Neither model
completes transactions with fewer than two sources. Whole-action tests reject
unauthorized combinations of individually approved fields.
Extraction probes identify mistaken approvals, and fault analysis shows how
shared failures can negate a second domain's benefit. Calibrations using
original defense implementations reveal security and task-completion tradeoffs
under different policies. These results support conditional enforcement and
recovery in constructed workflows, but do not establish that endorsements will
be available or correct in deployment.