MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
Ciyan Ouyang, Rui Hou
Why It Matters
What makes this one worth your time
As LLMs become more integrated into critical applications, ensuring the integrity of their memory and preventing malicious influences is crucial for safety and reliability.
MemLineage offers a novel approach to secure LLM agent memory through lineage tracking and cryptographic provenance.
Summary
The paper presents MemLineage, a defense mechanism for LLM agent memory that incorporates cryptographic provenance and lineage tracking to prevent untrusted content from influencing agent actions while allowing useful memory recall.
Key contributions
- Introduction of a six-module design incorporating cryptographic provenance and lineage tracking for LLM memory.
- Development of a max-of-strong-edges propagation rule to maintain memory integrity.
- Empirical evaluation demonstrating MemLineage's effectiveness against memory-poisoning attacks.
Notable insights
- MemLineage treats memory integrity as a chain-of-custody problem, which is a novel perspective compared to traditional filtering approaches.
- The use of a weighted derivation DAG to track influences on memory entries is an innovative method that could enhance the robustness of memory systems.
Possible limitations
- Not stated in the abstract.
Abstract
arXiv:2605.14421v1 Announce Type: cross Abstract: We introduce MemLineage, a defense for LLM agent memory that attaches both cryptographic provenance and LLM-mediated derivation lineage to every entry. Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction; the remaining systems question is how to preserve useful memory recall while preventing such state from justifying sensitive actions. MemLineage treats this as a chain-of-custody problem rather than a filtering problem. It is a six-module design around an RFC-6962 Merkle log over per-principal Ed25519-signed entries: a weighted derivation DAG records which retrieved entries influenced each new memory, and a max-of-strong-edges propagation rule makes Untrusted-Path Persistence hold for any chain whose attribution edges remain above threshold. The sensitive-action gate then refuses dispatches whose active justification descends from an external ancestor, while still allowing benign recall. We evaluate three defense cells against three memory-poisoning workloads on a deterministic mechanism-isolation harness; MemLineage is the only configuration in that harness that drives all three columns to zero ASR, while sub-millisecond per-operation overhead keeps it well below the noise floor of any LLM call. A Codex-backed AgentDojo bridge further separates strong-model behavior from defense-layer behavior: under an intentionally vulnerable tool-output profile, no-defense and signature-only baselines fail on all six banking pairs, while all MemLineage rows reduce strict AgentDojo ASR to zero. The core deterministic artifacts are byte-equal CI-verified; hosted-model AgentDojo and live-model sweeps are recorded as auditable logs rather than byte-pinned artifacts.