Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

2026-07-31

AI Summary

This work addresses a critical security vulnerability in large language model (LLM) agents, where untrusted external inputs can be disguised as high-authority user history within long-term memory, leading to improper authorization of high-risk actions. To mitigate this, the authors propose PPMF, a lightweight memory middleware that preserves platform-maintained provenance metadata during memory compression and formally introduces the notion of a “provenance non-amplification bound” to prevent untrusted content from being “laundered” through memory integration. PPMF enables dynamic, runtime access control by combining provenance tracking, risk labeling, and structured memory representations based on action risk and memory authority. Experimental results demonstrate that under a fixed risk policy, PPMF completely blocks all unauthorized high-risk operations—reducing attack success rates to 0%—while preserving full functionality for benign and low-risk memory usage.

Abstract

Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context. We identify memory provenance laundering: during LLM-based memory consolidation, an external observation may be rewritten as apparent user history or workflow support, preserving an action trigger while erasing the low-trust source that should limit its authority. Existing prompt filters, content sanitizers, and tool guards do not enforce source-authority non-amplification after lossy memory consolidation. We formalize this boundary and instantiate it as Provenance-Preserving Memory Fire wall (PPMF), a lightweight memory middleware that preserves platform-maintained provenance and authorizes tool calls by matching action risk to the authority of action-relevant memories. In our schema-grounded evaluation with fixed risk policies, vulnerable consolidated memories reach up to 1.000 attack success rate(ASR); with intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate while confirmed benign actions and targeted low-risk memory use remain executable.

Problem

• memory provenance laundering
• LLM agents
• persistent memory
• source-authority non-amplification
• trust boundary

Innovation

• memory provenance laundering
• non-amplification firewall
• provenance-preserving memory
• LLM agents
• source-authority enforcement