---
title: "Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05029v1"
permalink: "https://feed.astralor.com/items/itm_f0f161a88c25f24fb4846fc0"
published: "2026-07-06T13:10:13.000Z"
score: 81
channel: "ai"
tags: ["FARMA Attack","LLM Agent Safety","SENTINEL","Reasoning Guard"]
---

# Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses

## AI commentary

> This paper made me realize that we must not only focus on data poisoning in AI agents, but also on the more insidious 'reasoning memory contamination'. It is especially important for AI security researchers and LLM application developers, reminding us that every layer of the memory system can be a potential breach point.

## At a glance

This paper introduces FARMA, a novel attack targeting the persistent memory of LLM agents. It implants forged reasoning traces (rather than factual knowledge) to manipulate agent behavior and employs self-referential reinforcement to evade consensus-based defenses. The proposed defense framework SENTINEL includes a Reasoning Guard that detects forged reasoning entries via five weighted signals. Experiments show FARMA achieves up to 100% attack success rate under baseline conditions, while SENTINEL reduces it to 0% with zero false positives. The work underscores the need to protect the integrity of an agent's reasoning history.

## Key points

- FARMA focuses on poisoning the agent's reasoning history rather than factual knowledge
- It uses evasive language and self-referential reinforcement to bypass existing defenses
- SENTINEL defense framework uses Reasoning Guard for structural detection
- Experiments show SENTINEL reduces attack success rate to 0% with no false positives

## Full text

Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context. While this has improved the agent's functionality and continuity across tasks, it has also introduced a new attack surface: the agent's own reasoning history. In this paper, we introduce the Forged Amplifying Rationale Memory Attack (FARMA), which poisons an agent's remembered reasoning rather than its factual knowledge. It inserts forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses. To address FARMA, we introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries. Its central component is the Reasoning Guard that structurally analyzes candidate entries for forgery using five weighted signals. We evaluate FARMA and SENTINEL across multiple agents and different LLM models with 50 trials and show that FARMA achieves an attack success rate of up to 100% under baseline conditions and is capable of defeating defense mechanisms like keyword filter and A-MemGuard. Our evaluation also shows that SENTINEL reduces FARMA's attack success rate to as low as 0% with no false positives observed across 326 benign agent traces. Our work demonstrates the need to protect not only an agent's retrieved content but also the integrity of its reasoning history.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_f0f161a88c25f24fb4846fc0