Forensic Trajectory Signatures for Agent Memory Poisoning Detection
Score
58Why selected
Proposes a novel behavioral invariant detection method with thorough experiments (multi-model validation, high AUC, real-time feasibility) and practical application prospects, making a strong contribution to AI security.
AI commentary
「This work provides a robust method for detecting LLM agent memory poisoning attacks without requiring internal model access, and can differentiate attack types, offering significant practical value for agent security defense.」
Quick overview
This paper discovers a behavioral invariant in LLM agents under persistent memory poisoning: successful attacks require calling memory_recall_fact before email_send_email, a transition rarely seen in non-exfiltrating sessions. A simple rule based on this invariant achieves AUC=0.9563. A Random Forest classifier over 19 trajectory features refines it to AUC=0.9904. Cross-model hold-out on 9 models (7B-120B) confirms AUC=1.000 on 6/9 splits, and generalizes to frontier models (GPT-4.1, GPT-4o) without retraining. A prefix-only variant achieves AUC=0.934, enabling real-time blocking. Prompt injection attacks yield distinct trajectories (score=0.541), enabling differentiation of attack types from tool-call logs alone.
- A behavioral invariant in LLM agents under memory poisoning: memory_recall_fact must precede email_send_email for successful attacks.
- Simple rule based on invariant achieves AUC=0.9563; Random Forest model reaches AUC=0.9904.
- Cross-model validation on 9 models shows AUC=1.000 on 6/9 splits; generalizes to GPT-4.1/4o without retraining.
- Prefix-only variant achieves AUC=0.934 for real-time blocking; prompt injection yields distinct trajectory (score=0.541) for attack differentiation.
Full text
Computer Science > Cryptography and Security
arXiv:2606.30566v1 (cs) [Submitted on 29 Jun 2026]Title:Forensic Trajectory Signatures for Agent Memory Poisoning Detection
Authors:Jun Wen Leong View a PDF of the paper titled Forensic Trajectory Signatures for Agent Memory Poisoning Detection, by Jun Wen Leong View PDF HTML (experimental)Abstract:We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit. Under the evaluated architecture, this invariant follows from the attack's information-retrieval dependency rather than being merely an empirical correlation, and suppressing it breaks the attack. A simple rule exploiting this invariant alone achieves AUC = 0.9563. A Random Forest classifier over 19 trajectory features refines it to AUC = 0.9904 (BCa 95% CI [0.987, 0.993], N=10,000 resamples), demonstrating that the attack imprints on multiple independent behavioral channels. The signature is overdetermined: removing all recall-related features (half the feature set) leaves AUC unchanged at 0.990, confirming that memory poisoning induces a distributed trajectory signature rather than a single observable anomaly. Cross-model hold-out on 9 models (7B-120B parameters) confirms AUC = 1.000 on 6/9 hold-out splits, with all three exceptions mechanistically explained. The invariant generalizes to frontier models (GPT-4.1, GPT-4o) without retraining. A strictly prefix-only variant achieves AUC = 0.934, suggesting that real-time blocking is feasible with moderate degradation. The boundary is forensically useful: prompt-injection attacks that bypass memory produce a distinct trajectory (score = 0.541), enabling incident responders to distinguish memory-channel attacks from prompt-injection attacks using tool-call logs alone.
| Comments: | 11 pages, 4 figures. Companion note to arXiv:2605.08442 |
| Subjects: | Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2606.30566 [cs.CR] |
| (or arXiv:2606.30566v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2606.30566 Focus to learn more arXiv-issued DOI via DataCite |
Submission history
From: Jun Wen Leong [view email][v1] Mon, 29 Jun 2026 17:09:03 UTC (63 KB)
Full-text links:
Access Paper:
-
View a PDF of the paper titled Forensic Trajectory Signatures for Agent Memory Poisoning Detection, by Jun Wen Leong
- View PDF
- HTML (experimental)
- TeX Source
view license
Current browse context:
cs.CR < prev | next >new | recent | 2026-06 Change to browse by: cs
cs.LG
References & Citations
export BibTeX citation Loading...BibTeX formatted citation
× Data provided by:Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, MediaCode, Data and Media Associated with this Article
alphaXiv Toggle alphaXiv (What is alphaXiv?) Links to Code Toggle CatalyzeX Code Finder for Papers (What is CatalyzeX?) DagsHub Toggle DagsHub (What is DagsHub?) GotitPub Toggle Gotit.pub (What is GotitPub?) Huggingface Toggle Hugging Face (What is Huggingface?) ScienceCast Toggle ScienceCast (What is ScienceCast?) DemosDemos
Replicate Toggle Replicate (What is Replicate?) Spaces Toggle Hugging Face Spaces (What is Spaces?) Spaces Toggle TXYZ.AI (What is TXYZ.AI?) Related PapersRecommenders and Search Tools
Link to Influence Flower Influence Flower (What are Influence Flowers?) Core recommender toggle CORE Recommender (What is CORE?) About arXivLabsarXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)Related items
FeaturedDeepSeek V4 Doubles Token Share on OpenRouter, Driven by Agentic Workloads
DeepSeek V4 在 OpenRouter 上的代币份额翻倍，智能体工作负载成主要驱动力
The rapid adoption of DeepSeek V4 signals a strong market preference for high-performance, low-cost inference models, especially as agentic use cases reshape AI deployment.
91
FeaturedEnabling Two Settings Triples ARC-AGI-3 Benchmark Scores
启用两项设置使ARC-AGI-3基准测试分数提升三倍
This finding is crucial! It shows that model performance depends not only on training but also on inference-time configuration. For AI engineers and researchers, this is a must-know optimization direction. Teams deploying models on resource-constrained devices in particular could find a low-cost way to boost capabilities.
91
FeaturedGPT-5.6: Fusing Frontier Intelligence with Frontier Efficiency
GPT-5.6：前沿智能与前沿效率的融合
This news is worth watching as it marks a shift from pure parameter scaling to efficiency competition. For AI developers and business decision-makers, GPT-5.6 means higher performance at lower cost, especially for long-context or agentic tasks previously hindered by inference expenses. OpenAI's move may redefine what 'frontier' means.
91
FeaturedLFM2.5-Encoders: New Models for Fast Long-Context Inference on CPU
LFM2.5-Encoder：面向CPU快速长上下文推理的新模型
This blog post catches my eye because it directly solves the pain point of running long-context LLMs on CPU. For teams or individual developers without high-end GPUs, the LFM2.5-Encoder series offers a ready-to-use open-source solution. Highly recommended for those working on RAG, document search, or code analysis—now a standard server can handle million-token documents.
91
FeaturedGPT-Red: OpenAI Automates Red Teaming via Self-Play to Boost Model Robustness
GPT-Red：OpenAI通过自我对弈实现AI红队自动化，提升模型鲁棒性
GPT-Red marks a milestone from human to automated red-teaming—essential for safety engineers and alignment researchers. While reducing cost, it also raises ethical questions about automated attacks, worth pondering for everyone in AI governance.
91
FeaturedOpenAI Launches GPT-5.5 Bio Bug Bounty Program
OpenAI推出GPT-5.5生物漏洞赏金计划
This program deserves attention as it pioneers the extension of AI bug bounty to biosecurity, offering a new research direction for the security community and a practical training ground for AI risk governance. It is particularly important for model safety researchers, biosecurity experts, and practitioners concerned about dual-use AI risks.
91
FeaturedvLLM Introduces Native-Speed Transformers Modeling Backend for Enhanced Inference Performance
vLLM推出原生速度Transformers建模后端，大幅提升推理性能
This update is critical for AI engineering teams: eliminating format conversion speeds up model iteration, and 2-5x speedup directly reduces GPU costs. If you're building LLM online services or batch inference, this is practically a must-read technical update.
90
FeaturedGoogle DeepMind Introduces SL2T, a Sign Language-to-Text Model for Deaf Users
Google DeepMind 发布手语转文本模型 SL2T，助力聋人用户
This news matters not only as a technical breakthrough but also as a sign that AI is beginning to address the needs of marginalized groups. For developers, the architecture and technical approach of SL2T merit deep study; for accessibility advocates, it's a key case for advancing industry standards.