Persistent Memory Poisoning Defense: Four-Layer Provenance-Anchored Architecture
Memory poisoning plants malicious instructions via seemingly benign user queries using bridging steps that appear individually reasonable, achieving 95%+ injection success in vulnerable agents; payloads survive across sessions indefinitely, activating when future retrieval queries trigger the poisoned entry as the agent's own 'learned knowledge.' The defense requires four layers applied in sequence: (1) write-ahead validation—a secondary model evaluates every proposed memory write before storage; (2) provenance tagging on every entry (creation time, source, session context, trust score); (3) trust-aware retrieval with temporal decay that demotes older low-trust entries despite relevance scores; (4) behavioral monitoring with circuit-breakers that quarantine agents exhibiting unusual tool invocation patterns. Start with provenance tagging as the foundational primitive—it enables all downstream filtering without requiring immediate behavioral monitoring infrastructure.
↳ Follow the thread