Forensic Trajectory Signatures for Agent Memory Poisoning Detection
A new preprint identifies a behavioral invariant in LLM agents subjected to persistent memory poisoning: successful attacks consistently require a recall-before-send transition. Using a Random Forest classifier over 19 trajectory features, the method achieves high detection performance (AUC up to 0.9904), and the invariant generalizes across multiple model sizes and architectures. However, the same signature also appears in benign memory-grounded actions, leading to high false positive rates; the authors show that incorporating recipient metadata can restore effective separation.
Why it matters: This work both uncovers a robust detection signal for agent memory poisoning and highlights a critical limitation, informing safer deployment strategies for memory-augmented LLM agents.
Full story at: arXiv Cryptography and Security ↗