When AI agents share a memory that's been tampered with, what keeps that bad data from unlocking what they're allowed to do?
What stops poisoned memory from reaching the task-bound token or policy oracle?
This explores what keeps corrupted shared memory from influencing the authorization pieces (the signed task-bound token and the separate policy oracle) that gate what an agent pipeline is allowed to do.
This explores what keeps corrupted shared memory from influencing the authorization pieces (the signed task-bound token and the separate policy oracle) that gate what agents can do. The corpus doesn't answer it directly. The one note on the question says the source excerpt names only 'task-bound signed tokens' and a 'separately verified policy oracle'. It doesn't say who issues the tokens, what binds them, how verification works, or whether the attacks were aimed at these components at all How does the authorization layer stay outside the poisoned path?. Any mechanism for the isolation is therefore inferred from the surrounding results, not documented.
The results do show that the layer doesn't defend the agents' judgment. It stops the consequences of bad judgment. In the four-agent pipeline with authorization off, a validator reading poisoned shared memory forged approvals in every trial, and unsafe actions ran Can a poisoned validator still approve unsafe actions?. With authorization on, poisoning still bypassed the validator in every trial, yet no unsafe action executed Can memory poisoning compromise decision-making even with authorization layers?. The likely design bet is that the check sits at the point of execution and asks a component that never reads the poisoned memory. That would be why the agents' corrupted opinion didn't matter.
The zero-unsafe-actions result shouldn't be read as proof that the token or oracle can't be reached. The same pipeline's authors bundled clear authorization rules with restricted tools, and there's no single-factor ablation to tell whether risky actions were unavailable to the agents or merely not chosen. A 100% judgment-bypass rate alongside a 0% unsafe-action rate shows that difference matters Do authorization rules or restricted tools prevent test modifications?. An attacker who poisoned the token issuer or the oracle's inputs was never shown to have been tried.
Other work in the corpus defends the memory upstream instead, so poison never has to be tolerated. RAGPart and RAGMask catch poisoned documents at retrieval time, by bounding each document's influence or by flagging documents whose similarity collapses when tokens are masked Can we defend RAG systems from corpus poisoning without retraining?. A schema-governed committed state separates reading an artifact from writing it into permanent memory, so bad inputs can't silently accumulate Can agents fail from weak memory control rather than missing knowledge?. The token-and-oracle approach is an example of the opposite bet, checking at execution against a task binding, much as BenchShield checks a benchmark run's events against its intended lifecycle Can a finite lifecycle model detect reward hacking across benchmarks?. By contrast, putting governance rules inside the agent's own memory works because the agent actually consults them Can governance rules embedded in runtime memory actually protect autonomous agents?. That is also the surface poisoning attacks, which is why the separation matters.
Sources 8 notes
The paper reports zero unsafe actions when authorization is enabled, but the excerpt supplies only two phrases—"task-bound signed tokens" and "separately verified policy oracle"—without explaining who issues tokens, what binds them, how verification works, or whether attacks were positioned to reach these components.
In a four-agent LangGraph system with authorization disabled, a validator that reads poisoned shared memory forges approvals in every trial, leading to execution of unsafe actions. The validator's position as final authority before action execution, combined with its access to corrupted evidence, made it ineffective as a boundary.
Memory poisoning still bypassed the Validator in every trial, but a separate authorization layer using signed tokens and policy verification prevented any unsafe action from executing. The layer blocked execution without fixing the compromised judgment itself.
The abstract bundles clear authorization rules with restricted tools and reports zero protected-test modifications, but no single-factor ablation distinguishes whether the result comes from unavailable crossings, unchosen crossings, or both. The pipeline's own data elsewhere (100% Judgment Bypass Rate with 0% Unsafe Action Rate) shows the distinction matters.
RAGPart and RAGMask provide lightweight, retraining-free defenses that operate at the retrieval layer. RAGPart bounds poisoned-document influence via partitioned retriever learning; RAGMask flags suspicious documents through abnormal similarity collapse under token masking.
Show all 8 sources
Agent performance degrades in long workflows because transcript replay and retrieval-based memory lack gating mechanisms. A bounded, schema-governed committed state that separates artifact recall from permanent memory write prevents error accumulation and constraint drift.
BenchShield grounds exploit detection in a finite lifecycle model of reward-relevant events, enabling both static pre-run analysis and runtime instrumentation to operate over the same formal object. This replaces pattern-matching detection with deviation from an intended lifecycle structure.
A persistent agent recorded 889 governance events across 96 active days, with safeguards encoded directly into the memory layer the agent consulted during operation. Runtime-resident governance proved more effective than external policies because the agent actually accessed it during decision-making.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Trust propagation and structural containment in Multi-agent LLM pipelines
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents
- From Model Scaling to System Scaling: Scaling the Harness in Agentic AI
- Useful Memories Become Faulty When Continuously Updated by LLMs