Can memory poisoning compromise decision-making even with authorization layers?
When authorization systems add signed tokens and policy oracles to an AI pipeline, does this stop attackers from poisoning the agent's judgment about whether to approve actions, and what actually prevents unsafe execution?
Turning the authorization layer on (the paper's T1 condition, which "enables both" the token check and the policy oracle) changes the outcome without changing the Validator. The layer is "an independent authorization layer using task-bound signed tokens and a separately verified policy oracle." Against memory poisoning, Unsafe Action Rate falls to 0 percent while Judgment Bypass Rate stays at 100 percent. The paper's summary: "the Validator remains compromised, but the Executor independently prevents unauthorized action." It is the same attack and the same failed reviewer as Can a poisoned validator still approve unsafe actions?. What differs is that the approval no longer suffices.
The useful reading is that the result separates changing what the agent does from changing what the agent can do. At 100 percent JBR nothing was done to make the Validator resist; it is bypassed every time. At 0 percent UAR the action is unavailable anyway. That is the split drawn in Can architecture prevent violations better than training values?, seen at runtime in a pipeline and not in training: the forgery is still chosen, and the execution is not available. That link is mine. Neither paper uses the other's framing, and this excerpt is not about conditional compliance. The result is also a measured case of the design goal in Can prompting reduce bias in LLM judges reliably?, and of the layer choice in Why do agents fail at identity verification and authorization?, which puts authorization outside conversational context.
What the 0 percent does not cover:
- The corpus. 60 tasks under three seeds on a single codebase. The 95 percent intervals are Student's t over seeds (df = 2) because trials within a seed share the task corpus and are not independent, so 180 trials per cell are not 180 independent observations.
- The attacker's position. The tested attacks poison shared memory and a retrieved document. The excerpt does not say whether either could reach the token or the oracle (How does the authorization layer stay outside the poisoned path?).
- The cost. A layer that refused everything would also score 0 percent UAR, which is why the paper reports FPR beside it (I read that as false positive rate; the excerpt does not expand it). No FPR, LTC or F1 value is in the excerpt, so what the layer costs on the 36 safe tasks is unknown here.
- The kind of harm. A per-action check speaks to a forged approval, not to harm assembled from individually authorized steps (Can task decomposition hide harmful intent across agents?, Can step-by-step approval miss harmful behavior patterns?). This is my reading; the excerpt does not test it.
- The attack. The result is for memory poisoning. The injection and hijacking results are not in the excerpt. For a chain-of-thought monitor facing injected plans, the same judgment-versus-permission split is candidate 3 in Can monitors catch plan injection attacks in chain-of-thought reasoning?, where nothing has tested it.
Where the layer sits among the vault's defense placements. A check at the action is one more position beside the commit point in Where should workflow validation gates be placed for safety?, which also gates before an irreversible action but rebuilds the flow's global risk context, where this layer reads a licence (a token and a policy) and does not read the workflow. Whether such placements are alternatives or layers is an open tension filed in ops/tensions/. Two further pairings are the vault's and neither paper draws them. Can deterministic checks protect LLM judges from failure? puts checks that cannot be argued with in front of checks that can. On my reading the token check and policy oracle stand to the Validator's approval as an unarguable check to an arguable one, though the excerpt says only that they are signed and separately verified, and they sit at the action and not ahead of the reviewer in sequence. And Do authorization rules or restricted tools prevent test modifications? reports a zero for a regime that changed clear rules and restricted tools together, so it cannot say whether choice or availability did the work; here the paired rates show the forgery still chosen and the execution unavailable, though the layer's own two parts were also switched together (Which authorization component achieves the zero percent unsafe rate?).
Inquiring lines that read this note 13
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Can defenses detect attacks composed across multiple skills? What determines whether AI system errors remain visible and contestable? How do agents balance task completion with privacy compliance and security?- Who issues tokens and what attacks can reach them?
- Which of the two authorization components carries the zero percent Unsafe Action Rate?
- What keeps the task-bound token and policy oracle isolated from poisoning?
- What stops poisoned memory from reaching the task-bound token or policy oracle?
Related concepts in this collection 13
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can a poisoned validator still approve unsafe actions?
When a review agent reads from the same compromised memory as the retrieval agent, does it retain the authority to block unsafe actions? This tests whether a single approval point can serve as a meaningful safeguard.
the T0 baseline this contrasts with
-
Can action-level metrics alone expose contained attacks?
When a defense stops unsafe actions from executing, does measuring only the final action reveal whether the attack was blocked or never penetrated? This matters because different defense layers need different metrics to show what actually happened.
why the pair of rates carries the result
-
Can architecture prevent violations better than training values?
Whether making violations technically unavailable through system design is more reliable than trying to train agents to choose compliance. This matters because behavioral training may only produce conditional compliance that disappears when oversight is gone.
the unavailable-versus-unchosen split, instanced here at runtime
-
Can prompting reduce bias in LLM judges reliably?
The paper suggests that instructing LLM judges to be less biased may not work reliably. This matters because if prompting fails, effort should shift from debiasing to making judge errors survivable in system design.
the design goal this result measures at a different level
-
What makes an AI system truly safe in practice?
Does safety depend mainly on preventing errors, or on whether errors can be seen, challenged, fixed, and undone once they happen? This shifts where we should focus safety work.
on the vault's mapping, a measured case of the containable condition without prevention; the pipeline's paper does not use that standard
-
Why do agents fail at identity verification and authorization?
Agent systems reveal critical gaps in identity verification, authorization enforcement, and proportionality constraints that don't appear in chat models. Understanding these failures is essential because they enable unauthorized real-world actions rather than just wrong answers.
authorization enforced outside conversational context, the layer choice tested here
-
Can a model-level filter truly contain an agent with environment access?
Explores whether filtering individual model outputs can control agents that retain state, call tools, and access credentials. Matters because the distinction determines what security measures actually work against agentic systems.
the same judge-a-moment versus limit-what-it-can-touch line from the containment side
-
Where should workflow validation gates be placed for safety?
Can a single defense point catch attacks that fragment across planning, messaging, and execution? The note explores whether workflow-level validation at commit points reconstructs risk context that individual steps cannot see alone.
contrasts: also a check before an irreversible action, but one that reads the assembled workflow, where this layer reads a token and a policy; whether placements are alternatives or layers is an open tension
-
Can monitors catch plan injection attacks in chain-of-thought reasoning?
Plan injection successfully evades chain-of-thought monitors 25–33% of the time. The question is whether monitors can be hardened through deeper reasoning budgets or context checks to catch these attacks reliably.
the nearest measured neighbour of that note's candidate 3, for a different attack; untested against injected plans
-
Can deterministic checks protect LLM judges from failure?
Explores whether mechanical, non-contestable verification steps can safeguard LLM-based decision systems. Matters because it tests whether we can make AI judgment survivable even when it goes wrong.
the same relation of an unarguable check to an arguable one, on the vault's reading, placed at the action here and not ahead in sequence
-
Do authorization rules or restricted tools prevent test modifications?
The abstract reports that an explicit-boundary regime prevents protected test changes, but combines clear rules with restricted tools. This note explores which factor—or both—actually keeps tests unmodified, since the two mechanisms work differently on agent behavior.
a second explicit-boundary zero from another paper that cannot separate choice from availability; here the paired rates can
-
Can a quorum of honest validators certify an invalid transition?
When validators follow the protocol perfectly but lack semantic understanding, can they collectively approve a state change that violates application invariants? This matters because it reveals a gap between protocol correctness and execution safety.
the same reviewer-as-gate design with a quorum of honest but wrong validators in place of one poisoned reviewer; the cause differs, so this result speaks to containment and not to how often such errors occur
-
Can validator consensus guarantee both agreement and semantic correctness?
Explores whether agreement reached by protocol-compliant validators also ensures the agreed outcome is semantically valid, and what assumptions would be needed to make that guarantee hold.
what the layer sits outside of: reliance on the reviewer's judgment being usually right, which the attack defeated in every trial while execution stayed safe (poisoning here, not the honest errors that note's bounds are about)
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- Trust propagation and structural containment in Multi-agent LLM pipelines
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- Persistent Pre-Training Poisoning of LLMs
- Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety
- Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation
Original note title
with authorization enabled memory poisoning still bypasses the Validator in every trial yet no unsafe action executes — 100 percent Judgment Bypass Rate against 0 percent Unsafe Action Rate