Research · curated 26 Jul 2026
Forensic Trajectory Signatures for Agent Memory Poisoning Detection
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Memory poisoning of LLM agents can force covert data exfiltration via tool calls, and this study shows both a detection signal and its critical limitation, guiding defenders away from naive blocking toward metadata-gated triage.
The paper 'Forensic Trajectory Signatures for Agent Memory Poisoning Detection' by Jun Wen Leong identifies a behavioral invariant in LLM agents under persistent memory poisoning: successful attacks require calling memory_recall_fact before email_send_email. A rule and Random Forest classifier over trajectory features achieve high AUC (up to 0.99) across 9 models, but a preregistered follow-up (N=4,360, 13 models) reveals benign memory-grounded sends produce the same signature, causing high false positives; the recall_before_send pattern is an attack precondition rather than a maliciousness predicate, requiring recipient-metadata gating to restore separation.