Research
Forensic Trajectory Signatures for Agent Memory Poisoning Detection
Publication date not yet evaluated · Added arxiv.org
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
Memory poisoning of LLM agents can force covert data exfiltration via tool calls, and this study shows both a detection signal and its critical limitation, guiding defenders away from naive blocking toward metadata-gated triage.
The paper 'Forensic Trajectory Signatures for Agent Memory Poisoning Detection' by Jun Wen Leong identifies a behavioral invariant in LLM agents under persistent memory poisoning: successful attacks require calling memory_recall_fact before email_send_email. A rule and Random Forest classifier over trajectory features achieve high AUC (up to 0.99) across 9 models, but a preregistered follow-up (N=4,360, 13 models) reveals benign memory-grounded sends produce the same signature, causing high false positives; the recall_before_send pattern is an attack precondition rather than a maliciousness predicate, requiring recipient-metadata gating to restore separation.