Newest papers

PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust

Tanqiu Jiang, Min Bai, Sadat Shahriar, Wanyu Du, Sandesh Swamy · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28987 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Los agentes persistentes de verificación de la memoria son una superficie en gran parte indefensa para la inyección y la intoxicación autónoma, y los mismos límites de riesgo para el intercambio de memoria entre los agentes. Presentamos PerMIT, una arquitectura de memoria con garantías de integridad probables bajo una suposición de confianza explícita: sólo se confían las entradas de usuario y los valores comprobados por máquina en un puerto. PerMIT media la liberación y el uso de valores derivados del medio ambiente no confiables a través de una interfaz de memoria finita, mientras preserva el comportamiento del agente a través de lo que el puerto muestra la planificación de tareas multi-turn y la elección de herramientas. A través de esta interfaz finita, demostramos dos teoremas de integridad que también son verificados por máquina en Lean 4,

Machine translation (Meta M2M100); the English original follows.

Abstract

Persistent memory is a largely undefended surface for injection and poisoning, and the same risk limits memory sharing among agents. We present PerMIT, a memory architecture with provable integrity guarantees under an explicit trust assumption: only user-typed inputs and values confirmed at a gate are trusted. PerMIT mediates the release and use of untrusted environment-derived values through a finite memory interface, while preserving agent-driven multi-turn planning and tool choice. Over this finite interface, we prove two integrity theorems that are also machine-checked in Lean 4, which together ensure that environment-derived memory reaches a sensitive action only if confirmed at the gate and influences the agent's behavior only through what the gate displays. Every attack in our threat model thereby reduces to a single auditable decision, which a human, an LLM verifier, or both can make in practice. On Trojan Hippo, PerMIT records zero observed attack success with self-verification and lightweight verifiers. Because each confirmation is a logged verdict on exact content, endorsements accumulate across users, and sufficiently endorsed items become community-confirmed with no further verification required. Under explicit assumptions, we prove and corroborate in simulation a co-scaling property: as the community grows, the risks of promoting poison and of wrongly evicting benign knowledge fall, while per-user verification effort does not rise. On $τ^2$-bench, communities of up to 90 autonomous agents use PerMIT to build shared knowledge bases with no direct memory injection promoted, and the resulting knowledge significantly improves new agents on held-out tasks, suggesting a path toward agents that safely self-improve at test time.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Scalability, Computer security, Observability, Action (physics), Architecture

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange