Newest papers

PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust

Tanqiu Jiang, Min Bai, Sadat Shahriar, Wanyu Du, Sandesh Swamy · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28987 · cited by 0 works (OpenAlex) · open-access PDF

Hindi

स्थायी सुरक्षा एजेंटों की स्मृति एक व्यापक रूप से अनियंत्रित सतह है जो इंजेक्शन और जहर के लिए स्वतंत्र है, और एक ही जोखिम सीमा एजेंटों के बीच स्मृति साझा करने के लिए है। हम PerMIT, एक मेमोरी आर्किटेक्चर को एक स्पष्ट भरोसे की धारणा के तहत प्रमाणित अखंडता की गारंटी के साथ प्रस्तुत करते हैं: केवल उपयोगकर्ता-टाइप किए गए इनपुट और गेट पर अनुमोदित मूल्यों को विश्वसनीय माना जाता है। PerMIT एक समाप्त स्मृति इंटरफ़ेस के माध्यम से अविश्वसनीय पर्यावरण-उत्पादित मूल्यों के रिलीज और उपयोग को मध्यस्थ करता है, जबकि एजेंट-ड्राइविंग मल्टी-टॉर्निंग योजना और

Machine translation (Meta M2M100); the English original follows.

Abstract

Persistent memory is a largely undefended surface for injection and poisoning, and the same risk limits memory sharing among agents. We present PerMIT, a memory architecture with provable integrity guarantees under an explicit trust assumption: only user-typed inputs and values confirmed at a gate are trusted. PerMIT mediates the release and use of untrusted environment-derived values through a finite memory interface, while preserving agent-driven multi-turn planning and tool choice. Over this finite interface, we prove two integrity theorems that are also machine-checked in Lean 4, which together ensure that environment-derived memory reaches a sensitive action only if confirmed at the gate and influences the agent's behavior only through what the gate displays. Every attack in our threat model thereby reduces to a single auditable decision, which a human, an LLM verifier, or both can make in practice. On Trojan Hippo, PerMIT records zero observed attack success with self-verification and lightweight verifiers. Because each confirmation is a logged verdict on exact content, endorsements accumulate across users, and sufficiently endorsed items become community-confirmed with no further verification required. Under explicit assumptions, we prove and corroborate in simulation a co-scaling property: as the community grows, the risks of promoting poison and of wrongly evicting benign knowledge fall, while per-user verification effort does not rise. On $τ^2$-bench, communities of up to 90 autonomous agents use PerMIT to build shared knowledge bases with no direct memory injection promoted, and the resulting knowledge significantly improves new agents on held-out tasks, suggesting a path toward agents that safely self-improve at test time.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Scalability, Computer security, Observability, Action (physics), Architecture

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange