Newest papers

PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust

Tanqiu Jiang, Min Bai, Sadat Shahriar, Wanyu Du, Sandesh Swamy · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28987 · cited by 0 works (OpenAlex) · open-access PDF

Indonesian

Agen perverter langsung adalah permukaan yang sebagian besar tidak dilindungi untuk injeksi dan keracunan, dan batas-batas risiko yang sama untuk berbagi memori antara agen. Kami menyajikan PerMIT, arsitektur memori dengan jaminan integritas yang dapat diandalkan di bawah asumsi kepercayaan eksplisit: hanya input yang dikonfirmasi oleh pengguna dan nilai-nilai yang dikonfirmasi oleh mesin di Lean 4 dipercaya. PerMIT memediasi pelepasan dan penggunaan nilai-nilai lingkungan yang tidak dapat diandalkan melalui antarmuka memori terbatas, sementara mempertahankan perencanaan multi-turn dan pilihan alat yang didorong oleh agen. Melalui antarmuka terbatas ini, kami membuktikan dua teorema integritas yang juga dikonfirmasi oleh mesin di Lean 4, yang secara bersama-sama memastikan bahwa memori yang berasal dari lingkungan mencapai tindakan sensitif jika dikon

Machine translation (Meta M2M100); the English original follows.

Abstract

Persistent memory is a largely undefended surface for injection and poisoning, and the same risk limits memory sharing among agents. We present PerMIT, a memory architecture with provable integrity guarantees under an explicit trust assumption: only user-typed inputs and values confirmed at a gate are trusted. PerMIT mediates the release and use of untrusted environment-derived values through a finite memory interface, while preserving agent-driven multi-turn planning and tool choice. Over this finite interface, we prove two integrity theorems that are also machine-checked in Lean 4, which together ensure that environment-derived memory reaches a sensitive action only if confirmed at the gate and influences the agent's behavior only through what the gate displays. Every attack in our threat model thereby reduces to a single auditable decision, which a human, an LLM verifier, or both can make in practice. On Trojan Hippo, PerMIT records zero observed attack success with self-verification and lightweight verifiers. Because each confirmation is a logged verdict on exact content, endorsements accumulate across users, and sufficiently endorsed items become community-confirmed with no further verification required. Under explicit assumptions, we prove and corroborate in simulation a co-scaling property: as the community grows, the risks of promoting poison and of wrongly evicting benign knowledge fall, while per-user verification effort does not rise. On $τ^2$-bench, communities of up to 90 autonomous agents use PerMIT to build shared knowledge bases with no direct memory injection promoted, and the resulting knowledge significantly improves new agents on held-out tasks, suggesting a path toward agents that safely self-improve at test time.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Scalability, Computer security, Observability, Action (physics), Architecture

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange