Newest papers

PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust

Tanqiu Jiang, Min Bai, Sadat Shahriar, Wanyu Du, Sandesh Swamy · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28987 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

持久的代理人安全记忆是自动注射和中毒的大部分无防御的表面,同样的风险限制是代理人之间的记忆共享。我们介绍 PerMIT,一个记忆体系,在明确的信任假设下具有可验证的完整性保证:只有用户编写的输入和在 Lean 4 中机器验证的值是值得信赖的。 PerMIT 通过终端记忆接口来介导未受信任的环境衍生值的释放和使用,同时保持代理人驱动的多重转换计划和工具选择的记忆架构。在这个终端接口中,我们证明了两种完整性定理,这些定义在 Lean 4 中也被机器验证,这两者共同确保了环境衍生记忆在社区中仅通过门口确认的敏感行为,并且影响

Machine translation (Meta M2M100); the English original follows.

Abstract

Persistent memory is a largely undefended surface for injection and poisoning, and the same risk limits memory sharing among agents. We present PerMIT, a memory architecture with provable integrity guarantees under an explicit trust assumption: only user-typed inputs and values confirmed at a gate are trusted. PerMIT mediates the release and use of untrusted environment-derived values through a finite memory interface, while preserving agent-driven multi-turn planning and tool choice. Over this finite interface, we prove two integrity theorems that are also machine-checked in Lean 4, which together ensure that environment-derived memory reaches a sensitive action only if confirmed at the gate and influences the agent's behavior only through what the gate displays. Every attack in our threat model thereby reduces to a single auditable decision, which a human, an LLM verifier, or both can make in practice. On Trojan Hippo, PerMIT records zero observed attack success with self-verification and lightweight verifiers. Because each confirmation is a logged verdict on exact content, endorsements accumulate across users, and sufficiently endorsed items become community-confirmed with no further verification required. Under explicit assumptions, we prove and corroborate in simulation a co-scaling property: as the community grows, the risks of promoting poison and of wrongly evicting benign knowledge fall, while per-user verification effort does not rise. On $τ^2$-bench, communities of up to 90 autonomous agents use PerMIT to build shared knowledge bases with no direct memory injection promoted, and the resulting knowledge significantly improves new agents on held-out tasks, suggesting a path toward agents that safely self-improve at test time.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Scalability, Computer security, Observability, Action (physics), Architecture

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange