Technical Summary: Forensic Trajectory Signatures for Agent Memory Poisoning Detection

Problem Statement

The paper addresses the challenge of detecting persistent memory poisoning attacks in Large Language Model (LLM) agents. Unlike classical Endpoint Detection and Response (EDR) which analyzes process traces, LLM agent security lacks established methodologies for identifying specific attack channels using only observable logs. Existing defenses often require access to memory stores (e.g., MemLineage), white-box model internals (e.g., activation analysis), or pre-injection retrieval layers (e.g., RAG Sanitizer), imposing infrastructure demands many operators cannot meet.

The specific threat modeled is a Delayed-Trigger Attack (DTA): an adversary injects a malicious instruction via a RAG-retrieved document, which the agent stores in persistent memory. In a subsequent session, the agent retrieves this stored rule and executes a malicious action (e.g., email exfiltration). The detector's constraint is strict: it observes only the tool-call sequence and timestamps, without access to memory contents, model weights, or user messages.

Methodology

Threat Model & Assumptions

The study assumes an architecture where persistent memory is accessed exclusively through observable retrieval operations (tool calls). The attacker's routing information is stored as a value in memory, requiring a specific recall fact tool call to retrieve the destination address before an send email tool can be executed. This contrasts with prompt-injection attacks where the rule is embedded directly in the user prompt.

Dataset

The evaluation utilizes 2,520 labeled runs from a factorial experiment covering:

• 9 Models: Ranging from 7B to 120B parameters (Qwen, GLM, GPT-OSS families).
• 7 Defense Conditions: Including Minimizer, Sanitizer, RAG Sanitizer, Prompt Hardening, and Memory Sandbox.
• Labels: 1,919 attack successes (exfiltration occurred) and 601 non-exfiltration sessions (poisoned but defended). The classifier distinguishes between successful and unsuccessful attack executions within the DTA arm.

Feature Engineering

Features are extracted solely from the trigger session (S4) to avoid label leakage. The study defines 19 trajectory features based on tool-call ordering and counts:

• Counts: Raw call frequencies (e.g., recall count, send count).
• Structural: Binary indicators such as recall before send (did a recall occur prior to the first send?) and send without recall.
• Transitions: Bigram counts of consecutive tool calls (e.g., list then recall, draft then send).
• Entry Points: The identity of the first tool called in the session.

Classification & Evaluation

Three classifiers (Logistic Regression, Random Forest, Gradient Boosted Trees) were trained using stratified 5-fold cross-validation. The primary metric is Recall (minimizing false negatives/undetected attacks), with AUC-ROC as the secondary metric. Evaluation includes leave-one-model-out hold-out tests and frontier model probes (GPT-4.1).

Key Findings and Results

1. Discovery of a Behavioral Invariant

The core finding is a mechanistically forced behavioral invariant: successful memory-channel poisoning attacks must exhibit a recall fact call before the send email call. This is not a statistical correlation but a structural necessity; without retrieving the stored routing address, the agent cannot complete the exfiltration.

• Simple Rule Performance: A detector based solely on the recall before send transition achieves AUC = 0.9563.
• Mechanistic Robustness: Suppressing this transition breaks the attack, as the agent cannot retrieve the destination address.

2. Overdetermined Signature

The attack leaves a distributed signature across multiple independent behavioral channels, not just the single recall event.

• Full Classifier Performance: A Random Forest using all 19 features achieves AUC = 0.9904 (BCa 95% CI [0.987, 0.993]) with a Recall of 0.9838.
• Ablation Study: Removing all recall-related features (9 features) leaves the AUC unchanged at 0.9904. This confirms the signature is overdetermined; the attack's information-retrieval dependency triggers a cascade of downstream behavioral changes (e.g., draft counts, send counts, transition patterns) that are detectable even without explicit recall features.

3. Cross-Model Generalization

The invariant generalizes across model families and parameter scales (7B–120B):

• Hold-Out Validation: On 6 of 9 held-out models, the classifier achieved AUC = 1.000.
• Exceptions:
  • qwq:32b (AUC=0.000): An "implicit-bypass" failure where the model uses RAG fallback without calling recall fact, bypassing the memory channel entirely.
  • qwen2.5:14b (AUC=0.083): A distributional inversion where non-attack sessions aggressively call recall to verify benign data, mimicking the attack signature (though Recall remains 1.000).
  • qwen3.5:122b (AUC=0.750): Label ambiguity due to "sleeper" sessions where the model stores but refuses to execute the rule.
• Frontier Models: The classifier, trained only on open-source models, achieved Recall = 1.000 on GPT-4.1 probes without retraining.

4. Deployment Boundaries and Evasion

• Prefix-Only Detection: A strictly prefix-only classifier (operating before the send event) achieves AUC = 0.934, suggesting real-time blocking is feasible with moderate degradation.
• Evasion Boundary: Prompt-injection attacks (where the rule is in the prompt, not memory) produce a distinct trajectory with recall before send = 0. The detector correctly assigns these a low score (mean 0.541), enabling incident responders to distinguish memory-channel attacks from prompt-injection attacks using tool-call logs alone.
• False Negatives: All 31 false negatives originated from the Memory Sandbox defense condition (where recall fact is removed from the tool schema) or the specific qwq:32b implicit-bypass architecture.

Significance and Claims

The paper claims that the primary contribution is the empirical discovery of a stable, overdetermined behavioral invariant in agent execution trajectories, rather than the classifier architecture itself.

• Forensic Utility: The detector operates as a "State-Space IDS" for memory-channel attacks, requiring only tool-call logs (a lower deployment bar than memory inspection or model internals).
• Channel Attribution: It enables the distinction between memory-poisoning attacks and prompt-injection attacks based solely on operation logs.
• Structural Robustness: The detection relies on a feature (recall before send) that is mechanistically forced by the attack's information-retrieval dependency. An adversary cannot suppress this feature without either breaking the attack or changing the attack vector to prompt-injection.
• Generalizability: The signature transfers across model families and parameter scales without retraining, indicating it reflects the attack mechanism rather than specific model behaviors.

The authors position this work as a forensic audit tool that complements prevention mechanisms, providing high-confidence detection and attribution for incidents where prevention defenses (like Memory Sandbox) may fail or where the attack has already occurred.