Technical Summary: MutMem – Cryptographically Authorized Mutation in Persistent Agent Memory

Problem Statement

Persistent agent memory systems require adaptation: memories that were useful in the past may become misleading after corrections, while low-value observations may gain utility with new evidence. However, treating adaptation as a standard in-place update creates a forensic ambiguity. Once a memory's weight or content changes, an external reviewer cannot distinguish between an authorized cognitive adaptation and an unauthorized database edit. Furthermore, standard approaches often delete or suppress "poisoned" or suspicious content, destroying the audit trail necessary to study attack patterns or correct false positives.

The core challenge is to enable bidirectional cognitive mutation (reweighting memories up or down) while maintaining:

1. Retention: The memory and its historical evidence must remain present.
2. Authorization: Only the system's designated "housekeeper" can apply cognitive reweights.
3. Integrity: Hashes and signatures must make unauthorized divergence detectable.
4. Traceability: Poisoned content must be retained but marked as untrusted, preserving the history of classification without erasing the original evidence.

Crucially, the system distinguishes between authorization (proving a change was made by the right entity) and truth (proving the content is factually correct). Cryptography supports the former but not the latter.

Methodology: The MutMem Protocol

MutMem is implemented within HOM-AIMOS, a persistent-memory engine. The protocol separates retention from state evolution using a cryptographic mutation framework.

1. Retention-Preserving Mutation

The system forbids ordinary decay, deletion, or suppression. Instead:

• Weight Bounds: Cognitive weights ($w$) are bounded within $[0.1, 3.0]$. A weight of 0.1 represents "low relevance" but not deletion.
• Update Rule: Weights are updated based on signed outcome evidence (valence) using an age-neutral rule: $w' = \text{clip}(w \cdot \exp(\eta \cdot j))$, where $j$ is a valence score derived from a sum of retained rewards.
• Bidirectional Trajectory: A memory can be reweighted up or down. A later positive outcome can reverse a prior negative transition, but the reversal is an append-only transition, not an overwrite. This preserves the full history of judgments.

2. Cryptographic Mutation Protocol

Every nontrivial weight change is bound to a signed provenance node and a transition commitment:

• Provenance Node: A signed JSON body ($B_i$) containing the memory ID, company, old weight, new weight, and a hash of the previous provenance node. This creates a hash chain of memory history.
• Transition Commitment: A separate commitment ($t_i$) binds the specific company, memory, quantized weights, and provenance hash. This is signed by the Housekeeper (the system's native cognitive mutation owner) using Ed25519.
• Verification: A restricted database writer and an independent portable verifier check these signatures. They verify continuity, signer epoch validity, and that the transition matches the live state.
• Merkle Receipts: When a memory is recalled, the system generates an RFC 6962-style Merkle receipt binding the ordered evidence, memory ID, and calibration state.

3. Epistemic Poisoning and Traceability

Instead of deleting suspected poisoned content, MutMem retains it as "untrusted reference evidence."

• Epistemic Chain: A separate, append-only chain records signed labels (e.g., poison_suspect, poison_likely, poison_refuted).
• Classification Logic: A deterministic classifier appends labels based on detector signals. If a cluster of passages shares suspicious query patterns, the system appends a poison_likely transition.
• Retrieval Isolation: During recall, the system consults the current epistemic projection. If a memory is labeled as poisoned, it is excluded from the top-$k$ results or treated as untrusted, even though the raw memory row remains in the database.
• Reversibility: If later evidence refutes a poison label, a new signed transition (poison_refuted) is appended, restoring the memory's trust status without erasing the history of the suspicion.

Key Contributions

1. Retention-Preserving Mutation Protocol: A system where signed outcome evidence moves retrieval frequency without deleting or overwriting memories, maintaining a complete historical trajectory.
2. Two-Commitment Cognitive Trajectory: A mechanism where every reweight is authorized by a signed provenance node and independently signed over the exact transition details, creating a fork-free, verifiable history.
3. Recall-Time Result-Level Proof: Candidates are admitted only after provenance verification, and responses include a signed Merkle receipt binding the disclosed order and state.
4. Auditable Evaluation Design: A framework separating utility, mutation integrity, and poisoning robustness, with fixed statistical units and hash-verified artifacts.
5. Retention-Preserving Poison Traceability: A method to retain potentially poisoned passages while appending a signed, verifiable epistemic chain that marks them as untrusted, allowing for traceability and potential future refutation.

Results

The paper evaluates MutMem across three axes using specific benchmarks and protocols:

1. Utility (LongMemEval & LoCoMo)

• LongMemEval: Achieved 91.8% accuracy (459/500 questions) under LLM judgment.
• LoCoMo: Achieved 74.12% accuracy (1472/1986 questions) under LLM judgment and 58.20 F1 score under a token-F1 protocol.
• Note: These metrics demonstrate the system's ability to function effectively with persistent memory, separate from the cryptographic integrity claims.

2. Mutation Integrity

• A native mutation suite verified 20 signed transitions.
• Latency: Median latency of 4.865 ms per transition; p95 latency of 5.674 ms.
• Storage: Mean logical row storage of 966.35 bytes per transition.
• Integrity: The system successfully rejected unauthorized updates, cross-tenant proof reuse, and tampered signatures. SQL and portable verifiers confirmed exact parity.

3. PoisonedRAG Adaptation (N=100)

• Attack Setup: 100 targets with 5 injected poison passages each (500 total).
• Retrieval Defense: In the final post-calibration defended run (A1 arm), 0/100 targets had poison passages in the top-5 retrieved results. (In contrast, the unmitigated A0 bypass arm selected poison in 94/100 top-5 sets).
• Accuracy: Clean answer accuracy was 72%; attacked answer accuracy was 71%. The difference was not statistically significant.
• Traceability: All 500 poison passages were retained and assigned a poison_likely label. All 19,308 retained benchmark memory chains verified successfully.
• False Positives: Only 4 of 18,808 clean memories received an adverse label (0.0213%).

4. Epistemic Ablation

A causal ablation study compared four policy arms:

• A0 (Bypass): 94/100 poisoned passages selected in top-5; attacked accuracy dropped to 40%.
• A1 (Signed Labels): Poison retrieval dropped to 0/100; attacked accuracy recovered to 65%.
• A2/A3: Adding query-local detection or active-context withholding provided no additional measurable benefit on this fixed corpus, as the signed labels (A1) had already removed the poison.
• Conclusion: The signed stored labels were the primary causal factor in defense, recovering 25 percentage points of accuracy without harming clean performance.

Significance and Claims

The paper explicitly limits its claims to authorization, integrity, traceability, and historical continuity. It does not claim to prove semantic truth.

• Forensic Distinction: MutMem successfully demonstrates that legitimate cognitive mutations can be cryptographically distinguished from unauthorized edits. A signature proves who authorized a change and what the previous state was, but not whether the content is factually true.
• Retention as Security: By retaining poisoned content rather than deleting it, the system preserves the evidence necessary to audit attacks, study detector behavior, and correct false positives. The "poison" becomes a form of negative evidence that is traceable and reversible.
• Defense in Depth: The ablation shows that signed epistemic labels act as a sufficient first layer of defense, preventing poisoned content from reaching the generation prompt, while subsequent layers (like context withholding) remain unexercised because the first layer succeeded.
• Modesty: The author acknowledges that key compromise, runtime superuser access, and external anchor replacement remain outside the threat model. The results are bound to specific source commits and evidence manifests, and the human review was blinded but non-independent (conducted by the system author).

In summary, MutMem provides a cryptographic framework for persistent agent memory where adaptation is a verifiable, auditable, and reversible process, ensuring that the history of an agent's "thoughts" remains intact and distinguishable from tampering, even when the content itself is false or malicious.