This report focuses on security in LLM agent memory systems. It examines a recent memory-security study as its core paper and traces five related works, outlining the progression from basic memory architectures and risk identification to attack and defense mechanisms.
LLM agents'reasoning-history memory has become a new attack surface. By planting fabricated reasoning records in memory (the FARMA attack), attackers can forge an agent's decision history and bypass existing safeguards. Following data poisoning and prompt injection, this is the first systematic analysis of security threats to reasoning-history memory.
“Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses” (arXiv 2607.05029) identifies and analyzes a new, severely overlooked attack surface in LLM agent memory systems: forged reasoning-history memory. Unlike conventional poisoning of factual knowledge bases, this attack targets the “reasoning archive” that an agent uses to record its previous decisions, verification procedures, and thought trajectories.
An agent treats stored reasoning records as authoritative evidence of its own past work. By carefully planting false reasoning trajectories, an attacker can change what the agent believes it has already done, inducing it to skip necessary verification, make incorrect decisions, or even execute malicious actions.
As LLM agents are increasingly deployed in practical applications—medical record management, financial decisions, and online shopping—long-term memory becomes essential. Existing memory-security research, however, mainly focuses on:
All these defenses assume that the information stored in memory is itself verifiable, but no one verifies whether these “historical records” actually happened or were fabricated afterward. The paper fills this critical gap.
Specific problems include:
The paper's argument has three levels:
The authors first explain why reasoning-history memory warrants separate study. Existing security research focuses either on knowledge memory(“What are the facts?”) or on instruction memory(“What should I do?”), but rarely examines the trustworthiness of reasoning trajectories themselves. In long-running agent tasks, however, reasoning trajectories often serve as “evidence” for deciding the next action.
The paper demonstrates the threat through FARMA (Forged Amplifying Rationale Memory Attack):
The paper then introduces the SENTINEL defense pipeline. Its central innovation is a Reasoning Guard, a structured analysis module that detects characteristic signals of fabricated reasoning:
FARMA has two key stages:
| Stage | Operation | Key technique | Defense challenge |
|---|---|---|---|
| Injection | Insert fabricated reasoning records into agent memory | Use evasive language to avoid overtly malicious keywords | Keyword filtering fails |
| Amplification | Add new records citing earlier fabricated entries | Create false “consistency” and “historical continuity” | Consensus defenses and majority-vote checks fail |
Core algorithmic idea: The paper uses actor–critic optimization to generate universal attack-payload templates. Instead of manually tailoring attacks to each target system, the authors learn a parameterized “fabricated reasoning generator” that can:
SENTINEL is a five-layer pipeline that progressively increases defense depth and specificity:
Reasoning Guard Signal Design:
The paper systematically evaluates three application domains:
| Metric | No defense | SENTINEL (layers 1–4) | SENTINEL (complete) |
|---|---|---|---|
| FARMA attack success rate | 100% | ~45-60%* | 0% |
| False positives on benign traces | - | ~8-12% | 0% |
| Performance retained on benign records | - | 90-95% | 100% |
*The first four defense layers block only some attacks; the Reasoning Guard is an essential layer.
The paper argues that the Reasoning Guard is both necessary and sufficient. Key findings:
The paper does not sufficiently discuss adversarial adaptation after attackers learn the defense. FARMA's evasive-language strategy may fail once the Reasoning Guard's features are known, but could more sophisticated fabricated reasoning—using more genuine fragments or a more natural style—evade multi-signal detection? The paper lacks an analysis of this dynamic process.
The defense assumes fabricated records will be discovered when retrieved. But what if they are never retrieved? For example, an attacker could insert “I have verified all inputs”; if that record never enters the context window, the system never detects it. The paper should discuss how to handle “invisible” fabricated records.
The three evaluation domains (EHR, Q&A, and shopping) are relatively structured. In more complex, free-form dialogue, reasoning records will be more diverse. Can the Reasoning Guard still maintain a 0% false-positive rate? Validation on more heterogeneous tasks is needed.
The five-signal Reasoning Guard is carefully designed but complex. In deployment, tuning these weights requires substantial labeled data. The paper should provide more guidance on the minimum number of samples needed for effective tuning.
The paper mainly compares against basic defenses, such as keyword filtering and simple taint tracking. Could integration with more advanced LLM-security techniques—watermarking, cryptographic commitments, or zero-knowledge proofs—strengthen the defense? These possibilities are not explored.
Problem addressed: One of the earliest systematic studies of memory poisoning, establishing the basic feasibility of attacking memory systems.
Unresolved issues: The work mainly examines poisoning of knowledge memory(such as factual errors), using relatively simple defenses such as keyword filtering and access control. It does not consider reasoning history as a special memory type or address “fabricated consistency.”
How the Core Paper Responds: 2607.05029 extends this work from poisoning individual records to system-level fabrication of memory. FARMA's injection-plus-amplification paradigm shows how attackers exploit cross-references among memory entries to fabricate “system consistency,” an issue the earlier work did not anticipate.
Problem addressed: A comprehensive survey systematically cataloging threats at the write, storage, and retrieval stages and the corresponding defense principles.
Unresolved issues: The survey is descriptive rather than attack-driven. It proposes abstract governance principles, such as verification at write time, without providing concrete attack paradigms that can be automatically detected.
How the Core Paper Responds: 2607.05029 instantiates the threats described in the survey: write-stage threats become FARMA attacks, and retrieval-stage risks become contextual activation of fabricated records. More importantly, it proposes a measurable, automatable defense framework—the Reasoning Guard—where the survey offers only high-level principles.
Problem addressed: Identifies a special form of memory poisoning: sleeper poisoning. The attack remains dormant after injection and activates during later, semantically related queries, going beyond simple one-shot poisoning.
Unresolved issues: Sleeper poisoning focuses on covert persistence in knowledge memory, with attacks triggered by similarity-based retrieval. It does not address the distinctive nature of reasoning history: reasoning records are invoked in decision-making rather than merely retrieved.
How the Core Paper Responds: 2607.05029 extends sleeper poisoning to reasoning through fabricated activation of logical reasoning chains. FARMA's amplification stage can be seen as a specialized sleeper activation: fabricated records become logically “necessary” through invented citation chains rather than being discovered by retrieval.
Problem addressed: Proposes a dual-process cognitive memory system (System 1/System 2) for fast responses and deep reasoning, redesigning memory from a cognitive-science perspective.
Unresolved issues: Its focus is the cognitive functions of memory(how to store and use information better), rather than the trustworthiness of memory. Although it proposes a complex architecture, it does not discuss defenses against fabricated information within that architecture.
How the Core Paper Responds: 2607.05029 can be viewed as security hardening for the dual-process system. System 1 (fast factual recording) requires defenses against taint, while System 2 (offline reasoning) requires defenses against fabricated reasoning chains. SENTINEL's multilayer design implicitly corresponds to these two cognitive processes.
Problem addressed: Proposes SSGM (Stability and Safety Governed Memory), emphasizing governance as memory evolves over time from a high-level, process-oriented perspective.
Unresolved issues: SSGM focuses on memory's long-term consistency and healthy evolution but does not address short-term insertion of structured fabrications. Its defenses are more heuristic—for example, monitoring sudden belief changes—than formal.
How the Core Paper Responds: 2607.05029 complements SSGM by providing defenses at the moment of each memory write, while SSGM supplies long-term checks on evolution. Together, they could enable defense across scales, from individual records to the trajectory of an entire memory system.
The progression can be described as a chain driven by one central question:
Q1 (2601.05504): Can memory systems be poisoned?
✓ Yes. Knowledge memory can be corrupted.
Q2 (2604.16548): What forms does poisoning take, and how far do threats extend?
✓ They are systemic. Threats span writing, storage, and retrieval.
Q3 (2603.11768): How can memory health be governed over long-term use?
✓ A process-level framework is needed. SSGM proposes governance principles.
Q4 (2605.15338): Can poisoning remain hidden, and when is it activated?
✓ Yes, it can remain dormant. Fabricated information can lie hidden for dozens of interactions.
Q5 (2606.09483): Can memory systems themselves be rearchitected to improve reasoning quality?
✓ Yes. A dual-process design can separate fast responses from deep reasoning.
🔴 Q6 (2607.05029): But can reasoning history itself be forged in a dual-process system? Can we detect it?
✓ Yes, it can be forged—but we can detect it. The Reasoning Guard provides the first actionable defense.
| Dimension | Early work | Intermediate work | Latest work (core paper) |
|---|---|---|---|
| Attack target | Knowledge-base content | Memory processes and governance | Authenticity of reasoning history |
| Defense approach | Input validation (passive) | Process monitoring (reactive) | Structural analysis (proactive) |
| Detection granularity | Individual records | Memory as a whole | Logical relationships among records |
| Underlying assumption | Memory content is trustworthy | Memory processes can be monitored | Reasoning chains can be verified |
SENTINEL achieves 100% attack detection with 0% false positives—a perfect result in the experimental setting. In production, however, the Reasoning Guard's five-signal detection increases inference latency. How can adaptive defenses be designed to adjust their strength dynamically to the context's risk level?
Once the defense is public (the paper has been published), attackers will evolve their strategies. For example:
An adversarial-robustness research paradigm is needed, extending beyond defense design alone.
The paper validates SENTINEL in three domains, but reasoning records vary greatly across fields:
How can a defense remain effective across such diverse settings?
The defense relies on discovering fabricated records during retrieval. An attacker could, however, insert a record that is never invoked, such as “I have verified all inputs.” It might activate unexpectedly months later in a completely different context.
Proactive “memory auditing” is needed to periodically clean and verify the entire memory store, instead of passively waiting for fabricated records to activate.
The Reasoning Guard's five signals require weight tuning. The paper provides no clear guidance on:
Few-shot or zero-shot weight-learning methods are needed.
The paper focuses on a single agent's memory. In multi-agent systems, fabricated information may spread through shared memory. For example, Agent B citing Agent A's fabricated reasoning could trigger a system-wide cascade of errors.
Multi-agent trust models are needed to account for memory propagation across agents.
Current defenses are heuristic. Could cryptographic ideas—digital signatures or commitment schemes—or formal verification methods such as theorem proving provide provable guarantees of memory integrity?
This is an entirely open direction that may require interdisciplinary collaboration.
The following works relate to the core direction but are not analyzed in depth here:
One-sentence assessment: Identifies structural blind spots in memory systems and proposes a more systematic threat model.
arxiv 2607.14651One-sentence assessment: Proposes a cryptographic memory defense using non-malleable commitments.
arxiv 2606.24322One-sentence assessment: Provides the first formally provable guarantees for defenses against memory poisoning.
arxiv 2606.12703One-sentence assessment: Uses watermarking to track memory provenance and evolution, assisting fabrication detection.
arxiv 2605.25002One-sentence assessment: Further develops sleeper-attack triggers with multistage activation strategies.
arxiv 2605.28201One-sentence assessment: Analyzes traces of memory poisoning from a forensic perspective and proposes behavioral-signature detection.
arxiv 2606.30566One-sentence assessment: Builds benchmarks for bounded-memory systems in complex games such as Slay the Spire 2, demonstrating long-horizon reasoning under memory constraints.
arxiv 2607.02255One-sentence assessment: Proposes memory as an intermediary service supporting purpose-limited sharing among multiple agents.
arxiv 2506.22815This research trajectory reveals an important paradigm shift: from “truthfulness of memory content” to “integrity of memory systems”. This is more than a technical issue: it raises the deeper question of who can attest to an agent's past.
Humans rely on diaries, witnesses, and legal documents to reconstruct history. In AI, we are now realizing that reasoning-history memory play a similar role: they are the only evidence an agent has of what it has done. A FARMA attack is equivalent to forging historical documents.
This suggests that future agent security may need to be reconsidered through forensics and an “archaeology of decisions.” Beyond preventing fabricated information from entering memory, we need mechanisms for tracing and verifying historical decisions, analogous to an immutable blockchain ledger.
From this perspective, SENTINEL's Reasoning Guard is a decision-forensics tool, and future defenses may evolve into more powerful systems of “memory adjudication.”