PerMIT adds machine-checked integrity controls for LLM agent memory
Original title: PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust
On Trojan Hippo, the authors report zero attack success when self-verification and lightweight verifiers confirm memory.
PerMIT treats only user-typed inputs and gate-confirmed values as trusted, mediating untrusted environment-derived memory through a finite interface. Two integrity theorems, machine-checked in Lean 4, say such memory reaches a sensitive action only after gate confirmation and affects behavior only through what the gate displays. The authors report zero observed attack success on Trojan Hippo with self-verification. Simulated communities of up to 90 agents on τ²-bench shared knowledge with no direct memory injection promoted.
Unconfirmed: Zero attack success and the co-scaling property are author-reported under stated assumptions and simulation.
- Endorsed items can become community-confirmed without further per-user verification.
- The co-scaling claim says poison and wrongful-eviction risks fall as communities grow.
- New agents improved on held-out tasks using the shared knowledge base.
- Theorems are machine-checked in Lean 4 under an explicit trust assumption.
From the original article
1 min read at arxiv.orgPersistent memory is a largely undefended surface for injection and poisoning, and the same risk limits memory sharing among agents. We present PerMIT, a memory architecture with provable integrity guarantees under an explicit trust assumption: only user-typed inputs and values confirmed at a gate are trusted.
By Tanqiu Jiang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.