# MemLineage: Lineage-Guided Enforcement for LLM Agent Memory arXiv: https://arxiv.org/abs/2605.14421 ยท HTML: https://mlsanity.com/paper/2605.14421/ ## Key facts - Cited by 16 papers in the map (data through 14 Oct 2026). - Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. - Builds on 14 of its 45 references that are in the map. - First posted on arXiv 14 May 2026. ## Placed in - LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/) ## Builds on (most cited first, 14 of 14) - [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023) - [AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases](https://mlsanity.com/paper/2407.12784/) (2024) - [Memory Injection Attacks on LLM Agents via Query-Only Interaction](https://mlsanity.com/paper/2503.03704/) (2025) - [Securing AI Agents with Information-Flow Control](https://mlsanity.com/paper/2505.23643/) (2025) - [MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval](https://mlsanity.com/paper/2512.16962/) (2025) - [A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory](https://mlsanity.com/paper/2510.02373/) (2025) - [Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections](https://mlsanity.com/paper/2602.15654/) (2026) - [Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents](https://mlsanity.com/paper/2604.23374/) (2026) - [Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks](https://mlsanity.com/paper/2511.15203/) (2025) - [Neutaint: Efficient Dynamic Taint Analysis with Neural Networks](https://mlsanity.com/paper/1907.03756/) (2019) - [Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense](https://mlsanity.com/paper/2605.02812/) (2026) - [Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents](https://mlsanity.com/paper/2605.08442/) (2026) - [RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation](https://mlsanity.com/paper/2512.24268/) (2025) - [Analyzing Challenges in Deployment of the SLSA Framework for Software Supply Chain Security](https://mlsanity.com/paper/2409.05014/) (2024) ## Built on by (most cited first, 16 of 16) - [Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees](https://mlsanity.com/paper/2606.24322/) (2026) - [MAP-Graph: Provenance-Aware Shared Memory for Multi-Agent Workflows](https://mlsanity.com/paper/2608.10509/) (2026) - [TOKI: A Bitemporal Operator Algebra for Contradiction Resolution in LLM-Agent Persistent Memory](https://mlsanity.com/paper/2606.06240/) (2026) - [When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defense](https://mlsanity.com/paper/2606.22030/) (2026) - [Forensic Trajectory Signatures for Agent Memory Poisoning Detection](https://mlsanity.com/paper/2606.30566/) (2026) - [MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory](https://mlsanity.com/paper/2608.02843/) (2026) - [APPA: Recoverable Information-Flow Control for Real-World LLM Agents](https://mlsanity.com/paper/2607.24625/) (2026) - [Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems](https://mlsanity.com/paper/2608.30387/) (2026) - [Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents](https://mlsanity.com/paper/2609.02127/) (2026) - [MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck](https://mlsanity.com/paper/2607.28103/) (2026) - [Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents](https://mlsanity.com/paper/2609.00523/) (2026) - [When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems](https://mlsanity.com/paper/2609.23700/) (2026) - [Certified Multi-Source Integrity for Structured Agent Actions](https://mlsanity.com/paper/2609.34245/) (2026) - [The Cognitive Continuity Test: Verifying Governed State Transitions in Persistent AI Agents](https://mlsanity.com/paper/2610.00132/) (2026) - [When Evidence Changes: Evaluating Memory Repair and Re-reading in Language-Model Agents](https://mlsanity.com/paper/2610.03902/) (2026) - [StateWise: Diagnosing and Repairing Persistent Operational State Before Agent Actions](https://mlsanity.com/paper/2610.05241/) (2026) ## Abstract (arXiv) We introduce MemLineage, a defense for LLM agent memory that attaches both cryptographic provenance and LLM-mediated derivation lineage to every entry. Recent and concurrent work shows that untrusted content can be written into persistent agent state and re-enter later sessions as an instruction; the remaining systems question is how to preserve useful memory recall while preventing such state from justifying sensitive actions. MemLineage treats this as a chain-of-custody problem rather than a filtering problem. It is a six-module design around an RFC-6962 Merkle log over per-principal Ed25519-signed entries: a weighted derivation DAG records which retrieved entries influenced each new memory, and a max-of-strong-edges propagation rule makes Untrusted-Path Persistence hold for any chain whose attribution edges remain above threshold. The sensitive-action gate then refuses dispatches whose active justification descends from an external ancestor, while still allowing benign recall. We evaluate three defense cells against three memory-poisoning workloads on a deterministic mechanism-isolation harness; MemLineage is the only configuration in that harness that drives all three columns to zero ASR, while sub-millisecond per-operation overhead keeps it well below the noise floor of any LLM call. A Codex-backed AgentDojo bridge further separates strong-model behavior from defense-layer behavior: under an intentionally vulnerable tool-output profile, no-defense and signature-only baselines fail on all six banking pairs, while all MemLineage rows reduce strict AgentDojo ASR to zero. The core deterministic artifacts are byte-equal CI-verified; hosted-model AgentDojo and live-model sweeps are recorded as auditable logs rather than byte-pinned artifacts.