Persistent Memory Poisoning in Long-Lived AI Agents: A Threat Analysis and Trust-Aware Memory Defense Framework

Abstract

Many artificial intelligence (AI) agents use persistent memory to maintain context, remember user preferences, and streamline tasks across multiple interactions with a user. This capability enables long-term personalization, but also creates a security risk because the agent's behavior could be affected by information from an earlier interaction, including information from an adversarial source. Persistent memory poisoning is a form of attack in which malicious information continues to affect the agent even after its original source is no longer present. In this paper, persistent memory poisoning in long-lived AI agents is explored, and a trust-aware defense framework called M-Guard is introduced, which incorporates provenance tracking, memory-write validation, trust-aware retrieval, temporal revalidation, and execution-time verification. The proposed research methodology is based on a series of controlled scenarios that include direct memory injection, multi-record contamination, delayed trigger-based poisoning, and provenance laundering. A simulation-based evaluation compares five configurations: unrestricted memory, prompt-level filtering, write-time filtering, trust-aware retrieval, and the complete M-Guard framework. The evaluation measures attack success, legitimate task completion, the false-positive rate, and utility retention. In a single seeded simulation run over 1,000 multi-session trajectories (500 adversarial and 500 benign), M-Guard reduced the attack success rate from 72.4% (362/500 adversarial trajectories) under unrestricted memory to 12.8% (64/500; 95% CI 10.2–16.0%) while keeping benign task completion at 89.2% (446/500), compared with 94.2% (471/500) for unrestricted memory. This study argues that persistent memory should be treated as a security boundary rather than assumed to be a trusted store of knowledge. The proposed framework provides a basis for reproducible experimentation and subsequent validation with real AI agents.