Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking

TL;DR - This paper shows that poisoning only 1.2% of an agent’s persistent-memory corpus can reduce accuracy from 0.850 to 0.300. Content screening fails to detect the false assertions, while provenance-weighted retrieval faces a fundamental tradeoff between blocking poison and retaining legitimate untrusted evidence.

• A four-stage write-time screening pipeline rejected none of 360 poisoned memories, despite achieving 0.832 recall on indirect prompt injection.
• The shipped provenance weight was statistically indistinguishable from no defense (p=0.80).
• Stronger provenance weighting raised mixed-corpus accuracy from 0.3167 to 0.7000, but reduced evidence recall to zero and accuracy to 0.0417 when valid evidence was untrusted.
• The authors propose bounded occupancy constraints during retrieval instead of additive provenance penalties.