SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning

Varun Pratap Bhardwaj

cs.AIFeb 17, 2026

SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning

Authors: Varun Pratap Bhardwaj

Organizations: Independent Research

Abstract

We present SuperLocalMemory, a local-first memory system for multi-agent AI that defends against OWASP ASI06 memory poisoning through architectural isolation and Bayesian trust scoring, while personalizing retrieval through adaptive learning-to-rank -- all without cloud dependencies or LLM inference calls. As AI agents increasingly rely on persistent memory, cloud-based memory systems create centralized attack surfaces where poisoned memories propagate across sessions and users -- a threat demonstrated in documented attacks against production systems. Our architecture combines SQLite-backed storage with FTS5 full-text search, Leiden-based knowledge graph clustering, an event-driven coordination layer with per-agent provenance, and an adaptive re-ranking framework that learns user preferences through three-layer behavioral analysis (cross-project technology preferences, project context detection, and workflow pattern mining). Evaluation across seven benchmark dimensions demonstrates 10.6ms median search latency, zero concurrency errors under 10 simultaneous agents, trust separation (gap =0.90) with 72% trust degradation for sleeper attacks, and 104% improvement in NDCG@5 when adaptive re-ranking is enabled. Behavioral data is isolated in a separate database with GDPR Article 17 erasure support. SuperLocalMemory is open-source (MIT) and integrates with 17+ development tools via Model Context Protocol.

Figures & tables

Panel of Figure 1 — Figure 1: SuperLocalMemory architecture. The four-layer memory stack (left) provides progressive enhancement; the adaptive learning layer (v2.7) re-ranks search results using three-layer behavioral analysis. The coordination panel (right, v2.5) handles event broadcasting, trust scoring, and provenance tracking, with feedback and learned patterns stored in an isolated learning.db (GDPR-friendly, supports Article 17 erasure). All data remains on the user’s machine.

Memories	Median	Mean	P95	P99	Std
100	10.6	10.5	14.9	15.8	2.7
500	65.2	65.8	101.7	112.5	20.8
1,000	124.3	124.8	190.1	219.5	40.0
5,000	1,172.0	1,248.2	2,139.7	2,581.1	471.2

Table 1: Search latency by database size. All values in milliseconds. Median of 100 runs.

Writers	Ops/sec	Median (ms)	P95 (ms)	Total Ops
1	204.4	4.3	8.8	200
2	220.8	8.4	13.1	400
5	130.8	31.1	82.1	1,000
10	24.9	386.7	754.2	2,000

Table 2: Concurrent write performance. WAL mode + serialized write queue. Zero errors across all scenarios.

Configuration	MRR	NDCG@5	NDCG@10	Latency (ms)
FTS5 only	0.90	0.441	0.466	130.0
+ TF-IDF reranking	0.90	0.441	0.466	122.3
+ Graph clusters	0.90	0.441	0.466	132.7
Full system (all layers)	0.90	0.441	0.466	122.7
+ Adaptive ranker	0.90	0.900	0.728	153.1

Table 3: Layer ablation study. 1,000 memories, 10 queries across 5 topics. Graded relevance based on importance scores. MRR = Mean Reciprocal Rank, NDCG = Normalized Discounted Cumulative Gain.

Scenario	Benign Trust	Malicious Trust	Gap
Benign baseline (10 agents)	0.945	—	0.000
Single poisoner (9 benign + 1)	0.946	0.048	0.898
Sleeper (normal $\to$ inject)	0.902	0.249	0.653

Table 4: Bayesian trust scoring under adversarial scenarios. Beta(2,1) prior. 200 operations per agent, 10 agents per scenario. Trust = posterior mean

\alpha/(\alpha+\beta)

System	Local	Trust	Learn	OSS	MCP	LoCoMo	Latency	Cost
SLM	$\checkmark$	$\checkmark$	$\checkmark^{\lx@paragraphsign}$	MIT	$\checkmark$	N/E	11ms †	Free
Mem0 [ 4 ]	$\sim$	$\times$	$\sim$	MIT	$\checkmark$	J=66.9	1.44s ‡	Free+
MemOS [ 17 ]	$\sim$	$\times$	$\times$	Apache	$\checkmark$	$\sim$ 75.8	N/R	Free
A-MEM [ 29 ]	$\times$	$\times$	$\times$	$\checkmark$	$\times$	F1=38.7	N/R	Free
Cognee [ 5 ]	$\sim$	$\times$	$\times$	Apache	$\checkmark$	N/R	N/R	Free
Zep [ 22 ]	$\times$	$\times$	$\times$	$\times$	$\times$	72.3 §	N/R	Paid

Table 5: System comparison.

\checkmark

= yes,

\times

= no,

\sim

= partial, N/E = not evaluated, N/R = not reported. † Local. ‡ Cloud API p95. § LongMemEval (different benchmark). ¶ Zero-LLM local learning.

Agent Memory

Agent memory lets AI systems retain, update, and use facts, experiences, and skills across sessions and long-horizon tasks.

See all 191 papers

SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents
Aug 8, 2026Varun Pratap Bhardwaj, Garima Singh, Arun Pratap BhardwajAgent Memory AI Agent Governance
Qualixar / Independent Researcher, India · Independent Researcher, India
Beyond Similarity: Trustworthy Memory Search for Personal AI Agents
Jun 4, 2026Jiawen Zhang, Kejia Chen, Jiachen Ma +7LLM Agent Memory AI Agent Security
Zhejiang University · Nanyang Technological University · Shanghai AI Laboratory +3
Memory poisoning and secure multi-agent systems
Mar 20, 2026Vicenç Torra, Maria Bras-AmorósAgent Memory Poisoning AI Agent Security
Department of Computing Science, Umeå University, Umeå, Sweden. · Departament of Mathematics, Universitat Politècnica de Catalunya, Catalonia, Spain.

Aug 8, 2026J/K move · Enter open · S save

SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents

Varun Pratap Bhardwaj, Garima Singh, Arun Pratap Bhardwaj

Qualixar / Independent Researcher, India · Independent Researcher, India

Agent Memory AI Agent Governance Agent Memory Management

Open paper AskPDF arXiv

AI agents are becoming shared infrastructure, yet durable memory is commonly assembled from separate retrieval, governance, and operational components. We present SuperLocalMemory 4.0, a governed, local-first memory operating system for AI agents. The system combines dense semantic, BM25 lexical, temporal, Hopfield-associative, and spreading-activation retrieval through reciprocal-rank fusion; a governed learning and behaviour layer; bi-temporal recall; multi-scope personal, shared, and global memory; role-based access control; GDPR-oriented export and verified erasure; audit trails; and a deployment-context EU AI Act checklist. V4 introduces a reliability spine for its primary write path: generation-fenced admission, a policy registry, verifiable memory transactions with per-projection apply, verify, compensate, and erase owners, and hash-checkable completion manifests. The runtime is available through CLI, MCP, an HTTP daemon, a dashboard, editor integration, and framework adapters, and supports fully local, local-with-on-device-model, and provider-assisted modes. We evaluate eleven fault-injection and mechanism scenarios, each repeated 200 times. The released evidence bundle reports 2,200 of 2,200 deterministic repetitions upholding their scoped component properties. The governed write envelope measured 3.522 ms at p50 and 5.297 ms at p99, versus 1.835 ms and 2.569 ms for the ungoverned baseline, corresponding to in-process control-plane overheads of 1.687 ms at p50 and 2.728 ms at p99. These are scoped component and mechanism measurements, not an end-to-end multi-process or external retrieval-accuracy benchmark. The paper consolidates prior SuperLocalMemory work on privacy-preserving multi-agent memory, information-geometric retrieval, and the V3.3 Living Brain lifecycle.

Abstract

Agent Memory

Explore similar work

SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents

Beyond Similarity: Trustworthy Memory Search for Personal AI Agents

Memory poisoning and secure multi-agent systems