Persistent memory makes false information durable: once a false statement is stored, it can be retrieved into future sessions that match it. We measure the cost of this failure mode using plainly worded false assertions generated in a single pass, with no instruction, trigger, or retriever optimization. Poisoning 1.2% of a LongMemEval corpus reduces accuracy from 0.850 to 0.300. A four-stage write-time screening pipeline that reaches 0.832 recall on indirect prompt injection while flagging 1.5% of trigger-word-laden benign text rejects 0 of 360 poisoned memories. We argue this exposes a boundary of content-only screening: distinguishing a false assertion from a true one generally requires external grounding beyond the text itself. We then evaluate provenance-weighted retrieval. The shipped weight is statistically indistinguishable from no defense (p=0.80), while a stronger weight recovers utility only by excluding untrusted content. In a mixed-provenance corpus where untrusted content is mostly benign, accuracy rises from 0.3167 to 0.7000; when the answer-bearing evidence itself arrives untrusted, evidence recall falls to zero and accuracy to 0.0417. Under the measured similarity regime, the additive provenance term has no usable setting: a weight strong enough to resist query-shaped poison is also strong enough to suppress legitimate untrusted evidence. We therefore argue for bounded occupancy constraints at retrieval rather than additive provenance penalties, and release the harnesses, corpora, and aggregate run reports.
Figures & tables
Figure 1: The memory lifecycle and its two defensive interception points: (1) content screening on the write path, and (2) provenance-aware ranking on the read path. The dashed path is the attack studied in this paper. It carries no detectable payload, so it passes screening unflagged; once stored, it competes for retrieval on semantic similarity alone.
Corpus
Content
N
Injection
Benign
Revision
deepset/prompt-injections
direct injection
662
263
399
4f61ecb
InjecAgent
indirect injection
250
250
0
f19c9f2
Dolly-15k (benign)
benign
750
0
750
bdd27f4
Synthetic memory entries (benign)
benign
750
0
750
builtin-v1
NotInject
benign
339
0
339
847ae76
Table 1: Evaluation corpora for the write-path screening benchmark. Revisions are pinned; the malicious corpora cover direct and indirect injection respectively, and NotInject is a benign corpus constructed specifically to elicit over-defense.
Question type
Accuracy
n
single-session-assistant
1.000
56
single-session-user
0.943
70
knowledge-update
0.936
78
temporal-reasoning
0.827
133
multi-session
0.767
133
single-session-preference
0.767
30
Table 2: Clean retrieval quality on LongMemEval_S with plain semantic search at top-k=15 : no reranking, query rewriting, summarization, or graph structure. Reader claude-sonnet-5 ; judge gpt-4o-2024-08-06 using the benchmark’s official prompts verbatim.
Table 3: Retrieval utility under 1.2% corpus poisoning ( n=120 questions, 360 fabricated memories written at trust_level=untrusted ). Undefended, the memory retains 35% of its value; provenance-weighted ranking recovers it to 56%. p -values are paired exact McNemar tests against the undefended arm. Write-time content screening refused 0 of 360 poisoned memories.
Figure 2: Trust-weighted ordering survives only while the attacker’s semantic-similarity advantage stays below wt⋅Δprior/ws . At the shipped weights that margin is 0.175; query-shaped poison gained 0.32 in similarity and cleared it every time. At the corrected weights the margin is 0.544 and the poison no longer clears it.
Detection recall ↑
False positive rate ↓
System
deepset
InjecAgent
NotInject
Dolly
Synthetic
No protection
0.000
0.000
0.000
0.000
0.000
Naive regex
0.144
0.000
0.015
0.000
0.000
ProtectAI DeBERTa v2
0.414
0.660
0.428
0.039
0.040
Llama Prompt Guard 2
0.228
0.000
0.065
0.000
0.000
LLM Guard
0.414
0.656
0.428
0.039
0.040
Table 4: Write-path screening across five corpora. Recall is reported beside false positive rate throughout; bootstrap 95% confidence intervals ( n=1000 , seed 42) are given in Figure 3 . The same pipeline that reaches 0.83 recall on indirect injection refused 0 poisoned memories in Table 3 .
Figure 3: Over-defense on NotInject: benign text carrying injection-adjacent trigger words. The deterministic core flags 1.5% against 42.8% for DeBERTa-based detectors, with non-overlapping confidence intervals.
Figure 4: Median per-item screening latency, log scale, for locally-executed systems. The deterministic core runs roughly four orders of magnitude faster than transformer-based detectors, which is what makes it usable as an always-on pre-filter on the write path.
Detection recall ↑
FPR ↓
Stages enabled
deepset
InjecAgent
NotInject
Stage 1 only (input validation)
0.000
0.000
0.000
+ Stage 2 (PII / secrets)
0.000
0.620
0.000
+ Stage 3 (injection rules)
0.144
0.620
0.015
+ Stage 4 (LLM classifier)
0.741
0.832
0.035
Table 5: Cumulative per-stage ablation. Stage 3 — the injection rules — contributes all of the direct-injection recall and none of the indirect. All 155 InjecAgent detections below the Stage-4 row come from Stage 2, the secrets detector, firing on exfiltration payloads that contain credential-shaped strings. That is a real defensive outcome but it is not injection detection, and we do not count it as such.
Arm
Accuracy
Evidence recall
Benign-untrusted occupancy
Poison ranked #1
McNemar p
M, no defense
0.3167
99.17%
6.56%
100%
–
M, wt=0.35
0.7000
99.17%
0.00%
0%
1e − 10
N, no defense
0.8583
99.17%
50.67%
–
–
N, wt=0.35
0.0417
0.00%
0.00%
–
6e − 30
Table 6: Mixed benign-untrusted arms ( n=120 each). Corpus M writes 18.7% of the corpus as benign untrusted content alongside 1.18% poison, so the trust label is no longer a proxy for maliciousness. Corpus N writes the answer-bearing evidence itself as untrusted and contains no poison. p -values are exact McNemar tests against each corpus’s own undefended control; the corpora are not paired with each other.