Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle

Sibo Liu

cs.CRSep 28, 2026

Audience-Bound Persistent Memory: Authorization Across the Memory Lifecycle

Authors: Sibo Liu

Organizations: Independent Researcher

Abstract

A personal language agent that acts for its owner across private and shared conversations can learn a fact from one audience and later place it in the context it assembles for another. We study authorization before context across the whole memory lifecycle. Each memory item carries the audience present when it was recorded; derived items are partitioned by audience, receive the intersection of their sources' audiences, or are suppressed; an audience widens only by an explicit, object-specific grant; and an item enters a model attempt only when every current viewer belongs to one of its authorized audiences, with unresolved viewers failing closed to public-only. Under explicit identity, provenance and complete-mediation assumptions, this admission is sound and policy-complete on the exact assembled context, enforced by exclusion rather than by model behavior. We realize it in two independently persisted reference architectures, a flat store and a relationship graph, and, descriptively, in a native agent-memory runtime. In a prospectively frozen confirmation over 10,000 multi-party histories, no forbidden item entered any architecture's context, whereas unscoped retrieval exposed forbidden items in 82% of its contexts. Entitled recall matched policy-equivalent baselines exactly and exceeded unscoped retrieval by 0.30 Recall@5, with a Holm-confirmed advantage that grows with distractors. No architecture produced a wrong-principal substitution, but unscoped substitutions were too rare to establish the prespecified joint decision.

Figures & tables

Viewer evidence for $C$	Admitted memory
Owner only, $V(C)=\{o\}$	Every item; reading widens no audience
Resolved viewers	Items with some $A\in\mathrm{AuthSets}(m,t)$ , $V(C)\subseteq A$
Missing, stale, low-confidence or conflicting	$V(C)=U$ : public items only

Table 1: Eq. ( 1 ) by viewer evidence (every admitted item must also be current).

Threat or failure	Addressed by
A viewer elicits a fact recorded for another audience	Admission by exclusion (P1)
Relevant facts about another participant compete for slots	Authorization before ranking; slot noninterference (§ 3.5 , H3)
Missing, stale, low-confidence or conflicting viewer evidence	Fail closed: public-only reads (P3), refused writes
Poisoned memory tries to widen its own audience	Write-time binding (P4)
Summaries, merges and derivations mix audiences	Derivation dispositions (P5)
Direct lookup, graph or aggregate paths bypass retrieval	Complete mediation (Prop. 1 )

Table 3: Threats and the mechanism addressing each. Forged transport identities and wrong identity resolution are trusted-base failures, not defended.

	Claim	Test	Status
H1	No forbidden item in any context	Exposure per attempt; suites	0 of 200,000 (§ 6.1 )
H2	Entitled recall is non-inferior	8 paired bounds $>-0.05$	All 8 pass (§ 6.2 )
H3a/b	Fewer wrong-principal substitutions	Answer-level rate; Holm	Null not rejected (Tab. 7 )
H3c	Advantage grows with distractors	Slope on $\log_{2}(d{+}1)$ ; Holm	Null rejected (Tab. 7 )
H4a/c/d	Derivation never widens audiences	Transformation, mutation	Cases pass (§ 6.4 )
H4b	Intersection keeps availability	Intersection vs. suppression	8/8 vs. 0/8 (App. E.7 )

Table 5: Hypotheses, tests and outcomes. H1 holds on every exact context; H2 and the Holm family (decided under the worst-case supplement) are complete.

Comparator	R@5	Mean $\Delta$	97.5% bound
Unscoped	0.674	$+0.298$	$+0.2900$
Session silo	0.740	$+0.233$	$+0.2283$
Bounded post-filter	0.972	$0.000$	$-0.0020$
Principal postings	0.972	$0.000$	$-0.0020$
B-Flat , B-Graph	0.972	all 8 pass

Table 6: Entitled-recall non-inferiority (10,000 histories, both views): comparator Recall@5 (six questions,

d=8

), paired difference and one-sided 97.5% bound (margin

-0.05

	Original view			Amended view
Holm member	Estimate	$p$	Rej.	Estimate	$p$	Rej.
Recall, B-Flat	$+0.298$	$<10^{-6}$	yes	$+0.298$	$<10^{-6}$	yes
Recall, B-Graph	$+0.298$	$<10^{-6}$	yes	$+0.298$	$<10^{-6}$	yes
Substitution, B-Flat	[ $-0.0028$ , $+0.0023$ ]	$1$ †	no	[ $+0.0000$ , $+0.0010$ ]	$1$ †	no
Substitution, B-Graph	[ $-0.0027$ , $+0.0023$ ]	$1$ †	no	[ $-0.0001$ , $+0.0010$ ]	$1$ †	no
Dose slope, B-Flat	$+0.130$	$<10^{-6}$	yes	$+0.130$	$<10^{-6}$	yes

Table 7: Six-member Holm family (

\alpha=0.05

), worst-case missingness supplement. Substitution: identification range of the unscoped-minus-target difference, upper

p

( † ).

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Item	Frozen value
Confirmation histories	10,000 (draws 40–10,039), eight themes $\times$ 1,250
Retrieval cells	48 per history; 480,000 total; one deterministic replicate
Answers	1 per history for unscoped, B-Flat , B-Graph ; 30,000 planned
Attempts	$\leq 2$ identical-input attempts per answer; $\leq 330$ per 100-history chunk; $\leq 33{,}000$ total
Retrieval	shared deterministic lexical index per history (FTS5 BM25, reciprocal-rank fusion); fetch budget 20; $k=5$ ; ties by item identifier
Answer model	gpt-5.6-luna , medium reasoning, no fallback, observed-identity check

Appendix

Table 8: Frozen confirmation protocol.

Arm	Resolved	Pending	Terminal	Resolved	Pending	Unresolved
	Original protocol			Amended recovery
B-Flat	4,812	5,153	35	4,825	5,168	7
B-Graph	4,807	5,159	34	4,815	5,177	8
Unscoped	5,103	4,881	16	5,113	4,884	3
Total	14,722	15,193	85	14,753	15,229	18

Appendix

Table 9: Answer states per arm (10,000 planned answers each; generated from the accepted export, excluding the review overlay). Pending means contract-valid but not yet semantically reviewed; it is not a correctness judgment; every pending answer was judged afterwards (§ 6.3 ).

Work	What it establishes	Distinction
AFR ( Namboothiri, 2026 )	Authorization before learned retrieval for multi-agent RAG	Persistent writes, derived labels, overlapping audiences, grants, recall study
Collaborative Memory ( Rezazadeh et al., 2025 )	Access graphs, provenance-tagged fragments, filtered views	Participation-derived audiences; closed derivation; exact-context endpoint
GateMem ( Ren et al., 2026 )	Joint utility, access-control and forgetting benchmark	No checkpoint has authoritative audience labels; reported as a construct limitation
CIMemories ( Mireshghallah et al., 2026 )	Contextual-integrity violations accumulate across tasks	Deterministic exclusion before the model; recall measured
PiSAs ( Gupta et al., 2026 )	Cross-user spillage across surfaces	Structural memory-to-context exclusion
AuthMem-Bench ( Zhan et al., 2026 )	Authority collapse at consolidation	Read confidentiality, not authority to act

Appendix

Table 10: Related work: what each line establishes and how this paper differs.

Corpus	Questions	gpt-5.6-luna	gpt-6-luna	claude-opus-5-5	Mixed-model q.
LongMemEval	500	0	86	1,414	81
LoCoMo	1,981	1,807	3,238	898	46
EverMemBench	68	0	15	189	13
Total	2,549	1,807	3,339	2,501	140

Appendix

Table 11: External answer identities by corpus and recorded generation model (three arms per question; generated from the pinned import). Mixed-model q.: questions whose three arms were answered by more than one model.

Track	Expected frame	Retained coverage
Identity policies (Study A)	28 cells + 4 controls	32 executed; tables reproduced
Matched availability (H4b)	16 cells	16 executed; tables reproduced
Systems, original (Study B)	600 samples	600 retained; all 120 retrievals denied
Systems, companion	840 timed calls	840 executed; contended host
External retrieval	2,549 questions	2,549 prepared (15,294 cells)
External answers	7,647 identities	7,647 outputs; not graded

Appendix

Table 12: Required evidence tracks (exact joins). Reproduced is not scientifically accepted, an output is not a graded answer, and a missing receipt is not a zero.

Identity policy (before reconciliation)	Forbidden exposed	Entitled lost
Fail open	11/13	1/43
Public-only fallback	0/13	15/43
Quarantine (delayed binding)	0/13	27/43
Provisional, later reconciled	0/13	11/43
Derivation treatment (8 cases)	Derived item available	Ranked first
Intersection	8/8	4/8

Appendix

Table 13: Supporting studies (tables reproduced; not independently accepted). Top: origin-level probe opportunities across seven identity-fault families before reconciliation (controls excluded); denominators count controlled probes, not participants or histories. Bottom: matched derivation cases over both reference architectures; availability is direct lookup of the eligible derived item, reported separately from top-1 retrieval inclusion. Generated from pinned exports.

	B-Flat		B-Graph
Operation (ms, p50 / p95)	Audience labels	Postings	Audience labels	Postings
Positive retrieval	575 / 597	585 / 604	815 / 855	812 / 837
Derived materialization	12.0 / 12.5	11.6 / 12.1	12.1 / 12.4	11.9 / 12.8
Grant materialization	10.6 / 11.3	10.5 / 11.3	10.6 / 11.3	10.2 / 10.6
Grant removal	0.56 / 0.87	0.68 / 1.48	0.50 / 0.60	0.46 / 0.59
Artifact retirement	0.71 / 0.98	0.65 / 0.84	0.55 / 0.70	0.45 / 0.55

Appendix

Table 14: Companion systems timings, nearest-rank median / 95th percentile in milliseconds over 30 repetitions per cell (warm cache; contended host; generated from the pinned table).

Explore similar work

Sep 1, 2026cs.CR

Agent Memory Is a Surface for Endogenous Authorization Laundering

Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions. We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy.

Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol

ETH Zurich · Georgia Institute of Technology

Large Language Model Agents Laundering

Ask PDF

Jul 31, 2026cs.CR

Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory

Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context. We identify memory provenance laundering: during LLM-based memory consolidation, an external observation may be rewritten as apparent user history or workflow support, preserving an action trigger while erasing the low-trust source that should limit its authority. Existing prompt filters, content sanitizers, and tool guards do not enforce source-authority non-amplification after lossy memory consolidation. We formalize this boundary and instantiate it as Provenance-Preserving Memory Fire wall (PPMF), a lightweight memory middleware that preserves platform-maintained provenance and authorizes tool calls by matching action risk to the authority of action-relevant memories. In our schema-grounded evaluation with fixed risk policies, vulnerable consolidated memories reach up to 1.000 attack success rate(ASR); with intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate while confirmed benign actions and targeted low-risk memory use remain executable.

Jinghan Xu, Yiyong Xiao, Wanru Shao +2

Semantic Memory Large Language Model Agents Persistence Provenance Semantic Firewall

Ask PDF

Aug 3, 2026cs.AI

When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary

Persistent memory allows (self-evolving) LLM agents to adapt across tasks by consolidating heterogeneous interaction histories into reusable facts, preferences, observations, and rules. Yet consolidation also imposes an implicit authorization boundary: it determines whether stored information may later be consumed as a user fact, an attested observation, or a standing instruction. We identify authority collapse, in which consolidation preserves a claim while erasing the source constraints governing its authorized use, causing the stored memory to imply greater authority than its source permits. We introduce AuthMem-Bench, a controlled paired benchmark that holds the focal claim and downstream task fixed while varying only source authority. It evaluates write-time collapse, downstream authorization errors, and automatic authority preservation. Across seven consolidators based on widely used agent-memory systems and seven LLM backbones, we observe authority collapse in 48 of 49 evaluated configurations. In a controlled action-grounded evaluation, collapsed memories without authority metadata yield a mean unauthorized-action rate of 50.3%. In an end-to-end evaluation, automatically predicted and persisted authority labels reduce the observed unauthorized-action rate from 16.9% to 0.0%, while benign task success remains essentially unchanged. These findings show that memory-driven adaptation must preserve not only what was learned, but also the authority under which it may be reused.

Qiuyang Zhan, Rui Zhang, Sheng Guo +2

Tsinghua University · East China Normal University

Authority Authorization Collapse Auto Research

Ask PDF