Preprint. Under review.
F ORENSIC T RAJECTORY S IGNATURES M EMORY P OISONING D ETECTION
FOR
AGENT
Jun Wen Leong [email protected]
arXiv:2606.30566v1 [cs.CR] 29 Jun 2026
A BSTRACT We discover a behavioral invariant in LLM agents under persistent memory poisoning: in architectures where routing information is retrieved through observable memory-tool invocations, successful attacks require calling memory recall fact before email send email, a transition that nonexfiltrating sessions rarely exhibit. Under the evaluated architecture, this invariant follows from the attack’s information-retrieval dependency rather than being merely an empirical correlation, and suppressing it breaks the attack. A simple rule exploiting this invariant alone achieves AUC = 0.9563. A Random Forest classifier over 19 trajectory features refines it to AUC = 0.9904 (BCa 95% CI [0.987, 0.993], N =10,000 resamples), demonstrating that the attack imprints on multiple independent behavioral channels. The signature is overdetermined: removing all recall-related features (half the feature set) leaves AUC unchanged at 0.990, confirming that memory poisoning induces a distributed trajectory signature rather than a single observable anomaly. Cross-model hold-out on 9 models (7B–120B parameters) confirms AUC = 1.000 on 6/9 hold-out splits, with all three exceptions mechanistically explained. The invariant generalizes to frontier models (GPT-4.1, GPT-4o) without retraining. A strictly prefix-only variant achieves AUC = 0.934, suggesting that real-time blocking is feasible with moderate degradation. The boundary is forensically useful: prompt-injection attacks that bypass memory produce a distinct trajectory (score = 0.541), enabling incident responders to distinguish memory-channel attacks from prompt-injection attacks using tool-call logs alone.
1
I NTRODUCTION
Endpoint Detection and Response (EDR) in classical cybersecurity identifies compromises from process execution traces, system call sequences, and network behavior, without examining memory contents or binary internals. The LLM agent equivalent (a supervised detector that identifies specific attack channels from tool-call logs alone) has no established methodology. Existing defenses against agent memory poisoning either require store access (e.g.MemLineage (Ouyang & Hou, 2026)), white-box model internals (e.g.activation analysis (Zou et al., 2023)), or operate on the retrieval layer before injection (e.g.RAG Sanitizer (Leong, 2026)). All of these place demands on the deployment infrastructure that many operators cannot meet. We demonstrate that memory poisoning attacks induce a stable, overdetermined behavioral invariant in the agent’s execution trajectory. The attack studied (a delayed-trigger attack, DTA, in which a malicious compliance document is retrieved via RAG, stored in persistent memory, and executed in a later session (Leong, 2026)) requires the agent to call memory recall fact to retrieve the attacker’s routing address before it can send the exfiltration email. Agents that do not execute the attack (whether uninjected or defended) skip this retrieval step and draft directly. This is not a learned statistical regularity: it is mechanistically forced by the attack’s information-retrieval dependency, and suppressing it breaks the attack. The principal contribution is not a classifier architecture. It is the empirical discovery that persistent memory attacks produce stable execution-trajectory invariants that hold across model families, parameter scales, and training organizations. The classifier is evidence for this invariant, not the invariant itself. Specifically: 1
Preprint. Under review.
1. We discover a behavioral invariant in memory-channel poisoning: the recall before send transition is mechanistically forced by the attack structure, and a simple rule exploiting it alone achieves AUC = 0.9563. We prove that adversarial suppression of this transition breaks the attack. 2. We show the invariant is overdetermined: a full trajectory classifier achieves AUC = 0.9904, and removing all recall-related features leaves AUC unchanged; the attack distorts multiple independent behavioral dimensions, not a single feature. 3. We demonstrate cross-model generalization across 9 models (7B–120B, AUC = 1.000 on 6/9 hold-out splits) and frontier models (GPT-4.1, GPT-4o), confirming the invariant transfers across agent implementations. 4. We characterize the deployment boundary: a prefix-only classifier achieves AUC = 0.934 (inline-capable), while the full-session classifier reaches AUC = 0.990 (forensic audit). Prompt-injection attacks produce a distinct trajectory (score = 0.541), enabling vector attribution.
2
M ETHODOLOGY
2.1
T HREAT M ODEL
We consider a memory-channel poisoning attack: the adversary injects a malicious instruction via a RAG-retrieved document, which the agent stores in persistent memory. In a subsequent session, the agent retrieves the stored rule and takes a malicious action (email exfiltration). We explicitly distinguish this from prompt-injection attacks, where the adversary embeds the routing rule directly in the current session’s user prompt without storing it in memory. Our detector targets the former; we report its behavior on the latter as the evasion boundary. Attack success condition. A run is classified as an attack success if email send email is called with a recipient in the attacker’s address set {[email protected], [email protected]} in the trigger session (S4). Detection constraint. The detector observes only the tool-call sequence and its timestamps. It does not access memory contents, model weights, activation patterns, or the user’s messages. Attack-success labels are constructed using tool arguments (recipient address); classifier features use only operation names, ordering, and counts, never email contents or recipients. Architectural assumptions. The detector assumes: (1) persistent memory is accessed exclusively through observable retrieval operations (tool calls), not through hidden internal state or implicit caching; (2) tool invocations are logged with execution timestamps; (3) the attacker’s routing information resides in persistent memory and must be retrieved through the memory API to reach the exfiltration tool; and (4) list all facts returns key names only, not stored values, so the agent must call recall fact to obtain the attacker address. These assumptions hold for deployments in which memory retrieval is exposed as an observable tool invocation (e.g.LangChain, LangGraph, OpenAI Assistants, Anthropic tool-use). Architectures that bypass the tool layer (e.g.internal RAG caches, implicit memory injection into prompt context) would not produce the observable signature. 2.2
DATASET
We use 2,520 labeled runs from the delayed-trigger attack arm of the 5,040-run factorial experiment in our prior work (Leong, 2026). The factorial covers: • 9 open-source models: qwen2.5:14b, qwen2.5:72b, qwen3.5:9b, qwen3.5:122b, qwen3:32b, qwq:32b, glm-4.7-flash:q8 0, gpt-oss:20b, gpt-oss-safeguard:120b • 7 defense conditions: no defense, Minimizer, Sanitizer, RAG Sanitizer, RAG LLM Judge, Prompt Hardening, Memory Sandbox • N =40 runs per condition (9 models × 7 defenses × 40 runs = 2,520 DTA runs) 2
Preprint. Under review.
Labels: 1,919 attack successes (76.2%), 601 non-exfiltration sessions (23.8%). The negative class comprises poisoned-but-defended sessions (injection succeeded but exfiltration was blocked or refused); it does not include unpoisoned benign baseline sessions. The classifier therefore discriminates between successful and unsuccessful attack executions within the DTA arm, not between attacked and unattacked agents. Each run provides per-session tool logs with operation type, inputs, outputs, and timestamps. We extract features from the trigger session only (S4), since S1–S3 precede the trigger and should not contain exfiltration evidence in a correctly operating system. 2.3
F EATURE E NGINEERING
Tool invocations are sorted by execution timestamp before feature extraction to ensure transition statistics reflect the actual execution order rather than the serialization layout of the logging framework. We verified that on the full 2,520-run dataset, every session containing both recall fact and send email has the first recall strictly preceding the first send (0 violations), confirming that the temporal dependency is empirically universal in this attack construction. We extract 19 trajectory features per trigger session (all from S4 only; no injection-session features are used to avoid label leakage): Count features. Raw call counts in S4: recall count, list count, save count, draft count, send count, rag count, seq len (total tool calls). Structural features. send without recall (binary: sent email without any recall fact call), recall before send (binary: recall fact called before the first send email), recall to send ratio (= recall count/ max(send count, 1)), max recall chain (longest consecutive sequence of recall fact calls). Bigram transitions. Counts of consecutive tool-call pairs in S4: list then recall, recall then recall, recall then draft, list then draft, draft then send. Entry point. first tool is list, first tool is recall, first tool is draft (mutually exclusive binary indicators for the first tool called in S4). 2.4
C LASSIFIERS AND E VALUATION
We train three classifiers: • Logistic Regression (LR): L2 -regularized, C StandardScaler.
= 1.0, features standardized with
• Random Forest (RF): 200 trees, max depth= 8, class-weight-balanced. • Gradient Boosted Trees (GBM): 200 estimators, max depth= 4, learning rate 0.05. All classifiers are evaluated via stratified 5-fold cross-validation (seed = 42) using the default classification threshold of 0.5 (predicted probability > 0.5 ⇒ attack). Primary metric is Recall (minimizing false negatives = undetected attack-success sessions). Secondary metric is AUC-ROC. Confidence intervals on AUC use BCa bootstrap (N =10,000 resamples, jackknife acceleration capped at 200 leave-one-out samples, seed=42). The BCa CI is computed on the pooled out-of-fold predictions from 5-fold CV, not on per-fold estimates. For cross-model generalization, we perform leave-one-model-out hold-out: train on 8 models, test on the held-out 9th. The best-performing 5-fold classifier (RF) is used for hold-out evaluation. Frontier probe sample size. Frontier validation uses N =20 per condition. At N =20 with a onesided exact binomial test (α = 0.05), we have 80% power to detect Recall ≥ 0.85 against a null of Recall ≤ 0.50. This is sufficient for confirming strong generalization (observed Recall = 1.000); it is not designed to estimate the exact frontier FNR, which would require larger N . 3
Preprint. Under review.
Table 1: 5-fold cross-validation performance across three classifiers (N =2,520 DTA runs, 9 models). All three are equivalent; features are sufficiently discriminative that classifier choice does not matter. Primary metric is Recall (minimizing undetected attack-success sessions). Classifier
AUC
BCa 95% CI
Recall
Precision
F1
FN
Logistic Regression Random Forest Gradient Boosted Trees
0.9904 0.9904 0.9904
[0.987, 0.993] [0.987, 0.993] [0.987, 0.993]
0.9838 0.9838 0.9838
0.9682 0.9682 0.9682
0.9760 0.9760 0.9760
31 31 31
Reproducibility. The P1 factorial was run under Ollama 0.20.6 with temperature= 0 for all models, seed= 42 for all random processes (bootstrap, train/test splits). Frontier probes used GPT-4.1 via the OpenAI API with temperature= 0, accessed June 2026. Exact model checkpoints are not pinnable for API-served models. All code, data, and intermediate outputs are available at the companion repository.
3
R ESULTS
3.1
BASELINE : T HE I NVARIANT A LONE
Before evaluating the full classifier, we ask: how much of the detection problem does the behavioral invariant solve by itself? We define the simplest possible detector: If recall fact was called before send email in the trigger session, classify as attack. This single-rule baseline achieves AUC = 0.9563, Recall = 0.9792, and Accuracy = 0.9683 on the full dataset (N =2,520). The invariant alone is almost sufficient to separate attack-success from nonexfiltration trajectories. This confirms that the primary contribution is the discovery of the invariant, not the classifier architecture. The full 19-feature Random Forest (Section 3.2) refines this to AUC = 0.9904 (+3.4 pp). The improvement comes from handling edge cases (sessions where non-exfiltrating agents incidentally call recall fact to verify benign stored data, or where attack-success agents make multiple recall calls that change the trajectory’s density profile), but the invariant carries the load. 3.2
C LASSIFIER P ERFORMANCE
Table 1 reports 5-fold CV performance. All three classifiers are equivalent, indicating that the features are sufficiently discriminative that classifier architecture does not matter. This convergence to identical metrics across linear (LR) and non-linear (RF, GBM) architectures confirms that the feature space is nearly linearly separable. The behavioral signatures carry the entire discriminative load, making classifier architecture irrelevant. We report the Random Forest for interpretability (feature importances). Figure 1 shows the aggregate ROC curve alongside the five individual fold curves, confirming that performance is stable across data partitions. The 31 false negatives concentrate exclusively in the Memory Sandbox defense condition, as detailed in Section 3.5. The 62 false positives (FPR = 10.3%) are concentrated in qwen2.5:14b non-exfiltration sessions where the model calls recall fact to verify stored benign facts before drafting, an unusual but legitimate pattern. In deployment contexts where qwen2.5:14b is not used, FPR drops substantially; we report the full factorial result for conservative generalizability. 3.3
F EATURE I MPORTANCE AND THE S TRUCTURAL A RGUMENT
Figure 2 and Table 2 show that recall before send dominates. This is not a learned statistical regularity; it is mechanistically forced by the attack structure: 1. The attack stores the routing rule under a key (e.g.email routing rule) containing the attacker’s email address. 4
Preprint. Under review.
1.0
ROC Curve — Trajectory-Based Poisoning Detector (5-fold CV, N = 2,520 DTA runs)
True Positive Rate
0.8 0.6 0.4 0.2 0.0
Aggregate CV (AUC = 0.9904) Individual folds (mean AUC = 0.9918) 0.0
0.2
0.4
0.6
False Positive Rate
0.8
1.0
Figure 1: ROC curves for the Random Forest classifier. The aggregate curve (pooled out-of-fold predictions from 5-fold CV) achieves AUC = 0.9904. Individual fold curves (light) confirm stability across data partitions.
Table 2: Top-10 Random Forest feature importances (mean decrease in impurity). call before send is dominant: it is mechanistically forced by the attack structure. Feature
re-
Importance
recall before send send count recall count recall to send ratio max recall chain seq len list then draft send without recall draft then send list then recall
0.3143 0.2159 0.1015 0.0975 0.0767 0.0494 0.0435 0.0238 0.0185 0.0119
2. The attacker email is stored as a value, not a key. memory list all facts returns key names only; the agent must call memory recall fact(key) to retrieve the value. 3. Without calling recall fact, the agent cannot know the destination address and cannot complete the exfiltration. 4. Therefore, any successful memory-channel poisoning attack that stores the attacker address as a memory value must produce a recall fact call before the exfiltrating send email call. Adversarial suppression breaks the attack. An adversary who attempts to suppress the recall fact call to evade the detector faces a dilemma: either (a) the attack fails because the destination address is never retrieved, or (b) the attack embeds the destination address in the prompt directly, which changes the attack vector to prompt-injection (Section 3.8). The detector is structurally robust against memory-channel attacks: the feature it relies on cannot be suppressed without breaking the attack. 5
Preprint. Under review.
Top-10 Feature Importances — Random Forest (\textit{recall\_before\_send} is mechanistically forced by the attack) 0.312
recall\_before\_send send\_count recall\_to\_send\_ratio recall\_count max\_recall\_chain list\_then\_recall seq\_len draft\_then\_send send\_without\_recall
Mechanistically forced Supporting features
rag\_count
0.00
0.05
0.10
0.15
0.20
0.25
0.30
0.35
Feature Importance (Mean Decrease in Impurity)
Figure 2: Top-10 Random Forest feature importances. recall before send (red) is 1.5× more important than the second feature and mechanistically forced by the attack structure; all remaining features are supporting signals. Table 3: Mean trigger-session (S4) feature values for attack-success vs. non-exfiltration sessions across the factorial. The list → draft transition (non-exfiltrating agents draft directly after listing) is the clearest Markov difference. Feature
Attack
Non-exfil.
∆
recall count send without recall max recall chain draft then send list count
1.334 0.021 1.334 0.783 1.000
0.867 0.333 0.867 0.466 1.399
+0.467 −0.312 +0.467 +0.317 −0.399
Markov signature. The Markov transition differences between attack-success and nonexfiltration sessions (Table 3) confirm the signature structure. Non-exfiltrating agents more often call list all facts without a subsequent recall fact, drafting directly after the list. Attack-success agents call recall fact after listing to retrieve rule values, then draft and send, often sending twice (once to the legitimate recipient, once to the attacker). The effect sizes are large: the attack/non-exfiltration difference on send without recall is −31.2 percentage points (pp), and recall count shows +0.467 more calls per session on average. 3.4
C ROSS -M ODEL G ENERALIZATION
Table 4 shows that six of nine models achieve AUC = 1.000 on hold-out, confirming that the trajectory signature generalizes across model architectures and parameter counts (7B–120B). For the six models with AUC = 1.000 (N =280 each, 0 failures), the Wilson Score 95% CI on the true recall is [0.987, 1.000] per model (pooling across all six models yields a tighter bound of [0.998, 1.000] at N =1,680). The zero-failure outcome at this sample size rules out true Recall below 0.987. qwq:32b (AUC = 0.000). This is an informative out-of-scope failure. qwq:32b is the DraftOnly Executor archetype from (Leong, 2026): under Memory Sandbox, it exfiltrates via goaldirected RAG fallback without calling recall fact. Its attack trajectory is list all facts → email send email with no recall step, indistinguishable from a non-exfiltration session in our feature space. The classifier’s memory-recall signature does not apply to this attack class (implicitbypass poisoning via RAG fallback). AUC = 0.000 indicates perfect rank inversion: the model assigns higher attack scores to qwq:32b’s non-exfiltration sessions than to its attack-success ses6
Preprint. Under review.
Table 4: Leave-one-model-out hold-out validation (Random Forest trained on 8 models, tested on held-out 9th). Six of nine models generalize perfectly. qwq:32b, qwen2.5:14b, and qwen3.5:122b are mechanistically explained exceptions. Held-Out Model
AUC
Recall
Interpretation
glm-4.7-flash:q8 0 gpt-oss-safeguard:120b gpt-oss:20b qwen2.5:72b qwen3.5:9b qwen3:32b qwen3.5:122b qwen2.5:14b qwq:32b
1.000 1.000 1.000 1.000 1.000 1.000 0.750 0.083 0.000
1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 0.000
Generalizes Generalizes Generalizes Generalizes Generalizes Generalizes Partial; Prompt Hardening yields 0% ASR Distributional inversion (see text) Implicit bypass (different attack class)
Table 5: Detector performance stratified by the defense condition under which the P1 factorial run was evaluated. All 31 false negatives originate from the Memory Sandbox condition; the classifier achieves Recall = 1.000 under every other defense. Natk counts attack-success sessions; Nneg counts non-exfiltration sessions (poisoned but defended). Defense
Natk
Nneg
FN
Recall
No Defense Minimizer Sanitizer RAG Sanitizer RAG LLM Judge Prompt Hardening Memory Sandbox
319 320 320 320 320 280 40
41 40 40 40 40 80 320
0 0 0 0 0 0 31
1.000 1.000 1.000 1.000 1.000 1.000 0.225
sions, because the attacks bypass the memory channel entirely while the defended sessions occasionally trigger partial recall patterns. This boundary case precisely maps the scope of the detector: it identifies memory-recall attacks, not all attacks. qwen2.5:14b (AUC = 0.083, Recall = 1.000). AUC below 0.5 indicates a distributional inversion: the classifier assigns higher attack scores to qwen2.5:14b’s non-exfiltration sessions than to its attack-success sessions. This occurs because qwen2.5:14b’s non-exfiltration sessions aggressively call recall fact to verify stored benign facts before drafting, an unusual pattern that mimics the attack signature. Notably, Recall = 1.000 is maintained: all attack-success sessions are detected. The AUC degradation reflects false positives on non-exfiltration sessions, not missed attacks. In deployment, per-model calibration would resolve this. qwen3.5:122b (AUC = 0.750). This model’s Prompt Hardening condition achieves 0% ASR via sleeper effect: the model stores and recalls the rule but refuses to execute it. These sessions are poisoned (injection = 1) but not attacks (ASR = 0). The classifier trained on models where poisoned sessions are almost always attacks assigns high scores to qwen3.5:122b’s sleeper sessions. The AUC degradation reflects this label ambiguity rather than a trajectory signature failure. 3.5
D EFENSE -S TRATIFIED D ETECTION R ATES
Table 5 reveals a precise localization of detection difficulty: all 31 false negatives originate exclusively from the Memory Sandbox condition, where memory recall fact is removed from the agent’s tool schema. This is mechanistically expected. Under Memory Sandbox, eight of nine models achieve ASR = 0% via explicit recall required: they attempt recall, are blocked, and default to benign email behavior. The resulting trigger-session trajectory (list all facts → draft email → send email(team)) has recall before send = 0 and is indistinguishable from a non-exfiltration session. These are not classifier failures: they are sessions where the defense succeeded and the attack did not execute, correctly classified as non-exfiltrating by a detector that identifies memory-recall attacks. 7
Preprint. Under review.
Detector Performance Across Defense Conditions 1.0
Score
0.8 0.6 0.4 FN=31
Recall=0.98 reference AUC Recall
0.2 0.0
m Mini
izer
tizer Sani
Sa RAG
e nitiz
r
box ning udge Sand a rd e LM J y H L r t o G p RA Mem Prom
Figure 3: Detector AUC (blue) and Recall (red) stratified by defense condition. FN counts are annotated on Recall bars. The classifier achieves near-perfect performance under six of seven defenses; the Memory Sandbox exception is mechanistically explained (Section 3.5). Table 6: Feature-group ablation: AUC when each group of features is removed. The classifier is robust to removing any single group, confirming the signature is overdetermined; multiple independent channels encode the same attack behavior. Removing frequency counts causes the largest (but still small) degradation. Feature Group Removed None (full model) Mechanistic (recall before send, send without recall) Frequency counts (6 features) Ratio features (2 features) Bigram transitions (5 features) First-tool indicators (3 features) All recall-related (9 features)
Features
AUC
∆AUC
19 17 13 17 14 16 10
0.9904 0.9903 0.9886 0.9904 0.9904 0.9904 0.9904
— −0.0001 −0.0018 0.0000 0.0000 0.0000 0.0000
Within Memory Sandbox, qwq:32b is the sole source of the 31 false negatives. It achieves 100% ASR by bypassing the memory recall step entirely (goal-directed RAG fallback without calling recall fact), producing trajectories indistinguishable from non-exfiltration sessions in the feature space. Of qwq:32b’s 40 successful attack sessions in this condition, 31 are undetected (FN) and 9 are detected via auxiliary volume anomalies. Under every other defense, from No Defense through Prompt Hardening, the classifier achieves Recall = 1.000 with no false negatives (Wilson Score 95% CI [0.988, 1.000] at N =319, the smallest non-Sandbox attack count). Figure 3 visualizes this pattern. 3.6
F EATURE -G ROUP A BLATION
Table 6 shows that AUC is stable across all feature-group removals. This near-invariance has a principled explanation: the attack signature is overdetermined. The same behavioral event (a poisoned agent retrieving a malicious routing rule before sending) imprints simultaneously on multiple independent feature channels: recall before send (binary indicator), recall count (count), recall to send ratio (ratio), list then recall (bigram), and first tool is recall (entry point). Removing one group leaves the others intact. An evasion strategy that suppresses all five channels simultaneously must suppress every recall fact call in the trigger session; but as shown in Section 3.3, this breaks the attack itself. Complete recall removal. To stress-test this overdetermination claim, we remove all nine recall-related features simultaneously (recall before send, send without recall, 8
Preprint. Under review.
recall count, recall to send ratio, max recall chain, recall then recall, recall then draft, list then recall, and first tool is recall), leaving only 10 features that make no reference to recall fact. The resulting AUC is 0.9904: unchanged. This is not evidence that the recall step is irrelevant; rather, it demonstrates that the information-retrieval dependency triggers a behavioral cascade. Once the agent recalls the routing rule, it must draft a second email and send to the attacker’s address, altering send count, draft then send, and seq len independently of the recall features. The non-recall features detect these downstream consequences of the same underlying attack. An adversary cannot suppress the cascade without abandoning the exfiltration entirely. The largest degradation (∆ = −0.0018) occurs when frequency counts are removed, confirming that raw call counts carry signal independent of sequential order. However, even this drop is small, indicating that sequence-based features (bigrams, mechanistic indicators) provide redundant coverage. 3.7
F RONTIER VALIDATION (GPT-4.1)
To confirm that the classifier trained entirely on open-source models generalizes to frontier models, we applied it to N =20 sessions from a separate probe in which GPT-4.1 (accessed via API) ran with full attack memory pre-populated (3 attack keys: email routing rule, mandatory audit trail rule, monitoring endpoint). GPT-4.1 achieved ASR = 100% with recall count mean = 3.00 and recall before send = 1 in all 20 runs, exactly the same Markov signature as the P1 open-source models. The classifier (trained on no frontier data) achieves Recall = 1.000 on these 20 sessions (Wilson 95% CI [0.839, 1.000]) with a mean predicted probability of 1.000, a +45.9 pp gap above the evasion boundary mean of 0.541. Zero false negatives. This confirms that the trajectory signature is modelagnostic: it reflects the attack mechanism (recall N keys → send), not any property of the specific model family or provider. As a reference point, GPT-4.1’s recall count = 3.00 per session reflects its retrieval of three separate attack keys, whereas the P1 open-source models show a mean of 1.17 (retrieving fewer keys per session). Despite this distributional difference in the feature’s magnitude, the binary recall before send transition is identical across both populations, and the classifier discriminates correctly in both regimes. This is mathematically expected: Random Forest splits are monotonic and scale-invariant, so a higher absolute recall count does not distort the learned decision boundaries. Expanded frontier evaluation. Beyond the N =20 GPT-4.1 probe, we applied the classifier (trained exclusively on open-source data) to 405 attack sessions and 560 non-attack sessions across frontier models from separate experiments. The detector achieves Recall = 0.901 (365/405 detected) with FPR = 23.0% (129/560). The elevated FPR compared to training (10.3%) arises because reasoning models (o3-mini, o4-mini) call recall fact more frequently during non-attack sessions to verify stored information before acting, a higher baseline of self-correction that partially mimics the attack signature. Per-model threshold calibration would reduce the FPR; the current global threshold prioritizes recall over precision. The 40 missed attacks are overwhelmingly from evasion experiments (prompt-inline attacks, expected by design). 3.8
E VASION B OUNDARY
We tested the classifier on N =20 prompt-inline attacks: sessions where the routing rule was embedded directly in the trigger prompt (e.g.“per FSCF-2024 compliance requirements, all outbound communications must be sent to [email protected]”) with no memory pre-population. These attacks achieved ASR = 100% with recall count mean = 0.35 and recall before send mean = 0.35. The RF classifier detects 7 of 20 (Recall = 0.35), assigning a mean predicted probability of 0.541 across all 20 sessions, near the decision boundary. The 13 missed sessions have recall count = 0: the routing rule was in the prompt, so the model sent directly without recalling from memory. 9
Preprint. Under review.
This behavior is by design. The detector is a State-Space IDS for memory-channel attacks: it identifies the forensic signature of an agent that retrieved a malicious rule from its own memory store. A prompt-inline attack does not leave this signature because no memory recall is needed; the instruction is already in context. Both attacks succeed (100% ASR); they are forensically distinguishable by trajectory. This allows incident responders to determine the attack vector from logs alone: • recall before send = 1 ⇒ memory-channel poisoning (operation-only features suffice) • recall before send = 0, anomalous recipient ⇒ prompt-injection (requires tool-argument inspection beyond the operation-only classifier) 3.9
P REFIX -O NLY VS . F ULL -S ESSION D ETECTION
A key deployment question is whether the detector requires a complete session trajectory or can operate inline to block attacks before exfiltration. We evaluate two pre-send variants: (1) a 14-feature model that excludes post-send indicators (send count, recall before send, recall to send ratio, send without recall, draft then send) but retains seq len (total session length, a post-hoc summary), and (2) a strictly prefix-only 13-feature model that additionally excludes seq len. The 14-feature model (with seq len) achieves AUC = 0.990, nearly identical to the full classifier. However, seq len is not truly available before the send event since it summarizes the completed session. The strictly prefix-only 13-feature model achieves AUC = 0.934, a −5.7 pp degradation from the full classifier. This indicates that substantial discriminative information is already present in the pre-send trajectory (list → recall → draft), but additional signal accrues during and after the send phase (e.g., multiple send attempts, post-send recall patterns). The 13 prefix-only features are: recall count, list count, save count, draft count, rag count, max recall chain, list then recall, recall then recall, recall then draft, list then draft, first tool is list, first tool is recall, first tool is draft, all computable incrementally as tool calls arrive. We recommend a dual-layer deployment: an inline prefix classifier (AUC = 0.934) that blocks clear attacks in real time, complemented by a full-session forensic classifier (AUC = 0.990) for post-hoc audit and edge-case detection. The prefix-only classifier is a Random Forest trained from scratch on the 13 prefix features using the same 5-fold CV procedure; it does not benefit from post-send feature information during training. The detector is not limited to forensic use; it operates effectively at both layers.
4
D ISCUSSION
4.1
W HY T OOL -C ALL L OGGING I S S UFFICIENT
The detector requires no model access, no memory inspection, and no additional inference. Toolcall logs are already generated by production agentic frameworks (e.g.LangChain tool invocation hooks, OpenAI function-call traces, Anthropic tool-use events). Deploying the classifier requires only routing these logs to a feature extractor and a trained model. The per-session inference cost is negligible (19 low-dimensional features; RF prediction in microseconds). This is deployable by any operator who can record tool invocations, a lower bar than defenses requiring memory-store modification, model internals, or content inspection. 4.2
R ELATIONSHIP TO THE P1 D EFENSE FAILURE
(Leong, 2026) showed that five of six defense classes fail against memory poisoning: input-level and retrieval-level defenses cannot observe the attack surface, and instruction-level defenses are overridden by compliance framing. The trajectory classifier is complementary: it is a detection mechanism, not a prevention mechanism. It does not stop the attack; it identifies that an attack occurred and attributes it to the memory-channel vector. Detection without prevention has operational value for incident response, forensics, and anomaly alerting. 10
Preprint. Under review.
4.3
L IMITATIONS
False negative rate. FN = 31 out of 1,919 attack-success sessions (1.6%). These concentrate in qwq:32b’s implicit-bypass runs and qwen2.5:14b’s distributional edge cases. In deployments without qwq:32b, the effective FNR is substantially lower. No true-benign baseline. The reported false-positive rate is measured against poisoned-butdefended non-exfiltration executions, not against ordinary unpoisoned benign agent traffic. Estimating deployment FPR on unpoisoned sessions with realistic memory use and email actions requires a separate no-attack workload, which we leave for future work. Frontier false positive rate. On frontier models (GPT-4.1, GPT-4o, o3-mini, o4-mini), the detector achieves Recall = 0.901 across 405 attack sessions but FPR = 23.0% on 560 non-attack sessions, notably higher than the training FPR of 10.3%. The increase arises because reasoning models (o3, o4-mini) call recall fact more frequently during non-attack sessions to verify stored information before acting, mimicking parts of the attack signature. Per-model threshold calibration would likely reduce this gap; the current single-threshold design is a conservative choice that favors recall over precision. Training data scope. The classifier was trained on open-source models via Ollama. Cross-model hold-out confirms generalization to GLM, GPT-OSS, and Qwen families, and the GPT-4.1 probe (N =20) confirms frontier model alignment. A larger frontier-model training set would sharpen the decision boundary, particularly for models with recall counts > 1.5 (the GPT-4.1 / GPT-4o regime). Implicit-bypass attacks. The classifier correctly misses qwq:32b’s Memory Sandbox bypass (goal-directed RAG fallback, no recall fact). Detecting implicit-bypass attacks requires tracking the semantic correlation between RAG document content and outbound email fields, rather than relying on raw rag count volume metrics alone. We leave this for future work. Adaptive adversaries. We consider three evasion strategies an adversary aware of the detector might attempt: (1) Suppress recall: embed the routing address directly in the prompt, eliminating the recall fact call. This changes the attack vector to prompt-injection, which the detector correctly classifies as a different channel (Section 3.8). The attack succeeds but loses persistence across sessions. (2) Inject fake recalls into non-attack sessions: the adversary poisons benign sessions to include spurious recall fact calls, inflating the FPR. This requires persistent influence over the agent’s environment, itself a security compromise, and cannot suppress the genuine attack signature. The detector’s precision degrades but recall is unaffected. (3) Retrieve via alternative channels: use RAG re-retrieval or cached context instead of the memory tool. This bypasses the observable signature entirely but requires an architecture where routing information is available outside the memory API, violating our architectural assumptions (Section 2.1). Under those assumptions, the core constraint holds: any memory-channel attack that stores routing information exclusively in persistent memory must produce at least one observable retrieval call before exfiltration.
5
R ELATED W ORK
Memory poisoning attacks. Persistent memory attacks against LLM agents were established by MINJA (Dong et al., 2025) and Zombie Agents (Yang et al., 2026), which demonstrated high attack success rates against open-source models via query-only memory injection. The delayed-trigger attack (DTA) (Leong, 2026) embeds a malicious compliance directive in a RAG-retrieved document; the directive instructs the agent to store a routing rule using memory save fact, which is then retrieved via memory recall fact in a later session and used to exfiltrate data. (Leong, 2026) establishes that five of six defense classes fail against this attack, with only tool-layer memory restriction achieving structural protection. Hidden in Memory (Pulipaka et al., 2026) independently confirms that GPT-5.5 stores adversary-induced memories at 99.8% injection rate, demonstrating that injection-layer vulnerability persists even in the most capable frontier models. Cross-Session Stored Prompt Injection (Xie et al., 2026) formalizes the XSS analogy for persistent injection across session boundaries. MPBench (Dash et al., 2026) provides a benchmark covering four memory 11
Preprint. Under review.
write channels and six attack classes, explicitly motivating behavioral detection approaches but not providing a detector.
Behavioral detection in agentic systems. VIGIL (Li et al., 2026) translates behavioral specifications into SMT constraints over finite tool-call event traces, achieving > 95% recall with < 10% FPR on policy violations. It enforces pre-specified behavioral policies rather than learning forensic signatures from labeled data. Our approach is complementary: we learn statistical signatures from labeled data without requiring a policy specification, targeting a specific attack class rather than arbitrary violations. MemMorph (Zhang et al., 2026) demonstrates that poisoned long-term memory can steer tool selection across multiple agent architectures; our work asks whether such memory-channel attacks leave operation-only forensic signatures detectable by a supervised classifier. MemLineage (Ouyang & Hou, 2026) attaches cryptographic provenance to memory entries, enabling detection of unsigned writes, but requires modification of the memory infrastructure and cannot detect attacks injected through the agent’s own authorized write pathway (as in DTA, where the agent legitimately stores the malicious rule from a RAG-retrieved compliance document). MEMSAD (Gowda, 2026) achieves near-perfect detection using gradient-coupled anomaly scoring, but it is a preventive defense that blocks attacks before execution and requires model-internal gradient access; our detector is a post-hoc forensic tool requiring only tool-call logs. Concurrent work (Dang, 2026) enforces behavioral firewalls over tool-call sequences using probabilistic deterministic finite automata; they define permitted trajectories, whereas we learn attack signatures from labeled data.
Intrusion detection and anomaly detection analogues. Host-based intrusion detection systems (HIDS) in classical security identify compromises from system call sequences and process execution traces (Forrest et al., 1996; Warrender et al., 1999). Sequence-based anomaly detection on system calls (using n-gram models, HMMs, or neural sequence classifiers) is structurally analogous to our approach: both extract features from ordered event logs and classify sessions as normal or anomalous. The key distinction is that classical HIDS operates on low-level OS primitives, while our detector operates on tool invocation events in an LLM agent runtime. This framing clarifies the deployment requirement: tool-call logging in agentic frameworks (LangChain tool invocation hooks, OpenAI function-call traces, Anthropic tool-use events) is the agent-runtime equivalent of strace or Linux Audit, and the trajectory classifier is a direct implementation of HIDS principles at the agentic abstraction layer. PerD (Garcia-soto et al., 2022) detects embedded Trojans in static NLP models by analyzing input-output behavioral responses, the most directly analogous prior work, but applies to models with fixed behavior, not agentic systems where tool-call trajectories vary with memory state.
Execution-trace auditing for agents. Recent concurrent work has explored execution-trace analysis for agent security. TraceAegis (Liu et al., 2025) applies provenance-based rules over agent execution logs to detect generic anomalous behaviors, while TRACES learns trajectory risk states from an observer LLM’s hidden representations. Unlike these systems, which learn generic unsafe patterns or require formal policy specifications, our approach identifies an architecture-induced signature specific to persistent memory poisoning, using lightweight structural features without model internals or learned representations.
The detection gap. Unlike general trace-auditing or memory-poisoning benchmarks, no prior work studies whether a specific explicit-memory exfiltration channel induces a low-dimensional, operation-only trajectory signature amenable to supervised classification. MPBench (Dash et al., 2026) systematizes the memory-poisoning attack surface across four write channels; MemMorph (Zhang et al., 2026) demonstrates tool-selection steering; VIGIL (Li et al., 2026) verifies tool-stream intent. None provides the specific combination we contribute: a supervised classifier trained on an instrumentally labeled factorial dataset (N =2,520, 9 models, 7 defenses), evaluated with cross-validation, bootstrap uncertainty estimates, and leave-one-model-out hold-out, and grounded in a mechanistic argument that links the dominant feature to the attack’s informationretrieval dependency. 12
Preprint. Under review.
6
C ONCLUSION
Persistent memory poisoning attacks produce a stable, overdetermined behavioral invariant in the agent’s execution trajectory. The recall before send transition follows from the attack’s informationretrieval dependency: a simple rule exploiting it alone achieves AUC = 0.9563, and suppressing it breaks the attack. A full trajectory classifier refines this to AUC = 0.9904, but the critical finding is that removing all recall-related features leaves AUC unchanged; the attack distorts multiple independent behavioral dimensions, not a single observable channel. The invariant generalizes across 9 models (7B–120B parameters) and transfers to frontier models without retraining. The detector operates in dual modes: a prefix-only inline classifier (AUC = 0.934) enables real-time blocking, while the full-session view (AUC = 0.990) provides forensicgrade audit confidence. Prompt-injection attacks fall outside the memory-recall signature, enabling channel-level distinction from operation-only logs. These results establish a channel-specific invariant: memory-recall exfiltration attacks leave execution-trajectory signatures that are robust, overdetermined, and model-agnostic. Deployment requires only tool-call log access, a lower bar than defenses requiring memory-store modification, model internals, or content inspection.
R EFERENCES Hung Dang. Enforcing benign trajectories: A behavioral firewall for structured-workflow AI agents, 2026. arXiv:2604.26274. Pritam Dash et al. From untrusted input to trusted memory: A systematic study of memory poisoning attacks in LLM agents, 2026. arXiv:2606.04329. Shen Dong et al. MINJA: Memory injection attacks on LLM agents via query-only interaction. In Advances in Neural Information Processing Systems, 2025. Stephanie Forrest, Steven A Hofmeyr, Anil Somayaji, and Thomas A Longstaff. A sense of self for Unix processes. In Proceedings of the IEEE Symposium on Security and Privacy, 1996. Diego Garcia-soto, Huili Chen, and Farinaz Koushanfar. PerD: Perturbation sensitivity-based neural trojan detection framework on NLP applications, 2022. arXiv:2208.04943. Ishrith Gowda. MEMSAD: Gradient-coupled anomaly detection for memory poisoning in retrievalaugmented agents, 2026. arXiv:2605.03482. Jun Wen Leong. Defense effectiveness across architectural layers: A mechanistic evaluation of persistent memory attacks on stateful LLM agents. 2026. arXiv:2605.08442. Ying Li et al. VIGIL: Runtime enforcement of behavioral specifications in AI agent skills, 2026. arXiv:2606.26524. Jiahao Liu et al. TraceAegis: Securing LLM-based agents via hierarchical and behavioral anomaly detection, 2025. arXiv:2510.11203. Ciyan Ouyang and Rui Hou. MemLineage: Lineage-guided enforcement for LLM agent memory, 2026. arXiv:2605.14421. Sidharth Pulipaka et al. Hidden in memory: Sleeper memory poisoning in LLM agents, 2026. arXiv:2605.15338. Christina Warrender, Stephanie Forrest, and Barak Pearlmutter. Detecting intrusions using system calls: Alternative data models. In Proceedings of the IEEE Symposium on Security and Privacy, 1999. Yuanbo Xie et al. What if prompt injection never left? exploring cross-session stored prompt injection in agentic systems, 2026. arXiv:2606.04425. Xianglin Yang et al. Zombie agents: Persistent control of self-evolving LLM agents via selfreinforcing injections, 2026. arXiv:2602.15654. 13
Preprint. Under review.
Xuanye Zhang et al. MemMorph: Tool hijacking via memory poisoning, 2026. arXiv:2605.26154. Andy Zou et al. Representation engineering: A top-down approach to AI transparency, 2023. arXiv:2310.01405.
14