MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems

[2605.25002] MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems Skip to main content Search Submit Donate Log in Computer Science > Cryptography and Security arXiv:2605.25002 (cs) [Submitted on 24 May 2026 ( v1 ), last revised 25 Aug 2026 (this version, v4)] Title: MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems Authors: Haobo Zhang , Xutao Mao , Guangyuan Dong , Ziwei Li , Xuanbo Su , Kaijie Chen , Jing Yang , Zheng Lin View PDF HTML (experimental) Abstract: Memory-backed agents need provenance that can survive leaked or migrated snapshots, where logs, visible outputs, and trusted metadata may be absent. We propose MemMark, a state-evolution attribution watermark that embeds an owner-controlled signal into latent memory-write decisions. At each internal LLM call, MemMark samples among admissible candidates using keyed, distribution-preserving selection, and records cryptographic commitments with signed session anchors and reveal evidence. This makes attribution depend on reproducible backend behavior rather than mutable provenance fields. Across A-Mem and Graphiti on LoCoMo, with three LLM backbones, MemMark preserves memory utility: Overall F1 retains 99.6% of the unwatermarked baseline, while BLEU-1 changes by +0.2%. It also provides usable carrier capacity, with 1.16, 1.14, and 1.26 bits of mean entropy for update-target, link-target, and semantic-realization decisions. In the snapshot-only R3 setting, MemMark recovers the full 40-bit payload from final snapshots, while wrong-key verification remains near chance. Under nine memory-lifecycle attacks, verification distinguishes tampering, evidence deletion, and partial payload recovery. These results show that robust snapshot-only attribution is feasible for long-term agent memory without surviving traces, trusted metadata, or utility-degrading. Comments: Accepted to findings of EMNLP 2026 Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2605.25002 [cs.CR] (or arXiv:2605.25002v4 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2605.25002 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Zhang HaoBo [ view email ] [v1] Sun, 24 May 2026 11:04:35 UTC (1,993 KB) [v2] Tue, 26 May 2026 06:35:05 UTC (1,993 KB) [v3] Sat, 22 Aug 2026 04:12:32 UTC (1,994 KB) [v4] Tue, 25 Aug 2026 09:52:16 UTC (1,994 KB) Full-text links: Access Paper: View PDF HTML (experimental) TeX Source view license Additional Features Audio Summary Current browse context: cs.CR < prev | next > new | recent | 2026-05 Change to browse by: cs References & Citations SciX Google Scholar Semantic Scholar export BibTeX citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab)

Related documents

• MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems#670604
• MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems#224418
• Algorithmic regulation: A critical interrogation#23731
• AliMark: Enhancing Robustness of Sentence-Level Watermarking Against Text Paraphrasing#238522
• The Reliability of Memory: An Argument from the Armchair#739182