memlineage v0.1.0: A Two-Layer Defense Against LLM Agent Memory Poisoning

LLM agents with persistent memory (RAG / agentic memory) expose a new attack surface: an adversary interacting only through normal channels can inject crafted memories that, once retrieved, hijack the agent's future behavior without touching model weights or code. Recent academic work (SMSR, TMA-NM, Forensic Trajectory Signatures, MemLineage) reproducibly confirms this: content-based filters are evaded by fluent enterprise-style text, and origin-based trust scores can be laundered.

memlineage is an open-source Python library implementing a two-layer defense. Layer A performs cryptographic provenance at write time: every memory is signed with Ed25519, its trust tier is derived from the signing key rather than chosen by the caller, and a derivation graph with max-of-strong-edges propagation enforces that any memory transitively derived from an untrusted ancestor can never be laundered into a trusted one. A SensitiveActionGate cryptographically blocks irreversible actions whose justification descends from an untrusted path. Layer B adds a runtime behavioral detector that analyzes tool-call structure rather than content, combining an untrained invariant rule with a trainable RandomForest; in this MVP it only alerts and never auto-blocks.

An independent auditor cloned the repository from scratch and wrote their own adversarial tests to verify the guarantees. Results: 0.000 attack success rate for Layer A against real external attacks, 0.988 AUC for Layer B without camouflage, and 0.978 AUC with 0.950 recall under attacker camouflage. CI reports 30/30 passing tests, 95% coverage, and zero findings from bandit and SonarCloud.

The takeaway for engineers building agent stacks: content filters and trust scores alone are insufficient against memory poisoning; combining cryptographic provenance with behavioral trajectory detection offers a concrete, auditable reference architecture.