Stop AI Agent Memory Poisoning at the Write Path

说明与用途

通过在写入路径中插入屏蔽门，防止恶意指令被存储，从而阻止 AI 代理的内存中毒。

问题

AI agents can be poisoned by malicious prompts that are stored as facts, causing future sessions to act on false instructions and compromise decisions.

结果

The write‑gate prevents memory poisoning, limiting a single poisoned fact to affect only one key‑value lookup and all four booking decisions in the graph backend, thereby preserving agent integrity across sessions.

工作流

• 1. Wrap the MemoryStore with GatedMemoryStore, providing regex rules and an optional LLM classifier.
• 2. In GatedMemoryStore.add(), screen content; if not allowed, raise MemoryRejected.
• 3. If an LLM classifier is configured, invoke it; if unsafe, raise MemoryRejected.
• 4. On successful screening, forward the write to the inner store.
• 5. Configure the Agent’s MemoryManager to use the gated store.
• 6. When a write is rejected, the agent’s add_memory tool returns a failure, and the agent informs the user.
• 7. Deploy the agent behind any entry point (chat, API, Lambda) so the gate travels with the agent.

证据

one poisoned fact skews 1 lookup in key-value memory, but hijacks 4/4 booking decisions in a graph

来源

A rejected write raises rather than dropping silently

来源