A confirmation gate controls how agents reuse memory
PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust · arXiv:2610.28987
In plain words
Agents can save information and use it in later sessions, but text picked up from a webpage or tool could also carry an attack forward. PerMIT is a proposed system that puts a confirmation gate between that untrusted information and an agent’s memory or sensitive tools. Before approval, the agent sees a handle instead of the content.
In tests that planted an attack in memory and later checked for data being sent to an attacker, PerMIT’s tested verifier setups recorded no observed successes across four backbones. That result applies to those tests; it does not show that every verifier or deployment is reliable.
The research
If an agent can save text from a tool and act on it later, and shared memory can pass that text onward, what would stop unconfirmed content from reaching sensitive tools while still letting useful knowledge be reused?
PerMIT routes untrusted memory through a confirmation gate, then lets exact endorsed values and community confirmations authorize later use.
The authors formalize how a finite memory interface can control what an agent reads and sends to sensitive tools. Their guarantees make authorization depend on exact values and tools, and make protected behavior depend on what the gate displays under matched run conditions.
On Trojan Hippo, which plants an email payload and later checks whether an agent sends user data to an attacker, probes observed zero attack success with PerMIT’s self-check and two Qwen verifiers across four backbones. The accept-all configuration had successes on some backbones.
Shared-knowledge tests found utility gains in telecom for two model families, but no detectable gain in banking.
These guarantees depend on the stated interface and endorsement assumptions. The tests do not establish that verifiers are accurate or deployed systems implement the model faithfully, and shared-knowledge gains varied by domain and model.
What the evidence shows
- Memory can carry attacks
PerMIT is a proposed memory architecture and sharing protocol for language-model agents with persistent memory. The problem is that information an agent reads through tools or webpages can be saved and influence later actions; sharing memory could spread that influence to other agents.
The authors ask how such agents can reuse memory while controlling whether untrusted content reaches sensitive tools.
- A gate controls access
PerMIT treats user-typed information and content approved at a confirmation gate as trusted by provenance and authorization. Until approval, untrusted content is represented to the protected agent by an opaque handle.
The agent still chooses its plans and tools, while the interface controls how memory content crosses to the agent or a tool. This design makes the confirmation decision the point where untrusted content can be authorized.
- The interface has guarantees
The formal results specify what that gate enforces. Action Integrity restricts sensitive-tool arguments to user-typed values or values endorsed for that exact tool.
Reasoning Integrity says that, under matched run conditions, identical complete display transcripts imply identical protected-agent behavior. These are properties of the modeled interface under stated assumptions; they do not establish that an endorsement is factually correct.
- Observed attacks were contained
Trojan Hippo tests whether a payload planted in memory through an email later leads an agent to send user data to an attacker. The authors’ probes recorded zero observed attack success for PerMIT’s self-verification and two lightweight Qwen-verifier configurations across four backbones.
The accept-all configuration ranged from zero to 10% across those backbones, so the measured result concerns the tested gate configurations and attacks.
- Shared knowledge has limits
PerMIT also lets confirmations accumulate across users so sufficiently endorsed entries can be reused. In τ²-bench telecom, a test of completing simulated telecom tasks, pooled held-out task scores improved significantly over no shared knowledge for Claude-Sonnet-4.6 and Kimi-K2.5, but not GLM-5.
In banking, none of the three tested model families showed a detectable gain. The results indicate that utility depends on the tested domain and model.
Deep
- Original paper authors
- Tanqiu Jiang, Min Bai, Sadat Shahriar, Wanyu Du, Sandesh Swamy
- Submitted to arXiv
- License
- CC BY 4.0