Your Agent’s Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses

Jul 16, 2026

Upload by Liam

Persistent memory enables large language model (LLM) agents to retain factual knowledge, prior decisions, reasoning histories, tool usage, and task context, improving continuity but expanding the security attack surface. This work presents Forged Amplifying Rationale Memory Attack (FARMA), which poisons remembered reasoning traces using evasive language to bypass keyword defenses, then reinforces them through self-referential amplification that undermines consensus-based protections. A layered defense pipeline, SENTINEL, detects forged reasoning via a Reasoning Guard using five weighted signals. Across experiments, FARMA reaches up to 100% success under baseline settings, while SENTINEL reduces success to as low as 0% with no observed false positives.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages10

Reading Time25 min

Introduction

Threat background: persistent memory and reasoning integrity

Prior memory poisoning attacks and the gap

FARMA: forged reasoning injection and amplification

Defenses and evaluation

Your Agent’s Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses Neeraj Karamchandani Piyush Nagasubramaniam Sencun Zhu Dinghao Wu The Pennsylvania State University, University Park, PA, USA {njk5270,pvn5119,sxz16,[dinghao](dinghao}@psu.edu)[}](dinghao}@psu.edu)[@psu.edu](dinghao}@psu.edu) arXiv :2607 .05029v 1 [ cs .CR] 6 Jul 2026 Abstract—Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context. While this has improved the agent’s functionality and continuity across tasks, it has also introduced a new attack surface: the agent’s own reasoning history. In this paper, we introduce the Forged Amplifying Rationale Memory Attack (FARMA), which poisons an agent’s remembered reasoning rather than its factual knowledge. It inserts forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses. To address FARMA, we introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries. Its central component is the Reasoning Guard that structurally analyzes candidate entries for forgery using five weighted signals. We evaluate FARMA and SENTINEL across multiple agents and different LLM models with 50 trials and show that FARMA achieves an attack success rate of up to 100% under baseline conditions and is capable of defeating defense mechanisms like keyword filter and A-MemGuard. Our evaluation also shows that SENTINEL reduces FARMA’s attack success rate to as low as 0% with no false positives observed across 326 benign agent traces. Our work demonstrates the need to protect not only an agent’s retrieved content but also the integrity of its reasoning history. Index Terms—LLM agents, agentic security, memory poisoning, reasoning trace forgery, persistent memory, adversarial machine learning I. INTRODUCTION Modern Large Language Model (LLM) based agents [1],[2] are becoming increasingly reliant on persistent memory to perform complex, multi-step tasks. Memory in such systems does not just store facts but also stores past observations, prior examples, intermediate rationales, or stored experiences to guide future planning and action. This persistence improves continuity and reduces redundant work, but it also introducesa new attack surface: the integrity of the agent’s own remembered reasoning. When an agent retrieves a stored record indicating that it previously validated a data source or verified a safety condition, it may treat that record as grounds for skipping re-validation, a reasonable optimization when the record is authentic but can be a serious vulnerability when it is not. Recent disclosures show this is not a hypothetical concern but a real-world risk. SpAIware [3] demonstrated that adversarial entries can be written to ChatGPT’s persistent memory through indirect prompt injection, with the vulnerability requiring more than two months for OpenAI to patch. Salt Labs [4] documented OAuth flaws in ChatGPT plugins that grant unauthorized write access to user context. The OWASP Top 10 for Agentic Applications 2026 [5] also formally recognizes Memory and Context Poisoning (ASI06) as a deploymentrelevant attack class by itself, especially in multi-agent frameworks where shared memory stores turn one agent’s writes into another agent’s reads. Recent research work has also demonstrated several forms of memory poisoning in agentic systems. AgentPoison [6] showed how a backdoor trigger can be embedded in an agent’s retrieval corpus. MINJA [7] showed that an attacker can induce an agent to store poisoned examples with the help of specially crafted queries. MemoryGraft [8] showed that injecting seemingly successful past experiences into longterm memory can bias future behavior. These types of attacks target different memory artifacts such as retr

FAQs

What is the core vulnerability addressed in this paper?

The paper targets integrity of an LLM agent’s stored reasoning history, where forged past rationale can cause the agent to skip necessary re-validation or safety checks.

How does FARMA conduct the attack?

FARMA first injects forged reasoning/decision-log-like entries using evasive language to evade keyword-based defenses, then amplifies them by adding self-referential entries that increase retrieval probability and defeat consensus-based detection.

How does SENTINEL defend against forged reasoning entries?

SENTINEL uses a layered pipeline centered on a Reasoning Guard that structurally analyzes candidate memory entries for forgery using five weighted signals, reducing FARMA success substantially.

Jul 16, 2026

Upload by Liam