P2: Preventing Memory Poisoning & AI Knowledge Corruption

Scan every candidate memory insertion for anomalies and reject writes from untrusted sources, applying cryptographic validation for long-term stored entries.

Log all memory reads and writes to an immutable audit trail so every access can be traced after the fact.

Isolate each session's memory partition so the agent cannot read or carry over knowledge from a different user's session.

Enforce access-control lists on vector stores and shared memory so each agent can only retrieve data relevant to its current task.

Pin every model artefact to a registry-managed, checksummed version and gate promotion to production on a behavioural regression suite.

Enforce retention limits keyed to data sensitivity so agents discard historical knowledge before it can be exploited.

Record the originating source for every memory update so modifications can be traced back to a trusted or untrusted actor.

Require multi-agent or external corroboration before committing any memory change that will persist across sessions.

Cross-check new knowledge against trusted external sources before writing it to long-term storage, and fail closed when confidence is insufficient.

Monitor memory logs in real time for unexpected updates or unauthorised access and raise an alert on any anomaly.

Re-run multi-agent or external validation on any suspect memory entry after it has been committed to confirm or rule out poisoning.

Periodically re-check existing stored knowledge against trusted sources to detect drift or contamination introduced over time.

Roll back agent knowledge to the last validated snapshot whenever an anomaly is detected in the memory store.

Take periodic memory snapshots with actor attribution so a forensic rollback is possible after a poisoning event.

Alert when memory modification frequency for an agent spikes, as a sudden high rewrite rate is a reliable early indicator of manipulation.

Cross-check new knowledge against multiple trusted sources before accepting it as established fact within the agent's knowledge base.

Block knowledge propagation from unverified sources so low-trust inputs cannot influence downstream agent decisions.

Maintain a full provenance lineage of how agent knowledge evolved to enable forensic investigation into misinformation spread.

At the RAG retrieval boundary, route attacker-influenceable content through a quarantined extractor model before the privileged executor ever sees it.

Version-control every knowledge update so corrupted changes can be audited and rolled back to a clean state.

Continuously analyse memory access patterns and cross-audit access logs to catch long-term anomalies or policy drift before they compound.

Apply embedding-space anomaly detection and adversarial re-ranking at the retrieval layer to reduce the impact of poisoned vectors.