SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems

A team of researchers has detailed a new attack surface called Multi-Session Memory Poisoning (MSMP) that targets persistent memory in retrieval-augmented generation (RAG) agents, and they have proposed a certified defence named Signed Memory with Smoothed Retrieval (SMSR) to counter it [1]. The work, posted to the arXiv preprint repository on 10 June 2026, identifies MSMP as a threat where an adversary using only normal interaction channels can inject crafted memories that steer an agent's responses for subsequent users, without altering model weights or code [1]. The authors note that existing defences such as RobustRAG and ReliabilityRAG assume a fixed knowledge base and are bypassed by fluent enterprise-style text [1]. The arXiv repository, which hosts the paper, is an open-access platform for electronic preprints that are moderated but not peer-reviewed, and it serves as a primary distribution channel for computer science research [6]. SMSR is presented as the first defence with a certified robustness bound for the MSMP setting [1]. It consists of two components. The first adds HMAC-SHA256 provenance at write time, blocking unsigned injection [1]. The second applies randomised memory ablation with verdict-based majority voting at query time, which bounds the influence of authenticated adversaries [1]. The researchers prove that no provenance-free retrieval-time filter can certify against adaptive injection and derive a hypergeometric certificate for the second component [1]. Across 15 enterprise scenarios and 3,150 repeated trials, Component 1 reduced attack success from a range of 93–100 percent to 0 percent for all unsigned variants [1]. For an authenticated adversary with a single injection, Component 2 held success to 8.0 percent, with a 95 percent confidence interval of 5.8 to 10.9 across 450 trials, which the authors state is below the certified worst case [1]. In an end-to-end query-only attack where the agent itself writes the poison, SMSR reduced success from 65.3 percent to 5.3 percent over 150 trials, with non-overlapping confidence intervals [1]. Clean-query utility was measured at 90 percent for Component 1 alone and 85 percent for the combined system [1]. The paper also formalises what it calls the Consistent Minority Effect, a phenomenon where a consistent adversarial answer can win string-based voting as a numerical minority, while verdict-based voting removes it [1]. The research was submitted by Tarun Kumar Sharma [1]. Large language models, which underpin modern RAG agents, are neural networks trained on vast text corpora for tasks including generation and summarisation, and their reliability can be compromised by biased or inaccurate training data [8].