Trajectory-Based Detection of Memory Poisoning via Tool-Call Sequence Analysis
First seen Jul 5, 2026 · Updated Jul 5, 2026
This is a defensive research paper, not an active threat or exploit disclosure. It presents a detection method that identifies memory-poisoning attacks in LLM agents by analyzing tool-call ordering patterns (specifically, a memory-recall call preceding an email-send call), achieving very high classification accuracy. Since it describes a detection technique rather than a vulnerability or attack, severity is low from a threat standpoint, though the underlying attack class it detects (memory poisoning leading to data exfiltration) remains a legitimate concern.
Technical Analysis
The paper studies agent architectures where routing/context information is retrieved through observable memory-tool invocations, and finds that successful memory-poisoning attacks that exfiltrate data via email exhibit a near-deterministic behavioral invariant: a memory_recall_fact call preceding an email_send_email call. This ordering is causally required by the attack's information-retrieval dependency (the attacker must first pull poisoned/exfiltration-target data from memory before sending it out), making it a robust, hard-to-evade forensic signature rather than a spurious correlation. The authors build classifiers (a simple rule and a Random Forest over 19 trajectory features) on tool-call logs alone, achieving AUC up to 0.99 and generalizing across model families and sizes without retraining. This work does not introduce a new attack surface; it operates purely on existing tool-call telemetry to retroactively or proactively flag memory-channel exfiltration attempts, and can distinguish them from prompt-injection attacks that bypass memory.
Affected Systems
protocols: MCP
Detection Signatures
- Tool-call sequence: memory_recall_fact (or equivalent memory/context-retrieval tool call) immediately or shortly followed by an outbound communication tool call (email_send_email, http_post, message_send, webhook_call) within the same session
- High proportion of sessions where memory-read tools are called only in sessions that also invoke external-communication tools
- Anomalous trajectory score approaching 1.0 under a trained trajectory classifier vs. baseline sessions
- Presence of recall-then-exfiltrate pattern absent in normal task-completion trajectories
- Distinguish from prompt-injection-only sessions, which show a markedly lower trajectory anomaly score (~0.54) since they do not depend on the memory-recall step
Remediation Steps
- 1
Instrument and log tool-call trajectories
Ensure agent frameworks emit structured, ordered logs of all tool invocations (name, arguments, timestamp, session id) to enable trajectory-based forensic and real-time analysis.
- 2
Deploy trajectory-based anomaly detectors
Implement rule-based or ML-based classifiers (e.g., recall-before-send heuristics, Random Forest over trajectory features) as a monitoring layer to flag likely memory-poisoning/exfiltration sessions.
- 3
Gate high-risk tool transitions
Require additional confirmation, rate-limiting, or human-in-the-loop approval when a memory-recall tool call is immediately followed by an outbound communication or data-egress tool call.
- 4
Harden memory stores against poisoning
Apply provenance tracking, integrity checks, and write-access controls on agent memory to reduce the likelihood that untrusted content can be injected and later retrieved as trusted context.
- 5
Separate detection from blocking use cases
Use the prefix-only (partial trajectory) variant of the classifier for real-time blocking where full-session data isn't yet available, accepting the documented accuracy trade-off (AUC 0.934).
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.