MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI

What it is

MemSentry (Roy & Basu, arXiv:2609.08747, Sep 2026) is a pre-commit gate for agentic-AI persistent memory. The summary covers the five scoring factors and the classifier benchmark; what it omits is the actual decision logic, the concrete risk weights, and the design stances that determine whether this fits your system. Those are the reason to read.

How it works

The framework's distinguishing choice is that it evaluates each write before commitment and produces a deterministic verdict — the paper explicitly positions itself against reactive defenses (MemAudit, MEMSHIELD, A-memguard) that detect poisoning only after entries reach memory and are retrieved.

Concrete parameters the summary doesn't carry:

• Source trust is a 4-level lookup, not a learned score: external-unverified T=0.0, external-verified T=0.5, internal-unverified T=0.5, internal-verified T=1.0.
• Semantic categories carry fixed risk weights: security_strengthening −0.30, alert_suppression 0.80, credential_storage 0.90, authority_claim 0.90, conditional_trigger 0.85, policy_override 0.80, trust_modification 0.70, down to preference/schedule 0.05. Negative-risk (strengthening) operations do not inflate the risk score.
• A persistence factor f∈{0.3, 0.6, 1.0} (temporary / bounded / indefinite) amplifies both positive and negative projected impact — a permanent write is weighted ~3× a self-expiring one.
• The security delta is signed: harmful-operation degradation scales with source distrust (1−T), so a fully trusted source causes zero modeled degradation; beneficial operations scale with trust T.

The decision rules are the operative part:

flowchart TD
    O[Proposed write] --> E{External<br/>unverified?}
    E -->|yes| Q[Quarantine]
    E -->|no| D{δ < −τ∆<br/>or R ≥ τQ?}
    D -->|yes| Q
    D -->|no| A{internal T>τT AND<br/>authorized AND<br/>low risk AND<br/>benign category?}
    A -->|yes, not crit≥0.85| Acc[Accept]
    A -->|otherwise| Rev[Review]

Two stances follow from this: any external-unverified source is quarantined regardless of content (the paper claims this yields zero external malicious escapes, matching the "100% external quarantine-class" number), and operations touching a component with criticality ≥0.85 are forced to Review even when otherwise benign.

Also worth knowing: the explanation record is generated by templates, not an LLM — identical inputs with identical config always yield identical outputs, so verdicts are auditable and reproducible. A counterfactual simulation runs the agent with and without the candidate memory to measure observed blast radius and validate the predicted attack radius.

Caveats

The paper states its own core limitation: surface-similar operations with opposing security implications are not distinguishable by any of the four semantic methods, and this matters most for verified insiders (T=1), where MemSentry deliberately escalates to human review rather than quarantining — so the human, not the classifier, is the last line against a compromised trusted account. The authors flag LLM-based intent reasoning as future work, meaning insider intent detection is unsolved here. The environment is synthetic: a 20-asset random DAG and 1,000 GPT-4-generated scenarios, not a production deployment.