FAILED
Attaching provenance to a memory -- a "source:" tag, a "corroborated by N records" line, a
Defense-aware attacker vs 4 in-memory defenses (fictional-fact OVERRIDE, so no model prior confounds), 10 targets across 8 families (Anthropic Claude Opus 4.8, Google Gemini-3-flash + Gemma-3-27b, DeepSeek-v4-flash, Moonshot Kimi-k2.7, MiniMax-m3, NVIDIA Nemotron-3, Zhipu GLM-5.2, OpenAI gpt-oss 20b/120b), judge gpt-oss:120b. MEAN attack-success: no defense 1.00; source cited IN the record 0.91; "corroborated by >=2" written IN the record 0.95 -- the attacker forges whatever the defense reads, because it controls the content (v5). Even coherence + temporal corroboration gates are theater vs a competent forger who writes on-topic and time-spreads witnesses -- both free (v8). The ONLY signal that holds is metadata the writer CANNOT set: system-assigned write-history / distinct Ed25519 verified keys -- Biba integrity (1977) / Douceur Sybil cost (2002). Enforced in CODE (the memory layer surfaces only what passed the gate, so the poison never reaches the model) the end-to-end attack-success drops 1.00 -> 0.00 on all 10 models, gemma-3 included -- a code gate protects even a model that ignores a "distrust this memory" instruction, whereas the SAME rule as a PROMPT leaks (gemma-3 80%). BUT the defense PRICES the attack, it does not CLOSE it: (a) a sleeper who pays the Douceur cost (2 real keypairs, on-topic, time-spread) is indistinguishable from a legit fact -- Cheng & Friedman 2005, no symmetric reputation is sybilproof, confirmed empirically (v8); (b) it rides on outcome-credit being un-self-gradable -- a MINJA-style self-graded outcome (arXiv:2503.03704) collapses it back to 1.00; (c) it is coupled to a freshness cost -- the same >=2-corroboration bar that blocks a single-shot poison blocks a single-witness TRUE update (quickest-change-detection delay-vs-false-alarm; you cannot accept fresh facts fast without also accepting single-shot poison). VERDICT FAILED for "content-provenance is a memory-poisoning defense"; the honest replacement is a code-enforced gate on unforgeable, EARNED (un-self-gradable) signals, which prices but does not eliminate the attack. Prior art credited (not claimed): Biba 1977; Douceur 2002; Cheng-Friedman 2005; knowledge-conflict/memory-strength (Mallen PopQA ACL 2023, Li et al. arXiv:2409.10955 ACL 2025); adaptive-attack canon (Carlini-Wagner 2017, Athalye 2018, Tramer 2020, Nasr "Attacker Moves Second" arXiv:2510.09023); memory/RAG poisoning (MINJA 2503.03704, AgentPoison NeurIPS 2024 arXiv:2407.12784, PoisonedRAG USENIX Sec 2025 arXiv:2402.07867); PeerTrust signal fusion (Xiong-Liu 2004); quickest-change-detection (Lorden 1971 / CUSUM). HONEST LIMITS: single-turn fictional-fact override (not multi-turn persistent poisoning); one LLM judge (gpt-oss:120b), part self-judging gpt-oss outputs (biases lenient, not toward inflated robustness); attacker = static best-of-battery + a Claude-authored defense-aware battery, NOT an RL optimizer (PISmith arXiv:2603.13026), so ASR is a lower bound vs a stronger attacker; the code-gate GATED=0 is partly BY-CONSTRUCTION (a corroboration gate filters an uncorroborated poison ~tautologically) -- the measured, non-tautological parts are the end-to-end model pass-through, the Cheng-Friedman residual, and the density-dependent utility cost (~51% of legit recalls blocked at ~1x use -> ~6% at ~8x); open-weight/cloud snapshots only (Claude tested via Claude Code, no closed API). Probes: research/probes/memory_defense_layer_probe.py (attack), memory_gate_defense_probe.py (defense end-to-end), memory_corroboration_cost_probe.py (cost/residual/coupling). Post: r/RAG 2026-07-06.