Corroboration gating in agent memory: what it blocks, and what it only prices

It blocks the single-source attacker — and that is true by construction, not a lucky measurement. Memory poisoning (memory injection) of LLM agents — feeding an agent a crafted "memory" that later steers its behaviour — succeeds 70–95% of the time against naive memory stores that rank by importance or recency. A corroboration gate — a memory turns durable, or is allowed to overwrite a standing fact, only when ≥2 independent sources (or an earned outcome) back it — sends single-source poison to 0% for both goals (entrenchment by default, overwrite once its guard is on), on the real shipped inspeximus. But a corroboration count is forgeable: a sybil that mints ≥2 independent-looking sources sails through (100%). So the honest headline is narrow — the gate prices poisoning, it does not stop it.

What memory poisoning is — and why naive stores fail

A memory-based agent stores facts and experiences and recalls them later. Memory poisoning injects a malicious record that, once stored and retrieved, redirects the agent. On naive stores that rank records by importance/recency, a high-value injected record entrenches and is recalled again — and recent work reports it works alarmingly well:

• MINJA — Memory Injection Attacks on LLM Agents via Query-Only Interaction (Dong et al., NeurIPS 2025): 98.2% injection, 76.8% attack success, using only ordinary queries — the agent writes the attacker's bridging records itself (arXiv 2503.03704).
• Agent Security Bench (ASB): highest average attack-success rate 84.30% across 13 model backbones, with current defences shown "limited" (arXiv 2410.02644, ICLR 2025).

Scope, stated plainly: we did not implement MINJA or ASB — those rates are cited as threat context, not measured here. We tested inspeximus's corroboration gate against the two goals a poison pursues: entrench a durable falsehood, and overwrite a true standing fact.

The corroboration gate — and why the win is "by construction"

inspeximus is our open memory core. Its defence is not a ranking trick — it is corroboration: a memory graduates to the durable/trusted tier only with an earned outcome (credit the app assigns on resolved work, not self-assertable) or ≥2 corroborating links from distinct sources, not because it is "important". Because durability requires ≥2 sources, a lone self-asserted poison is blocked by definition — the 0% is a property of the rule, not a surprising empirical result. This is the direction the poisoning-defence literature is converging on: A-MemGuard gates on cross-memory consensus and cuts attack success >95% (arXiv 2510.02373). We tested two goals end-to-end on the recall the agent would actually use, against the real shipped inspeximus:

• Entrench — inject a poison that becomes durable + trusted (graduates episodic → semantic, the slow-decay tier).
• Overwrite — inject a poison that supersedes a true standing fact (state-toggle supersession).

The table (real shipped inspeximus, deterministic)

• The naive column is the no-guard behaviour — graduate/overwrite on value alone — which importance/recency stores exhibit by construction.
• inspeximus's corroboration gate cuts single-source poison to 0% — entrenchment by default; overwrite once the guard is enabled (supersede_requires_corroboration).
• A sybil forging ≥2 real distinct-source records clears the gate (100%) — the same ≥2-source rule read the other way.
• The result is deterministic: the 150 trials per cell are identical every run, because the gate has no stochastic component. The value is a runnable confirmation on a shipped store (the probe), not a variance estimate.

It prices poisoning, it doesn't stop it

The sybil boundary. An attacker who forges ≥2 independent-looking corroborations bypasses the gate (100%). This is a textbook sybil result: Douceur 2002 proved that without a central identity authority an entity can present many identities (bounded by its resource ratio), and Cheng & Friedman 2005 proved no non-trivial symmetric reputation rule is sybil-proof (Douceur; Cheng & Friedman). Counting corroborations is exactly such a rule — it is the Adaptation–Corruption Separation Law's boundary B ≥ d in another guise.

Attestation prices, it doesn't close. Turn on strict corroboration and each witness must carry a verified Ed25519 key (attested_key): manufacturing independence now costs a real key per witness — the Douceur cost. But two attested records still clear a 2-witness gate, so the boundary is priced, not shut at threshold 2 — the same limit as the Veracity-Gap result: provenance authenticates the source, not the independence the gate assumes.

The input-type limit. A poison phrased as a procedure ("always do X") is classified procedural — durable by design — and sidesteps the episodic graduation gate (~100%). Require corroboration for procedural/durable writes too, not only for facts.

The real frontier: independence, not counting

Every field that tried corroboration-counting eventually abandoned it and switched to detecting that the "independent" sources are secretly one actor — SybilLimit's graph cut, DMARC's behavioural sender analysis, Wikipedia's stylometric checkuser. The gate audits cardinality; the attack lives in independence. Attestation binds the container, not the behaviour (Dissociative Identity, FAccT 2026). And even perfect independence-detection has a floor: genuinely distinct colluding identities are truly independent by graph and stylometry — which pushes the real defence to outcome-accountability: earned credit per actor, not source-counting.

If you build agent memory, RAG, or a memory layer

1. Don't rank durability by importance or recency — that is exactly what memory poisoning exploits. Gate durability on corroboration or an earned outcome.
2. Enable the overwrite guard for adversarial ingestion (in inspeximus: supersede_requires_corroboration; the entrenchment gate is on by default).
3. Gate procedural/durable writes too, not just facts — phrasing is part of the attack surface.
4. Treat corroboration-count as forgeable — for untrusted, multi-tenant input you need a source-independence signal (and, past that, per-actor accountability) against sybils and collusion, not just a count.

This is the same principle we ship across inspeximus — see the corroboration guard that won't let an uncorroborated fact become permanent, the two-tier store that resists a poison flood in eviction, and the Veracity-Gap on why provenance can't buy truth.

FAQ

Does corroboration-gating stop all memory poisoning? No. It blocks the single-source attacker (0%), but it prices rather than stops the threat: a sybil that forges ≥2 independent-looking corroborations still gets through (100%).

Is inspeximus protected by default? The entrenchment defence (the graduation gate) is on by default. The overwrite defence (supersede_requires_corroboration) is opt-in — enable it for adversarial settings.

Did you replicate MINJA and Agent Security Bench? No. MINJA (98.2%/76.8%) and ASB (highest average ASR 84.30%) are cited from those papers as threat context. We did not implement their attacks; we tested inspeximus's corroboration gate against the entrench and overwrite goals.

Is the 0% a measurement or is it by construction? By construction. A ≥2-sources gate blocks a single source by definition, so the outcome is deterministic; the 150 trials per cell are identical every run. The value is a runnable confirmation on the real shipped inspeximus, not a stochastic measurement.

The falsifierThe gate's 0% is definitional, so the real test is the boundary: if a sybil forging ≥2 genuinely distinct-source records had also been blocked, the gate would be doing more than counting — and it is not. If strict attestation had shut the boundary at threshold 2 (blocked two validly-attested witnesses), the "prices-not-closes" claim would be wrong. Neither happened: the gate counts, and two attested keys still pass.