When should AI memory trust a new fact? Corroboration, measured

The threat, and the gap

Builders are actively worried about memory poisoning — "a stray sentence becomes a durable trait." The attack: write a false fact, get it recalled enough that the system treats it as important, and it self-reinforces into trusted long-term memory. It's a named research area (OWASP ASI06 "Memory & Context Poisoning"). Yet none of the public memory benchmarks — LoCoMo, LongMemEval, BEAM — score whether a system resists it; they score retrieval accuracy on clean data. That's the gap this probe addresses, for our own engine.

The mechanism (in inspeximus)

inspeximus decays a memory's recall weight on a per-type clock: episodic fades fast (7-day half-life), semantic slowly (180-day). A memory "graduates" episodic→semantic once it accrues enough recall value. The bug we fixed: graduation accepted a self-assertable source string as "corroboration" — so attacker-set provenance let a recall-pumped poison graduate to the durable tier. The fix: graduation now requires earned corroboration — a positive outcome (set only by the credit loop, not self-assertable) or ≥2 independent links. A self-sourced poison no longer graduates; it stays episodic and fades.

The measurement

40 diverse (truth, poison) scenarios; the poison is recall-pumped above the graduation threshold, then the attack stops; the truth is a normal, freshly-used memory. We age the poison and ask the contested question. Corruption = the poison out-ranks the truth. Two outcomes, identical except the poison's tier. Run in both semantic and lexical recall — identical results.

Median fade for the new guard: 21 days (day-14 52%, 95% CI 37–67%; day-21 0%, CI 0–9%, n=40); the old guard corrupts in 100% of scenarios through 90 days (and far beyond, on a 180-day half-life). Identical in semantic and lexical mode — which tells you this is the durability mechanism at work, not a retrieval quirk.

Read the 21 days honestly: it is a parameter readout, not a discovered constant. The fade time is d* = τ½ · log₂(V_pump / V_truth) — with the 7-day episodic half-life and a poison pumped to 8 over a fresh truth (~1), that is 7·log₂(8) = 21 days, i.e. ~3 episodic half-lives; a different decay clock scales it. And the OLD-vs-NEW gap is arithmetic once you fix which decay tier the poison lands in (180-day vs 7-day): the probe's own prediction was "~2–3 weeks" before it ran. So this confirms that two already-established mechanisms compose as expected — the graduation gate and two-tier decay — it is a sanity check, not an independent empirical property.

The attacker has to keep working now (measured) — and the honest limit

We also measured a sustained attacker who re-pumps the poison every P days (it decays between pumps), on a smaller set (n=15, not the 40 of the fade curve above). Fraction of a 90-day window the poison out-ranks the truth (this is spaced-repetition arithmetic — re-pump interval ÷ half-life sets it):

The honest limit, both directionsThe gate does not stop an active, continuous attacker — re-pump roughly weekly and the poison stays on top under either tier (that's a separate, harder problem). What it changes, measured: it denies unearned durability, so a single attack that used to poison memory for months becomes transient (fades in ~3 weeks), and a sustained attacker is forced to keep re-pumping every ~1–2 weeks instead of poisoning once and walking away. That is the whole — and only — claim. Decay is a hit-and-run blast-radius cap, not a live-attacker defense: a poisoned entry still fires on the next matching query, and a weekly re-pumper stays on top. The lever for a live attacker is not decay but read-time influence-gating (inspeximus's own recall(..., influence_only=True) — gate what drives an action, not what's stored) plus the source-keyed monitor/slash accountability stack.

Why the comparison is fair, and what it isn't

• Fair internal A/B — same 40 scenarios, same recall path; the only difference is whether the poison could graduate to the slow-decay tier. Not a strawman, not a cross-product comparison.
• Synthetic, single engine — this characterizes a mechanism in inspeximus; it is not a benchmark of other products or a real-world incident study.
• It isolates durability, not retrieval quality — which is why semantic and lexical match.
• Corroboration / write-decision logic exists elsewhere (e.g. Mem0's write decisions); we claim a measured property of our guard, not a novel defense.

What's runnable

The probe and the fix are open; the numbers above regenerate from one command, cloud-free (local embeddings) — the scripts + result files are at research/probes/poison_durability. If this axis matters to you, run it on your own memory layer — that's the point.

FAQ

What is AI memory poisoning? Writing a false fact, getting it recalled enough that the system treats it as important, so it self-reinforces into trusted long-term memory — “a stray sentence becomes a durable trait.” It is a named research area, yet most memory systems have no measured defense.

Can you stop a poisoned fact from becoming permanent? Yes, measurably. With a corroboration guard an uncorroborated fact stays episodic and fades: 52% corrupt at day 14 and 0% by day 21. The old “graduate on recall” guard stays 100% corrupt forever.

What counts as corroboration? A positive outcome set only by the credit loop (not self-assertable by the writer) or ≥2 independent links. A fact a single source merely asserts about itself never graduates to durable memory.

Why isn’t recall frequency enough to trust a fact? Because an attacker controls recall frequency — repeating a lie makes it “important” under any recall-based rule. Corroboration ties durability to outcomes or independent evidence the attacker cannot fake.

Related research

• Can corroboration stop AI-agent memory poisoning?
• When should an AI's memory refuse to believe what it just saw?
• The same hidden law in four AI-memory mechanisms