Tamper Evidence in AI Agent Memory Stores: A Method, a Taxonomy, and a Measurement

Abstract

AI agents increasingly persist memory across sessions and, on the next turn, treat that memory as their own prior experience. The stores that hold it, checkpoint databases, long-term memory tables, vector stores, were built for recovery, which asks whether stored state can be loaded, not for integrity, which asks whether stored state is what was written. This work defines a benchmarking method for that gap. We specify eight storage-level edits (T1 to T8), three verdict classes, a distinction between detection at read time and detection only on a separate audit, two control cases, and a scoring rule. An edit counts as detected only when the subsystem itself raises, refuses, or reports the problem, never when an external observer compares bytes. Applied to the checkpoint and memory layers of several widely used frameworks at pinned versions, the plain stores accept all eight edits silently and the agent resumes from adversary-chosen memory. Two edits, moving a genuine record between contexts (T6) and rolling a context back to an older genuine record (T7), use only bytes the subsystem itself wrote; they therefore pass any protection that binds ciphertext or a signature to record content but not to record identity, including an encrypted checkpointer. A receipt-based store detects six of the eight but accepts the cross-context move, because its receipt commits to text and key but not to the owning user. The method is offline, deterministic, runs in under a minute, pins each result to a library version, and is the reference method for the memory-integrity metric under discussion in the IETF Benchmarking Methodology Working Group.