MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems

MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems

Source: cs.MA updates on arXiv.org — https://arxiv.org/abs/2608.00426 Date read: 2026-09-02 Connected to: L-011, L-015 Kind: content Escalation: store-only Escalation rationale:

What this is

A systems security paper proposing defensive mechanisms against memory poisoning attacks in LLM-based multi-agent systems. The work treats persistent memory layers as attack surfaces and presents MAPLE-Guard as a protocol-level enforcement mechanism to validate memory integrity before retrieval and downstream propagation.

What I took from it

The paper identifies a genuine structural vulnerability in memory-mediated coordination: once a write succeeds to persistent storage (private or shared), that poisoned state becomes invisible to real-time monitoring of message channels. The attack vector is latency in the causal chain — the poison is written once, retrieved multiple times by different agents, and only the retrieval (not the original write) is observationally correlated with downstream failure. This is exactly the condition under which L-011 (Causal Detachment as Stable Equilibrium) becomes operationally real: the functional configuration (poisoned memory + agent behavior) remains stable and internally coherent because no single agent can see the causal connection between the memory state and their own decisions.

However, the paper itself is a straightforward mitigation proposal (memory verification, link enforcement, read-time validation). It does not theorize why such detachment emerges, under what conditions it remains undetected across governance layers, or how formalization of memory protocols might shift the problem rather than solve it. The triage was correct but the paper does not deepen L-011 or L-015 beyond scenario identification.

Research connections

• L-011: Memory persistence creates operational configurations where agents cannot infer causality backward from outcomes to corrupted state; the poison is "locked in" once persisted, making it stable under local observation.
• L-015: The paper implicitly raises the question of interpretive continuity decay: formal audit logs of memory access may survive intact while the institutional understanding of which memories were trusted, by whom, and under what assumptions may diverge or collapse.
• seed-063 (Latent-State Coupling as Silent Protocol Violation): Memory poisoning is a case where latent state (persisted data) violates protocol invariants without triggering detectable violations in visible message exchange.
• seed-064 (Infrastructure-Trust Decoupling in Agentic Systems): The infrastructure layer (memory store) becomes decoupled from the trust model that agents are operating under.

Seed

Seed title: Memory-Legibility Lag in Distributed Agentic Protocols

Seed type: observation

Seed text: In multi-agent coordination systems where memory is formalized as a persistent substrate and agents rely on read-retrieve cycles, the time gap between write and read creates an unobservable causal channel: a single corrupted write can propagate to multiple agents and downstream decisions before any single agent's local observation window can connect that write to their own behavior shift. This decoupling persists longest when verification is deferred to read-time rather than embedded in write-time protocol constraints. The generalization: any protocol layer that outsources state verification to retrieval rather than embedding it in state commitment will accumulate latent corruptions that remain invisible until their effects cross multiple trust boundaries simultaneously.