Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
2026-07-06 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors explain that language model agents remember their past thoughts and decisions to work better, but this memory can be attacked. They introduce a new attack called FARMA that tricks the agent by inserting fake reasoning in a sneaky way, which current defenses can't stop. To fight this, the authors created SENTINEL, a system that carefully checks the agent's reasoning for signs of forgery and stops the attack. Their tests show FARMA is very effective without protections, but SENTINEL can block these attacks completely without making mistakes. This highlights the importance of guarding not just the facts agents remember, but also their thought process history.
Persistent memoryLarge language model (LLM) agentsReasoning historyMemory poisoning attackFARMA attackEvasive languageSelf-referential reinforcementSENTINEL defenseReasoning GuardConsensus-based defenses
Authors
Neeraj Karamchandani, Piyush Nagasubramaniam, Sencun Zhu, Dinghao Wu
Abstract
Persistent memory has enabled large language model (LLM) agents to store factual knowledge, prior decisions, reasoning histories, tool usage information, and context. While this has improved the agent's functionality and continuity across tasks, it has also introduced a new attack surface: the agent's own reasoning history. In this paper, we introduce the Forged Amplifying Rationale Memory Attack (FARMA), which poisons an agent's remembered reasoning rather than its factual knowledge. It inserts forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses. To address FARMA, we introduce SENTINEL, a layered defense pipeline to detect forged reasoning entries. Its central component is the Reasoning Guard that structurally analyzes candidate entries for forgery using five weighted signals. We evaluate FARMA and SENTINEL across multiple agents and different LLM models with 50 trials and show that FARMA achieves an attack success rate of up to 100% under baseline conditions and is capable of defeating defense mechanisms like keyword filter and A-MemGuard. Our evaluation also shows that SENTINEL reduces FARMA's attack success rate to as low as 0% with no false positives observed across 326 benign agent traces. Our work demonstrates the need to protect not only an agent's retrieved content but also the integrity of its reasoning history.