Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened
2026-08-17 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors explain that language model agents rely on memory that can be manipulated by attackers to skip important safety steps. The previous defense, SENTINEL, tries to spot suspicious phrases but can be easily tricked by simply rewording the fake messages. They introduce a new method, Proof-of-Execution Memory (PoEM), which securely records actual safety steps in a tamper-proof ledger, making forgery impossible even if the main memory is altered. Tests show PoEM effectively stops attacks without disrupting normal operations, unlike SENTINEL which often blocks safe actions.
LLM agentsexternal memoryadversarial attackFARMA attackSENTINEL defenseProof-of-Execution MemoryHMAC ledgertamper-evidencesafety stepsLangChain agent
Authors
Md Habibur Rahman, Jaeho Kim
Abstract
LLM agents are stateless and rely on external memory to carry context between steps. Because agents treat that memory as trustworthy, an adversary who can write to it can steer their behavior. The FARMA attack does this with no malicious command: it inserts fabricated entries into the agent's reasoning memory claiming a required safety step is already done, so the agent skips it. SENTINEL, the defense proposed with FARMA, scores entries against a fixed list of suspicious wordings; its authors note that an attacker who knows the list can reword the forgery and evade it, and leave this open. We show the gap is worse than stated. An automated attacker that simply asks a language model to reword the forgery evades SENTINEL on its first try, reducing its protection to zero on every model tested. We also find a capability paradox: the attack succeeds far more often on stronger models (98-100% on GPT-4o and GPT-4o-mini) than on Llama-3.1-8B (44%), because more capable agents follow reworded claims more faithfully, so the threat grows with capability. We propose Proof-of-Execution Memory (PoEM), which does not inspect memory at all. PoEM keeps a separate, tamper-evident, HMAC-chained ledger of the safety steps that actually executed, writable only by the trusted action layer, and allows a skip only if the ledger confirms real execution. An attacker can change what memory says but cannot forge a ledger entry for a step that never ran, so rewording no longer helps. Across three models and three scenarios, PoEM drives attack success to 0% while leaving legitimate operation intact (0% false positives in eight of nine cells, 1.7% in the ninth, within sampling noise), whereas SENTINEL wrongly blocks 33-50% of legitimate operations. PoEM also withstands attacks aimed at itself, adds microseconds of overhead, and works unchanged in a real LangChain agent. PoEM protects exactly the decisions it gates.