The agent's own summary launders a poisoned web page past both memory defenses

An agent that fetches a page and saves a note stores its own sentences, not the page. The bytes change, and the paper's claim is that the derivation edge back to the untrusted origin breaks, or flips to "trusted", in the process ^[3]. Its worked example is a page that says to send the customer list to a given address whenever backups are mentioned. The agent rewrites the page in its own words. Weeks later, in an unrelated session, the user asks about backups, the agent recalls the note, and the data goes out ^[14].

That sequence defeats content inspection. A poisoned memory is benign until it activates, so there is nothing to detect at write or rest time, and the paper argues an adaptive adversary can disguise the trigger well enough to survive inspection at use time ^[12]. Provenance fails differently. MemLineage tracks derivation and gates sensitive actions, but according to the paper it re-derives its verdict at dispatch and "offers no path for legitimate untrusted information to ever act" ^[13].

Write-time binding, the condition T2 makes necessary, is a schema change before it is anything else. The origin label has to live outside the note's text, since the text is what the model rewrote. It belongs in a record field the model's output never reaches, set by the write path itself. Elevation is the harder half: T3 permits it only through corroboration that resists Sybils ^[5]. Skip the independence check and the third laundering channel supplies the corroboration ^[3].

The 68% is a maximum over a grid, cross-defense, cross-attack and cross-model, run on eight frontier models ^[7]. Eight models by three laundering channels is 24 model-channel cells ^[15]. For that maximum to say anything about a particular deployment, three properties have to hold there. The agent writes paraphrases of fetched content into durable memory, of the sort MemGPT, Mem0, Generative Agents and MemMachine provide ^[10]. A tool's output is treated as an origin and not merely as content ^[3]. And something in the action path consults a content score or a derivation edge before dispatch ^[2]. An agent that keeps nothing between sessions sits outside the write-retrieve-act pipeline the paper formalises ^[16].

The proofs are TLA+ models, published with the benchmark and the harness ^[9]. Soundness holds for the specification as written, and matching a memory store to that specification is separate work. Two figures are blank in the abstract as rendered: TMA-NM's attack-success rate on direct and laundering attacks, and the injection-success rate the introduction cites for earlier poisoning results ^[8].