Agent Memory Is a Surface for Endogenous Authorization Laundering
Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol
cs.CR · cs.AI
Quick verdict
Benchmarks authorization-state corruption in LLM agent memory; strong causal isolation and open artifacts, but small synthetic case pool limits generality.
Summary
The paper introduces 'endogenous authorization laundering': an LLM agent's persistent memory can encode permissions that the underlying interaction history never granted, and downstream executors then treat them as valid. EAL-Bench operationalizes this with a writer that compiles multi-session organizational histories into bounded memory (free-text or typed JSON, one-shot or incremental), an executor that later acts on memory alone, and a hidden deterministic ledger defining true authorization state across procurement, cybersecurity, and finance. Five writers (Nemotron 3 Ultra, Grok 4.3, Kimi K2.6, GLM 5.2, Qwen-Plus) and two calibrated executors (GPT-OSS-120B, DeepSeek V4 Pro) are evaluated over three seeds. Under typed incremental updating, false-authority formation reaches 28.3% (procurement), 10.4% (cybersecurity), and 50.2% (finance), closely tracking downstream unauthorized submission; executors act on present false authority in 98.6% of trials, and replacing memory with oracle-exact state eliminates unauthorized actions. Source-authority gating and bounded event sourcing cut pooled unauthorized submission from 25.3% to 7.3% and 9.0%, but drop authorized use from 93.3% to 53.8% and 64.7%, exposing a safety-utility tradeoff; writer-side scaling (k=8) improves generation but selection bottlenecks at 26.7%. Main limitations: small synthetic case pools (8-16 per domain), a single memory framework (LangMem), and single-seed pressure analyses.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Under typed incremental updating, memory writers create false authority for up to 50.2% of unauthorized requests (finance), and formation rates closely track downstream unauthorized submission (within 0.8 points, Table 2).
- Once false authority is present, calibrated executors act on it in 98.6% of matched trials, and replacing memory with oracle-exact state eliminates all unauthorized actions, establishing memory as the causal bottleneck.
- Source-authority gating and bounded event sourcing cut pooled unauthorized submission from 25.3% to 7.3% and 9.0%, but reduce authorized use from 93.3% to 53.8% and 64.7%, forming a discrete safety-utility Pareto frontier.
- Writer-side inference scaling improves candidate generation (55.0% exact-memory availability at k=8) but selection succeeds in only 26.7%, locating the bottleneck in verification rather than generation.
- Persistent memory functions as part of an agent's effective authorization policy and should carry the provenance, lifecycle, and audit discipline of an IAM system.
Strengths
Causal decomposition with a deterministic oracle
Formation F (Eq. 1) and propagation G (Eq. 2) are scored against a hidden deterministic ledger without any LLM judge; the exact-state repair intervention (Table 3: 0/68, 0/60, 0/80 unauthorized actions after oracle replacement) cleanly localizes the failure to memory, since only the memory artifact changes between replays.
Executor calibration discipline
Executors qualify only if faithful-memory controls achieve 100% authorized use and 0% unauthorized submission (§3.2); frozen, hashed memories replayed behind both executors agree in 97.9–99.5% of paired replays (App. B.2), so failures demonstrably travel with the artifact.
Transparency and cost accounting
Confounds actively ruled out
Weaknesses
Small author-constructed case pool carries headline claims
Single memory framework and no retrieval condition
Formation analysis confined to typed memory
Mitigation frontier may embed a design choice
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper (arXiv 2609.01836) defines **endogenous authorization laundering**: an agent's persistent memory encodes authority the underlying history never granted, and executors act on it with no attacker involved. EAL-Bench decomposes the failure into formation (F, Eq. 1: memory grants what the canonical ledger denies) and propagation (G, Eq. 2: the executor performs the exact requested action). Claims are stated with unusual precision and are mostly supported by the presented data: up to 50.2% formation under typed incremental memory (finance, Table 2), 98.6% propagation (pooled 205/208, Table 3), zero unauthorized actions after exact-state repair, and a safety-utility tradeoff for both mitigations (unauthorized submission 25.3%→7.3%/9.0% at authorized use 93.3%→53.8%/64.7%, §4.4).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is endogenous authorization laundering?
A failure mode in which an LLM agent's own persistent memory records a permission that the actual interaction history never granted. Because the agent later trusts its memory, it performs unauthorized actions with no attacker involved — the apparent authority is 'laundered' through the memory itself, making the violation invisible at execution time.
What is EAL-Bench?
A benchmark that measures whether persistent agent memory faithfully preserves evolving authorization state. A writer model compresses multi-session organizational histories into bounded memory, an executor model later acts on that memory alone, and a hidden deterministic ledger defines the true authorization state across procurement, cybersecurity, and finance scenarios.
How often do LLM agents act on falsely remembered permissions?
In the benchmark, once false authority was stored in typed memory, calibrated executor models took the unauthorized action in 98.6% of matched trials. Replacing the faulty memory with the exact correct authorization state reduced unauthorized actions to zero, showing the memory is the bottleneck.
Can this memory authorization problem be fixed?
Two safeguards help: requiring stored permissions to cite valid authoritative sources, and tracking permission changes through event sourcing. They cut pooled unauthorized submissions from 25.3% to 7.3% and 9.0%, but also reject many legitimate actions (authorized use falling to 53.8% and 64.7%), so deployments face a safety-utility tradeoff rather than a free fix.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Review is based on a sampled excerpt: marked sampling gaps skip portions of the evaluation-protocol/models text, part of Appendix A.5, the Table 24 header region in C.2, some Appendix D.1 pressure lead-ins, and blocks of the references; all main-text results, key tables, and the limitations section were fully visible.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.