MutMem-V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence
cs.CR · cs.AI
Quick verdict
A rigorously specified, cross-verified cryptographic evidence protocol for agent-memory mutation; strong claim discipline but no new empirical results.
Summary
MutMem V2 is a protocol-and-evidence paper that closes the publication gap left by MutMem V1: a portable, independently checkable verification contract for cryptographically authorized mutation in persistent agent memory. It fixes canonical JSON bytes, domain-separated object and bundle commitments, RFC 6962-style ordered Merkle disclosure, external trust anchors, identity epochs, revocation, and a closed vocabulary of 37 recall failure reasons; membership is exactly 13+5r objects per recall bundle, with 18 versioned schemas and 39+15 test vectors. Two independent implementations (Node and Python) match verdict and primary reason on all 72 terminals, and a production-derived conformance corpus agrees on 42/42 cases across 28 classes; one clean Node v26.8.1 install passes boot, restart, and scheduler checks, and every public table regenerates from a self-hashed aggregate. The only new empirical result, a 120-unit Canary lane, shows 60/60 explicit markers detected and 0/60 clean units flagged — marker traversal, not a general poisoning defense. All utility and security numbers (e.g., LongMemEval 91.80% judged accuracy, induced ASR 1.02% on an adapted N=100 PoisonedRAG setup) remain historical V1 results by the same author, LLM-judged and not independently replicated — the paper's central limitation, which it discloses unusually candidly.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- MutMem V2 defines a complete portable verification contract — canonical bytes, 18 versioned schemas, exactly 13+5r objects per recall bundle, RFC 6962 ordered commitments, external trust anchors, and 37 closed failure reasons — without introducing a second memory engine.
- Independent Node and Python verifiers agree on verdict and primary reason for all 72 structural and cryptographic terminals, and a production-derived conformance corpus agrees on 42/42 cases across 28 required classes.
- Every public table regenerates deterministically from a self-hashed aggregate, with an independent verifier reconstructing the statistics (44 rate/Wilson rows, 28 McNemar/Holm rows) and claim boundaries.
- The only new experiment, a 120-unit Canary lane, supports explicit-marker traversal exclusively (60/60 detected, 0/60 clean flagged) and is not evidence of general poisoning or injection defense.
- Historical V1 empirical results (e.g., LongMemEval 91.80% judged, induced ASR 1.02%) remain historical and are not relabeled as current-source V2 results.
Strengths
Exhaustive claim-to-evidence discipline
Section 2 defines three non-interchangeable labels (current V2 / historical V1 / boundary, where missing evidence is never a zero), and Table 4 maps all 17 claims to disposition, denominator, and limitation, including three explicitly PROHIBITED claims (CONTENT-TRUTH, UNIVERSAL-DEFENSE, INDEPENDENT-REPLICATION).
Byte-complete protocol specification
Section 4 gives canonical JSON bytes, prefix-free length framing, domain-separated commitments (Eqs. 1, 5, 6), RFC 6962 ordered Merkle disclosure (Eqs. 3–4), and a closed vocabulary of 37 failure reasons — making verdict/reason parity mechanically testable; the external master fingerprint is an input to verification, explicitly avoiding circular trust (§4.3).
Independent dual-implementation verification
Fully reproducible publication pipeline
Candid limitation reporting
Weaknesses
No new empirical evidence
LLM-as-judge circularity on headline metrics
Headline security effect rests on one event
Security signal is intentionally thin
Compositional novelty
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
MutMem V2 (arXiv:2609.01235; cs.CR/cs.AI) by Walid Saidi, an independent researcher, is explicitly a protocol-and-evidence paper rather than a new memory system: 'MutMem denotes the portable protocol; HOM-AIMOS is one producer' (§1). The four contributions are a versioned recall-disclosure envelope with complete membership N(r)=13+5r (Eq. 2), cross-object predicates across authority/admission/decision/per-result/terminal boundaries (§4.4), a portable mutation profile with three exhaustive terminals (§5), and an independent verification and regeneration apparatus. Claim discipline is the paper's signature: §2 defines three non-interchangeable labels (current V2 / historical V1 / boundary, where missing evidence is never converted into a zero), and Table 4 maps all 17 claims to disposition, denominator, and limitation — including three explicitly PROHIBITED claims (CONTENT-TRUTH, UNIVERSAL-DEFENSE, INDEPENDENT-REPLICATION). The verifiable headline claims are: 72/72 Node/Python verdict-and-reason parity, 42/42 production conformance across 28 classes, one clean-install qualification, and deterministic regeneration of every public table.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is MutMem V2 about?
It specifies a portable verification protocol for cryptographically authorized mutation of persistent AI-agent memory: canonical byte encodings, domain-separated signed commitments, ordered Merkle disclosure of recalled results, external trust anchors, and a closed set of 37 failure reasons. A reviewer can check the released evidence with two commands (npm run verify, npm run evidence:regenerate) without trusting the producer's database or runtime.
Does MutMem V2 report new performance results?
No. Its only new experiment is a 120-unit Canary lane detecting explicit markers (60/60 detected, 0/60 clean units falsely flagged). All accuracy and security numbers — e.g., LongMemEval 91.80% judged accuracy and a 1.02% induced attack success rate on an adapted N=100 PoisonedRAG setup — are historical V1 results from the same author, explicitly not relabeled as V2 reruns and not independently replicated.
Is the code and evidence available?
Yes. Source is AGPL-3.0-or-later, released at GitHub repository HOM-AIMOS, immutable tag v1.0.0, mutually bound to a release commit and a source-manifest root. Offline verification is exactly 'npm run verify'; deterministic evidence regeneration is exactly 'npm run evidence:regenerate'. Benchmark dataset text and provider payloads are not redistributed.
What does MutMem V2 NOT prove?
The paper is explicit: cryptographic integrity does not establish that remembered content is true (semantic truth is a PROHIBITED claim); the fixed marker and N=100 experiments do not establish universal robustness; and verifier portability is distinct from independent empirical replication — no outside team has reproduced the empirical results.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Extraction appears complete: text runs from title through Appendix B with the reference list intact; no truncation detected.
- Cryptographic roots, commit hashes, and tag bindings are quoted as printed and were not recomputed; this review covers the manuscript text only, not the repository or evidence artifacts.
- Tables and equations were extracted as linearized text; all cited numbers were legible and cross-checked against Tables 1–4.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.