# Persistent Agent Memory Needs an Integrity Model, Not Just a Prompt Filter _PerMIT frames agent memory as an integrity problem: what can become trusted, persistent, and shared. Here is what it assumes, reports, and leaves open._ By kestrel (AI writer at Yelno) · Edited by sina · Published Oct 26, 2026 Canonical: https://yelno.ai/blog/persistent-agent-memory-integrity-model-permit PerMIT shifts the focus from screening prompts to controlling what information can become trusted, persistent, and shareable across agents. One implication is that untrusted information retained in memory may affect a later action, even after the original input is no longer in view. The paper's trust assumption is that only user-typed inputs and values confirmed at a gate are trusted; environment-derived values begin untrusted. [1] ## Why persistent memory changes LLM agent memory security A prompt filter watches content at the door. Persistent memory creates another security boundary: information may be retained for later use or shared among agents. PerMIT is a memory architecture designed to address injection and poisoning risks in persistent memory and memory sharing. [1] For an enterprise team, the question is not only whether an agent recognizes suspicious content. It is also who or what can make information durable, reusable, or influential across agents. That is an architectural question about how information earns trust and how those rules are enforced, not only a question of detecting suspicious text. PerMIT mediates the release and use of untrusted, environment-derived values through a finite memory interface, while preserving agent-driven multi-turn planning and tool choice. [1] One way to read this design is as an integrity control over memory, rather than detection added to a memory store. ## What exactly does PerMIT trust? The trust assumption is narrow: user-typed inputs are trusted, while environment-derived values start untrusted unless confirmed at a gate. [1] A gate confirmation is a verdict on exact content, and each verdict is logged for later review. [1] The paper says that, within its threat model, attacks reduce to an auditable decision that a human, an LLM verifier, or both can make. [1] The paper also reports two integrity theorems machine-checked in Lean 4. It reports zero observed attack success on Trojan Hippo with self-verification and lightweight verifiers; that is an experimental result, not a guarantee about every deployment. [1] ## Multi-agent memory sharing: questions to ask before you trust it Shared memory is where the trust model gets tested. PerMIT records confirmations as logged verdicts on exact content and allows endorsements to accumulate across users, so sufficiently endorsed items can become community-confirmed without further verification. [1] The source leaves authentication, collusion handling, thresholds, and revocation as questions teams must examine. [1] A practical checklist for agent memory poisoning risk follows from that: - Who can write to memory, and who can confirm what was written? - How do confirmations bind to exact content? - How are endorsers authenticated? - What happens after a compromise or collusion? - How are harmful confirmed items revoked? These questions test whether a deployment actually matches PerMIT's stated trust model. [1] ## Where this fits in an AI agent security architecture Memory integrity is one layer. Controlling which providers and models an agent can call is a different layer, and an [enterprise AI gateway](/enterprise) with routing constraints addresses that second one without replacing a memory trust model. Teams designing agent systems may also find it useful to read how [SPEM changes LLM agent architecture](/blog/spem-llm-agent-skill-library-retrieval) for skill retrieval, and a [reviewer's checklist for Ray on Kubernetes agents](/blog/ray-kubernetes-ai-agents-reviewer-checklist) for the infrastructure side. ## What the evidence does and does not show The paper reports machine-checked theorems and benchmark or simulation findings. It does not provide production-deployment evidence, and its guarantees apply under the stated trust and threat-model assumptions. [1] Treat PerMIT as a design to evaluate against your own memory architecture, not as proof that persistent agent memory is secure in production. ## Frequently asked questions ### What is PerMIT in LLM agent memory security? PerMIT is a proposed architecture for persistent LLM-agent memory and shared memory. It mediates untrusted, environment-derived values through a finite memory interface and uses gate confirmation before those values can reach sensitive actions or affect behavior through displayed content. [1] ### What is PerMIT's trust assumption? PerMIT states that only user-typed inputs and values confirmed at a gate are trusted. Environment-derived values are treated as untrusted until they pass that confirmation boundary. [1] ### Does PerMIT prove that agent memory is secure in production? No. The paper reports machine-checked theorems, benchmark or simulation findings, and no production-deployment evidence. Its guarantees apply under the stated trust and threat-model assumptions. [1] ### How does PerMIT address multi-agent memory sharing? It records confirmations as logged verdicts on exact content and allows endorsements to accumulate across users, so sufficiently endorsed items can become community-confirmed without further verification. The source leaves authentication, collusion handling, thresholds, and revocation as questions teams must examine. [1] ### What should teams ask before trusting shared agent memory? They should identify who can write, who can confirm, how confirmations bind to exact content, how endorsers are authenticated, what happens after compromise or collusion, and how harmful confirmed items are revoked. These questions test whether the deployment actually matches PerMIT's stated trust model. [1] ## Questions **What is PerMIT in LLM agent memory security?** PerMIT is a proposed architecture for persistent LLM-agent memory and shared memory. It mediates untrusted, environment-derived values through a finite memory interface and uses gate confirmation before those values can reach sensitive actions or affect behavior through displayed content. [1] **What is PerMIT's trust assumption?** PerMIT states that only user-typed inputs and values confirmed at a gate are trusted. Environment-derived values are treated as untrusted until they pass that confirmation boundary. [1] **Does PerMIT prove that agent memory is secure in production?** No. The paper reports machine-checked theorems, benchmark or simulation findings, and no production-deployment evidence. Its guarantees apply under the stated trust and threat-model assumptions. [1] **How does PerMIT address multi-agent memory sharing?** It records confirmations as logged verdicts on exact content and allows endorsements to accumulate across users, so sufficiently endorsed items can become community-confirmed without further verification. The source leaves authentication, collusion handling, thresholds, and revocation as questions teams must examine. [1] **What should teams ask before trusting shared agent memory?** They should identify who can write, who can confirm, how confirmations bind to exact content, how endorsers are authenticated, what happens after compromise or collusion, and how harmful confirmed items are revoked. These questions test whether the deployment actually matches PerMIT's stated trust model. [1] ## Sources 1. [PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust](https://arxiv.org/abs/2610.28987) — arxiv — Oct 22, 2026 How this article was made: https://yelno.ai/blog/about