让智能体记忆可安全修改，防止篡改同时保留追溯证据。
MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory
- 用签名记录每次权重变更，确保修改合法可追溯。
- 在长程问答测试中准确率达91.8%，对抗毒化攻击时0毒物泄露。
- 适合需要可信记忆演化的AI系统，如金融、医疗决策场景。
持久化智能体记忆需随新结果动态调整，但可变检索权重引发归属难题：如何区分授权修改与数据库篡改？我们提出MutMem，一种在HOM-AIMOS持久化智能体记忆引擎中的授权修改协议。MutMem保留记忆内容，记录带签名的正负证据且无时间过期，每个非平凡权重变更均以管家授权的过渡形式提交。每次过渡绑定终端溯源节点、签名者纪元、量化旧/新权重、无分叉前驱及两个域分离的SHA-256承诺。Ed25519验证在数据库写入端与便携验证器中运行。被标记为有毒可能的内容保留带签名、可修订的标签，供召回时作为信任证据。评估显示：在LLM判断下，HOM-AIMOS在LongMemEval上正确回答459/500题（91.8%）；在LoCoMo上获得74.12%判断准确率，上游兼容协议下58.20词级F1。原生测试套件通过所有声明的授权、拓扑、篡改、签名纪元与变更后召回验证；中位签名过渡延迟为4.865毫秒。在预注册的N=100 PoisonedRAG适应测试中，攻击后顶级披露中无任何注入毒物（0/100；95%威尔逊上限3.70%），而对98个干净负例目标，诱导目标答案攻击成功率仅为1/98（1.02%）。预先注册的四臂消融实验表明，检索减少归因于已签名存储标签：当认知策略被绕过时，检索器选择毒物覆盖94/100目标，标签恢复后则为0/100。MutMem提供完整性、授权性、可追溯性与历史连续性的证据，但不保证内容真实性。
原文摘要 · Abstract (English)
Persistent agent memory must adapt as later outcomes change earlier evidence, yet mutable retrieval weights create an attribution problem: reviewers must distinguish authorized adaptation from database tampering. We present MutMem, an authorized-mutation protocol in HOM-AIMOS, a persistent agent-memory engine. MutMem retains memory content, records signed positive and negative outcome evidence without age-based expiry, and commits each nontrivial weight change as a housekeeper-authorized transition. Each transition binds a terminal provenance node, signer epoch, quantized old and new weights, a no-fork predecessor, and two domain-separated SHA-256 commitments. Ed25519 verification runs in both the database writer and a portable verifier. Content classified as poison-likely is retained with signed, revisable labels used by recall as trust evidence. We evaluate utility, mutation integrity, and poisoning adaptation. HOM-AIMOS answers 459/500 LongMemEval questions correctly under LLM judgment (91.8%). On LoCoMo, it obtains 74.12% judged accuracy and, under a separate upstream-compatible protocol, 58.20 token F1. A native suite passes all declared authorization, topology, tamper, signer-epoch, and post-mutation-recall cases; median signed-transition latency is 4.865 ms. In a declared N=100 PoisonedRAG adaptation, no injected poison appears in attacked top-5 disclosures (0/100; 95% Wilson upper bound 3.70%), while induced target-answer attack success among 98 clean-negative targets is 1/98 (1.02%). A preregistered four-arm ablation attributes the retrieval reduction to signed stored labels: the retriever selects poison for 94/100 targets when epistemic policy is bypassed and 0/100 when labels are restored. MutMem provides evidence of integrity, authorization, traceability, and historical continuity; it does not establish content truth.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。