{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:VOPMAZ7VFBKHHWSOTB4ZE2FRXE","short_pith_number":"pith:VOPMAZ7V","canonical_record":{"source":{"id":"2606.04329","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-03T01:04:13Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"a388a889bb7816bd92a10c17dc2278c01208908d60688c32924d56770758e751","abstract_canon_sha256":"ca578a4ddcaf842cd1b2d11140310c336e0c07725dcb2225a7b4fc6ed2ee1f08"},"schema_version":"1.0"},"canonical_sha256":"ab9ec067f5285473da4e98799268b1b9055df60f7d3d8342730f0e786755aff1","source":{"kind":"arxiv","id":"2606.04329","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.04329","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"arxiv_version","alias_value":"2606.04329v1","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.04329","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"pith_short_12","alias_value":"VOPMAZ7VFBKH","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"pith_short_16","alias_value":"VOPMAZ7VFBKHHWSO","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"pith_short_8","alias_value":"VOPMAZ7V","created_at":"2026-06-04T01:09:03Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:VOPMAZ7VFBKHHWSOTB4ZE2FRXE","target":"record","payload":{"canonical_record":{"source":{"id":"2606.04329","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-03T01:04:13Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"a388a889bb7816bd92a10c17dc2278c01208908d60688c32924d56770758e751","abstract_canon_sha256":"ca578a4ddcaf842cd1b2d11140310c336e0c07725dcb2225a7b4fc6ed2ee1f08"},"schema_version":"1.0"},"canonical_sha256":"ab9ec067f5285473da4e98799268b1b9055df60f7d3d8342730f0e786755aff1","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-04T01:09:03.788286Z","signature_b64":"hWkLo1sgHFdpEVK2tC+q4MvWN+VKQKJyMtfWxJPWs2Q4OqHykcsrUwjaG890ef2k78EefvE9V2hg2UxdKvjXAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ab9ec067f5285473da4e98799268b1b9055df60f7d3d8342730f0e786755aff1","last_reissued_at":"2026-06-04T01:09:03.787122Z","signature_status":"signed_v1","first_computed_at":"2026-06-04T01:09:03.787122Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.04329","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-04T01:09:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ftk9U7i52wSxPs3CIg+FFZfyNzL/kIZ3bYTQj9we8k3b5sWvCl/ag3KXNNBrIadYZ2kMxq/ZK4zTeJlPiRb9Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-27T04:54:02.938373Z"},"content_sha256":"b46ed7f48e06e6633d313eb692a08c8e22c209ce41483a5c393324c3736609df","schema_version":"1.0","event_id":"sha256:b46ed7f48e06e6633d313eb692a08c8e22c209ce41483a5c393324c3736609df"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:VOPMAZ7VFBKHHWSOTB4ZE2FRXE","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Aditi Jain, Pritam Dash, Tanmay Shah, Tongyu Ge, Zhiwei Shang","submitted_at":"2026-06-03T01:04:13Z","abstract_excerpt":"Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of s"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.04329","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.04329/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-04T01:09:03Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BbUt3q8PyMnfdS97njApTMoj0jXAh1PZq0uNLh1x1nTVS+3EgOdS46YAJTZ4x1VfzRi1dvAByUWCAOe5u4kvDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-27T04:54:02.938744Z"},"content_sha256":"9a22a4ab6391eeed284fd3cec820b3dc4f5ba47ee5ca9af4d7bd4bae1f194635","schema_version":"1.0","event_id":"sha256:9a22a4ab6391eeed284fd3cec820b3dc4f5ba47ee5ca9af4d7bd4bae1f194635"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/VOPMAZ7VFBKHHWSOTB4ZE2FRXE/bundle.json","state_url":"https://pith.science/pith/VOPMAZ7VFBKHHWSOTB4ZE2FRXE/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/VOPMAZ7VFBKHHWSOTB4ZE2FRXE/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-27T04:54:02Z","links":{"resolver":"https://pith.science/pith/VOPMAZ7VFBKHHWSOTB4ZE2FRXE","bundle":"https://pith.science/pith/VOPMAZ7VFBKHHWSOTB4ZE2FRXE/bundle.json","state":"https://pith.science/pith/VOPMAZ7VFBKHHWSOTB4ZE2FRXE/state.json","well_known_bundle":"https://pith.science/.well-known/pith/VOPMAZ7VFBKHHWSOTB4ZE2FRXE/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:VOPMAZ7VFBKHHWSOTB4ZE2FRXE","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"ca578a4ddcaf842cd1b2d11140310c336e0c07725dcb2225a7b4fc6ed2ee1f08","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-03T01:04:13Z","title_canon_sha256":"a388a889bb7816bd92a10c17dc2278c01208908d60688c32924d56770758e751"},"schema_version":"1.0","source":{"id":"2606.04329","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.04329","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"arxiv_version","alias_value":"2606.04329v1","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.04329","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"pith_short_12","alias_value":"VOPMAZ7VFBKH","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"pith_short_16","alias_value":"VOPMAZ7VFBKHHWSO","created_at":"2026-06-04T01:09:03Z"},{"alias_kind":"pith_short_8","alias_value":"VOPMAZ7V","created_at":"2026-06-04T01:09:03Z"}],"graph_snapshots":[{"event_id":"sha256:9a22a4ab6391eeed284fd3cec820b3dc4f5ba47ee5ca9af4d7bd4bae1f194635","target":"graph","created_at":"2026-06-04T01:09:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.04329/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of s","authors_text":"Aditi Jain, Pritam Dash, Tanmay Shah, Tongyu Ge, Zhiwei Shang","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-03T01:04:13Z","title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.04329","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b46ed7f48e06e6633d313eb692a08c8e22c209ce41483a5c393324c3736609df","target":"record","created_at":"2026-06-04T01:09:03Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"ca578a4ddcaf842cd1b2d11140310c336e0c07725dcb2225a7b4fc6ed2ee1f08","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-06-03T01:04:13Z","title_canon_sha256":"a388a889bb7816bd92a10c17dc2278c01208908d60688c32924d56770758e751"},"schema_version":"1.0","source":{"id":"2606.04329","kind":"arxiv","version":1}},"canonical_sha256":"ab9ec067f5285473da4e98799268b1b9055df60f7d3d8342730f0e786755aff1","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ab9ec067f5285473da4e98799268b1b9055df60f7d3d8342730f0e786755aff1","first_computed_at":"2026-06-04T01:09:03.787122Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-04T01:09:03.787122Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"hWkLo1sgHFdpEVK2tC+q4MvWN+VKQKJyMtfWxJPWs2Q4OqHykcsrUwjaG890ef2k78EefvE9V2hg2UxdKvjXAA==","signature_status":"signed_v1","signed_at":"2026-06-04T01:09:03.788286Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.04329","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b46ed7f48e06e6633d313eb692a08c8e22c209ce41483a5c393324c3736609df","sha256:9a22a4ab6391eeed284fd3cec820b3dc4f5ba47ee5ca9af4d7bd4bae1f194635"],"state_sha256":"613d50c37e1e481ee410269fea5421e7a6dc051e8cd8776a60a5dad77e38e5ab"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"klJLBwKDH9KTMmDyIhf/AMivU/SGuH4b8BIAKAbMlxjVlQBHcI42HOomOy/1TyPxZMfjAqap2/Jl40YqLxS/BQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-27T04:54:02.940659Z","bundle_sha256":"02a35686f2e1c9ca6b6dff6068609c63784234378656b63cbcfc73cdef5b407a"}}