Abstract

Agent memory is moving to graphs, and the provenance defenses now being built for it all check one thing: the provenance of the records an agent retrieves. We show that this entire class of defense is blind by construction. A longterm graph memory runs a global selection step over writable graph structure, so structure that an untrusted principal writes changes which authenticated facts are selected while the cited evidence stays fully authenticated; faithful information-flow control (IFC), checking the provenance of what the reader uses (all of it authenticated), makes the byte-identical decision to no defense at all, across document-QA substrates and real multisession agent memory. In the most consequential instance, a no-source structural write silently misdirects 28 irreversible ledger transfers over 499 live actions: faithful IFC permits every one, and AUTHSELECT prevents every one. We then characterize exactly which memories are exposed: a selector admits the channel when its structural term can reallocate an (1) share of top- k membership past a selected facts margin. Personalized PageRank can, since a sourceless write reroutes conserved random-walk mass; a content-fixed reranker cannot, and Graphitis node-distance, which leans on structure more than PageRank does, stays immune. Reallocatability, not reliance, is the predictor. We prove the immune case in general and the open case under a chokepoint condition we verify. Closing the channel forces any provenance defense to recompute selection on the authenticated subgraph, which is what AUTHSELECT does, at zero over-block and 23% latency.