FlagThis

Abstract

Retrieval-Augmented Generation (RAG) systems underpin an increasing fraction of enterprise AI deployments. When an agents memory store persists across user sessions, an adversary who can interact with the system can inject carefully crafted memories that, once retrieved, redirect the agents behaviour on future querieswithout ever modifying model weights or application code. We call this the MultiSession Memory Poisoning (MSMP) threat and observe that no existing defence provides a formal security certificate against it. Static-corpus defences (RobustRAG, ReliabilityRAG) assume a fixed knowledge base; heuristic filters are bypassable by fluent enterprise-style text. We present Signed Memory with Smoothed Retrieval (SMSR), a two-component defence that is the first to provide a certified robustness bound for the MSMP setting. Component 1 applies HMAC-SHA256 provenance tagging at write time, creating a cryptographically hard boundary against unsigned injection. Component 2 applies randomised memory ablation at query time with a verdict-based majority aggregator, bounding the influence of authenticated adversaries.