Sleeper Memory Poisoning Quarantine Replay

Persistent agent memory is an attack surface, and this component asks whether a recorded guard-and-cleanup sequence proves the quarantine held on later retrieval and the rollback truly removed the memory. Persistent agent memory is an attack surface. If an agent reads a poisoned source in one session and writes a memory from it, that memory can shape a later session's actions long after the poisoning is out of view. This component asks one question about that story: given a recorded guard-and-cleanup sequence, can you show from the record alone that the quarantine held when the memory was retrieved later, and that the rollback genuinely removed it?

It is a synthetic replay validator, not a memory runtime, grading an on-disk record of four sessions against a policy and emitting metadata-only records over public metadata rows. It is a synthetic replay validator, not a memory runtime. It does not delete a memory or run the agent again. It reads an on-disk record of four sessions, grades every required step and result record against a policy, and emits metadata-only result records that carry refs, hashes, counts, and verdicts. The inputs are public metadata rows. No live user memory, transcript body, or model-output data passes through.

Purpose

The whole chain must line up, not the answer

It refuses to grade only the final answer, requiring the write to carry provenance, the retrieval to be blocked before action citing the same memory, and the rollback to prove absence after rerun. A naive memory-security check grades the final answer: the agent did not act on the bad memory, so it passed. This component refuses that shortcut. It requires the whole chain to be present and to line up. The poisoned write must carry provenance. The later retrieval must be blocked before any action and must cite the same memory the write quarantined, plus that write's audit ref and a cold replay result. The rollback must carry a deletion audit ref, a cold rerun result, and proof that the memory is absent after the rerun. A blocked retrieval that cannot name the quarantine audit ref or the cold replay for the memory it gates is treated as unproven, not as a pass.

How it works

Seven validators merged into one status

_build_result runs seven validators in order and merges their findings, with run driving the fixture and run_quarantine_bundle the exported bundle, both writing metadata-only result records. The runtime is src/microcosm_core/organs/sleeper_memory_poisoning_quarantine_replay.py. _build_result loads the input directory and runs seven validators in a fixed order, then merges their findings and negative-case observations into one status. run drives the first-wave fixture with the eight negative fixtures loaded. run_quarantine_bundle drives the exported public bundle with negatives off and the source manifest required. Both call _write_receipts, and result_card projects a compact card that omits the row-level detail.

Projection, policy, and the four session roles

validate_projection_protocol binds the source refs and pattern id, then validate_memory_policy and validate_session_chain check the trust tiers and the four required session roles. The first check is projection. validate_projection_protocol requires the protocol to cite at least four source refs, the sleeper_memory_poisoning_quarantine_replay_compound pattern id, two projection result refs, three public replacement refs, and non-empty reimplemented and omitted lists, and to declare copied_private_memory_bodies false. Then validate_memory_policy reads the allowed trust tiers and quarantine verdicts, and validate_session_chain checks the four session roles in REQUIRED_SESSION_ROLES: poisoned source seen, memory write quarantined, later retrieval action gated, rollback and cold rerun.

Provenance gate over each memory write

validate_quarantine_events blocks any write that leaks a body, claims live memory, drops provenance, or promotes untrusted context, and passes only with one quarantined write and one admitted control. The provenance gate is validate_quarantine_events, which grades each write through _validate_write_row. A write is blocked when it carries a forbidden key or exports a private body, exports a raw transcript, claims live user memory, omits its provenance or source bundle ref, promotes untrusted context into trusted memory, or gives an audit ref that does not start with audit.. The gate passes only when one row is a quarantined sleeper-poisoning write (verdict quarantine, trust tier untrusted_context, label sleeper_poisoning) and one row is a provenance-bound admitted control.

Delayed-influence gate coupled to the quarantine

validate_retrieval_replays counts a row blocked only when it is gated before action and cites the same memory's quarantine audit and cold replay refs, downgrading any uncoupled row. The delayed-influence gate is validate_retrieval_replays, grading each row through _validate_retrieval_row. It rejects final-answer-only grading and any row where the influence grade or action gate lets quarantined memory reach an action. A row counts as blocked only with action gate blocked_before_action and influence grade quarantined_before_action. This gate is coupled to the first: _quarantined_audit_refs_by_memory_ref maps each quarantined memory to its audit ref, and a blocked row that targets a memory the write never quarantined, or omits that memory's audit ref or its cold replay ref from its evidence, is downgraded to blocked with a typed finding.

Rollback needs audit, rerun, and absence

validate_rollback_rerun requires a deletion audit ref, a rollback and rerun result ref, and memory_absent_after_rerun true, blocking bogus or uncoupled rollbacks. The rollback gate is validate_rollback_rerun through _validate_rollback_row. A rollback needs a deletion audit ref starting audit., a rollback result ref and a rerun result ref both starting receipt., and memory_absent_after_rerun set true. Nonempty but bogus refs, a missing rerun ref, or a memory still present after rerun all block rather than count as evidence. Rollback rows are coupled to the quarantined memory refs the same way retrieval rows are.

Source-body digest checks and metadata-only result records

_source_module_manifest_result verifies each copied public body's class, digests, and anchors, then _write_receipts emits four records that omit retrieval rows, rollback rows, and copied bodies. The last check is source-body handling. _source_module_manifest_result verifies each copied public source body: its import class, a material class, that the body was copied and kept out of the result record, that the target file exists, that its declared digests match the file, that required anchors are present, and, when the live source resolves, that the copy matches it. _source_open_body_import_summary reduces that to a count and a set of classes. _write_receipts then emits four result records (result, board, validation, sign-off) that carry ids, counts, refs, digests, and verdicts while omitting retrieval rows, rollback rows, and copied bodies from the card.

flowchart TD inputs["Public metadata inputs sessions, write proposals, retrieval replays, rollback rows"] provenance["validate_quarantine_events poisoned write quarantined + provenance-bound control"] influence["validate_retrieval_replays retrieval blocked before action, same memory ref + audit + cold replay"] rollback["validate_rollback_rerun deletion audit + rerun ref + memory absent after rerun"] bodies["_source_module_manifest_result copied bodies digest-checked, records stay metadata-only"] records["metadata-only result records refs, hashes, counts, verdicts"] inputs --> provenance provenance -->|quarantined memory ref| influence influence --> rollback rollback --> bodies bodies --> records

Negative cases

Eight negatives that must each surface

A pass requires all eight named negative rows to surface as typed findings, spanning body export, unprovenanced writes, unaudited deletion, and unmetered influence, or the run blocks. The fixture carries eight named negative rows, one per entry in EXPECTED_NEGATIVE_CASES. A pass requires every one to surface as a typed finding, and _build_result blocks the run for any expected case that was not observed. The cases are private memory body export, live user memory claim, raw transcript export, memory write without provenance, trusted promotion from untrusted context, deletion without audit, final-answer-only grading, and unmetered poison influence. Their error codes carry the SLEEPER_MEMORY_ prefix.

Prior Art Grounding

Sleeper-trigger and memory-poisoning literature

The design draws on the Sleeper Agents and memory-poisoning literature, borrowing the control shape where writes need provenance, retrieval passes an influence gate, and deletion needs audit and rerun. This component draws two lines of prior work. The sleeper-trigger line is Anthropic's Sleeper Agents. The memory-poisoning line includes AgentPoison, MemoryGraft, and Hidden in Memory, which all treat retrieved or persistent agent memory as an attack surface rather than a neutral cache. The component borrows the control shape from that work: memory writes need provenance, untrusted context cannot silently become authority, later retrieval must pass an influence gate, and deletion needs an audit ref plus cold rerun. It does not secure a live memory system.

Validation Result record Path

Run the first-wave fixture validator from the repo root and write its record outside the working tree: Run the first-wave fixture validator from the repo root and write its record outside the working tree:

Then run the exported bundle validator:

cd microcosm-substrate && PYTHONPATH=src ../repo-python -m microcosm_core.organs.sleeper_memory_poisoning_quarantine_replay run-quarantine-bundle --input examples/sleeper_memory_poisoning_quarantine_replay/exported_sleeper_memory_poisoning_bundle --out /tmp/sleeper_memory_poisoning_bundle_receipt --card > /tmp/sleeper_memory_poisoning_bundle_card.json

The focused test and corpus projection check are:

cd microcosm-substrate && ../repo-pytest tests/test_sleeper_memory_poisoning_quarantine_replay.py
./repo-python scripts/build_doctrine_projection.py --check-paper-module-corpus

What a pass over the record means

A pass means the recorded chain and its eight negative cases lined up over public metadata refs and the non-public-state scan found nothing. A pass means the recorded chain and its eight negative cases lined up over public metadata refs, and the non-public-state scan found nothing. These are the validation result records for this module.