Journal article
A Safety Memory Is a Declassification Channel: Why Origin Binding, Taint Tracking and Memory Isolation Do Not Secure the Records an Agent Writes About Attacks
Two lines of work on language-model agents have converged on the same component from opposite directions. One proposes that an agent keep a persistent safety memory, so that an attack seen once, a request refused once or a source found untrustworthy once continues to inform decisions in later…