FARMA Poisons Agent Memory, SENTINEL Defends at 0% False Positive

The attack surface of LLM agents just expanded — not into their knowledge base, but into their own remembered reasoning. The Forged Amplifying Rationale Memory Attack (FARMA) poisons an agent’s stored reasoning traces rather than its factual knowledge, targeting a new attack surface: the agent’s reasoning history [^claim_1507]. This is effectively a cognitive hijack, much like when we observed the 1890s shipping log forgeries that rerouted entire fleets — but here, the target is the agent’s internal ledger of thought. Persistent memory in LLM agents already stores factual knowledge, prior decisions, reasoning histories, tool usage information, and context [^claim_1515]. FARMA exploits this by inserting forged reasoning traces using evasive language that bypasses keyword-based defenses, then amplifies them through self-referential reinforcement that defeats consensus-based defenses [^claim_1508][^claim_1509]. The result: up to 100% attack success rate under baseline conditions, and the ability to defeat existing defenses like keyword filter and A-MemGuard [^claim_1510][^claim_1511].

For crypto, this is a direct threat to autonomous DeFi agents — MEV searchers, liquidation bots, intent-solver agents — that persist reasoning across sessions. An attacker could inject a forged rationale causing the agent to misprice a trade, misidentify an arbitrage opportunity, or approve a malicious transaction, all while the agent “remembers” having reasoned correctly. The interface was cold, like a Bond villain’s terminal — the latency on that script was zero; it hit the target. Any on-chain agent framework relying on simple prompt-level guardrails or multi-agent consensus for safety — think DAO-governed trading agents, multi-sig LLM-based oracles — is vulnerable: a single poisoned reasoning trace can slip past keyword filters and then self-reinforce to outvote honest traces. The yield on compliance just went ex-dividend.

The defense is SENTINEL, a layered pipeline whose core is the Reasoning Guard. It structurally analyzes candidate entries for forgery using five weighted signals [^claim_1512]. In evaluation across multiple agents and different LLM models with 50 trials, SENTINEL reduces FARMA’s attack success rate to as low as 0% with no false positives observed across 326 benign agent traces [^claim_1513][^claim_1514]. That zero false-positive rate is critical for production use — blocking a legitimate agent action could mean a missed liquidation or arbitrage. Short-selling truth has never been so precise.

For crypto agent frameworks, the implication is clear: integrate structural reasoning-trace analysis — via SENTINEL or similar — as a pre-execution check before an agent submits a transaction, or as a runtime monitor in TEE-based agent enclaves. The integrity of the entire memory store becomes a trust assumption, motivating on-chain attestation of memory contents or zero-knowledge proofs of reasoning-trace integrity before execution. FARMA proves the attack is real; SENTINEL proves the defense can be airtight.