MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems
For developers and deployers of memory-backed LLM agents, MemMark provides a robust method to prove ownership of leaked memory snapshots, solving a practical attribution problem in agent systems.
MemMark embeds an owner-controlled watermark into latent memory-write decisions of LLM-based agents, enabling attribution from leaked or migrated snapshots without logs or trusted metadata. It preserves memory utility (99.6% F1, +0.2% BLEU-1) and recovers full 40-bit payloads from snapshots under the R3 setting, with near-chance wrong-key verification.
Memory-backed agents need provenance that can survive leaked or migrated snapshots, where logs, visible outputs, and trusted metadata may be absent. We propose MemMark, a state-evolution attribution watermark that embeds an owner-controlled signal into latent memory-write decisions. At each internal LLM call, MemMark samples among admissible candidates using keyed, distribution-preserving selection, and records cryptographic commitments with signed session anchors and reveal evidence. This makes attribution depend on reproducible backend behavior rather than mutable provenance fields. Across A-Mem and Graphiti on LoCoMo, with three LLM backbones, MemMark preserves memory utility: Overall F1 retains 99.6% of the unwatermarked baseline, while BLEU-1 changes by +0.2%. It also provides usable carrier capacity, with 1.16, 1.14, and 1.26 bits of mean entropy for update-target, link-target, and semantic-realization decisions. In the snapshot-only R3 setting, MemMark recovers the full 40-bit payload from final snapshots, while wrong-key verification remains near chance. Under nine memory-lifecycle attacks, verification distinguishes tampering, evidence deletion, and partial payload recovery. These results show that robust snapshot-only attribution is feasible for long-term agent memory without surviving traces, trusted metadata, or utility-degrading.