Proof-of-Execution Memory: one LLM rewrite defeats the SENTINEL memory defense entirely, and stronger models are more vulnerable

arXiv·high signalXBlueskyLinkedInCopy link

The FARMA attack plants fabricated entries in an agent's reasoning memory claiming a safety step already ran, so the agent skips it. The authors show SENTINEL — the defense shipped with FARMA — is evaded on the first try by simply asking an LLM to reword the forgery, and report a capability paradox: 98–100% success on GPT-4o and GPT-4o-mini versus 44% on Llama-3.1-8B, because more capable agents follow reworded claims more faithfully. Their PoEM defense stops inspecting memory entirely, keeping an HMAC-chained ledger writable only by the trusted action layer; attack success drops to 0% with 0% false positives in eight of nine cells, against SENTINEL wrongly blocking 33–50% of legitimate operations.