Write-time memory-poisoning defenses cost nothing measurable, the read-time reranker costs 4.4 points.

The study holds memory backend, retrieval and judge fixed and varies only the defense, with three repetitions across five conversations to separate effect from pipeline noise that stays significant even at temperature zero. Input sanitization, provenance checking and LLM anomaly detection all show confidence intervals around ±4.5 points that include zero. The read-time reranker lowers core accuracy by 4.4 points (95% CI [-9.0, -0.05], McNemar p=0.064) and quarantines content on conversations containing no attack. (arXiv 2609.22818)