Rank-Bounded Agent Memory: A Storage-Level, By-Design Defense Against Memory-Poisoning Attacks

Persistent memory is the one attack surface of an LLM agent that outlives every session. Memory-poisoning attacks (MINJA, PoisonedRAG) are already packaged in open red-teaming frameworks, while the 2026 wave of runtime defenses guards actions inside a session and leaves storage undefended. This paper presents a memory-schema pattern, enforceable by any agent harness that mediates memory writes, in which every stored record carries an ownership path (a chain such as [self], [self, user], [self, user, self]) - making attribution a schema-enforced property of storage rather than a runtime convention. Rank (path length − 1) is protected by a non-elevation invariant: no operation may promote a claim sourced from another subject into the agent's own picture of the world. This is the Biba no-write-up integrity discipline applied to belief attribution, with the integrity label stored in the record itself, so it crosses the session boundary that episodic defenses do not. The consequence is a class defense: any attack whose payoff is that foreign content becomes the agent's own belief is demoted by construction - injected content can persist only as an attributed claim. The construction stands on one empirical question - can the label be computed reliably? First measurements say yes: blind human self-agreement on path annotation reaches 97.4% over a three-day gap, and a three-model LLM panel annotating under the same written rules matches or exceeds that ceiling, with zero errors on attributed (rank ≥ 1) records.