Working paper, v5.1.5 release candidate. This paper develops a substrate-typed taxonomy of memetic replication in persistent-memory AI agents. The framework types replicators by substrate: L1 (transient context window), L2 (persistent memory store), and L3 (model weights). Each substrate is paired with a distinct payload type and a distinct intervention class required to defeat replication. A fourth substrate, L0 (Environmental Persistence Reservoir — shared filesystems, inter-agent message channels, and shared tool registries outside any individual agent boundary), is introduced in §2.5.2 as a scope boundary with four candidate cells (0A–0D) and an implied intervention class (IC-H); formal cell admission for L0 is deferred to a subsequent paper. Twelve of the 13 formally admitted taxonomy cells are documented against published AI-agent attack literature, with evidence grades A through C. Cases covered include indirect prompt injection, memory poisoning (Unit 42; Microsoft Security 2025–2026), procedural graft (Srivastava et al. 2025), Zombie Agents-class frame persistence, RLHF-amplified disposition (Shapira et al. 2026), training-data backdoors, subliminal distillation inheritance (Wang et al. 2026), and reasoning-process backdoors (BadChain, DarkMind). The Stanford Hall et al. 2026 case — agents writing behavioral instructions to a shared skills file for future instances — is mapped to L0 candidate cell 0B as a near-case. The framework's risky prediction is one predicted cell, 2D (Prionic Autocatalytic Frame Templating), operationalized via four joint conditions: a frame-not-fact payload; persistence across sessions and topics; resistance to fact-correction and procedure-blocking; and self-templating into same-type memory entries. The pre-registration protocol in §10.3 commits to a 7-year falsification horizon, OSF pre-registration with a citable DOI before any 2D-confirming observation, and explicit inter-rater reliability (Cohen's κ ≥ 0.80) and effect-size (Cohen's d) thresholds. The paper compares the framework against OWASP LLM Top 10 (2025), NIST AI RMF and AI 600-1, MITRE ATLAS, and BackdoorLLM. It enumerates three structural framework gaps (plasmidic, mutualistic, ecological) and positions persistent-memory AI agents as unusually instrumentable cultural-evolution substrates. The pathogen-class mnemonics (viral, prionic, retroviral) are framed as mnemonics for a decision tree rather than as evidential biological claims; the substitution test holds. This deposit contains four artifacts: The master manuscript v5.1.5 (~25,500 words, estimated — see note below) The v5.1.3 → v5.1.4 changelog (most recent available; v5.1.4 → v5.1.5 changelog pending) The Reviewer Checklist v1.0 (81 items keyed to §5, §6, and §10; labeled v5.1.3, content applies to v5.1.5) The Alignment Forum short companion v1.4 (~2,900 words; references v5.1.3 in title block, core content applies to v5.1.5)
Emma Muehle (Mon,) studied this question.