Once a claim becomes a row, it reads as fact
We ran an experiment on Veracium and five memory architectures. Four of the five designs predate the whole idea of an AI agent.
Here are the five memory architectures we built:
- An append-only event log
- Bitemporal SQL tables with validity intervals
- A profile document revised in place
- A versioned knowledge graph
- Plain retrieval over stored text (the default for agent memory today)
These are our own constructions, built deliberately without any trust machinery, because that is the variable we wanted to isolate.
Every one of them records where each fact came from. Not one of them consults that record when deciding what to believe.
Then we lied to them.
The setup
Each test case, which we call a probe, is unglamorous. That is the point. An untrusted source states something. Later, a trusted speaker mentions the same thing, not vouching for it, just repeating it. Then we ask the system a question whose answer depends on whether it believes the original claim.
No jailbreak. No adversarial prompt. Nothing that looks like an attack. Just a claim that entered through one door and got restated at another.
What happened
All five record the source. None of them consult it. And after a trusted speaker restated an untrusted claim, the four cleanly-scorable baselines asserted it as fact in 55–90% of scored probes, depending on architecture (our instrument could not reliably score the fifth; too few of its results could be scored cleanly enough to quote a number).
The worst performer is the one that ought to be the most careful. Our bitemporal-SQL baseline is a design pattern about thirty years older than any of this, and its source column is recorded and read by nothing. In it, 90.3% of untrusted seeded claims (93 of 103 scored probes) were asserted as fact after a trusted speaker restated them.
That design has the most rigorous provenance of the five, the fullest record of who said what. Columns for where a record came from, when it was valid, when it was superseded. Decades of database practice. And it believed the attacker nine times out of ten, because nothing in the query path ever asks the source column a question.
There is a second result that is, if anything, worse. When two untrusted sources merely agreed with each other, with no trusted speaker involved at all, the baselines treated that repetition as corroboration in 94–100% of scored agreement probes (for four of the five arms; our instrument could not reliably score the fifth). Two strangers saying the same thing was enough. Consensus among the untrusted read as confirmation.
The finding
Recording provenance is not the same as enforcing it. A source column nothing reads is a label, not a defense.
This is the part we most wanted to test, and it is why the baselines are our own constructions rather than other people’s products. The claim isn’t “look how bad those systems are.” It is a neutrality claim, and a narrower one: a design built without trust machinery fails precisely where it lacks trust machinery, regardless of how sophisticated it is in every other respect. The thirty-year-old bitemporal design and the plain retrieval baseline fail the same way, for the same reason, at different rates.
Once a claim becomes a row, it reads as fact.
A trap worth naming
There is an obvious-looking defense in the data, and it is a trap.
Some architectures repeat attacker phrasing far less than others. In our interval-table baseline, attacker phrasing was repeated as fact in 27.8% of scored probes, against 86.8% in the plain-retrieval baseline. It would be easy to read the first as “more resistant.”
It isn’t, and the inversion is the interesting part: the arms that repeat attacker phrasing least are also the arms that lose the most trusted facts. Structure absorbs attacks and eats facts in roughly the same proportion. A system that summarises and restructures aggressively will mangle an attacker’s wording. It will mangle your user’s wording too. Suppression is not discrimination. If a memory system tells you it rarely repeats injected text, the follow-up question is how much of everything else it also dropped.
Where we sit
Veracium enforces provenance at the moment of assertion, when the system decides whether to state a claim as fact. At that moment it reads the claim’s source. The source is consulted, not just filed next to the claim.
Measured as a case study on the same scoring setup, fixed in advance, on our own system, Veracium repeated untrusted content verbatim in 13.9% of the same probes.
That number is not zero, and we are not going to present Veracium as perfect. It is the lowest such figure among the arms the instrument scores cleanly, and it is still one probe in seven. We publish it because a memory system that claimed perfect resistance would be making exactly the kind of unenforced assertion this whole experiment is about.
The question to take away
Whatever memory utility your agent uses, ours or anyone’s, the useful test is short:
When your system decides whether to assert something, does anything in that code path read the record of where it came from?
If the answer is no, the source column is just documentation. It may still be useful documentation but it is not a control, and the difference shows up the first time someone restates a claim you did not make.
You can check ours: veracium selfcheck ships in the package. Point it at an LLM
provider (or your own completion callable) and it exercises these properties on
your own machine.
Veracium is an open-source (MIT) provenance-aware memory library for AI agents.
One SQLite file, bring your own model. pip install veracium.
Discuss: GitHub Discussions