Memory poisoning, attack success rate
A belief established by 4 trusted observations, flooded with 50 false writes from an untrusted channel
- Channel trust
- 0.20
- Trials per cell
- 400
- Seed
- 20260709
- Config
- k=4, obs=4
| Injections | 1 | 3 | 5 | 10 | 20 | 50 |
|---|---|---|---|---|---|---|
| Last write wins | 100 | 100 | 100 | 100 | 100 | 100 |
| Majority vote | 0 | 0 | 100 | 100 | 100 | 100 |
| Nous, provenance capped | 0 | 0 | 0 | 0 | 0 | 0 |
Attack success is 0 percent at every injection volume tested while the attacker's channel is trusted at or below 0.5, measured on the 4 value configuration with 4 trusted observations. The breakpoint is 0.55.
Attack succeeds when the attacker's false value becomes the agent's belief, in percent. Lower is better. The two unprotected baselines are shown separately, never merged.
What this does not claim
The majority baseline is not flipped at every volume
It reads 0.0% at M = 1 and only flips from M = 5, once the flood outnumbers the trusted evidence. Last write wins is flipped from M = 1.
Forged trust defeats the defense outright
With the attacker on a channel trusted at 0.90, attack success is 100.0%. Reliability weighting cannot protect content it wrongly trusts. The defense holds to trust 0.50 and breaks at 0.55.
Laundering needs taint tracking, which is now implemented
Routed through a trusted intermediary that forgets the untrusted origin, attack success returns to 100.0%, and to 0.0% once provenance propagates. Measured against the real engine in nous/provenance.py: 100.0% without the chain, 0.0% with it.
The cap costs benign accuracy at low tiers
A reliable source routed through tier 0.20 drops to 8.8% accuracy in the stable noise regime, against 100.0% uncapped.