SuperLocalMemory is a local-first memory system for multi-agent AI defending against OWASP ASI06 memory poisoning via architectural isolation, Bayesian trust scoring (trust gap = 0.90, 72% sleeper degradation), and adaptive zero-LLM re-ranking (+104% NDCG@5) — all without cloud dependencies.
AI agents with persistent memory inherit persistent vulnerabilities. OWASP ASI06 identifies memory poisoning as a critical threat: poisoned memories survive session boundaries and influence all subsequent decisions. Documented production attacks include Gemini Memory exploit and calendar invite poisoning (73% success rate). Cloud-based memory systems (Mem0, MemOS, Letta) create centralized attack surfaces: multi-tenant cross-contamination, network exposure, opaque provenance, vendor lock-in. No existing system provides trust scoring or memory poisoning defense.
Four-layer progressive enhancement stack:
Bayesian trust model (Eq. 2): $t_{i+1} = t_i + \delta \cdot \frac{1}{1 + n \cdot \eta}$ where the decay factor makes trust harder to move with longer history — protecting against both false accusations and reputation laundering. Signal magnitudes are deliberately asymmetric (negative > positive), making trust harder to gain than lose. Enforcement: agents below $t < 0.3$ are blocked from writes.
Adaptive learning layer (v2.7): Three-layer behavioral analysis (cross-project technology preferences, project context detection, workflow pattern mining) with three-phase progression: Phase 0 (<20 signals, unchanged), Phase 1 (20–199, rule-based 9D feature boost), Phase 2 (200+, gradient boosted decision tree with LambdaRank).
核心技术壁垒: The local-first architectural isolation eliminates cloud-mediated attack surfaces by design — memories never traverse a network, no remote agent can write without explicit user-initiated tool invocation. This is a structural security property, not a feature that can be "added" to cloud-default architectures.
| Metric | Value |
|---|---|
| Median search latency (100 memories) | 10.6 ms |
| Trust separation gap (benign vs malicious) | 0.90 |
| Sleeper agent trust degradation | 72% (0.902 → 0.249) |
| NDCG@5 improvement with adaptive ranker | +104% (0.441 → 0.900) |
| Peak write throughput | 220 writes/sec (2 agents) |
| Concurrent write errors | 0 (all scenarios) |
| Per-memory storage | 1.4 KB at scale |
| MRR (base FTS5) | 0.90 |
Two architecturally isolated databases: memory.db (WAL, single file, zero network) and learning.db (GDPR-friendly behavioral data with one-command erasure).
无形式化作者证明 — 仅实证
The trust update equation (Eq. 2) is described as "Bayesian" but is a deterministic additive update with a decay factor, not a posterior distribution update. The Beta-Binomial is used for priors in §5.6 but per-signal trust evolution is not standard Bayesian inference.
| Check | Status |
|---|---|
| Success-rate model | ✓ Three adversarial scenarios with 200 ops/agent |
| Latency budget | ✓ Median/P95/P99 at multiple scale points |
| Failure mode classification | ✓ Three attack vectors (direct, indirect, sleeper) |
| Ablation | ✓ Layer ablation (Table 3), but Layers 2–4 contribute zero MRR/NDCG improvement without adaptive ranker |
| Standard benchmark | N/E on LoCoMo (acknowledged limitation) |
| User evaluation | N=1 pilot (182 memories, 20 queries) |
Search Performance (Table 1): 10.6 ms at 100 memories, scaling roughly linearly to 124 ms at 1,000. Superlinear at 5,000 (1,172 ms) — motivates optional HNSW index.
Concurrent Access (Table 2): Zero "database is locked" errors. Peak throughput 220 writes/sec at 2 writers; drops to 25 ops/sec at 10 writers due to SQLite single-writer serialization.
Layer Ablation (Table 3): Core FTS5 achieves MRR 0.90. Layers 2–4 maintain but do not improve ranking. Adaptive ranker: NDCG@5 jumps from 0.441 to 0.900 (+104%) with only 20 ms latency overhead. Acknowledged circularity: relevance labels derived from system's own importance scores.
Trust Defense (Table 4): Trust gap 0.898 in single-poisoner scenario (benign 0.946 vs malicious 0.048). Sleeper attack: trust degrades from 0.902 to 0.249 (72.4%), falling below the 0.3 enforcement threshold.
Pilot User Study (§5.7): N=1 developer, 182 organic memories, human-judged MRR 0.70, NDCG@5 0.90. 38.6% rated "highly relevant."
| Step | Claim | Evidence | Depends on |
|---|---|---|---|
| 1 | Cloud memory architectures amplify OWASP ASI06 risk via four structural vulnerabilities | Documented attacks: Gemini exploit, calendar poisoning (73% success) | — |
| 2 | Local-first architecture eliminates cloud-mediated attack surfaces by design | Architectural analysis: no network transit, single-user isolation, full provenance | Step 1 |
| 3 | Bayesian trust scoring separates benign from malicious agents | Table 4: gap = 0.90, sleeper degradation 72% | Step 2 |
| 4 | Adaptive re-ranking personalizes retrieval without LLM inference | Table 3: +104% NDCG@5, 20 ms overhead | Step 2 |
| 5 | System achieves competitive retrieval quality without cloud dependency | Table 5: SLM outperforms Mem0 in local features; N/E on LoCoMo | Steps 3, 4 |
MIT license. GitHub: https://github.com/varun369/SuperLocalMemoryV2. 17+ tool integrations via MCP. Core dependencies: Python stdlib only (sqlite3, json, hashlib, re, datetime); Layers 3–4 require scikit-learn, python-igraph, leidenalg.
关键实现细节: