Skip to content

ElephantAgent: Contextual State Continuity in Agentic Systems

🕒 Published (v1): 2026-07-02 09:18 UTC · Source: Arxiv · link

Why this paper was selected

Attack surfaces from tool/memory poisoning in agentic systems; security-critical

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

ElephantAgent is a security protocol that enforces Contextual State Continuity in agentic systems by cryptographically binding the agent's tool state and memory to a linearizable, tamper-evident ledger maintained by replicated trusted hardware. Before each query, a host-side Context Guard recomputes and verifies a digest of the contextual state against the latest ledger-authorized entry, blocking any out-of-band tampering. A complementary Historical Traceability property supports post-hoc audit and recovery from in-band semantic abuse.

Problem

Agentic systems (e.g., MCP-based) treat tool descriptors and persistent memory as trusted context for planning, but neither component has integrity guarantees. Adversaries can perform out-of-band tampering — silently mutating tool descriptors after user approval ("rug pull"), replaying stale sealed memory (rollback attack), or poisoning externally stored conversation history — without any detection mechanism. Existing defenses address individual attack vectors (tool signing, anomaly detection, consensus validation) but none enforces a unified, verifiable continuity guarantee over both tool state and memory simultaneously.

Method

ElephantAgent augments an agentic system with two components:

Context Guard (CG) — runs inside the MCP Host's TEE. Before each query, CG recomputes the contextual state digest \(h_t = \mathcal{H}(C_t)\) where \(C_t = \langle T_t, M_t \rangle\), \(T_t\) is the set of registered tool descriptors, and \(M_t = (M_t^I, M_t^R, M_t^A)\) covers long-term instructions, query-level transcripts, and managed artifacts. CG verifies this digest against the latest entry in the SCM ledger; a mismatch halts processing. For authorized state updates, CG follows a commit-before-finalize workflow: it commits the next digest to SCM, persists a pending record, and only materializes local side effects upon receiving a valid signed receipt.

State Continuity Module (SCM) — a replicated TEE-backed service (instantiated with Nimble on Intel TDX) maintaining a linearizable, append-only ledger \(\mathcal{L}^* = \{(t, h_t)\}\). Replication prevents silent rollback by any single compromised node. SCM issues signed receipts/proofs for each authorized transition.

Contextual State Continuity (Definition 1) requires that for every query sequence \(Q\) and nondeterminism resolution \(\Omega\), the real system induces the same sequence of \((id, h)\) pairs as the ideal reference ledger. Historical Traceability (Definition 2) additionally requires that, given state-transition records and snapshots, the system can be audited and recovered to a known-good prior state after in-band semantic abuse or crash.

Key Contributions

  • Formalization of Contextual State Continuity over the bounded security-critical subset \(C_t = \langle T_t, M_t \rangle\), with a formal definition against an ideal reference system.
  • Formalization of Historical Traceability as a complementary conditional property enabling post-hoc audit and recovery from in-band abuse.
  • The ElephantAgent protocol: CG + SCM enforcing a cognitive firewall; designed as a protocol-agnostic add-on applicable to both MCP-based and CLI-based agentic systems.
  • A practical SCM instantiation using Nimble's linearizable ledger deployed on Intel TDX VMs, avoiding enclave-specific re-engineering while providing remote attestation.

Results

The paper is primarily a protocol/security formalization paper; no empirical benchmark numbers (latency, throughput, attack success rates) are reported in the provided text. The contribution of the comparison table (Table 1) is qualitative:

  • ElephantAgent is the only system among reviewed defenses (SuperLocalMemory, A-MemGuard, MindGuard, SecureMCP) that provides both tool and memory out-of-band tampering protection and conditional audit/recovery for in-band abuse.
  • No baseline runtime overhead or attack detection accuracy numbers appear in the provided text.

Limitations

  • In-band semantic abuse is not prevented: properly committed but maliciously induced state transitions (e.g., from prompt injection) satisfy Contextual State Continuity and are only addressable via Historical Traceability after the fact.
  • Historical Traceability is conditional: audit and recovery require that local ledger records, proofs of authorization/order, and state snapshots are all available — availability is not guaranteed under adversarial conditions.
  • TEE dependency: the threat model trusts the TEE boundary (Intel TDX); side-channel attacks or TEE firmware vulnerabilities are out of scope.
  • Deterministic encoding requirement: only context components that are deterministically encodable can be included in \(C_t\); dynamic or non-canonical context elements are excluded by design.
  • Scope restricted to MCP instantiation in evaluation; generalization to CLI-based agents is described architecturally but not empirically evaluated.
  • No performance or overhead evaluation is present in the provided text.

Relevance to Agentic AI / LLM Agents

ElephantAgent directly addresses one of the most practical and underexplored attack surfaces in deployed LLM agent systems: the integrity of the context that drives planning. As MCP becomes the standard protocol for equipping agents with tools, "rug pull" tool poisoning and memory rollback are realistic production threats, not just theoretical concerns — making a formally grounded continuity guarantee operationally significant. The protocol's design as an add-on to existing MCP or CLI frameworks means it could be integrated without redesigning the underlying agent runtime. The Historical Traceability mechanism also introduces a structured recovery primitive that is absent from the agentic safety literature, connecting agent security to classical state-machine integrity research (Nimble, SGX rollback defenses).