PoisonZero — Technical Whitepaper

Abstract

AI agents retain persistent memory — standing instructions, project notes, learned preferences — in plain files read back into the model context on every invocation. An attacker who writes a single malicious entry influences all subsequent agent behaviour without being present when the damage occurs. PoisonZero treats every change to a protected file as untrusted until proven safe and is fail-closed by construction: when evaluation is impossible or ambiguous, the change is reverted and the last known-clean state is restored. This document specifies the five-class threat model, the processing pipeline (a watcher with a trailing-edge final-state guarantee, a deterministic Unicode-normalised rule layer, layered defence-in-depth filters that can only tighten the model's verdict, the decision engine, and the enforcer), the cloud-assisted flow with its verifiable egress contract, the fully on-device flow with its minimal-privilege sandbox, the decoder-only detection model with fully customised weights, the at-rest integrity of the on-device model — held authenticated-encrypted and tamper-evident, so any alteration fails closed — and the license and integrity architecture.