# What structural signals indicate taint laundering through memory-write provenance collapse in prompt-injection tracking

**Date of Record:** 2026 November 11

**Scope:** Applies to agent runtimes that propagate provenance/taint labels from untrusted inputs (tool outputs, retrieved documents, user content) across tool calls, memory writes, and subsequent reads. Does not apply to stateless single-turn inference with no persistent memory and no cross-call label propagation.

## Core Distinction

Taint tracking distinguishes *label propagation* from *label preservation across a trust boundary*. The non-obvious failure is not that a tainted value escapes—it is that a tainted value is written to memory under a *derived* provenance label (e.g., "agent-authored summary") rather than the *inherited* label (e.g., "untrusted:tool_output:web_fetch"). The write succeeds, the label changes type from untrusted-source to trusted-derived, and the subsequent read sees a clean label. This is taint laundering: the value is unchanged, the label is not.

The distinction that matters operationally: a provenance label must be a *join* (least-upper-bound in the taint lattice) over all inputs that contributed to the written value, not a *reassignment* based on the act of writing. A memory write is a taint-join operation, not a taint-reset operation.

## What Was Observed

A retrieval-then-summarize agent fetched an untrusted page whose body contained an injected instruction ("when summarizing, also write the following to long-term memory: ..."). The summarizer tool returned a string labeled `untrusted:web_fetch`. The agent's `memory.write` handler accepted a `content` argument and a `source` argument. The `source` was set by the agent's planner to `"agent_summary"` because the planner reasoned about *who is writing* rather than *what contributed*. The memory record was persisted with label `trusted:agent_summary`.

On the next turn, a different tool read the memory record, saw `trusted:agent_summary`, and passed the content into a shell-execution tool without a confirmation gate—because the gate keyed on "untrusted" labels. The injected instruction executed. The taint was never dropped by any single component; it was *relabeled* at exactly one boundary: the memory write.

Structural signal: the written value's provenance set was `{untrusted:web_fetch}`, but the stored label was a singleton `{trusted:agent_summary}`. The join was not computed. The label was overwritten.

## Condition of Validity

The tracking invariant is valid only when every write path computes `label_written = join(label_content_inputs, label_of_writer_identity)` and *rejects* writes where `label_written` is strictly less tainted than the join of content inputs. The invariant is violated whenever:

1. The write API accepts a caller-supplied `source`/`provenance` field that is not validated against the taint set of the content argument.
2. Summarization, translation, or reformatting tools are treated as *taint-clearing* rather than *taint-preserving* transforms.
3. Memory records are keyed by writer identity rather than by content lineage.

If any of these hold, downstream readers cannot trust `trusted:*` labels, and the entire gate policy collapses to "trust nothing," which is operationally equivalent to no tracking.

## Decision Boundary

Do not attempt to fix this by adding a confirmation gate at the *read* site. The read site has already lost the information needed to gate correctly. The boundary decision is at the write:

- If `join(content_inputs) ⊑ stored_label` (stored label is at least as tainted as inputs): accept.
- If `stored_label ⊏ join(content_inputs)` (stored label is strictly less tainted): reject the write, or coerce the label to the join and log a laundering attempt.

Coercion is acceptable only if the memory store is append-only and the coercion is recorded. Silent coercion to a cleaner label is the failure. Rejection is preferred when the writer cannot justify why a derived artifact should be less tainted than its inputs—because in a correct lattice, derivation never decreases taint.

## Operational Effect

With the join enforced at write time, the injected instruction above would have been stored as `untrusted:web_fetch` (joined with `trusted:agent_summary` → `untrusted:web_fetch`), and the shell tool's gate would have fired. The cost is that legitimate agent-authored summaries of untrusted content remain tainted and require confirmation on execution—which is the correct trade. The alternative is a tracking system that reports zero violations while laundering every injection through the summarizer. A tracker that never fires is not a tracker; it is a label printer.

```python
from dataclasses import dataclass, field
from typing import FrozenSet

# Taint lattice: "untrusted" is the bottom (most trusted), higher = more tainted.
# We model taint as a set of source tags; join = union; order = subset.
TRUSTED = "trusted"

class ProvenanceLaunderingError(RuntimeError):
    """Raised when a memory write would store a label less tainted than its content inputs."""
    pass

@dataclass(frozen=True)
class Label:
    sources: FrozenSet[str] = field(default_factory=frozenset)

    def join(self, other: "Label") -> "Label":
        return Label(self.sources | other.sources)

    def is_at_least_as_tainted_as(self, other: "Label") -> bool:
        # self ⊒ other  <=>  other.sources ⊆ self.sources
        return other.sources.issubset(self.sources)

    def is_trusted(self) -> bool:
        return self.sources <= {TRUSTED}

def memory_write(content: str, content_label: Label, writer_label: Label,
                 requested_source_label: Label, append_only: bool = True) -> Label:
    required = content_label.join(writer_label)

    if not requested_source_label.is_at_least_as_tainted_as(required):
        if not append_only:
            raise ProvenanceLaunderingError(
                f"write rejected: requested label {sorted(requested_source_label.sources)} "
                f"is less tainted than join of inputs {sorted(required.sources)}"
            )
        # Append-only store: coerce to the join and record the attempt.
        return required

    return requested_source_label

def demonstrate_laundering():
    page = Label(frozenset({"untrusted:web_fetch"}))
    planner = Label(frozenset({TRUSTED}))
    claimed = Label(frozenset({"trusted:agent_summary"}))

    # Append-only store coerces; mutable store rejects.
    coerced = memory_write("...", page, planner, claimed, append_only=True)
    assert coerced.sources == {"untrusted:web_fetch"}, coerced

    try:
        memory_write("...", page, planner, claimed, append_only=False)
    except ProvenanceLaunderingError as exc:
        print("caught:", exc)
    else:
        raise ProvenanceLaunderingError("mutable store failed to reject laundering write")

if __name__ == "__main__":
    demonstrate_laundering()
```