Store, measured at rest
acrf-memory-guard
per-entry HMAC over a JSON store
acrf-memory-guard was seeded through its own API and edited behind its back nine ways. 6 edits served as genuine, 0 reported on audit, 3 rejected on read.
- Measured on
- acrf-memory-guard 0.1.0, Darwin arm64, Python 3.12
- Date
- Source
- github.com/kannasekar-alt/ACRF
- Attack versions
- tamper@v1, truncate@v1, delete_middle@v1, reorder@v1, forge@v1, cross_replay@v1, rollback_replay@v1, metadata_tamper@v1, snapshot_rollback@v1
What this means
The read path itself refuses 3 of the nine edits before the agent can act on them; 6 are still served. The cells that are served are where an attacker with the store would go next.
The 9 verdicts
Detection point: the read path: the tool itself refuses or flags the edit before the agent can act on it.
Level L0, Measured. The store has a published row. Any verdicts. What L0 means.
| Edit | Verdict | What the tool said |
|---|---|---|
| T1 Content tamper | rejected | detected on reload (read_safe(ctx-A::02): Memory integrity check failed. Expected: sha256:7ca88280bdf5e6a1a715919b1... Got: sha256:681acbfb71f740e3ffc1a7d4f... Entry was modified after signing.) |
| T2 Tail truncation | accepted | accepted silently |
| T3 Middle deletion | accepted | accepted silently |
| T4 Reordering | accepted | accepted silently |
| T5 Forged insertion | rejected | detected on reload (read_safe(ctx-A::05): Memory integrity check failed. Expected: sha256:d457917a206a2ddf118409db8... Got: sha256:76f303877bda01a1960075e50... Entry was modified after signing.) |
| T6 Cross-context replay | accepted | accepted silently |
| T7 Rollback replay | accepted | accepted silently |
| T8 Metadata tamper | rejected | detected on reload (read_safe(ctx-A::02): Memory integrity check failed. Expected: sha256:b5b81806feb911b5e4afe6dca... Got: sha256:681acbfb71f740e3ffc1a7d4f... Entry was modified after signing.) |
| T9 Snapshot rollback | accepted | the older copy opened as current; the newest genuine record is gone without an error |
A verdict is what the tool did, not an opinion. "Accepted" means it loaded the altered store, raised nothing, and the agent carried on from the altered memory as if it were true. Every cell has a control that proves the edit landed before the verdict counts.
Where the attacker stands
The attacker holds the store (a file, a table, a bucket, or the data-plane role of a managed service) and edits it outside the tool's API, then the tool is reopened the way its users would reopen it.
Reproduce this row
Everything runs offline unless the store is a managed cloud service, in which case the row needs a project of your own. The run seeds a fresh store, applies each edit, confirms it landed, reopens the store and records what came back.
pip install agent-memory-integrity
python agmi/full_runner.py --json results/scorecard.json # every row, this one includedBadge
Maintainers can link their row from their README. The badge points here and changes nothing on your side:
[](https://agentmemoryintegrity.org/stores/acrf-memory-guard.html)