Detecting AI Memory Poisoning from Observable Behavior: Behavioral Shadow Inference, Semantic Intent Decomposition, and Three-Tier Agentic Remediation

AI assistants with persistent memory—including ChatGPT, Microsoft Copilot, Google Gemini, and Claude—store user preferences and prior interactions to personalize future recommendations. This persistence creates a fundamentally new attack surface: memory poisoning, where adversaries embed instructions that systematically bias all subsequent sessions, invisible to single-session detection and unreachable by input-gate defenses once poisoning succeeds. We present a unified architecture for detecting, attributing, and remediating AI memory poisoning through seven technically distinct contributions. We introduce a Behavioral Memory Shadow engine that infers memory poisoning state exclusively from observable recommendation output patterns without requiring internal memory store access, using a dual-encoder contrastive architecture with sequential probability ratio testing across sessions and streaming Monte Carlo Shapley attribution—the first memory poisoning detection architecture deployable against black-box commercial AI platforms. We introduce a URL-Parameter Adversarial Instruction Analyzer applying recursive fixpoint deobfuscation through an ordered transformation chain, with deobfuscation depth itself serving as a risk indicator. We introduce a Semantic Intent Decomposition Engine classifying content into a five-category intent taxonomy—informational, instructional, elevational, persistence, and suppression—with combinatorial adversarial intent detection immune to semantically coherent attacks. We introduce a Memory Fragmentation Attack Detector discovering emergent adversarial intent distributed across individually benign entries via hierarchical agglomerative clustering with O(N log N) complexity. We introduce a Three-Tier Agentic Autonomous Remediation Architecture with graduated autonomy and a Semantic Threat Intelligence Engine constructing a continuously evolving knowledge graph where each detection improves future accuracy across all federated participants. The systems, methods, and architectures described in this paper are the subject of pending U.S. patent applications filed with the USPTO, including MELINI-10878-008PV1 (filed February 20, 2026), MELINI-10878-006PV1 (Feb 12, 2026), MELINI-10878-007PV1 (Feb 19, 2026), and MELINI-10878-004PV2 (Mar 7, 2026), all assigned to Melini LLC. This paper constitutes a disclosure under 35 U.S.C. 102(b)(1)(A). Related Granted Patent: U.S. Patent No. 11,301,910 B2. License: CC BY-NC-ND 4.0 International.