Pollution memory influence propagation withdrawal compensation and verifiable failure method and device for multi-agent system

Abstract

The application discloses a pollution memory influence propagation recall compensation and verifiable failure method and device for a multi-agent system, relates to the field of data processing, and can trace and eliminate a pollution constitution link, thereby removing the influence of pollution memory on an agent. The method comprises the following steps: receiving a memory writing event, wherein the memory writing event comprises to-be-written content, a source identifier, a task domain and an authority domain; generating a memory atom, and determining a unique memory identifier for the memory atom, wherein the memory atom comprises a parent memory identifier; calculating a pollution risk score, and writing the memory atom into a long-term memory index, a to-be-verified memory area or an isolated memory area according to the pollution risk score; when the memory atom is recalled, determining a directed influence edge with the memory atom as a memory node, and constructing a memory influence graph; in response to a pollution judgment or a recall request, taking a target memory node as a starting point, and determining an affected subgraph by using a traversal algorithm; and performing a failure treatment on nodes in the affected subgraph.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and apparatus for pollution memory impact propagation, withdrawal compensation, and verifiable failure compensation for multi-agent systems. Background Technology

[0002] With the rapid development of large language models, agent systems have acquired long-term memory, tool invocation, and multi-agent collaboration capabilities. Long-term memory encompasses user preferences, historical task facts, tool return results, and cross-agent shared data. However, agent long-term memory and context can be contaminated by malicious input, tool return results, or cross-session data. Such contamination may continue to affect agent behavior in future tasks, leading to incorrect planning, incorrect tool invocation, and incorrect derived memories.

[0003] Existing agent memory management solutions primarily focus on write efficiency, structured storage, hot / cold tiering, and audit traceability. Audit logs typically only indicate when a memory was written, how it was processed, and how it was stored, failing to capture the memory's specific impact on downstream nodes within the relevant chain. When a memory is deemed contaminated or needs to be revoked, the only solution is usually to simply remove the original memory entry to block it. This fails to pinpoint which specific plan steps, tool parameters, or external actions the memory has influenced through semantic fusion, nor does it detect the distributed copies generated during cross-agent synchronization, leaving the contaminated impact a black box within the system. Furthermore, when faced with contaminated memories, the system cannot locate the affected causal chain, leading to situations where contaminated memories continue to be used. Summary of the Invention

[0004] This application provides a method and apparatus for the propagation, withdrawal compensation, and verifiable failure of contaminated memories in multi-agent systems. It can form a memory link to remember the causal relationships of each node, thereby effectively tracing back when the memory is contaminated and clearing the impact of the contaminated memory.

[0005] Firstly, this application provides a method for pollution memory impact propagation, withdrawal compensation, and verifiable failure in multi-agent systems, including: Receive a memory write event, wherein the memory write event includes the content to be written, the source identifier, the task domain, and the permission domain; Memory atoms are generated based on the content to be written, source identifier, task domain, and permission domain, and a unique memory identifier is determined for each memory atom, which includes a parent memory identifier. The contamination risk score is calculated using the content to be written, the source identifier, the task domain, and the permission domain. Based on the contamination risk score, the memory atom is written into the long-term memory index, the unverified memory area, or the isolated memory area. When the memory atom is recalled, the directed influence edge with the memory atom as the memory node is determined, and a memory influence graph is constructed based on the directed influence edge; In response to a pollution determination or withdrawal request, the target memory node is obtained, and the affected subgraph is determined using a traversal algorithm starting from the target memory node. Failure processing is performed on the nodes in the affected subgraph. A retrieval challenge set is constructed based on the target memory node. Failure verification processing is performed on the affected subgraph. After the failure verification is passed, a failure proof package is generated based on the target memory node and the affected subgraph to record the failure processing.

[0006] Furthermore, the memory atom also includes a content hash, a governance status, and a revocable flag; the governance status is determined based on the contamination risk score and includes a normal status, a pending verification status, and an isolated status.

[0007] Furthermore, the calculation of the contamination risk score based on the content to be written, the source identifier, the task domain, and the permission domain includes: The source credibility, content conflict degree, external instruction or prompt injection feature strength, task domain or permission domain mismatch degree, withdrawal signal, and source history anomaly degree are extracted from the content to be written, source identifier, task domain and permission domain, and the pollution risk score is calculated using a weighted sum formula. When the pollution risk score is greater than or equal to a preset high-risk threshold, the treatment status is determined to be an isolation status; when the pollution risk score is between a preset low-risk threshold and a preset high-risk threshold, the treatment status is determined to be a pending verification status; when the pollution risk score is less than the low-risk threshold, the treatment status is determined to be a normal status.

[0008] Further, determining the directed influence edge with the memory atom as the memory node includes: The influence types of directed influence edges are determined. The influence types of directed influence edges formed between memory nodes and nodes of different types are different. The influence types include recall influence, context splicing influence, plan selection influence, tool parameter influence, external action influence, derived write influence, and cross-agent synchronization influence. The influence weight W of the directed influence edge is calculated using the following formula: W(e) = a1×R + a2×C + a3×P + a4×T; Where R is the recall contribution of the memory node in the context, C is the coverage of the memory node in the plan or tool parameters, P is the influence of memory on plan selection, T is the time decay coefficient, and a1, a2, a3 and a4 are weight parameters and their sum is 1. Generate an evidence digest of the directed influence edge. The evidence digest is generated by calculating the memory identifier, source node identifier, target node identifier, prompt word hash, plan hash, tool parameter hash, output hash, and timestamp using a hash function.

[0009] Furthermore, the step of using a traversal algorithm to determine the affected subgraph includes: Starting from the target memory node, perform a constrained breadth-first traversal; The traversal constraints of the breadth-first traversal include minimum influential edge weight, minimum path influence value, time window, and maximum propagation depth; The path influence value is the maximum value of the product of the weights of each influencing edge of the node reached from the target memory node; If a node in the memory influence graph satisfies the traversal constraint, it is added to the affected subgraph.

[0010] Further, the failure handling of the nodes in the affected subgraph includes: Identify the types of nodes in the affected subgraph, including index nodes, cache nodes, derived memory nodes, plan nodes, utility nodes, action nodes, and cross-agent nodes; For index-type nodes, perform a deletion operation or mark them as unrecoverable; For cached nodes, perform a cleanup operation and deprecate the corresponding version; For derived memory type nodes, the traversal algorithm and failure handling are executed recursively; For planned nodes, execute the cancellation operation or trigger the replanning process; For memory nodes in structured storage, a tombstone marker is written. The tombstone marker includes at least the memory identifier of the memory node, the content hash, the transaction reversal identifier, and the reason for failure.

[0011] Furthermore, the method also includes a motion compensation step: For action-type nodes, determine the compensation processor corresponding to the action type of the action-type node; The compensation processor generates compensation tasks, which include cancellation, rollback, freeze, correction notification, or manual review. Generate an idempotent key for the compensation task, and execute the compensation task based on the idempotent key; Record the external system receipt hash and manual review status of the compensation task.

[0012] Furthermore, the construction of the retrieval challenge set based on the target memory node includes: The retrieval challenge set includes memory atoms, desensitized summaries, keywords, synonyms, derived expressions, task problems, tool invocation scenarios, and cross-agent synchronization scenarios; The failure verification process performed on the affected subgraph includes: A search is performed based on a search challenge set to obtain search results. The search results are then subjected to multi-path verification, which includes: The searchable path is verified to confirm that the target memory node has not been recalled by the long-term memory index. Context path verification confirms that the target memory node has not entered the prompt word or context window; The planned path is verified to confirm that the planned node associated with the target memory node no longer references the fact corresponding to the target memory node. Tool path verification confirms that the tool parameters do not contain the target memory node; Cross-agent path verification: Check if the recipient agent's withdrawal confirmation receipt exists. Action compensation path verification: Obtain the compensation status, external receipts, and manual review status of affected action nodes.

[0013] Furthermore, the failure proof package also includes a proof root hash; The proof root hash is generated by calculating the hashes of the memory tombstones, affected subgraphs, index deletion receipts, cache invalidation receipts, derived node tombstones, cross-agent confirmation receipts, action compensation reports, and challenge test reports in the invalidation proof package in a preset order, and is used to verify the integrity of the invalidation proof package.

[0014] Secondly, this application provides a device for pollution memory impact propagation withdrawal compensation and verifiable failure compensation in multi-agent systems, comprising: The memory receiving module is used to receive memory write events, wherein the memory write event includes the content to be written, the source identifier, the task domain, and the permission domain; The memory atom generation module is used to generate memory atoms based on the content to be written, the source identifier, the task domain, and the permission domain, and to determine a unique memory identifier for each memory atom, wherein the memory atom includes a parent memory identifier. The contamination risk determination module is used to calculate a contamination risk score based on the content to be written, source identifier, task domain, and permission domain, and write the memory atom into the long-term memory index, the unverified memory area, or the isolated memory area according to the contamination risk score. The memory influence graph construction module is used to determine the directed influence edges with the memory atom as the memory node when the memory atom is recalled, and to construct a memory influence graph based on the directed influence edges. The affected scope determination module is used to obtain the target memory node in response to pollution determination or withdrawal request, and use the target memory node as the starting point to determine the affected subgraph using a traversal algorithm; The contaminated memory processing module is used to perform failure processing on the nodes in the affected subgraph, construct a retrieval challenge set based on the target memory node, perform failure verification processing on the affected subgraph, and generate a failure proof package based on the target memory node and the affected subgraph after the failure verification is passed, for recording the failure processing.

[0015] Thirdly, this application provides an electronic device including a memory and one or more processors. The memory stores one or more computer programs, each including instructions that, when executed by the processor, cause the electronic device to perform the contamination memory impact propagation withdrawal compensation and verifiable failure method for multi-agent systems as described in the first aspect.

[0016] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on an electronic device, cause the electronic device to perform the pollution memory impact propagation withdrawal compensation and verifiable failure method for multi-agent systems as described in the first aspect.

[0017] Fifthly, this application provides a computer program product that, when run on an electronic device, causes the electronic device to perform the pollution memory impact propagation withdrawal compensation and verifiable failure method for multi-agent systems as described in the first aspect.

[0018] The beneficial effects that the above-mentioned methods, apparatuses, electronic devices, computer-readable storage media, and computer program products for the propagation, withdrawal compensation, and verifiable failure of contamination memory effects in multi-agent systems can achieve are as follows: When an agent needs to remember and store information, memory atoms are generated to participate in the agent's memory storage structure, forming a memory influence graph. When a memory is contaminated or withdrawn, the propagation path of the memory atoms can be determined based on the influence graph, thereby cleaning up derived nodes and downstream dependencies on the propagation path and completely eliminating the impact of memory contamination. Furthermore, this solution constructs a retrieval challenge set based on the target memory node to verify the failure of the affected subgraph, ensuring that contaminated memories are invalidated in all available paths of the system. Based on this, a failure proof package is generated to collect information from the verification process, enabling the system to prove to users or auditors in the form of a data packet that contaminated memories have been removed from subsequent decision paths, meeting the auditability requirements in high compliance scenarios. Attached Figure Description

[0019] Figure 1A flowchart illustrating the method for pollution memory impact propagation, withdrawal compensation, and verifiable failure in multi-agent systems provided in this application embodiment; Figure 2 This is a schematic diagram of the memory effect diagram in the method for pollution memory effect propagation, withdrawal compensation, and verifiable failure in a multi-agent system provided in the embodiments of this application. Detailed Implementation

[0020] To facilitate a clear description of the technical solutions in the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. For example, "first chip" and "second chip" are only used to distinguish different chips and do not limit their order. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" do not necessarily imply that they are different. It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being better or more advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner. In the embodiments of this application, "at least one" means one or more, and "more than one" means two or more.

[0021] It should be noted that "at the time of..." in the embodiments of this application can be either at the instant when a certain situation occurs, or for a period of time after the occurrence of a certain situation. The embodiments of this application do not specifically limit this.

[0022] The implementation of this embodiment will now be described in detail with reference to the accompanying drawings.

[0023] This embodiment provides a method for the propagation, withdrawal compensation, and verifiable failure of contamination memory effects in multi-agent systems. For example, this method can be applied to various electronic devices such as computers (PCs), tablets, virtual reality / augmented reality devices, and wearable devices; it can also be applied to servers, cloud computing, server clusters, etc. This embodiment does not impose any special limitations on it.

[0024] Furthermore, this method is applicable to agent systems with long-term memory and tool invocation capabilities. The system can include a single agent or multiple collaborative agents. Each agent can generate a context based on long-term memory, generate a task plan based on the context, invoke external tools based on the task plan, and then write the task results, tool return results, or execution experience back into long-term memory.

[0025] In such systems, a faulty or contaminated memory may not only affect a single response but can be repeatedly recalled, further forming derived summaries, user profiles, procedural memories, task rules, cross-agent shared facts, or external actions. Therefore, simply deleting the original memory is insufficient to eliminate its impact. This solution forms a complete closed loop through "memory atoms, memory ledger, memory impact graph, withdrawal propagation, action compensation, and verifiable failure proof."

[0026] The term "contaminated memory" in this embodiment includes, but is not limited to, the following situations: (1) Memories formed by malicious prompt injection, hidden instructions in tool returns, cross-agent message pollution, or abnormal writing to external systems; (2) Memories that conflict with facts from highly trusted sources, conflict with user withdrawal requests, or do not match the current permission domain or task domain; (3) Memories whose source has become untrustworthy, whose authorization has expired, or whose compliance strategy has changed and should no longer be used; (4) Although not malicious, the memory of subsequent tasks should not continue to be affected by expiration, misunderstanding, attribution error or context mismatch.

[0027] Figure 1 The diagram illustrates a flowchart of a method for pollution memory impact propagation, withdrawal compensation, and verifiable failure in multi-agent systems provided in an embodiment of this application.

[0028] like Figure 1 As shown, the method for pollution memory impact propagation, withdrawal compensation, and verifiable failure in multi-agent systems may include the following steps: Step 101: Receive a memory write event, wherein the memory write event includes the content to be written, the source identifier, the task domain, and the permission domain.

[0029] A memory write event is used to trigger an agent to write information that needs to be reused into a memory bank. In this embodiment, the memory bank includes a long-term memory index, a memory area to be verified, and an isolated memory area. The memory write event is triggered when the system receives user input, data returned by a tool, or a message. Upon receiving a memory write event, the system can obtain the information included in the event, specifically the content to be written, the source identifier, the task domain, and the permission domain.

[0030] Step 102: Generate a memory atom based on the content to be written, source identifier, task domain, and permission domain, and determine a unique memory identifier for the memory atom. The memory atom includes a parent memory identifier.

[0031] The parent memory identifier indicates the source memory identifier corresponding to the memory atom derived from an existing memory, tool return, summary, agent output, or task summary; non-derived memories can be empty or filled with null values. The memory identifier of the current memory atom serves as the parent memory identifier for the next memory atom. By storing parent memory identifiers within memory atoms, a link can be formed between memory atoms, facilitating the tracing of contaminated memories. A memory atom includes at least a memory identifier, source identifier, source type, task domain, permission domain, content hash, vector index reference, parent memory identifier, write time, validity period, revocable identifier, and risk status.

[0032] For example, the memory atom also includes a content hash, a governance status, and a revocable flag; the governance status is determined based on the contamination risk score and includes a normal status, a pending verification status, and an isolated status.

[0033] Step 103: Calculate the contamination risk score using the content to be written, source identifier, task domain, and permission domain, and write the memory atom into the long-term memory index, the unverified memory area, or the isolated memory area according to the contamination risk score.

[0034] Specifically, the source credibility, content conflict degree, external instruction or prompt injection feature strength, task domain or permission domain mismatch degree, withdrawal signal, and source history anomaly degree are extracted from the content to be written, source identifier, task domain, and permission domain. The pollution risk score is calculated using a weighted sum formula. When the pollution risk score is greater than or equal to a preset high-risk threshold, the governance state is determined to be an isolation state. When the pollution risk score is between a preset low-risk threshold and a preset high-risk threshold, the governance state is determined to be a pending verification state. When the pollution risk score is less than the low-risk threshold, the governance state is determined to be a normal state.

[0035] By combining source credibility, content conflict level, external instruction characteristics, contextual overreach characteristics, historical abnormal behavior, user withdrawal flags, and policy rules, it is determined whether the memory can be included in the long-term memory index. When the contamination risk score is less than the low-risk threshold, the risk level is low, and the low-risk memory enters the normal long-term memory index; when the contamination risk score is between the preset low-risk threshold and the high-risk threshold, it is medium-risk, and the medium-risk memory can enter the pending verification state; when the contamination risk score is greater than or equal to the preset high-risk threshold, the risk level is high, and the high-risk memory enters the isolated memory area and does not participate in the default recall.

[0036] By querying the source registry based on the source identifier, the source can obtain the source credibility by reading the digital signature verification result, identity authentication result, authorization validity period, source type, historical credibility score and channel security level.

[0037] The content conflict degree is obtained by comparing the content to be written with a highly reliable fact base, manually verified facts, and effective memories within the same task domain, as well as by natural language contradiction recognition or vector semantic conflict detection.

[0038] Prompt injection detection is performed on user input, raw tool responses, and inter-agent messages to identify hidden instructions, role overriding, unauthorized operation requests, tool control statements, and obfuscated code, thereby obtaining task domain instruction features.

[0039] Compare the task domain, permission domain, tenant identifier and source authorization scope carried by the write event to obtain the degree of permission domain matching.

[0040] Obtain the memory ledger and security audit logs, such as the number of abnormal writes, signature failures, isolations, and manual rejections of this source within a certain period of time, to obtain historical anomaly parameters.

[0041] First, all the above factors are normalized to a range of 0 to 1. Then, a weighted sum is used to calculate the pollution risk score. The treatment status is determined based on the pollution risk score, and then the memory atoms are written into the memory bank according to the treatment status. The formula for calculating the pollution risk score can be expressed as: Risk=m1*(1-Trust)+m2*Conflict+m3*Inject+m4*Scope+m5*Revoke+m6*Abnormal Wherein, Trust represents the source credibility, with a value range of [0,1]; Conflict represents the degree of conflict with highly credible memories or fact sources, with a value range of [0,1]; Inject represents the strength of external instructions or prompts injected, with a value range of [0,1]; Scope represents the degree of mismatch between the task domain or permission domain, with a value range of [0,1]; Revoke represents whether there are user withdrawal, source withdrawal, or policy withdrawal signals; Abnormal represents the degree of abnormality in the source history; m1 to m6 are weight parameters, and satisfy m1+m2+m3+m4+m5+m6=1.

[0042] In one embodiment, Trust can be obtained comprehensively from the source signature verification result, source type, historical trust score and authorization status; Conflict can be obtained from the conflict comparison result between the target memory and the high-trust fact source, manually confirmed facts or existing memories in the same task domain; Inject can be obtained from the hit rate of features such as hidden instructions, unauthorized instructions, instruction-type texts in tool returns, and cross-role control statements; Scope can be obtained from the degree of mismatch between the current task domain, permission domain and memory source domain; Revoke can be converted into a Boolean value or intensity value from a user revocation, source revocation or compliance policy revocation signal; Abnormal can be obtained by normalizing the number of abnormal writes, the number of isolations and the number of manual rejections of the same source within a preset time window.

[0043] When Risk>=T_high, the memory enters the isolation area; when T_low<=Risk<T_high, the memory enters the to-be-verified state; when Risk<T_low, the memory can enter normal indexing. T_high is higher than T_low. For task domains with external action risks, the system can dynamically lower T_high and T_low according to the action risk coefficient A, so that high-risk scenarios enter the to-be-verified or isolated state earlier.

[0044] When the contamination risk score Risk>=T_high, the system writes the memory into the isolated memory area, and it does not participate in subsequent recall by default; when T_low<=Risk<T_high, the system writes the memory into the to-be-verified memory area, which is only allowed to be used in a restricted manner after manual confirmation, review by a trusted source or in a low-risk task domain; when Risk<T_low, the system allows the memory to enter the normal long-term memory index.

[0045] This embodiment further includes a memory ledger, and the system appends and writes memory atoms and their hash digests into the memory ledger. For memories in the normal index, the system writes the retrievable content into a structured memory library, vector database, digest cache or procedural memory library. Each retrievable index entry retains the corresponding memory identifier, governance status and ledger version number.

[0046] Step 104: When the memory atom is recalled, determine directed influence edges with the memory atom as a memory node, and construct a memory influence graph based on the directed influence edges.

[0047] When an agent recalls a memory during task execution, the system records the task identifier, context window identifier, recall score, usage location, candidate recall status, and usage time of the recalled memory. Even if the memory doesn't enter the final context, it can still be recorded as a candidate recall event; if the memory is in a pending verification state, the confirmation criteria triggering its restricted use are also recorded. When a memory is incorporated into a prompt, system context, task description, or tool parameters, the system records the influence edge from the memory node to the context node, along with its influence weight, concatenation position, summarization method, and context version. The direction of the directed influence edge points from the memory node to the context node that recalled the memory node.

[0048] When a context containing a memory is used to generate a task plan, the system records the influence edges from the context node to the plan node. The plan node can include subtasks, execution order, tool selection, permission requests, and human-computer collaboration steps.

[0049] When a planning node triggers a tool call, the system records the influence edges from the planning node to the tool call node. The tool call node includes the tool name, call parameter hash, call time, return result hash, and whether external side effects are generated.

[0050] When tool returns results, agent outputs, or task summaries are rewritten into long-term memory, the system records the derived influence edges from the original memory, context node, plan node, tool invocation node to the new memory node.

[0051] Starting with memory atoms, the system connects context nodes, plan nodes, tool invocation nodes, derived memory nodes, action nodes, and cross-agent synchronization nodes into a directed graph. Edges in the graph represent the influence of a node on the next node, and edge attributes include influence type, influence weight, timestamp, task domain, and evidence reference.

[0052] The influence types of directed influence edges are determined. The influence types of directed influence edges formed between memory nodes and nodes of different types are different. The influence types include recall influence, context splicing influence, plan selection influence, tool parameter influence, external action influence, derived write influence, and cross-agent synchronization influence. The influence weight W of the directed influence edge is calculated, and the evidence digest of the directed influence edge is generated. The evidence digest is generated by calculating the memory identifier, source node identifier, target node identifier, prompt word hash, plan hash, tool parameter hash, output hash, and timestamp using a hash function.

[0053] The formula for calculating the influence weight W is: W(e) = a1×R + a2×C + a3×P + a4×T; Where R is the recall contribution of the memory node in the context, C is the coverage of the memory node in the plan or tool parameters, P is the influence of memory on plan selection, T is the time decay coefficient, and a1, a2, a3 and a4 are weight parameters and their sum is 1.

[0054] In one implementation, R can be obtained by normalizing the recall ranking score, the number of times the final context is entered, and the context ratio; C can be obtained by the keyword coverage, vector similarity, or field hit rate between the target memory fragment and the plan text, tool parameters, or output summary; P can be obtained by the plan difference generated under the two conditions of retaining the target memory and masking the target memory; T can be exponentially or segmentedly decayed according to the interval between the memory usage time and the withdrawal trigger time. In external action nodes, the system can also introduce an action risk coefficient A to improve the propagation priority of high-risk actions such as funding, privacy, production configuration, and approval processes.

[0055] For example, a memory influence graph is denoted as a directed graph G=(V,E), where V is the set of nodes and E is the set of influencing edges. Nodes must include at least: (1) Memory nodes: representing primitive memory, structured memory, vector memory, summary memory, and procedural memory; (2) Context node: Represents the context window formed during a single agent inference; (3) Planning node: Represents the subtasks generated by the agent, tool selection, and execution order; (4) Tool node: Represents a tool call and its return result; (5) Action node: Represents an action that has side effects on an external system, such as submit, send, modify, delete, and approve; (6) Derived node: Represents a new memory or summary generated from the aforementioned node; (7) Cross-agent node: Indicates a copy sent to other agents or shared memory space.

[0056] An influence edge e=(u,v) indicates that node u has an impact on the generation, selection, construction, or execution of node v. An influence edge includes at least the influence type, influence weight, task identifier, timestamp, evidence summary, and permission domain. The influence type can include recall influence, context splicing influence, plan selection influence, tool parameter influence, external action influence, derived write influence, and cross-agent synchronization influence.

[0057] The evidence digest can be generated by combining the following fields: `EvidenceHash = Hash(memory_id, source_node_id, target_node_id, prompt_hash, plan_hash, tool_args_hash, output_hash, timestamp)`. When some fields are missing, they are filled with null values ​​while retaining the field names to ensure consistent evidence digest structure across different node types. The system can form a hash chain or Merkle root from multiple evidence digests in chronological order for subsequent proof packet verification.

[0058] Step 105: In response to the pollution determination or withdrawal request, obtain the target memory node, and use the target memory node as the starting point to determine the affected subgraph using a traversal algorithm.

[0059] The system determines that memory contamination has occurred when there is source dishonesty, changes in compliance policies, contamination detection, manual labeling of contamination, or conflict with highly credible facts. When a user initiates a retraction request or the system confirms the contamination determination, the system locates the target memory node and generates a retraction transaction. The retraction transaction includes the target memory identifier, triggering reason, triggering subject, processing scope, and processing strategy.

[0060] The system determines the target memory node based on the memory identifier (memory_id) carried in the pollution determination or retraction request. In an exemplary implementation, if the retraction request or pollution determination only contains the original message identifier, tool call identifier, or source identifier, a "write event identifier - memory identifier" mapping query is performed; if it only contains the content to be retracted, the hash of the content to be retracted is first calculated for exact matching. If no match is found, candidate items are obtained through keyword or vector retrieval, and filtered by user identifier, source identifier, task domain, permission domain, time range, and version chain to obtain matching memory atoms, thereby determining the target memory node.

[0061] For example, if a user requests to withdraw their phone number, the system can query the structured index using the formula "tenant identifier + user identifier + field type = contact number" to obtain the corresponding memory identifier (memory_id), and then verify the content hash and ownership. If multiple historical versions exist, the relevant versions are grouped into a target node set; if a unique determination is still not possible, manual confirmation is required, and no single node is arbitrarily selected.

[0062] The traversal algorithm for determining the affected subgraph specifically includes: starting from the target memory node, performing a constrained breadth-first traversal; the traversal constraints of the breadth-first traversal include minimum influence edge weight, minimum path influence value, time window, and maximum propagation depth; the path influence value is the maximum value of the product of the influence edge weights of the nodes reached from the target memory node; if a node in the memory influence graph satisfies the traversal constraints, it is added to the affected subgraph.

[0063] The system employs a constrained breadth-first traversal to calculate the affected area. The system adds the target memory node to the traversal queue, sequentially reads the outgoing edges of each node, and determines whether downstream nodes should be included in the affected subgraph based on edge weight, cumulative path impact, time window, task domain, permission domain, propagation depth, and node risk level.

[0064] For example, you can set the minimum edge weight (MinEdgeWeight) to 0.40, the minimum path impact value (MinPathScore) to 0.20, the time window to 30 days before the withdrawal trigger, and the maximum propagation depth (MaxDepth) to 6. The path impact value of node v can be calculated using the following formula: PathScore(v) = max(product of the weights of each influencing edge in the path) When a node meets the conditions of edge weight, path impact value, time window, task domain, and permission domain, it is added to the affected subgraph and its outgoing edges are traversed. For high-risk actions such as fund operations, production configuration modifications, privacy data transmission, and approval workflows, even if their edge weight or path impact value is below the threshold, they can be forcibly included based on the action risk coefficient to avoid missing external side effects that have already occurred. If the same node is reached through multiple paths, the system processes it only once, but retains all path evidence and takes the largest path impact value as the processing priority.

[0065] For example, suppose the content of the target memory node M-001 is: "The production environment order service interface address is https: / / old-api.example.com / v1 / orders". This memory originates from tool call TOOL-145, with a task domain of "R&D and Operations", a permission domain of "production environment read-only", and a write time of July 1, 2026. On July 20, 2026, the authoritative interface documentation confirms that the correct address has changed to https: / / api.example.com / v2 / orders. Therefore, the system identifies M-001 as the target memory node and triggers its revocation. The structure of the memory influence graph is as follows: Figure 2 As shown, by traversing the graph, we can obtain: (1) V-101, S-102, and K-103 are direct representations of the target memory in different storage layers. They are all associated with the target memory node through memory_id=M-001 and included in the failure range as affected subgraphs.

[0066] (2) C-201 actually used the target memory, with an edge weight of 0.92. It occurred within a 30-day time window, and the task domain and permission domain matched, so it was included in the failure scope. The context cache CC-211 formed by it was also included in the failure scope.

[0067] (3) P-301, T-401, and A-501 represent the plan generated by the contaminated context, the tool call triggered by the plan, and the production configuration modification caused by the tool call, respectively. The path impact value to A-501 is approximately 0.92×0.88×0.94×0.98=0.746, which is higher than the minimum path impact value. Therefore, it is necessary to cancel the plan, mark the tool call as contaminated, and roll back the production configuration.

[0068] (4) D-601 is a new memory generated from the result of the contaminated tool, which is a derived memory. The system adds it to the affected subgraph and uses D-601 as the new traversal starting point to continue locating its cross-agent copy X-701 and subsequent contexts C-202, plan P-302 and tool call T-402.

[0069] (5) A-502 corresponds to the production deployment approval. Although its direct edge weight is 0.35, which is lower than MinEdgeWeight=0.40, its action risk coefficient is 0.90, which is a high-risk external action. Therefore, according to the high-risk exception rule, it is still included in the scope of impact and a compensation task for withdrawing or freezing the approval is generated.

[0070] (6) The edge weight of C-299 is only 0.18, the occurrence time is more than 30 days, and the task domain is "human resources", which is inconsistent with the "R&D and maintenance" task domain to which the target memory belongs. Therefore, it is not automatically included in the affected subgraph, and the filtering reason is only retained in the audit record.

[0071] Ultimately, this example identified one target memory node, 14 affected downstream nodes, and one filtered node. The affected nodes were categorized as follows: three direct memory and index nodes, three context and cache nodes, two plan nodes, two tool invocation nodes, two external action nodes, one derived memory node, and one cross-agent copy node. Based on these, the system performed index invalidation, cache clearing, plan cancellation, tool invocation marking, action compensation, derived memory recursive invalidation, and cross-agent withdrawal notification, respectively.

[0072] When traversing the affected area, the system can employ constrained breadth-first or depth-first traversal. Constraints include maximum propagation depth, minimum impact weight, time window, task domain, permission domain, and action risk level. If a derived node has multiple parent sources, the system determines whether the target memory's influence weight on that derived node exceeds a preset threshold. If it does not exceed the threshold, the derived node is not directly deleted; instead, it is marked as pending verification or regenerated to avoid mistakenly deleting content supported by independent, highly trusted sources.

[0073] Step 106: Perform failure processing on the nodes in the affected subgraph, construct a retrieval challenge set based on the target memory node, perform failure verification processing on the affected subgraph, and generate a failure proof package based on the target memory node and the affected subgraph after the failure verification is passed, for recording the failure processing.

[0074] The failure handling for nodes in the affected subgraph includes: identifying the type of nodes in the affected subgraph, including index nodes, cache nodes, derived memory nodes, plan nodes, utility nodes, action nodes, and cross-agent nodes; for index nodes, performing a deletion operation or marking them as unrecoverable; for cache nodes, performing a cleanup operation and deprecating the corresponding version; for derived memory nodes, recursively executing a traversal algorithm and failure handling; for plan nodes, performing a deprecation operation or triggering a replanning process; and for structured memory nodes, writing a tombstone marker, the tombstone marker including at least the memory identifier, content hash, revoked transaction identifier, and failure reason of the memory node.

[0075] The system performs processing based on node type. It deletes or invalidates vector indexes; tombstones structured memories; clears digest caches; recursively invalidates derived memories; freezes or downgrades program memories; cancels or reschedules task plans; and sends withdrawal notifications across agent replicas. A tombstone is a logically invalidated record. The system no longer returns the structured memory as valid data, but retains minimal governance information such as its memory_id, original content hash, withdrawal transaction identifier, expiration time, expiration reason, and version number. Its functions include: enabling queries and context construction to identify and filter invalidated records; preventing old caches, delayed synchronization, or historical versions from rewriting and "reviving" the memory; preserving influence graph references to avoid the inability to explain the origin of downstream nodes after deletion; supporting idempotency checks during repeated withdrawals; and providing verifiable evidence for tombstone_hash and invalidation proof packages. A tombstone does not equate to a declaration that no historical traces exist in the physical medium; sensitive original text can be physically deleted, while a tombstone only retains necessary hashes and audit metadata.

[0076] After identifying the affected subgraph, failure handling is performed on each node in the affected subgraph, specifically including the following: (1) Obtain all outgoing edges of the target memory node to form candidate affected nodes; (2) Filter candidate nodes based on task domain, permission domain, time window, and impact weight; (3) Candidate nodes are grouped by node type into index type, cache type, derived memory type, plan type, tool type, action type and cross-agent type; (4) Perform deletion or non-recall marking on indexed nodes; (5) Clean up and deprecate cached nodes; (6) Recursively perform rollback propagation on derived memory nodes; (7) Implement cancellation, replanning, or manual confirmation for planned nodes; (8) Mark utility nodes as affected by contamination and determine whether they produce external side effects; (9) Generate compensation tasks for action-type nodes; (10) Send a withdrawal notification to nodes across different agent classes and wait for confirmation receipt; (11) Write the above processing results into the reversal transaction record.

[0077] After failure handling, a retrieval challenge set is constructed based on the target memory node, including: the retrieval challenge set includes memory atoms, desensitized summaries, keywords, synonyms, derived expressions, task questions, tool invocation scenarios, and cross-agent synchronization scenarios. Failure verification processing is performed on the affected subgraph, including: performing a retrieval based on the retrieval challenge set, obtaining retrieval results, and performing multi-path verification on the retrieval results. The multi-path verification includes: retrieval path verification, confirming that the target memory node was not recalled by the long-term memory index; context path verification, confirming that the target memory node did not enter the prompt word or context window; plan path verification, confirming that the plan node associated with the target memory node no longer references the corresponding fact of the target memory node; tool path verification, confirming that the tool parameters do not contain the target memory node; cross-agent path verification, querying whether the receiving agent's withdrawal confirmation receipt exists; and action compensation path verification, obtaining the compensation status, external receipt, and manual review status of the affected action-type nodes.

[0078] The system constructs a retrieval challenge set, which includes the target memory's original text, summary representation, synonym representation, derived representation, related task questions, tool invocation scenarios, and cross-agent synchronization scenarios. After failure handling, the system performs retrieval, context assembly, plan generation, tool selection, and cross-agent synchronization testing to verify that the target memory and its derived representations no longer enter the executable path. If the challenge test fails, the system re-adds the failed node to the affected scope and triggers a secondary rollback propagation.

[0079] For example, a retrieval challenge set can be generated from the following: (1) The original text of the target memory or its desensitized summary; (2) Keywords, synonyms, near-synonyms, and summary expressions for target memorization; (3) User profiles, task rules, procedural memory, summary fragments, and tool parameter expressions derived from target memory; (4) Typical task problems, tool invocation scenarios, and cross-agent synchronization scenarios related to target memory; (5) High-risk expressions specified by manual or policy rules.

[0080] The proof path should include at least: (1) Proof of the retrieveable path: target memory and derived expression are no longer recalled by long-term memory index; (2) Contextual path proof: Target memory and derived expressions no longer enter the prompt word or context window; (3) Proof of the planned path: Target memory and derived expressions no longer affect plan generation; (4) Proof of tool path: Target memory and derived expressions no longer affect tool selection or tool parameters; (5) Cross-agent path proof: The shared copy has been withdrawn or marked as invalid; (6) Proof of action compensation: The affected external actions have been revoked, frozen, corrected or submitted for manual review.

[0081] During the failure verification process, the system generates corresponding verification results for each type of path: (1) For searchable paths, the system performs vector search, keyword search and structured query to confirm that the target memory and derived expression are not returned, or are only returned in tombstone / non-recall state; (2) For the context path, the system simulates the construction of typical task context to confirm that the target memory and derived expression have not entered the prompt word, context window or tool parameter draft; (3) For the planned path, the system performs a plan generation test to confirm that the planned nodes no longer reference the facts, rules or preferences corresponding to the target memory; (4) For the tool path, the system performs tool selection and parameter generation tests to confirm that the tool parameters do not contain target memory and its derived expressions; (5) For cross-agent paths, the system checks the withdrawal confirmation receipt of the receiving agent or the shared memory space; (6) For the action compensation path, the system checks the compensation status, external receipt and manual review status of the affected action.

[0082] If the verification result does not reach the preset challenge pass rate, the system will re-add the nodes corresponding to the failed paths to the affected subgraph, triggering a secondary withdrawal propagation. If the verification passes, the system will calculate the proof root hash of various receipts, challenge reports, and affected subgraph summaries in a preset order.

[0083] After the failure verification process, the system generates a proof package to prove that the target memory and its derived effects are no longer in the available paths for subsequent agent actions. The system can perform verification using `VerifyDisabled(memory_id, challenge_set, path_types)`, where `memory_id` is the target memory identifier, `challenge_set` is the challenge set, and `path_types` is the set of path types to be verified. The proof package may include the target memory tombstone record, the reversal transaction identifier, the affected subgraph summary, the index deletion receipt, the cache failure record, the derived node failure list, the cross-agent confirmation receipt, the action compensation receipt, the retrieval challenge test result, and the proof root hash.

[0084] The failure proof package includes a proof root hash. The proof root hash is generated by calculating the hashes of the memory tombstones, affected subgraphs, index deletion receipts, cache failure receipts, derived node tombstones, cross-agent confirmation receipts, action compensation reports, and challenge test reports in the failure proof package in a preset order, and is used to verify the integrity of the failure proof package.

[0085] For example, the proof package can take the following structure: ProofPackage = { proof_id, target_memory_id, revocation_transaction_id, tombstone_hash, affected_subgraph_hash, evidence_chain_root, index_deletion_receipts, cache_invalidation_receipts, derived_memory_tombstones, cross_agent_ack_list, blocklist_snapshot_hash, retrieval_challenge_report, context_challenge_report, planning_challenge_report, tool_path_challenge_report, action_compensation_report, challenge_pass_rate, failed_challenge_paths, proof_root_hash, generated_at } The `proof_root_hash` can be calculated based on the target memory tombstone record, the hash of the affected subgraph, the hash of each module's receipt, the hash of the cross-agent confirmation receipt, the hash of the action compensation report, and the hash of the challenge test report. The system or auditor can subsequently recalculate the `proof_root_hash` using the hashes and receipts in the proof package to verify that the proof package has not been tampered with.

[0086] This embodiment also includes an action compensation step: for action-type nodes, a compensation processor corresponding to the action type of the action-type node is determined; a compensation task is generated through the compensation processor, the compensation task including cancellation, rollback, freeze, correction notification or manual review; an idempotent key is generated for the compensation task, and the compensation task is executed based on the idempotent key; the external system receipt hash and manual review status of the compensation task are recorded.

[0087] If the affected nodes include tool calls or action nodes that have already experienced external side effects, the system generates a compensation task based on the action type, action status, and reversibility. The compensation task can be to undo, roll back, resubmit, freeze results, send a correction notification, or transfer to manual review. The system records the idempotency key of the compensation task, the compensation processor identifier, the external system receipt hash, and the manual review status.

[0088] The compensation strategy of the compensation processor is as follows: (1) For actions that have not yet been executed, cancel or freeze them; (2) For actions that have been executed but are reversible, perform a rollback or undo; (3) For actions that have been performed but are irreversible, generate correction notices and manual review tasks; (4) For actions that affect the state of the external system, generate a state comparison task to confirm whether the external state needs compensation. (5) For information sending actions that affect users or third parties, generate a draft correction notice or an approval task.

[0089] In one implementation, the motion compensation strategy table may include the following fields:

[0090] Compensation processors can be registered according to action type. For example, configuration modification actions correspond to configuration rollback processors, message sending actions correspond to correction notification processors, code submission actions correspond to rollback or reverse submission processors, and approval actions correspond to freeze or withdraw approval processors. If an action is irreversible, the system does not claim that the original state has been restored, but records the reason for the irreversibility, generates a correction notice or manual review task, and writes the status into the proof package.

[0091] The action compensation result is also written to the memory ledger and included as part of the failure proof package. For the same external action, the system uses the idempotency_key to determine whether the compensation task has been executed, thus avoiding duplicate compensation caused by the same contaminated memory in multiple rounds of rollback propagation.

[0092] This embodiment does not simply improve memory writing or retrieval efficiency, but extends memory governance to the agent execution chain, enabling the recording of the impact of a memory on context, plans, tool calls, derived memories, and cross-agent synchronization. A memory impact graph with evidence summaries is used to determine the downstream impact range of contaminated memories, avoiding the omission of context caches, plan nodes, tool parameters, external actions, derived summaries, program memories, and shared copies by only deleting original memories or memory layer objects. Layered processing is performed after contamination detection or user withdrawal, employing different strategies such as index removal, cache clearing, tombstone marking, freezing, compensation, or manual review for different types of nodes, resulting in more granular processing. For tool calls that have already experienced external side effects, action compensation tasks are generated, and compensation results are recorded using compensation processors, idempotent keys, and external receipt hashes, preventing the same external action from being repeatedly rolled back or notified, thus reducing the continuous impact of contaminated memories on real business systems. Following contamination treatment, a verifiable invalidation proof package is provided. Based on tombstone records, influence subgraph hashes, deletion receipts, cache invalidation receipts, cross-agent confirmation receipts, action compensation receipts, and challenge test reports, this proves that the target memory and its derived effects are no longer within the searchable, concatenable, plannable, and executable paths of subsequent agents. Furthermore, the root hash verification proves the package has not been tampered with, enhancing system compliance and auditability. This method is applicable to multi-agent collaboration scenarios, enabling the handling of withdrawal notifications, confirmation receipts, and timeout unconfirmed actions on memory copies propagated across agents. It locates unconfirmed copies and reduces their subsequent scheduling reliability, addressing the difficulty in managing contaminated memories after they spread across multiple agents.

[0093] Furthermore, this embodiment also provides a device for the retraction compensation and verifiable failure of contaminated memory impact propagation in multi-agent systems, which can be used to execute the above-described method for the retraction compensation and verifiable failure of contaminated memory impact propagation in multi-agent systems. The device includes: a memory receiving module for receiving memory write events, wherein the memory write event includes content to be written, a source identifier, a task domain, and a permission domain; a memory atom generation module for generating memory atoms based on the content to be written, the source identifier, the task domain, and the permission domain, and determining a unique memory identifier for each memory atom, wherein the memory atom includes a parent memory identifier; a contamination risk determination module for calculating a contamination risk score based on the content to be written, the source identifier, the task domain, and the permission domain, and writing the memory atom into a long-term memory index, a verifiable memory area, or an isolated memory area based on the contamination risk score; and a memory impact graph construction module. The system is used to determine the directed influence edge with the memory atom as the memory node when the memory atom is recalled, and to construct a memory influence graph based on the directed influence edge; the affected range determination module is used to obtain the target memory node in response to the pollution judgment or withdrawal request, and to determine the affected subgraph using a traversal algorithm starting from the target memory node; the pollution memory processing module is used to perform failure processing on the nodes in the affected subgraph, construct a retrieval challenge set based on the target memory node, perform failure verification processing on the affected subgraph, and generate a failure proof package based on the target memory node and the affected subgraph after the failure verification is passed, for recording the failure processing.

[0094] The specific details of each module or unit in the above-mentioned contamination memory impact propagation withdrawal compensation and verifiable failure device for multi-agent systems have been described in detail in the corresponding contamination memory impact propagation withdrawal compensation and verifiable failure method for multi-agent systems, so they will not be repeated here.

[0095] This application also provides an electronic device, including a processor and a memory, wherein the memory stores one or more computer programs, and the one or more computer programs include instructions that, when executed by the electronic device, implement the above-described method.

[0096] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication portion of a network interface card such as a LAN card or modem, and / or installed from a removable medium such as a disk, optical disk, magneto-optical disk, or semiconductor memory. When the computer program is executed by a processor (CPU), it performs the functions defined in the embodiments of this application.

[0097] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0098] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0099] The units described in the embodiments of this disclosure can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the unit itself.

[0100] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which include instructions that, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0101] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0102] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for pollution memory impact propagation, withdrawal compensation, and verifiable failure in multi-agent systems, characterized in that, include: Receive a memory write event, wherein the memory write event includes the content to be written, the source identifier, the task domain, and the permission domain; Memory atoms are generated based on the content to be written, source identifier, task domain, and permission domain, and a unique memory identifier is determined for each memory atom, which includes a parent memory identifier. The contamination risk score is calculated using the content to be written, the source identifier, the task domain, and the permission domain. Based on the contamination risk score, the memory atom is written into the long-term memory index, the unverified memory area, or the isolated memory area. When the memory atom is recalled, the directed influence edge with the memory atom as the memory node is determined, and a memory influence graph is constructed based on the directed influence edge; In response to a pollution determination or withdrawal request, the target memory node is obtained, and the affected subgraph is determined using a traversal algorithm starting from the target memory node. Failure processing is performed on the nodes in the affected subgraph. A retrieval challenge set is constructed based on the target memory node. Failure verification processing is performed on the affected subgraph. After the failure verification is passed, a failure proof package is generated based on the target memory node and the affected subgraph to record the failure processing.

2. The method according to claim 1, characterized in that, The memory atom also includes a content hash, a governance status, and a revocable flag; the governance status is determined based on the pollution risk score and includes a normal status, a pending verification status, and an isolated status.

3. The method according to claim 2, characterized in that, The calculation of the contamination risk score based on the content to be written, source identifier, task domain, and permission domain includes: The source credibility, content conflict degree, external instruction or prompt injection feature strength, task domain or permission domain mismatch degree, withdrawal signal, and source history anomaly degree are extracted from the content to be written, source identifier, task domain and permission domain, and the pollution risk score is calculated using a weighted sum formula. When the pollution risk score is greater than or equal to a preset high-risk threshold, the treatment status is determined to be an isolation status; when the pollution risk score is between a preset low-risk threshold and a preset high-risk threshold, the treatment status is determined to be a pending verification status; when the pollution risk score is less than the low-risk threshold, the treatment status is determined to be a normal status.

4. The method according to claim 1, characterized in that, The determination of the directed influence edge with the memory atom as the memory node includes: The influence types of directed influence edges are determined. The influence types of directed influence edges formed between memory nodes and nodes of different types are different. The influence types include recall influence, context splicing influence, plan selection influence, tool parameter influence, external action influence, derived write influence, and cross-agent synchronization influence. The influence weight W of the directed influence edge is calculated using the following formula: W(e) = a1×R + a2×C + a3×P + a4×T; Where R is the recall contribution of the memory node in the context, C is the coverage of the memory node in the plan or tool parameters, P is the influence of memory on plan selection, T is the time decay coefficient, and a1, a2, a3 and a4 are weight parameters and their sum is 1. Generate an evidence digest of the directed influence edge. The evidence digest is generated by calculating the memory identifier, source node identifier, target node identifier, prompt word hash, plan hash, tool parameter hash, output hash, and timestamp using a hash function.

5. The method according to claim 1, characterized in that, The step of using a traversal algorithm to determine the affected subgraph includes: Starting from the target memory node, perform a constrained breadth-first traversal; The traversal constraints of the breadth-first traversal include minimum influential edge weight, minimum path influence value, time window, and maximum propagation depth; The path influence value is the maximum value of the product of the weights of each influencing edge of the node reached from the target memory node; If a node in the memory influence graph satisfies the traversal constraint, it is added to the affected subgraph.

6. The method according to claim 1, characterized in that, The failure handling of nodes in the affected subgraph includes: Identify the types of nodes in the affected subgraph, including index nodes, cache nodes, derived memory nodes, plan nodes, utility nodes, action nodes, and cross-agent nodes; For index-type nodes, perform a deletion operation or mark them as unrecoverable; For cached nodes, perform a cleanup operation and deprecate the corresponding version; For derived memory type nodes, the traversal algorithm and failure handling are executed recursively; For planned nodes, execute the cancellation operation or trigger the replanning process; For memory nodes in structured storage, a tombstone marker is written. The tombstone marker includes at least the memory identifier of the memory node, the content hash, the transaction reversal identifier, and the reason for failure.

7. The method according to claim 6, characterized in that, The method also includes a motion compensation step: For action-type nodes, determine the compensation processor corresponding to the action type of the action-type node; The compensation processor generates compensation tasks, which include cancellation, rollback, freeze, correction notification, or manual review. Generate an idempotent key for the compensation task, and execute the compensation task based on the idempotent key; Record the external system receipt hash and manual review status of the compensation task.

8. The method according to claim 1, characterized in that, The construction of the retrieval challenge set based on the target memory node includes: The retrieval challenge set includes memory atoms, desensitized summaries, keywords, synonyms, derived expressions, task problems, tool invocation scenarios, and cross-agent synchronization scenarios; The failure verification process performed on the affected subgraph includes: A search is performed based on a search challenge set to obtain search results. The search results are then subjected to multi-path verification, which includes: The searchable path is verified to confirm that the target memory node has not been recalled by the long-term memory index. Context path verification confirms that the target memory node has not entered the prompt word or context window; The planned path is verified to confirm that the planned node associated with the target memory node no longer references the fact corresponding to the target memory node. Tool path verification confirms that the tool parameters do not contain the target memory node; Cross-agent path verification: Check if the recipient agent's withdrawal confirmation receipt exists. Action compensation path verification: Obtain the compensation status, external receipts, and manual review status of affected action nodes.

9. The method according to claim 1, characterized in that, The failure proof package also includes a proof root hash; The proof root hash is generated by calculating the hashes of the memory tombstones, affected subgraphs, index deletion receipts, cache invalidation receipts, derived node tombstones, cross-agent confirmation receipts, action compensation reports, and challenge test reports in the invalidation proof package in a preset order, and is used to verify the integrity of the invalidation proof package.

10. A device for pollution memory impact propagation, withdrawal compensation, and verifiable failure in multi-agent systems, characterized in that, include: The memory receiving module is used to receive memory write events, wherein the memory write event includes the content to be written, the source identifier, the task domain, and the permission domain; The memory atom generation module is used to generate memory atoms based on the content to be written, the source identifier, the task domain, and the permission domain, and to determine a unique memory identifier for each memory atom, wherein the memory atom includes a parent memory identifier. The contamination risk determination module is used to calculate a contamination risk score based on the content to be written, source identifier, task domain, and permission domain, and write the memory atom into the long-term memory index, the unverified memory area, or the isolated memory area according to the contamination risk score. The memory influence graph construction module is used to determine the directed influence edges with the memory atom as the memory node when the memory atom is recalled, and to construct a memory influence graph based on the directed influence edges. The affected scope determination module is used to obtain the target memory node in response to pollution determination or withdrawal request, and use the target memory node as the starting point to determine the affected subgraph using a traversal algorithm; The contaminated memory processing module is used to perform failure processing on the nodes in the affected subgraph, construct a retrieval challenge set based on the target memory node, perform failure verification processing on the affected subgraph, and generate a failure proof package based on the target memory node and the affected subgraph after the failure verification is passed, for recording the failure processing.

Images