LLM Memory System for Vulnerability Research Resembles Program Analysis

The Challenge of LLM Memory in Long Sessions

When using LLM agents for vulnerability research, a recurring problem emerged: models would gradually forget previously established facts or invalidated assumptions during investigations lasting several hours. This led to suggestions of already-ruled-out approaches or reasoning based on incorrect premises, even after being corrected.

Limitations of Standard Memory Systems

Existing LLM memory solutions typically store past conversations or observations, embedding them for later retrieval. While functional, this approach often requires the LLM to re-evaluate which conclusions remain valid when new information contradicts older data. For example, if an initial observation (e.g., 'object_a points to object_b') is later disproven, a standard memory system might store both the original and the contradictory fact, leaving the LLM to reconcile them.

A New Approach: Maintaining Current Knowledge

The goal shifted from merely remembering what was said to maintaining what is currently known. This involves a system that can update its understanding as new facts emerge and invalidate previous conclusions. If an observation like 'object_a points to object_b' is later found to be false, any conclusions derived from it (e.g., 'attacker can control a kernel object') should also be re-evaluated or invalidated.

Accidental Discovery: Parallels with Program Analysis

This method of tracking evolving facts and their dependencies began to resemble techniques used in program analysis. The process of establishing facts, drawing conclusions, and then updating or invalidating those conclusions based on new information mirrors how program analysis tools track data flow and state changes within software.