AID-R-003.002: Trusted Conversational & Agent-State Re-establishment

Version 1.20261015 · Actionable sub-technique

Restore approved non-secret conversational or agent state into a new isolated namespace from the exact authority-selected pre-incident snapshot, excluding tainted, cross-tenant, post-cutoff, and credential-bearing state.

Pillars: data, infra, app

Lifecycle: improvement

Scope boundary

Owns restoration of an authority-selected clean conversational or agent-state snapshot into a new isolated namespace. It excludes tainted, cross-tenant, post-cutoff, secret-bearing, and credential-bearing state and does not perform incident-time teardown of the compromised durable state.

AID-E-005: AID-R-003.002 restores selected clean conversational or agent state; AID-E-005 deletes compromised durable application and agent state. The recovery snapshot must not reintroduce records removed by AID-E-005, and successful restoration does not prove that tainted state was torn down everywhere.

Implementation guidance

AID-R-003.002-G001: Restore trusted conversational or agent state from verified pre-incident snapshots.

AID-R-003.002-G001

Restore trusted conversational or agent state from verified pre-incident snapshots.

Purpose and boundary

Use this state-store recovery reference architecture to verify that every approved conversational or agent-state object was restored into a new isolated namespace from the exact authority-selected pre-incident snapshot, while tainted and post-cutoff state remained excluded. Session secrets and reusable credentials are never restored.

Authorize the immutable state manifest

The recovery authority signs the incident, tenant and agent/session scope, trusted cutoff, immutable snapshot locator/version and digest, encryption-key version, schema and canonicalization digests, expected object/event-key population, tainted-object manifest, target namespace, and state-adapter release. A mutable "current" snapshot, operator-supplied key list, or store-reported row count is not authoritative.

# File: recovery/contracts/trusted-state-restore.yaml
schema_version: aidefend.r003.trusted-state-restore.v1
required_bindings:
  - system_or_tenant
  - incident_id
  - recovery_release_id
  - trusted_cutoff_at
  - source_snapshot_immutable_locator
  - source_snapshot_digest
  - encryption_key_version
  - expected_state_key_manifest_digest
  - tainted_state_key_manifest_digest
  - state_schema_digest
  - adapter_release_digest
  - isolated_target_namespace
receipt_required_fields:
  - expected_state_count
  - observed_source_count
  - restored_state_count
  - excluded_tainted_count
  - post_cutoff_count
  - target_manifest_digest
  - failed_state_ids
  - result

Restore, isolate, and preserve evidence

Verify the authority signature, snapshot retention/readability, member digests, event-chain continuity, timestamps, and tenant/session ownership before restoring. Write only declared non-secret state into a newly created isolated namespace; reject missing, duplicate, extra, tainted, post-cutoff, cross-tenant, or schema-invalid objects. The owner signs the source and target manifests, per-object decisions, key versions, adapter logs, counts, and errors and retains them with raw readback in retention-locked evidence.

Independent replay

A read-only verifier independently fetches the immutable snapshot and target namespace, recomputes source and target manifests, replays the event chain to the trusted cutoff, confirms every tainted/post-cutoff, reusable-credential, session-secret, and secret-bearing object is absent, and proves that the old or tainted namespace cannot be used. When fresh-session proof applies, it consumes the separately bound AID-R-003.001 receipt without counting that receipt as state-restoration completion. Dependencies are the signed recovery decision, snapshot and key availability, complete state/taint populations, schema, adapter trust root, trusted time, isolated target, and evidence store. Snapshot verification is only input eligibility.

Action: keep the restored namespace isolated until its exact receipt is consumed by the separate capability and readiness controls.

Open-source tools

PostgreSQL
Valkey
LangGraph
Temporal

Commercial / hosted tools

Mem0 Platform (scoped memory export and import)
Temporal Cloud
LangSmith Deployments
Redis Enterprise

Threat mappings

MITRE ATLAS

AML.T0092 Manipulate User LLM Chat History (clean re-establishment restores trusted conversational context)
AML.T0080 AI Agent Context Poisoning (a new isolated namespace restores only authority-selected pre-incident state)
AML.T0080.000 AI Agent Context Poisoning: Memory (restoration excludes tainted memory objects and credential-bearing state)
AML.T0080.001 AI Agent Context Poisoning: Thread (clean re-establishment restores trusted thread context)
AML.T0121 AI Agent Environment Reconstruction (recovery restores only authority-selected pre-incident state, excluding post-cutoff reconstruction artifacts)
AML.T0130 AI Agent Response Biasing (restores only approved pre-incident conversational state while excluding poisoned recommendation memory)

MAESTRO

Agent Goal Manipulation (L7) (clean state restoration excludes incident-tainted goals and instructions from the new isolated namespace)

OWASP LLM Top 10 2026

LLM01:2026 Prompt Injection (clean-state restoration removes persistent injected context from the recovered namespace)
LLM05:2026 Data and Model Poisoning (clean-state restoration excludes tainted persistent conversational or agent state)

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

ASI06:2026 Memory & Context Poisoning

NIST Adversarial Machine Learning 2025

NISTAML.015 Indirect Prompt Injection (restoring an authority-selected pre-incident state excludes persistent injected context)

Cisco Integrated AI Security and Safety Framework

AISubtech-4.2.2 Session Boundary Violation (Restores clean tenant/session-bound state; original-state teardown is separate)
AISubtech-5.1.1 Long-term / Short-term Memory Injection
AITech-4.2 Context Boundary Attacks (Restores clean tenant/session-bound state; original-state teardown is separate)
AITech-5.1 Memory System Persistence
AITech-7.2 Memory System Corruption

Google Secure AI Framework 2.0 - Risks

RA: Rogue Actions (clean state prevents poisoned pre-incident context from rehydrating rogue behavior)

Databricks AI Security Framework 3.0

Agents - Core 13.1: Memory Poisoning
Agents - Core 13.6: Intent Breaking & Goal Manipulation (clean state restoration excludes incident-tainted goals and instructions)
Agents - Tools MCP Client 13.34: Session and State Management Failures (clean re-establishment addresses session/state management failures)